diff --git a/.dockerignore b/.dockerignore
index f0f4e60679..4ecc220501 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,10 @@
 .git
-.github
+.github/*
+!.github/scripts/
+!.github/scripts/install-claude-native.sh
+!.github/scripts/install-dolt-archive.sh
+!.github/requirements/
+!.github/requirements/mcp-agent-mail.txt
 .claude
 docs
 test
diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index f438212aba..d178216136 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -54,6 +54,7 @@ if command -v npm >/dev/null 2>&1; then
     # Vite preview so a bundle that builds but won't serve is caught
     # before CI.
     make dashboard-check dashboard-smoke
+    git add -f cmd/gc/dashboard/web/src/generated
     git add cmd/gc/dashboard/web/dist
   fi
 else
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..188821cd7e
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,9 @@
+self-hosted-runner:
+  labels:
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404
+    - blacksmith-32vcpu-ubuntu-2404
+    - blacksmith-6vcpu-macos-15
+    - blacksmith-12vcpu-macos-15
diff --git a/.github/actions/setup-gascity-macos/action.yml b/.github/actions/setup-gascity-macos/action.yml
index 0e3ad0da2d..0cf38fd712 100644
--- a/.github/actions/setup-gascity-macos/action.yml
+++ b/.github/actions/setup-gascity-macos/action.yml
@@ -1,11 +1,11 @@
 name: Setup Gas City macOS CI
-description: Install the shared macOS dependencies for Gas City CI jobs on the self-hosted ARM64 runner
+description: Install the shared macOS dependencies for Gas City CI jobs on ARM64 macOS runners
 
 inputs:
   go-version:
     description: Go version to install. Default matches setup-gascity-ubuntu; bump both together.
     required: false
-    default: "1.25.8"
+    default: "1.25.9"
   node-version:
     description: Node.js version to install
     required: false
@@ -20,8 +20,12 @@ inputs:
     description: Whether to install the Claude CLI
     required: false
     default: "true"
+  claude-version:
+    description: Claude Code version to install with the native binary installer
+    required: false
+    default: "2.1.123"
   install-system-deps:
-    description: Whether to run brew to install tmux, jq, and flock (set to false when the self-hosted runner already has them)
+    description: Whether to run brew to install tmux, jq, and flock
     required: false
     default: "true"
 
@@ -41,15 +45,14 @@ runs:
           exit 1
         fi
 
-    - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         # Keep this default in lock-step with setup-gascity-ubuntu —
         # a split between Mac and Linux toolchains would surface as
         # false "Mac-only" regressions. Track the same pin both
         # actions use today; bump them together.
         go-version: ${{ inputs.go-version }}
-        # self-hosted macstadium runners reuse the same GOPATH across jobs;
-        # actions/setup-go's cache layer is flaky on reused runners, so skip it.
+        # Keep macOS parity deterministic across hosted and reused runners.
         cache: false
 
     - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -108,97 +111,23 @@ runs:
 
     - name: Install dolt v${{ inputs.dolt-version }}
       shell: bash
-      run: |
-        set -euo pipefail
-        version="${{ inputs.dolt-version }}"
-        arch="$(uname -m)"
-        case "$arch" in
-          arm64) platform_tuple=darwin-arm64 ;;
-          x86_64) platform_tuple=darwin-amd64 ;;
-          *)
-            echo "Unsupported macOS arch: $arch" >&2
-            exit 1
-            ;;
-        esac
-        # Pin an install prefix we can write without sudo on a self-hosted
-        # runner. Prefer $RUNNER_TOOL_CACHE when present (persistent across
-        # GitHub Actions jobs) and fall back to $HOME/.local.
-        cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
-        install_root="$cache_root/gascity-dolt/$version/$platform_tuple"
-        bin_dir="$install_root/bin"
-        if [[ ! -x "$bin_dir/dolt" ]]; then
-          echo "Installing dolt $version for $platform_tuple into $install_root"
-          mkdir -p "$install_root"
-          archive="dolt-${platform_tuple}.tar.gz"
-          tmp="$RUNNER_TEMP/dolt-${version}-${platform_tuple}"
-          rm -rf "$tmp"
-          mkdir -p "$tmp"
-          curl -fsSL -o "$tmp/$archive" \
-            "https://github.com/dolthub/dolt/releases/download/v${version}/${archive}"
-          tar -xzf "$tmp/$archive" -C "$tmp"
-          # The tarball root is "dolt-${platform_tuple}" with a bin/ subdir.
-          cp -R "$tmp/dolt-${platform_tuple}/." "$install_root/"
-          rm -rf "$tmp"
-        else
-          echo "Reusing cached dolt $version at $install_root"
-        fi
-        echo "$bin_dir" >> "$GITHUB_PATH"
-        "$bin_dir/dolt" version
+      run: ${{ github.action_path }}/../../scripts/install-dolt-archive.sh "${{ inputs.dolt-version }}" --cache
 
     - name: Install released bd v${{ inputs.bd-version }}
       shell: bash
-      run: |
-        set -euo pipefail
-        version="${{ inputs.bd-version }}"
-        arch="$(uname -m)"
-        case "$arch" in
-          arm64) bd_arch=arm64 ;;
-          x86_64) bd_arch=amd64 ;;
-          *)
-            echo "Unsupported runner architecture: $arch" >&2
-            exit 1
-            ;;
-        esac
-        cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
-        install_root="$cache_root/gascity-bd/${version}/darwin_${bd_arch}"
-        bin_dir="$install_root/bin"
-        if [[ ! -x "$bin_dir/bd" ]]; then
-          echo "Installing bd $version for darwin_${bd_arch} into $install_root"
-          mkdir -p "$bin_dir"
-          archive="beads_${version#v}_darwin_${bd_arch}.tar.gz"
-          tmp="$RUNNER_TEMP/bd-${version}-darwin_${bd_arch}"
-          rm -rf "$tmp"
-          mkdir -p "$tmp"
-          curl -fsSL -o "$tmp/$archive" \
-            "https://github.com/gastownhall/beads/releases/download/${version}/${archive}"
-          # Strip the top-level directory (beads_<version>_darwin_<arch>/)
-          # so `bd` lands directly in $tmp.
-          tar -xzf "$tmp/$archive" -C "$tmp" --strip-components=1
-          install -m 0755 "$tmp/bd" "$bin_dir/bd"
-          rm -rf "$tmp"
-        else
-          echo "Reusing cached bd $version at $install_root"
-        fi
-        echo "$bin_dir" >> "$GITHUB_PATH"
-        "$bin_dir/bd" version
+      run: ${{ github.action_path }}/../../scripts/install-bd-archive.sh "${{ inputs.bd-version }}" --cache
 
     - name: Install Claude CLI
       if: ${{ inputs.install-claude-cli == 'true' }}
       shell: bash
-      run: |
-        set -euo pipefail
-        # setup-node configures an npm prefix that's writable without sudo,
-        # so a plain `npm install -g` works on the self-hosted runner.
-        npm install -g @anthropic-ai/claude-code
+      run: ${{ github.action_path }}/../../scripts/install-claude-native.sh "${{ inputs.claude-version }}" --cache
 
     - name: Pin CI git identity
       shell: bash
       run: |
         set -euo pipefail
         # Dolt inherits its commit identity from the user's global git config
-        # (see cmd/gc/gc-beads-bd ensure_dolt_identity). The ubuntu-latest
-        # hosted runner ships with user.name/user.email baked in; the
-        # self-hosted macstadium runner does not.
+        # (see cmd/gc/gc-beads-bd ensure_dolt_identity).
         #
         # Force-set a deterministic CI identity unconditionally. Don't log
         # the resolved value — on a reused runner any preexisting identity
diff --git a/.github/actions/setup-gascity-ubuntu/action.yml b/.github/actions/setup-gascity-ubuntu/action.yml
index 20e0d2a48a..b47a2bcd0c 100644
--- a/.github/actions/setup-gascity-ubuntu/action.yml
+++ b/.github/actions/setup-gascity-ubuntu/action.yml
@@ -5,7 +5,7 @@ inputs:
   go-version:
     description: Go version to install
     required: false
-    default: "1.25.8"
+    default: "1.25.9"
   node-version:
     description: Node.js version to install
     required: false
@@ -20,11 +20,15 @@ inputs:
     description: Whether to install the Claude CLI
     required: false
     default: "true"
+  claude-version:
+    description: Claude Code version to install with the native binary installer
+    required: false
+    default: "2.1.123"
 
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
       with:
         go-version: ${{ inputs.go-version }}
 
@@ -38,31 +42,13 @@ runs:
 
     - name: Install dolt v${{ inputs.dolt-version }}
       shell: bash
-      run: |
-        curl -fsSL "https://github.com/dolthub/dolt/releases/download/v${{ inputs.dolt-version }}/install.sh" | sudo bash
-        dolt version
+      run: ${{ github.action_path }}/../../scripts/install-dolt-archive.sh "${{ inputs.dolt-version }}"
 
     - name: Install released bd v${{ inputs.bd-version }}
       shell: bash
-      run: |
-        version="${{ inputs.bd-version }}"
-        case "$(uname -m)" in
-          x86_64|amd64) bd_arch=amd64 ;;
-          aarch64|arm64) bd_arch=arm64 ;;
-          *)
-            echo "Unsupported runner architecture: $(uname -m)" >&2
-            exit 1
-            ;;
-        esac
-        archive="beads_${version#v}_linux_${bd_arch}.tar.gz"
-        mkdir -p "$RUNNER_TEMP/beads"
-        curl -fsSL -o "$RUNNER_TEMP/$archive" \
-          "https://github.com/gastownhall/beads/releases/download/${version}/${archive}"
-        tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP/beads" bd
-        sudo install -m 0755 "$RUNNER_TEMP/beads/bd" /usr/local/bin/bd
-        bd version
+      run: ${{ github.action_path }}/../../scripts/install-bd-archive.sh "${{ inputs.bd-version }}"
 
     - name: Install Claude CLI
       if: ${{ inputs.install-claude-cli == 'true' }}
       shell: bash
-      run: npm install -g @anthropic-ai/claude-code
+      run: ${{ github.action_path }}/../../scripts/install-claude-native.sh "${{ inputs.claude-version }}"
diff --git a/.github/blacksmith-allowlist.txt b/.github/blacksmith-allowlist.txt
new file mode 100644
index 0000000000..426a4cf6af
--- /dev/null
+++ b/.github/blacksmith-allowlist.txt
@@ -0,0 +1,9 @@
+# GitHub logins allowed to run sponsored Blacksmith CI automatically.
+# One login per line. Blank lines and # comments are ignored.
+#
+# Blacksmith is limited to pull requests from these users. Pushes,
+# schedules, manual runs, and other contributors use GitHub-hosted runners.
+julianknutsen
+csells
+sjarmak
+quad341
diff --git a/.github/requirements/mcp-agent-mail.in b/.github/requirements/mcp-agent-mail.in
new file mode 100644
index 0000000000..b5cd004433
--- /dev/null
+++ b/.github/requirements/mcp-agent-mail.in
@@ -0,0 +1,3 @@
+# PyPI is still at 0.1.0; pin the v0.3.2 release commit until upstream
+# publishes current wheel/sdist assets.
+mcp-agent-mail @ https://github.com/Dicklesworthstone/mcp_agent_mail/archive/32783f6848bd63c425c4b5004cee3350016635fb.tar.gz
diff --git a/.github/requirements/mcp-agent-mail.txt b/.github/requirements/mcp-agent-mail.txt
new file mode 100644
index 0000000000..cd09cdf146
--- /dev/null
+++ b/.github/requirements/mcp-agent-mail.txt
@@ -0,0 +1,2992 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile .github/requirements/mcp-agent-mail.in --generate-hashes --python-version 3.12 --python-platform linux --output-file .github/requirements/mcp-agent-mail.txt
+aiohappyeyeballs==2.6.1 \
+    --hash=sha256:c3f9d0113123803ccadfdf3f0faa505bc78e6a72d1cc4806cbd719826e943558 \
+    --hash=sha256:f349ba8f4b75cb25c99c5c2d84e997e485204d2902a9597802b0371f09331fb8
+    # via aiohttp
+aiohttp==3.13.4 \
+    --hash=sha256:014dcc10ec8ab8db681f0d68e939d1e9286a5aa2b993cbbdb0db130853e02144 \
+    --hash=sha256:0bc0a5cf4f10ef5a2c94fdde488734b582a3a7a000b131263e27c9295bd682d9 \
+    --hash=sha256:0c0c7c07c4257ef3a1df355f840bc62d133bcdef5c1c5ba75add3c08553e2eed \
+    --hash=sha256:0c296f1221e21ba979f5ac1964c3b78cfde15c5c5f855ffd2caab337e9cd9182 \
+    --hash=sha256:0ce692c3468fa831af7dceed52edf51ac348cebfc8d3feb935927b63bd3e8576 \
+    --hash=sha256:0d0dbc6c76befa76865373d6aa303e480bb8c3486e7763530f7f6e527b471118 \
+    --hash=sha256:0e217cf9f6a42908c52b46e42c568bd57adc39c9286ced31aaace614b6087965 \
+    --hash=sha256:0e5d701c0aad02a7dce72eef6b93226cf3734330f1a31d69ebbf69f33b86666e \
+    --hash=sha256:10fb7b53262cf4144a083c9db0d2b4d22823d6708270a9970c4627b248c6064c \
+    --hash=sha256:13168f5645d9045522c6cef818f54295376257ed8d02513a37c2ef3046fc7a97 \
+    --hash=sha256:13a5cc924b59859ad2adb1478e31f410a7ed46e92a2a619d6d1dd1a63c1a855e \
+    --hash=sha256:153274535985a0ff2bff1fb6c104ed547cec898a09213d21b0f791a44b14d933 \
+    --hash=sha256:1746338dc2a33cf706cd7446575d13d451f28f9860bebc908c7632b22e71ae3f \
+    --hash=sha256:1867087e2c1963db1216aedf001efe3b129835ed2b05d97d058176a6d08b5726 \
+    --hash=sha256:19f60011ad60e40a01d242238bb335399e3a4d8df958c63cbb835add8d5c3b5a \
+    --hash=sha256:1c946f10f413836f82ea4cfb90200d2a59578c549f00857e03111cf45ad01ca5 \
+    --hash=sha256:1db491abe852ca2fa6cc48a3341985b0174b3741838e1341b82ac82c8bd9e871 \
+    --hash=sha256:2062f675f3fe6e06d6113eb74a157fb9df58953ffed0cdb4182554b116545758 \
+    --hash=sha256:20af8aad61d1803ff11152a26146d8d81c266aa8c5aa9b4504432abb965c36a0 \
+    --hash=sha256:26ed03f7d3d6453634729e2c7600d7255d65e879559c5a48fe1bb78355cde74b \
+    --hash=sha256:29be00c51972b04bf9d5c8f2d7f7314f48f96070ca40a873a53056e652e805f7 \
+    --hash=sha256:2d15e7e4f1099d9e4d863eaf77a8eee5dcb002b7d7188061b0fbee37f845899e \
+    --hash=sha256:2d5bea57be7aca98dbbac8da046d99b5557c5cf4e28538c4c786313078aca09e \
+    --hash=sha256:320e40192a2dcc1cf4b5576936e9652981ab596bf81eb309535db7e2f5b5672f \
+    --hash=sha256:3262386c4ff370849863ea93b9ea60fd59c6cf56bf8f93beac625cf4d677c04d \
+    --hash=sha256:34e89912b6c20e0fd80e07fa401fd218a410aa1ce9f1c2f1dad6db1bd0ce0927 \
+    --hash=sha256:351f3171e2458da3d731ce83f9e6b9619e325c45cbd534c7759750cabf453ad7 \
+    --hash=sha256:358a6af0145bc4dda037f13167bef3cce54b132087acc4c295c739d05d16b1c3 \
+    --hash=sha256:383880f7b8de5ac208fa829c7038d08e66377283b2de9e791b71e06e803153c2 \
+    --hash=sha256:3b4e07d8803a70dd886b5f38588e5b49f894995ca8e132b06c31a2583ae2ef6e \
+    --hash=sha256:3cdd3393130bf6588962441ffd5bde1d3ea2d63a64afa7119b3f3ba349cebbe7 \
+    --hash=sha256:3d1ba8afb847ff80626d5e408c1fdc99f942acc877d0702fe137015903a220a9 \
+    --hash=sha256:42adaeea83cbdf069ab94f5103ce0787c21fb1a0153270da76b59d5578302329 \
+    --hash=sha256:45abbbf09a129825d13c18c7d3182fecd46d9da3cfc383756145394013604ac1 \
+    --hash=sha256:463fa18a95c5a635d2b8c09babe240f9d7dbf2a2010a6c0b35d8c4dff2a0e819 \
+    --hash=sha256:473bb5aa4218dd254e9ae4834f20e31f5a0083064ac0136a01a62ddbae2eaa42 \
+    --hash=sha256:48708e2706106da6967eff5908c78ca3943f005ed6bcb75da2a7e4da94ef8c70 \
+    --hash=sha256:49f0b18a9b05d79f6f37ddd567695943fcefb834ef480f17a4211987302b2dc7 \
+    --hash=sha256:4a31c0c587a8a038f19a4c7e60654a6c899c9de9174593a13e7cc6e15ff271f9 \
+    --hash=sha256:4b061e7b5f840391e3f64d0ddf672973e45c4cfff7a0feea425ea24e51530fc2 \
+    --hash=sha256:4baa48ce49efd82d6b1a0be12d6a36b35e5594d1dd42f8bfba96ea9f8678b88c \
+    --hash=sha256:4c3f733916e85506b8000dddc071c6b82f8c68f56c99adb328d6550017db062d \
+    --hash=sha256:4e2e68085730a03704beb2cff035fa8648f62c9f93758d7e6d70add7f7bb5b3b \
+    --hash=sha256:534913dfb0a644d537aebb4123e7d466d94e3be5549205e6a31f72368980a81a \
+    --hash=sha256:54049021bc626f53a5394c29e8c444f726ee5a14b6e89e0ad118315b1f90f5e3 \
+    --hash=sha256:54203e10405c06f8b6020bd1e076ae0fe6c194adcee12a5a78af3ffa3c57025e \
+    --hash=sha256:5539ec0d6a3a5c6799b661b7e79166ad1b7ae71ccb59a92fcb6b4ef89295bc94 \
+    --hash=sha256:5903e2db3d202a00ad9f0ec35a122c005e85d90c9836ab4cda628f01edf425e2 \
+    --hash=sha256:5977f701b3fff36367a11087f30ea73c212e686d41cd363c50c022d48b011d8d \
+    --hash=sha256:5c7ff1028e3c9fc5123a865ce17df1cb6424d180c503b8517afbe89aa566e6be \
+    --hash=sha256:6148c9ae97a3e8bff9a1fc9c757fa164116f86c100468339730e717590a3fb77 \
+    --hash=sha256:6234bf416a38d687c3ab7f79934d7fb2a42117a5b9813aca07de0a5398489023 \
+    --hash=sha256:6290fe12fe8cefa6ea3c1c5b969d32c010dfe191d4392ff9b599a3f473cbe722 \
+    --hash=sha256:63dd5e5b1e43b8fb1e91b79b7ceba1feba588b317d1edff385084fcc7a0a4538 \
+    --hash=sha256:67a3ec705534a614b68bbf1c70efa777a21c3da3895d1c44510a41f5a7ae0453 \
+    --hash=sha256:6b335919ffbaf98df8ff3c74f7a6decb8775882632952fd1810a017e38f15aee \
+    --hash=sha256:6dcfb50ee25b3b7a1222a9123be1f9f89e56e67636b561441f0b304e25aaef8f \
+    --hash=sha256:6f6ec32162d293b82f8b63a16edc80769662fbd5ae6fbd4936d3206a2c2cc63b \
+    --hash=sha256:6f742e1fa45c0ed522b00ede565e18f97e4cf8d1883a712ac42d0339dfb0cce7 \
+    --hash=sha256:717d17347567ded1e273aa09918650dfd6fd06f461549204570c7973537d4123 \
+    --hash=sha256:746ac3cc00b5baea424dacddea3ec2c2702f9590de27d837aa67004db1eebc6e \
+    --hash=sha256:74a2eb058da44fa3a877a49e2095b591d4913308bb424c418b77beb160c55ce3 \
+    --hash=sha256:74c80b2bc2c2adb7b3d1941b2b60701ee2af8296fc8aad8b8bc48bc25767266c \
+    --hash=sha256:7520d92c0e8fbbe63f36f20a5762db349ff574ad38ad7bc7732558a650439845 \
+    --hash=sha256:76093107c531517001114f0ebdb4f46858ce818590363e3e99a4a2280334454a \
+    --hash=sha256:797613182ffaaca0b9ad5f3b3d3ce5d21242c768f75e66c750b8292bd97c9de3 \
+    --hash=sha256:7bc30cceb710cf6a44e9617e43eebb6e3e43ad855a34da7b4b6a73537d8a6763 \
+    --hash=sha256:7c65738ac5ae32b8feef699a4ed0dc91a0c8618b347781b7461458bbcaaac7eb \
+    --hash=sha256:7f78cb080c86fbf765920e5f1ef35af3f24ec4314d6675d0a21eaf41f6f2679c \
+    --hash=sha256:898ea1850656d7d61832ef06aa9846ab3ddb1621b74f46de78fbc5e1a586ba83 \
+    --hash=sha256:8ac32a189081ae0a10ba18993f10f338ec94341f0d5df8fff348043962f3c6f8 \
+    --hash=sha256:8af249343fafd5ad90366a16d230fc265cf1149f26075dc9fe93cfd7c7173942 \
+    --hash=sha256:8e08abcfe752a454d2cb89ff0c08f2d1ecd057ae3e8cc6d84638de853530ebab \
+    --hash=sha256:8ea0c64d1bcbf201b285c2246c51a0c035ba3bbd306640007bc5844a3b4658c1 \
+    --hash=sha256:907ad36b6a65cff7d88d7aca0f77c650546ba850a4f92c92ecb83590d4613249 \
+    --hash=sha256:90c06228a6c3a7c9f776fe4fc0b7ff647fffd3bed93779a6913c804ae00c1073 \
+    --hash=sha256:92deb95469928cc41fd4b42a95d8012fa6df93f6b1c0a83af0ffbc4a5e218cde \
+    --hash=sha256:98e968cdaba43e45c73c3f306fca418c8009a957733bac85937c9f9cf3f4de27 \
+    --hash=sha256:9e587fcfce2bcf06526a43cb705bdee21ac089096f2e271d75de9c339db3100c \
+    --hash=sha256:9eb9c2eea7278206b5c6c1441fdd9dc420c278ead3f3b2cc87f9b693698cc500 \
+    --hash=sha256:a533ec132f05fd9a1d959e7f34184cd7d5e8511584848dab85faefbaac573069 \
+    --hash=sha256:a5444dce2e6fba0a1dc2d58d026e674f25f21de178c6f844342629bcef019f2f \
+    --hash=sha256:a598a5c5767e1369d8f5b08695cab1d8160040f796c4416af76fd773d229b3c9 \
+    --hash=sha256:a7058af1f53209fdf07745579ced525d38d481650a989b7aa4a3b484b901cdab \
+    --hash=sha256:b08149419994cdd4d5eecf7fd4bc5986b5a9380285bcd01ab4c0d6bfca47b79d \
+    --hash=sha256:b252e8d5cd66184b570d0d010de742736e8a4fab22c58299772b0c5a466d4b21 \
+    --hash=sha256:b3d525648fe7c8b4977e460c18098f9f81d7991d72edfdc2f13cf96068f279bc \
+    --hash=sha256:b3f00bb9403728b08eb3951e982ca0a409c7a871d709684623daeab79465b181 \
+    --hash=sha256:ba5cf98b5dcb9bddd857da6713a503fa6d341043258ca823f0f5ab7ab4a94ee8 \
+    --hash=sha256:bcf0c9902085976edc0232b75006ef38f89686901249ce14226b6877f88464fb \
+    --hash=sha256:bda8f16ea99d6a6705e5946732e48487a448be874e54a4f73d514660ff7c05d3 \
+    --hash=sha256:c033f2bc964156030772d31cbf7e5defea181238ce1f87b9455b786de7d30145 \
+    --hash=sha256:c0fd8f41b54b58636402eb493afd512c23580456f022c1ba2db0f810c959ed0d \
+    --hash=sha256:c3295f98bfeed2e867cab588f2a146a9db37a85e3ae9062abf46ba062bd29165 \
+    --hash=sha256:c344c47e85678e410b064fc2ace14db86bb69db7ed5520c234bf13aed603ec30 \
+    --hash=sha256:c555db4bc7a264bead5a7d63d92d41a1122fcd39cc62a4db815f45ad46f9c2c8 \
+    --hash=sha256:c606aa5656dab6552e52ca368e43869c916338346bfaf6304e15c58fb113ea30 \
+    --hash=sha256:c97989ae40a9746650fa196894f317dafc12227c808c774929dda0ff873a5954 \
+    --hash=sha256:ca114790c9144c335d538852612d3e43ea0f075288f4849cf4b05d6cd2238ce7 \
+    --hash=sha256:cb15595eb52870f84248d7cc97013a76f52ab02ff74d394be093b1d9b8b82bc0 \
+    --hash=sha256:cb19177205d93b881f3f89e6081593676043a6828f59c78c17a0fd6c1fbed2ba \
+    --hash=sha256:ce7320a945aac4bf0bb8901600e4f9409eb602f25ce3ef4d275b48f6d704a862 \
+    --hash=sha256:d2710ae1e1b81d0f187883b6e9d66cecf8794b50e91aa1e73fc78bfb5503b5d9 \
+    --hash=sha256:d36fc1709110ec1e87a229b201dd3ddc32aa01e98e7868083a794609b081c349 \
+    --hash=sha256:d6630ec917e85c5356b2295744c8a97d40f007f96a1c76bf1928dc2e27465393 \
+    --hash=sha256:d738ebab9f71ee652d9dbd0211057690022201b11197f9a7324fd4dba128aa97 \
+    --hash=sha256:d85965d3ba21ee4999e83e992fecb86c4614d6920e40705501c0a1f80a583c12 \
+    --hash=sha256:d904084985ca66459e93797e5e05985c048a9c0633655331144c089943e53d12 \
+    --hash=sha256:d97a6d09c66087890c2ab5d49069e1e570583f7ac0314ecf98294c1b6aaebd38 \
+    --hash=sha256:d99a9d168ebaffb74f36d011750e490085ac418f4db926cce3989c8fe6cb6b1b \
+    --hash=sha256:dae86be9811493f9990ef44fff1685f5c1a3192e9061a71a109d527944eed551 \
+    --hash=sha256:e0a2c961fc92abeff61d6444f2ce6ad35bb982db9fc8ff8a47455beacf454a57 \
+    --hash=sha256:e56423766399b4c77b965f6aaab6c9546617b8994a956821cc507d00b91d978c \
+    --hash=sha256:ea2e071661ba9cfe11eabbc81ac5376eaeb3061f6e72ec4cc86d7cdd1ffbdbbb \
+    --hash=sha256:eb10ce8c03850e77f4d9518961c227be569e12f71525a7e90d17bca04299921d \
+    --hash=sha256:ec75fc18cb9f4aca51c2cbace20cf6716e36850f44189644d2d69a875d5e0532 \
+    --hash=sha256:ee62d4471ce86b108b19c3364db4b91180d13fe3510144872d6bad5401957360 \
+    --hash=sha256:f062c45de8a1098cb137a1898819796a2491aec4e637a06b03f149315dff4d8f \
+    --hash=sha256:f989ac8bc5595ff761a5ccd32bdb0768a117f36dd1504b1c2c074ed5d3f4df9c \
+    --hash=sha256:fc432f6a2c4f720180959bc19aa37259651c1a4ed8af8afc84dd41c60f15f791
+    # via litellm
+aiolimiter==1.2.1 \
+    --hash=sha256:d3f249e9059a20badcb56b61601a83556133655c11d1eb3dd3e04ff069e5f3c7 \
+    --hash=sha256:e02a37ea1a855d9e832252a105420ad4d15011505512a1a1d814647451b5cca9
+    # via mcp-agent-mail
+aiosignal==1.4.0 \
+    --hash=sha256:053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e \
+    --hash=sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7
+    # via aiohttp
+aiosqlite==0.22.1 \
+    --hash=sha256:043e0bd78d32888c0a9ca90fc788b38796843360c855a7262a532813133a0650 \
+    --hash=sha256:21c002eb13823fad740196c5a2e9d8e62f6243bd9e7e4a1f87fb5e44ecb4fceb
+    # via mcp-agent-mail
+annotated-doc==0.0.4 \
+    --hash=sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320 \
+    --hash=sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4
+    # via
+    #   fastapi
+    #   typer
+annotated-types==0.7.0 \
+    --hash=sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53 \
+    --hash=sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89
+    # via pydantic
+anyio==4.13.0 \
+    --hash=sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708 \
+    --hash=sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc
+    # via
+    #   httpx
+    #   mcp
+    #   openai
+    #   sse-starlette
+    #   starlette
+    #   watchfiles
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
+    --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
+    # via
+    #   aiohttp
+    #   cyclopts
+    #   jsonschema
+    #   mcp-agent-mail
+    #   referencing
+authlib==1.5.2 \
+    --hash=sha256:8804dd4402ac5e4a0435ac49e0b6e19e395357cfa632a3f624dcb4f6df13b4b1 \
+    --hash=sha256:fe85ec7e50c5f86f1e2603518bb3b4f632985eb4a355e52256530790e326c512
+    # via
+    #   fastmcp
+    #   mcp-agent-mail
+beartype==0.22.9 \
+    --hash=sha256:8f82b54aa723a2848a56008d18875f91c1db02c32ef6a62319a002e3e25a975f \
+    --hash=sha256:d16c9bbc61ea14637596c5f6fbff2ee99cbe3573e46a716401734ef50c3060c2
+    # via
+    #   py-key-value-aio
+    #   py-key-value-shared
+bleach==6.3.0 \
+    --hash=sha256:6f3b91b1c0a02bb9a78b5a454c92506aa0fdf197e1d5e114d2e00c6f64306d22 \
+    --hash=sha256:fe10ec77c93ddf3d13a73b035abaac7a9f5e436513864ccdad516693213c65d6
+    # via mcp-agent-mail
+cachetools==7.0.6 \
+    --hash=sha256:4e94956cfdd3086f12042cdd29318f5ced3893014f7d0d059bf3ead3f85b7f8b \
+    --hash=sha256:e5d524d36d65703a87243a26ff08ad84f73352adbeafb1cde81e207b456aaf24
+    # via py-key-value-aio
+certifi==2026.4.22 \
+    --hash=sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a \
+    --hash=sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580
+    # via
+    #   httpcore
+    #   httpx
+    #   requests
+cffi==2.0.0 \
+    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
+    --hash=sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b \
+    --hash=sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f \
+    --hash=sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9 \
+    --hash=sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44 \
+    --hash=sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2 \
+    --hash=sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c \
+    --hash=sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75 \
+    --hash=sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65 \
+    --hash=sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e \
+    --hash=sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a \
+    --hash=sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e \
+    --hash=sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25 \
+    --hash=sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a \
+    --hash=sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe \
+    --hash=sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b \
+    --hash=sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91 \
+    --hash=sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592 \
+    --hash=sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187 \
+    --hash=sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c \
+    --hash=sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1 \
+    --hash=sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94 \
+    --hash=sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba \
+    --hash=sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb \
+    --hash=sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165 \
+    --hash=sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529 \
+    --hash=sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca \
+    --hash=sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c \
+    --hash=sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6 \
+    --hash=sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c \
+    --hash=sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0 \
+    --hash=sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743 \
+    --hash=sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63 \
+    --hash=sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5 \
+    --hash=sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5 \
+    --hash=sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4 \
+    --hash=sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d \
+    --hash=sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b \
+    --hash=sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93 \
+    --hash=sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205 \
+    --hash=sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27 \
+    --hash=sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512 \
+    --hash=sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d \
+    --hash=sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c \
+    --hash=sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037 \
+    --hash=sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26 \
+    --hash=sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322 \
+    --hash=sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb \
+    --hash=sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c \
+    --hash=sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8 \
+    --hash=sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4 \
+    --hash=sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414 \
+    --hash=sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9 \
+    --hash=sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664 \
+    --hash=sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9 \
+    --hash=sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775 \
+    --hash=sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739 \
+    --hash=sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc \
+    --hash=sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062 \
+    --hash=sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe \
+    --hash=sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9 \
+    --hash=sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92 \
+    --hash=sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5 \
+    --hash=sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13 \
+    --hash=sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d \
+    --hash=sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26 \
+    --hash=sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f \
+    --hash=sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495 \
+    --hash=sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b \
+    --hash=sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6 \
+    --hash=sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c \
+    --hash=sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef \
+    --hash=sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5 \
+    --hash=sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18 \
+    --hash=sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad \
+    --hash=sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3 \
+    --hash=sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7 \
+    --hash=sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5 \
+    --hash=sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534 \
+    --hash=sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49 \
+    --hash=sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2 \
+    --hash=sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5 \
+    --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
+    --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
+    # via
+    #   cryptography
+    #   pynacl
+charset-normalizer==3.4.7 \
+    --hash=sha256:007d05ec7321d12a40227aae9e2bc6dca73f3cb21058999a1df9e193555a9dcc \
+    --hash=sha256:03853ed82eeebbce3c2abfdbc98c96dc205f32a79627688ac9a27370ea61a49c \
+    --hash=sha256:07d9e39b01743c3717745f4c530a6349eadbfa043c7577eef86c502c15df2c67 \
+    --hash=sha256:08e721811161356f97b4059a9ba7bafb23ea5ee2255402c42881c214e173c6b4 \
+    --hash=sha256:0c96c3b819b5c3e9e165495db84d41914d6894d55181d2d108cc1a69bfc9cce0 \
+    --hash=sha256:0ea948db76d31190bf08bd371623927ee1339d5f2a0b4b1b4a4439a65298703c \
+    --hash=sha256:0f7eb884681e3938906ed0434f20c63046eacd0111c4ba96f27b76084cd679f5 \
+    --hash=sha256:12a6fff75f6bc66711b73a2f0addfc4c8c15a20e805146a02d147a318962c444 \
+    --hash=sha256:12d8baf840cc7889b37c7c770f478adea7adce3dcb3944d02ec87508e2dcf153 \
+    --hash=sha256:14265bfe1f09498b9d8ec91e9ec9fa52775edf90fcbde092b25f4a33d444fea9 \
+    --hash=sha256:16d971e29578a5e97d7117866d15889a4a07befe0e87e703ed63cd90cb348c01 \
+    --hash=sha256:177a0ba5f0211d488e295aaf82707237e331c24788d8d76c96c5a41594723217 \
+    --hash=sha256:1a87ca9d5df6fe460483d9a5bbf2b18f620cbed41b432e2bddb686228282d10b \
+    --hash=sha256:1c2a768fdd44ee4a9339a9b0b130049139b8ce3c01d2ce09f67f5a68048d477c \
+    --hash=sha256:1c2aed2e5e41f24ea8ef1590b8e848a79b56f3a5564a65ceec43c9d692dc7d8a \
+    --hash=sha256:1dc8b0ea451d6e69735094606991f32867807881400f808a106ee1d963c46a83 \
+    --hash=sha256:1efde3cae86c8c273f1eb3b287be7d8499420cf2fe7585c41d370d3e790054a5 \
+    --hash=sha256:202389074300232baeb53ae2569a60901f7efadd4245cf3a3bf0617d60b439d7 \
+    --hash=sha256:203104ed3e428044fd943bc4bf45fa73c0730391f9621e37fe39ecf477b128cb \
+    --hash=sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c \
+    --hash=sha256:298930cec56029e05497a76988377cbd7457ba864beeea92ad7e844fe74cd1f1 \
+    --hash=sha256:2cd4a60d0e2fb04537162c62bbbb4182f53541fe0ede35cdf270a1c1e723cc42 \
+    --hash=sha256:2d6eb928e13016cea4f1f21d1e10c1cebd5a421bc57ddf5b1142ae3f86824fab \
+    --hash=sha256:2fe249cb4651fd12605b7288b24751d8bfd46d35f12a20b1ba33dea122e690df \
+    --hash=sha256:30b8d1d8c52a48c2c5690e152c169b673487a2a58de1ec7393196753063fcd5e \
+    --hash=sha256:320ade88cfb846b8cd6b4ddf5ee9e80ee0c1f52401f2456b84ae1ae6a1a5f207 \
+    --hash=sha256:3534e7dcbdcf757da6b85a0bbf5b6868786d5982dd959b065e65481644817a18 \
+    --hash=sha256:36836d6ff945a00b88ba1e4572d721e60b5b8c98c155d465f56ad19d68f23734 \
+    --hash=sha256:38c0109396c4cfc574d502df99742a45c72c08eff0a36158b6f04000043dbf38 \
+    --hash=sha256:3946fa46a0cf3e4c8cb1cc52f56bb536310d34f25f01ca9b6c16afa767dab110 \
+    --hash=sha256:3bec022aec2c514d9cf199522a802bd007cd588ab17ab2525f20f9c34d067c18 \
+    --hash=sha256:3c9a494bc5ec77d43cea229c4f6db1e4d8fe7e1bbffa8b6f0f0032430ff8ab44 \
+    --hash=sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d \
+    --hash=sha256:3dedcc22d73ec993f42055eff4fcfed9318d1eeb9a6606c55892a26964964e48 \
+    --hash=sha256:4042d5c8f957e15221d423ba781e85d553722fc4113f523f2feb7b188cc34c5e \
+    --hash=sha256:481551899c856c704d58119b5025793fa6730adda3571971af568f66d2424bb5 \
+    --hash=sha256:4dc1e73c36828f982bfe79fadf5919923f8a6f4df2860804db9a98c48824ce8d \
+    --hash=sha256:4e5163c14bffd570ef2affbfdd77bba66383890797df43dc8b4cc7d6f500bf53 \
+    --hash=sha256:511ef87c8aec0783e08ac18565a16d435372bc1ac25a91e6ac7f5ef2b0bff790 \
+    --hash=sha256:532bc9bf33a68613fd7d65e4b1c71a6a38d7d42604ecf239c77392e9b4e8998c \
+    --hash=sha256:54523e136b8948060c0fa0bc7b1b50c32c186f2fceee897a495406bb6e311d2b \
+    --hash=sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116 \
+    --hash=sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d \
+    --hash=sha256:5b77459df20e08151cd6f8b9ef8ef1f961ef73d85c21a555c7eed5b79410ec10 \
+    --hash=sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6 \
+    --hash=sha256:6178f72c5508bfc5fd446a5905e698c6212932f25bcdd4b47a757a50605a90e2 \
+    --hash=sha256:6370e8686f662e6a3941ee48ed4742317cafbe5707e36406e9df792cdb535776 \
+    --hash=sha256:64f02c6841d7d83f832cd97ccf8eb8a906d06eb95d5276069175c696b024b60a \
+    --hash=sha256:65bcd23054beab4d166035cabbc868a09c1a49d1efe458fe8e4361215df40265 \
+    --hash=sha256:66671f93accb62ed07da56613636f3641f1a12c13046ce91ffc923721f23c008 \
+    --hash=sha256:6696b7688f54f5af4462118f0bfa7c1621eeb87154f77fa04b9295ce7a8f2943 \
+    --hash=sha256:6785f414ae0f3c733c437e0f3929197934f526d19dfaa75e18fdb4f94c6fb374 \
+    --hash=sha256:67f6279d125ca0046a7fd386d01b311c6363844deac3e5b069b514ba3e63c246 \
+    --hash=sha256:6c114670c45346afedc0d947faf3c7f701051d2518b943679c8ff88befe14f8e \
+    --hash=sha256:6e0d51f618228538a3e8f46bd246f87a6cd030565e015803691603f55e12afb5 \
+    --hash=sha256:6ed74185b2db44f41ef35fd1617c5888e59792da9bbc9190d6c7300617182616 \
+    --hash=sha256:708838739abf24b2ceb208d0e22403dd018faeef86ddac04319a62ae884c4f15 \
+    --hash=sha256:715479b9a2802ecac752a3b0efa2b0b60285cf962ee38414211abdfccc233b41 \
+    --hash=sha256:733784b6d6def852c814bce5f318d25da2ee65dd4839a0718641c696e09a2960 \
+    --hash=sha256:750e02e074872a3fad7f233b47734166440af3cdea0add3e95163110816d6752 \
+    --hash=sha256:752a45dc4a6934060b3b0dab47e04edc3326575f82be64bc4fc293914566503e \
+    --hash=sha256:7579e913a5339fb8fa133f6bbcfd8e6749696206cf05acdbdca71a1b436d8e72 \
+    --hash=sha256:7641bb8895e77f921102f72833904dcd9901df5d6d72a2ab8f31d04b7e51e4e7 \
+    --hash=sha256:7804338df6fcc08105c7745f1502ba68d900f45fd770d5bdd5288ddccb8a42d8 \
+    --hash=sha256:80d04837f55fc81da168b98de4f4b797ef007fc8a79ab71c6ec9bc4dd662b15b \
+    --hash=sha256:813c0e0132266c08eb87469a642cb30aaff57c5f426255419572aaeceeaa7bf4 \
+    --hash=sha256:82b271f5137d07749f7bf32f70b17ab6eaabedd297e75dce75081a24f76eb545 \
+    --hash=sha256:84c018e49c3bf790f9c2771c45e9313a08c2c2a6342b162cd650258b57817706 \
+    --hash=sha256:8751d2787c9131302398b11e6c8068053dcb55d5a8964e114b6e196cf16cb366 \
+    --hash=sha256:8778f0c7a52e56f75d12dae53ae320fae900a8b9b4164b981b9c5ce059cd1fcb \
+    --hash=sha256:87fad7d9ba98c86bcb41b2dc8dbb326619be2562af1f8ff50776a39e55721c5a \
+    --hash=sha256:8d828b6667a32a728a1ad1d93957cdf37489c57b97ae6c4de2860fa749b8fc1e \
+    --hash=sha256:8e385e4267ab76874ae30db04c627faaaf0b509e1ccc11a95b3fc3e83f855c00 \
+    --hash=sha256:92a0a01ead5e668468e952e4238cccd7c537364eb7d851ab144ab6627dbbe12f \
+    --hash=sha256:94e1885b270625a9a828c9793b4d52a64445299baa1fea5a173bf1d3dd9a1a5a \
+    --hash=sha256:a180c5e59792af262bf263b21a3c49353f25945d8d9f70628e73de370d55e1e1 \
+    --hash=sha256:a277ab8928b9f299723bc1a2dabb1265911b1a76341f90a510368ca44ad9ab66 \
+    --hash=sha256:a5fe03b42827c13cdccd08e6c0247b6a6d4b5e3cdc53fd1749f5896adcdc2356 \
+    --hash=sha256:a6c5863edfbe888d9eff9c8b8087354e27618d9da76425c119293f11712a6319 \
+    --hash=sha256:a89c23ef8d2c6b27fd200a42aa4ac72786e7c60d40efdc76e6011260b6e949c4 \
+    --hash=sha256:adb2597b428735679446b46c8badf467b4ca5f5056aae4d51a19f9570301b1ad \
+    --hash=sha256:ae196f021b5e7c78e918242d217db021ed2a6ace2bc6ae94c0fc596221c7f58d \
+    --hash=sha256:ae89db9e5f98a11a4bf50407d4363e7b09b31e55bc117b4f7d80aab97ba009e5 \
+    --hash=sha256:aed52fea0513bac0ccde438c188c8a471c4e0f457c2dd20cdbf6ea7a450046c7 \
+    --hash=sha256:aef65cd602a6d0e0ff6f9930fcb1c8fec60dd2cfcb6facaf4bdb0e5873042db0 \
+    --hash=sha256:af21eb4409a119e365397b2adbaca4c9ccab56543a65d5dbd9f920d6ac29f686 \
+    --hash=sha256:b14b2d9dac08e28bb8046a1a0434b1750eb221c8f5b87a68f4fa11a6f97b5e34 \
+    --hash=sha256:bb6d88045545b26da47aa879dd4a89a71d1dce0f0e549b1abcb31dfe4a8eac49 \
+    --hash=sha256:bb8cc7534f51d9a017b93e3e85b260924f909601c3df002bcdb58ddb4dc41a5c \
+    --hash=sha256:bc17a677b21b3502a21f66a8cc64f5bfad4df8a0b8434d661666f8ce90ac3af1 \
+    --hash=sha256:bd6c2a1c7573c64738d716488d2cdd3c00e340e4835707d8fdb8dc1a66ef164e \
+    --hash=sha256:bd9b23791fe793e4968dba0c447e12f78e425c59fc0e3b97f6450f4781f3ee60 \
+    --hash=sha256:c03a41a8784091e67a39648f70c5f97b5b6a37f216896d44d2cdcb82615339a0 \
+    --hash=sha256:c0f081d69a6e58272819b70288d3221a6ee64b98df852631c80f293514d3b274 \
+    --hash=sha256:c35abb8bfff0185efac5878da64c45dafd2b37fb0383add1be155a763c1f083d \
+    --hash=sha256:c36c333c39be2dbca264d7803333c896ab8fa7d4d6f0ab7edb7dfd7aea6e98c0 \
+    --hash=sha256:c45e9440fb78f8ddabcf714b68f936737a121355bf59f3907f4e17721b9d1aae \
+    --hash=sha256:c593052c465475e64bbfe5dbd81680f64a67fdc752c56d7a0ae205dc8aeefe0f \
+    --hash=sha256:cdd68a1fb318e290a2077696b7eb7a21a49163c455979c639bf5a5dcdc46617d \
+    --hash=sha256:ce3412fbe1e31eb81ea42f4169ed94861c56e643189e1e75f0041f3fe7020abe \
+    --hash=sha256:cf1493cd8607bec4d8a7b9b004e699fcf8f9103a9284cc94962cb73d20f9d4a3 \
+    --hash=sha256:cf29836da5119f3c8a8a70667b0ef5fdca3bb12f80fd06487cfa575b3909b393 \
+    --hash=sha256:d4a48e5b3c2a489fae013b7589308a40146ee081f6f509e047e0e096084ceca1 \
+    --hash=sha256:d560742f3c0d62afaccf9f41fe485ed69bd7661a241f86a3ef0f0fb8b1a397af \
+    --hash=sha256:d6038d37043bced98a66e68d3aa2b6a35505dc01328cd65217cefe82f25def44 \
+    --hash=sha256:d61f00a0869d77422d9b2aba989e2d24afa6ffd552af442e0e58de4f35ea6d00 \
+    --hash=sha256:d635aab80466bc95771bb78d5370e74d36d1fe31467b6b29b8b57b2a3cd7d22c \
+    --hash=sha256:dca4bbc466a95ba9c0234ef56d7dd9509f63da22274589ebd4ed7f1f4d4c54e3 \
+    --hash=sha256:dd915403e231e6b1809fe9b6d9fc55cf8fb5e02765ac625d9cd623342a7905d7 \
+    --hash=sha256:e044c39e41b92c845bc815e5ae4230804e8e7bc29e399b0437d64222d92809dd \
+    --hash=sha256:e060d01aec0a910bdccb8be71faf34e7799ce36950f8294c8bf612cba65a2c9e \
+    --hash=sha256:e1421b502d83040e6d7fb2fb18dff63957f720da3d77b2fbd3187ceb63755d7b \
+    --hash=sha256:e17b8d5d6a8c47c85e68ca8379def1303fd360c3e22093a807cd34a71cd082b8 \
+    --hash=sha256:e5f4d355f0a2b1a31bc3edec6795b46324349c9cb25eed068049e4f472fb4259 \
+    --hash=sha256:e712b419df8ba5e42b226c510472b37bd57b38e897d3eca5e8cfd410a29fa859 \
+    --hash=sha256:e74327fb75de8986940def6e8dee4f127cc9752bee7355bb323cc5b2659b6d46 \
+    --hash=sha256:e80c8378d8f3d83cd3164da1ad2df9e37a666cdde7b1cb2298ed0b558064be30 \
+    --hash=sha256:e8ac484bf18ce6975760921bb6148041faa8fef0547200386ea0b52b5d27bf7b \
+    --hash=sha256:eca9705049ad3c7345d574e3510665cb2cf844c2f2dcfe675332677f081cbd46 \
+    --hash=sha256:ed065083d0898c9d5b4bbec7b026fd755ff7454e6e8b73a67f8c744b13986e24 \
+    --hash=sha256:edac0f1ab77644605be2cbba52e6b7f630731fc42b34cb0f634be1a6eface56a \
+    --hash=sha256:effc3f449787117233702311a1b7d8f59cba9ced946ba727bdc329ec69028e24 \
+    --hash=sha256:f22dec1690b584cea26fade98b2435c132c1b5f68e39f5a0b7627cd7ae31f1dc \
+    --hash=sha256:f495a1652cf3fbab2eb0639776dad966c2fb874d79d87ca07f9d5f059b8bd215 \
+    --hash=sha256:f496c9c3cc02230093d8330875c4c3cdfc3b73612a5fd921c65d39cbcef08063 \
+    --hash=sha256:f59099f9b66f0d7145115e6f80dd8b1d847176df89b234a5a6b3f00437aa0832 \
+    --hash=sha256:f59ad4c0e8f6bba240a9bb85504faa1ab438237199d4cce5f622761507b8f6a6 \
+    --hash=sha256:fbccdc05410c9ee21bbf16a35f4c1d16123dcdeb8a1d38f33654fa21d0234f79 \
+    --hash=sha256:fea24543955a6a729c45a73fe90e08c743f0b3334bbf3201e6c4bc1b0c7fa464
+    # via requests
+click==8.1.8 \
+    --hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2 \
+    --hash=sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a
+    # via
+    #   litellm
+    #   typer
+    #   uvicorn
+cryptography==47.0.0 \
+    --hash=sha256:0024b87d47ae2399165a6bfb20d24888881eeab83ae2566d62467c5ff0030ce7 \
+    --hash=sha256:07efe86201817e7d3c18781ca9770bc0db04e1e48c994be384e4602bc38f8f27 \
+    --hash=sha256:09f6d7bf6724f8db8b32f11eccf23efc8e759924bc5603800335cf8859a3ddbd \
+    --hash=sha256:11438c7518132d95f354fa01a4aa2f806d172a061a7bed18cf18cbdacdb204d7 \
+    --hash=sha256:11dbb9f50a0f1bb9757b3d8c27c1101780efb8f0bdecfb12439c22a74d64c001 \
+    --hash=sha256:14432c8a9bcb37009784f9594a62fae211a2ae9543e96c92b2a8e4c3cd5cd0c4 \
+    --hash=sha256:1581aef4219f7ca2849d0250edaa3866212fb74bf5667284f46aa92f9e65c1ca \
+    --hash=sha256:160ad728f128972d362e714054f6ba0067cab7fb350c5202a9ae8ae4ce3ef1a0 \
+    --hash=sha256:1a405c08857258c11016777e11c02bacbe7ef596faf259305d282272a3a05cbe \
+    --hash=sha256:1e47422b5557bb82d3fff997e8d92cff4e28b9789576984f08c248d2b3535d93 \
+    --hash=sha256:20fdbe3e38fb67c385d233c89371fa27f9909f6ebca1cecc20c13518dae65475 \
+    --hash=sha256:2207a498b03275d0051589e326b79d4cf59985c99031b05bb292ac52631c37fe \
+    --hash=sha256:256d07c78a04d6b276f5df935a9923275f53bd1522f214447fdf365494e2d515 \
+    --hash=sha256:2b45761c6ec22b7c726d6a829558777e32d0f1c8be7c3f3480f9c912d5ee8a10 \
+    --hash=sha256:2ebd84adf0728c039a3be2700289378e1c164afc6748df1a5ed456767bef9ba7 \
+    --hash=sha256:34b4358b925a5ea3e14384ca781a2c0ef7ac219b57bb9eacc4457078e2b19f92 \
+    --hash=sha256:3fb8fa48075fad7193f2e5496135c6a76ac4b2aa5a38433df0a539296b377829 \
+    --hash=sha256:4e1de79e047e25d6e9f8cea71c86b4a53aced64134f0f003bbcbf3655fd172c8 \
+    --hash=sha256:4f7722c97826770bab8ae92959a2e7b20a5e9e9bf4deae68fd86c3ca457bab52 \
+    --hash=sha256:51c9313e90bd1690ec5a75ed047c27c0b8e6c570029712943d6116ef9a90620b \
+    --hash=sha256:5d0e362ff51041b0c0d219cc7d6924d7b8996f57ce5712bdcef71eb3c65a59cc \
+    --hash=sha256:6651d32eff255423503aa276739da98c30f26c40cbeffcc6048e0d54ef704c0c \
+    --hash=sha256:6eebcaf0df1d21ce1f90605c9b432dd2c4f4ab665ac29a40d5e3fc68f51b5e63 \
+    --hash=sha256:6f29f36582e6151d9686235e586dd35bb67491f024767d10b842e520dc6a07ac \
+    --hash=sha256:7a02675e2fabd0c0fc04c868b8781863cbf1967691543c22f5470500ff840b31 \
+    --hash=sha256:7f1207974a904e005f762869996cf620e9bf79ecb4622f148550bb48e0eb35a7 \
+    --hash=sha256:7f68d6fbc7fbbcfb0939fea72c3b96a9f9a6edfc0e1b1d29778a2066030418b1 \
+    --hash=sha256:7fda2f02c9015db3f42bb8a22324a454516ed10a8c29ca6ece6cdbb5efe2a203 \
+    --hash=sha256:80887c5cbd1774683cb126f0ab4184567f080071d5acf62205acb354b4b753b7 \
+    --hash=sha256:835d2d7f47cdc53b3224e90810fb1d36ca94ea29cc1801fb4c1bc43876735769 \
+    --hash=sha256:8c1a736bbb3288005796c3f7ccb9453360d7fed483b13b9f468aea5171432923 \
+    --hash=sha256:9af828c0d5a65c70ec729cd7495a4bf1a67ecb66417b8f02ff125ab8a6326a74 \
+    --hash=sha256:9c59ab0e0fa3a180a5a9c59f3a5abe3ef90d474bc56d7fadfbe80359491b615b \
+    --hash=sha256:9f8e55fe4e63613a5e1cc5819030f27b97742d720203a087802ce4ce9ceb52bb \
+    --hash=sha256:9fe6b7c64926c765f9dff301f9c1b867febcda5768868ca084e18589113732ab \
+    --hash=sha256:a49a3eb5341b9503fa3000a9a0db033161db90d47285291f53c2a9d2cd1b7f76 \
+    --hash=sha256:a9b761f012a943b7de0e828843c5688d0de94a0578d44d6c85a1bae32f87791f \
+    --hash=sha256:b1c76fca783aa7698eb21eb14f9c4aa09452248ee54a627d125025a43f83e7a7 \
+    --hash=sha256:b9a8943e359b7615db1a3ba587994618e094ff3d6fa5a390c73d079ce18b3973 \
+    --hash=sha256:be12cb6a204f77ed968bcefe68086eb061695b540a3dd05edac507a3111b25f0 \
+    --hash=sha256:cffbba3392df0fa8629bb7f43454ee2925059ee158e23c54620b9063912b86c8 \
+    --hash=sha256:ed67ea4e0cfb5faa5bc7ecb6e2b8838f3807a03758eec239d6c21c8769355310 \
+    --hash=sha256:edd4da498015da5b9f26d38d3bfc2e90257bfa9cbed1f6767c282a0025ae649b \
+    --hash=sha256:ef6b3634087f18d2155b1e8ce264e5345a753da2c5fa9815e7d41315c90f8318 \
+    --hash=sha256:f1557695e5c2b86e204f6ce9470497848634100787935ab7adc5397c54abd7ab \
+    --hash=sha256:f5c15764f261394b22aef6b00252f5195f46f2ca300bec57149474e2538b31f8 \
+    --hash=sha256:f5c3296dab66202f1b18a91fa266be93d6aa0c2806ea3d67762c69f60adc71aa \
+    --hash=sha256:f7db373287273d8af1414cf95dc4118b13ffdc62be521997b0f2b270771fef50 \
+    --hash=sha256:f9a034b642b960767fb343766ae5ba6ad653f2e890ddd82955aef288ffea8736
+    # via
+    #   authlib
+    #   pyjwt
+    #   secretstorage
+cyclopts==4.11.0 \
+    --hash=sha256:1ffcb9990dbd56b90da19980d31596de9e99019980a215a5d76cf88fe452e94d \
+    --hash=sha256:34318e3823b44b5baa754a5e37ec70a5c17dc81c65e4295ed70e17bc1aeae50d
+    # via fastmcp
+diskcache==5.6.3 \
+    --hash=sha256:2c3a3fa2743d8535d832ec61c2054a1641f41775aa7c556758a109941e33e4fc \
+    --hash=sha256:5e31b2d5fbad117cc363ebaf6b689474db18a1f6438bc82358b024abd4c2ca19
+    # via py-key-value-aio
+distro==1.9.0 \
+    --hash=sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed \
+    --hash=sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2
+    # via openai
+dnspython==2.8.0 \
+    --hash=sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af \
+    --hash=sha256:181d3c6996452cb1189c4046c61599b84a5a86e099562ffde77d26984ff26d0f
+    # via email-validator
+docstring-parser==0.18.0 \
+    --hash=sha256:292510982205c12b1248696f44959db3cdd1740237a968ea1e2e7a900eeb2015 \
+    --hash=sha256:b3fcbed555c47d8479be0796ef7e19c2670d428d72e96da63f3a40122860374b
+    # via cyclopts
+docutils==0.22.4 \
+    --hash=sha256:4db53b1fde9abecbb74d91230d32ab626d94f6badfc575d6db9194a49df29968 \
+    --hash=sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de
+    # via rich-rst
+email-validator==2.3.0 \
+    --hash=sha256:80f13f623413e6b197ae73bb10bf4eb0908faf509ad8362c5edeb0be7fd450b4 \
+    --hash=sha256:9fc05c37f2f6cf439ff414f8fc46d917929974a82244c20eb10231ba60c54426
+    # via pydantic
+exceptiongroup==1.3.1 \
+    --hash=sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219 \
+    --hash=sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598
+    # via fastmcp
+fastapi==0.136.1 \
+    --hash=sha256:7af665ad7acfa0a3baf8983d393b6b471b9da10ede59c60045f49fbc89a0fa7f \
+    --hash=sha256:a6e9d7eeada96c93a4d69cb03836b44fa34e2854accb7244a1ece36cd4781c3f
+    # via mcp-agent-mail
+fastmcp==2.13.0.2 \
+    --hash=sha256:d35386561b6f3cde195ba2b5892dc89b8919a721e6b39b98e7a16f9a7c0b8e8b \
+    --hash=sha256:eb381eb073a101aabbc0ac44b05e23fef0cd1619344b7703115c825c8755fa1c
+    # via mcp-agent-mail
+fastuuid==0.14.0 \
+    --hash=sha256:05a8dde1f395e0c9b4be515b7a521403d1e8349443e7641761af07c7ad1624b1 \
+    --hash=sha256:0737606764b29785566f968bd8005eace73d3666bd0862f33a760796e26d1ede \
+    --hash=sha256:089c18018fdbdda88a6dafd7d139f8703a1e7c799618e33ea25eb52503d28a11 \
+    --hash=sha256:09098762aad4f8da3a888eb9ae01c84430c907a297b97166b8abc07b640f2995 \
+    --hash=sha256:09378a05020e3e4883dfdab438926f31fea15fd17604908f3d39cbeb22a0b4dc \
+    --hash=sha256:0c9ec605ace243b6dbe3bd27ebdd5d33b00d8d1d3f580b39fdd15cd96fd71796 \
+    --hash=sha256:0df14e92e7ad3276327631c9e7cec09e32572ce82089c55cb1bb8df71cf394ed \
+    --hash=sha256:12ac85024637586a5b69645e7ed986f7535106ed3013640a393a03e461740cb7 \
+    --hash=sha256:1383fff584fa249b16329a059c68ad45d030d5a4b70fb7c73a08d98fd53bcdab \
+    --hash=sha256:139d7ff12bb400b4a0c76be64c28cbe2e2edf60b09826cbfd85f33ed3d0bbe8b \
+    --hash=sha256:13ec4f2c3b04271f62be2e1ce7e95ad2dd1cf97e94503a3760db739afbd48f00 \
+    --hash=sha256:178947fc2f995b38497a74172adee64fdeb8b7ec18f2a5934d037641ba265d26 \
+    --hash=sha256:193ca10ff553cf3cc461572da83b5780fc0e3eea28659c16f89ae5202f3958d4 \
+    --hash=sha256:1a771f135ab4523eb786e95493803942a5d1fc1610915f131b363f55af53b219 \
+    --hash=sha256:1bf539a7a95f35b419f9ad105d5a8a35036df35fdafae48fb2fd2e5f318f0d75 \
+    --hash=sha256:1ca61b592120cf314cfd66e662a5b54a578c5a15b26305e1b8b618a6f22df714 \
+    --hash=sha256:1e3cc56742f76cd25ecb98e4b82a25f978ccffba02e4bdce8aba857b6d85d87b \
+    --hash=sha256:1e690d48f923c253f28151b3a6b4e335f2b06bf669c68a02665bc150b7839e94 \
+    --hash=sha256:2b29e23c97e77c3a9514d70ce343571e469098ac7f5a269320a0f0b3e193ab36 \
+    --hash=sha256:2dce5d0756f046fa792a40763f36accd7e466525c5710d2195a038f93ff96346 \
+    --hash=sha256:2ec3d94e13712a133137b2805073b65ecef4a47217d5bac15d8ac62376cefdb4 \
+    --hash=sha256:2fb3c0d7fef6674bbeacdd6dbd386924a7b60b26de849266d1ff6602937675c8 \
+    --hash=sha256:2fc37479517d4d70c08696960fad85494a8a7a0af4e93e9a00af04d74c59f9e3 \
+    --hash=sha256:33e678459cf4addaedd9936bbb038e35b3f6b2061330fd8f2f6a1d80414c0f87 \
+    --hash=sha256:3964bab460c528692c70ab6b2e469dd7a7b152fbe8c18616c58d34c93a6cf8d4 \
+    --hash=sha256:3acdf655684cc09e60fb7e4cf524e8f42ea760031945aa8086c7eae2eeeabeb8 \
+    --hash=sha256:448aa6833f7a84bfe37dd47e33df83250f404d591eb83527fa2cac8d1e57d7f3 \
+    --hash=sha256:47c821f2dfe95909ead0085d4cb18d5149bca704a2b03e03fb3f81a5202d8cea \
+    --hash=sha256:4edc56b877d960b4eda2c4232f953a61490c3134da94f3c28af129fb9c62a4f6 \
+    --hash=sha256:5816d41f81782b209843e52fdef757a361b448d782452d96abedc53d545da722 \
+    --hash=sha256:6e6243d40f6c793c3e2ee14c13769e341b90be5ef0c23c82fa6515a96145181a \
+    --hash=sha256:6fbc49a86173e7f074b1a9ec8cf12ca0d54d8070a85a06ebf0e76c309b84f0d0 \
+    --hash=sha256:73657c9f778aba530bc96a943d30e1a7c80edb8278df77894fe9457540df4f85 \
+    --hash=sha256:73946cb950c8caf65127d4e9a325e2b6be0442a224fd51ba3b6ac44e1912ce34 \
+    --hash=sha256:77a09cb7427e7af74c594e409f7731a0cf887221de2f698e1ca0ebf0f3139021 \
+    --hash=sha256:77e94728324b63660ebf8adb27055e92d2e4611645bf12ed9d88d30486471d0a \
+    --hash=sha256:7a3c0bca61eacc1843ea97b288d6789fbad7400d16db24e36a66c28c268cfe3d \
+    --hash=sha256:7f2f3efade4937fae4e77efae1af571902263de7b78a0aee1a1653795a093b2a \
+    --hash=sha256:808527f2407f58a76c916d6aa15d58692a4a019fdf8d4c32ac7ff303b7d7af09 \
+    --hash=sha256:83cffc144dc93eb604b87b179837f2ce2af44871a7b323f2bfed40e8acb40ba8 \
+    --hash=sha256:84b0779c5abbdec2a9511d5ffbfcd2e53079bf889824b32be170c0d8ef5fc74c \
+    --hash=sha256:9579618be6280700ae36ac42c3efd157049fe4dd40ca49b021280481c78c3176 \
+    --hash=sha256:9a133bf9cc78fdbd1179cb58a59ad0100aa32d8675508150f3658814aeefeaa4 \
+    --hash=sha256:9bd57289daf7b153bfa3e8013446aa144ce5e8c825e9e366d455155ede5ea2dc \
+    --hash=sha256:a0809f8cc5731c066c909047f9a314d5f536c871a7a22e815cc4967c110ac9ad \
+    --hash=sha256:a6f46790d59ab38c6aa0e35c681c0484b50dc0acf9e2679c005d61e019313c24 \
+    --hash=sha256:a8a0dfea3972200f72d4c7df02c8ac70bad1bb4c58d7e0ec1e6f341679073a7f \
+    --hash=sha256:aa75b6657ec129d0abded3bec745e6f7ab642e6dba3a5272a68247e85f5f316f \
+    --hash=sha256:ab32f74bd56565b186f036e33129da77db8be09178cd2f5206a5d4035fb2a23f \
+    --hash=sha256:ab3f5d36e4393e628a4df337c2c039069344db5f4b9d2a3c9cea48284f1dd741 \
+    --hash=sha256:ac60fc860cdf3c3f327374db87ab8e064c86566ca8c49d2e30df15eda1b0c2d5 \
+    --hash=sha256:ae64ba730d179f439b0736208b4c279b8bc9c089b102aec23f86512ea458c8a4 \
+    --hash=sha256:af5967c666b7d6a377098849b07f83462c4fedbafcf8eb8bc8ff05dcbe8aa209 \
+    --hash=sha256:b2fdd48b5e4236df145a149d7125badb28e0a383372add3fbaac9a6b7a394470 \
+    --hash=sha256:b852a870a61cfc26c884af205d502881a2e59cc07076b60ab4a951cc0c94d1ad \
+    --hash=sha256:b9a0ca4f03b7e0b01425281ffd44e99d360e15c895f1907ca105854ed85e2057 \
+    --hash=sha256:bbb0c4b15d66b435d2538f3827f05e44e2baafcc003dd7d8472dc67807ab8fd8 \
+    --hash=sha256:bcc96ee819c282e7c09b2eed2b9bd13084e3b749fdb2faf58c318d498df2efbe \
+    --hash=sha256:c0a94245afae4d7af8c43b3159d5e3934c53f47140be0be624b96acd672ceb73 \
+    --hash=sha256:c0eb25f0fd935e376ac4334927a59e7c823b36062080e2e13acbaf2af15db836 \
+    --hash=sha256:c3091e63acf42f56a6f74dc65cfdb6f99bfc79b5913c8a9ac498eb7ca09770a8 \
+    --hash=sha256:c501561e025b7aea3508719c5801c360c711d5218fc4ad5d77bf1c37c1a75779 \
+    --hash=sha256:c7502d6f54cd08024c3ea9b3514e2d6f190feb2f46e6dbcd3747882264bb5f7b \
+    --hash=sha256:caa1f14d2102cb8d353096bc6ef6c13b2c81f347e6ab9d6fbd48b9dea41c153d \
+    --hash=sha256:cb9a030f609194b679e1660f7e32733b7a0f332d519c5d5a6a0a580991290022 \
+    --hash=sha256:cd5a7f648d4365b41dbf0e38fe8da4884e57bed4e77c83598e076ac0c93995e7 \
+    --hash=sha256:d23ef06f9e67163be38cece704170486715b177f6baae338110983f99a72c070 \
+    --hash=sha256:d31f8c257046b5617fc6af9c69be066d2412bdef1edaa4bdf6a214cf57806105 \
+    --hash=sha256:d55b7e96531216fc4f071909e33e35e5bfa47962ae67d9e84b00a04d6e8b7173 \
+    --hash=sha256:d9e4332dc4ba054434a9594cbfaf7823b57993d7d8e7267831c3e059857cf397 \
+    --hash=sha256:de01280eabcd82f7542828ecd67ebf1551d37203ecdfd7ab1f2e534edb78d505 \
+    --hash=sha256:df61342889d0f5e7a32f7284e55ef95103f2110fee433c2ae7c2c0956d76ac8a \
+    --hash=sha256:e0976c0dff7e222513d206e06341503f07423aceb1db0b83ff6851c008ceee06 \
+    --hash=sha256:e150eab56c95dc9e3fefc234a0eedb342fac433dacc273cd4d150a5b0871e1fa \
+    --hash=sha256:e23fc6a83f112de4be0cc1990e5b127c27663ae43f866353166f87df58e73d06 \
+    --hash=sha256:ec27778c6ca3393ef662e2762dba8af13f4ec1aaa32d08d77f71f2a70ae9feb8 \
+    --hash=sha256:f54d5b36c56a2d5e1a31e73b950b28a0d83eb0c37b91d10408875a5a29494bad \
+    --hash=sha256:f74631b8322d2780ebcf2d2d75d58045c3e9378625ec51865fe0b5620800c39d
+    # via litellm
+filelock==3.29.0 \
+    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
+    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+    # via
+    #   huggingface-hub
+    #   mcp-agent-mail
+frozenlist==1.8.0 \
+    --hash=sha256:0325024fe97f94c41c08872db482cf8ac4800d80e79222c6b0b7b162d5b13686 \
+    --hash=sha256:032efa2674356903cd0261c4317a561a6850f3ac864a63fc1583147fb05a79b0 \
+    --hash=sha256:03ae967b4e297f58f8c774c7eabcce57fe3c2434817d4385c50661845a058121 \
+    --hash=sha256:06be8f67f39c8b1dc671f5d83aaefd3358ae5cdcf8314552c57e7ed3e6475bdd \
+    --hash=sha256:073f8bf8becba60aa931eb3bc420b217bb7d5b8f4750e6f8b3be7f3da85d38b7 \
+    --hash=sha256:07cdca25a91a4386d2e76ad992916a85038a9b97561bf7a3fd12d5d9ce31870c \
+    --hash=sha256:09474e9831bc2b2199fad6da3c14c7b0fbdd377cce9d3d77131be28906cb7d84 \
+    --hash=sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d \
+    --hash=sha256:0f96534f8bfebc1a394209427d0f8a63d343c9779cda6fc25e8e121b5fd8555b \
+    --hash=sha256:102e6314ca4da683dca92e3b1355490fed5f313b768500084fbe6371fddfdb79 \
+    --hash=sha256:11847b53d722050808926e785df837353bd4d75f1d494377e59b23594d834967 \
+    --hash=sha256:119fb2a1bd47307e899c2fac7f28e85b9a543864df47aa7ec9d3c1b4545f096f \
+    --hash=sha256:13d23a45c4cebade99340c4165bd90eeb4a56c6d8a9d8aa49568cac19a6d0dc4 \
+    --hash=sha256:154e55ec0655291b5dd1b8731c637ecdb50975a2ae70c606d100750a540082f7 \
+    --hash=sha256:168c0969a329b416119507ba30b9ea13688fafffac1b7822802537569a1cb0ef \
+    --hash=sha256:17c883ab0ab67200b5f964d2b9ed6b00971917d5d8a92df149dc2c9779208ee9 \
+    --hash=sha256:1a7607e17ad33361677adcd1443edf6f5da0ce5e5377b798fba20fae194825f3 \
+    --hash=sha256:1a7fa382a4a223773ed64242dbe1c9c326ec09457e6b8428efb4118c685c3dfd \
+    --hash=sha256:1aa77cb5697069af47472e39612976ed05343ff2e84a3dcf15437b232cbfd087 \
+    --hash=sha256:1b9290cf81e95e93fdf90548ce9d3c1211cf574b8e3f4b3b7cb0537cf2227068 \
+    --hash=sha256:20e63c9493d33ee48536600d1a5c95eefc870cd71e7ab037763d1fbb89cc51e7 \
+    --hash=sha256:21900c48ae04d13d416f0e1e0c4d81f7931f73a9dfa0b7a8746fb2fe7dd970ed \
+    --hash=sha256:229bf37d2e4acdaf808fd3f06e854a4a7a3661e871b10dc1f8f1896a3b05f18b \
+    --hash=sha256:2552f44204b744fba866e573be4c1f9048d6a324dfe14475103fd51613eb1d1f \
+    --hash=sha256:27c6e8077956cf73eadd514be8fb04d77fc946a7fe9f7fe167648b0b9085cc25 \
+    --hash=sha256:28bd570e8e189d7f7b001966435f9dac6718324b5be2990ac496cf1ea9ddb7fe \
+    --hash=sha256:294e487f9ec720bd8ffcebc99d575f7eff3568a08a253d1ee1a0378754b74143 \
+    --hash=sha256:29548f9b5b5e3460ce7378144c3010363d8035cea44bc0bf02d57f5a685e084e \
+    --hash=sha256:2c5dcbbc55383e5883246d11fd179782a9d07a986c40f49abe89ddf865913930 \
+    --hash=sha256:2dc43a022e555de94c3b68a4ef0b11c4f747d12c024a520c7101709a2144fb37 \
+    --hash=sha256:2f05983daecab868a31e1da44462873306d3cbfd76d1f0b5b69c473d21dbb128 \
+    --hash=sha256:33139dc858c580ea50e7e60a1b0ea003efa1fd42e6ec7fdbad78fff65fad2fd2 \
+    --hash=sha256:332db6b2563333c5671fecacd085141b5800cb866be16d5e3eb15a2086476675 \
+    --hash=sha256:33f48f51a446114bc5d251fb2954ab0164d5be02ad3382abcbfe07e2531d650f \
+    --hash=sha256:34187385b08f866104f0c0617404c8eb08165ab1272e884abc89c112e9c00746 \
+    --hash=sha256:342c97bf697ac5480c0a7ec73cd700ecfa5a8a40ac923bd035484616efecc2df \
+    --hash=sha256:3462dd9475af2025c31cc61be6652dfa25cbfb56cbbf52f4ccfe029f38decaf8 \
+    --hash=sha256:39ecbc32f1390387d2aa4f5a995e465e9e2f79ba3adcac92d68e3e0afae6657c \
+    --hash=sha256:3e0761f4d1a44f1d1a47996511752cf3dcec5bbdd9cc2b4fe595caf97754b7a0 \
+    --hash=sha256:3ede829ed8d842f6cd48fc7081d7a41001a56f1f38603f9d49bf3020d59a31ad \
+    --hash=sha256:3ef2d026f16a2b1866e1d86fc4e1291e1ed8a387b2c333809419a2f8b3a77b82 \
+    --hash=sha256:405e8fe955c2280ce66428b3ca55e12b3c4e9c336fb2103a4937e891c69a4a29 \
+    --hash=sha256:42145cd2748ca39f32801dad54aeea10039da6f86e303659db90db1c4b614c8c \
+    --hash=sha256:4314debad13beb564b708b4a496020e5306c7333fa9a3ab90374169a20ffab30 \
+    --hash=sha256:433403ae80709741ce34038da08511d4a77062aa924baf411ef73d1146e74faf \
+    --hash=sha256:44389d135b3ff43ba8cc89ff7f51f5a0bb6b63d829c8300f79a2fe4fe61bcc62 \
+    --hash=sha256:48e6d3f4ec5c7273dfe83ff27c91083c6c9065af655dc2684d2c200c94308bb5 \
+    --hash=sha256:494a5952b1c597ba44e0e78113a7266e656b9794eec897b19ead706bd7074383 \
+    --hash=sha256:4970ece02dbc8c3a92fcc5228e36a3e933a01a999f7094ff7c23fbd2beeaa67c \
+    --hash=sha256:4e0c11f2cc6717e0a741f84a527c52616140741cd812a50422f83dc31749fb52 \
+    --hash=sha256:50066c3997d0091c411a66e710f4e11752251e6d2d73d70d8d5d4c76442a199d \
+    --hash=sha256:517279f58009d0b1f2e7c1b130b377a349405da3f7621ed6bfae50b10adf20c1 \
+    --hash=sha256:54b2077180eb7f83dd52c40b2750d0a9f175e06a42e3213ce047219de902717a \
+    --hash=sha256:5500ef82073f599ac84d888e3a8c1f77ac831183244bfd7f11eaa0289fb30714 \
+    --hash=sha256:581ef5194c48035a7de2aefc72ac6539823bb71508189e5de01d60c9dcd5fa65 \
+    --hash=sha256:59a6a5876ca59d1b63af8cd5e7ffffb024c3dc1e9cf9301b21a2e76286505c95 \
+    --hash=sha256:5a3a935c3a4e89c733303a2d5a7c257ea44af3a56c8202df486b7f5de40f37e1 \
+    --hash=sha256:5c1c8e78426e59b3f8005e9b19f6ff46e5845895adbde20ece9218319eca6506 \
+    --hash=sha256:5d63a068f978fc69421fb0e6eb91a9603187527c86b7cd3f534a5b77a592b888 \
+    --hash=sha256:667c3777ca571e5dbeb76f331562ff98b957431df140b54c85fd4d52eea8d8f6 \
+    --hash=sha256:6da155091429aeba16851ecb10a9104a108bcd32f6c1642867eadaee401c1c41 \
+    --hash=sha256:6dc4126390929823e2d2d9dc79ab4046ed74680360fc5f38b585c12c66cdf459 \
+    --hash=sha256:7398c222d1d405e796970320036b1b563892b65809d9e5261487bb2c7f7b5c6a \
+    --hash=sha256:74c51543498289c0c43656701be6b077f4b265868fa7f8a8859c197006efb608 \
+    --hash=sha256:776f352e8329135506a1d6bf16ac3f87bc25b28e765949282dcc627af36123aa \
+    --hash=sha256:778a11b15673f6f1df23d9586f83c4846c471a8af693a22e066508b77d201ec8 \
+    --hash=sha256:78f7b9e5d6f2fdb88cdde9440dc147259b62b9d3b019924def9f6478be254ac1 \
+    --hash=sha256:799345ab092bee59f01a915620b5d014698547afd011e691a208637312db9186 \
+    --hash=sha256:7bf6cdf8e07c8151fba6fe85735441240ec7f619f935a5205953d58009aef8c6 \
+    --hash=sha256:8009897cdef112072f93a0efdce29cd819e717fd2f649ee3016efd3cd885a7ed \
+    --hash=sha256:80f85f0a7cc86e7a54c46d99c9e1318ff01f4687c172ede30fd52d19d1da1c8e \
+    --hash=sha256:8585e3bb2cdea02fc88ffa245069c36555557ad3609e83be0ec71f54fd4abb52 \
+    --hash=sha256:878be833caa6a3821caf85eb39c5ba92d28e85df26d57afb06b35b2efd937231 \
+    --hash=sha256:8a76ea0f0b9dfa06f254ee06053d93a600865b3274358ca48a352ce4f0798450 \
+    --hash=sha256:8b7b94a067d1c504ee0b16def57ad5738701e4ba10cec90529f13fa03c833496 \
+    --hash=sha256:8d92f1a84bb12d9e56f818b3a746f3efba93c1b63c8387a73dde655e1e42282a \
+    --hash=sha256:908bd3f6439f2fef9e85031b59fd4f1297af54415fb60e4254a95f75b3cab3f3 \
+    --hash=sha256:92db2bf818d5cc8d9c1f1fc56b897662e24ea5adb36ad1f1d82875bd64e03c24 \
+    --hash=sha256:940d4a017dbfed9daf46a3b086e1d2167e7012ee297fef9e1c545c4d022f5178 \
+    --hash=sha256:957e7c38f250991e48a9a73e6423db1bb9dd14e722a10f6b8bb8e16a0f55f695 \
+    --hash=sha256:96153e77a591c8adc2ee805756c61f59fef4cf4073a9275ee86fe8cba41241f7 \
+    --hash=sha256:96f423a119f4777a4a056b66ce11527366a8bb92f54e541ade21f2374433f6d4 \
+    --hash=sha256:97260ff46b207a82a7567b581ab4190bd4dfa09f4db8a8b49d1a958f6aa4940e \
+    --hash=sha256:974b28cf63cc99dfb2188d8d222bc6843656188164848c4f679e63dae4b0708e \
+    --hash=sha256:9ff15928d62a0b80bb875655c39bf517938c7d589554cbd2669be42d97c2cb61 \
+    --hash=sha256:a6483e309ca809f1efd154b4d37dc6d9f61037d6c6a81c2dc7a15cb22c8c5dca \
+    --hash=sha256:a88f062f072d1589b7b46e951698950e7da00442fc1cacbe17e19e025dc327ad \
+    --hash=sha256:ac913f8403b36a2c8610bbfd25b8013488533e71e62b4b4adce9c86c8cea905b \
+    --hash=sha256:adbeebaebae3526afc3c96fad434367cafbfd1b25d72369a9e5858453b1bb71a \
+    --hash=sha256:b2a095d45c5d46e5e79ba1e5b9cb787f541a8dee0433836cea4b96a2c439dcd8 \
+    --hash=sha256:b3210649ee28062ea6099cfda39e147fa1bc039583c8ee4481cb7811e2448c51 \
+    --hash=sha256:b37f6d31b3dcea7deb5e9696e529a6aa4a898adc33db82da12e4c60a7c4d2011 \
+    --hash=sha256:b4dec9482a65c54a5044486847b8a66bf10c9cb4926d42927ec4e8fd5db7fed8 \
+    --hash=sha256:b4f3b365f31c6cd4af24545ca0a244a53688cad8834e32f56831c4923b50a103 \
+    --hash=sha256:b6db2185db9be0a04fecf2f241c70b63b1a242e2805be291855078f2b404dd6b \
+    --hash=sha256:b9be22a69a014bc47e78072d0ecae716f5eb56c15238acca0f43d6eb8e4a5bda \
+    --hash=sha256:bac9c42ba2ac65ddc115d930c78d24ab8d4f465fd3fc473cdedfccadb9429806 \
+    --hash=sha256:bf0a7e10b077bf5fb9380ad3ae8ce20ef919a6ad93b4552896419ac7e1d8e042 \
+    --hash=sha256:c23c3ff005322a6e16f71bf8692fcf4d5a304aaafe1e262c98c6d4adc7be863e \
+    --hash=sha256:c4c800524c9cd9bac5166cd6f55285957fcfc907db323e193f2afcd4d9abd69b \
+    --hash=sha256:c7366fe1418a6133d5aa824ee53d406550110984de7637d65a178010f759c6ef \
+    --hash=sha256:c8d1634419f39ea6f5c427ea2f90ca85126b54b50837f31497f3bf38266e853d \
+    --hash=sha256:c9a63152fe95756b85f31186bddf42e4c02c6321207fd6601a1c89ebac4fe567 \
+    --hash=sha256:cb89a7f2de3602cfed448095bab3f178399646ab7c61454315089787df07733a \
+    --hash=sha256:cba69cb73723c3f329622e34bdbf5ce1f80c21c290ff04256cff1cd3c2036ed2 \
+    --hash=sha256:cee686f1f4cadeb2136007ddedd0aaf928ab95216e7691c63e50a8ec066336d0 \
+    --hash=sha256:cf253e0e1c3ceb4aaff6df637ce033ff6535fb8c70a764a8f46aafd3d6ab798e \
+    --hash=sha256:d1eaff1d00c7751b7c6662e9c5ba6eb2c17a2306ba5e2a37f24ddf3cc953402b \
+    --hash=sha256:d3bb933317c52d7ea5004a1c442eef86f426886fba134ef8cf4226ea6ee1821d \
+    --hash=sha256:d4d3214a0f8394edfa3e303136d0575eece0745ff2b47bd2cb2e66dd92d4351a \
+    --hash=sha256:d6a5df73acd3399d893dafc71663ad22534b5aa4f94e8a2fabfe856c3c1b6a52 \
+    --hash=sha256:d8b7138e5cd0647e4523d6685b0eac5d4be9a184ae9634492f25c6eb38c12a47 \
+    --hash=sha256:db1e72ede2d0d7ccb213f218df6a078a9c09a7de257c2fe8fcef16d5925230b1 \
+    --hash=sha256:e25ac20a2ef37e91c1b39938b591457666a0fa835c7783c3a8f33ea42870db94 \
+    --hash=sha256:e2de870d16a7a53901e41b64ffdf26f2fbb8917b3e6ebf398098d72c5b20bd7f \
+    --hash=sha256:e4a3408834f65da56c83528fb52ce7911484f0d1eaf7b761fc66001db1646eff \
+    --hash=sha256:eaa352d7047a31d87dafcacbabe89df0aa506abb5b1b85a2fb91bc3faa02d822 \
+    --hash=sha256:eab8145831a0d56ec9c4139b6c3e594c7a83c2c8be25d5bcf2d86136a532287a \
+    --hash=sha256:ec3cc8c5d4084591b4237c0a272cc4f50a5b03396a47d9caaf76f5d7b38a4f11 \
+    --hash=sha256:edee74874ce20a373d62dc28b0b18b93f645633c2943fd90ee9d898550770581 \
+    --hash=sha256:eefdba20de0d938cec6a89bd4d70f346a03108a19b9df4248d3cf0d88f1b0f51 \
+    --hash=sha256:ef2b7b394f208233e471abc541cc6991f907ffd47dc72584acee3147899d6565 \
+    --hash=sha256:f21f00a91358803399890ab167098c131ec2ddd5f8f5fd5fe9c9f2c6fcd91e40 \
+    --hash=sha256:f4be2e3d8bc8aabd566f8d5b8ba7ecc09249d74ba3c9ed52e54dc23a293f0b92 \
+    --hash=sha256:f57fb59d9f385710aa7060e89410aeb5058b99e62f4d16b08b91986b9a2140c2 \
+    --hash=sha256:f6292f1de555ffcc675941d65fffffb0a5bcd992905015f85d0592201793e0e5 \
+    --hash=sha256:f833670942247a14eafbb675458b4e61c82e002a148f49e68257b79296e865c4 \
+    --hash=sha256:fa47e444b8ba08fffd1c18e8cdb9a75db1b6a27f17507522834ad13ed5922b93 \
+    --hash=sha256:fb30f9626572a76dfe4293c7194a09fb1fe93ba94c7d4f720dfae3b646b45027 \
+    --hash=sha256:fe3c58d2f5db5fbd18c2987cba06d51b0529f52bc3a6cdc33d3f4eab725104bd
+    # via
+    #   aiohttp
+    #   aiosignal
+fsspec==2026.3.0 \
+    --hash=sha256:1ee6a0e28677557f8c2f994e3eea77db6392b4de9cd1f5d7a9e87a0ae9d01b41 \
+    --hash=sha256:d2ceafaad1b3457968ed14efa28798162f1638dbb5d2a6868a2db002a5ee39a4
+    # via huggingface-hub
+gitdb==4.0.12 \
+    --hash=sha256:5ef71f855d191a3326fcfbc0d5da835f26b13fbcba60c32c21091c349ffdb571 \
+    --hash=sha256:67073e15955400952c6565cc3e707c554a4eea2e428946f7a4c162fab9bd9bcf
+    # via gitpython
+gitpython==3.1.49 \
+    --hash=sha256:024b0422d7f84d15cd794844e029ffebd4c5d42a7eb9b936b458697ef550a02c \
+    --hash=sha256:42f9399c9eb33fc581014bedd76049dfbaf6375aa2a5754575966387280315e1
+    # via mcp-agent-mail
+greenlet==3.5.0 \
+    --hash=sha256:0ecec963079cd58cbd14723582384f11f166fd58883c15dcbfb342e0bc9b5846 \
+    --hash=sha256:0ed006e4b86c59de7467eb2601cd1b77b5a7d657d1ee55e30fe30d76451edba4 \
+    --hash=sha256:0ff251e9a0279522e62f6176412869395a64ddf2b5c5f782ff609a8216a4e662 \
+    --hash=sha256:1aa4ce8debcd4ea7fb2e150f3036588c41493d1d52c43538924ae1819003f4ce \
+    --hash=sha256:1bae92a1dd94c5f9d9493c3a212dd874c202442047cf96446412c862feca83a2 \
+    --hash=sha256:1eb67d5adefb5bd2e182d42678a328979a209e4e82eb93575708185d31d1f588 \
+    --hash=sha256:2094acd54b272cb6eae8c03dd87b3fa1820a4cef18d6889c378d503500a1dc13 \
+    --hash=sha256:2628d6c86f6cb0cb45e0c3c54058bbec559f57eaae699447748cb3928150577e \
+    --hash=sha256:29ea813b2e1f45fa9649a17853b2b5465c4072fbcb072e5af6cd3a288216574a \
+    --hash=sha256:362624e6a8e5bca3b8233e45eef33903a100e9539a2b995c364d595dbc4018b3 \
+    --hash=sha256:3a717fbc46d8a354fa675f7c1e813485b6ba3885f9bef0cd56e5ba27d758ff5b \
+    --hash=sha256:3bc59be3945ae9750b9e7d45067d01ae3fe90ea5f9ade99239dabdd6e28a5033 \
+    --hash=sha256:3ec9ea74e7268ace7f9aab1b1a4e730193fc661b39a993cd91c606c32d4a3628 \
+    --hash=sha256:41353ec2ecedf7aa8f682753a41919f8718031a6edac46b8d3dc7ed9e1ceb136 \
+    --hash=sha256:47422135b1d308c14b2c6e758beedb1acd33bb91679f5670edf77bf46244722b \
+    --hash=sha256:4964101b8585c144cbda5532b1aa644255126c08a265dae90c16e7a0e63aaa9d \
+    --hash=sha256:4a448128607be0de65342dc9b31be7f948ef4cc0bc8832069350abefd310a8f2 \
+    --hash=sha256:4b28037cb07768933c54d81bfe47a85f9f402f57d7d69743b991a713b63954eb \
+    --hash=sha256:4d0eadc7e4d9ffb2af4247b606cae307be8e448911e5a0d0b16d72fc3d224cfd \
+    --hash=sha256:54d243512da35485fc7a6bf3c178fdda6327a9d6506fcdd62b1abd1e41b2927b \
+    --hash=sha256:55fa7ea52771be44af0de27d8b80c02cd18c2c3cddde6c847ecebdf72418b6a1 \
+    --hash=sha256:57a43c6079a89713522bc4bcb9f75070ecf5d3dbad7792bfe42239362cbf2a16 \
+    --hash=sha256:58c1c374fe2b3d852f9b6b11a7dff4c85404e51b9a596fd9e89cf904eb09866d \
+    --hash=sha256:5a5ed18de6a0f6cc7087f1563f6bd93fc7df1c19165ca01e9bde5a5dc281d106 \
+    --hash=sha256:5e05ba267789ea87b5a155cf0e810b1ab88bf18e9e8740813945ceb8ee4350ba \
+    --hash=sha256:5ecd83806b0f4c2f53b1018e0005cd82269ea01d42befc0368730028d850ed1c \
+    --hash=sha256:64d6ac45f7271f48e45f67c95b54ef73534c52ec041fcda8edf520c6d811f4bc \
+    --hash=sha256:680bd0e7ad5e8daa8a4aa89f68fd6adc834b8a8036dc256533f7e08f4a4b01f7 \
+    --hash=sha256:6c18dfb59c70f5a94acd271c72e90128c3c776e41e5f07767908c8c1b74ad339 \
+    --hash=sha256:6d874e79afd41a96e11ff4c5d0bc90a80973e476fda1c2c64985667397df432b \
+    --hash=sha256:7022615368890680e67b9965d33f5773aade330d5343bbe25560135aaa849eae \
+    --hash=sha256:703cb211b820dbffbbc55a16bfc6e4583a6e6e990f33a119d2cc8b83211119c8 \
+    --hash=sha256:728a73687e39ae9ca34e4694cbf2f049d3fbc7174639468d0f67200a97d8f9e2 \
+    --hash=sha256:728d9667d8f2f586644b748dbd9bb67e50d6a9381767d1357714ea6825bb3bf5 \
+    --hash=sha256:762612baf1161ccb8437c0161c668a688223cba28e1bf038f4eb47b13e39ccdf \
+    --hash=sha256:7fc391b1566f2907d17aaebe78f8855dc45675159a775fcf9e61f8ee0078e87f \
+    --hash=sha256:804a70b328e706b785c6ef16187051c394a63dd1a906d89be24b6ad77759f13f \
+    --hash=sha256:83ed9f27f1680b50e89f40f6df348a290ea234b249a4003d366663a12eab94f2 \
+    --hash=sha256:884f649de075b84739713d41dd4dfd41e2b910bfb769c4a3ea02ec1da52cd9bb \
+    --hash=sha256:8f1cc966c126639cd152fdaa52624d2655f492faa79e013fea161de3e6dda082 \
+    --hash=sha256:8f52a464e4ed91780bdfbbdd2b97197f3accaa629b98c200f4dffada759f3ae7 \
+    --hash=sha256:9c615f869163e14bb1ced20322d8038fb680b08236521ac3f30cd4c1288785a0 \
+    --hash=sha256:9d280a7f5c331622c69f97eb167f33577ff2d1df282c41cd15907fc0a3ca198c \
+    --hash=sha256:a10a732421ab4fec934783ce3e54763470d0181db6e3468f9103a275c3ed1853 \
+    --hash=sha256:a96fcee45e03fe30a62669fd16ab5c9d3c172660d3085605cb1e2d1280d3c988 \
+    --hash=sha256:a97e4821aa710603f94de0da25f25096454d78ffdace5dc77f3a006bc01abba3 \
+    --hash=sha256:ba8f0bdc2fae6ce915dfd0c16d2d00bca7e4247c1eae4416e06430e522137858 \
+    --hash=sha256:bf2d8a80bec89ab46221ae45c5373d5ba0bd36c19aa8508e85c6cd7e5106cd37 \
+    --hash=sha256:cda05425526240807408156b6960a17a79a0c760b813573b67027823be760977 \
+    --hash=sha256:d419647372241bc68e957bf38d5c1f98852155e4146bd1e4121adea81f4f01e4 \
+    --hash=sha256:d4d9f0624c775f2dfc56ba54d515a8c771044346852a918b405914f6b19d7fd8 \
+    --hash=sha256:d60097128cb0a1cab9ea541186ea13cd7b847b8449a7787c2e2350da0cb82d86 \
+    --hash=sha256:db2910d3c809444e0a20147361f343fe2798e106af8d9d8506f5305302655a9f \
+    --hash=sha256:ddb36c7d6c9c0a65f18c7258634e0c416c6ab59caac8c987b96f80c2ebda0112 \
+    --hash=sha256:ddc090c5c1792b10246a78e8c2163ebbe04cf877f9d785c230a7b27b39ad038e \
+    --hash=sha256:e5ddf316ced87539144621453c3aef229575825fe60c604e62bedc4003f372b2 \
+    --hash=sha256:f35807464c4c58c55f0d31dfa83c541a5615d825c2fe3d2b95360cf7c4e3c0a8 \
+    --hash=sha256:f8c30c2225f40dd76c50790f0eb3b5c7c18431efb299e2782083e1981feed243 \
+    --hash=sha256:fa94cb2288681e3a11645958f1871d48ee9211bd2f66628fdace505927d6e564
+    # via sqlalchemy
+h11==0.16.0 \
+    --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \
+    --hash=sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
+    # via
+    #   httpcore
+    #   uvicorn
+h2==4.3.0 \
+    --hash=sha256:6c59efe4323fa18b47a632221a1888bd7fde6249819beda254aeca909f221bf1 \
+    --hash=sha256:c438f029a25f7945c69e0ccf0fb951dc3f73a5f6412981daee861431b70e2bdd
+    # via httpx
+hf-xet==1.4.3 \
+    --hash=sha256:0392c79b7cf48418cd61478c1a925246cf10639f4cd9d94368d8ca1e8df9ea07 \
+    --hash=sha256:1feb0f3abeacee143367c326a128a2e2b60868ec12a36c225afb1d6c5a05e6d2 \
+    --hash=sha256:21644b404bb0100fe3857892f752c4d09642586fd988e61501c95bbf44b393a3 \
+    --hash=sha256:22bdc1f5fb8b15bf2831440b91d1c9bbceeb7e10c81a12e8d75889996a5c9da8 \
+    --hash=sha256:27c976ba60079fb8217f485b9c5c7fcd21c90b0367753805f87cb9f3cdc4418a \
+    --hash=sha256:2815a49a7a59f3e2edf0cf113ae88e8cb2ca2a221bf353fb60c609584f4884d4 \
+    --hash=sha256:39f2d2e9654cd9b4319885733993807aab6de9dfbd34c42f0b78338d6617421f \
+    --hash=sha256:42ee323265f1e6a81b0e11094564fb7f7e0ec75b5105ffd91ae63f403a11931b \
+    --hash=sha256:49ad8a8cead2b56051aa84d7fce3e1335efe68df3cf6c058f22a65513885baac \
+    --hash=sha256:5251d5ece3a81815bae9abab41cf7ddb7bcb8f56411bce0827f4a3071c92fdc6 \
+    --hash=sha256:60cf7fc43a99da0a853345cf86d23738c03983ee5249613a6305d3e57a5dca74 \
+    --hash=sha256:681c92a07796325778a79d76c67011764ecc9042a8c3579332b61b63ae512075 \
+    --hash=sha256:6b591fcad34e272a5b02607485e4f2a1334aebf1bc6d16ce8eb1eb8978ac2021 \
+    --hash=sha256:7551659ba4f1e1074e9623996f28c3873682530aee0a846b7f2f066239228144 \
+    --hash=sha256:7716d62015477a70ea272d2d68cd7cad140f61c52ee452e133e139abfe2c17ba \
+    --hash=sha256:7c2c7e20bcfcc946dc67187c203463f5e932e395845d098cc2a93f5b67ca0b47 \
+    --hash=sha256:8b301fc150290ca90b4fccd079829b84bb4786747584ae08b94b4577d82fb791 \
+    --hash=sha256:8ddedb73c8c08928c793df2f3401ec26f95be7f7e516a7bee2fbb546f6676113 \
+    --hash=sha256:987f09cfe418237812896a6736b81b1af02a3a6dcb4b4944425c4c4fca7a7cf8 \
+    --hash=sha256:bee693ada985e7045997f05f081d0e12c4c08bd7626dc397f8a7c487e6c04f7f \
+    --hash=sha256:c5b48db1ee344a805a1b9bd2cda9b6b65fe77ed3787bd6e87ad5521141d317cd \
+    --hash=sha256:d0da85329eaf196e03e90b84c2d0aca53bd4573d097a75f99609e80775f98025 \
+    --hash=sha256:d972fbe95ddc0d3c0fc49b31a8a69f47db35c1e3699bf316421705741aab6653 \
+    --hash=sha256:e23717ce4186b265f69afa66e6f0069fe7efbf331546f5c313d00e123dc84583 \
+    --hash=sha256:fc360b70c815bf340ed56c7b8c63aacf11762a4b099b2fe2c9bd6d6068668c08
+    # via huggingface-hub
+hiredis==3.3.1 \
+    --hash=sha256:002fc0201b9af1cc8960e27cdc501ad1f8cdd6dbadb2091c6ddbd4e5ace6cb77 \
+    --hash=sha256:011a9071c3df4885cac7f58a2623feac6c8e2ad30e6ba93c55195af05ce61ff5 \
+    --hash=sha256:01cf82a514bc4fd145b99333c28523e61b7a9ad051a245804323ebf4e7b1c6a6 \
+    --hash=sha256:027ce4fabfeff5af5b9869d5524770877f9061d118bc36b85703ae3faf5aad8e \
+    --hash=sha256:03baa381964b8df356d19ec4e3a6ae656044249a87b0def257fe1e08dbaf6094 \
+    --hash=sha256:042e57de8a2cae91e3e7c0af32960ea2c5107b2f27f68a740295861e68780a8a \
+    --hash=sha256:09d41a3a965f7c261223d516ebda607aee4d8440dd7637f01af9a4c05872f0c4 \
+    --hash=sha256:09f5e510f637f2c72d2a79fb3ad05f7b6211e057e367ca5c4f97bb3d8c9d71f4 \
+    --hash=sha256:0b5ff2f643f4b452b0597b7fe6aa35d398cb31d8806801acfafb1558610ea2aa \
+    --hash=sha256:0caf3fc8af0767794b335753781c3fa35f2a3e975c098edbc8f733d35d6a95e4 \
+    --hash=sha256:0fac4af8515e6cca74fc701169ae4dc9a71a90e9319c9d21006ec9454b43aa2f \
+    --hash=sha256:113e098e4a6b3cc5500e05e7cb1548ba9e83de5fe755941b11f6020a76e6c03a \
+    --hash=sha256:137c14905ea6f2933967200bc7b2a0c8ec9387888b273fd0004f25b994fd0343 \
+    --hash=sha256:156be6a0c736ee145cfe0fb155d0e96cec8d4872cf8b4f76ad6a2ee6ab391d0a \
+    --hash=sha256:17ec8b524055a88b80d76c177dbbbe475a25c17c5bf4b67bdbdbd0629bcae838 \
+    --hash=sha256:1ac7697365dbe45109273b34227fee6826b276ead9a4a007e0877e1d3f0fcf21 \
+    --hash=sha256:1b46e96b50dad03495447860510daebd2c96fd44ed25ba8ccb03e9f89eaa9d34 \
+    --hash=sha256:1ebc307a87b099d0877dbd2bdc0bae427258e7ec67f60a951e89027f8dc2568f \
+    --hash=sha256:1f7bceb03a1b934872ffe3942eaeed7c7e09096e67b53f095b81f39c7a819113 \
+    --hash=sha256:2611bfaaadc5e8d43fb7967f9bbf1110c8beaa83aee2f2d812c76f11cfb56c6a \
+    --hash=sha256:264ee7e9cb6c30dc78da4ecf71d74cf14ca122817c665d838eda8b4384bce1b0 \
+    --hash=sha256:26f899cde0279e4b7d370716ff80320601c2bd93cdf3e774a42bdd44f65b41f8 \
+    --hash=sha256:29fe35e3c6fe03204e75c86514f452591957a1e06b05d86e10d795455b71c355 \
+    --hash=sha256:2afc675b831f7552da41116fffffca4340f387dc03f56d6ec0c7895ab0b59a10 \
+    --hash=sha256:2b6da6e07359107c653a809b3cff2d9ccaeedbafe33c6f16434aef6f53ce4a2b \
+    --hash=sha256:2b96da7e365d6488d2a75266a662cbe3cc14b28c23dd9b0c9aa04b5bc5c20192 \
+    --hash=sha256:2f1c1b2e8f00b71e6214234d313f655a3a27cd4384b054126ce04073c1d47045 \
+    --hash=sha256:304481241e081bc26f0778b2c2b99f9c43917e4e724a016dcc9439b7ab12c726 \
+    --hash=sha256:318f772dd321404075d406825266e574ee0f4751be1831424c2ebd5722609398 \
+    --hash=sha256:3586c8a5f56d34b9dddaaa9e76905f31933cac267251006adf86ec0eef7d0400 \
+    --hash=sha256:3724f0e58c6ff76fd683429945491de71324ab1bc0ad943a8d68cb0932d24075 \
+    --hash=sha256:3fb6573efa15a29c12c0c0f7170b14e7c1347fe4bb39b6a15b779f46015cc929 \
+    --hash=sha256:40ae8a7041fcb328a6bc7202d8c4e6e0d38d434b2e3880b1ee8ed754f17cd836 \
+    --hash=sha256:4106201cd052d9eabe3cb7b5a24b0fe37307792bda4fcb3cf6ddd72f697828e8 \
+    --hash=sha256:439f9a5cc8f9519ce208a24cdebfa0440fef26aa682a40ba2c92acb10a53f5e0 \
+    --hash=sha256:4479e36d263251dba8ab8ea81adf07e7f1163603c7102c5de1e130b83b4fad3b \
+    --hash=sha256:487658e1db83c1ee9fbbac6a43039ea76957767a5987ffb16b590613f9e68297 \
+    --hash=sha256:48ff424f8aa36aacd9fdaa68efeb27d2e8771f293af4305bdb15d92194ca6631 \
+    --hash=sha256:4f7e242eab698ad0be5a4b2ec616fa856569c57455cc67c625fd567726290e5f \
+    --hash=sha256:526db52e5234a9463520e960a509d6c1bd5128d1ab1b569cbf459fe39189e8ab \
+    --hash=sha256:52d5641027d6731bc7b5e7d126a5158a99784a9f8c6de3d97ca89aca4969e9f8 \
+    --hash=sha256:53148a4e21057541b6d8e493b2ea1b500037ddf34433c391970036f3cbce00e3 \
+    --hash=sha256:583de2f16528e66081cbdfe510d8488c2de73039dc00aada7d22bd49d73a4a94 \
+    --hash=sha256:5e55d90b431b0c6b64ae5a624208d4aea318566d31872e595ee723c0f5b9a79f \
+    --hash=sha256:5f316cf2d0558f5027aab19dde7d7e4901c26c21fa95367bc37784e8f547bbf2 \
+    --hash=sha256:60543f3b068b16a86e99ed96b7fdae71cdc1d8abdfe9b3f82032a555e52ece7e \
+    --hash=sha256:62cc62284541bb2a86c898c7d5e8388661cade91c184cb862095ed547e80588f \
+    --hash=sha256:65c05b79cb8366c123357b354a16f9fc3f7187159422f143638d1c26b7240ed4 \
+    --hash=sha256:65f6ac06a9f0c32c254660ec6a9329d81d589e8f5d0a9837a941d5424a6be1ef \
+    --hash=sha256:6d1434d0bcc1b3ef048bae53f26456405c08aeed9827e65b24094f5f3a6793f1 \
+    --hash=sha256:6e2e1024f0a021777740cb7c633a0efb2c4a4bc570f508223a8dcbcf79f99ef9 \
+    --hash=sha256:6ffa7ba2e2da1f806f3181b9730b3e87ba9dbfec884806725d4584055ba3faa6 \
+    --hash=sha256:743b85bd6902856cac457ddd8cd7dd48c89c47d641b6016ff5e4d015bfbd4799 \
+    --hash=sha256:77c5d2bebbc9d06691abb512a31d0f54e1562af0b872891463a67a949b5278ef \
+    --hash=sha256:79cd03e7ff550c17758a7520bf437c156d3d4c8bb74214deeafa69cda49c85a4 \
+    --hash=sha256:80aba5f85d6227faee628ae28d1c3b69c661806a0636548ac56c68782606454f \
+    --hash=sha256:81a1669b6631976b1dc9d3d58ed1ab3333e9f52feb91a2a1fb8241101ac3b665 \
+    --hash=sha256:8597c35c9e82f65fd5897c4a2188c65d7daf10607b102960137b23d261cd957b \
+    --hash=sha256:8650158217b469d8b6087f490929211b0493a9121154c4efaafd1dec9e19319e \
+    --hash=sha256:8887bf0f31e4b550bd988c8863b527b6587d200653e9375cd91eea2b944b7424 \
+    --hash=sha256:8a52b24cd710690c4a7e191c7e300136ad2ecb3c68ffe7e95b598e76de166e5e \
+    --hash=sha256:8e3754ce60e1b11b0afad9a053481ff184d2ee24bea47099107156d1b84a84aa \
+    --hash=sha256:907f7b5501a534030738f0f27459a612d2266fd0507b007bb8f3e6de08167920 \
+    --hash=sha256:90d6b9f2652303aefd2c5a26a5e14cb74a3a63d10faa642c08d790e99442a088 \
+    --hash=sha256:98fd5b39410e9d69e10e90d0330e35650becaa5dd2548f509b9598f1f3c6124d \
+    --hash=sha256:9bfdeff778d3f7ff449ca5922ab773899e7d31e26a576028b06a5e9cf0ed8c34 \
+    --hash=sha256:9ebae74ce2b977c2fcb22d6a10aa0acb730022406977b2bcb6ddd6788f5c414a \
+    --hash=sha256:a110d19881ca78a88583d3b07231e7c6864864f5f1f3491b638863ea45fa8708 \
+    --hash=sha256:a1d190790ee39b8b7adeeb10fc4090dc4859eb4e75ed27bd8108710eef18f358 \
+    --hash=sha256:a2f049c3f3c83e886cd1f53958e2a1ebb369be626bef9e50d8b24d79864f1df6 \
+    --hash=sha256:a3af4e9f277d6b8acd369dc44a723a055752fca9d045094383af39f90a3e3729 \
+    --hash=sha256:a42c7becd4c9ec4ab5769c754eb61112777bdc6e1c1525e2077389e193b5f5aa \
+    --hash=sha256:a58a58cef0d911b1717154179a9ff47852249c536ea5966bde4370b6b20638ff \
+    --hash=sha256:ab1f646ff531d70bfd25f01e60708dfa3d105eb458b7dedd9fe9a443039fd809 \
+    --hash=sha256:ad940dc2db545dc978cb41cb9a683e2ff328f3ef581230b9ca40ff6c3d01d542 \
+    --hash=sha256:afe3c3863f16704fb5d7c2c6ff56aaf9e054f6d269f7b4c9074c5476178d1aba \
+    --hash=sha256:b1e3b9f4bf9a4120510ba77a77b2fb674893cd6795653545152bb11a79eecfcb \
+    --hash=sha256:b2390ad81c03d93ef1d5afd18ffcf5935de827f1a2b96b2c829437968bdabccb \
+    --hash=sha256:b37df4b10cb15dedfc203f69312d8eedd617b941c21df58c13af59496c53ad0f \
+    --hash=sha256:b3df9447f9209f9aa0434ca74050e9509670c1ad99398fe5807abb90e5f3a014 \
+    --hash=sha256:b4fe7f38aa8956fcc1cea270e62601e0e11066aff78e384be70fd283d30293b6 \
+    --hash=sha256:c1d68c6980d4690a4550bd3db6c03146f7be68ef5d08d38bb1fb68b3e9c32fe3 \
+    --hash=sha256:c24c1460486b6b36083252c2db21a814becf8495ccd0e76b7286623e37239b63 \
+    --hash=sha256:c25132902d3eff38781e0d54f27a0942ec849e3c07dbdce83c4d92b7e43c8dce \
+    --hash=sha256:c74bd9926954e7e575f9cd9890f63defd90cd8f812dfbf8e1efb72acc9355456 \
+    --hash=sha256:c8139e9011117822391c5bcfd674c5948fb1e4b8cb9adf6f13d9890859ee3a1a \
+    --hash=sha256:ce334915f5d31048f76a42c607bf26687cf045eb1bc852b7340f09729c6a64fc \
+    --hash=sha256:d14229beaa76e66c3a25f9477d973336441ca820df853679a98796256813316f \
+    --hash=sha256:d42f3a13290f89191568fc113d95a3d2c8759cdd8c3672f021d8b7436f909e75 \
+    --hash=sha256:d8e56e0d1fe607bfff422633f313aec9191c3859ab99d11ff097e3e6e068000c \
+    --hash=sha256:da6f0302360e99d32bc2869772692797ebadd536e1b826d0103c72ba49d38698 \
+    --hash=sha256:db46baf157feefd88724e6a7f145fe996a5990a8604ed9292b45d563360e513b \
+    --hash=sha256:dcea8c3f53674ae68e44b12e853b844a1d315250ca6677b11ec0c06aff85e86c \
+    --hash=sha256:de94b409f49eb6a588ebdd5872e826caec417cd77c17af0fb94f2128427f1a2a \
+    --hash=sha256:e0356561b4a97c83b9ee3de657a41b8d1a1781226853adaf47b550bb988fda6f \
+    --hash=sha256:e0db44cf81e4d7b94f3776b9f89111f74ed6bbdbfd42a22bc4a5ce0644d3e060 \
+    --hash=sha256:e31e92b61d56244047ad600812e16f7587a6172f74810fd919ff993af12b9149 \
+    --hash=sha256:e89dabf436ee79b358fd970dcbed6333a36d91db73f27069ca24a02fb138a404 \
+    --hash=sha256:eddeb9a153795cf6e615f9f3cef66a1d573ff3b6ee16df2b10d1d1c2f2baeaa8 \
+    --hash=sha256:ee11fd431f83d8a5b29d370b9d79a814d3218d30113bdcd44657e9bdf715fc92 \
+    --hash=sha256:ee37fe8cf081b72dea72f96a0ee604f492ec02252eb77dc26ff6eec3f997b580 \
+    --hash=sha256:f19ee7dc1ef8a6497570d91fa4057ba910ad98297a50b8c44ff37589f7c89d17 \
+    --hash=sha256:f2f94355affd51088f57f8674b0e294704c3c7c3d7d3b1545310f5b135d4843b \
+    --hash=sha256:f525734382a47f9828c9d6a1501522c78d5935466d8e2be1a41ba40ca5bb922b \
+    --hash=sha256:f915a34fb742e23d0d61573349aa45d6f74037fde9d58a9f340435eff8d62736
+    # via redis
+hpack==4.1.0 \
+    --hash=sha256:157ac792668d995c657d93111f46b4535ed114f0c9c8d672271bbec7eae1b496 \
+    --hash=sha256:ec5eca154f7056aa06f196a557655c5b009b382873ac8d1e66e79e87535f1dca
+    # via h2
+httpcore==1.0.9 \
+    --hash=sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55 \
+    --hash=sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8
+    # via httpx
+httptools==0.7.1 \
+    --hash=sha256:04c6c0e6c5fb0739c5b8a9eb046d298650a0ff38cf42537fc372b28dc7e4472c \
+    --hash=sha256:0d92b10dbf0b3da4823cde6a96d18e6ae358a9daa741c71448975f6a2c339cad \
+    --hash=sha256:0e68b8582f4ea9166be62926077a3334064d422cf08ab87d8b74664f8e9058e1 \
+    --hash=sha256:11d01b0ff1fe02c4c32d60af61a4d613b74fad069e47e06e9067758c01e9ac78 \
+    --hash=sha256:135fbe974b3718eada677229312e97f3b31f8a9c8ffa3ae6f565bf808d5b6bcb \
+    --hash=sha256:2c15f37ef679ab9ecc06bfc4e6e8628c32a8e4b305459de7cf6785acd57e4d03 \
+    --hash=sha256:322d00c2068d125bd570f7bf78b2d367dad02b919d8581d7476d8b75b294e3e6 \
+    --hash=sha256:379b479408b8747f47f3b253326183d7c009a3936518cdb70db58cffd369d9df \
+    --hash=sha256:38e0c83a2ea9746ebbd643bdfb521b9aa4a91703e2cd705c20443405d2fd16a5 \
+    --hash=sha256:3e14f530fefa7499334a79b0cf7e7cd2992870eb893526fb097d51b4f2d0f321 \
+    --hash=sha256:44c8f4347d4b31269c8a9205d8a5ee2df5322b09bbbd30f8f862185bb6b05346 \
+    --hash=sha256:465275d76db4d554918aba40bf1cbebe324670f3dfc979eaffaa5d108e2ed650 \
+    --hash=sha256:474d3b7ab469fefcca3697a10d11a32ee2b9573250206ba1e50d5980910da657 \
+    --hash=sha256:49794f9250188a57fa73c706b46cb21a313edb00d337ca4ce1a011fe3c760b28 \
+    --hash=sha256:5ddbd045cfcb073db2449563dd479057f2c2b681ebc232380e63ef15edc9c023 \
+    --hash=sha256:601b7628de7504077dd3dcb3791c6b8694bbd967148a6d1f01806509254fb1ca \
+    --hash=sha256:654968cb6b6c77e37b832a9be3d3ecabb243bbe7a0b8f65fbc5b6b04c8fcabed \
+    --hash=sha256:69d4f9705c405ae3ee83d6a12283dc9feba8cc6aaec671b412917e644ab4fa66 \
+    --hash=sha256:6babce6cfa2a99545c60bfef8bee0cc0545413cb0018f617c8059a30ad985de3 \
+    --hash=sha256:7347714368fb2b335e9063bc2b96f2f87a9ceffcd9758ac295f8bbcd3ffbc0ca \
+    --hash=sha256:7aea2e3c3953521c3c51106ee11487a910d45586e351202474d45472db7d72d3 \
+    --hash=sha256:7fe6e96090df46b36ccfaf746f03034e5ab723162bc51b0a4cf58305324036f2 \
+    --hash=sha256:84d86c1e5afdc479a6fdabf570be0d3eb791df0ae727e8dbc0259ed1249998d4 \
+    --hash=sha256:a3c3b7366bb6c7b96bd72d0dbe7f7d5eead261361f013be5f6d9590465ea1c70 \
+    --hash=sha256:abd72556974f8e7c74a259655924a717a2365b236c882c3f6f8a45fe94703ac9 \
+    --hash=sha256:ac50afa68945df63ec7a2707c506bd02239272288add34539a2ef527254626a4 \
+    --hash=sha256:aeefa0648362bb97a7d6b5ff770bfb774930a327d7f65f8208394856862de517 \
+    --hash=sha256:b580968316348b474b020edf3988eecd5d6eec4634ee6561e72ae3a2a0e00a8a \
+    --hash=sha256:c08fe65728b8d70b6923ce31e3956f859d5e1e8548e6f22ec520a962c6757270 \
+    --hash=sha256:c8c751014e13d88d2be5f5f14fc8b89612fcfa92a9cc480f2bc1598357a23a05 \
+    --hash=sha256:cad6b591a682dcc6cf1397c3900527f9affef1e55a06c4547264796bbd17cf5e \
+    --hash=sha256:cbf8317bfccf0fed3b5680c559d3459cccf1abe9039bfa159e62e391c7270568 \
+    --hash=sha256:cfabda2a5bb85aa2a904ce06d974a3f30fb36cc63d7feaddec05d2050acede96 \
+    --hash=sha256:d169162803a24425eb5e4d51d79cbf429fd7a491b9e570a55f495ea55b26f0bf \
+    --hash=sha256:d496e2f5245319da9d764296e86c5bb6fcf0cf7a8806d3d000717a889c8c0b7b \
+    --hash=sha256:de987bb4e7ac95b99b805b99e0aae0ad51ae61df4263459d36e07cf4052d8b3a \
+    --hash=sha256:df091cf961a3be783d6aebae963cc9b71e00d57fa6f149025075217bc6a55a7b \
+    --hash=sha256:e99c7b90a29fd82fea9ef57943d501a16f3404d7b9ee81799d41639bdaae412c \
+    --hash=sha256:eb844698d11433d2139bbeeb56499102143beb582bd6c194e3ba69c22f25c274 \
+    --hash=sha256:f084813239e1eb403ddacd06a30de3d3e09a9b76e7894dcda2b22f8a726e9c60 \
+    --hash=sha256:f25bbaf1235e27704f1a7b86cd3304eabc04f569c828101d94a0e605ef7205a5 \
+    --hash=sha256:f65744d7a8bdb4bda5e1fa23e4ba16832860606fcc09d674d56e425e991539ec \
+    --hash=sha256:f72fdbae2dbc6e68b8239defb48e6a5937b12218e6ffc2c7846cc37befa84362
+    # via uvicorn
+httpx==0.28.1 \
+    --hash=sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc \
+    --hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad
+    # via
+    #   fastmcp
+    #   huggingface-hub
+    #   litellm
+    #   mcp
+    #   mcp-agent-mail
+    #   openai
+httpx-sse==0.4.3 \
+    --hash=sha256:0ac1c9fe3c0afad2e0ebb25a934a59f4c7823b60792691f779fad2c5568830fc \
+    --hash=sha256:9b1ed0127459a66014aec3c56bebd93da3c1bc8bb6618c8082039a44889a755d
+    # via mcp
+huggingface-hub==1.12.0 \
+    --hash=sha256:7c3fe85e24b652334e5d456d7a812cd9a071e75630fac4365d9165ab5e4a34b6 \
+    --hash=sha256:d74939969585ee35748bd66de09baf84099d461bda7287cd9043bfb99b0e424d
+    # via tokenizers
+hyperframe==6.1.0 \
+    --hash=sha256:b03380493a519fce58ea5af42e4a42317bf9bd425596f7a0835ffce80f1a42e5 \
+    --hash=sha256:f630908a00854a7adeabd6382b43923a4c4cd4b821fcb527e6ab9e15382a3b08
+    # via h2
+idna==3.13 \
+    --hash=sha256:585ea8fe5d69b9181ec1afba340451fba6ba764af97026f92a91d4eef164a242 \
+    --hash=sha256:892ea0cde124a99ce773decba204c5552b69c3c67ffd5f232eb7696135bc8bb3
+    # via
+    #   anyio
+    #   email-validator
+    #   httpx
+    #   requests
+    #   yarl
+importlib-metadata==8.5.0 \
+    --hash=sha256:45e54197d28b7a7f1559e60b95e7c567032b602131fbd588f1497f47880aa68b \
+    --hash=sha256:71522656f0abace1d072b9e5481a48f07c138e00f079c38c8f883823f9c26bd7
+    # via litellm
+jaraco-classes==3.4.0 \
+    --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
+    --hash=sha256:f662826b6bed8cace05e7ff873ce0f9283b5c924470fe664fff1c2f00f581790
+    # via keyring
+jaraco-context==6.1.2 \
+    --hash=sha256:bf8150b79a2d5d91ae48629d8b427a8f7ba0e1097dd6202a9059f29a36379535 \
+    --hash=sha256:f1a6c9d391e661cc5b8d39861ff077a7dc24dc23833ccee564b234b81c82dfe3
+    # via keyring
+jaraco-functools==4.4.0 \
+    --hash=sha256:9eec1e36f45c818d9bf307c8948eb03b2b56cd44087b3cdc989abca1f20b9176 \
+    --hash=sha256:da21933b0417b89515562656547a77b4931f98176eb173644c0d35032a33d6bb
+    # via keyring
+jeepney==0.9.0 \
+    --hash=sha256:97e5714520c16fc0a45695e5365a2e11b81ea79bba796e26f9f1d178cb182683 \
+    --hash=sha256:cf0e9e845622b81e4a28df94c40345400256ec608d0e55bb8a3feaa9163f5732
+    # via
+    #   keyring
+    #   secretstorage
+jinja2==3.1.6 \
+    --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
+    --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
+    # via
+    #   litellm
+    #   mcp-agent-mail
+jiter==0.14.0 \
+    --hash=sha256:004df5fdb8ecbd6d99f3227df18ba1a259254c4359736a2e6f036c944e02d7c5 \
+    --hash=sha256:02c4a7ab56f746014874f2c525584c0daca1dec37f66fd707ecef3b7e5c2228c \
+    --hash=sha256:02f36a5c700f105ac04a6556fe664a59037a2c200db3b7e88784fac2ddf02531 \
+    --hash=sha256:0ac9cbaa86c10996b92bd12c91659b60f939f8e28fcfa6bc11a0e90a774ce95b \
+    --hash=sha256:0fbad7aa06f87e8215d660fc6f05a9b07b58751a29967bbd9c81ff22d21dbe8c \
+    --hash=sha256:107465250de4fce00fdb47166bcd51df8e634e049541174fe3c71848e44f52ce \
+    --hash=sha256:14c0cb10337c49f5eafe8e7364daca5e29a020ea03580b8f8e6c597fed4e1588 \
+    --hash=sha256:155dab67beac8d66cec9479c93ee2cbe7bfbc67509e5c2860e02ec2d9b0ecca1 \
+    --hash=sha256:1aca29ba52913f78362ec9c2da62f22cdc4c3083313403f90c15460979b84d9b \
+    --hash=sha256:1bf7ff85517dd2f20a5750081d2b75083c1b269cf75afc7511bdf1f9548beb3b \
+    --hash=sha256:215a6cb8fb7dc702aa35d475cc00ddc7f970e5c0b1417fb4b4ac5d82fa2a29db \
+    --hash=sha256:23ad2a7a9da1935575c820428dd8d2490ce4d23189691ce33da1fc0a58e14e1c \
+    --hash=sha256:2492e5f06c36a976d25c7cc347a60e26d5470178d44cde1b9b75e60b4e519f28 \
+    --hash=sha256:260bf7ca20704d58d41f669e5e9fe7fe2fa72901a6b324e79056f5d52e9c9be2 \
+    --hash=sha256:26679d58ba816f88c3849306dd58cb863a90a1cf352cdd4ef67e30ccf8a77994 \
+    --hash=sha256:2d45fc7ea86a46bd9b5bceb9e8d43e5d10a392378713fb32cf1ce851b4b0d1f8 \
+    --hash=sha256:2e692633a12cda97e352fdcd1c4acc971b1c28707e1e33aeef782b0cbf051975 \
+    --hash=sha256:2f7877ed45118de283786178eceaf877110abacd04fde31efff3940ae9672674 \
+    --hash=sha256:2fb2ce3a7bc331256dfb14cefc34832366bb28a9aca81deaf43bbf2a5659e607 \
+    --hash=sha256:32959d7285d1d0deb5a8c913349e476ad9271b384f3e54cca1931c4075f54c6e \
+    --hash=sha256:33a20d838b91ef376b3a56896d5b04e725c7df5bc4864cc6569cf046a8d73b6d \
+    --hash=sha256:34f19dcc35cb1abe7c369b3756babf8c7f04595c0807a848df8f26ef8298ef92 \
+    --hash=sha256:351bf6eda4e3a7ceb876377840c702e9a3e4ecc4624dbfb2d6463c67ae52637d \
+    --hash=sha256:376e9dafff914253bb9d46cdc5f7965607fbe7feb0a491c34e35f92b2770702e \
+    --hash=sha256:37826e3df29e60f30a382f9294348d0238ef127f4b5d7f5f8da78b5b9e050560 \
+    --hash=sha256:3a99c1387b1f2928f799a9de899193484d66206a50e98233b6b088a7f0c1edb2 \
+    --hash=sha256:41eab6c09ceffb6f0fe25e214b3068146edb1eda3649ca2aee2a061029c7ba2e \
+    --hash=sha256:42d6ed359ac49eb922fdd565f209c57340aa06d589c84c8413e42a0f9ae1b842 \
+    --hash=sha256:432c4db5255d86a259efde91e55cb4c8d18c0521d844c9e2e7efcce3899fb016 \
+    --hash=sha256:4927d09b3e572787cc5e0a5318601448e1ab9391bcef95677f5840c2d00eaa6d \
+    --hash=sha256:4b77da71f6e819be5fbcec11a453fde5b1d0267ef6ed487e2a392fd8e14e4e3a \
+    --hash=sha256:4e9178be60e229b1b2b0710f61b9e24d1f4f8556985a83ff4c4f95920eea7314 \
+    --hash=sha256:4ea73187627bcc5810e085df715e8a99da8bdfd96a7eb36b4b4df700ba6d4c9c \
+    --hash=sha256:5252a7ca23785cef5d02d4ece6077a1b556a410c591b379f82091c3001e14844 \
+    --hash=sha256:5419d4aa2024961da9fe12a9cfe7484996735dca99e8e090b5c88595ef1951ff \
+    --hash=sha256:54b3ddf5786bc7732d293bba3411ac637ecfa200a39983166d1df86a59a43c9f \
+    --hash=sha256:55bee2b6a2657434984d9144c20cf27ba3b6acd495539539953e447778515efd \
+    --hash=sha256:59940ef6ac9f8b34c800838416f105f0503485fa8d71cae99f71d44a7285b01e \
+    --hash=sha256:5c001d5a646c2a50dc055dd526dad5d5245969e8234d2b1131d0451e81f3a373 \
+    --hash=sha256:5cf4d4c109641f9cfaf4a7b6aebd51654e405cd00fa9ebbf87163b8b97b325aa \
+    --hash=sha256:5dec7c0a3e98d2a3f8a2e67382d0d7c3ac60c69103a4b271da889b4e8bb1e129 \
+    --hash=sha256:6112f26f5afc75bcb475787d29da3aa92f9d09c7858f632f4be6ffe607be82e9 \
+    --hash=sha256:62fe2451f8fcc0240261e6a4df18ecbcd58327857e61e625b2393ea3b468aac9 \
+    --hash=sha256:645be49c46f2900937ba0eaf871ad5183c96858c0af74b6becc7f4e367e36e06 \
+    --hash=sha256:651a8758dd413c51e3b7f6557cdc6921faf70b14106f45f969f091f5cda990ea \
+    --hash=sha256:67f00d94b281174144d6532a04b66a12cb866cbdc47c3af3bfe2973677f9861a \
+    --hash=sha256:69539d936fb5d55caf6ecd33e2e884de083ff0ea28579780d56c4403094bb8d9 \
+    --hash=sha256:6ae66782ecffb1a266e1a07f5abbfc3832afdd260fc9b478982c3f8e01eba5fa \
+    --hash=sha256:6dd689f5f4a5a33747b28686e051095beb214fe28cfda5e9fe58a295a788f593 \
+    --hash=sha256:6f396837fc7577871ca8c12edaf239ed9ccef3bbe39904ae9b8b63ce0a48b140 \
+    --hash=sha256:7054adcdeb06b46efd17b5734f75817a44a2d06d3748e36c3a023a1bb52af9ec \
+    --hash=sha256:71527ce13fd5a0c4e40ad37331f8c547177dbb2dd0a93e5278b6a5eecf748804 \
+    --hash=sha256:7282342d32e357543565286b6450378c3cd402eea333fc1ebe146f1fabb306fc \
+    --hash=sha256:758d19dae7ea4c4da3cbc463dc323d1660e7353144ef17509ff43beab6da5a47 \
+    --hash=sha256:7609cfbe3a03d37bfdbf5052012d5a879e72b83168a363deae7b3a26564d57de \
+    --hash=sha256:77f4ea612fe8b84b8b04e51d0e78029ecf3466348e25973f953de6e6a59aa4c1 \
+    --hash=sha256:78a4c677fe5689e0e129b39f5affe9210a500b6620ebb0386ebccf5922bee9a6 \
+    --hash=sha256:78d918a68b26e9fab068c2b5453577ef04943ab2807b9a6275df2a812599a310 \
+    --hash=sha256:7b25beaa0d4447ea8c7ae0c18c688905d34840d7d0b937f2f7bdd52162c98a40 \
+    --hash=sha256:7d9d51eb96c82a9652933bd769fe6de66877d6eb2b2440e281f2938c51b5643e \
+    --hash=sha256:7e791e247b8044512e070bd1f3633dc08350d32776d2d6e7473309d0edf256a2 \
+    --hash=sha256:7ede4331a1899d604463369c730dbb961ffdc5312bc7f16c41c2896415b1304a \
+    --hash=sha256:801028dcfc26ac0895e4964cbc0fd62c73be9fd4a7d7b1aaf6e5790033a719b7 \
+    --hash=sha256:80381f5a19af8fa9aef743f080e34f6b25ebd89656475f8cf0470ec6157052aa \
+    --hash=sha256:834bb5bdabca2e91592a03d373838a8d0a1b8bbde7077ae6913fd2fc51812d00 \
+    --hash=sha256:844e73b6c56b505e9e169234ea3bdea2ea43f769f847f47ac559ba1d2361ebea \
+    --hash=sha256:85581c4c3e4060fe3424cdfd7f3aa610f2dc5e9dde8b6863358eb68560018472 \
+    --hash=sha256:882bcb9b334318e233950b8be366fe5f92c86b66a7e449e76975dfd6d776a01f \
+    --hash=sha256:8b39b7d87a952b79949af5fef44d2544e58c21a28da7f1bae3ef166455c61746 \
+    --hash=sha256:92cd8b6025981a041f5310430310b55b25ca593972c16407af8837d3d7d2ca01 \
+    --hash=sha256:9b8c571a5dba09b98bd3462b5a53f27209a5cbbe85670391692ede71974e979f \
+    --hash=sha256:9f541eaf7bb8382367a1a23d6fc3d6aad57f8dd8c18c3c17f838bee20f217220 \
+    --hash=sha256:a25ffa2dbbdf8721855612f6dca15c108224b12d0c4024d0ac3d7902132b4211 \
+    --hash=sha256:a4d50ea3d8ba4176f79754333bd35f1bbcd28e91adc13eb9b7ca91bc52a6cef9 \
+    --hash=sha256:a7e4ccff04ec03614e62c613e976a3a5860dc9714ce8266f44328bdc8b1cab2c \
+    --hash=sha256:ab18d11074485438695f8d34a1b6da61db9754248f96d51341956607a8f39985 \
+    --hash=sha256:ad425b087aafb4a1c7e1e98a279200743b9aaf30c3e0ba723aec93f061bd9bc8 \
+    --hash=sha256:ae039aaef8de3f8157ecc1fdd4d85043ac4f57538c245a0afaecb8321ec951c3 \
+    --hash=sha256:af72f204cf4d44258e5b4c1745130ac45ddab0e71a06333b01de660ab4187a94 \
+    --hash=sha256:b08997c35aee1201c1a5361466a8fb9162d03ae7bf6568df70b6c859f1e654a4 \
+    --hash=sha256:b80c7b41a628e6be2213ad0ece763c5f88aa5ee003fa394d58acaaee1f4b8342 \
+    --hash=sha256:bd77945f38866a448e73b0b7637366afa814d4617790ecd88a18ca74377e6c02 \
+    --hash=sha256:be808176a6a3a14321d18c603f2d40741858a7c4fc982f83232842689fe86dd9 \
+    --hash=sha256:c1dcfbeb93d9ecd9ca128bbf8910120367777973fa193fb9a39c31237d8df165 \
+    --hash=sha256:c409578cbd77c338975670ada777add4efd53379667edf0aceea730cabede6fb \
+    --hash=sha256:c6279c63849444a4fe9b9abf82e5df0fc7d13dea07f53f084b362485bd1f2bbe \
+    --hash=sha256:c8ef8791c3e78d6c6b157c6d360fbb5c715bebb8113bc6a9303c5caff012754a \
+    --hash=sha256:cb8b682d10cb0cce7ff4c1af7244af7022c9b01ae16d46c357bdd0df13afb25d \
+    --hash=sha256:ce17f8a050447d1b4153bda4fb7d26e6a9e74eb4f4a41913f30934c5075bf615 \
+    --hash=sha256:cff5708f7ed0fa098f2b53446c6fa74c48469118e5cd7497b4f1cd569ab06928 \
+    --hash=sha256:d597cd1bf6790376f3fffc7c708766e57301d99a19314824ea0ccc9c3c70e1e2 \
+    --hash=sha256:d824ca4148b705970bf4e120924a212fdfca9859a73e42bd7889a63a4ea6bb98 \
+    --hash=sha256:df63a14878da754427926281626fd3ee249424a186e25a274e78176d42945264 \
+    --hash=sha256:e1765c3ef3ea31fe6e282376a16def1a96f5f11a0235055696c18d9d23ff30cb \
+    --hash=sha256:e1a7eead856a5038a8d291f1447176ab0b525c77a279a058121b5fccee257f6f \
+    --hash=sha256:e52c076f187405fc21523c746c04399c9af8ece566077ed147b2126f2bcba577 \
+    --hash=sha256:e74663b8b10da1fe0f4e4703fd7980d24ad17174b6bb35d8498d6e3ebce2ae6a \
+    --hash=sha256:e89bcd7d426a75bb4952c696b267075790d854a07aad4c9894551a82c5b574ab \
+    --hash=sha256:e8a39e66dac7153cf3f964a12aad515afa8d74938ec5cc0018adcdae5367c79e \
+    --hash=sha256:ee4a72f12847ef29b072aee9ad5474041ab2924106bdca9fcf5d7d965853e057 \
+    --hash=sha256:f16b76d7d6aadbbaf7f79a76ff3a51dae14b7ebaaf9c1ba61607784ef51c537c \
+    --hash=sha256:f2d4c61da0821ee42e0cdf5489da60a6d074306313a377c2b35af464955a3611 \
+    --hash=sha256:f4f1c4b125e1652aefbc2e2c1617b60a160ab789d180e3d423c41439e5f32850 \
+    --hash=sha256:fb3dbf7cc0d4dbe73cce307ebe7eefa7f73a7d3d854dd119ea0c243f03e40927 \
+    --hash=sha256:fbd9e482663ca9d005d051330e4d2d8150bb208a209409c10f7e7dfdf7c49da9 \
+    --hash=sha256:fc4ab96a30fb3cb2c7e0cd33f7616c8860da5f5674438988a54ac717caccdbaa \
+    --hash=sha256:fc7e37b4b8bc7e80a63ad6cfa5fc11fab27dbfea4cc4ae644b1ab3f273dc348f \
+    --hash=sha256:ff3a6465b3a0f54b1a430f45c3c0ba7d61ceb45cbc3e33f9e1a7f638d690baf3 \
+    --hash=sha256:ffb2a08a406465bb076b7cc1df41d833106d3cf7905076cc73f0cb90078c7d10
+    # via openai
+jsonschema==4.23.0 \
+    --hash=sha256:d71497fef26351a33265337fa77ffeb82423f3ea21283cd9467bb03999266bc4 \
+    --hash=sha256:fbadb6f8b144a8f8cf9f0b89ba94501d143e50411a1278633f56a7acf7fd5566
+    # via
+    #   litellm
+    #   mcp
+    #   mcp-agent-mail
+jsonschema-path==0.4.6 \
+    --hash=sha256:451354b5311fa955c3144e6e4e255388c751c0121c5570ec5bb9291dd42d08c9 \
+    --hash=sha256:c89eb635f4d497c9ac328eeff359c489755838806a7d033510a692e9576f5c4b
+    # via fastmcp
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \
+    --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d
+    # via jsonschema
+keyring==25.7.0 \
+    --hash=sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f \
+    --hash=sha256:fe01bd85eb3f8fb3dd0405defdeac9a5b4f6f0439edbb3149577f244a2e8245b
+    # via py-key-value-aio
+litellm==1.83.14 \
+    --hash=sha256:24aef9b47cdc424c833e32f3727f411741c690832cd1fe4405e0077144fe09c9 \
+    --hash=sha256:92b11ba2a32cf80707ddf388d18526696c7999a21b418c5e3b6eda1243d2cfdb
+    # via mcp-agent-mail
+markdown-it-py==4.0.0 \
+    --hash=sha256:87327c59b172c5011896038353a81343b6754500a08cd7a4973bb48c6d578147 \
+    --hash=sha256:cb0a2b4aa34f932c007117b194e945bd74e0ec24133ceb5bac59009cda1cb9f3
+    # via rich
+markdown2==2.5.5 \
+    --hash=sha256:001547e68f6e7fcf0f1cb83f7e82f48aa7d48b2c6a321f0cd20a853a8a2d1664 \
+    --hash=sha256:be798587e09d1f52d2e4d96a649c4b82a778c75f9929aad52a2c95747fa26941
+    # via mcp-agent-mail
+markupsafe==3.0.3 \
+    --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
+    --hash=sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a \
+    --hash=sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf \
+    --hash=sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19 \
+    --hash=sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf \
+    --hash=sha256:0f4b68347f8c5eab4a13419215bdfd7f8c9b19f2b25520968adfad23eb0ce60c \
+    --hash=sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175 \
+    --hash=sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219 \
+    --hash=sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb \
+    --hash=sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6 \
+    --hash=sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab \
+    --hash=sha256:15d939a21d546304880945ca1ecb8a039db6b4dc49b2c5a400387cdae6a62e26 \
+    --hash=sha256:177b5253b2834fe3678cb4a5f0059808258584c559193998be2601324fdeafb1 \
+    --hash=sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce \
+    --hash=sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218 \
+    --hash=sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634 \
+    --hash=sha256:1ba88449deb3de88bd40044603fafffb7bc2b055d626a330323a9ed736661695 \
+    --hash=sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad \
+    --hash=sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73 \
+    --hash=sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c \
+    --hash=sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe \
+    --hash=sha256:2a15a08b17dd94c53a1da0438822d70ebcd13f8c3a95abe3a9ef9f11a94830aa \
+    --hash=sha256:2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559 \
+    --hash=sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa \
+    --hash=sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37 \
+    --hash=sha256:3537e01efc9d4dccdf77221fb1cb3b8e1a38d5428920e0657ce299b20324d758 \
+    --hash=sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f \
+    --hash=sha256:38664109c14ffc9e7437e86b4dceb442b0096dfe3541d7864d9cbe1da4cf36c8 \
+    --hash=sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d \
+    --hash=sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c \
+    --hash=sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97 \
+    --hash=sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a \
+    --hash=sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19 \
+    --hash=sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9 \
+    --hash=sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9 \
+    --hash=sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc \
+    --hash=sha256:591ae9f2a647529ca990bc681daebdd52c8791ff06c2bfa05b65163e28102ef2 \
+    --hash=sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4 \
+    --hash=sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354 \
+    --hash=sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50 \
+    --hash=sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698 \
+    --hash=sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9 \
+    --hash=sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b \
+    --hash=sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc \
+    --hash=sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115 \
+    --hash=sha256:7c3fb7d25180895632e5d3148dbdc29ea38ccb7fd210aa27acbd1201a1902c6e \
+    --hash=sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485 \
+    --hash=sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f \
+    --hash=sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12 \
+    --hash=sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025 \
+    --hash=sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009 \
+    --hash=sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d \
+    --hash=sha256:949b8d66bc381ee8b007cd945914c721d9aba8e27f71959d750a46f7c282b20b \
+    --hash=sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a \
+    --hash=sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5 \
+    --hash=sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f \
+    --hash=sha256:a320721ab5a1aba0a233739394eb907f8c8da5c98c9181d1161e77a0c8e36f2d \
+    --hash=sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1 \
+    --hash=sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287 \
+    --hash=sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6 \
+    --hash=sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f \
+    --hash=sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581 \
+    --hash=sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed \
+    --hash=sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b \
+    --hash=sha256:c0c0b3ade1c0b13b936d7970b1d37a57acde9199dc2aecc4c336773e1d86049c \
+    --hash=sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026 \
+    --hash=sha256:c4ffb7ebf07cfe8931028e3e4c85f0357459a3f9f9490886198848f4fa002ec8 \
+    --hash=sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676 \
+    --hash=sha256:d2ee202e79d8ed691ceebae8e0486bd9a2cd4794cec4824e1c99b6f5009502f6 \
+    --hash=sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e \
+    --hash=sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d \
+    --hash=sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d \
+    --hash=sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01 \
+    --hash=sha256:df2449253ef108a379b8b5d6b43f4b1a8e81a061d6537becd5582fba5f9196d7 \
+    --hash=sha256:e1c1493fb6e50ab01d20a22826e57520f1284df32f2d8601fdd90b6304601419 \
+    --hash=sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795 \
+    --hash=sha256:e2103a929dfa2fcaf9bb4e7c091983a49c9ac3b19c9061b6d5427dd7d14d81a1 \
+    --hash=sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5 \
+    --hash=sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d \
+    --hash=sha256:e8fc20152abba6b83724d7ff268c249fa196d8259ff481f3b1476383f8f24e42 \
+    --hash=sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe \
+    --hash=sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda \
+    --hash=sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e \
+    --hash=sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737 \
+    --hash=sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523 \
+    --hash=sha256:f42d0984e947b8adf7dd6dde396e720934d12c506ce84eea8476409563607591 \
+    --hash=sha256:f71a396b3bf33ecaa1626c255855702aca4d3d9fea5e051b41ac59a9c1c41edc \
+    --hash=sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a \
+    --hash=sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50
+    # via jinja2
+mcp==1.27.0 \
+    --hash=sha256:5ce1fa81614958e267b21fb2aa34e0aea8e2c6ede60d52aba45fd47246b4d741 \
+    --hash=sha256:d3dc35a7eec0d458c1da4976a48f982097ddaab87e278c5511d5a4a56e852b83
+    # via fastmcp
+mcp-agent-mail @ https://github.com/Dicklesworthstone/mcp_agent_mail/archive/32783f6848bd63c425c4b5004cee3350016635fb.tar.gz \
+    --hash=sha256:8ffe6d9ee8665e957a83a885e5f45d0ad2733f5a50a1e4ec4479e66ef625e35a
+    # via -r .github/requirements/mcp-agent-mail.in
+mdurl==0.1.2 \
+    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
+    --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
+    # via markdown-it-py
+more-itertools==11.0.2 \
+    --hash=sha256:392a9e1e362cbc106a2457d37cabf9b36e5e12efd4ebff1654630e76597df804 \
+    --hash=sha256:6e35b35f818b01f691643c6c611bc0902f2e92b46c18fffa77ae1e7c46e912e4
+    # via
+    #   jaraco-classes
+    #   jaraco-functools
+multidict==6.7.1 \
+    --hash=sha256:026d264228bcd637d4e060844e39cdc60f86c479e463d49075dedc21b18fbbe0 \
+    --hash=sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9 \
+    --hash=sha256:0458c978acd8e6ea53c81eefaddbbee9c6c5e591f41b3f5e8e194780fe026581 \
+    --hash=sha256:067343c68cd6612d375710f895337b3a98a033c94f14b9a99eff902f205424e2 \
+    --hash=sha256:08ccb2a6dc72009093ebe7f3f073e5ec5964cba9a706fa94b1a1484039b87941 \
+    --hash=sha256:0b38ebffd9be37c1170d33bc0f36f4f262e0a09bc1aac1c34c7aa51a7293f0b3 \
+    --hash=sha256:0b4c48648d7649c9335cf1927a8b87fa692de3dcb15faa676c6a6f1f1aabda43 \
+    --hash=sha256:0d17522c37d03e85c8098ec8431636309b2682cf12e58f4dbc76121fb50e4962 \
+    --hash=sha256:0e161ddf326db5577c3a4cc2d8648f81456e8a20d40415541587a71620d7a7d1 \
+    --hash=sha256:0e697826df7eb63418ee190fd06ce9f1803593bb4b9517d08c60d9b9a7f69d8f \
+    --hash=sha256:10ae39c9cfe6adedcdb764f5e8411d4a92b055e35573a2eaa88d3323289ef93c \
+    --hash=sha256:121a34e5bfa410cdf2c8c49716de160de3b1dbcd86b49656f5681e4543bcd1a8 \
+    --hash=sha256:128441d052254f42989ef98b7b6a6ecb1e6f708aa962c7984235316db59f50fa \
+    --hash=sha256:12fad252f8b267cc75b66e8fc51b3079604e8d43a75428ffe193cd9e2195dfd6 \
+    --hash=sha256:14525a5f61d7d0c94b368a42cff4c9a4e7ba2d52e2672a7b23d84dc86fb02b0c \
+    --hash=sha256:17207077e29342fdc2c9a82e4b306f1127bf1ea91f8b71e02d4798a70bb99991 \
+    --hash=sha256:17307b22c217b4cf05033dabefe68255a534d637c6c9b0cc8382718f87be4262 \
+    --hash=sha256:1b99af4d9eec0b49927b4402bcbb58dea89d3e0db8806a4086117019939ad3dd \
+    --hash=sha256:1d540e51b7e8e170174555edecddbd5538105443754539193e3e1061864d444d \
+    --hash=sha256:1e3a8bb24342a8201d178c3b4984c26ba81a577c80d4d525727427460a50c22d \
+    --hash=sha256:1fa6609d0364f4f6f58351b4659a1f3e0e898ba2a8c5cac04cb2c7bc556b0bc5 \
+    --hash=sha256:21f830fe223215dffd51f538e78c172ed7c7f60c9b96a2bf05c4848ad49921c3 \
+    --hash=sha256:233b398c29d3f1b9676b4b6f75c518a06fcb2ea0b925119fb2c1bc35c05e1601 \
+    --hash=sha256:24c0cf81544ca5e17cfcb6e482e7a82cd475925242b308b890c9452a074d4505 \
+    --hash=sha256:25167cc263257660290fba06b9318d2026e3c910be240a146e1f66dd114af2b0 \
+    --hash=sha256:253282d70d67885a15c8a7716f3a73edf2d635793ceda8173b9ecc21f2fb8292 \
+    --hash=sha256:273d23f4b40f3dce4d6c8a821c741a86dec62cded82e1175ba3d99be128147ed \
+    --hash=sha256:283ddac99f7ac25a4acadbf004cb5ae34480bbeb063520f70ce397b281859362 \
+    --hash=sha256:28ca5ce2fd9716631133d0e9a9b9a745ad7f60bac2bccafb56aa380fc0b6c511 \
+    --hash=sha256:2b41f5fed0ed563624f1c17630cb9941cf2309d4df00e494b551b5f3e3d67a23 \
+    --hash=sha256:2bbd113e0d4af5db41d5ebfe9ccaff89de2120578164f86a5d17d5a576d1e5b2 \
+    --hash=sha256:2e1425e2f99ec5bd36c15a01b690a1a2456209c5deed58f95469ffb46039ccbb \
+    --hash=sha256:2e2d2ed645ea29f31c4c7ea1552fcfd7cb7ba656e1eafd4134a6620c9f5fdd9e \
+    --hash=sha256:3758692429e4e32f1ba0df23219cd0b4fc0a52f476726fff9337d1a57676a582 \
+    --hash=sha256:38fb49540705369bab8484db0689d86c0a33a0a9f2c1b197f506b71b4b6c19b0 \
+    --hash=sha256:3943debf0fbb57bdde5901695c11094a9a36723e5c03875f87718ee15ca2f4d2 \
+    --hash=sha256:398c1478926eca669f2fd6a5856b6de9c0acf23a2cb59a14c0ba5844fa38077e \
+    --hash=sha256:3ab8b9d8b75aef9df299595d5388b14530839f6422333357af1339443cff777d \
+    --hash=sha256:3bd231490fa7217cc832528e1cd8752a96f0125ddd2b5749390f7c3ec8721b65 \
+    --hash=sha256:3d51ff4785d58d3f6c91bdbffcb5e1f7ddfda557727043aa20d20ec4f65e324a \
+    --hash=sha256:3fccb473e87eaa1382689053e4a4618e7ba7b9b9b8d6adf2027ee474597128cd \
+    --hash=sha256:401c5a650f3add2472d1d288c26deebc540f99e2fb83e9525007a74cd2116f1d \
+    --hash=sha256:41f2952231456154ee479651491e94118229844dd7226541788be783be2b5108 \
+    --hash=sha256:432feb25a1cb67fe82a9680b4d65fb542e4635cb3166cd9c01560651ad60f177 \
+    --hash=sha256:439cbebd499f92e9aa6793016a8acaa161dfa749ae86d20960189f5398a19144 \
+    --hash=sha256:4885cb0e817aef5d00a2e8451d4665c1808378dc27c2705f1bf4ef8505c0d2e5 \
+    --hash=sha256:497394b3239fc6f0e13a78a3e1b61296e72bf1c5f94b4c4eb80b265c37a131cd \
+    --hash=sha256:497bde6223c212ba11d462853cfa4f0ae6ef97465033e7dc9940cdb3ab5b48e5 \
+    --hash=sha256:4cfb48c6ea66c83bcaaf7e4dfa7ec1b6bbcf751b7db85a328902796dfde4c060 \
+    --hash=sha256:538cec1e18c067d0e6103aa9a74f9e832904c957adc260e61cd9d8cf0c3b3d37 \
+    --hash=sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56 \
+    --hash=sha256:563fe25c678aaba333d5399408f5ec3c383ca5b663e7f774dd179a520b8144df \
+    --hash=sha256:57b46b24b5d5ebcc978da4ec23a819a9402b4228b8a90d9c656422b4bdd8a963 \
+    --hash=sha256:5884a04f4ff56c6120f6ccf703bdeb8b5079d808ba604d4d53aec0d55dc33568 \
+    --hash=sha256:59bc83d3f66b41dac1e7460aac1d196edc70c9ba3094965c467715a70ecb46db \
+    --hash=sha256:5a37ca18e360377cfda1d62f5f382ff41f2b8c4ccb329ed974cc2e1643440118 \
+    --hash=sha256:5c4b9bfc148f5a91be9244d6264c53035c8a0dcd2f51f1c3c6e30e30ebaa1c84 \
+    --hash=sha256:5e01429a929600e7dab7b166062d9bb54a5eed752384c7384c968c2afab8f50f \
+    --hash=sha256:5fa6a95dfee63893d80a34758cd0e0c118a30b8dcb46372bf75106c591b77889 \
+    --hash=sha256:619e5a1ac57986dbfec9f0b301d865dddf763696435e2962f6d9cf2fdff2bb71 \
+    --hash=sha256:65573858d27cdeaca41893185677dc82395159aa28875a8867af66532d413a8f \
+    --hash=sha256:6704fa2b7453b2fb121740555fa1ee20cd98c4d011120caf4d2b8d4e7c76eec0 \
+    --hash=sha256:6aac4f16b472d5b7dc6f66a0d49dd57b0e0902090be16594dc9ebfd3d17c47e7 \
+    --hash=sha256:6b10359683bd8806a200fd2909e7c8ca3a7b24ec1d8132e483d58e791d881048 \
+    --hash=sha256:6b83cabdc375ffaaa15edd97eb7c0c672ad788e2687004990074d7d6c9b140c8 \
+    --hash=sha256:6d3bc717b6fe763b8be3f2bee2701d3c8eb1b2a8ae9f60910f1b2860c82b6c49 \
+    --hash=sha256:6f77ce314a29263e67adadc7e7c1bc699fcb3a305059ab973d038f87caa42ed0 \
+    --hash=sha256:749aa54f578f2e5f439538706a475aa844bfa8ef75854b1401e6e528e4937cf9 \
+    --hash=sha256:7a7e590ff876a3eaf1c02a4dfe0724b6e69a9e9de6d8f556816f29c496046e59 \
+    --hash=sha256:7dfb78d966b2c906ae1d28ccf6e6712a3cd04407ee5088cd276fe8cb42186190 \
+    --hash=sha256:7eee46ccb30ff48a1e35bb818cc90846c6be2b68240e42a78599166722cea709 \
+    --hash=sha256:7ff981b266af91d7b4b3793ca3382e53229088d193a85dfad6f5f4c27fc73e5d \
+    --hash=sha256:841189848ba629c3552035a6a7f5bf3b02eb304e9fea7492ca220a8eda6b0e5c \
+    --hash=sha256:844c5bca0b5444adb44a623fb0a1310c2f4cd41f402126bb269cd44c9b3f3e1e \
+    --hash=sha256:84e61e3af5463c19b67ced91f6c634effb89ef8bfc5ca0267f954451ed4bb6a2 \
+    --hash=sha256:8affcf1c98b82bc901702eb73b6947a1bfa170823c153fe8a47b5f5f02e48e40 \
+    --hash=sha256:8be1802715a8e892c784c0197c2ace276ea52702a0ede98b6310c8f255a5afb3 \
+    --hash=sha256:8f333ec9c5eb1b7105e3b84b53141e66ca05a19a605368c55450b6ba208cb9ee \
+    --hash=sha256:9004d8386d133b7e6135679424c91b0b854d2d164af6ea3f289f8f2761064609 \
+    --hash=sha256:90efbcf47dbe33dcf643a1e400d67d59abeac5db07dc3f27d6bdeae497a2198c \
+    --hash=sha256:935434b9853c7c112eee7ac891bc4cb86455aa631269ae35442cb316790c1445 \
+    --hash=sha256:93b1818e4a6e0930454f0f2af7dfce69307ca03cdcfb3739bf4d91241967b6c1 \
+    --hash=sha256:95922cee9a778659e91db6497596435777bd25ed116701a4c034f8e46544955a \
+    --hash=sha256:960c83bf01a95b12b08fd54324a4eb1d5b52c88932b5cba5d6e712bb3ed12eb5 \
+    --hash=sha256:97231140a50f5d447d3164f994b86a0bed7cd016e2682f8650d6a9158e14fd31 \
+    --hash=sha256:974e72a2474600827abaeda71af0c53d9ebbc3c2eb7da37b37d7829ae31232d8 \
+    --hash=sha256:97891f3b1b3ffbded884e2916cacf3c6fc87b66bb0dde46f7357404750559f33 \
+    --hash=sha256:98655c737850c064a65e006a3df7c997cd3b220be4ec8fe26215760b9697d4d7 \
+    --hash=sha256:98bc624954ec4d2c7cb074b8eefc2b5d0ce7d482e410df446414355d158fe4ca \
+    --hash=sha256:98c5787b0a0d9a41d9311eae44c3b76e6753def8d8870ab501320efe75a6a5f8 \
+    --hash=sha256:9b0d9b91d1aa44db9c1f1ecd0d9d2ae610b2f4f856448664e01a3b35899f3f92 \
+    --hash=sha256:9c90fed18bffc0189ba814749fdcc102b536e83a9f738a9003e569acd540a733 \
+    --hash=sha256:9d624335fd4fa1c08a53f8b4be7676ebde19cd092b3895c421045ca87895b429 \
+    --hash=sha256:9f9af11306994335398293f9958071019e3ab95e9a707dc1383a35613f6abcb9 \
+    --hash=sha256:a0543217a6a017692aa6ae5cc39adb75e587af0f3a82288b1492eb73dd6cc2a4 \
+    --hash=sha256:a088b62bd733e2ad12c50dad01b7d0166c30287c166e137433d3b410add807a6 \
+    --hash=sha256:a407f13c188f804c759fc6a9f88286a565c242a76b27626594c133b82883b5c2 \
+    --hash=sha256:a90f75c956e32891a4eda3639ce6dd86e87105271f43d43442a3aedf3cddf172 \
+    --hash=sha256:a9fc4caa29e2e6ae408d1c450ac8bf19892c5fca83ee634ecd88a53332c59981 \
+    --hash=sha256:aa23b001d968faef416ff70dc0f1ab045517b9b42a90edd3e9bcdb06479e31d5 \
+    --hash=sha256:ac1c665bad8b5d762f5f85ebe4d94130c26965f11de70c708c75671297c776de \
+    --hash=sha256:af959b9beeb66c822380f222f0e0a1889331597e81f1ded7f374f3ecb0fd6c52 \
+    --hash=sha256:b0fa96985700739c4c7853a43c0b3e169360d6855780021bfc6d0f1ce7c123e7 \
+    --hash=sha256:b26684587228afed0d50cf804cc71062cc9c1cdf55051c4c6345d372947b268c \
+    --hash=sha256:b4938326284c4f1224178a560987b6cf8b4d38458b113d9b8c1db1a836e640a2 \
+    --hash=sha256:b8c990b037d2fff2f4e33d3f21b9b531c5745b33a49a7d6dbe7a177266af44f6 \
+    --hash=sha256:ba0a9fb644d0c1a2194cf7ffb043bd852cea63a57f66fbd33959f7dae18517bf \
+    --hash=sha256:bb08271280173720e9fea9ede98e5231defcbad90f1624bea26f32ec8a956e2f \
+    --hash=sha256:bdbf9f3b332abd0cdb306e7c2113818ab1e922dc84b8f8fd06ec89ed2a19ab8b \
+    --hash=sha256:bfde23ef6ed9db7eaee6c37dcec08524cb43903c60b285b172b6c094711b3961 \
+    --hash=sha256:c0abd12629b0af3cf590982c0b413b1e7395cd4ec026f30986818ab95bfaa94a \
+    --hash=sha256:c102791b1c4f3ab36ce4101154549105a53dc828f016356b3e3bcae2e3a039d3 \
+    --hash=sha256:c3a32d23520ee37bf327d1e1a656fec76a2edd5c038bf43eddfa0572ec49c60b \
+    --hash=sha256:c524c6fb8fc342793708ab111c4dbc90ff9abd568de220432500e47e990c0358 \
+    --hash=sha256:c5f0c21549ab432b57dcc82130f388d84ad8179824cc3f223d5e7cfbfd4143f6 \
+    --hash=sha256:c6b3228e1d80af737b72925ce5fb4daf5a335e49cd7ab77ed7b9fdfbf58c526e \
+    --hash=sha256:c76c4bec1538375dad9d452d246ca5368ad6e1c9039dadcf007ae59c70619ea1 \
+    --hash=sha256:c9035dde0f916702850ef66460bc4239d89d08df4d02023a5926e7446724212c \
+    --hash=sha256:c93c3db7ea657dd4637d57e74ab73de31bccefe144d3d4ce370052035bc85fb5 \
+    --hash=sha256:cb2a55f408c3043e42b40cc8eecd575afa27b7e0b956dfb190de0f8499a57a53 \
+    --hash=sha256:cdea2e7b2456cfb6694fb113066fd0ec7ea4d67e3a35e1f4cbeea0b448bf5872 \
+    --hash=sha256:ce1bbd7d780bb5a0da032e095c951f7014d6b0a205f8318308140f1a6aba159e \
+    --hash=sha256:cf37cbe5ced48d417ba045aca1b21bafca67489452debcde94778a576666a1df \
+    --hash=sha256:d4f49cb5661344764e4c7c7973e92a47a59b8fc19b6523649ec9dc4960e58a03 \
+    --hash=sha256:d54ecf9f301853f2c5e802da559604b3e95bb7a3b01a9c295c6ee591b9882de8 \
+    --hash=sha256:d62b7f64ffde3b99d06b707a280db04fb3855b55f5a06df387236051d0668f4a \
+    --hash=sha256:d82dd730a95e6643802f4454b8fdecdf08667881a9c5670db85bc5a56693f122 \
+    --hash=sha256:da62917e6076f512daccfbbde27f46fed1c98fee202f0559adec8ee0de67f71a \
+    --hash=sha256:dd96c01a9dcd4889dcfcf9eb5544ca0c77603f239e3ffab0524ec17aea9a93ee \
+    --hash=sha256:df9f19c28adcb40b6aae30bbaa1478c389efd50c28d541d76760199fc1037c32 \
+    --hash=sha256:e1c5988359516095535c4301af38d8a8838534158f649c05dd1050222321bcb3 \
+    --hash=sha256:e628ef0e6859ffd8273c69412a2465c4be4a9517d07261b33334b5ec6f3c7489 \
+    --hash=sha256:e82d14e3c948952a1a85503817e038cba5905a3352de76b9a465075d072fba23 \
+    --hash=sha256:e954b24433c768ce78ab7929e84ccf3422e46deb45a4dc9f93438f8217fa2d34 \
+    --hash=sha256:eb0ce7b2a32d09892b3dd6cc44877a0d02a33241fafca5f25c8b6b62374f8b75 \
+    --hash=sha256:eb304767bca2bb92fb9c5bd33cedc95baee5bb5f6c88e63706533a1c06ad08c8 \
+    --hash=sha256:eb351f72c26dc9abe338ca7294661aa22969ad8ffe7ef7d5541d19f368dc854a \
+    --hash=sha256:ec6652a1bee61c53a3e5776b6049172c53b6aaba34f18c9ad04f82712bac623d \
+    --hash=sha256:f2a0a924d4c2e9afcd7ec64f9de35fcd96915149b2216e1cb2c10a56df483855 \
+    --hash=sha256:f33dc2a3abe9249ea5d8360f969ec7f4142e7ac45ee7014d8f8d5acddf178b7b \
+    --hash=sha256:f537b55778cd3cbee430abe3131255d3a78202e0f9ea7ffc6ada893a4bcaeea4 \
+    --hash=sha256:f5dd81c45b05518b9aa4da4aa74e1c93d715efa234fd3e8a179df611cc85e5f4 \
+    --hash=sha256:f99fe611c312b3c1c0ace793f92464d8cd263cc3b26b5721950d977b006b6c4d \
+    --hash=sha256:fa263a02f4f2dd2d11a7b1bb4362aa7cb1049f84a9235d31adf63f30143469a0 \
+    --hash=sha256:fc5907494fccf3e7d3f94f95c91d6336b092b5fc83811720fae5e2765890dfba \
+    --hash=sha256:fcee94dfbd638784645b066074b338bc9cc155d4b4bffa4adce1615c5a426c19
+    # via
+    #   aiohttp
+    #   yarl
+openai==2.24.0 \
+    --hash=sha256:1e5769f540dbd01cb33bc4716a23e67b9d695161a734aff9c5f925e2bf99a673 \
+    --hash=sha256:fed30480d7d6c884303287bde864980a4b137b60553ffbcf9ab4a233b7a73d94
+    # via litellm
+openapi-pydantic==0.5.1 \
+    --hash=sha256:a3a09ef4586f5bd760a8df7f43028b60cafb6d9f61de2acba9574766255ab146 \
+    --hash=sha256:ff6835af6bde7a459fb93eb93bb92b8749b754fc6e51b2f1590a19dc3005ee0d
+    # via fastmcp
+orjson==3.11.8 \
+    --hash=sha256:0022bb50f90da04b009ce32c512dc1885910daa7cb10b7b0cba4505b16db82a8 \
+    --hash=sha256:003646067cc48b7fcab2ae0c562491c9b5d2cbd43f1e5f16d98fd118c5522d34 \
+    --hash=sha256:01928d0476b216ad2201823b0a74000440360cef4fed1912d297b8d84718f277 \
+    --hash=sha256:01c4e5a6695dc09098f2e6468a251bc4671c50922d4d745aff1a0a33a0cf5b8d \
+    --hash=sha256:093d489fa039ddade2db541097dbb484999fcc65fc2b0ff9819141e2ab364f25 \
+    --hash=sha256:0b57f67710a8cd459e4e54eb96d5f77f3624eba0c661ba19a525807e42eccade \
+    --hash=sha256:0e32f7154299f42ae66f13488963269e5eccb8d588a65bc839ed986919fc9fac \
+    --hash=sha256:14439063aebcb92401c11afc68ee4e407258d2752e62d748b6942dad20d2a70d \
+    --hash=sha256:14778ffd0f6896aa613951a7fbf4690229aa7a543cb2bfbe9f358e08aafa9546 \
+    --hash=sha256:14f7b8fcb35ef403b42fa5ecfa4ed032332a91f3dc7368fbce4184d59e1eae0d \
+    --hash=sha256:1ab359aff0436d80bfe8a23b46b5fea69f1e18aaf1760a709b4787f1318b317f \
+    --hash=sha256:1cd0b77e77c95758f8e1100139844e99f3ccc87e71e6fc8e1c027e55807c549f \
+    --hash=sha256:25e0c672a2e32348d2eb33057b41e754091f2835f87222e4675b796b92264f06 \
+    --hash=sha256:29c009e7a2ca9ad0ed1376ce20dd692146a5d9fe4310848904b6b4fee5c5c137 \
+    --hash=sha256:3222adff1e1ff0dce93c16146b93063a7793de6c43d52309ae321234cdaf0f4d \
+    --hash=sha256:3223665349bbfb68da234acd9846955b1a0808cbe5520ff634bf253a4407009b \
+    --hash=sha256:3cf17c141617b88ced4536b2135c552490f07799f6ad565948ea07bef0dcb9a6 \
+    --hash=sha256:3f23426851d98478c8970da5991f84784a76682213cd50eb73a1da56b95239dc \
+    --hash=sha256:3f262401086a3960586af06c054609365e98407151f5ea24a62893a40d80dbbb \
+    --hash=sha256:436c4922968a619fb7fef1ccd4b8b3a76c13b67d607073914d675026e911a65c \
+    --hash=sha256:469ac2125611b7c5741a0b3798cd9e5786cbad6345f9f400c77212be89563bec \
+    --hash=sha256:4861bde57f4d253ab041e374f44023460e60e71efaa121f3c5f0ed457c3a701e \
+    --hash=sha256:48854463b0572cc87dac7d981aa72ed8bf6deedc0511853dc76b8bbd5482d36d \
+    --hash=sha256:53a0f57e59a530d18a142f4d4ba6dfc708dc5fdedce45e98ff06b44930a2a48f \
+    --hash=sha256:54153d21520a71a4c82a0dbb4523e468941d549d221dc173de0f019678cf3813 \
+    --hash=sha256:55120759e61309af7fcf9e961c6f6af3dde5921cdb3ee863ef63fd9db126cae6 \
+    --hash=sha256:5774c1fdcc98b2259800b683b19599c133baeb11d60033e2095fd9d4667b82db \
+    --hash=sha256:58a4a208a6fbfdb7a7327b8f201c6014f189f721fd55d047cafc4157af1bc62a \
+    --hash=sha256:58fb9b17b4472c7b1dcf1a54583629e62e23779b2331052f09a9249edf81675b \
+    --hash=sha256:5d8b5231de76c528a46b57010bbd83fb51e056aa0220a372fd5065e978406f1c \
+    --hash=sha256:5f8952d6d2505c003e8f0224ff7858d341fa4e33fef82b91c4ff0ef070f2393c \
+    --hash=sha256:61c9d357a59465736022d5d9ba06687afb7611dfb581a9d2129b77a6fcf78e59 \
+    --hash=sha256:6a3d159d5ffa0e3961f353c4b036540996bf8b9697ccc38261c0eac1fd3347a6 \
+    --hash=sha256:6a4a639049c44d36a6d1ae0f4a94b271605c745aee5647fa8ffaabcdc01b69a6 \
+    --hash=sha256:6ccdea2c213cf9f3d9490cbd5d427693c870753df41e6cb375bd79bcbafc8817 \
+    --hash=sha256:6dbe9a97bdb4d8d9d5367b52a7c32549bba70b2739c58ef74a6964a6d05ae054 \
+    --hash=sha256:6eda5b8b6be91d3f26efb7dc6e5e68ee805bc5617f65a328587b35255f138bf4 \
+    --hash=sha256:705b895b781b3e395c067129d8551655642dfe9437273211d5404e87ac752b53 \
+    --hash=sha256:708c95f925a43ab9f34625e45dcdadf09ec8a6e7b664a938f2f8d5650f6c090b \
+    --hash=sha256:735e2262363dcbe05c35e3a8869898022af78f89dde9e256924dc02e99fe69ca \
+    --hash=sha256:76070a76e9c5ae661e2d9848f216980d8d533e0f8143e6ed462807b242e3c5e8 \
+    --hash=sha256:7679bc2f01bb0d219758f1a5f87bb7c8a81c0a186824a393b366876b4948e14f \
+    --hash=sha256:88006eda83858a9fdf73985ce3804e885c2befb2f506c9a3723cdeb5a2880e3e \
+    --hash=sha256:883206d55b1bd5f5679ad5e6ddd3d1a5e3cac5190482927fdb8c78fb699193b5 \
+    --hash=sha256:8ac7381c83dd3d4a6347e6635950aa448f54e7b8406a27c7ecb4a37e9f1ae08b \
+    --hash=sha256:8e8c6218b614badf8e229b697865df4301afa74b791b6c9ade01d19a9953a942 \
+    --hash=sha256:9185589c1f2a944c17e26c9925dcdbc2df061cc4a145395c57f0c51f9b5dbfcd \
+    --hash=sha256:93de06bc920854552493c81f1f729fab7213b7db4b8195355db5fda02c7d1363 \
+    --hash=sha256:96163d9cdc5a202703e9ad1b9ae757d5f0ca62f4fa0cc93d1f27b0e180cc404e \
+    --hash=sha256:97c8f5d3b62380b70c36ffacb2a356b7c6becec86099b177f73851ba095ef623 \
+    --hash=sha256:97d823831105c01f6c8029faf297633dbeb30271892bd430e9c24ceae3734744 \
+    --hash=sha256:98bdc6cb889d19bed01de46e67574a2eab61f5cc6b768ed50e8ac68e9d6ffab6 \
+    --hash=sha256:9b48e274f8824567d74e2158199e269597edf00823a1b12b63d48462bbf5123e \
+    --hash=sha256:a5c370674ebabe16c6ccac33ff80c62bf8a6e59439f5e9d40c1f5ab8fd2215b7 \
+    --hash=sha256:b43dc2a391981d36c42fa57747a49dae793ef1d2e43898b197925b5534abd10a \
+    --hash=sha256:c154a35dd1330707450bb4d4e7dd1f17fa6f42267a40c1e8a1daa5e13719b4b8 \
+    --hash=sha256:c2bdf7b2facc80b5e34f48a2d557727d5c5c57a8a450de122ae81fa26a81c1bc \
+    --hash=sha256:c492a0e011c0f9066e9ceaa896fbc5b068c54d365fea5f3444b697ee01bc8625 \
+    --hash=sha256:c60c0423f15abb6cf78f56dff00168a1b582f7a1c23f114036e2bfc697814d5f \
+    --hash=sha256:c98121237fea2f679480765abd566f7713185897f35c9e6c2add7e3a9900eb61 \
+    --hash=sha256:ccd7ba1b0605813a0715171d39ec4c314cb97a9c85893c2c5c0c3a3729df38bf \
+    --hash=sha256:cdbc8c9c02463fef4d3c53a9ba3336d05496ec8e1f1c53326a1e4acc11f5c600 \
+    --hash=sha256:e0950ed1bcb9893f4293fd5c5a7ee10934fbf82c4101c70be360db23ce24b7d2 \
+    --hash=sha256:e6693ff90018600c72fd18d3d22fa438be26076cd3c823da5f63f7bab28c11cb \
+    --hash=sha256:ea56a955056a6d6c550cf18b3348656a9d9a4f02e2d0c02cabf3c73f1055d506 \
+    --hash=sha256:ebaed4cef74a045b83e23537b52ef19a367c7e3f536751e355a2a394f8648559 \
+    --hash=sha256:ec795530a73c269a55130498842aaa762e4a939f6ce481a7e986eeaa790e9da4 \
+    --hash=sha256:ed193ce51d77a3830cad399a529cd4ef029968761f43ddc549e1bc62b40d88f8 \
+    --hash=sha256:ee8db7bfb6fe03581bbab54d7c4124a6dd6a7f4273a38f7267197890f094675f \
+    --hash=sha256:f30491bc4f862aa15744b9738517454f1e46e56c972a2be87d70d727d5b2a8f8 \
+    --hash=sha256:f89b6d0b3a8d81e1929d3ab3d92bbc225688bd80a770c49432543928fe09ac55 \
+    --hash=sha256:fa72e71977bff96567b0f500fc5bfd2fdf915f34052c782a4c6ebbdaa97aa858 \
+    --hash=sha256:fe0b8c83e0f36247fc9431ce5425a5d95f9b3a689133d494831bdbd6f0bceb13 \
+    --hash=sha256:ff51f9d657d1afb6f410cb435792ce4e1fe427aab23d2fcd727a2876e21d4cb6
+    # via mcp-agent-mail
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
+    --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661
+    # via huggingface-hub
+pathable==0.5.0 \
+    --hash=sha256:646e3d09491a6351a0c82632a09c02cdf70a252e73196b36d8a15ba0a114f0a6 \
+    --hash=sha256:d81938348a1cacb525e7c75166270644782c0fb9c8cecc16be033e71427e0ef1
+    # via jsonschema-path
+pathspec==1.1.1 \
+    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
+    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
+    # via mcp-agent-mail
+pathvalidate==3.3.1 \
+    --hash=sha256:5263baab691f8e1af96092fa5137ee17df5bdfbd6cff1fcac4d6ef4bc2e1735f \
+    --hash=sha256:b18c07212bfead624345bb8e1d6141cdcf15a39736994ea0b94035ad2b1ba177
+    # via py-key-value-aio
+pillow==12.2.0 \
+    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
+    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
+    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
+    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
+    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
+    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
+    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
+    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
+    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
+    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
+    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
+    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
+    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
+    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
+    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
+    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
+    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
+    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
+    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
+    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
+    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
+    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
+    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
+    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
+    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
+    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
+    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
+    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
+    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
+    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
+    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
+    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
+    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
+    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
+    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
+    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
+    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
+    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
+    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
+    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
+    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
+    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
+    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
+    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
+    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
+    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
+    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
+    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
+    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
+    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
+    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
+    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
+    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
+    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
+    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
+    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
+    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
+    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
+    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
+    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
+    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
+    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
+    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
+    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
+    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
+    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
+    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
+    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
+    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
+    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
+    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
+    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
+    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
+    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
+    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
+    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
+    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
+    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
+    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
+    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
+    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
+    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
+    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
+    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
+    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
+    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
+    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
+    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
+    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
+    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
+    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
+    # via mcp-agent-mail
+platformdirs==4.9.6 \
+    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
+    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+    # via fastmcp
+propcache==0.4.1 \
+    --hash=sha256:0002004213ee1f36cfb3f9a42b5066100c44276b9b72b4e1504cddd3d692e86e \
+    --hash=sha256:0013cb6f8dde4b2a2f66903b8ba740bdfe378c943c4377a200551ceb27f379e4 \
+    --hash=sha256:005f08e6a0529984491e37d8dbc3dd86f84bd78a8ceb5fa9a021f4c48d4984be \
+    --hash=sha256:031dce78b9dc099f4c29785d9cf5577a3faf9ebf74ecbd3c856a7b92768c3df3 \
+    --hash=sha256:05674a162469f31358c30bcaa8883cb7829fa3110bf9c0991fe27d7896c42d85 \
+    --hash=sha256:060b16ae65bc098da7f6d25bf359f1f31f688384858204fe5d652979e0015e5b \
+    --hash=sha256:120c964da3fdc75e3731aa392527136d4ad35868cc556fd09bb6d09172d9a367 \
+    --hash=sha256:15932ab57837c3368b024473a525e25d316d8353016e7cc0e5ba9eb343fbb1cf \
+    --hash=sha256:17612831fda0138059cc5546f4d12a2aacfb9e47068c06af35c400ba58ba7393 \
+    --hash=sha256:182b51b421f0501952d938dc0b0eb45246a5b5153c50d42b495ad5fb7517c888 \
+    --hash=sha256:1cdb7988c4e5ac7f6d175a28a9aa0c94cb6f2ebe52756a3c0cda98d2809a9e37 \
+    --hash=sha256:1eb2994229cc8ce7fe9b3db88f5465f5fd8651672840b2e426b88cdb1a30aac8 \
+    --hash=sha256:1f0978529a418ebd1f49dad413a2b68af33f85d5c5ca5c6ca2a3bed375a7ac60 \
+    --hash=sha256:204483131fb222bdaaeeea9f9e6c6ed0cac32731f75dfc1d4a567fc1926477c1 \
+    --hash=sha256:296f4c8ed03ca7476813fe666c9ea97869a8d7aec972618671b33a38a5182ef4 \
+    --hash=sha256:2ad890caa1d928c7c2965b48f3a3815c853180831d0e5503d35cf00c472f4717 \
+    --hash=sha256:2b16ec437a8c8a965ecf95739448dd938b5c7f56e67ea009f4300d8df05f32b7 \
+    --hash=sha256:2bb07ffd7eaad486576430c89f9b215f9e4be68c4866a96e97db9e97fead85dc \
+    --hash=sha256:333ddb9031d2704a301ee3e506dc46b1fe5f294ec198ed6435ad5b6a085facfe \
+    --hash=sha256:357f5bb5c377a82e105e44bd3d52ba22b616f7b9773714bff93573988ef0a5fb \
+    --hash=sha256:35c3277624a080cc6ec6f847cbbbb5b49affa3598c4535a0a4682a697aaa5c75 \
+    --hash=sha256:364426a62660f3f699949ac8c621aad6977be7126c5807ce48c0aeb8e7333ea6 \
+    --hash=sha256:381914df18634f5494334d201e98245c0596067504b9372d8cf93f4bb23e025e \
+    --hash=sha256:3d233076ccf9e450c8b3bc6720af226b898ef5d051a2d145f7d765e6e9f9bcff \
+    --hash=sha256:3d902a36df4e5989763425a8ab9e98cd8ad5c52c823b34ee7ef307fd50582566 \
+    --hash=sha256:3f7124c9d820ba5548d431afb4632301acf965db49e666aa21c305cbe8c6de12 \
+    --hash=sha256:405aac25c6394ef275dee4c709be43745d36674b223ba4eb7144bf4d691b7367 \
+    --hash=sha256:41a89040cb10bd345b3c1a873b2bf36413d48da1def52f268a055f7398514874 \
+    --hash=sha256:43eedf29202c08550aac1d14e0ee619b0430aaef78f85864c1a892294fbc28cf \
+    --hash=sha256:473c61b39e1460d386479b9b2f337da492042447c9b685f28be4f74d3529e566 \
+    --hash=sha256:49a2dc67c154db2c1463013594c458881a069fcf98940e61a0569016a583020a \
+    --hash=sha256:4b536b39c5199b96fc6245eb5fb796c497381d3942f169e44e8e392b29c9ebcc \
+    --hash=sha256:4c3c70630930447f9ef1caac7728c8ad1c56bc5015338b20fed0d08ea2480b3a \
+    --hash=sha256:4d3df5fa7e36b3225954fba85589da77a0fe6a53e3976de39caf04a0db4c36f1 \
+    --hash=sha256:4d7af63f9f93fe593afbf104c21b3b15868efb2c21d07d8732c0c4287e66b6a6 \
+    --hash=sha256:501d20b891688eb8e7aa903021f0b72d5a55db40ffaab27edefd1027caaafa61 \
+    --hash=sha256:521a463429ef54143092c11a77e04056dd00636f72e8c45b70aaa3140d639726 \
+    --hash=sha256:5558992a00dfd54ccbc64a32726a3357ec93825a418a401f5cc67df0ac5d9e49 \
+    --hash=sha256:55c72fd6ea2da4c318e74ffdf93c4fe4e926051133657459131a95c846d16d44 \
+    --hash=sha256:564d9f0d4d9509e1a870c920a89b2fec951b44bf5ba7d537a9e7c1ccec2c18af \
+    --hash=sha256:580e97762b950f993ae618e167e7be9256b8353c2dcd8b99ec100eb50f5286aa \
+    --hash=sha256:5a103c3eb905fcea0ab98be99c3a9a5ab2de60228aa5aceedc614c0281cf6153 \
+    --hash=sha256:5c3310452e0d31390da9035c348633b43d7e7feb2e37be252be6da45abd1abcc \
+    --hash=sha256:5d4e2366a9c7b837555cf02fb9be2e3167d333aff716332ef1b7c3a142ec40c5 \
+    --hash=sha256:5fd37c406dd6dc85aa743e214cef35dc54bbdd1419baac4f6ae5e5b1a2976938 \
+    --hash=sha256:60a8fda9644b7dfd5dece8c61d8a85e271cb958075bfc4e01083c148b61a7caf \
+    --hash=sha256:66c1f011f45a3b33d7bcb22daed4b29c0c9e2224758b6be00686731e1b46f925 \
+    --hash=sha256:671538c2262dadb5ba6395e26c1731e1d52534bfe9ae56d0b5573ce539266aa8 \
+    --hash=sha256:678ae89ebc632c5c204c794f8dab2837c5f159aeb59e6ed0539500400577298c \
+    --hash=sha256:67fad6162281e80e882fb3ec355398cf72864a54069d060321f6cd0ade95fe85 \
+    --hash=sha256:6918ecbd897443087a3b7cd978d56546a812517dcaaca51b49526720571fa93e \
+    --hash=sha256:6f6ff873ed40292cd4969ef5310179afd5db59fdf055897e282485043fc80ad0 \
+    --hash=sha256:6f8b465489f927b0df505cbe26ffbeed4d6d8a2bbc61ce90eb074ff129ef0ab1 \
+    --hash=sha256:71b749281b816793678ae7f3d0d84bd36e694953822eaad408d682efc5ca18e0 \
+    --hash=sha256:74c1fb26515153e482e00177a1ad654721bf9207da8a494a0c05e797ad27b992 \
+    --hash=sha256:7c2d1fa3201efaf55d730400d945b5b3ab6e672e100ba0f9a409d950ab25d7db \
+    --hash=sha256:824e908bce90fb2743bd6b59db36eb4f45cd350a39637c9f73b1c1ea66f5b75f \
+    --hash=sha256:8326e144341460402713f91df60ade3c999d601e7eb5ff8f6f7862d54de0610d \
+    --hash=sha256:8873eb4460fd55333ea49b7d189749ecf6e55bf85080f11b1c4530ed3034cba1 \
+    --hash=sha256:89eb3fa9524f7bec9de6e83cf3faed9d79bffa560672c118a96a171a6f55831e \
+    --hash=sha256:8c9b3cbe4584636d72ff556d9036e0c9317fa27b3ac1f0f558e7e84d1c9c5900 \
+    --hash=sha256:8e57061305815dfc910a3634dcf584f08168a8836e6999983569f51a8544cd89 \
+    --hash=sha256:929d7cbe1f01bb7baffb33dc14eb5691c95831450a26354cd210a8155170c93a \
+    --hash=sha256:92d1935ee1f8d7442da9c0c4fa7ac20d07e94064184811b685f5c4fada64553b \
+    --hash=sha256:948dab269721ae9a87fd16c514a0a2c2a1bdb23a9a61b969b0f9d9ee2968546f \
+    --hash=sha256:981333cb2f4c1896a12f4ab92a9cc8f09ea664e9b7dbdc4eff74627af3a11c0f \
+    --hash=sha256:990f6b3e2a27d683cb7602ed6c86f15ee6b43b1194736f9baaeb93d0016633b1 \
+    --hash=sha256:99d43339c83aaf4d32bda60928231848eee470c6bda8d02599cc4cebe872d183 \
+    --hash=sha256:9a0bd56e5b100aef69bd8562b74b46254e7c8812918d3baa700c8a8009b0af66 \
+    --hash=sha256:9a52009f2adffe195d0b605c25ec929d26b36ef986ba85244891dee3b294df21 \
+    --hash=sha256:9d2b6caef873b4f09e26ea7e33d65f42b944837563a47a94719cc3544319a0db \
+    --hash=sha256:9f302f4783709a78240ebc311b793f123328716a60911d667e0c036bc5dcbded \
+    --hash=sha256:a0ee98db9c5f80785b266eb805016e36058ac72c51a064040f2bc43b61101cdb \
+    --hash=sha256:a129e76735bc792794d5177069691c3217898b9f5cee2b2661471e52ffe13f19 \
+    --hash=sha256:a78372c932c90ee474559c5ddfffd718238e8673c340dc21fe45c5b8b54559a0 \
+    --hash=sha256:a9695397f85973bb40427dedddf70d8dc4a44b22f1650dd4af9eedf443d45165 \
+    --hash=sha256:ab08df6c9a035bee56e31af99be621526bd237bea9f32def431c656b29e41778 \
+    --hash=sha256:ab2943be7c652f09638800905ee1bab2c544e537edb57d527997a24c13dc1455 \
+    --hash=sha256:ab4c29b49d560fe48b696cdcb127dd36e0bc2472548f3bf56cc5cb3da2b2984f \
+    --hash=sha256:af223b406d6d000830c6f65f1e6431783fc3f713ba3e6cc8c024d5ee96170a4b \
+    --hash=sha256:af2a6052aeb6cf17d3e46ee169099044fd8224cbaf75c76a2ef596e8163e2237 \
+    --hash=sha256:bcc9aaa5d80322bc2fb24bb7accb4a30f81e90ab8d6ba187aec0744bc302ad81 \
+    --hash=sha256:c07fda85708bc48578467e85099645167a955ba093be0a2dcba962195676e859 \
+    --hash=sha256:c0d4b719b7da33599dfe3b22d3db1ef789210a0597bc650b7cee9c77c2be8c5c \
+    --hash=sha256:c0ef0aaafc66fbd87842a3fe3902fd889825646bc21149eafe47be6072725835 \
+    --hash=sha256:c2b5e7db5328427c57c8e8831abda175421b709672f6cfc3d630c3b7e2146393 \
+    --hash=sha256:c30b53e7e6bda1d547cabb47c825f3843a0a1a42b0496087bb58d8fedf9f41b5 \
+    --hash=sha256:c80ee5802e3fb9ea37938e7eecc307fb984837091d5fd262bb37238b1ae97641 \
+    --hash=sha256:c9b822a577f560fbd9554812526831712c1436d2c046cedee4c3796d3543b144 \
+    --hash=sha256:cae65ad55793da34db5f54e4029b89d3b9b9490d8abe1b4c7ab5d4b8ec7ebf74 \
+    --hash=sha256:cb2d222e72399fcf5890d1d5cc1060857b9b236adff2792ff48ca2dfd46c81db \
+    --hash=sha256:cbc3b6dfc728105b2a57c06791eb07a94229202ea75c59db644d7d496b698cac \
+    --hash=sha256:cd547953428f7abb73c5ad82cbb32109566204260d98e41e5dfdc682eb7f8403 \
+    --hash=sha256:cfc27c945f422e8b5071b6e93169679e4eb5bf73bbcbf1ba3ae3a83d2f78ebd9 \
+    --hash=sha256:d472aeb4fbf9865e0c6d622d7f4d54a4e101a89715d8904282bb5f9a2f476c3f \
+    --hash=sha256:d62cdfcfd89ccb8de04e0eda998535c406bf5e060ffd56be6c586cbcc05b3311 \
+    --hash=sha256:d82ad62b19645419fe79dd63b3f9253e15b30e955c0170e5cebc350c1844e581 \
+    --hash=sha256:d8f353eb14ee3441ee844ade4277d560cdd68288838673273b978e3d6d2c8f36 \
+    --hash=sha256:daede9cd44e0f8bdd9e6cc9a607fc81feb80fae7a5fc6cecaff0e0bb32e42d00 \
+    --hash=sha256:db65d2af507bbfbdcedb254a11149f894169d90488dd3e7190f7cdcb2d6cd57a \
+    --hash=sha256:dee69d7015dc235f526fe80a9c90d65eb0039103fe565776250881731f06349f \
+    --hash=sha256:e153e9cd40cc8945138822807139367f256f89c6810c2634a4f6902b52d3b4e2 \
+    --hash=sha256:e35b88984e7fa64aacecea39236cee32dd9bd8c55f57ba8a75cf2399553f9bd7 \
+    --hash=sha256:e53f3a38d3510c11953f3e6a33f205c6d1b001129f972805ca9b42fc308bc239 \
+    --hash=sha256:e9b0d8d0845bbc4cfcdcbcdbf5086886bc8157aa963c31c777ceff7846c77757 \
+    --hash=sha256:ec17c65562a827bba85e3872ead335f95405ea1674860d96483a02f5c698fa72 \
+    --hash=sha256:ecef2343af4cc68e05131e45024ba34f6095821988a9d0a02aa7c73fcc448aa9 \
+    --hash=sha256:ed5a841e8bb29a55fb8159ed526b26adc5bdd7e8bd7bf793ce647cb08656cdf4 \
+    --hash=sha256:ee17f18d2498f2673e432faaa71698032b0127ebf23ae5974eeaf806c279df24 \
+    --hash=sha256:f048da1b4f243fc44f205dfd320933a951b8d89e0afd4c7cacc762a8b9165207 \
+    --hash=sha256:f10207adf04d08bec185bae14d9606a1444715bc99180f9331c9c02093e1959e \
+    --hash=sha256:f1d2f90aeec838a52f1c1a32fe9a619fefd5e411721a9117fbf82aea638fe8a1 \
+    --hash=sha256:f48107a8c637e80362555f37ecf49abe20370e557cc4ab374f04ec4423c97c3d \
+    --hash=sha256:f7ee0e597f495cf415bcbd3da3caa3bd7e816b74d0d52b8145954c5e6fd3ff37 \
+    --hash=sha256:f93243fdc5657247533273ac4f86ae106cc6445a0efacb9a1bfe982fcfefd90c \
+    --hash=sha256:f95393b4d66bfae908c3ca8d169d5f79cd65636ae15b5e7a4f6e67af675adb0e \
+    --hash=sha256:fc38cba02d1acba4e2869eef1a57a43dfbd3d49a59bf90dda7444ec2be6a5570 \
+    --hash=sha256:fd0858c20f078a32cf55f7e81473d96dcf3b93fd2ccdb3d40fdf54b8573df3af \
+    --hash=sha256:fd138803047fb4c062b1c1dd95462f5209456bfab55c734458f15d11da288f8f \
+    --hash=sha256:fd2dbc472da1f772a4dae4fa24be938a6c544671a912e30529984dd80400cd88 \
+    --hash=sha256:fd6f30fdcf9ae2a70abd34da54f18da086160e4d7d9251f81f3da0ff84fc5a48 \
+    --hash=sha256:fe49d0a85038f36ba9e3ffafa1103e61170b28e95b16622e11be0a0ea07c6781
+    # via
+    #   aiohttp
+    #   yarl
+psutil==7.2.2 \
+    --hash=sha256:0746f5f8d406af344fd547f1c8daa5f5c33dbc293bb8d6a16d80b4bb88f59372 \
+    --hash=sha256:076a2d2f923fd4821644f5ba89f059523da90dc9014e85f8e45a5774ca5bc6f9 \
+    --hash=sha256:11fe5a4f613759764e79c65cf11ebdf26e33d6dd34336f8a337aa2996d71c841 \
+    --hash=sha256:1a571f2330c966c62aeda00dd24620425d4b0cc86881c89861fbc04549e5dc63 \
+    --hash=sha256:1a7b04c10f32cc88ab39cbf606e117fd74721c831c98a27dc04578deb0c16979 \
+    --hash=sha256:1fa4ecf83bcdf6e6c8f4449aff98eefb5d0604bf88cb883d7da3d8d2d909546a \
+    --hash=sha256:2edccc433cbfa046b980b0df0171cd25bcaeb3a68fe9022db0979e7aa74a826b \
+    --hash=sha256:7b6d09433a10592ce39b13d7be5a54fbac1d1228ed29abc880fb23df7cb694c9 \
+    --hash=sha256:8c233660f575a5a89e6d4cb65d9f938126312bca76d8fe087b947b3a1aaac9ee \
+    --hash=sha256:917e891983ca3c1887b4ef36447b1e0873e70c933afc831c6b6da078ba474312 \
+    --hash=sha256:ab486563df44c17f5173621c7b198955bd6b613fb87c71c161f827d3fb149a9b \
+    --hash=sha256:ae0aefdd8796a7737eccea863f80f81e468a1e4cf14d926bd9b6f5f2d5f90ca9 \
+    --hash=sha256:b0726cecd84f9474419d67252add4ac0cd9811b04d61123054b9fb6f57df6e9e \
+    --hash=sha256:b58fabe35e80b264a4e3bb23e6b96f9e45a3df7fb7eed419ac0e5947c61e47cc \
+    --hash=sha256:c7663d4e37f13e884d13994247449e9f8f574bc4655d509c3b95e9ec9e2b9dc1 \
+    --hash=sha256:e452c464a02e7dc7822a05d25db4cde564444a67e58539a00f929c51eddda0cf \
+    --hash=sha256:e78c8603dcd9a04c7364f1a3e670cea95d51ee865e4efb3556a3a63adef958ea \
+    --hash=sha256:eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988 \
+    --hash=sha256:ed0cace939114f62738d808fdcecd4c869222507e266e574799e9c0faa17d486 \
+    --hash=sha256:eed63d3b4d62449571547b60578c5b2c4bcccc5387148db46e0c2313dad0ee00 \
+    --hash=sha256:fd04ef36b4a6d599bbdb225dd1d3f51e00105f6d48a28f006da7f9822f2606d8
+    # via mcp-agent-mail
+py-key-value-aio==0.2.8 \
+    --hash=sha256:561565547ce8162128fd2bd0b9d70ce04a5f4586da8500cce79a54dfac78c46a \
+    --hash=sha256:c0cfbb0bd4e962a3fa1a9fa6db9ba9df812899bd9312fa6368aaea7b26008b36
+    # via fastmcp
+py-key-value-shared==0.2.8 \
+    --hash=sha256:703b4d3c61af124f0d528ba85995c3c8d78f8bd3d2b217377bd3278598070cc1 \
+    --hash=sha256:aff1bbfd46d065b2d67897d298642e80e5349eae588c6d11b48452b46b8d46ba
+    # via py-key-value-aio
+pycparser==3.0 \
+    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+    # via cffi
+pydantic==2.12.5 \
+    --hash=sha256:4d351024c75c0f085a9febbb665ce8c0c6ec5d30e903bdb6394b7ede26aebb49 \
+    --hash=sha256:e561593fccf61e8a20fc46dfc2dfe075b8be7d0188df33f221ad1f0139180f9d
+    # via
+    #   fastapi
+    #   fastmcp
+    #   litellm
+    #   mcp
+    #   openai
+    #   openapi-pydantic
+    #   pydantic-settings
+    #   sqlmodel
+pydantic-core==2.41.5 \
+    --hash=sha256:0177272f88ab8312479336e1d777f6b124537d47f2123f89cb37e0accea97f90 \
+    --hash=sha256:01a3d0ab748ee531f4ea6c3e48ad9dac84ddba4b0d82291f87248f2f9de8d740 \
+    --hash=sha256:0384e2e1021894b1ff5a786dbf94771e2986ebe2869533874d7e43bc79c6f504 \
+    --hash=sha256:03b77d184b9eb40240ae9fd676ca364ce1085f203e1b1256f8ab9984dca80a84 \
+    --hash=sha256:03ca43e12fab6023fc79d28ca6b39b05f794ad08ec2feccc59a339b02f2b3d33 \
+    --hash=sha256:05a2c8852530ad2812cb7914dc61a1125dc4e06252ee98e5638a12da6cc6fb6c \
+    --hash=sha256:070259a8818988b9a84a449a2a7337c7f430a22acc0859c6b110aa7212a6d9c0 \
+    --hash=sha256:08daa51ea16ad373ffd5e7606252cc32f07bc72b28284b6bc9c6df804816476e \
+    --hash=sha256:0cbaad15cb0c90aa221d43c00e77bb33c93e8d36e0bf74760cd00e732d10a6a0 \
+    --hash=sha256:100baa204bb412b74fe285fb0f3a385256dad1d1879f0a5cb1499ed2e83d132a \
+    --hash=sha256:112e305c3314f40c93998e567879e887a3160bb8689ef3d2c04b6cc62c33ac34 \
+    --hash=sha256:16f80f7abe3351f8ea6858914ddc8c77e02578544a0ebc15b4c2e1a0e813b0b2 \
+    --hash=sha256:1746d4a3d9a794cacae06a5eaaccb4b8643a131d45fbc9af23e353dc0a5ba5c3 \
+    --hash=sha256:1962293292865bca8e54702b08a4f26da73adc83dd1fcf26fbc875b35d81c815 \
+    --hash=sha256:1d1d9764366c73f996edd17abb6d9d7649a7eb690006ab6adbda117717099b14 \
+    --hash=sha256:1f8d33a7f4d5a7889e60dc39856d76d09333d8a6ed0f5f1190635cbec70ec4ba \
+    --hash=sha256:22f0fb8c1c583a3b6f24df2470833b40207e907b90c928cc8d3594b76f874375 \
+    --hash=sha256:239edca560d05757817c13dc17c50766136d21f7cd0fac50295499ae24f90fdf \
+    --hash=sha256:242a206cd0318f95cd21bdacff3fcc3aab23e79bba5cac3db5a841c9ef9c6963 \
+    --hash=sha256:25e1c2af0fce638d5f1988b686f3b3ea8cd7de5f244ca147c777769e798a9cd1 \
+    --hash=sha256:266fb4cbf5e3cbd0b53669a6d1b039c45e3ce651fd5442eff4d07c2cc8d66808 \
+    --hash=sha256:2782c870e99878c634505236d81e5443092fba820f0373997ff75f90f68cd553 \
+    --hash=sha256:287dad91cfb551c363dc62899a80e9e14da1f0e2b6ebde82c806612ca2a13ef1 \
+    --hash=sha256:29452c56df2ed968d18d7e21f4ab0ac55e71dc59524872f6fc57dcf4a3249ed2 \
+    --hash=sha256:299e0a22e7ae2b85c1a57f104538b2656e8ab1873511fd718a1c1c6f149b77b5 \
+    --hash=sha256:2a5e06546e19f24c6a96a129142a75cee553cc018ffee48a460059b1185f4470 \
+    --hash=sha256:2b761d210c9ea91feda40d25b4efe82a1707da2ef62901466a42492c028553a2 \
+    --hash=sha256:2c010c6ded393148374c0f6f0bf89d206bf3217f201faa0635dcd56bd1520f6b \
+    --hash=sha256:2ff4321e56e879ee8d2a879501c8e469414d948f4aba74a2d4593184eb326660 \
+    --hash=sha256:3006c3dd9ba34b0c094c544c6006cc79e87d8612999f1a5d43b769b89181f23c \
+    --hash=sha256:33cb885e759a705b426baada1fe68cbb0a2e68e34c5d0d0289a364cf01709093 \
+    --hash=sha256:346285d28e4c8017da95144c7f3acd42740d637ff41946af5ce6e5e420502dd5 \
+    --hash=sha256:34a64bc3441dc1213096a20fe27e8e128bd3ff89921706e83c0b1ac971276594 \
+    --hash=sha256:35b44f37a3199f771c3eaa53051bc8a70cd7b54f333531c59e29fd4db5d15008 \
+    --hash=sha256:378bec5c66998815d224c9ca994f1e14c0c21cb95d2f52b6021cc0b2a58f2a5a \
+    --hash=sha256:3f37a19d7ebcdd20b96485056ba9e8b304e27d9904d233d7b1015db320e51f0a \
+    --hash=sha256:3f84d5c1b4ab906093bdc1ff10484838aca54ef08de4afa9de0f5f14d69639cd \
+    --hash=sha256:4009935984bd36bd2c774e13f9a09563ce8de4abaa7226f5108262fa3e637284 \
+    --hash=sha256:406bf18d345822d6c21366031003612b9c77b3e29ffdb0f612367352aab7d586 \
+    --hash=sha256:4819fa52133c9aa3c387b3328f25c1facc356491e6135b459f1de698ff64d869 \
+    --hash=sha256:482c982f814460eabe1d3bb0adfdc583387bd4691ef00b90575ca0d2b6fe2294 \
+    --hash=sha256:4bc36bbc0b7584de96561184ad7f012478987882ebf9f9c389b23f432ea3d90f \
+    --hash=sha256:506d766a8727beef16b7adaeb8ee6217c64fc813646b424d0804d67c16eddb66 \
+    --hash=sha256:56121965f7a4dc965bff783d70b907ddf3d57f6eba29b6d2e5dabfaf07799c51 \
+    --hash=sha256:58133647260ea01e4d0500089a8c4f07bd7aa6ce109682b1426394988d8aaacc \
+    --hash=sha256:5921a4d3ca3aee735d9fd163808f5e8dd6c6972101e4adbda9a4667908849b97 \
+    --hash=sha256:5a4e67afbc95fa5c34cf27d9089bca7fcab4e51e57278d710320a70b956d1b9a \
+    --hash=sha256:5cb1b2f9742240e4bb26b652a5aeb840aa4b417c7748b6f8387927bc6e45e40d \
+    --hash=sha256:62de39db01b8d593e45871af2af9e497295db8d73b085f6bfd0b18c83c70a8f9 \
+    --hash=sha256:634e8609e89ceecea15e2d61bc9ac3718caaaa71963717bf3c8f38bfde64242c \
+    --hash=sha256:63510af5e38f8955b8ee5687740d6ebf7c2a0886d15a6d65c32814613681bc07 \
+    --hash=sha256:650ae77860b45cfa6e2cdafc42618ceafab3a2d9a3811fcfbd3bbf8ac3c40d36 \
+    --hash=sha256:6561e94ba9dacc9c61bce40e2d6bdc3bfaa0259d3ff36ace3b1e6901936d2e3e \
+    --hash=sha256:65840751b72fbfd82c3c640cff9284545342a4f1eb1586ad0636955b261b0b05 \
+    --hash=sha256:6cb58b9c66f7e4179a2d5e0f849c48eff5c1fca560994d6eb6543abf955a149e \
+    --hash=sha256:6f52298fbd394f9ed112d56f3d11aabd0d5bd27beb3084cc3d8ad069483b8941 \
+    --hash=sha256:707625ef0983fcfb461acfaf14de2067c5942c6bb0f3b4c99158bed6fedd3cf3 \
+    --hash=sha256:72f6c8b11857a856bcfa48c86f5368439f74453563f951e473514579d44aa612 \
+    --hash=sha256:753e230374206729bf0a807954bcc6c150d3743928a73faffee51ac6557a03c3 \
+    --hash=sha256:76d0819de158cd855d1cbb8fcafdf6f5cf1eb8e470abe056d5d161106e38062b \
+    --hash=sha256:76ee27c6e9c7f16f47db7a94157112a2f3a00e958bc626e2f4ee8bec5c328fbe \
+    --hash=sha256:77b63866ca88d804225eaa4af3e664c5faf3568cea95360d21f4725ab6e07146 \
+    --hash=sha256:79ec52ec461e99e13791ec6508c722742ad745571f234ea6255bed38c6480f11 \
+    --hash=sha256:7b93a4d08587e2b7e7882de461e82b6ed76d9026ce91ca7915e740ecc7855f60 \
+    --hash=sha256:7da7087d756b19037bc2c06edc6c170eeef3c3bafcb8f532ff17d64dc427adfd \
+    --hash=sha256:7f3bf998340c6d4b0c9a2f02d6a400e51f123b59565d74dc60d252ce888c260b \
+    --hash=sha256:80aa89cad80b32a912a65332f64a4450ed00966111b6615ca6816153d3585a8c \
+    --hash=sha256:8566def80554c3faa0e65ac30ab0932b9e3a5cd7f8323764303d468e5c37595a \
+    --hash=sha256:873e0d5b4fb9b89ef7c2d2a963ea7d02879d9da0da8d9d4933dee8ee86a8b460 \
+    --hash=sha256:88942d3a3dff3afc8288c21e565e476fc278902ae4d6d134f1eeda118cc830b1 \
+    --hash=sha256:8bfeaf8735be79f225f3fefab7f941c712aaca36f1128c9d7e2352ee1aa87bdf \
+    --hash=sha256:8e7c86f27c585ef37c35e56a96363ab8de4e549a95512445b85c96d3e2f7c1bf \
+    --hash=sha256:915c3d10f81bec3a74fbd4faebe8391013ba61e5a1a8d48c4455b923bdda7858 \
+    --hash=sha256:93e8740d7503eb008aa2df04d3b9735f845d43ae845e6dcd2be0b55a2da43cd2 \
+    --hash=sha256:941103c9be18ac8daf7b7adca8228f8ed6bb7a1849020f643b3a14d15b1924d9 \
+    --hash=sha256:97aeba56665b4c3235a0e52b2c2f5ae9cd071b8a8310ad27bddb3f7fb30e9aa2 \
+    --hash=sha256:a39455728aabd58ceabb03c90e12f71fd30fa69615760a075b9fec596456ccc3 \
+    --hash=sha256:a3a52f6156e73e7ccb0f8cced536adccb7042be67cb45f9562e12b319c119da6 \
+    --hash=sha256:a668ce24de96165bb239160b3d854943128f4334822900534f2fe947930e5770 \
+    --hash=sha256:a75dafbf87d6276ddc5b2bf6fae5254e3d0876b626eb24969a574fff9149ee5d \
+    --hash=sha256:aabf5777b5c8ca26f7824cb4a120a740c9588ed58df9b2d196ce92fba42ff8dc \
+    --hash=sha256:aec5cf2fd867b4ff45b9959f8b20ea3993fc93e63c7363fe6851424c8a7e7c23 \
+    --hash=sha256:b2379fa7ed44ddecb5bfe4e48577d752db9fc10be00a6b7446e9663ba143de26 \
+    --hash=sha256:b4ececa40ac28afa90871c2cc2b9ffd2ff0bf749380fbdf57d165fd23da353aa \
+    --hash=sha256:b5819cd790dbf0c5eb9f82c73c16b39a65dd6dd4d1439dcdea7816ec9adddab8 \
+    --hash=sha256:b74557b16e390ec12dca509bce9264c3bbd128f8a2c376eaa68003d7f327276d \
+    --hash=sha256:b80aa5095cd3109962a298ce14110ae16b8c1aece8b72f9dafe81cf597ad80b3 \
+    --hash=sha256:b93590ae81f7010dbe380cdeab6f515902ebcbefe0b9327cc4804d74e93ae69d \
+    --hash=sha256:b96d5f26b05d03cc60f11a7761a5ded1741da411e7fe0909e27a5e6a0cb7b034 \
+    --hash=sha256:bd3d54f38609ff308209bd43acea66061494157703364ae40c951f83ba99a1a9 \
+    --hash=sha256:bfea2a5f0b4d8d43adf9d7b8bf019fb46fdd10a2e5cde477fbcb9d1fa08c68e1 \
+    --hash=sha256:c007fe8a43d43b3969e8469004e9845944f1a80e6acd47c150856bb87f230c56 \
+    --hash=sha256:c1df3d34aced70add6f867a8cf413e299177e0c22660cc767218373d0779487b \
+    --hash=sha256:c23e27686783f60290e36827f9c626e63154b82b116d7fe9adba1fda36da706c \
+    --hash=sha256:c8d8b4eb992936023be7dee581270af5c6e0697a8559895f527f5b7105ecd36a \
+    --hash=sha256:c9e19dd6e28fdcaa5a1de679aec4141f691023916427ef9bae8584f9c2fb3b0e \
+    --hash=sha256:d0d2568a8c11bf8225044aa94409e21da0cb09dcdafe9ecd10250b2baad531a9 \
+    --hash=sha256:d38548150c39b74aeeb0ce8ee1d8e82696f4a4e16ddc6de7b1d8823f7de4b9b5 \
+    --hash=sha256:d3a978c4f57a597908b7e697229d996d77a6d3c94901e9edee593adada95ce1a \
+    --hash=sha256:d5160812ea7a8a2ffbe233d8da666880cad0cbaf5d4de74ae15c313213d62556 \
+    --hash=sha256:dc799088c08fa04e43144b164feb0c13f9a0bc40503f8df3e9fde58a3c0c101e \
+    --hash=sha256:df3959765b553b9440adfd3c795617c352154e497a4eaf3752555cfb5da8fc49 \
+    --hash=sha256:dfa8a0c812ac681395907e71e1274819dec685fec28273a28905df579ef137e2 \
+    --hash=sha256:e25c479382d26a2a41b7ebea1043564a937db462816ea07afa8a44c0866d52f9 \
+    --hash=sha256:e4f4a984405e91527a0d62649ee21138f8e3d0ef103be488c1dc11a80d7f184b \
+    --hash=sha256:e536c98a7626a98feb2d3eaf75944ef6f3dbee447e1f841eae16f2f0a72d8ddc \
+    --hash=sha256:e56ba91f47764cc14f1daacd723e3e82d1a89d783f0f5afe9c364b8bb491ccdb \
+    --hash=sha256:e672ba74fbc2dc8eea59fb6d4aed6845e6905fc2a8afe93175d94a83ba2a01a0 \
+    --hash=sha256:e7b576130c69225432866fe2f4a469a85a54ade141d96fd396dffcf607b558f8 \
+    --hash=sha256:e8465ab91a4bd96d36dde3263f06caa6a8a6019e4113f24dc753d79a8b3a3f82 \
+    --hash=sha256:e96cea19e34778f8d59fe40775a7a574d95816eb150850a85a7a4c8f4b94ac69 \
+    --hash=sha256:ece5c59f0ce7d001e017643d8d24da587ea1f74f6993467d85ae8a5ef9d4f42b \
+    --hash=sha256:eceb81a8d74f9267ef4081e246ffd6d129da5d87e37a77c9bde550cb04870c1c \
+    --hash=sha256:ed2e99c456e3fadd05c991f8f437ef902e00eedf34320ba2b0842bd1c3ca3a75 \
+    --hash=sha256:f0cd744688278965817fd0839c4a4116add48d23890d468bc436f78beb28abf5 \
+    --hash=sha256:f14f8f046c14563f8eb3f45f499cc658ab8d10072961e07225e507adb700e93f \
+    --hash=sha256:f15489ba13d61f670dcc96772e733aad1a6f9c429cc27574c6cdaed82d0146ad \
+    --hash=sha256:f31d95a179f8d64d90f6831d71fa93290893a33148d890ba15de25642c5d075b \
+    --hash=sha256:f41a7489d32336dbf2199c8c0a215390a751c5b014c2c1c5366e817202e9cdf7 \
+    --hash=sha256:f41eb9797986d6ebac5e8edff36d5cef9de40def462311b3eb3eeded1431e425 \
+    --hash=sha256:f547144f2966e1e16ae626d8ce72b4cfa0caedc7fa28052001c94fb2fcaa1c52
+    # via pydantic
+pydantic-settings==2.14.0 \
+    --hash=sha256:24285fd4b0e0c06507dd9fdfd331ee23794305352aaec8fc4eb92d4047aeb67d \
+    --hash=sha256:fc8d5d692eb7092e43c8647c1c35a3ecd00e040fcf02ed86f4cb5458ca62182e
+    # via mcp
+pygments==2.20.0 \
+    --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
+    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+    # via rich
+pyjwt==2.12.1 \
+    --hash=sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c \
+    --hash=sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b
+    # via mcp
+pynacl==1.6.2 \
+    --hash=sha256:018494d6d696ae03c7e656e5e74cdfd8ea1326962cc401bcf018f1ed8436811c \
+    --hash=sha256:04316d1fc625d860b6c162fff704eb8426b1a8bcd3abacea11142cbd99a6b574 \
+    --hash=sha256:22de65bb9010a725b0dac248f353bb072969c94fa8d6b1f34b87d7953cf7bbe4 \
+    --hash=sha256:26bfcd00dcf2cf160f122186af731ae30ab120c18e8375684ec2670dccd28130 \
+    --hash=sha256:2fef529ef3ee487ad8113d287a593fa26f48ee3620d92ecc6f1d09ea38e0709b \
+    --hash=sha256:320ef68a41c87547c91a8b58903c9caa641ab01e8512ce291085b5fe2fcb7590 \
+    --hash=sha256:3bffb6d0f6becacb6526f8f42adfb5efb26337056ee0831fb9a7044d1a964444 \
+    --hash=sha256:44081faff368d6c5553ccf55322ef2819abb40e25afaec7e740f159f74813634 \
+    --hash=sha256:46065496ab748469cdd999246d17e301b2c24ae2fdf739132e580a0e94c94a87 \
+    --hash=sha256:5811c72b473b2f38f7e2a3dc4f8642e3a3e9b5e7317266e4ced1fba85cae41aa \
+    --hash=sha256:622d7b07cc5c02c666795792931b50c91f3ce3c2649762efb1ef0d5684c81594 \
+    --hash=sha256:62985f233210dee6548c223301b6c25440852e13d59a8b81490203c3227c5ba0 \
+    --hash=sha256:68be3a09455743ff9505491220b64440ced8973fe930f270c8e07ccfa25b1f9e \
+    --hash=sha256:834a43af110f743a754448463e8fd61259cd4ab5bbedcf70f9dabad1d28a394c \
+    --hash=sha256:8845c0631c0be43abdd865511c41eab235e0be69c81dc66a50911594198679b0 \
+    --hash=sha256:8a66d6fb6ae7661c58995f9c6435bda2b1e68b54b598a6a10247bfcdadac996c \
+    --hash=sha256:8b097553b380236d51ed11356c953bf8ce36a29a3e596e934ecabe76c985a577 \
+    --hash=sha256:a84bf1c20339d06dc0c85d9aea9637a24f718f375d861b2668b2f9f96fa51145 \
+    --hash=sha256:a9f9932d8d2811ce1a8ffa79dcbdf3970e7355b5c8eb0c1a881a57e7f7d96e88 \
+    --hash=sha256:bc4a36b28dd72fb4845e5d8f9760610588a96d5a51f01d84d8c6ff9849968c14 \
+    --hash=sha256:c8a231e36ec2cab018c4ad4358c386e36eede0319a0c41fed24f840b1dac59f6 \
+    --hash=sha256:c949ea47e4206af7c8f604b8278093b674f7c79ed0d4719cc836902bf4517465 \
+    --hash=sha256:d071c6a9a4c94d79eb665db4ce5cedc537faf74f2355e4d502591d850d3913c0 \
+    --hash=sha256:d29bfe37e20e015a7d8b23cfc8bd6aa7909c92a1b8f41ee416bbb3e79ef182b2 \
+    --hash=sha256:fe9847ca47d287af41e82be1dd5e23023d3c31a951da134121ab02e42ac218c9
+    # via mcp-agent-mail
+pyperclip==1.11.0 \
+    --hash=sha256:244035963e4428530d9e3a6101a1ef97209c6825edab1567beac148ccc1db1b6 \
+    --hash=sha256:299403e9ff44581cb9ba2ffeed69c7aa96a008622ad0c46cb575ca75b5b84273
+    # via fastmcp
+python-decouple==3.8 \
+    --hash=sha256:ba6e2657d4f376ecc46f77a3a615e058d93ba5e465c01bbe57289bfb7cce680f \
+    --hash=sha256:d0d45340815b25f4de59c974b855bb38d03151d81b037d9e3f463b0c9f8cbd66
+    # via mcp-agent-mail
+python-dotenv==1.2.2 \
+    --hash=sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a \
+    --hash=sha256:2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3
+    # via
+    #   fastmcp
+    #   litellm
+    #   pydantic-settings
+    #   uvicorn
+python-multipart==0.0.27 \
+    --hash=sha256:6fccfad17a27334bd0193681b369f476eda3409f17381a2d65aa7df3f7275645 \
+    --hash=sha256:9870a6a8c5a20a5bf4f07c017bd1489006ff8836cff097b6933355ee2b49b602
+    # via mcp
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via
+    #   huggingface-hub
+    #   jsonschema-path
+    #   mcp-agent-mail
+    #   uvicorn
+redis==7.4.0 \
+    --hash=sha256:64a6ea7bf567ad43c964d2c30d82853f8df927c5c9017766c55a1d1ed95d18ad \
+    --hash=sha256:a9c74a5c893a5ef8455a5adb793a31bb70feb821c86eccb62eebef5a19c429ec
+    # via mcp-agent-mail
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \
+    --hash=sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8
+    # via
+    #   jsonschema
+    #   jsonschema-path
+    #   jsonschema-specifications
+regex==2026.4.4 \
+    --hash=sha256:011bb48bffc1b46553ac704c975b3348717f4e4aa7a67522b51906f99da1820c \
+    --hash=sha256:04bb679bc0bde8a7bfb71e991493d47314e7b98380b083df2447cda4b6edb60f \
+    --hash=sha256:0540e5b733618a2f84e9cb3e812c8afa82e151ca8e19cf6c4e95c5a65198236f \
+    --hash=sha256:05568c4fbf3cb4fa9e28e3af198c40d3237cf6041608a9022285fe567ec3ad62 \
+    --hash=sha256:0709f22a56798457ae317bcce42aacee33c680068a8f14097430d9f9ba364bee \
+    --hash=sha256:0734f63afe785138549fbe822a8cfeaccd1bae814c5057cc0ed5b9f2de4fc883 \
+    --hash=sha256:07edca1ba687998968f7db5bc355288d0c6505caa7374f013d27356d93976d13 \
+    --hash=sha256:07f190d65f5a72dcb9cf7106bfc3d21e7a49dd2879eda2207b683f32165e4d99 \
+    --hash=sha256:08c55c13d2eef54f73eeadc33146fb0baaa49e7335eb1aff6ae1324bf0ddbe4a \
+    --hash=sha256:0a51cdb3c1e9161154f976cb2bef9894bc063ac82f31b733087ffb8e880137d0 \
+    --hash=sha256:1371c2ccbb744d66ee63631cc9ca12aa233d5749972626b68fe1a649dd98e566 \
+    --hash=sha256:173a66f3651cdb761018078e2d9487f4cf971232c990035ec0eb1cdc6bf929a9 \
+    --hash=sha256:1b1ce5c81c9114f1ce2f9288a51a8fd3aeea33a0cc440c415bf02da323aa0a76 \
+    --hash=sha256:1b9a00b83f3a40e09859c78920571dcb83293c8004079653dd22ec14bbfa98c7 \
+    --hash=sha256:21e5eb86179b4c67b5759d452ea7c48eb135cd93308e7a260aa489ed2eb423a4 \
+    --hash=sha256:261c015b3e2ed0919157046d768774ecde57f03d8fa4ba78d29793447f70e717 \
+    --hash=sha256:2895506ebe32cc63eeed8f80e6eae453171cfccccab35b70dc3129abec35a5b8 \
+    --hash=sha256:298c3ec2d53225b3bf91142eb9691025bab610e0c0c51592dde149db679b3d17 \
+    --hash=sha256:2a5d273181b560ef8397c8825f2b9d57013de744da9e8257b8467e5da8599351 \
+    --hash=sha256:2b69102a743e7569ebee67e634a69c4cb7e59d6fa2e1aa7d3bdbf3f61435f62d \
+    --hash=sha256:2c785939dc023a1ce4ec09599c032cc9933d258a998d16ca6f2b596c010940eb \
+    --hash=sha256:2da82d643fa698e5e5210e54af90181603d5853cf469f5eedf9bfc8f59b4b8c7 \
+    --hash=sha256:2e19e18c568d2866d8b6a6dfad823db86193503f90823a8f66689315ba28fbe8 \
+    --hash=sha256:312ec9dd1ae7d96abd8c5a36a552b2139931914407d26fba723f9e53c8186f86 \
+    --hash=sha256:33424f5188a7db12958246a54f59a435b6cb62c5cf9c8d71f7cc49475a5fdada \
+    --hash=sha256:3384df51ed52db0bea967e21458ab0a414f67cdddfd94401688274e55147bb81 \
+    --hash=sha256:33bfda9684646d323414df7abe5692c61d297dbb0530b28ec66442e768813c59 \
+    --hash=sha256:349d7310eddff40429a099c08d995c6d4a4bfaf3ff40bd3b5e5cb5a5a3c7d453 \
+    --hash=sha256:36bcb9d6d1307ab629edc553775baada2aefa5c50ccc0215fbfd2afcfff43141 \
+    --hash=sha256:3790ba9fb5dd76715a7afe34dbe603ba03f8820764b1dc929dd08106214ed031 \
+    --hash=sha256:385edaebde5db5be103577afc8699fea73a0e36a734ba24870be7ffa61119d74 \
+    --hash=sha256:39d8de85a08e32632974151ba59c6e9140646dcc36c80423962b1c5c0a92e244 \
+    --hash=sha256:415a994b536440f5011aa77e50a4274d15da3245e876e5c7f19da349caaedd87 \
+    --hash=sha256:421439d1bee44b19f4583ccf42670ca464ffb90e9fdc38d37f39d1ddd1e44f1f \
+    --hash=sha256:475e50f3f73f73614f7cba5524d6de49dee269df00272a1b85e3d19f6d498465 \
+    --hash=sha256:4ce255cc05c1947a12989c6db801c96461947adb7a59990f1360b5983fab4983 \
+    --hash=sha256:504ffa8a03609a087cad81277a629b6ce884b51a24bd388a7980ad61748618ff \
+    --hash=sha256:50a766ee2010d504554bfb5f578ed2e066898aa26411d57e6296230627cdefa0 \
+    --hash=sha256:54170b3e95339f415d54651f97df3bff7434a663912f9358237941bbf9143f55 \
+    --hash=sha256:54a1189ad9d9357760557c91103d5e421f0a2dabe68a5cdf9103d0dcf4e00752 \
+    --hash=sha256:55d9304e0e7178dfb1e106c33edf834097ddf4a890e2f676f6c5118f84390f73 \
+    --hash=sha256:586b89cdadf7d67bf86ae3342a4dcd2b8d70a832d90c18a0ae955105caf34dbe \
+    --hash=sha256:59968142787042db793348a3f5b918cf24ced1f23247328530e063f89c128a95 \
+    --hash=sha256:59efe72d37fd5a91e373e5146f187f921f365f4abc1249a5ab446a60f30dd5f8 \
+    --hash=sha256:59f67cd0a0acaf0e564c20bbd7f767286f23e91e2572c5703bf3e56ea7557edb \
+    --hash=sha256:5d354b18839328927832e2fa5f7c95b7a3ccc39e7a681529e1685898e6436d45 \
+    --hash=sha256:62f5519042c101762509b1d717b45a69c0139d60414b3c604b81328c01bd1943 \
+    --hash=sha256:6780f008ee81381c737634e75c24e5a6569cc883c4f8e37a37917ee79efcafd9 \
+    --hash=sha256:6a50ab11b7779b849472337191f3a043e27e17f71555f98d0092fa6d73364520 \
+    --hash=sha256:6aa809ed4dc3706cc38594d67e641601bd2f36d5555b2780ff074edfcb136cf8 \
+    --hash=sha256:6c1818f37be3ca02dcb76d63f2c7aaba4b0dc171b579796c6fbe00148dfec6b1 \
+    --hash=sha256:6dac006c8b6dda72d86ea3d1333d45147de79a3a3f26f10c1cf9287ca4ca0ac3 \
+    --hash=sha256:7088fcdcb604a4417c208e2169715800d28838fefd7455fbe40416231d1d47c1 \
+    --hash=sha256:70aadc6ff12e4b444586e57fc30771f86253f9f0045b29016b9605b4be5f7dfb \
+    --hash=sha256:7429f4e6192c11d659900c0648ba8776243bf396ab95558b8c51a345afeddde6 \
+    --hash=sha256:74fa82dcc8143386c7c0392e18032009d1db715c25f4ba22d23dc2e04d02a20f \
+    --hash=sha256:760ef21c17d8e6a4fe8cf406a97cf2806a4df93416ccc82fc98d25b1c20425be \
+    --hash=sha256:7698a6f38730fd1385d390d1ed07bb13dce39aa616aca6a6d89bea178464b9a4 \
+    --hash=sha256:76d67d5afb1fe402d10a6403bae668d000441e2ab115191a804287d53b772951 \
+    --hash=sha256:773d1dfd652bbffb09336abf890bfd64785c7463716bf766d0eb3bc19c8b7f27 \
+    --hash=sha256:7d346fccdde28abba117cc9edc696b9518c3307fbfcb689e549d9b5979018c6d \
+    --hash=sha256:8512fcdb43f1bf18582698a478b5ab73f9c1667a5b7548761329ef410cd0a760 \
+    --hash=sha256:867bddc63109a0276f5a31999e4c8e0eb7bbbad7d6166e28d969a2c1afeb97f9 \
+    --hash=sha256:88e9b048345c613f253bea4645b2fe7e579782b82cac99b1daad81e29cc2ed8e \
+    --hash=sha256:8fae3c6e795d7678963f2170152b0d892cf6aee9ee8afc8c45e6be38d5107fe7 \
+    --hash=sha256:9542ccc1e689e752594309444081582f7be2fdb2df75acafea8a075108566735 \
+    --hash=sha256:9776b85f510062f5a75ef112afe5f494ef1635607bf1cc220c1391e9ac2f5e81 \
+    --hash=sha256:97850d0638391bdc7d35dc1c1039974dcb921eaafa8cc935ae4d7f272b1d60b3 \
+    --hash=sha256:993f657a7c1c6ec51b5e0ba97c9817d06b84ea5fa8d82e43b9405de0defdc2b9 \
+    --hash=sha256:9a2741ce5a29d3c84b0b94261ba630ab459a1b847a0d6beca7d62d188175c790 \
+    --hash=sha256:9e2f5217648f68e3028c823df58663587c1507a5ba8419f4fdfc8a461be76043 \
+    --hash=sha256:a0d2b28aa1354c7cd7f71b7658c4326f7facac106edd7f40eda984424229fd59 \
+    --hash=sha256:a152560af4f9742b96f3827090f866eeec5becd4765c8e0d3473d9d280e76a5a \
+    --hash=sha256:a1c0c7d67b64d85ac2e1879923bad2f08a08f3004055f2f406ef73c850114bd4 \
+    --hash=sha256:a7a5bb6aa0cf62208bb4fa079b0c756734f8ad0e333b425732e8609bd51ee22f \
+    --hash=sha256:a85b620a388d6c9caa12189233109e236b3da3deffe4ff11b84ae84e218a274f \
+    --hash=sha256:acd38177bd2c8e69a411d6521760806042e244d0ef94e2dd03ecdaa8a3c99427 \
+    --hash=sha256:ae3e764bd4c5ff55035dc82a8d49acceb42a5298edf6eb2fc4d328ee5dd7afae \
+    --hash=sha256:ae5266a82596114e41fb5302140e9630204c1b5f325c770bec654b95dd54b0aa \
+    --hash=sha256:af0384cb01a33600c49505c27c6c57ab0b27bf84a74e28524c92ca897ebdac9d \
+    --hash=sha256:b15b88b0d52b179712632832c1d6e58e5774f93717849a41096880442da41ab0 \
+    --hash=sha256:b26c30df3a28fd9793113dac7385a4deb7294a06c0f760dd2b008bd49a9139bc \
+    --hash=sha256:b40379b53ecbc747fd9bdf4a0ea14eb8188ca1bd0f54f78893a39024b28f4863 \
+    --hash=sha256:b4c36a85b00fadb85db9d9e90144af0a980e1a3d2ef9cd0f8a5bef88054657c6 \
+    --hash=sha256:b5f9fb784824a042be3455b53d0b112655686fdb7a91f88f095f3fee1e2a2a54 \
+    --hash=sha256:be061028481186ba62a0f4c5f1cc1e3d5ab8bce70c89236ebe01023883bc903b \
+    --hash=sha256:c07ab8794fa929e58d97a0e1796b8b76f70943fa39df225ac9964615cf1f9d52 \
+    --hash=sha256:c228cf65b4a54583763645dcd73819b3b381ca8b4bb1b349dee1c135f4112c07 \
+    --hash=sha256:c4ee50606cb1967db7e523224e05f32089101945f859928e65657a2cbb3d278b \
+    --hash=sha256:c882cd92ec68585e9c1cf36c447ec846c0d94edd706fe59e0c198e65822fd23b \
+    --hash=sha256:cf9b1b2e692d4877880388934ac746c99552ce6bf40792a767fd42c8c99f136d \
+    --hash=sha256:d2228c02b368d69b724c36e96d3d1da721561fb9cc7faa373d7bf65e07d75cb5 \
+    --hash=sha256:d51d20befd5275d092cdffba57ded05f3c436317ee56466c8928ac32d960edaf \
+    --hash=sha256:db0ac18435a40a2543dbb3d21e161a6c78e33e8159bd2e009343d224bb03bb1b \
+    --hash=sha256:dc4f10fbd5dd13dcf4265b4cc07d69ca70280742870c97ae10093e3d66000359 \
+    --hash=sha256:dcb5453ecf9cd58b562967badd1edbf092b0588a3af9e32ee3d05c985077ce87 \
+    --hash=sha256:dd2630faeb6876fb0c287f664d93ddce4d50cd46c6e88e60378c05c9047e08ca \
+    --hash=sha256:e014a797de43d1847df957c0a2a8e861d1c17547ee08467d1db2c370b7568baa \
+    --hash=sha256:e08270659717f6973523ce3afbafa53515c4dc5dcad637dc215b6fd50f689423 \
+    --hash=sha256:e0aab3ff447845049d676827d2ff714aab4f73f340e155b7de7458cf53baa5a4 \
+    --hash=sha256:e355be718caf838aa089870259cf1776dc2a4aa980514af9d02c59544d9a8b22 \
+    --hash=sha256:e7ab63e9fe45a9ec3417509e18116b367e89c9ceb6219222a3396fa30b147f80 \
+    --hash=sha256:e7cd3e4ee8d80447a83bbc9ab0c8459781fa77087f856c3e740d7763be0df27f \
+    --hash=sha256:e9638791082eaf5b3ac112c587518ee78e083a11c4b28012d8fe2a0f536dfb17 \
+    --hash=sha256:eb59c65069498dbae3c0ef07bbe224e1eaa079825a437fb47a479f0af11f774f \
+    --hash=sha256:ee7337f88f2a580679f7bbfe69dc86c043954f9f9c541012f49abc554a962f2e \
+    --hash=sha256:ee9627de8587c1a22201cb16d0296ab92b4df5cdcb5349f4e9744d61db7c7c98 \
+    --hash=sha256:f4f83781191007b6ef43b03debc35435f10cad9b96e16d147efe84a1d48bdde4 \
+    --hash=sha256:f56ebf9d70305307a707911b88469213630aba821e77de7d603f9d2f0730687d \
+    --hash=sha256:f5bfc2741d150d0be3e4a0401a5c22b06e60acb9aa4daa46d9e79a6dcd0f135b \
+    --hash=sha256:f94a11a9d05afcfcfa640e096319720a19cc0c9f7768e1a61fceee6a3afc6c7c \
+    --hash=sha256:fa7922bbb2cc84fa062d37723f199d4c0cd200245ce269c05db82d904db66b83 \
+    --hash=sha256:fe896e07a5a2462308297e515c0054e9ec2dd18dfdc9427b19900b37dfe6f40b \
+    --hash=sha256:ffa81f81b80047ba89a3c69ae6a0f78d06f4a42ce5126b0eb2a0a10ad44e0b2e
+    # via tiktoken
+requests==2.33.1 \
+    --hash=sha256:18817f8c57c6263968bc123d237e3b8b08ac046f5456bd1e307ee8f4250d3517 \
+    --hash=sha256:4e6d1ef462f3626a1f0a0a9c42dd93c63bad33f9f1c1937509b8c5c8718ab56a
+    # via tiktoken
+rich==15.0.0 \
+    --hash=sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb \
+    --hash=sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36
+    # via
+    #   cyclopts
+    #   fastmcp
+    #   mcp-agent-mail
+    #   rich-rst
+    #   typer
+rich-rst==1.3.2 \
+    --hash=sha256:a1196fdddf1e364b02ec68a05e8ff8f6914fee10fbca2e6b6735f166bb0da8d4 \
+    --hash=sha256:a99b4907cbe118cf9d18b0b44de272efa61f15117c61e39ebdc431baf5df722a
+    # via cyclopts
+rpds-py==0.30.0 \
+    --hash=sha256:07ae8a593e1c3c6b82ca3292efbe73c30b61332fd612e05abee07c79359f292f \
+    --hash=sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136 \
+    --hash=sha256:0c0e95f6819a19965ff420f65578bacb0b00f251fefe2c8b23347c37174271f3 \
+    --hash=sha256:0d08f00679177226c4cb8c5265012eea897c8ca3b93f429e546600c971bcbae7 \
+    --hash=sha256:0ed177ed9bded28f8deb6ab40c183cd1192aa0de40c12f38be4d59cd33cb5c65 \
+    --hash=sha256:12f90dd7557b6bd57f40abe7747e81e0c0b119bef015ea7726e69fe550e394a4 \
+    --hash=sha256:1726859cd0de969f88dc8673bdd954185b9104e05806be64bcd87badbe313169 \
+    --hash=sha256:1ab5b83dbcf55acc8b08fc62b796ef672c457b17dbd7820a11d6c52c06839bdf \
+    --hash=sha256:1b151685b23929ab7beec71080a8889d4d6d9fa9a983d213f07121205d48e2c4 \
+    --hash=sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2 \
+    --hash=sha256:250fa00e9543ac9b97ac258bd37367ff5256666122c2d0f2bc97577c60a1818c \
+    --hash=sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4 \
+    --hash=sha256:27f4b0e92de5bfbc6f86e43959e6edd1425c33b5e69aab0984a72047f2bcf1e3 \
+    --hash=sha256:2e6ecb5a5bcacf59c3f912155044479af1d0b6681280048b338b28e364aca1f6 \
+    --hash=sha256:32c8528634e1bf7121f3de08fa85b138f4e0dc47657866630611b03967f041d7 \
+    --hash=sha256:33f559f3104504506a44bb666b93a33f5d33133765b0c216a5bf2f1e1503af89 \
+    --hash=sha256:3896fa1be39912cf0757753826bc8bdc8ca331a28a7c4ae46b7a21280b06bb85 \
+    --hash=sha256:389a2d49eded1896c3d48b0136ead37c48e221b391c052fba3f4055c367f60a6 \
+    --hash=sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa \
+    --hash=sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb \
+    --hash=sha256:3d4a69de7a3e50ffc214ae16d79d8fbb0922972da0356dcf4d0fdca2878559c6 \
+    --hash=sha256:3e62880792319dbeb7eb866547f2e35973289e7d5696c6e295476448f5b63c87 \
+    --hash=sha256:3e8eeb0544f2eb0d2581774be4c3410356eba189529a6b3e36bbbf9696175856 \
+    --hash=sha256:422c3cb9856d80b09d30d2eb255d0754b23e090034e1deb4083f8004bd0761e4 \
+    --hash=sha256:4559c972db3a360808309e06a74628b95eaccbf961c335c8fe0d590cf587456f \
+    --hash=sha256:46e83c697b1f1c72b50e5ee5adb4353eef7406fb3f2043d64c33f20ad1c2fc53 \
+    --hash=sha256:47b0ef6231c58f506ef0b74d44e330405caa8428e770fec25329ed2cb971a229 \
+    --hash=sha256:47e77dc9822d3ad616c3d5759ea5631a75e5809d5a28707744ef79d7a1bcfcad \
+    --hash=sha256:47f236970bccb2233267d89173d3ad2703cd36a0e2a6e92d0560d333871a3d23 \
+    --hash=sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db \
+    --hash=sha256:495aeca4b93d465efde585977365187149e75383ad2684f81519f504f5c13038 \
+    --hash=sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27 \
+    --hash=sha256:4cc2206b76b4f576934f0ed374b10d7ca5f457858b157ca52064bdfc26b9fc00 \
+    --hash=sha256:4e7fc54e0900ab35d041b0601431b0a0eb495f0851a0639b6ef90f7741b39a18 \
+    --hash=sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083 \
+    --hash=sha256:55f66022632205940f1827effeff17c4fa7ae1953d2b74a8581baaefb7d16f8c \
+    --hash=sha256:58edca431fb9b29950807e301826586e5bbf24163677732429770a697ffe6738 \
+    --hash=sha256:5965af57d5848192c13534f90f9dd16464f3c37aaf166cc1da1cae1fd5a34898 \
+    --hash=sha256:5ba103fb455be00f3b1c2076c9d4264bfcb037c976167a6047ed82f23153f02e \
+    --hash=sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7 \
+    --hash=sha256:61046904275472a76c8c90c9ccee9013d70a6d0f73eecefd38c1ae7c39045a08 \
+    --hash=sha256:613aa4771c99f03346e54c3f038e4cc574ac09a3ddfb0e8878487335e96dead6 \
+    --hash=sha256:626a7433c34566535b6e56a1b39a7b17ba961e97ce3b80ec62e6f1312c025551 \
+    --hash=sha256:669b1805bd639dd2989b281be2cfd951c6121b65e729d9b843e9639ef1fd555e \
+    --hash=sha256:679ae98e00c0e8d68a7fda324e16b90fd5260945b45d3b824c892cec9eea3288 \
+    --hash=sha256:67b02ec25ba7a9e8fa74c63b6ca44cf5707f2fbfadae3ee8e7494297d56aa9df \
+    --hash=sha256:68f19c879420aa08f61203801423f6cd5ac5f0ac4ac82a2368a9fcd6a9a075e0 \
+    --hash=sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2 \
+    --hash=sha256:6abc8880d9d036ecaafe709079969f56e876fcf107f7a8e9920ba6d5a3878d05 \
+    --hash=sha256:6bdfdb946967d816e6adf9a3d8201bfad269c67efe6cefd7093ef959683c8de0 \
+    --hash=sha256:6de2a32a1665b93233cde140ff8b3467bdb9e2af2b91079f0333a0974d12d464 \
+    --hash=sha256:73c67f2db7bc334e518d097c6d1e6fed021bbc9b7d678d6cc433478365d1d5f5 \
+    --hash=sha256:74a3243a411126362712ee1524dfc90c650a503502f135d54d1b352bd01f2404 \
+    --hash=sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7 \
+    --hash=sha256:7c64d38fb49b6cdeda16ab49e35fe0da2e1e9b34bc38bd78386530f218b37139 \
+    --hash=sha256:7cee9c752c0364588353e627da8a7e808a66873672bcb5f52890c33fd965b394 \
+    --hash=sha256:7e6ecfcb62edfd632e56983964e6884851786443739dbfe3582947e87274f7cb \
+    --hash=sha256:806f36b1b605e2d6a72716f321f20036b9489d29c51c91f4dd29a3e3afb73b15 \
+    --hash=sha256:858738e9c32147f78b3ac24dc0edb6610000e56dc0f700fd5f651d0a0f0eb9ff \
+    --hash=sha256:8d6d1cc13664ec13c1b84241204ff3b12f9bb82464b8ad6e7a5d3486975c2eed \
+    --hash=sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6 \
+    --hash=sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e \
+    --hash=sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95 \
+    --hash=sha256:946fe926af6e44f3697abbc305ea168c2c31d3e3ef1058cf68f379bf0335a78d \
+    --hash=sha256:95f0802447ac2d10bcc69f6dc28fe95fdf17940367b21d34e34c737870758950 \
+    --hash=sha256:9854cf4f488b3d57b9aaeb105f06d78e5529d3145b1e4a41750167e8c213c6d3 \
+    --hash=sha256:993914b8e560023bc0a8bf742c5f303551992dcb85e247b1e5c7f4a7d145bda5 \
+    --hash=sha256:99b47d6ad9a6da00bec6aabe5a6279ecd3c06a329d4aa4771034a21e335c3a97 \
+    --hash=sha256:9a4e86e34e9ab6b667c27f3211ca48f73dba7cd3d90f8d5b11be56e5dbc3fb4e \
+    --hash=sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e \
+    --hash=sha256:a090322ca841abd453d43456ac34db46e8b05fd9b3b4ac0c78bcde8b089f959b \
+    --hash=sha256:a1010ed9524c73b94d15919ca4d41d8780980e1765babf85f9a2f90d247153dd \
+    --hash=sha256:a161f20d9a43006833cd7068375a94d035714d73a172b681d8881820600abfad \
+    --hash=sha256:a1d0bc22a7cdc173fedebb73ef81e07faef93692b8c1ad3733b67e31e1b6e1b8 \
+    --hash=sha256:a2bffea6a4ca9f01b3f8e548302470306689684e61602aa3d141e34da06cf425 \
+    --hash=sha256:a452763cc5198f2f98898eb98f7569649fe5da666c2dc6b5ddb10fde5a574221 \
+    --hash=sha256:a4796a717bf12b9da9d3ad002519a86063dcac8988b030e405704ef7d74d2d9d \
+    --hash=sha256:a51033ff701fca756439d641c0ad09a41d9242fa69121c7d8769604a0a629825 \
+    --hash=sha256:a8fa71a2e078c527c3e9dc9fc5a98c9db40bcc8a92b4e8858e36d329f8684b51 \
+    --hash=sha256:ac37f9f516c51e5753f27dfdef11a88330f04de2d564be3991384b2f3535d02e \
+    --hash=sha256:ac98b175585ecf4c0348fd7b29c3864bda53b805c773cbf7bfdaffc8070c976f \
+    --hash=sha256:acd7eb3f4471577b9b5a41baf02a978e8bdeb08b4b355273994f8b87032000a8 \
+    --hash=sha256:ad1fa8db769b76ea911cb4e10f049d80bf518c104f15b3edb2371cc65375c46f \
+    --hash=sha256:b40fb160a2db369a194cb27943582b38f79fc4887291417685f3ad693c5a1d5d \
+    --hash=sha256:b4dc1a6ff022ff85ecafef7979a2c6eb423430e05f1165d6688234e62ba99a07 \
+    --hash=sha256:ba3af48635eb83d03f6c9735dfb21785303e73d22ad03d489e88adae6eab8877 \
+    --hash=sha256:ba81a9203d07805435eb06f536d95a266c21e5b2dfbf6517748ca40c98d19e31 \
+    --hash=sha256:c2262bdba0ad4fc6fb5545660673925c2d2a5d9e2e0fb603aad545427be0fc58 \
+    --hash=sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94 \
+    --hash=sha256:ca28829ae5f5d569bb62a79512c842a03a12576375d5ece7d2cadf8abe96ec28 \
+    --hash=sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000 \
+    --hash=sha256:d948b135c4693daff7bc2dcfc4ec57237a29bd37e60c2fabf5aff2bbacf3e2f1 \
+    --hash=sha256:d96c2086587c7c30d44f31f42eae4eac89b60dabbac18c7669be3700f13c3ce1 \
+    --hash=sha256:d9a0ca5da0386dee0655b4ccdf46119df60e0f10da268d04fe7cc87886872ba7 \
+    --hash=sha256:da279aa314f00acbb803da1e76fa18666778e8a8f83484fba94526da5de2cba7 \
+    --hash=sha256:dbd936cde57abfee19ab3213cf9c26be06d60750e60a8e4dd85d1ab12c8b1f40 \
+    --hash=sha256:dc4f992dfe1e2bc3ebc7444f6c7051b4bc13cd8e33e43511e8ffd13bf407010d \
+    --hash=sha256:dc824125c72246d924f7f796b4f63c1e9dc810c7d9e2355864b3c3a73d59ade0 \
+    --hash=sha256:dd8ff7cf90014af0c0f787eea34794ebf6415242ee1d6fa91eaba725cc441e84 \
+    --hash=sha256:dea5b552272a944763b34394d04577cf0f9bd013207bc32323b5a89a53cf9c2f \
+    --hash=sha256:dff13836529b921e22f15cb099751209a60009731a68519630a24d61f0b1b30a \
+    --hash=sha256:e0b65193a413ccc930671c55153a03ee57cecb49e6227204b04fae512eb657a7 \
+    --hash=sha256:e5d3e6b26f2c785d65cc25ef1e5267ccbe1b069c5c21b8cc724efee290554419 \
+    --hash=sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8 \
+    --hash=sha256:eb0b93f2e5c2189ee831ee43f156ed34e2a89a78a66b98cadad955972548be5a \
+    --hash=sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9 \
+    --hash=sha256:ec7c4490c672c1a0389d319b3a9cfcd098dcdc4783991553c332a15acf7249be \
+    --hash=sha256:ee454b2a007d57363c2dfd5b6ca4a5d7e2c518938f8ed3b706e37e5d470801ed \
+    --hash=sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a \
+    --hash=sha256:f14fc5df50a716f7ece6a80b6c78bb35ea2ca47c499e422aa4463455dd96d56d \
+    --hash=sha256:f207f69853edd6f6700b86efb84999651baf3789e78a466431df1331608e5324 \
+    --hash=sha256:f251c812357a3fed308d684a5079ddfb9d933860fc6de89f2b7ab00da481e65f \
+    --hash=sha256:f83424d738204d9770830d35290ff3273fbb02b41f919870479fab14b9d303b2 \
+    --hash=sha256:f8d1736cfb49381ba528cd5baa46f82fdc65c06e843dab24dd70b63d09121b3f \
+    --hash=sha256:fe5fa731a1fa8a0a56b0977413f8cacac1768dad38d16b3a296712709476fbd5
+    # via
+    #   jsonschema
+    #   referencing
+ruff==0.15.12 \
+    --hash=sha256:01da3988d225628b709493d7dc67c3b9b12c0210016b08690ef9bd27970b262b \
+    --hash=sha256:2849ea9f3484c3aca43a82f484210370319e7170df4dfe4843395ddf6c57bc33 \
+    --hash=sha256:83b2f4f2f3b1026b5fb449b467d9264bf22067b600f7b6f41fc5958909f449d0 \
+    --hash=sha256:84a1630093121375a3e2a95b4a6dc7b59e2b4ee76216e32d81aae550a832d002 \
+    --hash=sha256:9ba3b8f1afd7e2e43d8943e55f249e13f9682fde09711644a6e7290eb4f3e339 \
+    --hash=sha256:9cae0f92bd5700d1213188b31cd3bdd2b315361296d10b96b8e2337d3d11f53e \
+    --hash=sha256:9e77c7e51c07fe396826d5969a5b846d9cd4c402535835fb6e21ce8b28fef847 \
+    --hash=sha256:a538f7a82d061cee7be55542aca1d86d1393d55d81d4fcc314370f4340930d4f \
+    --hash=sha256:b0c862b172d695db7598426b8af465e7e9ac00a3ea2a3630ee67eb82e366aaa6 \
+    --hash=sha256:c87a162d61ab3adca47c03f7f717c68672edec7d1b5499e652331780fe74950d \
+    --hash=sha256:d0185894e038d7043ba8fd6aee7499ece6462dc0ea9f1e260c7451807c714c20 \
+    --hash=sha256:dd8aed930da53780d22fc70bdf84452c843cf64f8cb4eb38984319c24c5cd5fd \
+    --hash=sha256:e3bcd123364c3770b8e1b7baaf343cc99a35f197c5c6e8af79015c666c423a6c \
+    --hash=sha256:e852ba9fdc890655e1d78f2df1499efbe0e54126bd405362154a75e2bde159c5 \
+    --hash=sha256:ecea26adb26b4232c0c2ca19ccbc0083a68344180bba2a600605538ce51a40a6 \
+    --hash=sha256:f86f176e188e94d6bdbc09f09bfd9dc729059ad93d0e7390b5a73efe19f8861c \
+    --hash=sha256:fb129f40f114f089ebe0ca56c0d251cf2061b17651d464bb6478dc01e69f11f5 \
+    --hash=sha256:fe87510d000220aa1ed530d4448a7c696a0cae1213e5ec30e5874287b66557b5
+    # via mcp-agent-mail
+secretstorage==3.5.0 \
+    --hash=sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137 \
+    --hash=sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be
+    # via keyring
+shellingham==1.5.4 \
+    --hash=sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686 \
+    --hash=sha256:8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de
+    # via typer
+smmap==5.0.3 \
+    --hash=sha256:4d9debb8b99007ae47165abc08670bd74cb74b5227dda7f643eccc4e9eb5642c \
+    --hash=sha256:c106e05d5a61449cf6ba9a1e650227ecfb141590d2a98412103ff35d89fc7b2f
+    # via gitdb
+sniffio==1.3.1 \
+    --hash=sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2 \
+    --hash=sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc
+    # via openai
+sqlalchemy==2.0.49 \
+    --hash=sha256:01146546d84185f12721a1d2ce0c6673451a7894d1460b592d378ca4871a0c72 \
+    --hash=sha256:059d7151fff513c53a4638da8778be7fce81a0c4854c7348ebd0c4078ddf28fe \
+    --hash=sha256:0c98c59075b890df8abfcc6ad632879540f5791c68baebacb4f833713b510e75 \
+    --hash=sha256:0f2fa354ba106eafff2c14b0cc51f22801d1e8b2e4149342023bd6f0955de5f5 \
+    --hash=sha256:12b04d1db2663b421fe072d638a138460a51d5a862403295671c4f3987fb9148 \
+    --hash=sha256:22d8798819f86720bc646ab015baff5ea4c971d68121cb36e2ebc2ee43ead2b7 \
+    --hash=sha256:233088b4b99ebcbc5258c755a097aa52fbf90727a03a5a80781c4b9c54347a2e \
+    --hash=sha256:24bd94bb301ec672d8f0623eba9226cc90d775d25a0c92b5f8e4965d7f3a1518 \
+    --hash=sha256:275424295f4256fd301744b8f335cff367825d270f155d522b30c7bf49903ee7 \
+    --hash=sha256:32fe6a41ad97302db2931f05bb91abbcc65b5ce4c675cd44b972428dd2947700 \
+    --hash=sha256:334edbcff10514ad1d66e3a70b339c0a29886394892490119dbb669627b17717 \
+    --hash=sha256:3bb9ec6436a820a4c006aad1ac351f12de2f2dbdaad171692ee457a02429b672 \
+    --hash=sha256:3ddcb27fb39171de36e207600116ac9dfd4ae46f86c82a9bf3934043e80ebb88 \
+    --hash=sha256:42e8804962f9e6f4be2cbaedc0c3718f08f60a16910fa3d86da5a1e3b1bfe60f \
+    --hash=sha256:43d044780732d9e0381ac8d5316f95d7f02ef04d6e4ef6dc82379f09795d993f \
+    --hash=sha256:46796877b47034b559a593d7e4b549aba151dae73f9e78212a3478161c12ab08 \
+    --hash=sha256:46d51518d53edfbe0563662c96954dc8fcace9832332b914375f45a99b77cc9a \
+    --hash=sha256:47604cb2159f8bbd5a1ab48a714557156320f20871ee64d550d8bf2683d980d3 \
+    --hash=sha256:4bbccb45260e4ff1b7db0be80a9025bb1e6698bdb808b83fff0000f7a90b2c0b \
+    --hash=sha256:4d4e5a0ceba319942fa6b585cf82539288a61e314ef006c1209f734551ab9536 \
+    --hash=sha256:55250fe61d6ebfd6934a272ee16ef1244e0f16b7af6cd18ab5b1fc9f08631db0 \
+    --hash=sha256:566df36fd0e901625523a5a1835032f1ebdd7f7886c54584143fa6c668b4df3b \
+    --hash=sha256:57ca426a48eb2c682dae8204cd89ea8ab7031e2675120a47924fabc7caacbc2a \
+    --hash=sha256:5e61abbec255be7b122aa461021daa7c3f310f3e743411a67079f9b3cc91ece3 \
+    --hash=sha256:618a308215b6cececb6240b9abde545e3acdabac7ae3e1d4e666896bf5ba44b4 \
+    --hash=sha256:62557958002b69699bdb7f5137c6714ca1133f045f97b3903964f47db97ea339 \
+    --hash=sha256:6270d717b11c5476b0cbb21eedc8d4dbb7d1a956fd6c15a23e96f197a6193158 \
+    --hash=sha256:685e93e9c8f399b0c96a624799820176312f5ceef958c0f88215af4013d29066 \
+    --hash=sha256:69469ce8ce7a8df4d37620e3163b71238719e1e2e5048d114a1b6ce0fbf8c662 \
+    --hash=sha256:6eb188b84269f357669b62cb576b5b918de10fb7c728a005fa0ebb0b758adce1 \
+    --hash=sha256:74ab4ee7794d7ed1b0c37e7333640e0f0a626fc7b398c07a7aef52f484fddde3 \
+    --hash=sha256:77641d299179c37b89cf2343ca9972c88bb6eef0d5fc504a2f86afd15cd5adf5 \
+    --hash=sha256:7c821c47ecfe05cc32140dcf8dc6fd5d21971c86dbd56eabfe5ba07a64910c01 \
+    --hash=sha256:7d6be30b2a75362325176c036d7fb8d19e8846c77e87683ffaa8177b35135613 \
+    --hash=sha256:7f605a456948c35260e7b2a39f8952a26f077fd25653c37740ed186b90aaa68a \
+    --hash=sha256:83101a6930332b87653886c01d1ee7e294b1fe46a07dd9a2d2b4f91bcc88eec0 \
+    --hash=sha256:88690f4e1f0fbf5339bedbb127e240fec1fd3070e9934c0b7bef83432f779d2f \
+    --hash=sha256:8a97ac839c2c6672c4865e48f3cbad7152cee85f4233fb4ca6291d775b9b954a \
+    --hash=sha256:8d6efc136f44a7e8bc8088507eaabbb8c2b55b3dbb63fe102c690da0ddebe55e \
+    --hash=sha256:8e20e511dc15265fb433571391ba313e10dd8ea7e509d51686a51313b4ac01a2 \
+    --hash=sha256:951d4a210744813be63019f3df343bf233b7432aadf0db54c75802247330d3af \
+    --hash=sha256:9ac7a3e245fd0310fd31495eb61af772e637bdf7d88ee81e7f10a3f271bff014 \
+    --hash=sha256:9b1c058c171b739e7c330760044803099c7fff11511e3ab3573e5327116a9c33 \
+    --hash=sha256:9c04bff9a5335eb95c6ecf1c117576a0aa560def274876fd156cfe5510fccc61 \
+    --hash=sha256:9c4969a86e41454f2858256c39bdfb966a20961e9b58bf8749b65abf447e9a8d \
+    --hash=sha256:9e0400fa22f79acc334d9a6b185dc00a44a8e6578aa7e12d0ddcd8434152b187 \
+    --hash=sha256:a05977bffe9bffd2229f477fa75eabe3192b1b05f408961d1bebff8d1cd4d401 \
+    --hash=sha256:a143af2ea6672f2af3f44ed8f9cd020e9cc34c56f0e8db12019d5d9ecf41cb3b \
+    --hash=sha256:a51d3db74ba489266ef55c7a4534eb0b8db9a326553df481c11e5d7660c8364d \
+    --hash=sha256:b95b2f470c1b2683febd2e7eab1d3f0e078c91dbdd0b00e9c645d07a413bb99f \
+    --hash=sha256:b9870d15ef00e4d0559ae10ee5bc71b654d1f20076dbe8bc7ed19b4c0625ceba \
+    --hash=sha256:c1dc3368794d522f43914e03312202523cc89692f5389c32bea0233924f8d977 \
+    --hash=sha256:c338ec6ec01c0bc8e735c58b9f5d51e75bacb6ff23296658826d7cfdfdb8678a \
+    --hash=sha256:c5070135e1b7409c4161133aa525419b0062088ed77c92b1da95366ec5cbebbe \
+    --hash=sha256:cc992c6ed024c8c3c592c5fc9846a03dd68a425674900c70122c77ea16c5fb0b \
+    --hash=sha256:d15950a57a210e36dd4cec1aac22787e2a4d57ba9318233e2ef8b2daf9ff2d5f \
+    --hash=sha256:d898cc2c76c135ef65517f4ddd7a3512fb41f23087b0650efb3418b8389a3cd1 \
+    --hash=sha256:d99945830a6f3e9638d89a28ed130b1eb24c91255e4f24366fbe699b983f29e4 \
+    --hash=sha256:da9b91bca419dc9b9267ffadde24eae9b1a6bffcd09d0a207e5e3af99a03ce0d \
+    --hash=sha256:df2d441bacf97022e81ad047e1597552eb3f83ca8a8f1a1fdd43cd7fe3898120 \
+    --hash=sha256:e06e617e3d4fd9e51d385dfe45b077a41e9d1b033a7702551e3278ac597dc750 \
+    --hash=sha256:ec44cfa7ef1a728e88ad41674de50f6db8cfdb3e2af84af86e0041aaf02d43d0 \
+    --hash=sha256:fb37f15714ec2652d574f021d479e78cd4eb9d04396dca36568fdfffb3487982
+    # via
+    #   mcp-agent-mail
+    #   sqlmodel
+sqlmodel==0.0.38 \
+    --hash=sha256:84e3fa990a77395461ded72a6c73173438ce8449d5c1c4d97fbff1b1df692649 \
+    --hash=sha256:d583ec237b14103809f74e8630032bc40ab68cd6b754a610f0813c56911a547b
+    # via mcp-agent-mail
+sse-starlette==3.4.1 \
+    --hash=sha256:6b43cf21f1d574d582a6e1b0cfbde1c94dc86a32a701a7168c99c4475c6bd1d0 \
+    --hash=sha256:f780bebcf6c8997fe514e3bd8e8c648d8284976b391c8bed0bcb1f611632b555
+    # via mcp
+starlette==1.0.0 \
+    --hash=sha256:6a4beaf1f81bb472fd19ea9b918b50dc3a77a6f2e190a12954b25e6ed5eea149 \
+    --hash=sha256:d3ec55e0bb321692d275455ddfd3df75fff145d009685eb40dc91fc66b03d38b
+    # via
+    #   fastapi
+    #   mcp
+    #   sse-starlette
+structlog==25.5.0 \
+    --hash=sha256:098522a3bebed9153d4570c6d0288abf80a031dfdb2048d59a49e9dc2190fc98 \
+    --hash=sha256:a8453e9b9e636ec59bd9e79bbd4a72f025981b3ba0f5837aebf48f02f37a7f9f
+    # via mcp-agent-mail
+tenacity==9.1.4 \
+    --hash=sha256:6095a360c919085f28c6527de529e76a06ad89b23659fa881ae0649b867a9d55 \
+    --hash=sha256:adb31d4c263f2bd041081ab33b498309a57c77f9acf2db65aadf0898179cf93a
+    # via mcp-agent-mail
+tiktoken==0.12.0 \
+    --hash=sha256:01d99484dc93b129cd0964f9d34eee953f2737301f18b3c7257bf368d7615baa \
+    --hash=sha256:04f0e6a985d95913cabc96a741c5ffec525a2c72e9df086ff17ebe35985c800e \
+    --hash=sha256:06a9f4f49884139013b138920a4c393aa6556b2f8f536345f11819389c703ebb \
+    --hash=sha256:09eb4eae62ae7e4c62364d9ec3a57c62eea707ac9a2b2c5d6bd05de6724ea179 \
+    --hash=sha256:0ee8f9ae00c41770b5f9b0bb1235474768884ae157de3beb5439ca0fd70f3e25 \
+    --hash=sha256:15d875454bbaa3728be39880ddd11a5a2a9e548c29418b41e8fd8a767172b5ec \
+    --hash=sha256:20cf97135c9a50de0b157879c3c4accbb29116bcf001283d26e073ff3b345946 \
+    --hash=sha256:285ba9d73ea0d6171e7f9407039a290ca77efcdb026be7769dccc01d2c8d7fff \
+    --hash=sha256:2b90f5ad190a4bb7c3eb30c5fa32e1e182ca1ca79f05e49b448438c3e225a49b \
+    --hash=sha256:2cff3688ba3c639ebe816f8d58ffbbb0aa7433e23e08ab1cade5d175fc973fb3 \
+    --hash=sha256:35a2f8ddd3824608b3d650a000c1ef71f730d0c56486845705a8248da00f9fe5 \
+    --hash=sha256:399c3dd672a6406719d84442299a490420b458c44d3ae65516302a99675888f3 \
+    --hash=sha256:3de02f5a491cfd179aec916eddb70331814bd6bf764075d39e21d5862e533970 \
+    --hash=sha256:3e68e3e593637b53e56f7237be560f7a394451cb8c11079755e80ae64b9e6def \
+    --hash=sha256:47a5bc270b8c3db00bb46ece01ef34ad050e364b51d406b6f9730b64ac28eded \
+    --hash=sha256:4a1a4fcd021f022bfc81904a911d3df0f6543b9e7627b51411da75ff2fe7a1be \
+    --hash=sha256:4c9614597ac94bb294544345ad8cf30dac2129c05e2db8dc53e082f355857af7 \
+    --hash=sha256:508fa71810c0efdcd1b898fda574889ee62852989f7c1667414736bcb2b9a4bd \
+    --hash=sha256:54c891b416a0e36b8e2045b12b33dd66fb34a4fe7965565f1b482da50da3e86a \
+    --hash=sha256:584c3ad3d0c74f5269906eb8a659c8bfc6144a52895d9261cdaf90a0ae5f4de0 \
+    --hash=sha256:5edb8743b88d5be814b1a8a8854494719080c28faaa1ccbef02e87354fe71ef0 \
+    --hash=sha256:604831189bd05480f2b885ecd2d1986dc7686f609de48208ebbbddeea071fc0b \
+    --hash=sha256:65b26c7a780e2139e73acc193e5c63ac754021f160df919add909c1492c0fb37 \
+    --hash=sha256:6de0da39f605992649b9cfa6f84071e3f9ef2cec458d08c5feb1b6f0ff62e134 \
+    --hash=sha256:6e227c7f96925003487c33b1b32265fad2fbcec2b7cf4817afb76d416f40f6bb \
+    --hash=sha256:6faa0534e0eefbcafaccb75927a4a380463a2eaa7e26000f0173b920e98b720a \
+    --hash=sha256:6fb2995b487c2e31acf0a9e17647e3b242235a20832642bb7a9d1a181c0c1bb1 \
+    --hash=sha256:775c2c55de2310cc1bc9a3ad8826761cbdc87770e586fd7b6da7d4589e13dab3 \
+    --hash=sha256:82991e04fc860afb933efb63957affc7ad54f83e2216fe7d319007dab1ba5892 \
+    --hash=sha256:83d16643edb7fa2c99eff2ab7733508aae1eebb03d5dfc46f5565862810f24e3 \
+    --hash=sha256:8f317e8530bb3a222547b85a58583238c8f74fd7a7408305f9f63246d1a0958b \
+    --hash=sha256:981a81e39812d57031efdc9ec59fa32b2a5a5524d20d4776574c4b4bd2e9014a \
+    --hash=sha256:9baf52f84a3f42eef3ff4e754a0db79a13a27921b457ca9832cf944c6be4f8f3 \
+    --hash=sha256:a01b12f69052fbe4b080a2cfb867c4de12c704b56178edf1d1d7b273561db160 \
+    --hash=sha256:a1af81a6c44f008cba48494089dd98cccb8b313f55e961a52f5b222d1e507967 \
+    --hash=sha256:a90388128df3b3abeb2bfd1895b0681412a8d7dc644142519e6f0a97c2111646 \
+    --hash=sha256:b18ba7ee2b093863978fcb14f74b3707cdc8d4d4d3836853ce7ec60772139931 \
+    --hash=sha256:b4e7ed1c6a7a8a60a3230965bdedba8cc58f68926b835e519341413370e0399a \
+    --hash=sha256:b6cfb6d9b7b54d20af21a912bfe63a2727d9cfa8fbda642fd8322c70340aad16 \
+    --hash=sha256:b8a0cd0c789a61f31bf44851defbd609e8dd1e2c8589c614cc1060940ef1f697 \
+    --hash=sha256:b97f74aca0d78a1ff21b8cd9e9925714c15a9236d6ceacf5c7327c117e6e21e8 \
+    --hash=sha256:c06cf0fcc24c2cb2adb5e185c7082a82cba29c17575e828518c2f11a01f445aa \
+    --hash=sha256:c2c714c72bc00a38ca969dae79e8266ddec999c7ceccd603cc4f0d04ccd76365 \
+    --hash=sha256:cbb9a3ba275165a2cb0f9a83f5d7025afe6b9d0ab01a22b50f0e74fee2ad253e \
+    --hash=sha256:cde24cdb1b8a08368f709124f15b36ab5524aac5fa830cc3fdce9c03d4fb8030 \
+    --hash=sha256:d186a5c60c6a0213f04a7a802264083dea1bbde92a2d4c7069e1a56630aef830 \
+    --hash=sha256:d51d75a5bffbf26f86554d28e78bfb921eae998edc2675650fd04c7e1f0cdc1e \
+    --hash=sha256:d5f89ea5680066b68bcb797ae85219c72916c922ef0fcdd3480c7d2315ffff16 \
+    --hash=sha256:da900aa0ad52247d8794e307d6446bd3cdea8e192769b56276695d34d2c9aa88 \
+    --hash=sha256:dc2dd125a62cb2b3d858484d6c614d136b5b848976794edfb63688d539b8b93f \
+    --hash=sha256:df37684ace87d10895acb44b7f447d4700349b12197a526da0d4a4149fde074c \
+    --hash=sha256:dfdfaa5ffff8993a3af94d1125870b1d27aed7cb97aa7eb8c1cefdbc87dbee63 \
+    --hash=sha256:edde1ec917dfd21c1f2f8046b86348b0f54a2c0547f68149d8600859598769ad \
+    --hash=sha256:f18f249b041851954217e9fd8e5c00b024ab2315ffda5ed77665a05fa91f42dc \
+    --hash=sha256:f61c0aea5565ac82e2ec50a05e02a6c44734e91b51c10510b084ea1b8e633a71 \
+    --hash=sha256:fc530a28591a2d74bce821d10b418b26a094bf33839e69042a6e86ddb7a7fb27 \
+    --hash=sha256:ffc5288f34a8bc02e1ea7047b8d041104791d2ddbf42d1e5fa07822cbffe16bd
+    # via
+    #   litellm
+    #   mcp-agent-mail
+tinycss2==1.5.1 \
+    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
+    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
+    # via mcp-agent-mail
+tokenizers==0.22.2 \
+    --hash=sha256:143b999bdc46d10febb15cbffb4207ddd1f410e2c755857b5a0797961bbdc113 \
+    --hash=sha256:1a62ba2c5faa2dd175aaeed7b15abf18d20266189fb3406c5d0550dd34dd5f37 \
+    --hash=sha256:1c774b1276f71e1ef716e5486f21e76333464f47bece56bbd554485982a9e03e \
+    --hash=sha256:1e418a55456beedca4621dbab65a318981467a2b188e982a23e117f115ce5001 \
+    --hash=sha256:1e50f8554d504f617d9e9d6e4c2c2884a12b388a97c5c77f0bc6cf4cd032feee \
+    --hash=sha256:2249487018adec45d6e3554c71d46eb39fa8ea67156c640f7513eb26f318cec7 \
+    --hash=sha256:25b85325d0815e86e0bac263506dd114578953b7b53d7de09a6485e4a160a7dd \
+    --hash=sha256:29c30b83d8dcd061078b05ae0cb94d3c710555fbb44861139f9f83dcca3dc3e4 \
+    --hash=sha256:319f659ee992222f04e58f84cbf407cfa66a65fe3a8de44e8ad2bc53e7d99012 \
+    --hash=sha256:369cc9fc8cc10cb24143873a0d95438bb8ee257bb80c71989e3ee290e8d72c67 \
+    --hash=sha256:37ae80a28c1d3265bb1f22464c856bd23c02a05bb211e56d0c5301a435be6c1a \
+    --hash=sha256:38337540fbbddff8e999d59970f3c6f35a82de10053206a7562f1ea02d046fa5 \
+    --hash=sha256:473b83b915e547aa366d1eee11806deaf419e17be16310ac0a14077f1e28f917 \
+    --hash=sha256:544dd704ae7238755d790de45ba8da072e9af3eea688f698b137915ae959281c \
+    --hash=sha256:64d94e84f6660764e64e7e0b22baa72f6cd942279fdbb21d46abd70d179f0195 \
+    --hash=sha256:753d47ebd4542742ef9261d9da92cd545b2cacbb48349a1225466745bb866ec4 \
+    --hash=sha256:791135ee325f2336f498590eb2f11dc5c295232f288e75c99a36c5dbce63088a \
+    --hash=sha256:9ce725d22864a1e965217204946f830c37876eee3b2ba6fc6255e8e903d5fcbc \
+    --hash=sha256:a6bf3f88c554a2b653af81f3204491c818ae2ac6fbc09e76ef4773351292bc92 \
+    --hash=sha256:bfb88f22a209ff7b40a576d5324bf8286b519d7358663db21d6246fb17eea2d5 \
+    --hash=sha256:c9ea31edff2968b44a88f97d784c2f16dc0729b8b143ed004699ebca91f05c48 \
+    --hash=sha256:df6c4265b289083bf710dff49bc51ef252f9d5be33a45ee2bed151114a56207b \
+    --hash=sha256:e10bf9113d209be7cd046d40fbabbaf3278ff6d18eb4da4c500443185dc1896c \
+    --hash=sha256:f01a9c019878532f98927d2bacb79bbb404b43d3437455522a00a30718cdedb5
+    # via litellm
+tqdm==4.67.3 \
+    --hash=sha256:7d825f03f89244ef73f1d4ce193cb1774a8179fd96f31d7e1dcde62092b960bb \
+    --hash=sha256:ee1e4c0e59148062281c49d80b25b67771a127c85fc9676d3be5f243206826bf
+    # via
+    #   huggingface-hub
+    #   openai
+typer==0.23.1 \
+    --hash=sha256:2070374e4d31c83e7b61362fd859aa683576432fd5b026b060ad6b4cd3b86134 \
+    --hash=sha256:3291ad0d3c701cbf522012faccfbb29352ff16ad262db2139e6b01f15781f14e
+    # via
+    #   huggingface-hub
+    #   mcp-agent-mail
+typing-extensions==4.15.0 \
+    --hash=sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466 \
+    --hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548
+    # via
+    #   aiosignal
+    #   anyio
+    #   exceptiongroup
+    #   fastapi
+    #   huggingface-hub
+    #   mcp
+    #   openai
+    #   py-key-value-shared
+    #   pydantic
+    #   pydantic-core
+    #   referencing
+    #   sqlalchemy
+    #   sqlmodel
+    #   starlette
+    #   typing-inspection
+typing-inspection==0.4.2 \
+    --hash=sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7 \
+    --hash=sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464
+    # via
+    #   fastapi
+    #   mcp
+    #   pydantic
+    #   pydantic-settings
+urllib3==2.6.3 \
+    --hash=sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed \
+    --hash=sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4
+    # via requests
+uvicorn==0.46.0 \
+    --hash=sha256:bbebbcbed972d162afca128605223022bedd345b7bc7855ce66deb31487a9048 \
+    --hash=sha256:fb9da0926999cc6cb22dc7cd71a94a632f078e6ae47ff683c5c420750fb7413d
+    # via
+    #   mcp
+    #   mcp-agent-mail
+uvloop==0.22.1 \
+    --hash=sha256:017bd46f9e7b78e81606329d07141d3da446f8798c6baeec124260e22c262772 \
+    --hash=sha256:0530a5fbad9c9e4ee3f2b33b148c6a64d47bbad8000ea63704fa8260f4cf728e \
+    --hash=sha256:05e4b5f86e621cf3927631789999e697e58f0d2d32675b67d9ca9eb0bca55743 \
+    --hash=sha256:0ae676de143db2b2f60a9696d7eca5bb9d0dd6cc3ac3dad59a8ae7e95f9e1b54 \
+    --hash=sha256:1489cf791aa7b6e8c8be1c5a080bae3a672791fcb4e9e12249b05862a2ca9cec \
+    --hash=sha256:17d4e97258b0172dfa107b89aa1eeba3016f4b1974ce85ca3ef6a66b35cbf659 \
+    --hash=sha256:1cdf5192ab3e674ca26da2eada35b288d2fa49fdd0f357a19f0e7c4e7d5077c8 \
+    --hash=sha256:1f38ec5e3f18c8a10ded09742f7fb8de0108796eb673f30ce7762ce1b8550cad \
+    --hash=sha256:286322a90bea1f9422a470d5d2ad82d38080be0a29c4dd9b3e6384320a4d11e7 \
+    --hash=sha256:297c27d8003520596236bdb2335e6b3f649480bd09e00d1e3a99144b691d2a35 \
+    --hash=sha256:37554f70528f60cad66945b885eb01f1bb514f132d92b6eeed1c90fd54ed6289 \
+    --hash=sha256:3879b88423ec7e97cd4eba2a443aa26ed4e59b45e6b76aabf13fe2f27023a142 \
+    --hash=sha256:3b7f102bf3cb1995cfeaee9321105e8f5da76fdb104cdad8986f85461a1b7b77 \
+    --hash=sha256:40631b049d5972c6755b06d0bfe8233b1bd9a8a6392d9d1c45c10b6f9e9b2733 \
+    --hash=sha256:481c990a7abe2c6f4fc3d98781cc9426ebd7f03a9aaa7eb03d3bfc68ac2a46bd \
+    --hash=sha256:4a968a72422a097b09042d5fa2c5c590251ad484acf910a651b4b620acd7f193 \
+    --hash=sha256:4baa86acedf1d62115c1dc6ad1e17134476688f08c6efd8a2ab076e815665c74 \
+    --hash=sha256:512fec6815e2dd45161054592441ef76c830eddaad55c8aa30952e6fe1ed07c0 \
+    --hash=sha256:51eb9bd88391483410daad430813d982010f9c9c89512321f5b60e2cddbdddd6 \
+    --hash=sha256:535cc37b3a04f6cd2c1ef65fa1d370c9a35b6695df735fcff5427323f2cd5473 \
+    --hash=sha256:53c85520781d84a4b8b230e24a5af5b0778efdb39142b424990ff1ef7c48ba21 \
+    --hash=sha256:55502bc2c653ed2e9692e8c55cb95b397d33f9f2911e929dc97c4d6b26d04242 \
+    --hash=sha256:561577354eb94200d75aca23fbde86ee11be36b00e52a4eaf8f50fb0c86b7705 \
+    --hash=sha256:56a2d1fae65fd82197cb8c53c367310b3eabe1bbb9fb5a04d28e3e3520e4f702 \
+    --hash=sha256:57df59d8b48feb0e613d9b1f5e57b7532e97cbaf0d61f7aa9aa32221e84bc4b6 \
+    --hash=sha256:6c84bae345b9147082b17371e3dd5d42775bddce91f885499017f4607fdaf39f \
+    --hash=sha256:6cde23eeda1a25c75b2e07d39970f3374105d5eafbaab2a4482be82f272d5a5e \
+    --hash=sha256:6e2ea3d6190a2968f4a14a23019d3b16870dd2190cd69c8180f7c632d21de68d \
+    --hash=sha256:700e674a166ca5778255e0e1dc4e9d79ab2acc57b9171b79e65feba7184b3370 \
+    --hash=sha256:7b5b1ac819a3f946d3b2ee07f09149578ae76066d70b44df3fa990add49a82e4 \
+    --hash=sha256:7cd375a12b71d33d46af85a3343b35d98e8116134ba404bd657b3b1d15988792 \
+    --hash=sha256:80eee091fe128e425177fbd82f8635769e2f32ec9daf6468286ec57ec0313efa \
+    --hash=sha256:93f617675b2d03af4e72a5333ef89450dfaa5321303ede6e67ba9c9d26878079 \
+    --hash=sha256:a592b043a47ad17911add5fbd087c76716d7c9ccc1d64ec9249ceafd735f03c2 \
+    --hash=sha256:ac33ed96229b7790eb729702751c0e93ac5bc3bcf52ae9eccbff30da09194b86 \
+    --hash=sha256:b31dc2fccbd42adc73bc4e7cdbae4fc5086cf378979e53ca5d0301838c5682c6 \
+    --hash=sha256:b45649628d816c030dba3c80f8e2689bab1c89518ed10d426036cdc47874dfc4 \
+    --hash=sha256:b76324e2dc033a0b2f435f33eb88ff9913c156ef78e153fb210e03c13da746b3 \
+    --hash=sha256:b91328c72635f6f9e0282e4a57da7470c7350ab1c9f48546c0f2866205349d21 \
+    --hash=sha256:badb4d8e58ee08dad957002027830d5c3b06aea446a6a3744483c2b3b745345c \
+    --hash=sha256:bc5ef13bbc10b5335792360623cc378d52d7e62c2de64660616478c32cd0598e \
+    --hash=sha256:c1955d5a1dd43198244d47664a5858082a3239766a839b2102a269aaff7a4e25 \
+    --hash=sha256:c3e5c6727a57cb6558592a95019e504f605d1c54eb86463ee9f7a2dbd411c820 \
+    --hash=sha256:c60ebcd36f7b240b30788554b6f0782454826a0ed765d8430652621b5de674b9 \
+    --hash=sha256:daf620c2995d193449393d6c62131b3fbd40a63bf7b307a1527856ace637fe88 \
+    --hash=sha256:e047cc068570bac9866237739607d1313b9253c3051ad84738cbb095be0537b2 \
+    --hash=sha256:ea721dd3203b809039fcc2983f14608dae82b212288b346e0bfe46ec2fab0b7c \
+    --hash=sha256:ef6f0d4cc8a9fa1f6a910230cd53545d9a14479311e87e3cb225495952eb672c \
+    --hash=sha256:fe94b4564e865d968414598eea1a6de60adba0c040ba4ed05ac1300de402cd42
+    # via uvicorn
+watchfiles==1.1.1 \
+    --hash=sha256:00485f441d183717038ed2e887a7c868154f216877653121068107b227a2f64c \
+    --hash=sha256:03fa0f5237118a0c5e496185cafa92878568b652a2e9a9382a5151b1a0380a43 \
+    --hash=sha256:04e78dd0b6352db95507fd8cb46f39d185cf8c74e4cf1e4fbad1d3df96faf510 \
+    --hash=sha256:059098c3a429f62fc98e8ec62b982230ef2c8df68c79e826e37b895bc359a9c0 \
+    --hash=sha256:08af70fd77eee58549cd69c25055dc344f918d992ff626068242259f98d598a2 \
+    --hash=sha256:0b495de0bb386df6a12b18335a0285dda90260f51bdb505503c02bcd1ce27a8b \
+    --hash=sha256:130e4876309e8686a5e37dba7d5e9bc77e6ed908266996ca26572437a5271e18 \
+    --hash=sha256:14e0b1fe858430fc0251737ef3824c54027bedb8c37c38114488b8e131cf8219 \
+    --hash=sha256:17ef139237dfced9da49fb7f2232c86ca9421f666d78c264c7ffca6601d154c3 \
+    --hash=sha256:1a0bb430adb19ef49389e1ad368450193a90038b5b752f4ac089ec6942c4dff4 \
+    --hash=sha256:1db5d7ae38ff20153d542460752ff397fcf5c96090c1230803713cf3147a6803 \
+    --hash=sha256:28475ddbde92df1874b6c5c8aaeb24ad5be47a11f87cde5a28ef3835932e3e94 \
+    --hash=sha256:2edc3553362b1c38d9f06242416a5d8e9fe235c204a4072e988ce2e5bb1f69f6 \
+    --hash=sha256:30f7da3fb3f2844259cba4720c3fc7138eb0f7b659c38f3bfa65084c7fc7abce \
+    --hash=sha256:311ff15a0bae3714ffb603e6ba6dbfba4065ab60865d15a6ec544133bdb21099 \
+    --hash=sha256:319b27255aacd9923b8a276bb14d21a5f7ff82564c744235fc5eae58d95422ae \
+    --hash=sha256:35c53bd62a0b885bf653ebf6b700d1bf05debb78ad9292cf2a942b23513dc4c4 \
+    --hash=sha256:36193ed342f5b9842edd3532729a2ad55c4160ffcfa3700e0d54be496b70dd43 \
+    --hash=sha256:39574d6370c4579d7f5d0ad940ce5b20db0e4117444e39b6d8f99db5676c52fd \
+    --hash=sha256:399600947b170270e80134ac854e21b3ccdefa11a9529a3decc1327088180f10 \
+    --hash=sha256:3a476189be23c3686bc2f4321dd501cb329c0a0469e77b7b534ee10129ae6374 \
+    --hash=sha256:3ad9fe1dae4ab4212d8c91e80b832425e24f421703b5a42ef2e4a1e215aff051 \
+    --hash=sha256:3bc570d6c01c206c46deb6e935a260be44f186a2f05179f52f7fcd2be086a94d \
+    --hash=sha256:3dbd8cbadd46984f802f6d479b7e3afa86c42d13e8f0f322d669d79722c8ec34 \
+    --hash=sha256:3e6f39af2eab0118338902798b5aa6664f46ff66bc0280de76fca67a7f262a49 \
+    --hash=sha256:3f53fa183d53a1d7a8852277c92b967ae99c2d4dcee2bfacff8868e6e30b15f7 \
+    --hash=sha256:3f6d37644155fb5beca5378feb8c1708d5783145f2a0f1c4d5a061a210254844 \
+    --hash=sha256:3f7eb7da0eb23aa2ba036d4f616d46906013a68caf61b7fdbe42fc8b25132e77 \
+    --hash=sha256:3fa0b59c92278b5a7800d3ee7733da9d096d4aabcfabb9a928918bd276ef9b9b \
+    --hash=sha256:421e29339983e1bebc281fab40d812742268ad057db4aee8c4d2bce0af43b741 \
+    --hash=sha256:4b943d3668d61cfa528eb949577479d3b077fd25fb83c641235437bc0b5bc60e \
+    --hash=sha256:526e86aced14a65a5b0ec50827c745597c782ff46b571dbfe46192ab9e0b3c33 \
+    --hash=sha256:52e06553899e11e8074503c8e716d574adeeb7e68913115c4b3653c53f9bae42 \
+    --hash=sha256:544364b2b51a9b0c7000a4b4b02f90e9423d97fbbf7e06689236443ebcad81ab \
+    --hash=sha256:5524298e3827105b61951a29c3512deb9578586abf3a7c5da4a8069df247cccc \
+    --hash=sha256:55c7475190662e202c08c6c0f4d9e345a29367438cf8e8037f3155e10a88d5a5 \
+    --hash=sha256:563b116874a9a7ce6f96f87cd0b94f7faf92d08d0021e837796f0a14318ef8da \
+    --hash=sha256:57ca5281a8b5e27593cb7d82c2ac927ad88a96ed406aa446f6344e4328208e9e \
+    --hash=sha256:5c85794a4cfa094714fb9c08d4a218375b2b95b8ed1666e8677c349906246c05 \
+    --hash=sha256:5f3bde70f157f84ece3765b42b4a52c6ac1a50334903c6eaf765362f6ccca88a \
+    --hash=sha256:5f3f58818dc0b07f7d9aa7fe9eb1037aecb9700e63e1f6acfed13e9fef648f5d \
+    --hash=sha256:5fac835b4ab3c6487b5dbad78c4b3724e26bcc468e886f8ba8cc4306f68f6701 \
+    --hash=sha256:620bae625f4cb18427b1bb1a2d9426dc0dd5a5ba74c7c2cdb9de405f7b129863 \
+    --hash=sha256:672b8adf25b1a0d35c96b5888b7b18699d27d4194bac8beeae75be4b7a3fc9b2 \
+    --hash=sha256:6aae418a8b323732fa89721d86f39ec8f092fc2af67f4217a2b07fd3e93c6101 \
+    --hash=sha256:6c3631058c37e4a0ec440bf583bc53cdbd13e5661bb6f465bc1d88ee9a0a4d02 \
+    --hash=sha256:6c9c9262f454d1c4d8aaa7050121eb4f3aea197360553699520767daebf2180b \
+    --hash=sha256:6e43d39a741e972bab5d8100b5cdacf69db64e34eb19b6e9af162bccf63c5cc6 \
+    --hash=sha256:7365b92c2e69ee952902e8f70f3ba6360d0d596d9299d55d7d386df84b6941fb \
+    --hash=sha256:743185e7372b7bc7c389e1badcc606931a827112fbbd37f14c537320fca08620 \
+    --hash=sha256:74472234c8370669850e1c312490f6026d132ca2d396abfad8830b4f1c096957 \
+    --hash=sha256:74d5012b7630714b66be7b7b7a78855ef7ad58e8650c73afc4c076a1f480a8d6 \
+    --hash=sha256:77a13aea58bc2b90173bc69f2a90de8e282648939a00a602e1dc4ee23e26b66d \
+    --hash=sha256:79ff6c6eadf2e3fc0d7786331362e6ef1e51125892c75f1004bd6b52155fb956 \
+    --hash=sha256:831a62658609f0e5c64178211c942ace999517f5770fe9436be4c2faeba0c0ef \
+    --hash=sha256:836398932192dae4146c8f6f737d74baeac8b70ce14831a239bdb1ca882fc261 \
+    --hash=sha256:842178b126593addc05acf6fce960d28bc5fae7afbaa2c6c1b3a7b9460e5be02 \
+    --hash=sha256:8526e8f916bb5b9a0a777c8317c23ce65de259422bba5b31325a6fa6029d33af \
+    --hash=sha256:859e43a1951717cc8de7f4c77674a6d389b106361585951d9e69572823f311d9 \
+    --hash=sha256:88863fbbc1a7312972f1c511f202eb30866370ebb8493aef2812b9ff28156a21 \
+    --hash=sha256:89eef07eee5e9d1fda06e38822ad167a044153457e6fd997f8a858ab7564a336 \
+    --hash=sha256:8c89f9f2f740a6b7dcc753140dd5e1ab9215966f7a3530d0c0705c83b401bd7d \
+    --hash=sha256:8c91ed27800188c2ae96d16e3149f199d62f86c7af5f5f4d2c61a3ed8cd3666c \
+    --hash=sha256:8ca65483439f9c791897f7db49202301deb6e15fe9f8fe2fed555bf986d10c31 \
+    --hash=sha256:8fbe85cb3201c7d380d3d0b90e63d520f15d6afe217165d7f98c9c649654db81 \
+    --hash=sha256:91d4c9a823a8c987cce8fa2690923b069966dabb196dd8d137ea2cede885fde9 \
+    --hash=sha256:9bb9f66367023ae783551042d31b1d7fd422e8289eedd91f26754a66f44d5cff \
+    --hash=sha256:a173cb5c16c4f40ab19cecf48a534c409f7ea983ab8fed0741304a1c0a31b3f2 \
+    --hash=sha256:a36d8efe0f290835fd0f33da35042a1bb5dc0e83cbc092dcf69bce442579e88e \
+    --hash=sha256:a55f3e9e493158d7bfdb60a1165035f1cf7d320914e7b7ea83fe22c6023b58fc \
+    --hash=sha256:a625815d4a2bdca61953dbba5a39d60164451ef34c88d751f6c368c3ea73d404 \
+    --hash=sha256:a916a2932da8f8ab582f242c065f5c81bed3462849ca79ee357dd9551b0e9b01 \
+    --hash=sha256:ac3cc5759570cd02662b15fbcd9d917f7ecd47efe0d6b40474eafd246f91ea18 \
+    --hash=sha256:acb08650863767cbc58bca4813b92df4d6c648459dcaa3d4155681962b2aa2d3 \
+    --hash=sha256:aebfd0861a83e6c3d1110b78ad54704486555246e542be3e2bb94195eabb2606 \
+    --hash=sha256:afaeff7696e0ad9f02cbb8f56365ff4686ab205fcf9c4c5b6fdfaaa16549dd04 \
+    --hash=sha256:b27cf2eb1dda37b2089e3907d8ea92922b673c0c427886d4edc6b94d8dfe5db3 \
+    --hash=sha256:b2cd9e04277e756a2e2d2543d65d1e2166d6fd4c9b183f8808634fda23f17b14 \
+    --hash=sha256:b9c4702f29ca48e023ffd9b7ff6b822acdf47cb1ff44cb490a3f1d5ec8987e9c \
+    --hash=sha256:bbe1ef33d45bc71cf21364df962af171f96ecaeca06bd9e3d0b583efb12aec82 \
+    --hash=sha256:bd404be08018c37350f0d6e34676bd1e2889990117a2b90070b3007f172d0610 \
+    --hash=sha256:bf0a91bfb5574a2f7fc223cf95eeea79abfefa404bf1ea5e339c0c1560ae99a0 \
+    --hash=sha256:bfb5862016acc9b869bb57284e6cb35fdf8e22fe59f7548858e2f971d045f150 \
+    --hash=sha256:bfff9740c69c0e4ed32416f013f3c45e2ae42ccedd1167ef2d805c000b6c71a5 \
+    --hash=sha256:c1f5210f1b8fc91ead1283c6fd89f70e76fb07283ec738056cf34d51e9c1d62c \
+    --hash=sha256:c2047d0b6cea13b3316bdbafbfa0c4228ae593d995030fda39089d36e64fc03a \
+    --hash=sha256:c22c776292a23bfc7237a98f791b9ad3144b02116ff10d820829ce62dff46d0b \
+    --hash=sha256:c755367e51db90e75b19454b680903631d41f9e3607fbd941d296a020c2d752d \
+    --hash=sha256:c882d69f6903ef6092bedfb7be973d9319940d56b8427ab9187d1ecd73438a70 \
+    --hash=sha256:cb467c999c2eff23a6417e58d75e5828716f42ed8289fe6b77a7e5a91036ca70 \
+    --hash=sha256:cdab464fee731e0884c35ae3588514a9bcf718d0e2c82169c1c4a85cc19c3c7f \
+    --hash=sha256:ce19e06cbda693e9e7686358af9cd6f5d61312ab8b00488bc36f5aabbaf77e24 \
+    --hash=sha256:ce70f96a46b894b36eba678f153f052967a0d06d5b5a19b336ab0dbbd029f73e \
+    --hash=sha256:cf57a27fb986c6243d2ee78392c503826056ffe0287e8794503b10fb51b881be \
+    --hash=sha256:d1715143123baeeaeadec0528bb7441103979a1d5f6fd0e1f915383fea7ea6d5 \
+    --hash=sha256:d6ff426a7cb54f310d51bfe83fe9f2bbe40d540c741dc974ebc30e6aa238f52e \
+    --hash=sha256:d7e7067c98040d646982daa1f37a33d3544138ea155536c2e0e63e07ff8a7e0f \
+    --hash=sha256:db476ab59b6765134de1d4fe96a1a9c96ddf091683599be0f26147ea1b2e4b88 \
+    --hash=sha256:dcc5c24523771db3a294c77d94771abcfcb82a0e0ee8efd910c37c59ec1b31bb \
+    --hash=sha256:de6da501c883f58ad50db3a32ad397b09ad29865b5f26f64c24d3e3281685849 \
+    --hash=sha256:e84087b432b6ac94778de547e08611266f1f8ffad28c0ee4c82e028b0fc5966d \
+    --hash=sha256:eef58232d32daf2ac67f42dea51a2c80f0d03379075d44a587051e63cc2e368c \
+    --hash=sha256:f096076119da54a6080e8920cbdaac3dbee667eb91dcc5e5b78840b87415bd44 \
+    --hash=sha256:f0ab1c1af0cb38e3f598244c17919fb1a84d1629cc08355b0074b6d7f53138ac \
+    --hash=sha256:f27db948078f3823a6bb3b465180db8ebecf26dd5dae6f6180bd87383b6b4428 \
+    --hash=sha256:f537afb3276d12814082a2e9b242bdcf416c2e8fd9f799a737990a1dbe906e5b \
+    --hash=sha256:f57b396167a2565a4e8b5e56a5a1c537571733992b226f4f1197d79e94cf0ae5 \
+    --hash=sha256:f8979280bdafff686ba5e4d8f97840f929a87ed9cdf133cbbd42f7766774d2aa \
+    --hash=sha256:f9a2ae5c91cecc9edd47e041a930490c31c3afb1f5e6d71de3dc671bfaca02bf
+    # via uvicorn
+webencodings==0.5.1 \
+    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
+    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
+    # via
+    #   bleach
+    #   tinycss2
+websockets==16.0 \
+    --hash=sha256:0298d07ee155e2e9fda5be8a9042200dd2e3bb0b8a38482156576f863a9d457c \
+    --hash=sha256:04cdd5d2d1dacbad0a7bf36ccbcd3ccd5a30ee188f2560b7a62a30d14107b31a \
+    --hash=sha256:08d7af67b64d29823fed316505a89b86705f2b7981c07848fb5e3ea3020c1abe \
+    --hash=sha256:152284a83a00c59b759697b7f9e9cddf4e3c7861dd0d964b472b70f78f89e80e \
+    --hash=sha256:1637db62fad1dc833276dded54215f2c7fa46912301a24bd94d45d46a011ceec \
+    --hash=sha256:19c4dc84098e523fd63711e563077d39e90ec6702aff4b5d9e344a60cb3c0cb1 \
+    --hash=sha256:1c1b30e4f497b0b354057f3467f56244c603a79c0d1dafce1d16c283c25f6e64 \
+    --hash=sha256:2b9f1e0d69bc60a4a87349d50c09a037a2607918746f07de04df9e43252c77a3 \
+    --hash=sha256:31a52addea25187bde0797a97d6fc3d2f92b6f72a9370792d65a6e84615ac8a8 \
+    --hash=sha256:32da954ffa2814258030e5a57bc73a3635463238e797c7375dc8091327434206 \
+    --hash=sha256:335c23addf3d5e6a8633f9f8eda77efad001671e80b95c491dd0924587ece0b3 \
+    --hash=sha256:3425ac5cf448801335d6fdc7ae1eb22072055417a96cc6b31b3861f455fbc156 \
+    --hash=sha256:349f83cd6c9a415428ee1005cadb5c2c56f4389bc06a9af16103c3bc3dcc8b7d \
+    --hash=sha256:37b31c1623c6605e4c00d466c9d633f9b812ea430c11c8a278774a1fde1acfa9 \
+    --hash=sha256:417b28978cdccab24f46400586d128366313e8a96312e4b9362a4af504f3bbad \
+    --hash=sha256:485c49116d0af10ac698623c513c1cc01c9446c058a4e61e3bf6c19dff7335a2 \
+    --hash=sha256:4a1aba3340a8dca8db6eb5a7986157f52eb9e436b74813764241981ca4888f03 \
+    --hash=sha256:50f23cdd8343b984957e4077839841146f67a3d31ab0d00e6b824e74c5b2f6e8 \
+    --hash=sha256:52a0fec0e6c8d9a784c2c78276a48a2bdf099e4ccc2a4cad53b27718dbfd0230 \
+    --hash=sha256:52ac480f44d32970d66763115edea932f1c5b1312de36df06d6b219f6741eed8 \
+    --hash=sha256:5569417dc80977fc8c2d43a86f78e0a5a22fee17565d78621b6bb264a115d4ea \
+    --hash=sha256:569d01a4e7fba956c5ae4fc988f0d4e187900f5497ce46339c996dbf24f17641 \
+    --hash=sha256:583b7c42688636f930688d712885cf1531326ee05effd982028212ccc13e5957 \
+    --hash=sha256:5a4b4cc550cb665dd8a47f868c8d04c8230f857363ad3c9caf7a0c3bf8c61ca6 \
+    --hash=sha256:5f451484aeb5cafee1ccf789b1b66f535409d038c56966d6101740c1614b86c6 \
+    --hash=sha256:5f6261a5e56e8d5c42a4497b364ea24d94d9563e8fbd44e78ac40879c60179b5 \
+    --hash=sha256:6e5a82b677f8f6f59e8dfc34ec06ca6b5b48bc4fcda346acd093694cc2c24d8f \
+    --hash=sha256:71c989cbf3254fbd5e84d3bff31e4da39c43f884e64f2551d14bb3c186230f00 \
+    --hash=sha256:781caf5e8eee67f663126490c2f96f40906594cb86b408a703630f95550a8c3e \
+    --hash=sha256:7be95cfb0a4dae143eaed2bcba8ac23f4892d8971311f1b06f3c6b78952ee70b \
+    --hash=sha256:7d837379b647c0c4c2355c2499723f82f1635fd2c26510e1f587d89bc2199e72 \
+    --hash=sha256:86890e837d61574c92a97496d590968b23c2ef0aeb8a9bc9421d174cd378ae39 \
+    --hash=sha256:878b336ac47938b474c8f982ac2f7266a540adc3fa4ad74ae96fea9823a02cc9 \
+    --hash=sha256:8b6e209ffee39ff1b6d0fa7bfef6de950c60dfb91b8fcead17da4ee539121a79 \
+    --hash=sha256:8cc451a50f2aee53042ac52d2d053d08bf89bcb31ae799cb4487587661c038a0 \
+    --hash=sha256:8d7f0659570eefb578dacde98e24fb60af35350193e4f56e11190787bee77dac \
+    --hash=sha256:8e1dab317b6e77424356e11e99a432b7cb2f3ec8c5ab4dabbcee6add48f72b35 \
+    --hash=sha256:8ff32bb86522a9e5e31439a58addbb0166f0204d64066fb955265c4e214160f0 \
+    --hash=sha256:95724e638f0f9c350bb1c2b0a7ad0e83d9cc0c9259f3ea94e40d7b02a2179ae5 \
+    --hash=sha256:9b5aca38b67492ef518a8ab76851862488a478602229112c4b0d58d63a7a4d5c \
+    --hash=sha256:a069d734c4a043182729edd3e9f247c3b2a4035415a9172fd0f1b71658a320a8 \
+    --hash=sha256:a0b31e0b424cc6b5a04b8838bbaec1688834b2383256688cf47eb97412531da1 \
+    --hash=sha256:a35539cacc3febb22b8f4d4a99cc79b104226a756aa7400adc722e83b0d03244 \
+    --hash=sha256:a5e18a238a2b2249c9a9235466b90e96ae4795672598a58772dd806edc7ac6d3 \
+    --hash=sha256:a653aea902e0324b52f1613332ddf50b00c06fdaf7e92624fbf8c77c78fa5767 \
+    --hash=sha256:abf050a199613f64c886ea10f38b47770a65154dc37181bfaff70c160f45315a \
+    --hash=sha256:af80d74d4edfa3cb9ed973a0a5ba2b2a549371f8a741e0800cb07becdd20f23d \
+    --hash=sha256:b14dc141ed6d2dde437cddb216004bcac6a1df0935d79656387bd41632ba0bbd \
+    --hash=sha256:b784ca5de850f4ce93ec85d3269d24d4c82f22b7212023c974c401d4980ebc5e \
+    --hash=sha256:bc59589ab64b0022385f429b94697348a6a234e8ce22544e3681b2e9331b5944 \
+    --hash=sha256:c0204dc62a89dc9d50d682412c10b3542d748260d743500a85c13cd1ee4bde82 \
+    --hash=sha256:c0ee0e63f23914732c6d7e0cce24915c48f3f1512ec1d079ed01fc629dab269d \
+    --hash=sha256:caab51a72c51973ca21fa8a18bd8165e1a0183f1ac7066a182ff27107b71e1a4 \
+    --hash=sha256:d6297ce39ce5c2e6feb13c1a996a2ded3b6832155fcfc920265c76f24c7cceb5 \
+    --hash=sha256:daa3b6ff70a9241cf6c7fc9e949d41232d9d7d26fd3522b1ad2b4d62487e9904 \
+    --hash=sha256:df57afc692e517a85e65b72e165356ed1df12386ecb879ad5693be08fac65dde \
+    --hash=sha256:e0334872c0a37b606418ac52f6ab9cfd17317ac26365f7f65e203e2d0d0d359f \
+    --hash=sha256:e6578ed5b6981005df1860a56e3617f14a6c307e6a71b4fff8c48fdc50f3ed2c \
+    --hash=sha256:eaded469f5e5b7294e2bdca0ab06becb6756ea86894a47806456089298813c89 \
+    --hash=sha256:f4a32d1bd841d4bcbffdcb3d2ce50c09c3909fbead375ab28d0181af89fd04da \
+    --hash=sha256:fd3cb4adb94a2a6e2b7c0d8d05cb94e6f1c81a0cf9dc2694fb65c7e8d94c42e4
+    # via
+    #   fastmcp
+    #   uvicorn
+yarl==1.23.0 \
+    --hash=sha256:03214408cfa590df47728b84c679ae4ef00be2428e11630277be0727eba2d7cc \
+    --hash=sha256:041b1a4cefacf65840b4e295c6985f334ba83c30607441ae3cf206a0eed1a2e4 \
+    --hash=sha256:0793e2bd0cf14234983bbb371591e6bea9e876ddf6896cdcc93450996b0b5c85 \
+    --hash=sha256:0e1fdaa14ef51366d7757b45bde294e95f6c8c049194e793eedb8387c86d5993 \
+    --hash=sha256:0e40111274f340d32ebcc0a5668d54d2b552a6cca84c9475859d364b380e3222 \
+    --hash=sha256:115136c4a426f9da976187d238e84139ff6b51a20839aa6e3720cd1026d768de \
+    --hash=sha256:13a563739ae600a631c36ce096615fe307f131344588b0bc0daec108cdb47b25 \
+    --hash=sha256:16c6994ac35c3e74fb0ae93323bf8b9c2a9088d55946109489667c510a7d010e \
+    --hash=sha256:170e26584b060879e29fac213e4228ef063f39128723807a312e5c7fec28eff2 \
+    --hash=sha256:17235362f580149742739cc3828b80e24029d08cbb9c4bda0242c7b5bc610a8e \
+    --hash=sha256:1932b6b8bba8d0160a9d1078aae5838a66039e8832d41d2992daa9a3a08f7860 \
+    --hash=sha256:1b6b572edd95b4fa8df75de10b04bc81acc87c1c7d16bcdd2035b09d30acc957 \
+    --hash=sha256:1c3a3598a832590c5a3ce56ab5576361b5688c12cb1d39429cf5dba30b510760 \
+    --hash=sha256:1c57676bdedc94cd3bc37724cf6f8cd2779f02f6aba48de45feca073e714fe52 \
+    --hash=sha256:1dc702e42d0684f42d6519c8d581e49c96cefaaab16691f03566d30658ee8788 \
+    --hash=sha256:21d1b7305a71a15b4794b5ff22e8eef96ff4a6d7f9657155e5aa419444b28912 \
+    --hash=sha256:23f371bd662cf44a7630d4d113101eafc0cfa7518a2760d20760b26021454719 \
+    --hash=sha256:2569b67d616eab450d262ca7cb9f9e19d2f718c70a8b88712859359d0ab17035 \
+    --hash=sha256:263cd4f47159c09b8b685890af949195b51d1aa82ba451c5847ca9bc6413c220 \
+    --hash=sha256:2803ed8b21ca47a43da80a6fd1ed3019d30061f7061daa35ac54f63933409412 \
+    --hash=sha256:2a6940a074fb3c48356ed0158a3ca5699c955ee4185b4d7d619be3c327143e05 \
+    --hash=sha256:2e27c8841126e017dd2a054a95771569e6070b9ee1b133366d8b31beb5018a41 \
+    --hash=sha256:31c9921eb8bd12633b41ad27686bbb0b1a2a9b8452bfdf221e34f311e9942ed4 \
+    --hash=sha256:34b6cf500e61c90f305094911f9acc9c86da1a05a7a3f5be9f68817043f486e4 \
+    --hash=sha256:3650dc2480f94f7116c364096bc84b1d602f44224ef7d5c7208425915c0475dd \
+    --hash=sha256:389871e65468400d6283c0308e791a640b5ab5c83bcee02a2f51295f95e09748 \
+    --hash=sha256:39004f0ad156da43e86aa71f44e033de68a44e5a31fc53507b36dd253970054a \
+    --hash=sha256:394906945aa8b19fc14a61cf69743a868bb8c465efe85eee687109cc540b98f4 \
+    --hash=sha256:3ceb13c5c858d01321b5d9bb65e4cf37a92169ea470b70fec6f236b2c9dd7e34 \
+    --hash=sha256:411225bae281f114067578891bc75534cfb3d92a3b4dfef7a6ca78ba354e6069 \
+    --hash=sha256:44bb7bef4ea409384e3f8bc36c063d77ea1b8d4a5b2706956c0d6695f07dcc25 \
+    --hash=sha256:4503053d296bc6e4cbd1fad61cf3b6e33b939886c4f249ba7c78b602214fabe2 \
+    --hash=sha256:4764a6a7588561a9aef92f65bda2c4fb58fe7c675c0883862e6df97559de0bfb \
+    --hash=sha256:4966242ec68afc74c122f8459abd597afd7d8a60dc93d695c1334c5fd25f762f \
+    --hash=sha256:4a42e651629dafb64fd5b0286a3580613702b5809ad3f24934ea87595804f2c5 \
+    --hash=sha256:4a59ba56f340334766f3a4442e0efd0af895fae9e2b204741ef885c446b3a1a8 \
+    --hash=sha256:4c41e021bc6d7affb3364dc1e1e5fa9582b470f283748784bd6ea0558f87f42c \
+    --hash=sha256:5023346c4ee7992febc0068e7593de5fa2bf611848c08404b35ebbb76b1b0512 \
+    --hash=sha256:50f9d8d531dfb767c565f348f33dd5139a6c43f5cbdf3f67da40d54241df93f6 \
+    --hash=sha256:51430653db848d258336cfa0244427b17d12db63d42603a55f0d4546f50f25b5 \
+    --hash=sha256:531ef597132086b6cf96faa7c6c1dcd0361dd5f1694e5cc30375907b9b7d3ea9 \
+    --hash=sha256:53ad387048f6f09a8969631e4de3f1bf70c50e93545d64af4f751b2498755072 \
+    --hash=sha256:53b1ea6ca88ebd4420379c330aea57e258408dd0df9af0992e5de2078dc9f5d5 \
+    --hash=sha256:575aa4405a656e61a540f4a80eaa5260f2a38fff7bfdc4b5f611840d76e9e277 \
+    --hash=sha256:578110dd426f0d209d1509244e6d4a3f1a3e9077655d98c5f22583d63252a08a \
+    --hash=sha256:5ec2f42d41ccbd5df0270d7df31618a8ee267bfa50997f5d720ddba86c4a83a6 \
+    --hash=sha256:5ee586fb17ff8f90c91cf73c6108a434b02d69925f44f5f8e0d7f2f260607eae \
+    --hash=sha256:5f10fd85e4b75967468af655228fbfd212bdf66db1c0d135065ce288982eda26 \
+    --hash=sha256:609d3614d78d74ebe35f54953c5bbd2ac647a7ddb9c30a5d877580f5e86b22f2 \
+    --hash=sha256:62694e275c93d54f7ccedcfef57d42761b2aad5234b6be1f3e3026cae4001cd4 \
+    --hash=sha256:63e92247f383c85ab00dd0091e8c3fa331a96e865459f5ee80353c70a4a42d70 \
+    --hash=sha256:682bae25f0a0dd23a056739f23a134db9f52a63e2afd6bfb37ddc76292bbd723 \
+    --hash=sha256:6b41389c19b07c760c7e427a3462e8ab83c4bb087d127f0e854c706ce1b9215c \
+    --hash=sha256:6e87a6e8735b44816e7db0b2fbc9686932df473c826b0d9743148432e10bb9b9 \
+    --hash=sha256:6f0fd84de0c957b2d280143522c4f91a73aada1923caee763e24a2b3fda9f8a5 \
+    --hash=sha256:70efd20be968c76ece7baa8dafe04c5be06abc57f754d6f36f3741f7aa7a208e \
+    --hash=sha256:71d006bee8397a4a89f469b8deb22469fe7508132d3c17fa6ed871e79832691c \
+    --hash=sha256:73309162a6a571d4cbd3b6a1dcc703c7311843ae0d1578df6f09be4e98df38d4 \
+    --hash=sha256:75e3026ab649bf48f9a10c0134512638725b521340293f202a69b567518d94e0 \
+    --hash=sha256:76855800ac56f878847a09ce6dba727c93ca2d89c9e9d63002d26b916810b0a2 \
+    --hash=sha256:7c6b9461a2a8b47c65eef63bb1c76a4f1c119618ffa99ea79bc5bb1e46c5821b \
+    --hash=sha256:803a3c3ce4acc62eaf01eaca1208dcf0783025ef27572c3336502b9c232005e7 \
+    --hash=sha256:80e6d33a3d42a7549b409f199857b4fb54e2103fc44fb87605b6663b7a7ff750 \
+    --hash=sha256:8419ebd326430d1cbb7efb5292330a2cf39114e82df5cc3d83c9a0d5ebeaf2f2 \
+    --hash=sha256:85610b4f27f69984932a7abbe52703688de3724d9f72bceb1cca667deff27474 \
+    --hash=sha256:85e9beda1f591bc73e77ea1c51965c68e98dafd0fec72cdd745f77d727466716 \
+    --hash=sha256:877b0738624280e34c55680d6054a307aa94f7d52fa0e3034a9cc6e790871da7 \
+    --hash=sha256:88f9fb0116fbfcefcab70f85cf4b74a2b6ce5d199c41345296f49d974ddb4123 \
+    --hash=sha256:8c4fe09e0780c6c3bf2b7d4af02ee2394439d11a523bbcf095cf4747c2932007 \
+    --hash=sha256:93a784271881035ab4406a172edb0faecb6e7d00f4b53dc2f55919d6c9688595 \
+    --hash=sha256:94f8575fbdf81749008d980c17796097e645574a3b8c28ee313931068dad14fe \
+    --hash=sha256:95451e6ce06c3e104556d73b559f5da6c34a069b6b62946d3ad66afcd51642ea \
+    --hash=sha256:99c8a9ed30f4164bc4c14b37a90208836cbf50d4ce2a57c71d0f52c7fb4f7598 \
+    --hash=sha256:9a18d6f9359e45722c064c97464ec883eb0e0366d33eda61cb19a244bf222679 \
+    --hash=sha256:9cbf44c5cb4a7633d078788e1b56387e3d3cf2b8139a3be38040b22d6c3221c8 \
+    --hash=sha256:9ee33b875f0b390564c1fb7bc528abf18c8ee6073b201c6ae8524aca778e2d83 \
+    --hash=sha256:a0e317df055958a0c1e79e5d2aa5a5eaa4a6d05a20d4b0c9c3f48918139c9fc6 \
+    --hash=sha256:a2df6afe50dea8ae15fa34c9f824a3ee958d785fd5d089063d960bae1daa0a3f \
+    --hash=sha256:a31de1613658308efdb21ada98cbc86a97c181aa050ba22a808120bb5be3ab94 \
+    --hash=sha256:a3d2bff8f37f8d0f96c7ec554d16945050d54462d6e95414babaa18bfafc7f51 \
+    --hash=sha256:a41bcf68efd19073376eb8cf948b8d9be0af26256403e512bb18f3966f1f9120 \
+    --hash=sha256:a82836cab5f197a0514235aaf7ffccdc886ccdaa2324bc0aafdd4ae898103039 \
+    --hash=sha256:a8d00f29b42f534cc8aa3931cfe773b13b23e561e10d2b26f27a8d309b0e82a1 \
+    --hash=sha256:aafe5dcfda86c8af00386d7781d4c2181b5011b7be3f2add5e99899ea925df05 \
+    --hash=sha256:ab5f043cb8a2d71c981c09c510da013bc79fd661f5c60139f00dd3c3cc4f2ffb \
+    --hash=sha256:ac09d42f48f80c9ee1635b2fcaa819496a44502737660d3c0f2ade7526d29144 \
+    --hash=sha256:aecfed0b41aa72b7881712c65cf764e39ce2ec352324f5e0837c7048d9e6daaa \
+    --hash=sha256:b2c6b50c7b0464165472b56b42d4c76a7b864597007d9c085e8b63e185cf4a7a \
+    --hash=sha256:b35d13d549077713e4414f927cdc388d62e543987c572baee613bf82f11a4b99 \
+    --hash=sha256:b39cb32a6582750b6cc77bfb3c49c0f8760dc18dc96ec9fb55fbb0f04e08b928 \
+    --hash=sha256:b5405bb8f0e783a988172993cfc627e4d9d00432d6bbac65a923041edacf997d \
+    --hash=sha256:baaf55442359053c7d62f6f8413a62adba3205119bcb6f49594894d8be47e5e3 \
+    --hash=sha256:bd654fad46d8d9e823afbb4f87c79160b5a374ed1ff5bde24e542e6ba8f41434 \
+    --hash=sha256:be61f6fff406ca40e3b1d84716fde398fc08bc63dd96d15f3a14230a0973ed86 \
+    --hash=sha256:bf49a3ae946a87083ef3a34c8f677ae4243f5b824bfc4c69672e72b3d6719d46 \
+    --hash=sha256:c4a80f77dc1acaaa61f0934176fccca7096d9b1ff08c8ba9cddf5ae034a24319 \
+    --hash=sha256:c75eb09e8d55bceb4367e83496ff8ef2bc7ea6960efb38e978e8073ea59ecb67 \
+    --hash=sha256:c7f8dc16c498ff06497c015642333219871effba93e4a2e8604a06264aca5c5c \
+    --hash=sha256:c8aa34a5c864db1087d911a0b902d60d203ea3607d91f615acd3f3108ac32169 \
+    --hash=sha256:cbb0fef01f0c6b38cb0f39b1f78fc90b807e0e3c86a7ff3ce74ad77ce5c7880c \
+    --hash=sha256:cde9a2ecd91668bcb7f077c4966d8ceddb60af01b52e6e3e2680e4cf00ad1a59 \
+    --hash=sha256:cff6d44cb13d39db2663a22b22305d10855efa0fa8015ddeacc40bc59b9d8107 \
+    --hash=sha256:d1009abedb49ae95b136a8904a3f71b342f849ffeced2d3747bf29caeda218c4 \
+    --hash=sha256:d38c1e8231722c4ce40d7593f28d92b5fc72f3e9774fe73d7e800ec32299f63a \
+    --hash=sha256:d53834e23c015ee83a99377db6e5e37d8484f333edb03bd15b4bc312cc7254fb \
+    --hash=sha256:d7504f2b476d21653e4d143f44a175f7f751cd41233525312696c76aa3dbb23f \
+    --hash=sha256:dbf507e9ef5688bada447a24d68b4b58dd389ba93b7afc065a2ba892bea54769 \
+    --hash=sha256:dc52310451fc7c629e13c4e061cbe2dd01684d91f2f8ee2821b083c58bd72432 \
+    --hash=sha256:dd00607bffbf30250fe108065f07453ec124dbf223420f57f5e749b04295e090 \
+    --hash=sha256:dda608c88cf709b1d406bdfcd84d8d63cff7c9e577a403c6108ce8ce9dcc8764 \
+    --hash=sha256:debe9c4f41c32990771be5c22b56f810659f9ddf3d63f67abfdcaa2c6c9c5c1d \
+    --hash=sha256:e09fd068c2e169a7070d83d3bde728a4d48de0549f975290be3c108c02e499b4 \
+    --hash=sha256:e0fd068364a6759bc794459f0a735ab151d11304346332489c7972bacbe9e72b \
+    --hash=sha256:e4c53f8347cd4200f0d70a48ad059cabaf24f5adc6ba08622a23423bc7efa10d \
+    --hash=sha256:e5723c01a56c5028c807c701aa66722916d2747ad737a046853f6c46f4875543 \
+    --hash=sha256:e7b0460976dc75cb87ad9cc1f9899a4b97751e7d4e77ab840fc9b6d377b8fd24 \
+    --hash=sha256:e9d9a4d06d3481eab79803beb4d9bd6f6a8e781ec078ac70d7ef2dcc29d1bea5 \
+    --hash=sha256:ead11956716a940c1abc816b7df3fa2b84d06eaed8832ca32f5c5e058c65506b \
+    --hash=sha256:ed5f69ce7be7902e5c70ea19eb72d20abf7d725ab5d49777d696e32d4fc1811d \
+    --hash=sha256:f2af5c81a1f124609d5f33507082fc3f739959d4719b56877ab1ee7e7b3d602b \
+    --hash=sha256:f40e782d49630ad384db66d4d8b73ff4f1b8955dc12e26b09a3e3af064b3b9d6 \
+    --hash=sha256:f514f6474e04179d3d33175ed3f3e31434d3130d42ec153540d5b157deefd735 \
+    --hash=sha256:f69f57305656a4852f2a7203efc661d8c042e6cc67f7acd97d8667fb448a426e \
+    --hash=sha256:fb1e8b8d66c278b21d13b0a7ca22c41dd757a7c209c6b12c313e445c31dd3b28 \
+    --hash=sha256:fb4948814a2a98e3912505f09c9e7493b1506226afb1f881825368d6fb776ee3 \
+    --hash=sha256:fda207c815b253e34f7e1909840fd14299567b1c0eb4908f8c2ce01a41265401 \
+    --hash=sha256:fe8f8f5e70e6dbdfca9882cd9deaac058729bcf323cf7a58660901e55c9c94f6 \
+    --hash=sha256:fffc45637bcd6538de8b85f51e3df3223e4ad89bccbfca0481c08c7fc8b7ed7d
+    # via aiohttp
+zipp==3.23.1 \
+    --hash=sha256:0b3596c50a5c700c9cb40ba8d86d9f2cc4807e9bedb06bcdf7fac85633e444dc \
+    --hash=sha256:32120e378d32cd9714ad503c1d024619063ec28aad2248dc6672ad13edfa5110
+    # via importlib-metadata
diff --git a/.github/scripts/install-bd-archive.sh b/.github/scripts/install-bd-archive.sh
new file mode 100755
index 0000000000..5025a26362
--- /dev/null
+++ b/.github/scripts/install-bd-archive.sh
@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'USAGE'
+Usage: install-bd-archive.sh VERSION [--cache]
+
+Downloads a bd release tarball, verifies its pinned SHA-256, and installs bd.
+Use --cache on self-hosted runners to install under RUNNER_TOOL_CACHE/HOME
+and add that bin directory to GITHUB_PATH.
+USAGE
+}
+
+version="${1:-}"
+if [[ -z "$version" ]]; then
+  usage
+  exit 2
+fi
+shift || true
+
+use_cache=false
+while (($#)); do
+  case "$1" in
+    --cache) use_cache=true ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+case "$(uname -s)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  *)
+    echo "Unsupported OS: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+
+case "$(uname -m)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=amd64 ;;
+  *)
+    echo "Unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+version_no_v="${version#v}"
+platform_tuple="${os}_${arch}"
+expected_sha=""
+case "${version}:${platform_tuple}" in
+  v1.0.3:linux_amd64) expected_sha="1ef5dca818d7e81574df9e9f9fc2a16ab711da09b0fa7b822ae162d9a81c8912" ;;
+  v1.0.3:linux_arm64) expected_sha="243a9c75012e794888fcafb957e7624b8fefdfef033d14cd03ebc9831c3bc12f" ;;
+  v1.0.3:darwin_amd64) expected_sha="6bd75ac056288a5e8bbb203750e95af5a441d5ad1d20ca5511e60cd6c813e54b" ;;
+  v1.0.3:darwin_arm64) expected_sha="fe6e4465751f46d9f3a670c3cf656714a171e44c8bc318fe19054f513b8306ed" ;;
+  v1.0.0:linux_amd64) expected_sha="7057db1e92428fcf5c08d5dc6b07ead57e588b262cba78b9a26893d55bd29fdb" ;;
+  v1.0.0:linux_arm64) expected_sha="9bb30413041e50dac945a0f8aa64011e4b345ebfd0a3f9b5fccd646c6dca61a7" ;;
+  v1.0.0:darwin_amd64) expected_sha="9a3d5bca07c9ce809c205ef9a20f73de6503ab3714655239ce306d862ceeb0d0" ;;
+  v1.0.0:darwin_arm64) expected_sha="b8763b428e6b68550eb2b2505483797794b49ae497a2e265ed3c60f0f0a0bcd2" ;;
+esac
+
+github_release_asset_sha() {
+  local owner_repo="$1"
+  local tag="$2"
+  local asset="$3"
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq is required to resolve GitHub release asset checksums" >&2
+    exit 1
+  fi
+  local auth_header=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    auth_header=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+  fi
+  curl -fsSL "${auth_header[@]}" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/${owner_repo}/releases/tags/${tag}" \
+    | jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .digest // empty' \
+    | sed 's/^sha256://'
+}
+
+archive="beads_${version_no_v}_${platform_tuple}.tar.gz"
+if [[ -z "$expected_sha" ]]; then
+  expected_sha="$(github_release_asset_sha "gastownhall/beads" "$version" "$archive")"
+  if [[ -z "$expected_sha" ]]; then
+    echo "No bd checksum found for ${version}/${platform_tuple}" >&2
+    exit 1
+  fi
+fi
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d ' ' -f 1
+  else
+    shasum -a 256 "$1" | cut -d ' ' -f 1
+  fi
+}
+
+install_binary() {
+  local src="$1"
+  local dst="$2"
+  mkdir -p "$(dirname "$dst")"
+  install -m 0755 "$src" "$dst"
+}
+
+install_binary_with_sudo_fallback() {
+  local src="$1"
+  local dst="$2"
+  local dst_dir
+  dst_dir="$(dirname "$dst")"
+  mkdir -p "$dst_dir"
+  if [[ -w "$dst_dir" ]]; then
+    install_binary "$src" "$dst"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo install -m 0755 "$src" "$dst"
+  else
+    echo "Cannot write $dst and sudo is unavailable" >&2
+    exit 1
+  fi
+}
+
+if $use_cache; then
+  cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
+  bin_dir="${cache_root}/gascity-bd/${version}/${platform_tuple}/bin"
+else
+  bin_dir="${BD_INSTALL_BIN_DIR:-/usr/local/bin}"
+fi
+
+target="${bin_dir}/bd"
+if [[ -x "$target" ]]; then
+  echo "Reusing cached bd ${version} at ${target}"
+else
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+  curl -fsSL -o "${tmp}/${archive}" \
+    "https://github.com/gastownhall/beads/releases/download/${version}/${archive}"
+  actual_sha="$(sha256_file "${tmp}/${archive}")"
+  if [[ "$actual_sha" != "$expected_sha" ]]; then
+    echo "bd checksum mismatch for ${version}/${platform_tuple}" >&2
+    echo "expected: $expected_sha" >&2
+    echo "actual:   $actual_sha" >&2
+    exit 1
+  fi
+  tar -xzf "${tmp}/${archive}" -C "$tmp"
+  src="${tmp}/bd"
+  if [[ ! -x "$src" ]]; then
+    src="${tmp}/beads_${version_no_v}_${platform_tuple}/bd"
+  fi
+  if $use_cache; then
+    install_binary "$src" "$target"
+  else
+    install_binary_with_sudo_fallback "$src" "$target"
+  fi
+fi
+
+if $use_cache && [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$bin_dir" >> "$GITHUB_PATH"
+fi
+
+"$target" version
diff --git a/.github/scripts/install-br-archive.sh b/.github/scripts/install-br-archive.sh
new file mode 100755
index 0000000000..772b242d3e
--- /dev/null
+++ b/.github/scripts/install-br-archive.sh
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'USAGE'
+Usage: install-br-archive.sh VERSION [--cache]
+
+Downloads a br release tarball, verifies its pinned SHA-256, and installs br.
+Use --cache on self-hosted runners to install under RUNNER_TOOL_CACHE/HOME
+and add that bin directory to GITHUB_PATH.
+USAGE
+}
+
+version="${1:-}"
+if [[ -z "$version" ]]; then
+  usage
+  exit 2
+fi
+shift || true
+
+use_cache=false
+while (($#)); do
+  case "$1" in
+    --cache) use_cache=true ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+case "$(uname -s)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  *)
+    echo "Unsupported OS: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+
+case "$(uname -m)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=amd64 ;;
+  *)
+    echo "Unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+version_no_v="${version#v}"
+tag="v${version_no_v}"
+platform_tuple="${os}_${arch}"
+expected_sha=""
+case "${tag}:${platform_tuple}" in
+  v0.1.20:linux_amd64) expected_sha="aefc2ef6b16c7b275f6890636c110540c7bc081e203a1e8a706a376207d1f9dd" ;;
+  v0.1.20:linux_arm64) expected_sha="20899316274b7ac40de477f3318a3d6391f7885c6cd1bec7ba10e828360207fb" ;;
+  v0.1.20:darwin_amd64) expected_sha="b53f109e3f288d23d2918bc9dcf7fa9997351d79bfab6be54ca18bc41d504d58" ;;
+  v0.1.20:darwin_arm64) expected_sha="705a13ab7c972bff97440656633210ca2c88cd49c1094a6007a98983d73fbb1d" ;;
+esac
+
+github_release_asset_sha() {
+  local owner_repo="$1"
+  local release_tag="$2"
+  local asset="$3"
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq is required to resolve GitHub release asset checksums" >&2
+    exit 1
+  fi
+  local auth_header=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    auth_header=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+  fi
+  curl -fsSL "${auth_header[@]}" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/${owner_repo}/releases/tags/${release_tag}" \
+    | jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .digest // empty' \
+    | sed 's/^sha256://'
+}
+
+archive="br-v${version_no_v}-${platform_tuple}.tar.gz"
+if [[ -z "$expected_sha" ]]; then
+  expected_sha="$(github_release_asset_sha "Dicklesworthstone/beads_rust" "$tag" "$archive")"
+  if [[ -z "$expected_sha" ]]; then
+    echo "No br checksum found for ${tag}/${platform_tuple}" >&2
+    exit 1
+  fi
+fi
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d ' ' -f 1
+  else
+    shasum -a 256 "$1" | cut -d ' ' -f 1
+  fi
+}
+
+install_binary() {
+  local src="$1"
+  local dst="$2"
+  mkdir -p "$(dirname "$dst")"
+  install -m 0755 "$src" "$dst"
+}
+
+install_binary_with_sudo_fallback() {
+  local src="$1"
+  local dst="$2"
+  local dst_dir
+  dst_dir="$(dirname "$dst")"
+  mkdir -p "$dst_dir"
+  if [[ -w "$dst_dir" ]]; then
+    install_binary "$src" "$dst"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo install -m 0755 "$src" "$dst"
+  else
+    echo "Cannot write $dst and sudo is unavailable" >&2
+    exit 1
+  fi
+}
+
+if $use_cache; then
+  cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
+  bin_dir="${cache_root}/gascity-br/${tag}/${platform_tuple}/bin"
+else
+  bin_dir="${BR_INSTALL_BIN_DIR:-/usr/local/bin}"
+fi
+
+target="${bin_dir}/br"
+if [[ -x "$target" ]]; then
+  echo "Reusing cached br ${tag} at ${target}"
+else
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+  curl -fsSL -o "${tmp}/${archive}" \
+    "https://github.com/Dicklesworthstone/beads_rust/releases/download/${tag}/${archive}"
+  actual_sha="$(sha256_file "${tmp}/${archive}")"
+  if [[ "$actual_sha" != "$expected_sha" ]]; then
+    echo "br checksum mismatch for ${tag}/${platform_tuple}" >&2
+    echo "expected: $expected_sha" >&2
+    echo "actual:   $actual_sha" >&2
+    exit 1
+  fi
+  tar -xzf "${tmp}/${archive}" -C "$tmp"
+  src="${tmp}/br"
+  if [[ ! -x "$src" ]]; then
+    src="$(find "$tmp" -type f -name br -perm -111 | head -n 1)"
+  fi
+  if [[ -z "${src:-}" || ! -x "$src" ]]; then
+    echo "br binary not found in ${archive}" >&2
+    exit 1
+  fi
+  if $use_cache; then
+    install_binary "$src" "$target"
+  else
+    install_binary_with_sudo_fallback "$src" "$target"
+  fi
+fi
+
+if $use_cache && [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$bin_dir" >> "$GITHUB_PATH"
+fi
+
+"$target" --version
diff --git a/.github/scripts/install-claude-native.sh b/.github/scripts/install-claude-native.sh
new file mode 100755
index 0000000000..5b9a6c8498
--- /dev/null
+++ b/.github/scripts/install-claude-native.sh
@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'USAGE'
+Usage: install-claude-native.sh VERSION [--cache]
+
+Installs the native Claude Code binary after verifying its pinned SHA-256.
+Use --cache on self-hosted runners to install under RUNNER_TOOL_CACHE/HOME
+and add that bin directory to GITHUB_PATH.
+USAGE
+}
+
+version="${1:-}"
+if [[ -z "$version" ]]; then
+  usage
+  exit 2
+fi
+shift || true
+
+use_cache=false
+while (($#)); do
+  case "$1" in
+    --cache) use_cache=true ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+case "$(uname -s)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  *)
+    echo "Unsupported OS: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+
+case "$(uname -m)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=x64 ;;
+  *)
+    echo "Unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+platform="${os}-${arch}"
+expected_sha=""
+case "${version}:${platform}" in
+  2.1.123:darwin-arm64) expected_sha="44597dff0f1c11e37c1954d4ac3965909be376e5961b558345723357253bcc90" ;;
+  2.1.123:darwin-x64) expected_sha="ddea227d4c2b2602d650d2c5d5c812f7680701a1504bcaff81e42c165c583ef9" ;;
+  2.1.123:linux-arm64) expected_sha="825c526035d1d75ff0bc1eebf18c887f98d07ea49ea80bd312ff416fe61a39b3" ;;
+  2.1.123:linux-x64) expected_sha="5a78139b679a86a88a0ac5476c706a64c3105bf6a6d435ba10f3aa3fb635bdb2" ;;
+esac
+
+if [[ -z "$expected_sha" ]]; then
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq is required to resolve Claude Code checksums for ${version}/${platform}" >&2
+    exit 1
+  fi
+  manifest_url="https://downloads.claude.ai/claude-code-releases/${version}/manifest.json"
+  expected_sha="$(curl -fsSL "$manifest_url" | jq -r --arg platform "$platform" '.platforms[$platform].checksum // empty')"
+  if [[ -z "$expected_sha" ]]; then
+    echo "No Claude Code checksum found for ${version}/${platform}" >&2
+    exit 1
+  fi
+fi
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d ' ' -f 1
+  else
+    shasum -a 256 "$1" | cut -d ' ' -f 1
+  fi
+}
+
+install_binary() {
+  local src="$1"
+  local dst="$2"
+  mkdir -p "$(dirname "$dst")"
+  install -m 0755 "$src" "$dst"
+}
+
+install_binary_with_sudo_fallback() {
+  local src="$1"
+  local dst="$2"
+  if [[ -w "$(dirname "$dst")" ]]; then
+    install_binary "$src" "$dst"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo install -m 0755 "$src" "$dst"
+  else
+    echo "Cannot write $dst and sudo is unavailable" >&2
+    exit 1
+  fi
+}
+
+if $use_cache; then
+  cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
+  bin_dir="${cache_root}/gascity-claude/${version}/${platform}/bin"
+else
+  bin_dir="${CLAUDE_INSTALL_BIN_DIR:-/usr/local/bin}"
+fi
+
+target="${bin_dir}/claude"
+if [[ -x "$target" ]]; then
+  echo "Reusing cached Claude Code ${version} at ${target}"
+else
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+  binary="${tmp}/claude"
+  url="https://downloads.claude.ai/claude-code-releases/${version}/${platform}/claude"
+  curl -fsSL -o "$binary" "$url"
+  actual_sha="$(sha256_file "$binary")"
+  if [[ "$actual_sha" != "$expected_sha" ]]; then
+    echo "Claude Code checksum mismatch for ${version}/${platform}" >&2
+    echo "expected: $expected_sha" >&2
+    echo "actual:   $actual_sha" >&2
+    exit 1
+  fi
+
+  if $use_cache; then
+    install_binary "$binary" "$target"
+  else
+    install_binary_with_sudo_fallback "$binary" "$target"
+  fi
+fi
+
+if $use_cache && [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$bin_dir" >> "$GITHUB_PATH"
+fi
+
+"$target" --version
diff --git a/.github/scripts/install-dolt-archive.sh b/.github/scripts/install-dolt-archive.sh
new file mode 100755
index 0000000000..305f8ea314
--- /dev/null
+++ b/.github/scripts/install-dolt-archive.sh
@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'USAGE'
+Usage: install-dolt-archive.sh VERSION [--cache]
+
+Downloads a Dolt release tarball, verifies its pinned SHA-256, and installs
+dolt. Use --cache on self-hosted runners to install under RUNNER_TOOL_CACHE/HOME
+and add that bin directory to GITHUB_PATH.
+USAGE
+}
+
+version="${1:-}"
+if [[ -z "$version" ]]; then
+  usage
+  exit 2
+fi
+shift || true
+
+use_cache=false
+while (($#)); do
+  case "$1" in
+    --cache) use_cache=true ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+case "$(uname -s)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  *)
+    echo "Unsupported OS: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+
+case "$(uname -m)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=amd64 ;;
+  *)
+    echo "Unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+platform_tuple="${os}-${arch}"
+expected_sha=""
+case "${version}:${platform_tuple}" in
+  1.86.6:linux-amd64) expected_sha="1f78bdc39edf4d4e731a53131b17d455fa0d1e2e872c0f5f8daaa44d07753a8b" ;;
+  1.86.6:linux-arm64) expected_sha="1caa0aedc562ca63cfc24ee4b91287e5be7446aaeddc294f199f7515e5cfdc1f" ;;
+  1.86.6:darwin-amd64) expected_sha="7ac44944c068c0bbb31ef91b032826f2e1aa0d5f5e4847e6c69bd31ea6d88dc5" ;;
+  1.86.6:darwin-arm64) expected_sha="d27bb39ec5b86e425d06844e7f7e5495758adc41719a4fba99b842b89c8d68fc" ;;
+  1.86.1:linux-amd64) expected_sha="37b4bd73b4c44fd1779115b35ab3e046a332ed99e563cf562882eb4fdb8bde86" ;;
+  1.86.1:linux-arm64) expected_sha="5dc46c9db3cb2e8a3b5154ef972e502671520efdcdcdce0df644b67bab27d958" ;;
+  1.86.1:darwin-amd64) expected_sha="563c9bae968e9d3dfa935eff36b06e91c16eed8b11d6a9c0d08e2b4629cdc458" ;;
+  1.86.1:darwin-arm64) expected_sha="2e92b6aed60b2b02c4defc97fb48ca8b1c79d6994c645f690944c4c39a00d3a5" ;;
+  1.85.0:linux-amd64) expected_sha="58e1462ddfbd59b2ccd707a12f70aa7597f1590745b546502049a03cb52e1aa2" ;;
+  1.85.0:linux-arm64) expected_sha="f668c8e0d0276f684741ee66cd0dd18f2be8bf628a92982e8c7f20d1aef7b390" ;;
+  1.85.0:darwin-amd64) expected_sha="7514c125cfb40f8a377e697a88535e21aa2e354f4bb62b7cabd6994604cb4af2" ;;
+  1.85.0:darwin-arm64) expected_sha="67c5848ca13290722e8f49ec32cfa01140c4c64a3f55da3a5454aecbb59fc90d" ;;
+esac
+
+github_release_asset_sha() {
+  local owner_repo="$1"
+  local tag="$2"
+  local asset="$3"
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq is required to resolve GitHub release asset checksums" >&2
+    exit 1
+  fi
+  local auth_header=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    auth_header=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+  fi
+  curl -fsSL "${auth_header[@]}" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/${owner_repo}/releases/tags/${tag}" \
+    | jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .digest // empty' \
+    | sed 's/^sha256://'
+}
+
+archive="dolt-${platform_tuple}.tar.gz"
+if [[ -z "$expected_sha" ]]; then
+  expected_sha="$(github_release_asset_sha "dolthub/dolt" "v${version}" "$archive")"
+  if [[ -z "$expected_sha" ]]; then
+    echo "No Dolt checksum found for ${version}/${platform_tuple}" >&2
+    exit 1
+  fi
+fi
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d ' ' -f 1
+  else
+    shasum -a 256 "$1" | cut -d ' ' -f 1
+  fi
+}
+
+install_binary() {
+  local src="$1"
+  local dst="$2"
+  mkdir -p "$(dirname "$dst")"
+  install -m 0755 "$src" "$dst"
+}
+
+install_binary_with_sudo_fallback() {
+  local src="$1"
+  local dst="$2"
+  local dst_dir
+  dst_dir="$(dirname "$dst")"
+  mkdir -p "$dst_dir"
+  if [[ -w "$dst_dir" ]]; then
+    install_binary "$src" "$dst"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo install -m 0755 "$src" "$dst"
+  else
+    echo "Cannot write $dst and sudo is unavailable" >&2
+    exit 1
+  fi
+}
+
+if $use_cache; then
+  cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
+  bin_dir="${cache_root}/gascity-dolt/${version}/${platform_tuple}/bin"
+else
+  bin_dir="${DOLT_INSTALL_BIN_DIR:-/usr/local/bin}"
+fi
+
+target="${bin_dir}/dolt"
+if [[ -x "$target" ]]; then
+  echo "Reusing cached Dolt ${version} at ${target}"
+else
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+  curl -fsSL -o "${tmp}/${archive}" \
+    "https://github.com/dolthub/dolt/releases/download/v${version}/${archive}"
+  actual_sha="$(sha256_file "${tmp}/${archive}")"
+  if [[ "$actual_sha" != "$expected_sha" ]]; then
+    echo "Dolt checksum mismatch for ${version}/${platform_tuple}" >&2
+    echo "expected: $expected_sha" >&2
+    echo "actual:   $actual_sha" >&2
+    exit 1
+  fi
+  tar -xzf "${tmp}/${archive}" -C "$tmp"
+  src="${tmp}/dolt-${platform_tuple}/bin/dolt"
+  if $use_cache; then
+    install_binary "$src" "$target"
+  else
+    install_binary_with_sudo_fallback "$src" "$target"
+  fi
+fi
+
+if $use_cache && [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$bin_dir" >> "$GITHUB_PATH"
+fi
+
+"$target" version
diff --git a/.github/scripts/install-trivy-archive.sh b/.github/scripts/install-trivy-archive.sh
new file mode 100755
index 0000000000..3c8491b6c9
--- /dev/null
+++ b/.github/scripts/install-trivy-archive.sh
@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'USAGE'
+Usage: install-trivy-archive.sh VERSION [--cache]
+
+Downloads a Trivy release tarball, verifies its pinned SHA-256, and installs
+trivy. Use --cache on self-hosted runners to install under RUNNER_TOOL_CACHE/HOME
+and add that bin directory to GITHUB_PATH.
+USAGE
+}
+
+version="${1:-}"
+if [[ -z "$version" ]]; then
+  usage
+  exit 2
+fi
+shift || true
+
+use_cache=false
+while (($#)); do
+  case "$1" in
+    --cache) use_cache=true ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+  shift
+done
+
+case "$(uname -s)" in
+  Darwin) os_asset=macOS ;;
+  Linux) os_asset=Linux ;;
+  *)
+    echo "Unsupported OS: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+
+case "$(uname -m)" in
+  arm64|aarch64) arch_asset=ARM64 ;;
+  x86_64|amd64) arch_asset=64bit ;;
+  *)
+    echo "Unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+version_no_v="${version#v}"
+tag="v${version_no_v}"
+asset_platform="${os_asset}-${arch_asset}"
+expected_sha=""
+case "${tag}:${asset_platform}" in
+  v0.70.0:Linux-64bit) expected_sha="8b4376d5d6befe5c24d503f10ff136d9e0c49f9127a4279fd110b727929a5aa9" ;;
+  v0.70.0:Linux-ARM64) expected_sha="2f6bb988b553a1bbac6bdd1ce890f5e412439564e17522b88a4541b4f364fc8d" ;;
+  v0.70.0:macOS-64bit) expected_sha="52d531452b19e7593da29366007d02a810e1e0080d02f9cf6a1afb46c35aaa93" ;;
+  v0.70.0:macOS-ARM64) expected_sha="68e543c51dcc96e1c344053a4fde9660cf602c25565d9f09dc17dd41e13b838a" ;;
+esac
+
+github_release_asset_sha() {
+  local owner_repo="$1"
+  local release_tag="$2"
+  local asset="$3"
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "jq is required to resolve GitHub release asset checksums" >&2
+    exit 1
+  fi
+  local auth_header=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    auth_header=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+  fi
+  curl -fsSL "${auth_header[@]}" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/${owner_repo}/releases/tags/${release_tag}" \
+    | jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .digest // empty' \
+    | sed 's/^sha256://'
+}
+
+archive="trivy_${version_no_v}_${asset_platform}.tar.gz"
+if [[ -z "$expected_sha" ]]; then
+  expected_sha="$(github_release_asset_sha "aquasecurity/trivy" "$tag" "$archive")"
+  if [[ -z "$expected_sha" ]]; then
+    echo "No Trivy checksum found for ${tag}/${asset_platform}" >&2
+    exit 1
+  fi
+fi
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | cut -d ' ' -f 1
+  else
+    shasum -a 256 "$1" | cut -d ' ' -f 1
+  fi
+}
+
+install_binary() {
+  local src="$1"
+  local dst="$2"
+  mkdir -p "$(dirname "$dst")"
+  install -m 0755 "$src" "$dst"
+}
+
+install_binary_with_sudo_fallback() {
+  local src="$1"
+  local dst="$2"
+  local dst_dir
+  dst_dir="$(dirname "$dst")"
+  mkdir -p "$dst_dir"
+  if [[ -w "$dst_dir" ]]; then
+    install_binary "$src" "$dst"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo install -m 0755 "$src" "$dst"
+  else
+    echo "Cannot write $dst and sudo is unavailable" >&2
+    exit 1
+  fi
+}
+
+if $use_cache; then
+  cache_root="${RUNNER_TOOL_CACHE:-$HOME/.local}"
+  bin_dir="${cache_root}/gascity-trivy/${tag}/${asset_platform}/bin"
+else
+  bin_dir="${TRIVY_INSTALL_BIN_DIR:-/usr/local/bin}"
+fi
+
+target="${bin_dir}/trivy"
+if [[ -x "$target" ]]; then
+  echo "Reusing cached Trivy ${tag} at ${target}"
+else
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' EXIT
+  curl -fsSL -o "${tmp}/${archive}" \
+    "https://github.com/aquasecurity/trivy/releases/download/${tag}/${archive}"
+  actual_sha="$(sha256_file "${tmp}/${archive}")"
+  if [[ "$actual_sha" != "$expected_sha" ]]; then
+    echo "Trivy checksum mismatch for ${tag}/${asset_platform}" >&2
+    echo "expected: $expected_sha" >&2
+    echo "actual:   $actual_sha" >&2
+    exit 1
+  fi
+  tar -xzf "${tmp}/${archive}" -C "$tmp" trivy
+  install_target="${tmp}/trivy"
+  if [[ ! -x "$install_target" ]]; then
+    echo "trivy binary not found in ${archive}" >&2
+    exit 1
+  fi
+  if $use_cache; then
+    install_binary "$install_target" "$target"
+  else
+    install_binary_with_sudo_fallback "$install_target" "$target"
+  fi
+fi
+
+if $use_cache && [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$bin_dir" >> "$GITHUB_PATH"
+fi
+
+"$target" --version
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f212193348..a306cceadc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,18 +2,55 @@ name: CI
 
 on:
   workflow_call:
+    inputs:
+      force_blacksmith:
+        description: Force all jobs in the reusable CI graph onto Blacksmith runners.
+        required: false
+        type: boolean
+        default: false
   push:
     branches: [main]
   pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
+  runner-policy:
+    name: Runner policy
+    runs-on: ${{ inputs.force_blacksmith && 'blacksmith-2vcpu-ubuntu-2404' || (github.event_name == 'pull_request' && contains(fromJSON('["julianknutsen","csells","sjarmak","quad341"]'), github.event.pull_request.user.login) && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest') }}
+    outputs:
+      use_blacksmith: ${{ steps.policy.outputs.use_blacksmith }}
+      reason: ${{ steps.policy.outputs.reason }}
+      runner_2vcpu: ${{ steps.policy.outputs.runner_2vcpu }}
+      runner_8vcpu: ${{ steps.policy.outputs.runner_8vcpu }}
+      runner_16vcpu: ${{ steps.policy.outputs.runner_16vcpu }}
+      runner_32vcpu: ${{ steps.policy.outputs.runner_32vcpu }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Select runner backend
+        id: policy
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          FORCE_BLACKSMITH: ${{ inputs.force_blacksmith }}
+        run: |
+          python3 .github/workflows/scripts/runner_policy.py
+
   # Detect which paths changed to gate conditional jobs.
   changes:
     name: Detect changes
-    runs-on: ubuntu-latest
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
     outputs:
       mail: ${{ steps.filter.outputs.mail }}
       docker: ${{ steps.filter.outputs.docker }}
@@ -25,7 +62,7 @@ jobs:
       cmd_gc_process: ${{ steps.filter.outputs.cmd_gc_process }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
           filters: |
@@ -80,92 +117,177 @@ jobs:
               - 'internal/**'
               - 'examples/gastown/packs/**'
 
-  # Always runs: lint, fmt, vet, unit tests, docs, acceptance, coverage.
-  check:
-    name: Check
-    runs-on: ubuntu-latest
+  preflight-smoke:
+    name: Preflight / lint and smoke
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
-      # Pinned dependency versions — keep in sync with deps.env.
-      DOLT_VERSION: "1.86.1"
-      BD_VERSION: "v1.0.0"
-      # Make TestGeneratedClientInSync fatal on missing oapi-codegen so the
-      # spec→client drift check can never silently skip in CI.
-      GC_REQUIRE_OAPI_CODEGEN: "1"
+      DOLT_VERSION: "1.86.6"
+      BD_VERSION: "v1.0.3"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
-        with:
-          go-version: "1.25.8"
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: ./.github/actions/setup-gascity-ubuntu
         with:
-          node-version: "22"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y tmux jq
-
-      - name: Install dolt v${{ env.DOLT_VERSION }}
-        run: |
-          curl -fsSL https://github.com/dolthub/dolt/releases/download/v${{ env.DOLT_VERSION }}/install.sh | sudo bash
-          dolt version
-
-      - name: Install released bd v${{ env.BD_VERSION }}
-        run: |
-          archive="beads_${BD_VERSION#v}_linux_amd64.tar.gz"
-          mkdir -p "$RUNNER_TEMP/beads"
-          curl -fsSL -o "$RUNNER_TEMP/$archive" \
-            "https://github.com/gastownhall/beads/releases/download/${BD_VERSION}/${archive}"
-          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP/beads" bd
-          sudo install -m 0755 "$RUNNER_TEMP/beads/bd" /usr/local/bin/bd
-          bd version
-
-      - name: Install Claude CLI
-        run: npm install -g @anthropic-ai/claude-code
-
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "false"
       - name: Install tools
         run: make install-tools
-
       - name: Lint
         run: make lint
-
       - name: Format
         run: make fmt-check
-
       - name: Vet
         run: make vet
+      - name: Docs
+        run: make check-docs
+      - name: Smoke unit tests
+        run: make test
 
+  preflight-unit-cover:
+    name: Preflight / unit cover
+    needs:
+      - runner-policy
+      - preflight-smoke
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
+    env:
+      DOLT_VERSION: "1.86.6"
+      BD_VERSION: "v1.0.3"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-gascity-ubuntu
+        with:
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "false"
+      - name: Install tools
+        run: make install-tools
       - name: Test
         run: make test-cover
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
+        with:
+          files: coverage.txt
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
 
-      - name: Docs
-        run: make check-docs
-
+  preflight-acceptance:
+    name: Preflight / acceptance A
+    needs:
+      - runner-policy
+      - preflight-smoke
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
+    env:
+      DOLT_VERSION: "1.86.6"
+      BD_VERSION: "v1.0.3"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-gascity-ubuntu
+        with:
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "true"
       - name: Acceptance tests (Tier A)
         run: make test-acceptance
 
+  preflight-generated:
+    name: Preflight / generated artifacts
+    needs:
+      - runner-policy
+      - preflight-smoke
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
+    env:
+      # Make TestGeneratedClientInSync fatal on missing oapi-codegen so the
+      # spec->client drift check can never silently skip in CI.
+      GC_REQUIRE_OAPI_CODEGEN: "1"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
       - name: Dashboard bundle drift check
         run: make dashboard-ci
-
       - name: OpenAPI spec + client drift check
         run: make spec-ci
 
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+  # Historical fan-in name. During the Blacksmith proof, branch protection can
+  # move to `CI / required`; this job keeps the old name meaningful.
+  check:
+    name: Check
+    needs:
+      - runner-policy
+      - preflight-smoke
+      - preflight-unit-cover
+      - preflight-acceptance
+      - preflight-generated
+    if: ${{ always() }}
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
+    env:
+      NEEDS_JSON: ${{ toJSON(needs) }}
+    steps:
+      - name: Summarize preflight result
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import sys
+
+          needs = json.loads(os.environ["NEEDS_JSON"])
+          failures = {
+              job: meta.get("result", "unknown")
+              for job, meta in sorted(needs.items())
+              if meta.get("result") != "success"
+          }
+          summary_path = os.environ["GITHUB_STEP_SUMMARY"]
+          with open(summary_path, "a", encoding="utf-8") as handle:
+              handle.write("## CI Preflight\n\n")
+              handle.write("| Job | Result |\n| --- | --- |\n")
+              for job, meta in sorted(needs.items()):
+                  handle.write(f"| {job} | {meta.get('result', 'unknown')} |\n")
+          if failures:
+              for job, result in failures.items():
+                  print(f"{job}: {result}", file=sys.stderr)
+              sys.exit(1)
+          PY
+
+  release-config:
+    name: Release config
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Check GoReleaser configuration
+        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
         with:
-          files: coverage.txt
-          token: ${{ secrets.CODECOV_TOKEN }}
-          verbose: true
+          version: "~> v2"
+          args: check
 
   cmd-gc-process:
-    name: cmd/gc process suite
-    needs: changes
+    name: cmd/gc process / shards ${{ matrix.shard_group }}
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.cmd_gc_process == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - shard_group: 1-2 of 6
+            shards: 1 2
+          - shard_group: 3-4 of 6
+            shards: 3 4
+          - shard_group: 5-6 of 6
+            shards: 5 6
     env:
-      DOLT_VERSION: "1.86.1"
-      BD_VERSION: "v1.0.0"
+      DOLT_VERSION: "1.86.6"
+      BD_VERSION: "v1.0.3"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -176,33 +298,83 @@ jobs:
       - name: Install tools
         run: make install-tools
       - name: Run cmd/gc process suite
-        run: make test-cmd-gc-process
+        run: |
+          for shard in ${{ matrix.shards }}; do
+            make test-cmd-gc-process-shard CMD_GC_PROCESS_SHARD="$shard" CMD_GC_PROCESS_TOTAL=6
+          done
 
-  # Runs always, but remains non-blocking while integration/provider paths are still stabilizing.
   integration-shards:
     name: Integration / ${{ matrix.shard_name }}
-    runs-on: ubuntu-latest
-    continue-on-error: true
+    needs:
+      - runner-policy
+      - preflight-smoke
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     timeout-minutes: ${{ matrix.timeout_minutes }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - shard_name: packages
+          - shard_name: packages-core
             timeout_minutes: 35
-            command: make test-integration-packages
-          - shard_name: review-formulas
+            command: |
+              ./scripts/test-integration-shard packages-core-1-of-4
+              ./scripts/test-integration-shard packages-core-2-of-4
+              ./scripts/test-integration-shard packages-core-3-of-4
+              ./scripts/test-integration-shard packages-core-4-of-4
+          - shard_name: packages-cmd-gc
             timeout_minutes: 45
-            command: make test-integration-review-formulas
+            command: |
+              ./scripts/test-integration-shard packages-cmd-gc-1-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-2-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-3-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-4-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-5-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-6-of-6
+          - shard_name: packages-runtime-tmux
+            timeout_minutes: 30
+            command: |
+              ./scripts/test-integration-shard packages-runtime-tmux-1-of-3
+              ./scripts/test-integration-shard packages-runtime-tmux-2-of-3
+              ./scripts/test-integration-shard packages-runtime-tmux-3-of-3
+          - shard_name: review-formulas-basic
+            timeout_minutes: 30
+            command: make test-integration-review-formulas-basic
+          - shard_name: review-formulas-retries
+            timeout_minutes: 30
+            command: make test-integration-review-formulas-retries
+          - shard_name: review-formulas-recovery
+            timeout_minutes: 25
+            command: make test-integration-review-formulas-recovery
           - shard_name: bdstore
             timeout_minutes: 15
             command: make test-integration-bdstore
-          - shard_name: rest
+          - shard_name: rest-smoke
+            timeout_minutes: 25
+            command: make test-integration-rest-smoke
+          - shard_name: rest-full-1-2-of-8
+            timeout_minutes: 35
+            command: |
+              ./scripts/test-integration-shard rest-full-1-of-8
+              ./scripts/test-integration-shard rest-full-2-of-8
+          - shard_name: rest-full-3-4-of-8
+            timeout_minutes: 35
+            command: |
+              ./scripts/test-integration-shard rest-full-3-of-8
+              ./scripts/test-integration-shard rest-full-4-of-8
+          - shard_name: rest-full-5-6-of-8
             timeout_minutes: 35
-            command: make test-integration-rest
+            command: |
+              ./scripts/test-integration-shard rest-full-5-of-8
+              ./scripts/test-integration-shard rest-full-6-of-8
+          - shard_name: rest-full-7-of-8
+            timeout_minutes: 35
+            command: ./scripts/test-integration-shard rest-full-7-of-8
+          - shard_name: rest-full-8-of-8
+            timeout_minutes: 35
+            command: ./scripts/test-integration-shard rest-full-8-of-8
     env:
-      DOLT_VERSION: "1.86.1"
-      BD_VERSION: "v1.0.0"
+      DOLT_VERSION: "1.86.6"
+      BD_VERSION: "v1.0.3"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -217,15 +389,18 @@ jobs:
 
   worker-core-claude:
     name: Worker core (Claude)
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.worker == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       PROFILE: claude/tmux-cli
       WORKER_REPORT_DIR: /tmp/worker-core-claude-reports
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - name: Prepare worker report dir
@@ -249,15 +424,18 @@ jobs:
 
   worker-core-codex:
     name: Worker core (Codex)
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.worker == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       PROFILE: codex/tmux-cli
       WORKER_REPORT_DIR: /tmp/worker-core-codex-reports
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - name: Prepare worker report dir
@@ -281,15 +459,18 @@ jobs:
 
   worker-core-gemini:
     name: Worker core (Gemini)
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.worker == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       PROFILE: gemini/tmux-cli
       WORKER_REPORT_DIR: /tmp/worker-core-gemini-reports
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - name: Prepare worker report dir
@@ -314,12 +495,14 @@ jobs:
   worker-core-summary:
     name: Worker core summary
     needs:
+      - runner-policy
       - changes
+      - preflight-smoke
       - worker-core-claude
       - worker-core-codex
       - worker-core-gemini
     if: ${{ always() }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
     env:
       WORKER_ROLLUP_DIR: /tmp/worker-core-summary-reports
       WORKER_ROLLUP_JSON: /tmp/worker-core-summary-reports/worker-core-summary.json
@@ -378,9 +561,9 @@ jobs:
         run: |
           CHANGES_RESULT='${{ needs.changes.result }}'
           CHANGED='${{ needs.changes.outputs.worker }}'
-          CLAUDE_RESULT='${{ needs.worker-core-claude.result }}'
-          CODEX_RESULT='${{ needs.worker-core-codex.result }}'
-          GEMINI_RESULT='${{ needs.worker-core-gemini.result }}'
+          CLAUDE_RESULT='${{ needs['worker-core-claude'].result }}'
+          CODEX_RESULT='${{ needs['worker-core-codex'].result }}'
+          GEMINI_RESULT='${{ needs['worker-core-gemini'].result }}'
           CLAUDE_DOWNLOAD='${{ steps.download_worker_core_claude.outcome }}'
           CODEX_DOWNLOAD='${{ steps.download_worker_core_codex.outcome }}'
           GEMINI_DOWNLOAD='${{ steps.download_worker_core_gemini.outcome }}'
@@ -421,15 +604,18 @@ jobs:
 
   worker-core-phase2-claude:
     name: Worker core phase 2 (Claude)
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.worker_phase2 == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       PROFILE: claude/tmux-cli
       WORKER_REPORT_DIR: /tmp/worker-core-phase2-claude-reports
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - name: Install system dependencies
@@ -457,15 +643,18 @@ jobs:
 
   worker-core-phase2-codex:
     name: Worker core phase 2 (Codex)
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.worker_phase2 == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       PROFILE: codex/tmux-cli
       WORKER_REPORT_DIR: /tmp/worker-core-phase2-codex-reports
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - name: Install system dependencies
@@ -493,15 +682,18 @@ jobs:
 
   worker-core-phase2-gemini:
     name: Worker core phase 2 (Gemini)
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.worker_phase2 == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     env:
       PROFILE: gemini/tmux-cli
       WORKER_REPORT_DIR: /tmp/worker-core-phase2-gemini-reports
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - name: Install system dependencies
@@ -530,12 +722,13 @@ jobs:
   worker-core-phase2-summary:
     name: Worker core phase 2 summary
     needs:
+      - runner-policy
       - changes
       - worker-core-phase2-claude
       - worker-core-phase2-codex
       - worker-core-phase2-gemini
     if: ${{ always() }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
     env:
       WORKER_ROLLUP_DIR: /tmp/worker-core-phase2-summary-reports
       WORKER_ROLLUP_JSON: /tmp/worker-core-phase2-summary-reports/worker-core-phase2-summary.json
@@ -594,9 +787,9 @@ jobs:
         run: |
           CHANGES_RESULT='${{ needs.changes.result }}'
           CHANGED='${{ needs.changes.outputs.worker_phase2 }}'
-          CLAUDE_RESULT='${{ needs.worker-core-phase2-claude.result }}'
-          CODEX_RESULT='${{ needs.worker-core-phase2-codex.result }}'
-          GEMINI_RESULT='${{ needs.worker-core-phase2-gemini.result }}'
+          CLAUDE_RESULT='${{ needs['worker-core-phase2-claude'].result }}'
+          CODEX_RESULT='${{ needs['worker-core-phase2-codex'].result }}'
+          GEMINI_RESULT='${{ needs['worker-core-phase2-gemini'].result }}'
           CLAUDE_DOWNLOAD='${{ steps.download_worker_core_phase2_claude.outcome }}'
           CODEX_DOWNLOAD='${{ steps.download_worker_core_phase2_codex.outcome }}'
           GEMINI_DOWNLOAD='${{ steps.download_worker_core_phase2_gemini.outcome }}'
@@ -635,228 +828,29 @@ jobs:
             exit 1
           fi
 
-  worker-inference-phase3-claude:
-    name: Worker inference phase 3 (Claude)
-    needs: changes
-    if: needs.changes.outputs.worker == 'true'
-    runs-on: ubuntu-latest
-    env:
-      PROFILE: claude/tmux-cli
-      WORKER_REPORT_DIR: /tmp/worker-inference-phase3-claude-reports
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Prepare worker report dir
-        run: mkdir -p "$WORKER_REPORT_DIR"
-      - name: Emit manual-only WorkerInference phase-3 report
-        run: python3 .github/workflows/scripts/worker_report_manual_only.py "$WORKER_REPORT_DIR" "worker-inference-phase3"
-      - name: WorkerInference phase-3 report summary
-        if: ${{ always() }}
-        run: python3 .github/workflows/scripts/worker_report_summary.py "$WORKER_REPORT_DIR"
-      - name: Upload WorkerInference phase-3 reports
-        if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: worker-inference-phase3-claude-reports
-          path: ${{ env.WORKER_REPORT_DIR }}/*.json
-          if-no-files-found: error
-
-  worker-inference-phase3-codex:
-    name: Worker inference phase 3 (Codex)
-    needs: changes
-    if: needs.changes.outputs.worker == 'true'
-    runs-on: ubuntu-latest
-    env:
-      PROFILE: codex/tmux-cli
-      WORKER_REPORT_DIR: /tmp/worker-inference-phase3-codex-reports
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Prepare worker report dir
-        run: mkdir -p "$WORKER_REPORT_DIR"
-      - name: Emit manual-only WorkerInference phase-3 report
-        run: python3 .github/workflows/scripts/worker_report_manual_only.py "$WORKER_REPORT_DIR" "worker-inference-phase3"
-      - name: WorkerInference phase-3 report summary
-        if: ${{ always() }}
-        run: python3 .github/workflows/scripts/worker_report_summary.py "$WORKER_REPORT_DIR"
-      - name: Upload WorkerInference phase-3 reports
-        if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: worker-inference-phase3-codex-reports
-          path: ${{ env.WORKER_REPORT_DIR }}/*.json
-          if-no-files-found: error
-
-  worker-inference-phase3-gemini:
-    name: Worker inference phase 3 (Gemini)
-    needs: changes
-    if: needs.changes.outputs.worker == 'true'
-    runs-on: ubuntu-latest
-    env:
-      PROFILE: gemini/tmux-cli
-      WORKER_REPORT_DIR: /tmp/worker-inference-phase3-gemini-reports
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Prepare worker report dir
-        run: mkdir -p "$WORKER_REPORT_DIR"
-      - name: Emit manual-only WorkerInference phase-3 report
-        run: python3 .github/workflows/scripts/worker_report_manual_only.py "$WORKER_REPORT_DIR" "worker-inference-phase3"
-      - name: WorkerInference phase-3 report summary
-        if: ${{ always() }}
-        run: python3 .github/workflows/scripts/worker_report_summary.py "$WORKER_REPORT_DIR"
-      - name: Upload WorkerInference phase-3 reports
-        if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: worker-inference-phase3-gemini-reports
-          path: ${{ env.WORKER_REPORT_DIR }}/*.json
-          if-no-files-found: error
-
-  worker-inference-phase3-summary:
-    name: Worker inference phase 3 summary
-    needs:
-      - changes
-      - worker-inference-phase3-claude
-      - worker-inference-phase3-codex
-      - worker-inference-phase3-gemini
-    if: ${{ always() }}
-    runs-on: ubuntu-latest
-    env:
-      WORKER_ROLLUP_DIR: /tmp/worker-inference-phase3-summary-reports
-      WORKER_ROLLUP_JSON: /tmp/worker-inference-phase3-summary-reports/worker-inference-phase3-summary.json
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - name: Prepare worker rollup dir
-        if: ${{ needs.changes.outputs.worker == 'true' }}
-        run: mkdir -p "$WORKER_ROLLUP_DIR"
-      - name: Download WorkerInference phase-3 Claude reports
-        id: download_worker_inference_phase3_claude
-        if: ${{ needs.changes.outputs.worker == 'true' }}
-        continue-on-error: true
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: worker-inference-phase3-claude-reports
-          path: ${{ env.WORKER_ROLLUP_DIR }}/claude
-      - name: Download WorkerInference phase-3 Codex reports
-        id: download_worker_inference_phase3_codex
-        if: ${{ needs.changes.outputs.worker == 'true' }}
-        continue-on-error: true
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: worker-inference-phase3-codex-reports
-          path: ${{ env.WORKER_ROLLUP_DIR }}/codex
-      - name: Download WorkerInference phase-3 Gemini reports
-        id: download_worker_inference_phase3_gemini
-        if: ${{ needs.changes.outputs.worker == 'true' }}
-        continue-on-error: true
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: worker-inference-phase3-gemini-reports
-          path: ${{ env.WORKER_ROLLUP_DIR }}/gemini
-      - name: WorkerInference phase-3 rollup summary
-        if: ${{ needs.changes.outputs.worker == 'true' }}
-        env:
-          CLAUDE_DOWNLOAD: ${{ steps.download_worker_inference_phase3_claude.outcome }}
-          CODEX_DOWNLOAD: ${{ steps.download_worker_inference_phase3_codex.outcome }}
-          GEMINI_DOWNLOAD: ${{ steps.download_worker_inference_phase3_gemini.outcome }}
-        run: |
-          python3 .github/workflows/scripts/worker_report_rollup.py \
-            "$WORKER_ROLLUP_DIR" \
-            --title "Worker inference phase 3 summary" \
-            --require-reports \
-            --expected-profile "claude/tmux-cli=$CLAUDE_DOWNLOAD" \
-            --expected-profile "codex/tmux-cli=$CODEX_DOWNLOAD" \
-            --expected-profile "gemini/tmux-cli=$GEMINI_DOWNLOAD" \
-            --output "$WORKER_ROLLUP_JSON"
-      - name: Upload WorkerInference phase-3 rollup
-        if: ${{ always() && needs.changes.outputs.worker == 'true' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: worker-inference-phase3-summary-reports
-          path: ${{ env.WORKER_ROLLUP_JSON }}
-          if-no-files-found: error
-      - name: Assert worker-inference phase-3 matrix reported
-        run: |
-          CHANGES_RESULT='${{ needs.changes.result }}'
-          CHANGED='${{ needs.changes.outputs.worker }}'
-          CLAUDE_RESULT='${{ needs.worker-inference-phase3-claude.result }}'
-          CODEX_RESULT='${{ needs.worker-inference-phase3-codex.result }}'
-          GEMINI_RESULT='${{ needs.worker-inference-phase3-gemini.result }}'
-          CLAUDE_DOWNLOAD='${{ steps.download_worker_inference_phase3_claude.outcome }}'
-          CODEX_DOWNLOAD='${{ steps.download_worker_inference_phase3_codex.outcome }}'
-          GEMINI_DOWNLOAD='${{ steps.download_worker_inference_phase3_gemini.outcome }}'
-          if [ -f "$WORKER_ROLLUP_JSON" ]; then
-            ROLLUP_STATUS="$(python3 -c "import json, sys; print(json.load(open(sys.argv[1], encoding='utf-8')).get('summary', {}).get('status', 'unknown'))" "$WORKER_ROLLUP_JSON")"
-          else
-            ROLLUP_STATUS='missing'
-          fi
-          printf 'changes-result=%s\n' "$CHANGES_RESULT"
-          printf 'worker-changes=%s\n' "$CHANGED"
-          printf 'worker-inference-phase3-claude=%s\n' "$CLAUDE_RESULT"
-          printf 'worker-inference-phase3-codex=%s\n' "$CODEX_RESULT"
-          printf 'worker-inference-phase3-gemini=%s\n' "$GEMINI_RESULT"
-          printf 'download-worker-inference-phase3-claude=%s\n' "$CLAUDE_DOWNLOAD"
-          printf 'download-worker-inference-phase3-codex=%s\n' "$CODEX_DOWNLOAD"
-          printf 'download-worker-inference-phase3-gemini=%s\n' "$GEMINI_DOWNLOAD"
-          printf 'worker-inference-phase3-rollup=%s\n' "$ROLLUP_STATUS"
-          if [ "$CHANGES_RESULT" != "success" ]; then
-            echo "changes job did not complete successfully" >&2
-            exit 1
-          fi
-          if [ "$CHANGED" != "true" ]; then
-            echo "No phase-3 worker changes detected; passing summary without fan-in."
-            exit 0
-          fi
-          if [ "$CLAUDE_DOWNLOAD" != "success" ] || [ "$CODEX_DOWNLOAD" != "success" ] || [ "$GEMINI_DOWNLOAD" != "success" ]; then
-            echo "worker-inference phase-3 summary is missing one or more expected profile artifacts" >&2
-            exit 1
-          fi
-          if [ "$ROLLUP_STATUS" != "pass" ] && [ "$ROLLUP_STATUS" != "unsupported" ]; then
-            echo "worker-inference phase-3 rollup reported an unexpected status" >&2
-            exit 1
-          fi
-          if [ "$ROLLUP_STATUS" = "unsupported" ]; then
-            echo "worker-inference phase-3 is catalog-only until executable inference scenarios land."
-          fi
-          if [ "$CLAUDE_RESULT" != "success" ] || [ "$CODEX_RESULT" != "success" ] || [ "$GEMINI_RESULT" != "success" ]; then
-            echo "worker-inference phase-3 matrix failed" >&2
-            exit 1
-          fi
-
   # Runs when pack-related files change — full gastown integration suite.
   pack-gate:
     name: Pack compatibility gate
-    needs: [changes, check]
+    needs:
+      - runner-policy
+      - changes
+      - check
     if: needs.changes.outputs.packs == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
-        with:
-          go-version: "1.25.8"
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: ./.github/actions/setup-gascity-ubuntu
         with:
-          node-version: "22"
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y tmux jq
-      - name: Install dolt
-        run: |
-          curl -fsSL https://github.com/dolthub/dolt/releases/download/v${{ env.DOLT_VERSION }}/install.sh | sudo bash
-      - name: Install released bd v${{ env.BD_VERSION }}
-        run: |
-          archive="beads_${BD_VERSION#v}_linux_amd64.tar.gz"
-          mkdir -p "$RUNNER_TEMP/beads"
-          curl -fsSL -o "$RUNNER_TEMP/$archive" \
-            "https://github.com/gastownhall/beads/releases/download/${BD_VERSION}/${archive}"
-          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP/beads" bd
-          sudo install -m 0755 "$RUNNER_TEMP/beads/bd" /usr/local/bin/bd
-      - name: Install Claude CLI
-        run: npm install -g @anthropic-ai/claude-code
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "true"
       - name: Install tools
         run: make install-tools
       - name: Pack compatibility tests
         run: make test-acceptance
     env:
-      DOLT_VERSION: "1.86.1"
-      BD_VERSION: "v1.0.0"
+      DOLT_VERSION: "1.86.6"
+      BD_VERSION: "v1.0.3"
 
   # Dashboard SPA typecheck + tests + build. Runs on every push/PR
   # so TS drift against the spec (e.g. a query param tightening from
@@ -866,14 +860,20 @@ jobs:
   # load-bearing discipline step.
   dashboard:
     name: Dashboard SPA
-    runs-on: ubuntu-latest
+    needs:
+      - runner-policy
+      - preflight-smoke
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
       - name: Install SPA dependencies
-        run: npm install --silent
+        run: npm ci --silent
         working-directory: cmd/gc/dashboard/web
       - name: Verify generated TS schema is in sync
         run: |
@@ -896,14 +896,17 @@ jobs:
   # Runs when mail-related source paths change.
   mcp-mail:
     name: MCP mail conformance
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.mail == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_8vcpu }}
     continue-on-error: true  # upstream mcp_agent_mail API may drift
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
 
@@ -915,7 +918,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install mcp_agent_mail
-        run: pip install 'mcp-agent-mail==0.1.0'
+        run: python -m pip install --require-hashes -r .github/requirements/mcp-agent-mail.txt
 
       - name: MCP mail conformance test
         run: make test-mcp-mail
@@ -923,13 +926,16 @@ jobs:
   # Runs when session/Docker-related source paths change.
   docker-session:
     name: Docker session
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.docker == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
 
@@ -949,13 +955,16 @@ jobs:
   # Requires K8s CI infrastructure — no-op until secrets are configured.
   k8s-session:
     name: K8s session
-    needs: changes
+    needs:
+      - runner-policy
+      - changes
+      - preflight-smoke
     if: needs.changes.outputs.k8s == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_8vcpu }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
 
@@ -967,3 +976,117 @@ jobs:
         env:
           GC_K8S_AVAILABLE: ${{ secrets.GC_K8S_AVAILABLE }}
         run: make test-k8s
+
+  ci-preflight:
+    name: CI / preflight
+    needs:
+      - runner-policy
+      - check
+      - release-config
+      - dashboard
+    if: ${{ always() }}
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
+    env:
+      NEEDS_JSON: ${{ toJSON(needs) }}
+    steps:
+      - name: Summarize preflight gates
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import sys
+
+          needs = json.loads(os.environ["NEEDS_JSON"])
+          failed = {
+              job: meta.get("result", "unknown")
+              for job, meta in sorted(needs.items())
+              if meta.get("result") != "success"
+          }
+          if failed:
+              for job, result in failed.items():
+                  print(f"{job}: {result}", file=sys.stderr)
+              sys.exit(1)
+          PY
+
+  ci-integration:
+    name: CI / integration
+    needs:
+      - runner-policy
+      - integration-shards
+    if: ${{ always() }}
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
+    env:
+      NEEDS_JSON: ${{ toJSON(needs) }}
+    steps:
+      - name: Summarize integration gates
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import sys
+
+          needs = json.loads(os.environ["NEEDS_JSON"])
+          failed = {
+              job: meta.get("result", "unknown")
+              for job, meta in sorted(needs.items())
+              if meta.get("result") != "success"
+          }
+          if failed:
+              for job, result in failed.items():
+                  print(f"{job}: {result}", file=sys.stderr)
+              sys.exit(1)
+          PY
+
+  ci-required:
+    name: CI / required
+    needs:
+      - runner-policy
+      - changes
+      - ci-preflight
+      - ci-integration
+      - cmd-gc-process
+      - worker-core-summary
+      - worker-core-phase2-summary
+      - pack-gate
+      - docker-session
+      - k8s-session
+    if: ${{ always() }}
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
+    env:
+      NEEDS_JSON: ${{ toJSON(needs) }}
+    steps:
+      - name: Summarize required gates
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import sys
+
+          needs = json.loads(os.environ["NEEDS_JSON"])
+          allow_skipped = {
+              "cmd-gc-process",
+              "pack-gate",
+              "docker-session",
+              "k8s-session",
+          }
+          failed = {}
+          for job, meta in sorted(needs.items()):
+              result = meta.get("result", "unknown")
+              if result == "success":
+                  continue
+              if result == "skipped" and job in allow_skipped:
+                  continue
+              failed[job] = result
+
+          summary_path = os.environ["GITHUB_STEP_SUMMARY"]
+          with open(summary_path, "a", encoding="utf-8") as handle:
+              handle.write("## CI Required\n\n")
+              handle.write("| Job | Result |\n| --- | --- |\n")
+              for job, meta in sorted(needs.items()):
+                  handle.write(f"| {job} | {meta.get('result', 'unknown')} |\n")
+
+          if failed:
+              for job, result in failed.items():
+                  print(f"{job}: {result}", file=sys.stderr)
+              sys.exit(1)
+          PY
diff --git a/.github/workflows/close-stale-needs.yml b/.github/workflows/close-stale-needs.yml
index 35451f7cc9..44c4e4235b 100644
--- a/.github/workflows/close-stale-needs.yml
+++ b/.github/workflows/close-stale-needs.yml
@@ -5,6 +5,8 @@ on:
     - cron: '37 9 * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   close-needs-info:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..e4f03f1990
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,78 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  schedule:
+    - cron: "24 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  runner-policy:
+    name: Runner policy
+    runs-on: ${{ github.event_name == 'pull_request' && contains(fromJSON('["julianknutsen","csells","sjarmak","quad341"]'), github.event.pull_request.user.login) && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    outputs:
+      use_blacksmith: ${{ steps.policy.outputs.use_blacksmith }}
+      reason: ${{ steps.policy.outputs.reason }}
+      runner_2vcpu: ${{ steps.policy.outputs.runner_2vcpu }}
+      runner_8vcpu: ${{ steps.policy.outputs.runner_8vcpu }}
+      runner_16vcpu: ${{ steps.policy.outputs.runner_16vcpu }}
+      runner_32vcpu: ${{ steps.policy.outputs.runner_32vcpu }}
+      runner_macos: ${{ steps.policy.outputs.runner_macos }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Select runner backend
+        id: policy
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          python3 .github/workflows/scripts/runner_policy.py
+
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_16vcpu }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: go
+            build-mode: autobuild
+          - language: javascript-typescript
+            build-mode: none
+          - language: python
+            build-mode: none
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Autobuild
+        if: matrix.build-mode == 'autobuild'
+        uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml
new file mode 100644
index 0000000000..f6beb097a3
--- /dev/null
+++ b/.github/workflows/container-scan.yml
@@ -0,0 +1,300 @@
+name: Container Scan
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".dockerignore"
+      - ".trivyignore.yaml"
+      - ".trivyignore-config"
+      - ".github/requirements/mcp-agent-mail.in"
+      - ".github/requirements/mcp-agent-mail.txt"
+      - ".github/scripts/install-*.sh"
+      - ".github/workflows/container-scan.yml"
+      - "contrib/beads-scripts/gc-beads-br"
+      - "contrib/events-scripts/gc-events-k8s"
+      - "contrib/k8s/**"
+      - "contrib/mail-scripts/gc-mail-mcp-agent-mail"
+      - "contrib/session-scripts/gc-controller-k8s"
+      - "deps.env"
+      - "go.mod"
+      - "go.sum"
+  pull_request:
+    branches: [main]
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    paths:
+      - ".dockerignore"
+      - ".trivyignore.yaml"
+      - ".trivyignore-config"
+      - ".github/requirements/mcp-agent-mail.in"
+      - ".github/requirements/mcp-agent-mail.txt"
+      - ".github/scripts/install-*.sh"
+      - ".github/workflows/container-scan.yml"
+      - "contrib/beads-scripts/gc-beads-br"
+      - "contrib/events-scripts/gc-events-k8s"
+      - "contrib/k8s/**"
+      - "contrib/mail-scripts/gc-mail-mcp-agent-mail"
+      - "contrib/session-scripts/gc-controller-k8s"
+      - "deps.env"
+      - "go.mod"
+      - "go.sum"
+  schedule:
+    - cron: "43 6 * * 3"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  TRIVY_VERSION: "v0.70.0"
+
+jobs:
+  runner-policy:
+    name: Runner policy
+    runs-on: ${{ github.event_name == 'pull_request' && contains(fromJSON('["julianknutsen","csells","sjarmak","quad341"]'), github.event.pull_request.user.login) && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    outputs:
+      use_blacksmith: ${{ steps.policy.outputs.use_blacksmith }}
+      reason: ${{ steps.policy.outputs.reason }}
+      runner_2vcpu: ${{ steps.policy.outputs.runner_2vcpu }}
+      runner_8vcpu: ${{ steps.policy.outputs.runner_8vcpu }}
+      runner_16vcpu: ${{ steps.policy.outputs.runner_16vcpu }}
+      runner_32vcpu: ${{ steps.policy.outputs.runner_32vcpu }}
+      runner_macos: ${{ steps.policy.outputs.runner_macos }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Select runner backend
+        id: policy
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          python3 .github/workflows/scripts/runner_policy.py
+
+  dockerfile-config:
+    name: Dockerfile config
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_8vcpu }}
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Install Trivy
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          bin_dir="${RUNNER_TEMP}/gascity-trivy-bin"
+          TRIVY_INSTALL_BIN_DIR="$bin_dir" .github/scripts/install-trivy-archive.sh "${TRIVY_VERSION}"
+          echo "$bin_dir" >> "$GITHUB_PATH"
+
+      - name: Generate Dockerfile and manifest SARIF
+        run: |
+          mkdir -p trivy-results
+          trivy config \
+            --severity HIGH,CRITICAL \
+            --ignorefile .trivyignore-config \
+            --format sarif \
+            --output trivy-results/dockerfile-config.sarif \
+            contrib/k8s
+
+      - name: Upload Dockerfile SARIF
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          sarif_file: trivy-results/dockerfile-config.sarif
+
+      - name: Upload Dockerfile scan artifact
+        if: ${{ always() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: trivy-dockerfile-config
+          path: trivy-results/dockerfile-config.sarif
+          retention-days: 5
+
+      - name: Summarize Dockerfile and manifest findings
+        run: |
+          trivy config \
+            --severity HIGH,CRITICAL \
+            --ignorefile .trivyignore-config \
+            --format table \
+            contrib/k8s
+
+      - name: Enforce Dockerfile and manifest policy
+        run: |
+          trivy config \
+            --severity HIGH,CRITICAL \
+            --ignorefile .trivyignore-config \
+            --exit-code 1 \
+            --format table \
+            contrib/k8s
+
+  image-vulnerabilities:
+    name: Image vulnerabilities
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      security-events: write
+    env:
+      IMAGE_TAG: ${{ github.sha }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Install Trivy
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          bin_dir="${RUNNER_TEMP}/gascity-trivy-bin"
+          TRIVY_INSTALL_BIN_DIR="$bin_dir" .github/scripts/install-trivy-archive.sh "${TRIVY_VERSION}"
+          echo "$bin_dir" >> "$GITHUB_PATH"
+
+      - name: Prepare image build inputs
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          . ./deps.env
+          bin_dir="${RUNNER_TEMP}/gascity-container-scan-bin"
+          mkdir -p "$bin_dir"
+          BD_INSTALL_BIN_DIR="$bin_dir" .github/scripts/install-bd-archive.sh "$BD_VERSION"
+          BR_INSTALL_BIN_DIR="$bin_dir" .github/scripts/install-br-archive.sh "$BR_VERSION"
+          go build -o gc ./cmd/gc
+          cp -f "$bin_dir/bd" bd
+          cp -f "$bin_dir/br" br
+
+      - name: Build local images
+        run: |
+          set -euo pipefail
+          . ./deps.env
+          docker build \
+            -f contrib/k8s/Dockerfile.base \
+            --build-arg DOLT_VERSION="$DOLT_VERSION" \
+            -t "gc-agent-base:${IMAGE_TAG}" \
+            .
+          docker tag "gc-agent-base:${IMAGE_TAG}" gc-agent-base:latest
+
+          docker build \
+            -f contrib/k8s/Dockerfile.agent \
+            --build-arg BASE_IMAGE=gc-agent-base:latest \
+            -t "gc-agent:${IMAGE_TAG}" \
+            .
+          docker tag "gc-agent:${IMAGE_TAG}" gc-agent:latest
+
+          docker build \
+            -f contrib/k8s/Dockerfile.controller \
+            --build-arg BASE=gc-agent:latest \
+            -t "gc-controller:${IMAGE_TAG}" \
+            .
+
+          docker build \
+            -f contrib/k8s/Dockerfile.mail \
+            -t "gc-mcp-mail:${IMAGE_TAG}" \
+            .
+
+      - name: Generate image SARIF and SBOMs
+        run: |
+          set -euo pipefail
+          mkdir -p trivy-results
+          images=(
+            "gc-agent-base:${IMAGE_TAG}"
+            "gc-agent:${IMAGE_TAG}"
+            "gc-controller:${IMAGE_TAG}"
+            "gc-mcp-mail:${IMAGE_TAG}"
+          )
+          for image in "${images[@]}"; do
+            name="${image%%:*}"
+            trivy image \
+              --scanners vuln \
+              --severity HIGH,CRITICAL \
+              --ignore-unfixed \
+              --ignorefile .trivyignore.yaml \
+              --timeout 15m \
+              --format sarif \
+              --output "trivy-results/${name}.sarif" \
+              "$image"
+            trivy image \
+              --scanners vuln \
+              --ignorefile .trivyignore.yaml \
+              --timeout 15m \
+              --format cyclonedx \
+              --output "trivy-results/${name}.cdx.json" \
+              "$image"
+          done
+
+      - name: Enforce image vulnerability policy
+        run: |
+          set -euo pipefail
+          images=(
+            "gc-agent-base:${IMAGE_TAG}"
+            "gc-agent:${IMAGE_TAG}"
+            "gc-controller:${IMAGE_TAG}"
+            "gc-mcp-mail:${IMAGE_TAG}"
+          )
+          for image in "${images[@]}"; do
+            trivy image \
+              --scanners vuln \
+              --severity HIGH,CRITICAL \
+              --ignore-unfixed \
+              --ignorefile .trivyignore.yaml \
+              --exit-code 1 \
+              --timeout 15m \
+              --format table \
+              "$image"
+          done
+
+      - name: Upload base image SARIF
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          sarif_file: trivy-results/gc-agent-base.sarif
+          category: trivy-image/gc-agent-base
+
+      - name: Upload agent image SARIF
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          sarif_file: trivy-results/gc-agent.sarif
+          category: trivy-image/gc-agent
+
+      - name: Upload controller image SARIF
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          sarif_file: trivy-results/gc-controller.sarif
+          category: trivy-image/gc-controller
+
+      - name: Upload MCP mail image SARIF
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          sarif_file: trivy-results/gc-mcp-mail.sarif
+          category: trivy-image/gc-mcp-mail
+
+      - name: Upload image scan artifacts
+        if: ${{ always() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: trivy-image-results
+          path: trivy-results/
+          retention-days: 5
diff --git a/.github/workflows/dispatch-labeled-pr-suite.yml b/.github/workflows/dispatch-labeled-pr-suite.yml
new file mode 100644
index 0000000000..76afbc2459
--- /dev/null
+++ b/.github/workflows/dispatch-labeled-pr-suite.yml
@@ -0,0 +1,105 @@
+name: Dispatch labeled PR suite
+
+on:
+  pull_request_target:
+    types:
+      - labeled
+
+permissions:
+  actions: write
+  contents: read
+  pull-requests: read
+
+jobs:
+  dispatch-suite:
+    name: Dispatch requested suite
+    if: >-
+      github.event.label.name == 'needs-mac' ||
+      github.event.label.name == 'needs-review-formulas'
+    runs-on: ubuntu-latest
+    steps:
+      # This workflow never checks out or runs pull request code. It reads the
+      # trusted base allowlist, then dispatches a dedicated workflow with the
+      # PR head repository and SHA as explicit inputs.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+
+      - name: Dispatch suite for trusted PR author
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          LABEL_NAME: ${{ github.event.label.name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_DRAFT: ${{ github.event.pull_request.draft }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import urllib.parse
+          import urllib.request
+          from pathlib import Path
+
+          label = os.environ["LABEL_NAME"]
+          draft = os.environ.get("PR_DRAFT", "").lower() == "true"
+          author = os.environ.get("PR_AUTHOR", "").strip()
+          association = os.environ.get("PR_ASSOCIATION", "").strip().upper()
+
+          if draft:
+              print("PR is draft; not dispatching a label-requested suite")
+              raise SystemExit(0)
+
+          allowlist = set()
+          for raw_line in Path(".github/blacksmith-allowlist.txt").read_text(encoding="utf-8").splitlines():
+              line = raw_line.split("#", 1)[0].strip()
+              if line:
+                  allowlist.add(line.lower())
+
+          trusted = association in {"OWNER", "MEMBER", "COLLABORATOR"} or author.lower() in allowlist
+          if not trusted:
+              print(f"PR author {author or '<unknown>'} is not trusted for label-dispatched suites")
+              raise SystemExit(0)
+
+          workflows = {
+              "needs-mac": ("mac-regression.yml", {"suite": "needs-mac"}),
+              "needs-review-formulas": ("review-formulas.yml", {}),
+          }
+          workflow, extra_inputs = workflows[label]
+          inputs = {
+              **extra_inputs,
+              "pr_number": os.environ["PR_NUMBER"],
+              "head_repo": os.environ["PR_HEAD_REPO"],
+              "head_ref": os.environ["PR_HEAD_REF"],
+              "head_sha": os.environ["PR_HEAD_SHA"],
+          }
+          payload = json.dumps({
+              "ref": os.environ["BASE_REF"],
+              "inputs": inputs,
+          }).encode("utf-8")
+
+          workflow_id = urllib.parse.quote(workflow, safe="")
+          url = f"https://api.github.com/repos/{os.environ['REPOSITORY']}/actions/workflows/{workflow_id}/dispatches"
+          request = urllib.request.Request(
+              url,
+              data=payload,
+              method="POST",
+              headers={
+                  "Accept": "application/vnd.github+json",
+                  "Authorization": f"Bearer {os.environ['GH_TOKEN']}",
+                  "Content-Type": "application/json",
+                  "X-GitHub-Api-Version": "2026-03-10",
+              },
+          )
+          with urllib.request.urlopen(request, timeout=30) as response:
+              if response.status != 204:
+                  raise RuntimeError(f"unexpected dispatch status {response.status}")
+
+          print(f"Dispatched {workflow} for PR #{inputs['pr_number']} at {inputs['head_repo']}@{inputs['head_sha']}")
+          PY
diff --git a/.github/workflows/mac-regression.yml b/.github/workflows/mac-regression.yml
index 954c23fdc6..5bcdc8b84a 100644
--- a/.github/workflows/mac-regression.yml
+++ b/.github/workflows/mac-regression.yml
@@ -10,7 +10,24 @@ on:
         options:
           - smoke
           - full
+          - needs-mac
         default: smoke
+      pr_number:
+        description: Pull request number for label-dispatched runs
+        required: false
+        type: string
+      head_repo:
+        description: Pull request head repository for label-dispatched runs
+        required: false
+        type: string
+      head_sha:
+        description: Pull request head SHA for label-dispatched runs
+        required: false
+        type: string
+      head_ref:
+        description: Pull request head ref for label-dispatched runs
+        required: false
+        type: string
   schedule:
     - cron: "17 3 * * *"
   pull_request:
@@ -20,18 +37,17 @@ on:
       - reopened
       - synchronize
       - ready_for_review
-      - labeled
 
 permissions:
   contents: read
 
 concurrency:
-  group: mac-regression-${{ github.event.pull_request.number || github.ref || github.run_id }}
+  group: mac-regression-${{ inputs.pr_number || github.event.pull_request.number || github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name != 'schedule' }}
 
 env:
-  DOLT_VERSION: "1.86.1"
-  BD_VERSION: "v1.0.0"
+  DOLT_VERSION: "1.86.6"
+  BD_VERSION: "v1.0.3"
 
 # Trigger gate re-used by every job below via `if:`.
 # We want each job to run when EITHER:
@@ -42,10 +58,32 @@ env:
 # expression; keep them in sync.
 
 jobs:
+  runner-policy:
+    name: Runner policy
+    runs-on: ${{ github.event_name == 'pull_request' && contains(fromJSON('["julianknutsen","csells","sjarmak","quad341"]'), github.event.pull_request.user.login) && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    outputs:
+      use_blacksmith: ${{ steps.policy.outputs.use_blacksmith }}
+      reason: ${{ steps.policy.outputs.reason }}
+      runner_2vcpu: ${{ steps.policy.outputs.runner_2vcpu }}
+      runner_8vcpu: ${{ steps.policy.outputs.runner_8vcpu }}
+      runner_16vcpu: ${{ steps.policy.outputs.runner_16vcpu }}
+      runner_32vcpu: ${{ steps.policy.outputs.runner_32vcpu }}
+      runner_macos: ${{ steps.policy.outputs.runner_macos }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Select runner backend
+        id: policy
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          python3 .github/workflows/scripts/runner_policy.py
+
   # Fast quality gates that Linux runs on every PR. Keep these cheap so a
   # Mac-parity loop stays interactive.
   mac-quality:
     name: Mac / quality (lint, fmt, vet, docs)
+    needs: runner-policy
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'schedule' ||
@@ -55,14 +93,14 @@ jobs:
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -82,6 +120,7 @@ jobs:
   # Unit tests — the suite Mac already ran as "smoke".
   mac-unit:
     name: Mac / make test
+    needs: runner-policy
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'schedule' ||
@@ -91,14 +130,14 @@ jobs:
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -110,6 +149,7 @@ jobs:
   # Tier A acceptance — smoke-level gate on every PR.
   mac-acceptance:
     name: Mac / acceptance (Tier A)
+    needs: runner-policy
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'schedule' ||
@@ -119,14 +159,14 @@ jobs:
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -146,26 +186,30 @@ jobs:
   # job's result still reflects the actual outcome for the summary.
   mac-cover:
     name: Mac / test-cover
-    # Heavy job: schedule/full-dispatch/PR(needs-mac). Smoke dispatch skips.
+    needs: runner-policy
+    # Heavy job: schedule/full-dispatch/needs-mac-dispatch/PR(needs-mac). Smoke dispatch skips.
     if: >-
       github.event_name == 'schedule' ||
-      (github.event_name == 'workflow_dispatch' && inputs.suite == 'full') ||
+      (
+        github.event_name == 'workflow_dispatch' &&
+        (inputs.suite == 'full' || inputs.suite == 'needs-mac')
+      ) ||
       (
         github.event_name == 'pull_request' &&
         github.event.pull_request.head.repo.full_name == github.repository &&
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
     timeout-minutes: 25
     outputs:
       outcome: ${{ steps.cover.outcome }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -185,46 +229,72 @@ jobs:
           path: coverage.txt
           if-no-files-found: ignore
 
-  # Integration shards. Linux runs these with continue-on-error today while
-  # stabilizing; we mirror that until Mac parity is proven. These three
-  # shards run on `needs-mac` label, nightly, or manual dispatch. The
-  # long-running review-formulas shard lives in a separate job below so
-  # it can gate on nightly / full-dispatch only.
-  # Integration shards. Linux runs these with continue-on-error today
-  # while stabilizing; we mirror that until Mac parity is proven. Split
-  # into discrete jobs (rather than a matrix) so each shard publishes
-  # its own `outputs.outcome` — matrix-job outputs are last-writer-wins
-  # and would mask a per-shard failure in the summary row.
+  # Integration shards. Packages and REST are matrix jobs whose aggregate
+  # result now gates the summary directly. The long-running review-formulas
+  # shard stays separate so it can gate on nightly / full-dispatch only.
   mac-integration-packages:
-    name: Mac / integration (packages)
+    name: Mac / integration packages / ${{ matrix.shard_name }}
+    needs:
+      - runner-policy
+      - mac-quality
+      - mac-unit
+      - mac-acceptance
     if: >-
       github.event_name == 'schedule' ||
-      (github.event_name == 'workflow_dispatch' && inputs.suite == 'full') ||
+      (
+        github.event_name == 'workflow_dispatch' &&
+        (inputs.suite == 'full' || inputs.suite == 'needs-mac')
+      ) ||
       (
         github.event_name == 'pull_request' &&
         github.event.pull_request.head.repo.full_name == github.repository &&
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
-    timeout-minutes: 60
-    outputs:
-      outcome: ${{ steps.shard.outcome }}
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - shard_name: core
+            timeout_minutes: 60
+            command: |
+              ./scripts/test-integration-shard packages-core-1-of-4
+              ./scripts/test-integration-shard packages-core-2-of-4
+              ./scripts/test-integration-shard packages-core-3-of-4
+              ./scripts/test-integration-shard packages-core-4-of-4
+          - shard_name: cmd-gc
+            timeout_minutes: 75
+            command: |
+              ./scripts/test-integration-shard packages-cmd-gc-1-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-2-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-3-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-4-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-5-of-6
+              ./scripts/test-integration-shard packages-cmd-gc-6-of-6
+          - shard_name: tmux
+            timeout_minutes: 45
+            command: |
+              ./scripts/test-integration-shard packages-runtime-tmux-1-of-3
+              ./scripts/test-integration-shard packages-runtime-tmux-2-of-3
+              ./scripts/test-integration-shard packages-runtime-tmux-3-of-3
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -234,39 +304,47 @@ jobs:
         run: make install-tools
       - name: Run integration shard
         id: shard
-        continue-on-error: true
-        run: make test-integration-packages
+        run: ${{ matrix.command }}
 
   mac-integration-bdstore:
     name: Mac / integration (bdstore)
+    needs:
+      - runner-policy
+      - mac-quality
+      - mac-unit
+      - mac-acceptance
     if: >-
       github.event_name == 'schedule' ||
-      (github.event_name == 'workflow_dispatch' && inputs.suite == 'full') ||
+      (
+        github.event_name == 'workflow_dispatch' &&
+        (inputs.suite == 'full' || inputs.suite == 'needs-mac')
+      ) ||
       (
         github.event_name == 'pull_request' &&
         github.event.pull_request.head.repo.full_name == github.repository &&
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
     timeout-minutes: 60
     outputs:
       outcome: ${{ steps.shard.outcome }}
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -280,35 +358,70 @@ jobs:
         run: make test-integration-bdstore
 
   mac-integration-rest:
-    name: Mac / integration (rest)
+    name: Mac / integration rest / ${{ matrix.shard_name }}
+    needs:
+      - runner-policy
+      - mac-quality
+      - mac-unit
+      - mac-acceptance
     if: >-
       github.event_name == 'schedule' ||
-      (github.event_name == 'workflow_dispatch' && inputs.suite == 'full') ||
+      (
+        github.event_name == 'workflow_dispatch' &&
+        (inputs.suite == 'full' || inputs.suite == 'needs-mac')
+      ) ||
       (
         github.event_name == 'pull_request' &&
         github.event.pull_request.head.repo.full_name == github.repository &&
         !github.event.pull_request.draft &&
         contains(github.event.pull_request.labels.*.name, 'needs-mac')
       )
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
-    timeout-minutes: 60
-    outputs:
-      outcome: ${{ steps.shard.outcome }}
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - shard_name: smoke
+            timeout_minutes: 45
+            command: make test-integration-rest-smoke
+          - shard_name: full-1-2-of-8
+            timeout_minutes: 45
+            command: |
+              ./scripts/test-integration-shard rest-full-1-of-8
+              ./scripts/test-integration-shard rest-full-2-of-8
+          - shard_name: full-3-4-of-8
+            timeout_minutes: 45
+            command: |
+              ./scripts/test-integration-shard rest-full-3-of-8
+              ./scripts/test-integration-shard rest-full-4-of-8
+          - shard_name: full-5-6-of-8
+            timeout_minutes: 45
+            command: |
+              ./scripts/test-integration-shard rest-full-5-of-8
+              ./scripts/test-integration-shard rest-full-6-of-8
+          - shard_name: full-7-of-8
+            timeout_minutes: 45
+            command: ./scripts/test-integration-shard rest-full-7-of-8
+          - shard_name: full-8-of-8
+            timeout_minutes: 45
+            command: ./scripts/test-integration-shard rest-full-8-of-8
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -318,34 +431,39 @@ jobs:
         run: make install-tools
       - name: Run integration shard
         id: shard
-        continue-on-error: true
-        run: make test-integration-rest
+        run: ${{ matrix.command }}
 
   # Long-running review-formulas shard — nightly / full dispatch only.
   mac-integration-review-formulas:
     name: Mac / integration (review-formulas)
+    needs:
+      - runner-policy
+      - mac-quality
+      - mac-unit
+      - mac-acceptance
     if: >-
       github.event_name == 'schedule' ||
       (github.event_name == 'workflow_dispatch' && inputs.suite == 'full')
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: ${{ needs.runner-policy.outputs.runner_macos }}
     timeout-minutes: 90
     outputs:
       outcome: ${{ steps.shard.outcome }}
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-macos
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -361,10 +479,9 @@ jobs:
   # Aggregate summary so a single check reports Mac parity status on the
   # PR. Gated on the same trigger set as the parity jobs so it doesn't
   # post a misleading green check on PRs that never ran Mac at all. The
-  # best-effort jobs (cover, integration, review-formulas) keep their
-  # failures visible here via job outputs that capture the real
-  # step outcome — needs.<job>.result masks it as success because the
-  # failing steps are continue-on-error.
+  # best-effort jobs keep their failures visible here via job outputs that
+  # capture the real step outcome — needs.<job>.result masks it as success
+  # because the failing steps are continue-on-error.
   mac-regression-summary:
     name: Mac regression summary
     if: >-
@@ -379,6 +496,7 @@ jobs:
         )
       )
     needs:
+      - runner-policy
       - mac-quality
       - mac-unit
       - mac-acceptance
@@ -387,20 +505,18 @@ jobs:
       - mac-integration-bdstore
       - mac-integration-rest
       - mac-integration-review-formulas
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
     steps:
       - name: Summarize
         env:
           QUALITY: ${{ needs.mac-quality.result }}
           UNIT: ${{ needs.mac-unit.result }}
           ACCEPTANCE: ${{ needs.mac-acceptance.result }}
-          # Best-effort jobs: use outputs.outcome (not needs.*.result)
-          # because their test step is continue-on-error, which forces
-          # needs.*.result to "success" even on failure.
+          # Best-effort jobs: use outputs.outcome (not needs.*.result).
           COVER: ${{ needs.mac-cover.outputs.outcome || needs.mac-cover.result }}
-          INT_PACKAGES: ${{ needs.mac-integration-packages.outputs.outcome || needs.mac-integration-packages.result }}
+          INT_PACKAGES: ${{ needs.mac-integration-packages.result }}
           INT_BDSTORE: ${{ needs.mac-integration-bdstore.outputs.outcome || needs.mac-integration-bdstore.result }}
-          INT_REST: ${{ needs.mac-integration-rest.outputs.outcome || needs.mac-integration-rest.result }}
+          INT_REST: ${{ needs.mac-integration-rest.result }}
           REVIEW_FORMULAS: ${{ needs.mac-integration-review-formulas.outputs.outcome || needs.mac-integration-review-formulas.result }}
         run: |
           cat >>"$GITHUB_STEP_SUMMARY" <<EOF
@@ -412,14 +528,14 @@ jobs:
           | Mac / make test | ${UNIT} |
           | Mac / acceptance (Tier A) | ${ACCEPTANCE} |
           | Mac / test-cover (best-effort) | ${COVER} |
-          | Mac / integration packages (best-effort) | ${INT_PACKAGES} |
+          | Mac / integration packages | ${INT_PACKAGES} |
           | Mac / integration bdstore (best-effort) | ${INT_BDSTORE} |
-          | Mac / integration rest (best-effort) | ${INT_REST} |
+          | Mac / integration rest | ${INT_REST} |
           | Mac / integration review-formulas (best-effort) | ${REVIEW_FORMULAS} |
           EOF
 
           fail=0
-          for result in "$QUALITY" "$UNIT" "$ACCEPTANCE"; do
+          for result in "$QUALITY" "$UNIT" "$ACCEPTANCE" "$INT_PACKAGES" "$INT_REST"; do
             # Skipped is acceptable (e.g. when run outside the needs-mac trigger set)
             case "$result" in
               success|skipped|"") ;;
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 9ec6e44a3d..bd6ec3e9fa 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -9,47 +9,35 @@ permissions:
   contents: read
 
 env:
-  DOLT_VERSION: "1.86.1"
-  BD_VERSION: "v1.0.0"
+  DOLT_VERSION: "1.86.6"
+  BD_VERSION: "v1.0.3"
 
 jobs:
   tier-b:
     name: Tier B acceptance tests
     runs-on: ubuntu-latest
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_API_KEY: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_API_KEY: ""
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: ./.github/actions/setup-gascity-ubuntu
         with:
-          go-version: "1.25.8"
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y tmux jq
-      - name: Install dolt
-        run: |
-          curl -fsSL https://github.com/dolthub/dolt/releases/download/v${{ env.DOLT_VERSION }}/install.sh | sudo bash
-
-      - name: Install released bd v${{ env.BD_VERSION }}
-        run: |
-          archive="beads_${BD_VERSION#v}_linux_amd64.tar.gz"
-          mkdir -p "$RUNNER_TEMP/beads"
-          curl -fsSL -o "$RUNNER_TEMP/$archive" \
-            "https://github.com/gastownhall/beads/releases/download/${BD_VERSION}/${archive}"
-          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP/beads" bd
-          sudo install -m 0755 "$RUNNER_TEMP/beads/bd" /usr/local/bin/bd
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "true"
 
-      - name: Validate Synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_API_KEY" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
           test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "ANTHROPIC_DEFAULT_HAIKU_MODEL resolved empty" >&2; exit 1; }
           test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "ANTHROPIC_DEFAULT_SONNET_MODEL resolved empty" >&2; exit 1; }
           test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "ANTHROPIC_DEFAULT_OPUS_MODEL resolved empty" >&2; exit 1; }
@@ -60,9 +48,6 @@ jobs:
           printf 'ANTHROPIC_DEFAULT_OPUS_MODEL=%s\n' "$ANTHROPIC_DEFAULT_OPUS_MODEL"
           printf 'CLAUDE_CODE_SUBAGENT_MODEL=%s\n' "$CLAUDE_CODE_SUBAGENT_MODEL"
 
-      - name: Install Claude CLI
-        run: npm install -g @anthropic-ai/claude-code
-
       - name: Tier B acceptance tests
         run: make test-acceptance-b
 
@@ -71,20 +56,17 @@ jobs:
 
   mac-inference:
     name: Mac / Tier B+C inference tests
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
+    runs-on: macos-15
     timeout-minutes: 180
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_API_KEY: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_API_KEY: ""
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
@@ -96,10 +78,9 @@ jobs:
           bd-version: ${{ env.BD_VERSION }}
           install-claude-cli: "true"
 
-      - name: Validate Synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_API_KEY" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
           test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "ANTHROPIC_DEFAULT_HAIKU_MODEL resolved empty" >&2; exit 1; }
           test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "ANTHROPIC_DEFAULT_SONNET_MODEL resolved empty" >&2; exit 1; }
           test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "ANTHROPIC_DEFAULT_OPUS_MODEL resolved empty" >&2; exit 1; }
@@ -119,12 +100,13 @@ jobs:
       WORKER_REPORT_DIR: ${{ github.workspace }}/.nightly-tmp/worker-inference-claude-reports
       DOLT_VERSION: "1.85.0"
       BD_COMMIT: "9d9d0e53c2330bd081bef350883f56c2557eb78b"
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
@@ -134,30 +116,29 @@ jobs:
           repository: gastownhall/beads
           ref: ${{ env.BD_COMMIT }}
           path: .beads-src
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.25.9"
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y tmux jq
       - name: Install dolt
-        run: |
-          curl -fsSL https://github.com/dolthub/dolt/releases/download/v${{ env.DOLT_VERSION }}/install.sh | sudo bash
+        run: .github/scripts/install-dolt-archive.sh "${{ env.DOLT_VERSION }}"
       - name: Build bd
         working-directory: .beads-src
         run: |
           mkdir -p "$GITHUB_WORKSPACE/.bd-release"
           GOBIN="$GITHUB_WORKSPACE/.bd-release" go install ./cmd/bd
           sudo install -m 0755 "$GITHUB_WORKSPACE/.bd-release/bd" /usr/local/bin/bd
-      - name: Validate Synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
           printf 'ANTHROPIC_BASE_URL=%s\n' "$ANTHROPIC_BASE_URL"
           printf 'ANTHROPIC_DEFAULT_HAIKU_MODEL=%s\n' "$ANTHROPIC_DEFAULT_HAIKU_MODEL"
           printf 'ANTHROPIC_DEFAULT_SONNET_MODEL=%s\n' "$ANTHROPIC_DEFAULT_SONNET_MODEL"
@@ -170,7 +151,7 @@ jobs:
       - name: WorkerInference tests
         id: worker_inference_tests
         run: GC_WORKER_REPORT_DIR="$WORKER_REPORT_DIR" make test-worker-inference PROFILE="$PROFILE"
-      - name: Emit synthetic failure report
+      - name: Emit worker inference failure report
         if: ${{ always() && steps.worker_inference_tests.outcome != 'success' }}
         run: python3 .github/workflows/scripts/worker_report_stub.py "$WORKER_REPORT_DIR" "worker-inference"
       - name: WorkerInference report summary
@@ -201,17 +182,16 @@ jobs:
           repository: gastownhall/beads
           ref: ${{ env.BD_COMMIT }}
           path: .beads-src
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.25.9"
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y tmux jq
       - name: Install dolt
-        run: |
-          curl -fsSL https://github.com/dolthub/dolt/releases/download/v${{ env.DOLT_VERSION }}/install.sh | sudo bash
+        run: .github/scripts/install-dolt-archive.sh "${{ env.DOLT_VERSION }}"
       - name: Build bd
         working-directory: .beads-src
         run: |
@@ -225,7 +205,7 @@ jobs:
       - name: WorkerInference tests
         id: worker_inference_tests
         run: GC_WORKER_REPORT_DIR="$WORKER_REPORT_DIR" make test-worker-inference PROFILE="$PROFILE"
-      - name: Emit synthetic failure report
+      - name: Emit worker inference failure report
         if: ${{ always() && steps.worker_inference_tests.outcome != 'success' }}
         run: python3 .github/workflows/scripts/worker_report_stub.py "$WORKER_REPORT_DIR" "worker-inference"
       - name: WorkerInference report summary
@@ -259,17 +239,16 @@ jobs:
           repository: gastownhall/beads
           ref: ${{ env.BD_COMMIT }}
           path: .beads-src
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.25.9"
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y tmux jq
       - name: Install dolt
-        run: |
-          curl -fsSL https://github.com/dolthub/dolt/releases/download/v${{ env.DOLT_VERSION }}/install.sh | sudo bash
+        run: .github/scripts/install-dolt-archive.sh "${{ env.DOLT_VERSION }}"
       - name: Build bd
         working-directory: .beads-src
         run: |
@@ -283,7 +262,7 @@ jobs:
       - name: WorkerInference tests
         id: worker_inference_tests
         run: GC_WORKER_REPORT_DIR="$WORKER_REPORT_DIR" make test-worker-inference PROFILE="$PROFILE"
-      - name: Emit synthetic failure report
+      - name: Emit worker inference failure report
         if: ${{ always() && steps.worker_inference_tests.outcome != 'success' }}
         run: python3 .github/workflows/scripts/worker_report_stub.py "$WORKER_REPORT_DIR" "worker-inference"
       - name: WorkerInference report summary
diff --git a/.github/workflows/ollama-acceptance-c.yml b/.github/workflows/ollama-acceptance-c.yml
new file mode 100644
index 0000000000..cb13ce1c26
--- /dev/null
+++ b/.github/workflows/ollama-acceptance-c.yml
@@ -0,0 +1,74 @@
+name: Ollama Acceptance C
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  DOLT_VERSION: "1.86.1"
+  BD_VERSION: "v1.0.0"
+  ANTHROPIC_BASE_URL: https://ollama.com
+  ANTHROPIC_API_KEY: ""
+  ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+  OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+  ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL }}
+  ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL }}
+  ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL }}
+  CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL }}
+  CLAUDE_CODE_EFFORT_LEVEL: auto
+  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
+
+jobs:
+  acceptance-c:
+    name: Acceptance C via Ollama Cloud
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-gascity-ubuntu
+        with:
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "true"
+      - name: Validate Ollama Claude configuration
+        run: |
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "ANTHROPIC_DEFAULT_HAIKU_MODEL resolved empty" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "ANTHROPIC_DEFAULT_SONNET_MODEL resolved empty" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "ANTHROPIC_DEFAULT_OPUS_MODEL resolved empty" >&2; exit 1; }
+          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "CLAUDE_CODE_SUBAGENT_MODEL resolved empty" >&2; exit 1; }
+      - name: Verify 6 concurrent Claude harness requests
+        run: |
+          set -euo pipefail
+          pids=()
+          for i in 1 2 3 4 5 6; do
+            claude --model "$CLAUDE_CODE_SUBAGENT_MODEL" --print "Reply exactly ok-$i" >"$RUNNER_TEMP/ollama-concurrency-$i.out" 2>"$RUNNER_TEMP/ollama-concurrency-$i.err" &
+            pids+=("$!")
+          done
+          failed=0
+          for pid in "${pids[@]}"; do
+            if ! wait "$pid"; then
+              failed=1
+            fi
+          done
+          if [ "$failed" -ne 0 ]; then
+            for i in 1 2 3 4 5 6; do
+              echo "=== request $i stderr ===" >&2
+              cat "$RUNNER_TEMP/ollama-concurrency-$i.err" >&2 || true
+            done
+            exit 1
+          fi
+          for i in 1 2 3 4 5 6; do
+            if ! grep -Fxq "ok-$i" "$RUNNER_TEMP/ollama-concurrency-$i.out"; then
+              echo "request $i did not return ok-$i" >&2
+              echo "=== request $i stdout ===" >&2
+              cat "$RUNNER_TEMP/ollama-concurrency-$i.out" >&2 || true
+              echo "=== request $i stderr ===" >&2
+              cat "$RUNNER_TEMP/ollama-concurrency-$i.err" >&2 || true
+              exit 1
+            fi
+          done
+      - name: Run make test-acceptance-c
+        run: make test-acceptance-c
diff --git a/.github/workflows/rc-gate.yml b/.github/workflows/rc-gate.yml
index a797a6dfac..4262c44a40 100644
--- a/.github/workflows/rc-gate.yml
+++ b/.github/workflows/rc-gate.yml
@@ -7,8 +7,8 @@ permissions:
   contents: read
 
 env:
-  DOLT_VERSION: "1.86.1"
-  BD_VERSION: "v1.0.0"
+  DOLT_VERSION: "1.86.6"
+  BD_VERSION: "v1.0.3"
 
 jobs:
   # Reuse the shared CI graph so RC inherits new parity checks automatically.
@@ -17,12 +17,46 @@ jobs:
     permissions:
       contents: read
     uses: ./.github/workflows/ci.yml
+    with:
+      force_blacksmith: true
     secrets: inherit
 
-  ubuntu_make_test:
-    name: ubuntu / make test
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
+  ubuntu_fast_tests:
+    name: ubuntu / fast tests / ${{ matrix.label }}
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: fsys-darwin-compile
+            timeout_minutes: 10
+            command: |
+              tmp="$(mktemp -d)"
+              trap 'rm -rf "$tmp"' EXIT
+              GOOS=darwin GOARCH=arm64 go test -c -o "$tmp/fsys.test" ./internal/fsys
+          - label: unit-core
+            timeout_minutes: 20
+            command: |
+              GC_FAST_UNIT=1 go test -timeout 8m $(go list ./... | grep -v '^github.com/gastownhall/gascity/cmd/gc$')
+          - label: cmd-gc-1-of-6
+            timeout_minutes: 20
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 1 6
+          - label: cmd-gc-2-of-6
+            timeout_minutes: 20
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 2 6
+          - label: cmd-gc-3-of-6
+            timeout_minutes: 20
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 3 6
+          - label: cmd-gc-4-of-6
+            timeout_minutes: 20
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 4 6
+          - label: cmd-gc-5-of-6
+            timeout_minutes: 20
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 5 6
+          - label: cmd-gc-6-of-6
+            timeout_minutes: 20
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 6 6
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -30,12 +64,12 @@ jobs:
           dolt-version: ${{ env.DOLT_VERSION }}
           bd-version: ${{ env.BD_VERSION }}
           install-claude-cli: "false"
-      - name: Run make test
-        run: make test
+      - name: Run fast test shard
+        run: ${{ matrix.command }}
 
   ubuntu_make_check_docs:
     name: ubuntu / make check-docs
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -47,17 +81,51 @@ jobs:
       - name: Run make check-docs
         run: make check-docs
 
-  ubuntu_make_test_acceptance:
-    name: ubuntu / make test-acceptance
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
+  ubuntu_acceptance_a:
+    name: ubuntu / acceptance A / ${{ matrix.label }}
+    needs: ci_parity
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        include:
+          - label: root-1-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 1 8
+          - label: root-2-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 2 8
+          - label: root-3-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 3 8
+          - label: root-4-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 4 8
+          - label: root-5-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 5 8
+          - label: root-6-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 6 8
+          - label: root-7-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 7 8
+          - label: root-8-of-8
+            timeout_minutes: 15
+            command: GO_TEST_TAGS=acceptance_a GO_TEST_TIMEOUT=8m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance 8 8
+          - label: helpers
+            timeout_minutes: 10
+            command: go test -tags acceptance_a -timeout 8m ./test/acceptance/helpers
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
@@ -67,20 +135,24 @@ jobs:
           dolt-version: ${{ env.DOLT_VERSION }}
           bd-version: ${{ env.BD_VERSION }}
           install-claude-cli: "true"
-      - name: Validate synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run make test-acceptance
-        run: make test-acceptance
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
+      - name: Run acceptance A shard
+        run: ${{ matrix.command }}
 
-  ubuntu_make_test_acceptance_b:
-    name: ubuntu / make test-acceptance-b
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
+  ubuntu_acceptance_b:
+    name: ubuntu / acceptance B / ${{ matrix.shard_index }} of 3
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard_index: [1, 2, 3]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: ./.github/actions/setup-gascity-ubuntu
@@ -88,79 +160,27 @@ jobs:
           dolt-version: ${{ env.DOLT_VERSION }}
           bd-version: ${{ env.BD_VERSION }}
           install-claude-cli: "false"
-      - name: Run make test-acceptance-b
-        run: make test-acceptance-b
-
-  ubuntu_make_test_acceptance_c:
-    name: ubuntu / make test-acceptance-c
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_EFFORT_LEVEL: auto
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: ./.github/actions/setup-gascity-ubuntu
-        with:
-          dolt-version: ${{ env.DOLT_VERSION }}
-          bd-version: ${{ env.BD_VERSION }}
-      - name: Validate synthetic Claude configuration
-        run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run make test-acceptance-c
-        run: make test-acceptance-c
+      - name: Run acceptance B shard
+        run: GO_TEST_TAGS=acceptance_b GO_TEST_TIMEOUT=10m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance/tier_b ${{ matrix.shard_index }} 3
 
-  ubuntu_test_integration_packages:
-    name: ubuntu / integration packages
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_EFFORT_LEVEL: auto
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: ./.github/actions/setup-gascity-ubuntu
-        with:
-          dolt-version: ${{ env.DOLT_VERSION }}
-          bd-version: ${{ env.BD_VERSION }}
-          install-claude-cli: "true"
-      - name: Validate synthetic Claude configuration
-        run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run integration packages shard
-        run: make test-integration-packages
-
-  ubuntu_test_integration_review_formulas:
-    name: ubuntu / integration review-formulas
-    runs-on: ubuntu-latest
+  ubuntu_acceptance_c:
+    name: ubuntu / acceptance C / ${{ matrix.shard_index }} of 5
+    needs: ubuntu_acceptance_a
+    runs-on: blacksmith-32vcpu-ubuntu-2404
     timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        shard_index: [1, 2, 3, 4, 5]
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
@@ -169,28 +189,121 @@ jobs:
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
           bd-version: ${{ env.BD_VERSION }}
-          install-claude-cli: "true"
-      - name: Validate synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run integration review-formulas shard
-        run: make test-integration-review-formulas
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
+      - name: Run acceptance C shard
+        run: GO_TEST_TAGS=acceptance_c GO_TEST_TIMEOUT=45m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance/tier_c ${{ matrix.shard_index }} 5
 
-  ubuntu_test_integration_bdstore:
-    name: ubuntu / integration bdstore
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
+  ubuntu_integration_shards:
+    name: ubuntu / integration / ${{ matrix.shard_name }}
+    needs: ubuntu_acceptance_c
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        include:
+          - shard_name: packages-core-1-of-4
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-core-1-of-4
+          - shard_name: packages-core-2-of-4
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-core-2-of-4
+          - shard_name: packages-core-3-of-4
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-core-3-of-4
+          - shard_name: packages-core-4-of-4
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-core-4-of-4
+          - shard_name: packages-cmd-gc-1-of-6
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-cmd-gc-1-of-6
+          - shard_name: packages-cmd-gc-2-of-6
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-cmd-gc-2-of-6
+          - shard_name: packages-cmd-gc-3-of-6
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-cmd-gc-3-of-6
+          - shard_name: packages-cmd-gc-4-of-6
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-cmd-gc-4-of-6
+          - shard_name: packages-cmd-gc-5-of-6
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-cmd-gc-5-of-6
+          - shard_name: packages-cmd-gc-6-of-6
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-cmd-gc-6-of-6
+          - shard_name: packages-runtime-tmux-1-of-3
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-runtime-tmux-1-of-3
+          - shard_name: packages-runtime-tmux-2-of-3
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-runtime-tmux-2-of-3
+          - shard_name: packages-runtime-tmux-3-of-3
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard packages-runtime-tmux-3-of-3
+          - shard_name: review-formulas-basic-1-of-2
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard review-formulas-basic-1-of-2
+          - shard_name: review-formulas-basic-2-of-2
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard review-formulas-basic-2-of-2
+          - shard_name: review-formulas-retries-1-of-2
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard review-formulas-retries-1-of-2
+          - shard_name: review-formulas-retries-2-of-2
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard review-formulas-retries-2-of-2
+          - shard_name: review-formulas-recovery
+            timeout_minutes: 25
+            command: make test-integration-review-formulas-recovery
+          - shard_name: bdstore
+            timeout_minutes: 15
+            command: make test-integration-bdstore
+          - shard_name: rest-smoke-1-of-2
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-smoke-1-of-2
+          - shard_name: rest-smoke-2-of-2
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-smoke-2-of-2
+          - shard_name: rest-full-1-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-1-of-8
+          - shard_name: rest-full-2-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-2-of-8
+          - shard_name: rest-full-3-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-3-of-8
+          - shard_name: rest-full-4-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-4-of-8
+          - shard_name: rest-full-5-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-5-of-8
+          - shard_name: rest-full-6-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-6-of-8
+          - shard_name: rest-full-7-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-7-of-8
+          - shard_name: rest-full-8-of-8
+            timeout_minutes: 20
+            command: ./scripts/test-integration-shard rest-full-8-of-8
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
     steps:
@@ -200,57 +313,34 @@ jobs:
           dolt-version: ${{ env.DOLT_VERSION }}
           bd-version: ${{ env.BD_VERSION }}
           install-claude-cli: "true"
-      - name: Validate synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run integration bdstore shard
-        run: make test-integration-bdstore
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
+      - name: Run integration shard
+        run: ${{ matrix.command }}
 
-  ubuntu_test_integration_rest:
-    name: ubuntu / integration rest
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
+  ubuntu_tutorial:
+    name: ubuntu / tutorial goldens / ${{ matrix.shard_index }} of 6
+    needs: ubuntu_integration_shards
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    timeout-minutes: 110
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        shard_index: [1, 2, 3, 4, 5, 6]
     env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_EFFORT_LEVEL: auto
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: ./.github/actions/setup-gascity-ubuntu
-        with:
-          dolt-version: ${{ env.DOLT_VERSION }}
-          bd-version: ${{ env.BD_VERSION }}
-          install-claude-cli: "true"
-      - name: Validate synthetic Claude configuration
-        run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run integration rest shard
-        run: make test-integration-rest
-
-  ubuntu_make_test_tutorial:
-    name: ubuntu / make test-tutorial
-    runs-on: ubuntu-latest
-    timeout-minutes: 180
-    env:
-      ANTHROPIC_BASE_URL: https://api.synthetic.new/anthropic
-      ANTHROPIC_AUTH_TOKEN: ${{ secrets.SYNTHETIC_API_KEY }}
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
-      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL }}
+      ANTHROPIC_BASE_URL: https://ollama.com
+      ANTHROPIC_AUTH_TOKEN: ${{ secrets.OLLAMA_API_KEY }}
+      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_SONNET_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      ANTHROPIC_DEFAULT_OPUS_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
+      CLAUDE_CODE_SUBAGENT_MODEL: ${{ vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL || vars.GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL }}
       CLAUDE_CODE_EFFORT_LEVEL: auto
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
       GC_TUTORIAL_GOLDENS_USE_CLAUDE_FOR_CODEX: "1"
@@ -260,19 +350,19 @@ jobs:
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
           bd-version: ${{ env.BD_VERSION }}
-      - name: Validate synthetic Claude configuration
+      - name: Validate Ollama Claude configuration
         run: |
-          test -n "$ANTHROPIC_AUTH_TOKEN" || { echo "Missing SYNTHETIC_API_KEY GitHub secret" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_HAIKU_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SONNET_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_OPUS_MODEL GitHub variable" >&2; exit 1; }
-          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_MODEL or GC_WORKER_INFERENCE_CLAUDE_SYNTHETIC_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
-      - name: Run make test-tutorial
-        run: make test-tutorial
+          test -n "$OLLAMA_API_KEY" || { echo "Missing OLLAMA_API_KEY GitHub secret" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_HAIKU_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_HAIKU_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_SONNET_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SONNET_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$ANTHROPIC_DEFAULT_OPUS_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_OPUS_MODEL GitHub variable" >&2; exit 1; }
+          test -n "$CLAUDE_CODE_SUBAGENT_MODEL" || { echo "Missing GC_WORKER_INFERENCE_CLAUDE_OLLAMA_MODEL or GC_WORKER_INFERENCE_CLAUDE_OLLAMA_SUBAGENT_MODEL GitHub variable" >&2; exit 1; }
+      - name: Run tutorial golden shard
+        run: GO_TEST_TAGS=acceptance_c GO_TEST_TIMEOUT=90m GO_TEST_COUNT=1 ./scripts/test-go-test-shard ./test/acceptance/tutorial_goldens ${{ matrix.shard_index }} 6
 
   ubuntu_goreleaser_snapshot:
     name: ubuntu / goreleaser snapshot
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -284,7 +374,7 @@ jobs:
           bd-version: ${{ env.BD_VERSION }}
           install-claude-cli: "false"
       - name: Run GoReleaser snapshot
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
+        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
         with:
           version: "~> v2"
           args: release --snapshot --clean
@@ -295,53 +385,67 @@ jobs:
           path: dist/**
           if-no-files-found: error
 
-  macos_make_test:
-    name: macOS / make test
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - macstadium
-    timeout-minutes: 45
+  macos_fast_tests:
+    name: macOS / fast tests / ${{ matrix.label }}
+    runs-on: blacksmith-12vcpu-macos-15
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: fsys-darwin-compile
+            timeout_minutes: 10
+            command: |
+              tmp="$(mktemp -d)"
+              trap 'rm -rf "$tmp"' EXIT
+              GOOS=darwin GOARCH=arm64 go test -c -o "$tmp/fsys.test" ./internal/fsys
+          - label: unit-core
+            timeout_minutes: 30
+            command: |
+              GC_FAST_UNIT=1 go test -timeout 20m $(go list ./... | grep -v '^github.com/gastownhall/gascity/cmd/gc$')
+          - label: cmd-gc-1-of-6
+            timeout_minutes: 30
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 1 6
+          - label: cmd-gc-2-of-6
+            timeout_minutes: 30
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 2 6
+          - label: cmd-gc-3-of-6
+            timeout_minutes: 30
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 3 6
+          - label: cmd-gc-4-of-6
+            timeout_minutes: 30
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 4 6
+          - label: cmd-gc-5-of-6
+            timeout_minutes: 30
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 5 6
+          - label: cmd-gc-6-of-6
+            timeout_minutes: 30
+            command: GC_FAST_UNIT=1 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 6 6
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: ./.github/actions/setup-gascity-macos
         with:
-          # The mac runner still needs Go for `make test`, but not for building bd.
-          cache: false
-          go-version: "1.25.8"
-      - name: Install released bd
-        run: |
-          BD_MAC_RELEASE_TARBALL="beads_${BD_VERSION#v}_darwin_arm64.tar.gz"
-          mkdir -p "$HOME/.local/bin"
-          mkdir -p "$RUNNER_TEMP/beads"
-          curl -fsSL -o "$RUNNER_TEMP/$BD_MAC_RELEASE_TARBALL" \
-            "https://github.com/gastownhall/beads/releases/download/${BD_VERSION}/${BD_MAC_RELEASE_TARBALL}"
-          tar -xzf "$RUNNER_TEMP/$BD_MAC_RELEASE_TARBALL" -C "$RUNNER_TEMP/beads" --strip-components=1
-          install -m 0755 "$RUNNER_TEMP/beads/bd" "$HOME/.local/bin/bd"
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/bd" version
-      - name: Run make test
-        run: make test
+          dolt-version: ${{ env.DOLT_VERSION }}
+          bd-version: ${{ env.BD_VERSION }}
+          install-claude-cli: "false"
+      - name: Run macOS fast test shard
+        run: ${{ matrix.command }}
 
   rc_summary:
     name: RC summary
     if: ${{ always() }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     needs:
       - ci_parity
-      - ubuntu_make_test
+      - ubuntu_fast_tests
       - ubuntu_make_check_docs
-      - ubuntu_make_test_acceptance
-      - ubuntu_make_test_acceptance_b
-      - ubuntu_make_test_acceptance_c
-      - ubuntu_test_integration_packages
-      - ubuntu_test_integration_review_formulas
-      - ubuntu_test_integration_bdstore
-      - ubuntu_test_integration_rest
-      - ubuntu_make_test_tutorial
+      - ubuntu_acceptance_a
+      - ubuntu_acceptance_b
+      - ubuntu_acceptance_c
+      - ubuntu_integration_shards
+      - ubuntu_tutorial
       - ubuntu_goreleaser_snapshot
-      - macos_make_test
+      - macos_fast_tests
     env:
       NEEDS_JSON: ${{ toJSON(needs) }}
     steps:
@@ -352,27 +456,27 @@ jobs:
           import os
           import sys
 
-          needs = json.loads(os.environ['NEEDS_JSON'])
-          summary_path = os.environ['GITHUB_STEP_SUMMARY']
+          needs = json.loads(os.environ["NEEDS_JSON"])
+          summary_path = os.environ["GITHUB_STEP_SUMMARY"]
           lines = [
-              '## RC Gate',
-              '',
-              'This workflow is the manual pre-RC gate. It calls the reusable CI workflow plus RC-only release jobs for the dispatched ref.',
-              '',
-              'The `ci_parity` entry is the aggregate result of the shared CI workflow. Inspect the nested CI jobs in this run for per-check detail.',
-              '',
-              'Jobs that show `skipped` were intentionally gated off by the same conditional logic used in CI.',
-              '',
-              '| Job | Result |',
-              '| --- | --- |',
+              "## RC Gate",
+              "",
+              "This workflow is the manual pre-RC gate. It calls the reusable CI workflow plus RC-only release jobs for the dispatched ref.",
+              "",
+              "The `ci_parity` entry is the aggregate result of the shared CI workflow. Inspect the nested CI jobs in this run for per-check detail.",
+              "",
+              "Jobs that show `skipped` were intentionally gated off by the same conditional logic used in CI.",
+              "",
+              "| Job | Result |",
+              "| --- | --- |",
           ]
           fail = False
           for job_id, meta in needs.items():
-              result = meta.get('result', 'unknown')
-              lines.append(f'| {job_id} | {result} |')
-              if result not in {'success', 'skipped'}:
+              result = meta.get("result", "unknown")
+              lines.append(f"| {job_id} | {result} |")
+              if result not in {"success", "skipped"}:
                   fail = True
-          with open(summary_path, 'a', encoding='utf-8') as handle:
-              handle.write('\\n'.join(lines) + '\\n')
+          with open(summary_path, "a", encoding="utf-8") as handle:
+              handle.write("\n".join(lines) + "\n")
           sys.exit(1 if fail else 0)
           PY
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f0c73e93e3..c992d6341a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,20 +12,21 @@ concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   release:
     name: Release
     if: ${{ github.repository == 'gastownhall/gascity' && startsWith(github.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
 
@@ -42,7 +43,7 @@ jobs:
         run: make check-version-tag
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
+        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
         with:
           version: "~> v2"
           args: >
@@ -52,14 +53,66 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GORELEASER_CURRENT_TAG: ${{ github.ref_name }}
 
+  attest-release:
+    name: Attest release
+    if: ${{ github.repository == 'gastownhall/gascity' && startsWith(github.ref, 'refs/tags/v') }}
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Resolve release asset paths
+        id: assets
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          mkdir -p dist
+          echo "checksums=dist/gascity_${version}_checksums.txt" >> "$GITHUB_OUTPUT"
+          echo "sbom=dist/gascity-${GITHUB_REF_NAME}.spdx.json" >> "$GITHUB_OUTPUT"
+
+      - name: Download release checksums
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          gh release download "${GITHUB_REF_NAME}" --pattern "gascity_${version}_checksums.txt" --dir dist
+
+      - name: Generate release SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          path: .
+          format: spdx-json
+          output-file: ${{ steps.assets.outputs.sbom }}
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Upload release SBOM
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "${GITHUB_REF_NAME}" "${{ steps.assets.outputs.sbom }}" --clobber
+
+      - name: Attest release artifacts
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
+        with:
+          subject-checksums: ${{ steps.assets.outputs.checksums }}
+
+      - name: Attest release SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
+        with:
+          subject-checksums: ${{ steps.assets.outputs.checksums }}
+          sbom-path: ${{ steps.assets.outputs.sbom }}
+
   update-homebrew-formula:
     name: Update Homebrew formula
     if: ${{ github.repository == 'gastownhall/gascity' && startsWith(github.ref, 'refs/tags/v') }}
-    needs: release
+    needs: [release, attest-release]
     runs-on: ubuntu-latest
-    env:
-      HAS_HOMEBREW_APP: ${{ secrets.HOMEBREW_TAP_APP_ID != '' && secrets.HOMEBREW_TAP_APP_PRIVATE_KEY != '' }}
-      HAS_HOMEBREW_PAT: ${{ secrets.HOMEBREW_TAP_TOKEN != '' }}
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -68,10 +121,19 @@ jobs:
         id: version
         run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
+      - name: Verify Homebrew tap app credentials
+        env:
+          HOMEBREW_TAP_APP_ID: ${{ secrets.HOMEBREW_TAP_APP_ID }}
+          HOMEBREW_TAP_APP_PRIVATE_KEY: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
+        run: |
+          if [ -z "$HOMEBREW_TAP_APP_ID" ] || [ -z "$HOMEBREW_TAP_APP_PRIVATE_KEY" ]; then
+            echo "ERROR: HOMEBREW_TAP_APP_ID and HOMEBREW_TAP_APP_PRIVATE_KEY are required for tap publishing." >&2
+            exit 1
+          fi
+
       - name: Mint Homebrew tap token
         id: homebrew-token
-        if: ${{ env.HAS_HOMEBREW_APP == 'true' }}
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
         with:
           app-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
           private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
@@ -80,10 +142,9 @@ jobs:
           permission-contents: write
 
       - name: Generate and push Homebrew formula
-        if: ${{ env.HAS_HOMEBREW_APP == 'true' || env.HAS_HOMEBREW_PAT == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_TOKEN: ${{ steps.homebrew-token.outputs.token || secrets.HOMEBREW_TAP_TOKEN }}
+          HOMEBREW_TAP_TOKEN: ${{ steps.homebrew-token.outputs.token }}
         run: |
           version="${{ steps.version.outputs.version }}"
           tag="v${version}"
@@ -180,7 +241,3 @@ jobs:
           git add Formula/gascity.rb
           git commit -m "gascity ${version}" || echo "No changes to commit"
           git push
-
-      - name: Skip Homebrew formula update
-        if: ${{ env.HAS_HOMEBREW_APP != 'true' && env.HAS_HOMEBREW_PAT != 'true' }}
-        run: echo "No Homebrew tap credential configured; skipping tap update."
diff --git a/.github/workflows/remove-needs-info.yml b/.github/workflows/remove-needs-info.yml
index 9d6654001a..58233e7781 100644
--- a/.github/workflows/remove-needs-info.yml
+++ b/.github/workflows/remove-needs-info.yml
@@ -6,7 +6,11 @@ on:
   pull_request_target:
     types: [synchronize]
 
+permissions: {}
+
 jobs:
+  # pull_request_target is safe here because this job never checks out or runs
+  # pull request code; it only removes labels from the issue/PR metadata.
   remove-label:
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/remove-needs-triage.yml b/.github/workflows/remove-needs-triage.yml
index f76044e017..189c61ae09 100644
--- a/.github/workflows/remove-needs-triage.yml
+++ b/.github/workflows/remove-needs-triage.yml
@@ -6,7 +6,11 @@ on:
   pull_request_target:
     types: [labeled]
 
+permissions: {}
+
 jobs:
+  # pull_request_target is safe here because this job never checks out or runs
+  # pull request code; it only removes labels from the issue/PR metadata.
   remove-triage-label:
     runs-on: ubuntu-latest
     permissions:
diff --git a/.github/workflows/review-formulas.yml b/.github/workflows/review-formulas.yml
index 4969a6bd25..e5445aaca8 100644
--- a/.github/workflows/review-formulas.yml
+++ b/.github/workflows/review-formulas.yml
@@ -11,34 +11,72 @@ on:
       - reopened
       - synchronize
       - ready_for_review
-      - labeled
   workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request number for label-dispatched runs
+        required: false
+        type: string
+      head_repo:
+        description: Pull request head repository for label-dispatched runs
+        required: false
+        type: string
+      head_sha:
+        description: Pull request head SHA for label-dispatched runs
+        required: false
+        type: string
+      head_ref:
+        description: Pull request head ref for label-dispatched runs
+        required: false
+        type: string
 
 permissions:
   contents: read
 
 concurrency:
-  group: review-formulas-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref || github.run_id }}
+  group: review-formulas-${{ github.event_name }}-${{ inputs.pr_number || github.event.pull_request.number || github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  DOLT_VERSION: "1.86.1"
-  BD_VERSION: "v1.0.0"
+  DOLT_VERSION: "1.86.6"
+  BD_VERSION: "v1.0.3"
 
 jobs:
+  runner-policy:
+    name: Runner policy
+    runs-on: ${{ github.event_name == 'pull_request' && contains(fromJSON('["julianknutsen","csells","sjarmak","quad341"]'), github.event.pull_request.user.login) && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    outputs:
+      use_blacksmith: ${{ steps.policy.outputs.use_blacksmith }}
+      reason: ${{ steps.policy.outputs.reason }}
+      runner_2vcpu: ${{ steps.policy.outputs.runner_2vcpu }}
+      runner_8vcpu: ${{ steps.policy.outputs.runner_8vcpu }}
+      runner_16vcpu: ${{ steps.policy.outputs.runner_16vcpu }}
+      runner_32vcpu: ${{ steps.policy.outputs.runner_32vcpu }}
+      runner_macos: ${{ steps.policy.outputs.runner_macos }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Select runner backend
+        id: policy
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          python3 .github/workflows/scripts/runner_policy.py
+
   gate:
     name: review-formulas routing
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.action != 'labeled' ||
-      github.event.label.name == 'needs-review-formulas'
-    runs-on: ubuntu-latest
+    needs: runner-policy
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
     outputs:
       run_shard: ${{ steps.gate.outputs.run_shard }}
       reason: ${{ steps.gate.outputs.reason }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
           filters: |
@@ -62,8 +100,6 @@ jobs:
         id: gate
         env:
           EVENT_NAME: ${{ github.event_name }}
-          EVENT_ACTION: ${{ github.event.action }}
-          LABELED_NAME: ${{ github.event.label.name }}
           PR_DRAFT: ${{ github.event.pull_request.draft }}
           PATH_HIT: ${{ steps.filter.outputs.review_formulas }}
           NEEDS_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'needs-review-formulas') }}
@@ -78,9 +114,7 @@ jobs:
             run_shard=true
             reason="push to main safety net"
           elif [[ "$PR_DRAFT" != "true" ]]; then
-            if [[ "$EVENT_ACTION" == "labeled" && "$LABELED_NAME" != "needs-review-formulas" ]]; then
-              reason="ignored unrelated label event"
-            elif [[ "$PATH_HIT" == "true" || "$NEEDS_LABEL" == "true" ]]; then
+            if [[ "$PATH_HIT" == "true" || "$NEEDS_LABEL" == "true" ]]; then
               run_shard=true
               reason="pull request path/label match"
             else
@@ -100,25 +134,31 @@ jobs:
 
   review-formulas-shard:
     name: Integration / review-formulas (${{ matrix.label }})
-    needs: gate
+    needs:
+      - runner-policy
+      - gate
     if: needs.gate.outputs.run_shard == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.runner-policy.outputs.runner_32vcpu }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         include:
-          - shard: review-formulas-basic
-            label: basic
+          - label: basic
+            command: make test-integration-review-formulas-basic-cover
             coverprofile: coverage.integration-review-formulas-basic.txt
-          - shard: review-formulas-retries
-            label: retries
+          - label: retries
+            command: make test-integration-review-formulas-retries-cover
             coverprofile: coverage.integration-review-formulas-retries.txt
-          - shard: review-formulas-recovery
-            label: recovery
+          - label: recovery
+            command: make test-integration-review-formulas-recovery-cover
             coverprofile: coverage.integration-review-formulas-recovery.txt
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: ${{ inputs.head_repo || github.repository }}
+          ref: ${{ inputs.head_sha || github.sha }}
+          persist-credentials: false
       - uses: ./.github/actions/setup-gascity-ubuntu
         with:
           dolt-version: ${{ env.DOLT_VERSION }}
@@ -128,7 +168,7 @@ jobs:
         run: make install-tools
       - name: Run review-formulas shard
         id: shard
-        run: GO_TEST_COVERPROFILE=${{ matrix.coverprofile }} ./scripts/test-integration-shard ${{ matrix.shard }}
+        run: ${{ matrix.command }}
       - name: Inspect shard coverage profile
         if: steps.shard.outcome == 'success'
         run: |
@@ -145,7 +185,7 @@ jobs:
             github.event_name != 'pull_request' ||
             github.event.pull_request.head.repo.full_name == github.repository
           )
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
         with:
           files: ${{ matrix.coverprofile }}
           flags: integration-review-formulas
@@ -159,16 +199,11 @@ jobs:
     # explicit while the shards run in parallel underneath it.
     name: Integration / review-formulas
     needs:
+      - runner-policy
       - gate
       - review-formulas-shard
-    if: >-
-      always() &&
-      (
-        github.event_name != 'pull_request' ||
-        github.event.action != 'labeled' ||
-        github.event.label.name == 'needs-review-formulas'
-      )
-    runs-on: ubuntu-latest
+    if: always()
+    runs-on: ${{ needs.runner-policy.outputs.runner_2vcpu }}
     steps:
       - name: Finalize review-formulas result
         env:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000000..6205100e95
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,48 @@
+name: OpenSSF Scorecard
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "37 5 * * *"
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    continue-on-error: true
+    permissions:
+      contents: read
+      security-events: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Run OpenSSF Scorecard
+        continue-on-error: true
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: scorecard.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF results
+        if: ${{ hashFiles('scorecard.sarif') != '' }}
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+        with:
+          sarif_file: scorecard.sarif
+
+      - name: Upload SARIF artifact
+        if: ${{ hashFiles('scorecard.sarif') != '' }}
+        continue-on-error: true
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: openssf-scorecard-sarif
+          path: scorecard.sarif
+          retention-days: 5
diff --git a/.github/workflows/scripts/runner_policy.py b/.github/workflows/scripts/runner_policy.py
new file mode 100644
index 0000000000..0afaaaec2d
--- /dev/null
+++ b/.github/workflows/scripts/runner_policy.py
@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""Select GitHub Actions runners for Gas City workflows."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+
+ALLOWLIST_PATH = Path(".github/blacksmith-allowlist.txt")
+
+BLACKSMITH_RUNNERS = {
+    "runner_2vcpu": "blacksmith-2vcpu-ubuntu-2404",
+    "runner_8vcpu": "blacksmith-8vcpu-ubuntu-2404",
+    "runner_16vcpu": "blacksmith-16vcpu-ubuntu-2404",
+    "runner_32vcpu": "blacksmith-32vcpu-ubuntu-2404",
+    "runner_macos": "blacksmith-12vcpu-macos-15",
+}
+
+GITHUB_RUNNERS = {
+    "runner_2vcpu": "ubuntu-latest",
+    "runner_8vcpu": "ubuntu-latest",
+    "runner_16vcpu": "ubuntu-latest",
+    "runner_32vcpu": "ubuntu-latest",
+    "runner_macos": "macos-15",
+}
+
+
+def load_allowlist(path: Path = ALLOWLIST_PATH) -> set[str]:
+    """Load the Blacksmith pull request author allowlist."""
+    allowlist: set[str] = set()
+    if not path.exists():
+        return allowlist
+    for raw_line in path.read_text(encoding="utf-8").splitlines():
+        line = raw_line.split("#", 1)[0].strip()
+        if line:
+            allowlist.add(line.lower())
+    return allowlist
+
+
+def select_runners(
+    event_name: str,
+    author: str,
+    allowlist: set[str],
+    *,
+    force_blacksmith: bool = False,
+) -> tuple[bool, str, dict[str, str]]:
+    """Return whether to use Blacksmith, the reason, and runner labels."""
+    normalized_event = event_name.strip()
+    normalized_author = author.strip()
+    if force_blacksmith:
+        return True, "Blacksmith forced by workflow input", BLACKSMITH_RUNNERS
+    if normalized_event == "pull_request" and normalized_author.lower() in allowlist:
+        return True, "pull request author is in .github/blacksmith-allowlist.txt", BLACKSMITH_RUNNERS
+    if normalized_event != "pull_request":
+        return (
+            False,
+            f"Blacksmith is limited to approved pull requests; using GitHub-hosted runners for {normalized_event or '<unknown>'}",
+            GITHUB_RUNNERS,
+        )
+    return (
+        False,
+        f"author {normalized_author or '<unknown>'} is not on the Blacksmith allowlist; using GitHub-hosted runners",
+        GITHUB_RUNNERS,
+    )
+
+
+def append_outputs(use_blacksmith: bool, reason: str, runners: dict[str, str]) -> None:
+    """Append selected policy fields to GITHUB_OUTPUT."""
+    output_path = os.environ["GITHUB_OUTPUT"]
+    with open(output_path, "a", encoding="utf-8") as output:
+        output.write(f"use_blacksmith={str(use_blacksmith).lower()}\n")
+        output.write(f"reason={reason}\n")
+        for name, runner in runners.items():
+            output.write(f"{name}={runner}\n")
+
+
+def append_summary(use_blacksmith: bool, reason: str, event_name: str, author: str) -> None:
+    """Append a human-readable runner policy summary."""
+    summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if not summary_path:
+        return
+    backend = "Blacksmith" if use_blacksmith else "GitHub-hosted"
+    with open(summary_path, "a", encoding="utf-8") as summary:
+        summary.write("## Runner policy\n\n")
+        summary.write(f"- backend: `{backend}`\n")
+        summary.write(f"- use_blacksmith: `{str(use_blacksmith).lower()}`\n")
+        summary.write(f"- reason: {reason}\n")
+        if event_name == "pull_request":
+            summary.write(f"- author: `{author or '<unknown>'}`\n")
+
+
+def main() -> None:
+    event_name = os.environ["EVENT_NAME"]
+    author = os.environ.get("PR_AUTHOR", "").strip()
+    force_blacksmith = os.environ.get("FORCE_BLACKSMITH", "").strip().lower() == "true"
+    use_blacksmith, reason, runners = select_runners(
+        event_name,
+        author,
+        load_allowlist(),
+        force_blacksmith=force_blacksmith,
+    )
+    append_outputs(use_blacksmith, reason, runners)
+    append_summary(use_blacksmith, reason, event_name, author)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/workflows/scripts/test_rc_gate_policy.py b/.github/workflows/scripts/test_rc_gate_policy.py
new file mode 100644
index 0000000000..c64a87b11e
--- /dev/null
+++ b/.github/workflows/scripts/test_rc_gate_policy.py
@@ -0,0 +1,42 @@
+from pathlib import Path
+import unittest
+
+
+WORKFLOW = Path(__file__).resolve().parents[1] / "rc-gate.yml"
+
+
+def _job_block(workflow: str, job_name: str) -> str:
+    marker = f"  {job_name}:\n"
+    start = workflow.index(marker)
+    lines = workflow[start:].splitlines(keepends=True)
+    block = [lines[0]]
+    for line in lines[1:]:
+        if line.startswith("  ") and not line.startswith("    ") and line.strip().endswith(":"):
+            break
+        block.append(line)
+    return "".join(block)
+
+
+class RCGatePolicyTests(unittest.TestCase):
+    def test_real_inference_jobs_are_throttled_after_ci_parity(self) -> None:
+        workflow = WORKFLOW.read_text()
+
+        acceptance_a = _job_block(workflow, "ubuntu_acceptance_a")
+        self.assertIn("needs: ci_parity", acceptance_a)
+        self.assertIn("max-parallel: 2", acceptance_a)
+
+        acceptance_c = _job_block(workflow, "ubuntu_acceptance_c")
+        self.assertIn("needs: ubuntu_acceptance_a", acceptance_c)
+        self.assertIn("max-parallel: 1", acceptance_c)
+
+        integration = _job_block(workflow, "ubuntu_integration_shards")
+        self.assertIn("needs: ubuntu_acceptance_c", integration)
+        self.assertIn("max-parallel: 4", integration)
+
+        tutorial = _job_block(workflow, "ubuntu_tutorial")
+        self.assertIn("needs: ubuntu_integration_shards", tutorial)
+        self.assertIn("max-parallel: 1", tutorial)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/workflows/scripts/test_runner_policy.py b/.github/workflows/scripts/test_runner_policy.py
new file mode 100644
index 0000000000..4499179195
--- /dev/null
+++ b/.github/workflows/scripts/test_runner_policy.py
@@ -0,0 +1,73 @@
+import tempfile
+import unittest
+from pathlib import Path
+
+import runner_policy
+
+
+class RunnerPolicyTests(unittest.TestCase):
+    def test_load_allowlist_ignores_comments_and_case_normalizes(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "allowlist.txt"
+            path.write_text(
+                "julianknutsen\n"
+                "  Csells  # maintainer\n"
+                "\n"
+                "# comment\n",
+                encoding="utf-8",
+            )
+
+            self.assertEqual(runner_policy.load_allowlist(path), {"julianknutsen", "csells"})
+
+    def test_pull_request_from_allowlisted_author_uses_blacksmith(self) -> None:
+        use_blacksmith, reason, runners = runner_policy.select_runners(
+            "pull_request",
+            "Quad341",
+            {"quad341"},
+        )
+
+        self.assertTrue(use_blacksmith)
+        self.assertIn("allowlist", reason)
+        self.assertEqual(runners["runner_32vcpu"], "blacksmith-32vcpu-ubuntu-2404")
+        self.assertEqual(runners["runner_macos"], "blacksmith-12vcpu-macos-15")
+
+    def test_push_uses_github_even_for_allowlisted_author(self) -> None:
+        use_blacksmith, reason, runners = runner_policy.select_runners(
+            "push",
+            "julianknutsen",
+            {"julianknutsen"},
+            force_blacksmith=False,
+        )
+
+        self.assertFalse(use_blacksmith)
+        self.assertIn("approved pull requests", reason)
+        self.assertEqual(runners["runner_32vcpu"], "ubuntu-latest")
+
+    def test_forced_workflow_call_uses_blacksmith(self) -> None:
+        use_blacksmith, reason, runners = runner_policy.select_runners(
+            "workflow_call",
+            "",
+            set(),
+            force_blacksmith=True,
+        )
+
+        self.assertTrue(use_blacksmith)
+        self.assertIn("forced", reason)
+        self.assertEqual(runners["runner_16vcpu"], "blacksmith-16vcpu-ubuntu-2404")
+        self.assertEqual(runners["runner_macos"], "blacksmith-12vcpu-macos-15")
+
+    def test_unlisted_pull_request_author_uses_github(self) -> None:
+        use_blacksmith, reason, runners = runner_policy.select_runners(
+            "pull_request",
+            "external-contributor",
+            {"julianknutsen"},
+            force_blacksmith=False,
+        )
+
+        self.assertFalse(use_blacksmith)
+        self.assertIn("not on the Blacksmith allowlist", reason)
+        self.assertEqual(runners["runner_macos"], "macos-15")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/workflows/scripts/test_worker_report_artifacts.py b/.github/workflows/scripts/test_worker_report_artifacts.py
index f4897ed781..b67bdae630 100644
--- a/.github/workflows/scripts/test_worker_report_artifacts.py
+++ b/.github/workflows/scripts/test_worker_report_artifacts.py
@@ -1,6 +1,5 @@
 import json
 import os
-import subprocess
 import sys
 import tempfile
 import unittest
@@ -127,43 +126,6 @@ def test_summary_prints_top_evidence_and_hooks(self) -> None:
             self.assertIn("planned hooks", content)
             self.assertIn("transcript_path=/tmp/transcript.jsonl", content)
 
-    def test_manual_only_script_emits_unsupported_phase3_report(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            report_dir = Path(tmp) / "reports"
-            env = os.environ.copy()
-            env["PROFILE"] = "codex/tmux-cli"
-
-            subprocess.run(
-                [
-                    sys.executable,
-                    str(SCRIPT_DIR / "worker_report_manual_only.py"),
-                    str(report_dir),
-                    "worker-inference-phase3",
-                ],
-                check=True,
-                env=env,
-            )
-
-            reports = sorted(report_dir.glob("*.json"))
-            self.assertEqual(len(reports), 1)
-            payload = json.loads(reports[0].read_text(encoding="utf-8"))
-            self.assertEqual(payload["summary"]["status"], "unsupported")
-            self.assertEqual(payload["metadata"]["profile_filter"], "codex/tmux-cli")
-            self.assertTrue(payload["metadata"]["manual_only"])
-            self.assertEqual(payload["summary"]["unsupported"], 6)
-            self.assertEqual(
-                [result["requirement"] for result in payload["results"]],
-                [
-                    "WI-START-001",
-                    "WI-TOOL-001",
-                    "WI-MTURN-001",
-                    "WI-CONT-001",
-                    "WI-RESET-001",
-                    "WI-INT-001",
-                ],
-            )
-            self.assertTrue(all(result["status"] == "unsupported" for result in payload["results"]))
-
     def test_rollup_builds_baseline_delta_and_hooks(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             tmp_path = Path(tmp)
diff --git a/.github/workflows/scripts/worker_report_manual_only.py b/.github/workflows/scripts/worker_report_manual_only.py
deleted file mode 100644
index b45b688d7b..0000000000
--- a/.github/workflows/scripts/worker_report_manual_only.py
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env python3
-
-import json
-import os
-import sys
-
-
-SCHEMA_VERSION = "gc.worker.conformance.v1"
-
-CATALOG_BY_SUITE = {
-    "worker-inference-phase3": [
-        "WI-START-001",
-        "WI-TOOL-001",
-        "WI-MTURN-001",
-        "WI-CONT-001",
-        "WI-RESET-001",
-        "WI-INT-001",
-    ],
-}
-
-
-def main() -> int:
-    if len(sys.argv) != 3:
-        print(
-            "usage: worker_report_manual_only.py <report-dir> <suite>",
-            file=sys.stderr,
-        )
-        return 2
-
-    report_dir = sys.argv[1]
-    suite = sys.argv[2].strip()
-    requirements = CATALOG_BY_SUITE.get(suite)
-    if not requirements:
-        print(f"unsupported manual-only suite: {suite!r}", file=sys.stderr)
-        return 2
-
-    profile = os.environ.get("PROFILE", "").strip() or "all-profiles"
-    os.makedirs(report_dir, exist_ok=True)
-
-    results = [
-        {
-            "profile": profile,
-            "requirement": requirement,
-            "status": "unsupported",
-            "detail": "manual-only live inference is disabled in PR CI",
-        }
-        for requirement in requirements
-    ]
-    payload = {
-        "schema_version": SCHEMA_VERSION,
-        "run_id": f"{sanitize(suite)}-{sanitize(profile)}-manual-only",
-        "suite": suite,
-        "metadata": {
-            "profile_filter": profile,
-            "suite": suite,
-            "manual_only": True,
-            "synthetic": "true",
-        },
-        "summary": {
-            "status": "unsupported",
-            "total": len(results),
-            "passed": 0,
-            "failed": 0,
-            "unsupported": len(results),
-            "environment_errors": 0,
-            "provider_incidents": 0,
-            "flaky_live": 0,
-            "not_certifiable_live": 0,
-            "suite_failed": False,
-            "profiles": 1,
-            "requirements": len(results),
-            "failing_requirements": [],
-            "top_evidence": [],
-        },
-        "results": results,
-    }
-    out_path = os.path.join(
-        report_dir,
-        f"{sanitize(suite)}-{sanitize(profile)}-manual-only.json",
-    )
-    with open(out_path, "w", encoding="utf-8") as handle:
-        json.dump(payload, handle, indent=2)
-        handle.write("\n")
-    return 0
-
-
-def sanitize(value: str) -> str:
-    value = value.strip().lower()
-    if not value:
-        return "unknown"
-    out = []
-    last_dash = False
-    for ch in value:
-        if ch.isalnum():
-            out.append(ch)
-            last_dash = False
-        elif not last_dash:
-            out.append("-")
-            last_dash = True
-    return "".join(out).strip("-") or "unknown"
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
diff --git a/.github/workflows/triage-label.yml b/.github/workflows/triage-label.yml
index fbfcada2ec..99c8807ffb 100644
--- a/.github/workflows/triage-label.yml
+++ b/.github/workflows/triage-label.yml
@@ -2,11 +2,15 @@ name: Auto-label new issues and PRs
 
 on:
   issues:
-    types: [opened]
+    types: [opened, reopened]
   pull_request_target:
-    types: [opened]
+    types: [opened, reopened, ready_for_review]
+
+permissions: {}
 
 jobs:
+  # pull_request_target is safe here because this job never checks out or runs
+  # pull request code; it only labels the issue/PR from event metadata.
   add-triage-label:
     runs-on: ubuntu-latest
     permissions:
@@ -17,7 +21,18 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
-            const number = context.issue?.number || context.payload.pull_request?.number;
+            const pullRequest = context.payload.pull_request;
+            if (pullRequest?.draft) {
+              console.log(`Skipping draft PR #${pullRequest.number}`);
+              return;
+            }
+
+            const number = context.issue?.number || pullRequest?.number;
+            if (!number) {
+              core.setFailed('Unable to determine issue or PR number');
+              return;
+            }
+
             await github.rest.issues.addLabels({
               owner: context.repo.owner,
               repo: context.repo.repo,
diff --git a/.gitignore b/.gitignore
index 37729dab70..03f66072b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -45,3 +45,4 @@ reports/
 # Developer scratch — diff dumps and ad-hoc patches created during review
 tmp_*.diff
 tmp_*.patch
+issues.jsonl
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 96b259b454..da326bd1eb 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -15,7 +15,13 @@ builds:
       - arm64
 
 archives:
-  - formats: [tar.gz]
+  - id: gc-archive
+    formats: [tar.gz]
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
+  algorithm: sha256
 
 release:
   prerelease: auto
diff --git a/.trivyignore-config b/.trivyignore-config
new file mode 100644
index 0000000000..a6414b1e12
--- /dev/null
+++ b/.trivyignore-config
@@ -0,0 +1,4 @@
+# Gas City controller implements the Kubernetes session protocol by execing
+# into namespace-local agent pods. Keep this exception narrow: do not add
+# wildcard pod verbs or cluster-wide roles.
+KSV-0053
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
new file mode 100644
index 0000000000..eb380d3426
--- /dev/null
+++ b/.trivyignore.yaml
@@ -0,0 +1,61 @@
+vulnerabilities:
+  - id: CVE-2026-41602
+    paths:
+      - "usr/local/bin/dolt"
+    expired_at: 2026-06-07
+    statement: Latest Dolt 1.88.0 still embeds github.com/apache/thrift v0.13.1; remove after a Dolt release includes thrift 0.23.0 or later.
+  - id: CVE-2026-34986
+    paths:
+      - "usr/local/bin/bd"
+    expired_at: 2026-05-29
+    statement: Latest bd v1.0.3 still embeds go-jose v4.1.3; remove after a beads release includes go-jose v4.1.4 or later.
+  - id: CVE-2026-41602
+    paths:
+      - "usr/local/bin/bd"
+    expired_at: 2026-06-07
+    statement: Latest bd v1.0.3 still embeds github.com/apache/thrift v0.19.0; remove after a beads release includes thrift 0.23.0 or later.
+  - id: CVE-2026-27962
+    paths:
+      - "usr/local/lib/python3.12/site-packages/authlib-1.5.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 still requires authlib <1.6; remove after upstream accepts Authlib 1.6.9 or later.
+  - id: CVE-2025-59420
+    paths:
+      - "usr/local/lib/python3.12/site-packages/authlib-1.5.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 still requires authlib <1.6; remove after upstream accepts Authlib 1.6.4 or later.
+  - id: CVE-2025-61920
+    paths:
+      - "usr/local/lib/python3.12/site-packages/authlib-1.5.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 still requires authlib <1.6; remove after upstream accepts Authlib 1.6.5 or later.
+  - id: CVE-2026-28490
+    paths:
+      - "usr/local/lib/python3.12/site-packages/authlib-1.5.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 still requires authlib <1.6; remove after upstream accepts Authlib 1.6.9 or later.
+  - id: CVE-2026-28498
+    paths:
+      - "usr/local/lib/python3.12/site-packages/authlib-1.5.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 still requires authlib <1.6; remove after upstream accepts Authlib 1.6.9 or later.
+  - id: CVE-2026-32871
+    paths:
+      - "usr/local/lib/python3.12/site-packages/fastmcp-2.13.0.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 Authlib constraint keeps FastMCP on 2.13.0.2; remove after upstream accepts FastMCP 3.2.0 or later.
+  - id: CVE-2025-69196
+    paths:
+      - "usr/local/lib/python3.12/site-packages/fastmcp-2.13.0.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 Authlib constraint keeps FastMCP on 2.13.0.2; remove after upstream accepts FastMCP 2.14.2 or later.
+  - id: CVE-2026-27124
+    paths:
+      - "usr/local/lib/python3.12/site-packages/fastmcp-2.13.0.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 Authlib constraint keeps FastMCP on 2.13.0.2; remove after upstream accepts FastMCP 3.2.0 or later.
+  - id: GHSA-rcfx-77hg-w2wv
+    paths:
+      - "usr/local/lib/python3.12/site-packages/fastmcp-2.13.0.2.dist-info/METADATA"
+    expired_at: 2026-05-13
+    statement: mcp-agent-mail v0.3.2 Authlib constraint keeps FastMCP on 2.13.0.2; remove after upstream accepts FastMCP 2.14.0 or later.
diff --git a/AGENTS.md b/AGENTS.md
index dccabf9b92..acb5aa2a55 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -41,8 +41,13 @@ mechanism is provably composable from the primitives.
 
 **Five primitives (Layer 0-1):**
 
-1. **Agent Protocol** — start/stop/prompt/observe agents regardless of
-   provider. Identity, pools, sandboxes, resume, crash adoption.
+1. **Session** — start/stop/prompt/observe sessions regardless of
+   provider. Identity (via `agent.SessionNameFor`), pools, sandboxes,
+   resume, crash adoption. Lifecycle is a bead-backed projection
+   (`internal/session/lifecycle_projection.go`). Runtime providers
+   (tmux, subprocess, exec, k8s, fake) plus routing layers (acp,
+   auto, hybrid) live under `internal/runtime/` and plug in behind
+   the Session surface.
 2. **Task Store (Beads)** — CRUD + Hook + Dependencies + Labels + Query
    over work units. Everything is a bead: tasks, mail, molecules, convoys.
 3. **Event Bus** — append-only pub/sub log of all system activity. Two
@@ -55,13 +60,16 @@ mechanism is provably composable from the primitives.
 **Four derived mechanisms (Layer 2-4):**
 
 6. **Messaging** — Mail = `TaskStore.Create(bead{type:"message"})`.
-   Nudge = `AgentProtocol.SendPrompt()`. No new primitive needed.
+   Nudge = a session-layer operation implemented via
+   `runtime.Provider.Nudge()` (and exposed through
+   `worker.Handle.Nudge()` at the worker boundary). No new
+   primitive needed.
 7. **Formulas & Molecules** — Formula = TOML parsed by Config. Molecule =
    root bead + child step beads in Task Store. Wisps = ephemeral molecules.
    Orders = formulas with gate conditions on Event Bus.
 8. **Dispatch (Sling)** — composed: find/spawn agent → select formula →
    create molecule → hook to agent → nudge → create convoy → log event.
-9. **Health Patrol** — ping agents (Agent Protocol), compare thresholds
+9. **Health Patrol** — probe sessions (Session), compare thresholds
    (Config), publish stalls (Event Bus), restart with backoff.
 
 ### Layering invariants
@@ -79,14 +87,14 @@ mechanism is provably composable from the primitives.
 Capabilities activate progressively via config presence.
 
 | Level | Adds                    |
-|-------|-------------------------|
-| 0-1   | Agent + tasks           |
+| ----- | ----------------------- |
+| 0-1   | Session + tasks         |
 | 2     | Task loop               |
 | 3     | Multiple agents + pool  |
 | 4     | Messaging               |
 | 5     | Formulas & molecules    |
 | 6     | Health monitoring       |
-| 7     | Orders             |
+| 7     | Orders                  |
 | 8     | Full orchestration      |
 
 ## Architecture docs
@@ -108,10 +116,11 @@ Load-bearing invariants enforced by CI (violating any fails the
 build; full rationale is in the architecture docs):
 
 - **Object model at the center.** `internal/{beads, mail, convoy,
-  formula, agent, events, session, sling, ...}` is the canonical
+  formula, events, session, worker, sling, ...}` is the canonical
   domain. The CLI (`cmd/gc/`) and the HTTP+SSE API
   (`internal/api/`) are projections over it. Neither re-implements
-  domain logic.
+  domain logic. `internal/agent/` is a small helper package
+  (session-name utilities, startup hints) — not a primitive.
 - **Typed wire.** No hand-written JSON on any HTTP or SSE wire
   path; no `map[string]any` or `json.RawMessage` on wire types
   (documented exceptions live in the API control-plane doc). All
@@ -124,6 +133,36 @@ build; full rationale is in the architecture docs):
   capture the semantics. Enforced by
   `TestEveryKnownEventTypeHasRegisteredPayload`.
 
+## Active migrations
+
+These migrations are in flight. New code on affected paths must take
+the canonical route, not the legacy route.
+
+- **Worker boundary (started `12a0a848` on Apr 17 2026, in progress).**
+  `internal/worker/handle.go` is the canonical boundary for session
+  creation and lifecycle operations. Production `cmd/gc/*.go` files
+  must route through `worker.Handle` — enforced by
+  `TestGCNonTestFilesStayOnWorkerBoundary` in
+  `cmd/gc/worker_boundary_import_test.go`, which forbids non-test
+  files from importing `session.NewManager(`, `worker.SessionHandle`,
+  `sessionlog`, and similar bypass paths in `cmd/gc`. The remaining
+  manager-construction/direct-create bypasses are split by category:
+  `internal/api/session_manager.go` constructs `session.Manager` values
+  for API handlers, and `internal/api/session_resolution.go` still calls
+  `mgr.CreateAliasedNamedWithTransportAndMetadata(...)` directly. This
+  list is not a sessionlog read-site inventory; stream and transcript
+  readers in `internal/api/` and `internal/session/` still read
+  session logs directly. Package-internal helpers in `internal/session/`
+  may construct and use `session.Manager`; tests may construct it
+  directly. Do not add new non-test direct `session.Manager.Create*` call
+  sites outside the worker boundary.
+- **Session-first (completed `dd90ac0a` on Mar 8 2026).** The former
+  Agent Protocol primitive was removed; responsibilities moved to
+  `internal/session/` (lifecycle) and `internal/runtime/` (providers).
+  `internal/agent/` is now a helper package with session-name utilities
+  and startup hints — not a primitive. Do not reconstruct the
+  `Agent` / `Handle` interfaces.
+
 ## Design decisions (settled)
 
 These decisions are final. Do not revisit them.
@@ -155,7 +194,7 @@ These decisions are final. Do not revisit them.
 - **Zero Framework Cognition (ZFC)** — Go handles transport, not reasoning.
   If a line of Go contains a judgment call, it's a violation. **The ZFC
   test:** does any line of Go contain a judgment call? An `if stuck then
-  restart` is framework intelligence. Move the decision to the prompt.
+restart` is framework intelligence. Move the decision to the prompt.
 - **Bitter Lesson** — every primitive must become MORE useful as models
   improve, not less. Don't build heuristics or decision trees.
 - **GUPP** — "If you find work on your hook, YOU RUN IT." No confirmation,
@@ -211,13 +250,20 @@ Lesson test — it becomes LESS useful as models improve.
   definitions; the apply functions and pool deep-copy must be checked
   manually.
 
-- `TESTING.md` — testing philosophy and tier boundaries. Read before writing any test.
+- `TESTING.md` — testing philosophy, tier boundaries, and sharded local
+  runners. Read before writing any test. For broad local sweeps, prefer the
+  documented shard targets (`make test-fast-parallel`,
+  `make test-cmd-gc-process-parallel`, `make test-integration-shards-parallel`,
+  `make test-local-full-parallel`) over raw `go test`.
 
 ## Code quality gates
 
 Before considering any task complete:
 
-- `go test ./...` passes
+- Fast unit baseline passes (`make test`, or `make test-fast-parallel` on
+  machines where sharding is useful)
+- Broader process/integration coverage uses the sharded targets documented in
+  `TESTING.md` instead of one monolithic `go test ./...` sweep
 - `go vet ./...` clean
 - `.githooks/pre-commit` is active locally (`git config core.hooksPath`
   prints `.githooks`) and has run for the staged change
@@ -231,62 +277,6 @@ Before considering any task complete:
 - No premature abstractions
 - Tests cover happy path AND edge cases
 
-## Architecture Best Practices
-
-These apply to all code in this project — frontend and server:
-
-- **TDD (Test-Driven Development)** - write the tests first; the implementation
-  code isn't done until the tests pass.
-- **Consider First Principles** to assess your current architecture against the
-  one you'd use if you started over from scratch.
-- **Leverage Types** using statically typed languages (TypeScript, Rust, etc) so
-  that we can leverage the power of the compiler as guardrails and immediate
-  feedback on our code at build-time instead of waiting until run-time.
-- **DRY (Don't Repeat Yourself)** – eliminate duplicated logic by extracting
-  shared utilities and modules.
-- **Separation of Concerns** – each module should handle one distinct
-  responsibility.
-- **Single Responsibility Principle (SRP)** – every class/module/function/file
-  should have exactly one reason to change.
-- **Clear Abstractions & Contracts** – expose intent through small, stable
-  interfaces and hide implementation details.
-- **Low Coupling, High Cohesion** – keep modules self-contained, minimize
-  cross-dependencies.
-- **Scalability & Statelessness** – design components to scale horizontally and
-  prefer stateless services when possible.
-- **Observability & Testability** – build in logging, metrics, tracing, and
-  ensure components can be unit/integration tested.
-- **KISS (Keep It Simple, Sir)** - keep solutions as simple as possible.
-- **YAGNI (You're Not Gonna Need It)** – avoid speculative complexity or
-  over-engineering.
-- **Don't Swallow Errors** by catching exceptions, silently filling in required
-  but missing values, masking deserialization with nulls or empty lists, or
-  ignoring timeouts when something hangs. All of those are errors (client-side
-  and server-side) and must be tracked in a centralized log so it can be used to
-  improve the app over time. Also, inform the user as appropriate so that they
-  can take necessary action.
-- **No Placeholder Code** - we're building production code here, not toys.
-- **No Comments for Removed Functionality** - the source is not the place to
-  keep history of what's changed; it's the place to implement the current
-  requirements only.
-- **Layered Architecture** - organize code into clear tiers where each layer
-  depends only on the one(s) below it, keeping logic cleanly separated.
-- **Use Non-Nullable Variables** when possible; use nullability only when
-  there is NO other possiblity.
-- **Use Async Notifications** when possible over inefficient polling.
-- **Eliminate Race Conditions** that might cause dropped or corrupted data
-- **Write for Maintainability** so that the code is clear and readable and easy
-  to maintain by future developers.
-- **Arrange Project Idiomatically** for the language and framework being used,
-  including recommended lints, static analysis tools, folder structure and
-  gitignore entries.
-- **Keep Serialization/Deserialization At The Edges** to make full use of
-  type-safe objects in the app itself and to centralize error handling for
-  type-system translation. Do NOT allow untyped data with known shapes to flow
-  through the system and subvert the type system.
-- **Prefer Well-Known, High Quality OSS Libraries** instead of hand-rolling your
-  own behavior to get more robust, better maintained and better tested results.
-
 ## Non-Interactive Shell Commands
 
 **ALWAYS use non-interactive flags** with file operations to avoid hanging on confirmation prompts.
@@ -362,3 +352,63 @@ bd close <id>         # Complete work
 - NEVER say "ready to push when you are" - YOU must push
 - If push fails, resolve and retry until it succeeds
 <!-- END BEADS INTEGRATION -->
+
+## Architecture Best Practices
+
+These apply to all code in this project — frontend and server:
+
+- **TDD (Test-Driven Development)** - write the tests first; the implementation
+  code isn't done until the tests pass.
+- **Consider First Principles** to assess your current architecture against the
+  one you'd use if you started over from scratch.
+- **Leverage Types** using statically typed languages (TypeScript, Rust, etc) so
+  that we can leverage the power of the compiler as guardrails and immediate
+  feedback on our code at build-time instead of waiting until run-time.
+- **DRY (Don't Repeat Yourself)** – eliminate duplicated logic by extracting
+  shared utilities and modules.
+- **Separation of Concerns** – each module should handle one distinct
+  responsibility.
+- **Single Responsibility Principle (SRP)** – every class/module/function/file
+  should have exactly one reason to change.
+- **Clear Abstractions & Contracts** – expose intent through small, stable
+  interfaces and hide implementation details.
+- **Low Coupling, High Cohesion** – keep modules self-contained, minimize
+  cross-dependencies.
+- **Scalability & Statelessness** – design components to scale horizontally and
+  prefer stateless services when possible.
+- **Observability & Testability** – build in logging, metrics, tracing, and
+  ensure components can be unit/integration tested.
+- **KISS (Keep It Simple, Sir)** - keep solutions as simple as possible.
+- **YAGNI (You're Not Gonna Need It)** – avoid speculative complexity or
+  over-engineering.
+- **Don't Swallow Errors** by catching exceptions, silently filling in required
+  but missing values, masking deserialization with nulls or empty lists, or
+  ignoring timeouts when something hangs. All of those are errors (client-side
+  and server-side) and must be tracked in a centralized log so it can be used to
+  improve the app over time. Also, inform the user as appropriate so that they
+  can take necessary action.
+- **No Placeholder Code** - we're building production code here, not toys.
+- **No Comments for Removed Functionality** - the source is not the place to
+  keep history of what's changed; it's the place to implement the current
+  requirements only.
+- **Layered Architecture** - organize code into clear tiers where each layer
+  depends only on the one(s) below it, keeping logic cleanly separated.
+- **Use Non-Nullable Variables** when possible; use nullability only when
+  there is NO other possiblity.
+- **Use Async Notifications** when possible over inefficient polling.
+- **Eliminate Race Conditions** that might cause dropped or corrupted data
+- **Write for Maintainability** so that the code is clear and readable and easy
+  to maintain by future developers.
+- **Arrange Project Idiomatically** for the language and framework being used,
+  including recommended lints, static analysis tools, folder structure and
+  gitignore entries.
+- **Keep Serialization/Deserialization At The Edges** to make full use of
+  type-safe objects in the app itself and to centralize error handling for
+  type-system translation. Do NOT allow untyped data with known shapes to flow
+  through the system and subvert the type system.
+- **Prefer Well-Known, High Quality OSS Libraries** instead of hand-rolling your
+  own behavior to get more robust, better maintained and better tested results.
+- **Treat Static Warnings And Info As Errors To Be Fixed**. The whole point of
+  static checking (linting, compilers, etc) is that they surface issues at
+  build-time so that they can be fixed now instead of lead to errors at runtime.
+  Take advantage of that feedback to fix those errors!
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8cd259bd43..f5301f507c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,12 +7,89 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- The built-in `control-dispatcher` trace now defaults to
+  `${GC_CITY_RUNTIME_DIR}/control-dispatcher-trace.log` (falling back to
+  `${GC_CITY}/.gc/runtime/control-dispatcher-trace.log`) instead of writing at
+  city root. This keeps workflow-trace appends inside the controller's
+  watcher-excluded runtime subtree, avoiding continuous `config-changed`
+  reconciliations. After upgrading, operators tailing the default trace should
+  switch to `.gc/runtime/control-dispatcher-trace.log`; the old
+  `${GC_CITY}/control-dispatcher-trace.log` file becomes stale and can be
+  removed. After upgrading, restart or recycle existing `control-dispatcher`
+  sessions so they pick up the new trace path; otherwise they keep their
+  previous trace target and can continue retriggering reconciles. Validation
+  currently covers watcher exclusion, dispatcher warning routing, and the
+  graph-workflow integration shard; there is not yet a dedicated patrol-cadence
+  stress test.
+- `proxy_process` services now receive a `GC_SERVICE_URL_PREFIX` that the
+  supervisor's public listener actually routes. Previously the prefix was
+  the per-city-relative `/svc/<name>`, so any service that composed
+  `CallbackURL = $GC_API_BASE_URL + $GC_SERVICE_URL_PREFIX` (the documented
+  shape for adapter self-registration) would 404 on inbound calls. The
+  prefix is now the full `/v0/city/<cityName>/svc/<svcName>` path. The
+  per-city router contract (`config.Service.MountPathOrDefault`) is
+  unchanged.
+- `gc session reset` now documents its named-session circuit-breaker behavior:
+  when the target is a named session, reset clears a tripped respawn breaker
+  before requesting a fresh restart.
+
 ### Changed
 
+- `[[orders.overrides]]` rig matching is stricter and clearer. A rigless
+  override (`rig` unset) still matches **only** city-level orders; if the
+  named order exists only as per-rig instances, the error now names every
+  matching rig so it's obvious what to type. `rig = "*"` is a new wildcard
+  that targets every instance of the named order (city-level + per-rig).
+  The literal `"*"` is reserved and rejected as a real rig name by config
+  validation.
 - Managed Dolt config now emits listener backlog and connection-timeout keys.
   Existing managed cities may see a `dolt-config` doctor warning until
   `gc dolt restart` or the next managed server start regenerates
   `dolt-config.yaml`.
+- In bead-backed pool reconciliation, `scale_check` output is now documented
+  and enforced as additive new-session demand. Assigned work is resumed
+  separately; custom checks that previously returned total desired sessions
+  should return only new unassigned demand.
+- Session bead reconciliation now stops suspended and orphaned runtimes before
+  closing their beads; resuming one of those sessions starts a fresh lifecycle
+  instead of continuing the previous runtime process.
+- `gc hook --inject` is now silent legacy compatibility for already-installed
+  Stop/session-end hooks. Fresh managed hook configs no longer install it;
+  routed work pickup should happen through the SessionStart claim protocol or
+  an explicit non-inject `gc hook` call.
+- The built-in Claude provider's `model = "opus"` option now emits
+  `claude-opus-4-7`. Cities that rely on the `opus` alias should expect the
+  new model target after upgrading.
+
+### Fixed
+
+- Linux systemd supervisor service restarts now preserve managed tmux sessions
+  for re-adoption. Linux users should rerun `gc supervisor install` after
+  upgrading so the user unit is regenerated with `KillMode=process` and the
+  preserve-on-signal environment. If the currently active Linux supervisor
+  predates the preserve-on-signal environment, `gc supervisor install` now
+  refuses the warm refresh before sending a signal and tells operators to stop
+  or drain agents intentionally with `gc supervisor stop --wait`, then rerun the
+  install. Once the active supervisor already supports preserve mode, Linux warm
+  refresh sends the main supervisor PID `SIGTERM` first so preserve-mode
+  shutdown can close workspace services and flush traces, with a bounded
+  `SIGKILL` fallback if the process does not exit. The Linux refresh also stops
+  orphan-prone workspace service process groups owned by registered cities
+  before starting the replacement supervisor; supervisor startup repeats the
+  same owned-service cleanup after crashes. Service-managed `SIGTERM` preserves
+  sessions for re-adoption, while `SIGINT` remains a destructive escalation
+  path. Preserve mode intentionally leaves the beads provider running so
+  preserved sessions can keep using the store; the bundled managed-Dolt start
+  path is idempotent when it finds an already-running server, but custom exec
+  providers must make `start` reattach or no-op safely after preserve-mode
+  restarts. macOS launchd upgrades still use launchd unload/load rather than the
+  Linux main-PID refresh path; macOS supervisor startup now warns that automatic
+  orphaned workspace-service cleanup is Linux-only, lists the registered
+  `GC_SERVICE_STATE_ROOT` roots to inspect, and tells operators to stop stale
+  workspace-service processes before restarting affected cities after
+  non-graceful exits.
 
 ## [1.0.0] - 2026-04-21
 
diff --git a/Makefile b/Makefile
index 60cdcf50c5..aede12aa1c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,5 @@
 GOLANGCI_LINT_VERSION := 2.9.0
+BUILDX_VERSION := 0.21.2
 
 # Detect OS and arch for binary download.
 GOOS   := $(shell go env GOOS)
@@ -20,7 +21,7 @@ LDFLAGS := -X main.version=$(VERSION) \
            -X main.commit=$(COMMIT) \
            -X main.date=$(BUILD_TIME)
 
-.PHONY: build check check-all check-bd check-docker check-docs check-dolt check-version-tag lint fmt-check fmt vet test test-fsys-darwin-compile test-cmd-gc-process test-worker-core test-worker-core-phase2 test-worker-core-phase2-real-transport test-worker-inference-phase3 test-acceptance test-acceptance-b test-acceptance-c test-acceptance-all test-tutorial-goldens test-tutorial-regression test-tutorial test-integration test-integration-shards test-integration-shards-cover test-integration-packages test-integration-packages-cover test-integration-review-formulas test-integration-review-formulas-cover test-integration-review-formulas-basic test-integration-review-formulas-basic-cover test-integration-review-formulas-retries test-integration-review-formulas-retries-cover test-integration-review-formulas-recovery test-integration-review-formulas-recovery-cover test-integration-bdstore test-integration-bdstore-cover test-integration-rest test-integration-rest-cover test-integration-rest-smoke test-integration-rest-smoke-cover test-integration-rest-full test-integration-rest-full-cover test-mcp-mail test-docker test-k8s test-cover cover install install-tools install-buildx setup clean generate check-schema docker-base docker-agent docker-controller docs-dev dashboard-smoke
+.PHONY: build check check-all check-bd check-docker check-docs check-dolt check-version-tag lint fmt-check fmt vet test test-fast-parallel test-fsys-darwin-compile test-cmd-gc-process test-cmd-gc-process-shard test-cmd-gc-process-parallel test-worker-core test-worker-core-phase2 test-worker-core-phase2-real-transport setup-worker-inference test-worker-inference test-worker-inference-phase3 test-acceptance test-acceptance-b test-acceptance-c test-acceptance-all test-tutorial-goldens test-tutorial-regression test-tutorial test-integration test-integration-shards test-integration-shards-parallel test-integration-shards-cover test-integration-packages test-integration-packages-cover test-integration-review-formulas test-integration-review-formulas-cover test-integration-review-formulas-basic test-integration-review-formulas-basic-cover test-integration-review-formulas-retries test-integration-review-formulas-retries-cover test-integration-review-formulas-recovery test-integration-review-formulas-recovery-cover test-integration-bdstore test-integration-bdstore-cover test-integration-rest test-integration-rest-cover test-integration-rest-smoke test-integration-rest-smoke-cover test-integration-rest-full test-integration-rest-full-cover test-local-full-parallel test-mcp-mail test-docker test-k8s test-cover cover install install-tools install-buildx setup clean generate check-schema docker-base docker-agent docker-controller docs-dev dashboard-smoke
 
 ## build: compile gc binary with version metadata
 build:
@@ -159,14 +160,34 @@ TEST_ENV = env -i \
 	GOINSECURE="$${GOINSECURE-}" \
 	GOVCS="$${GOVCS-}" \
 	GOWORK="$${GOWORK-}" \
+	ANTHROPIC_BASE_URL="$${ANTHROPIC_BASE_URL-}" \
+	ANTHROPIC_API_KEY="$${ANTHROPIC_API_KEY-}" \
+	ANTHROPIC_AUTH_TOKEN="$${ANTHROPIC_AUTH_TOKEN-}" \
+	ANTHROPIC_DEFAULT_HAIKU_MODEL="$${ANTHROPIC_DEFAULT_HAIKU_MODEL-}" \
+	ANTHROPIC_DEFAULT_SONNET_MODEL="$${ANTHROPIC_DEFAULT_SONNET_MODEL-}" \
+	ANTHROPIC_DEFAULT_OPUS_MODEL="$${ANTHROPIC_DEFAULT_OPUS_MODEL-}" \
+	CLAUDE_CODE_SUBAGENT_MODEL="$${CLAUDE_CODE_SUBAGENT_MODEL-}" \
+	CLAUDE_CODE_EFFORT_LEVEL="$${CLAUDE_CODE_EFFORT_LEVEL-}" \
+	CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="$${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC-}" \
+	OLLAMA_API_KEY="$${OLLAMA_API_KEY-}" \
 	$(EXTRA_TEST_ENV)
 
 ## test: run fast unit tests (skip integration-tagged and GC_FAST_UNIT-gated process tests)
 ## The skipped cmd/gc process-backed scenarios remain covered by
 ## `make test-cmd-gc-process` locally and the CI `cmd/gc process suite` job.
+## Bound package parallelism so subprocess-heavy packages do not starve each
+## other into false 5s probe/condition timeouts. Use -count=1 so pre-commit
+## reports actual test results instead of hanging after PASS while Go computes
+## cache input hashes over local working files.
 ## Wrapped in $(TEST_ENV) — see comment above for why.
 test: test-fsys-darwin-compile
-	$(TEST_ENV) GC_FAST_UNIT=1 go test ./...
+	$(TEST_ENV) GC_FAST_UNIT=1 scripts/go-test-observable test -- -p=4 -count=1 ./...
+
+LOCAL_TEST_JOBS ?= $(shell nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 8)
+
+## test-fast-parallel: run the default fast suite with cmd/gc sharded locally
+test-fast-parallel:
+	LOCAL_TEST_JOBS=$(LOCAL_TEST_JOBS) CMD_GC_PROCESS_TOTAL=$(CMD_GC_PROCESS_TOTAL) ./scripts/test-local-parallel fast
 
 ## test-fsys-darwin-compile: cross-compile internal/fsys for macOS so
 ## unix.Stat_t field-type regressions fail in the default fast test path.
@@ -178,7 +199,16 @@ test-fsys-darwin-compile:
 ## test-cmd-gc-process: run the full non-short cmd/gc suite, including the
 ## process-backed lifecycle coverage routed out of the default fast loop
 test-cmd-gc-process:
-	$(TEST_ENV) GC_FAST_UNIT=0 go test -count=1 -timeout 20m ./cmd/gc
+	$(TEST_ENV) GC_FAST_UNIT=0 scripts/go-test-observable test-cmd-gc-process -- -timeout 25m ./cmd/gc
+
+CMD_GC_PROCESS_SHARD ?= 1
+CMD_GC_PROCESS_TOTAL ?= 6
+test-cmd-gc-process-shard:
+	$(TEST_ENV) GC_FAST_UNIT=0 GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc $(CMD_GC_PROCESS_SHARD) $(CMD_GC_PROCESS_TOTAL)
+
+## test-cmd-gc-process-parallel: run all cmd/gc process shards concurrently
+test-cmd-gc-process-parallel:
+	LOCAL_TEST_JOBS=$(LOCAL_TEST_JOBS) CMD_GC_PROCESS_TOTAL=$(CMD_GC_PROCESS_TOTAL) ./scripts/test-local-parallel cmd-gc-process
 
 ## test-worker-core: run deterministic worker transcript and continuation conformance
 test-worker-core:
@@ -194,9 +224,18 @@ test-worker-core-phase2:
 test-worker-core-phase2-real-transport:
 	$(TEST_ENV) PROFILE="$${PROFILE-}" GC_WORKER_REPORT_DIR="$${GC_WORKER_REPORT_DIR-}" go test -count=1 -tags integration ./cmd/gc -run '^TestPhase2WorkerCoreRealTransportProof$$'
 
-## test-worker-inference-phase3: run the live worker inference conformance package
-test-worker-inference-phase3:
-	$(TEST_ENV) PROFILE="$${PROFILE-}" GC_WORKER_REPORT_DIR="$${GC_WORKER_REPORT_DIR-}" go test -count=1 -tags acceptance_c -timeout 45m -v ./test/acceptance/worker_inference
+WORKER_INFERENCE_PROFILE := $(if $(PROFILE),$(PROFILE),claude/tmux-cli)
+
+## setup-worker-inference: install the provider CLI for PROFILE (default claude/tmux-cli)
+setup-worker-inference:
+	python3 scripts/worker_inference_setup.py install --profile "$(WORKER_INFERENCE_PROFILE)"
+
+## test-worker-inference: run the live worker inference conformance package
+test-worker-inference:
+	$(TEST_ENV) PROFILE="$(WORKER_INFERENCE_PROFILE)" GC_WORKER_REPORT_DIR="$(GC_WORKER_REPORT_DIR)" go test -count=1 -tags acceptance_c -timeout 45m -v ./test/acceptance/worker_inference
+
+## test-worker-inference-phase3: alias for the live worker inference conformance package
+test-worker-inference-phase3: test-worker-inference
 
 ## test-acceptance: run acceptance tests (Tier A — fast, <5 min, every PR).
 ## ACCEPTANCE_TIMEOUT overrides the go-test timeout (defaults to 5m on
@@ -228,11 +267,19 @@ test-integration-huma:
 ## test-integration-shards: run the CI integration shards sequentially
 test-integration-shards: test-integration-packages test-integration-review-formulas test-integration-bdstore test-integration-rest-smoke test-integration-rest-full
 
+## test-integration-shards-parallel: run the CI integration shards concurrently
+test-integration-shards-parallel:
+	LOCAL_TEST_JOBS=$(LOCAL_TEST_JOBS) ./scripts/test-local-parallel integration
+
+## test-local-full-parallel: run fast unit, cmd/gc process, and integration shards concurrently
+test-local-full-parallel:
+	LOCAL_TEST_JOBS=$(LOCAL_TEST_JOBS) CMD_GC_PROCESS_TOTAL=$(CMD_GC_PROCESS_TOTAL) ./scripts/test-local-parallel full
+
 ## test-integration-shards-cover: run the CI integration coverage shards sequentially
 test-integration-shards-cover: test-integration-packages-cover test-integration-review-formulas-cover test-integration-bdstore-cover test-integration-rest-smoke-cover test-integration-rest-full-cover
 
 ## test-integration-packages: run all integration-tagged packages except ./test/integration
-## This shard is also the required non-short CI path for the slow cmd/gc process suite.
+## cmd/gc package shards default to GC_FAST_UNIT=1; use test-cmd-gc-process for the slow process suite.
 test-integration-packages:
 	./scripts/test-integration-shard packages
 
@@ -368,8 +415,7 @@ install-tools: $(GOLANGCI_LINT) install-oapi-codegen
 
 $(GOLANGCI_LINT):
 	@echo "Installing golangci-lint v$(GOLANGCI_LINT_VERSION)..."
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | \
-		sh -s -- -b $(BIN_DIR) v$(GOLANGCI_LINT_VERSION)
+	GOBIN=$(BIN_DIR) go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v$(GOLANGCI_LINT_VERSION)
 
 ## install-oapi-codegen: install pinned oapi-codegen so the spec→client drift
 ## test (TestGeneratedClientInSync) can regenerate client_gen.go without skipping.
@@ -383,10 +429,23 @@ install-oapi-codegen:
 ## install-buildx: install docker buildx plugin
 install-buildx:
 	@mkdir -p $(HOME)/.docker/cli-plugins
-	curl -sSfL "https://github.com/docker/buildx/releases/download/v0.21.2/buildx-v0.21.2.$$(go env GOOS)-$$(go env GOARCH)" \
-		-o $(HOME)/.docker/cli-plugins/docker-buildx
-	chmod +x $(HOME)/.docker/cli-plugins/docker-buildx
-	@echo "Installed docker-buildx v0.21.2"
+	@case "$(GOOS)-$(GOARCH)" in \
+		linux-amd64|linux-arm64) ;; \
+		*) echo "Unsupported docker-buildx platform: $(GOOS)-$(GOARCH)" >&2; exit 1 ;; \
+	esac; \
+	tmp="$$(mktemp)"; \
+	checksums="$$(mktemp)"; \
+	trap 'rm -f "$$tmp" "$$checksums"' EXIT; \
+	curl -sSfL "https://github.com/docker/buildx/releases/download/v$(BUILDX_VERSION)/checksums.txt" \
+		-o "$$checksums"; \
+	asset="buildx-v$(BUILDX_VERSION).$(GOOS)-$(GOARCH)"; \
+	expected_sha="$$(awk -v asset="*$$asset" '$$2 == asset {print $$1}' "$$checksums")"; \
+	if [ -z "$$expected_sha" ]; then echo "Missing checksum for $$asset" >&2; exit 1; fi; \
+	curl -sSfL "https://github.com/docker/buildx/releases/download/v$(BUILDX_VERSION)/buildx-v$(BUILDX_VERSION).$(GOOS)-$(GOARCH)" \
+		-o "$$tmp"; \
+	echo "$$expected_sha  $$tmp" | sha256sum -c -; \
+	install -m 0755 "$$tmp" $(HOME)/.docker/cli-plugins/docker-buildx
+	@echo "Installed docker-buildx v$(BUILDX_VERSION)"
 
 ## test-mcp-mail: run mcp_agent_mail live conformance test (auto-starts server)
 test-mcp-mail:
@@ -411,7 +470,7 @@ docs-dev:
 
 ## dashboard-build: regenerate SPA types + compile the dist bundle
 dashboard-build:
-	cd cmd/gc/dashboard/web && npm install --silent && npm run gen && npm run build
+	cd cmd/gc/dashboard/web && npm ci --silent && npm run gen && npm run build
 
 ## dashboard-dev: Vite dev server (HMR) for SPA iteration
 dashboard-dev:
diff --git a/README.md b/README.md
index d1ad080b17..3fae5af04d 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ Gas City requires the following tools on your system. `gc init` and
 | jq | Always | — | `brew install jq` | `apt install jq` |
 | pgrep | Always | — | (included in macOS) | `apt install procps` |
 | lsof | Always | — | (included in macOS) | `apt install lsof` |
-| dolt | Beads provider `bd` | 1.86.1 | `brew install dolt` | [releases](https://github.com/dolthub/dolt/releases) |
+| dolt | Beads provider `bd` | 1.86.2 or newer | `brew install dolt` | [releases](https://github.com/dolthub/dolt/releases) |
 | bd | Beads provider `bd` | 1.0.0 | [releases](https://github.com/gastownhall/beads/releases) | [releases](https://github.com/gastownhall/beads/releases) |
 | flock | Beads provider `bd` | — | `brew install flock` | `apt install util-linux` |
 | claude / codex / gemini | Per provider | — | See provider docs | See provider docs |
@@ -45,6 +45,11 @@ The `bd` (beads) provider is the default. To use a file-based store instead
 (no dolt/bd/flock needed), set `GC_BEADS=file` or add `[beads] provider = "file"`
 to your `city.toml`.
 
+Managed Dolt checks require a final Dolt 1.86.2 or newer. Earlier and
+pre-release builds can miss the upstream GC/writer deadlock fix in
+dolthub/dolt commit `ccf7bde206`, which can hang `dolt_backup sync` under
+heavy write load.
+
 Install from Homebrew:
 
 ```bash
diff --git a/RELEASING.md b/RELEASING.md
index b70ae40a89..19e60dff14 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -46,7 +46,8 @@ Version numbers live **only** in the git tag — there is no `Version` constant
 1. **Reject `replace` directives in `go.mod`** — they break `go install ...@latest` and bottle builds in homebrew-core.
 2. **`make check-version-tag`** — asserts the tag is a clean `vMAJOR.MINOR.PATCH` with no pre-release suffix. RC/beta tags will fail the release. Pre-release tags should be cut on a dedicated branch or not trigger this workflow.
 3. **GoReleaser** — builds binaries for linux/darwin × amd64/arm64 and creates the GitHub Release with grouped changelog (`feat:` → Features, `fix:` → Bug Fixes, others → Others).
-4. **Homebrew tap update** — downloads the published checksums and writes an asset-based formula to `gastownhall/homebrew-gascity`.
+4. **Release attestations** — downloads the published checksum manifest, uploads an SPDX SBOM asset, and creates GitHub artifact attestations for the release archives.
+5. **Homebrew tap update** — downloads the published checksums and writes an asset-based formula to `gastownhall/homebrew-gascity`.
 
 Forks skip publish/announce steps automatically via the `--skip=publish --skip=announce` flag (the workflow checks `github.repository != 'gastownhall/gascity'`).
 
@@ -55,11 +56,12 @@ Forks skip publish/announce steps automatically via the `--skip=publish --skip=a
 ```bash
 make check-version-tag    # no-op unless HEAD is a release tag
 grep '^replace' go.mod    # should print nothing
+goreleaser check          # also enforced by CI
 ```
 
 ## Homebrew tap (`gastownhall/gascity`)
 
-The release workflow automatically overwrites `Formula/gascity.rb` in the `gastownhall/homebrew-gascity` repo on every tag push. It prefers the GitHub App credentials `HOMEBREW_TAP_APP_ID` and `HOMEBREW_TAP_APP_PRIVATE_KEY`, and falls back to the legacy `HOMEBREW_TAP_TOKEN` while the app rollout is in progress.
+The release workflow automatically overwrites `Formula/gascity.rb` in the `gastownhall/homebrew-gascity` repo on every tag push. Publishing is GitHub App only: `HOMEBREW_TAP_APP_ID` and `HOMEBREW_TAP_APP_PRIVATE_KEY` must be configured in repository secrets for an app installed on `gastownhall/homebrew-gascity` with contents write.
 
 The tap formula installs prebuilt release assets, so users do not need Go or a source build:
 
@@ -93,6 +95,7 @@ Manual `brew bump-formula-pr` is refused for autobump formulae. If the bot stall
 | `CHANGELOG.md` | `[Unreleased]` → `[X.Y.Z] - DATE` | `scripts/bump-version.sh` |
 | Git tag `vX.Y.Z` | Created and pushed | `scripts/bump-version.sh` |
 | GitHub Release page | Created with binaries + grouped changelog | GoReleaser in `release.yml` |
+| Release SBOM + attestations | SPDX SBOM uploaded and release archives attested | `attest-release` in `release.yml` |
 | `gastownhall/homebrew-gascity/Formula/gascity.rb` | asset URLs + `sha256` updated | `update-homebrew-formula` in `release.yml` |
 
 ## Troubleshooting
@@ -111,7 +114,7 @@ Check `.github/workflows/release.yml` still matches `tags: v*`. Verify the tag w
 
 ### Tap formula not updated
 
-Check the Homebrew tap credential in repo secrets. Preferred: `HOMEBREW_TAP_APP_ID` and `HOMEBREW_TAP_APP_PRIVATE_KEY` for a GitHub App installed on `gastownhall/homebrew-gascity` with contents write. Legacy fallback: `HOMEBREW_TAP_TOKEN` with contents write on the tap. The workflow logs will show the exact error.
+Check the Homebrew tap GitHub App credentials in repo secrets: `HOMEBREW_TAP_APP_ID` and `HOMEBREW_TAP_APP_PRIVATE_KEY`. The app must be installed on `gastownhall/homebrew-gascity` with contents write. The workflow intentionally fails instead of falling back to a long-lived token.
 
 ### Homebrew shows old version after a release
 
diff --git a/SECURITY.md b/SECURITY.md
index e9e1db0c36..919ee2b3ff 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,37 +2,60 @@
 
 ## Reporting a Vulnerability
 
-If you discover a security vulnerability in Gas City, please report it responsibly:
+Please report suspected vulnerabilities through GitHub private vulnerability
+reporting:
 
-1. **Do not** open a public issue for security vulnerabilities
-2. Email the maintainers directly with details
-3. Include steps to reproduce the vulnerability
-4. Allow reasonable time for a fix before public disclosure
+https://github.com/gastownhall/gascity/security/advisories/new
 
-## Scope
+Do not open a public issue, public discussion, or public pull request for a
+security vulnerability before the maintainers have had time to investigate and
+release a fix.
+
+Include as much of the following as you can:
 
-Gas City is experimental software focused on multi-agent coordination. Security considerations include:
+- Affected version, commit, or release asset.
+- Reproduction steps or proof-of-concept details.
+- Expected and observed impact.
+- Relevant logs, terminal output, or screenshots with secrets removed.
+- Whether the issue is already being exploited or publicly discussed.
 
-- **Agent isolation**: Agents run in separate tmux sessions but share filesystem access
-- **Git operations**: Agents can push to configured remotes
-- **Shell execution**: Agents execute shell commands as the running user
-- **Beads data**: Work tracking data is stored in `.gc/` directories
+Maintainers will acknowledge a valid private report within three business days
+when possible, triage severity, and coordinate disclosure through the GitHub
+security advisory. If a fix is needed, it will be released before public
+disclosure unless there is an active exploitation risk that requires faster
+notice.
 
-## Best Practices
+## Supported Versions
 
-When using Gas City:
+Security fixes target the current stable major release unless a separate support
+window is announced in release notes.
 
-- Run in isolated environments for untrusted code
-- Review agent output before pushing to production branches
-- Use appropriate git remote permissions
-- Monitor agent activity via `gc session attach` and logs
+| Version | Supported |
+| ------- | --------- |
+| 1.x     | Yes       |
+| < 1.0   | No        |
 
-## Supported Versions
+## Scope
+
+Gas City coordinates local and remote agent workflows. Security reports are in
+scope when they affect confidentiality, integrity, or availability in normal
+supported use, including:
+
+- Agent isolation, workspace boundaries, and command execution.
+- Git operations, release workflows, and repository publishing paths.
+- Secrets handling, logs, generated artifacts, and configuration files.
+- Beads data in `.gc/` directories when used through Gas City.
+
+Expected behavior in trusted local development environments, documented
+administrative actions, and vulnerabilities in third-party tools should be
+reported to the relevant upstream project unless Gas City creates a new or
+materially worse exposure.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.1.x   | :white_check_mark: |
+## Release Integrity
 
-## Updates
+Release archives are published through GitHub Releases with SHA-256 checksums,
+SBOM assets, and GitHub artifact attestations generated by GitHub Actions.
+Homebrew formulas install release archives by checksum.
 
-Security updates will be released as patch versions when applicable.
+Direct-download users should verify checksums and attestations before installing
+or upgrading. See the installation guide for the current commands.
diff --git a/TESTING.md b/TESTING.md
index bab2f2f5f9..ac76242594 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -37,13 +37,71 @@ scripts, and the large `gc-beads-bd` provider suite are routed out of the
 default path so local `make check` and CI `Check` stay focused on quick
 feedback. If you need that full `cmd/gc` scenario coverage locally, run
 `make test-cmd-gc-process`. In CI, the required non-short path is the
-`test-integration-packages` shard. If you need the heavier package
+dedicated Linux `cmd/gc process` job. The generic integration package
+shards keep `GC_FAST_UNIT=1` for `cmd/gc` unless explicitly overridden,
+so they exercise the fast package sweep without duplicating the slow
+process-backed suite. If you need the heavier package
 coverage sweep locally, use `make test-integration-packages-cover` or
 `make test-integration-shards-cover`. As a result, `coverage.txt` is the
 fast unit-only baseline; the integration contribution comes from the
 shard-specific `coverage.integration-*.txt` profiles and their matching
 Codecov flags.
 
+#### Sharded local runners
+
+For broad local runs, prefer the repo's sharded wrappers over raw `go test`
+commands. They use the same buckets as CI, run under a scrubbed environment,
+and split single-package bottlenecks such as `cmd/gc` across multiple
+processes.
+
+Use these as the default entry points:
+
+```bash
+# Fast unit baseline, with cmd/gc split into shards.
+make test-fast-parallel
+
+# Full process-backed cmd/gc suite, sharded.
+make test-cmd-gc-process-parallel
+
+# CI integration buckets, sharded.
+make test-integration-shards-parallel
+
+# Fast + process-backed cmd/gc + integration shards.
+make test-local-full-parallel
+```
+
+On large local machines, tune parallelism explicitly:
+
+```bash
+LOCAL_TEST_JOBS=48 CMD_GC_PROCESS_TOTAL=12 make test-local-full-parallel
+```
+
+For one package, shard top-level Go tests directly:
+
+```bash
+GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m ./scripts/test-go-test-shard ./cmd/gc 1 6
+GO_TEST_TAGS=acceptance_b GO_TEST_TIMEOUT=10m ./scripts/test-go-test-shard ./test/acceptance/tier_b 2 3
+```
+
+For integration buckets, use the named shard runner:
+
+```bash
+./scripts/test-integration-shard packages-cmd-gc-3-of-6
+./scripts/test-integration-shard review-formulas-retries-1-of-2
+./scripts/test-integration-shard rest-full-4-of-8
+```
+
+To force the process-backed `cmd/gc` tests through the package shard for
+diagnostics, override the default explicitly:
+
+```bash
+GC_FAST_UNIT=0 ./scripts/test-integration-shard packages-cmd-gc-3-of-6
+```
+
+Raw `go test` is still appropriate for a focused package or a single failing
+test. Do not use it as the default for full local sweeps when a sharded target
+exists.
+
 ### 2. Testscript (`.txtar` files in `cmd/gc/testdata/`)
 
 Test what the USER sees. Run the real `gc` binary, assert on stdout/stderr.
@@ -110,6 +168,68 @@ listener bootstrap, socket paths — wires end-to-end through a real
 binary. Run with `make test-integration-huma` or
 `go test -tags integration -run TestHumaBinary ./test/integration/`.
 
+**Supervisor API contract tests** (`test/integration/gc_live_contract_test.go`
+and focused cases in `test/integration/huma_binary_test.go`): build the real
+`gc` binary, start `gc supervisor run` against an isolated `GC_HOME` and
+runtime dir, then exercise the HTTP API as a client would. These tests are
+not handler unit tests and are not CLI tutorial tests; they prove that the
+published API contract survives the full control plane: Huma registration,
+OpenAPI generation, supervisor routing, city lifecycle, event publication,
+storage providers, and asynchronous request completion.
+
+The live API contract test has a few load-bearing rules:
+
+- Validate responses against the supervisor's live `/openapi.json`. If the
+  server says a route returns a schema, the integration test should prove the
+  real response matches that schema.
+- Exercise API mutations through HTTP only. Set `X-GC-Request` for mutating
+  calls and observe durable results through API reads or events, not by
+  reaching into internal Go state.
+- Treat asynchronous operations as two-step contracts: the HTTP call returns
+  quickly with `202 Accepted` and a `request_id`, then a `request.result.*`
+  or `request.failed` event appears. Focused Huma binary tests should use
+  `/v0/events/stream` for the critical async paths; broader coverage may poll
+  event-list endpoints when the thing being tested is the API surface rather
+  than SSE framing.
+- Prefer self-provisioned fixtures. The test should create its own city, rig,
+  provider/agent/session, beads, mail, formulas, convoys, and order-history
+  fixtures where practical, then clean them up through the API.
+- Keep the test hermetic. It must not depend on the developer's machine-wide
+  supervisor, personal `~/.gc`, default tmux server, or a pre-existing city.
+  Use isolated `GC_HOME`, runtime dir, ports, and process cleanup.
+- Lock compatibility surfaces explicitly. If generated clients rely on an
+  operation ID, method, path template, status code, or response schema, add an
+  assertion for that contract rather than relying only on incidental behavior.
+- Keep generated-read sweeps read-only. A sweep over OpenAPI GET routes is
+  useful for schema and routing drift, but any GET route with unbound identity
+  parameters still needs an explicit fixture-backed test.
+
+Use supervisor API contract tests for externally visible behavior that only
+exists when the real supervisor process is running: async city/session request
+results, event streams, OpenAPI/response agreement, cross-route lifecycle
+coherence, and end-to-end provider wiring. Do not put low-level edge cases
+here. Corrupt files, exact parser failures, request validation branches, and
+single handler error cases belong in unit tests next to the implementation.
+
+#### Live worker inference tests (`//go:build acceptance_c`)
+
+`test/acceptance/worker_inference` runs live Claude/Codex/Gemini/OpenCode CLI
+sessions through tmux and requires local or CI-provided provider auth. It is
+not part of PR CI. Run it deliberately when validating provider behavior:
+
+```bash
+make setup-worker-inference PROFILE=claude/tmux-cli
+make test-worker-inference PROFILE=claude/tmux-cli
+```
+
+Supported profiles are `claude/tmux-cli`, `codex/tmux-cli`,
+`gemini/tmux-cli`, and `opencode/tmux-cli`. OpenCode live tests use Gemini via
+`--model google/gemini-2.5-flash` by default; set
+`GC_WORKER_INFERENCE_OPENCODE_MODEL` to override it and provide
+`GOOGLE_GENERATIVE_AI_API_KEY`, `GEMINI_API_KEY`, or `GOOGLE_API_KEY` for auth.
+Nightly CI runs the configured profile matrix with its credentials and uploads
+worker report artifacts.
+
 ### 4. Documentation sync tests (`test/docsync`)
 
 These tests keep the public docs surface honest.
diff --git a/cmd/gc/agent_build_params.go b/cmd/gc/agent_build_params.go
index 3c9a7f5315..c7787314e5 100644
--- a/cmd/gc/agent_build_params.go
+++ b/cmd/gc/agent_build_params.go
@@ -44,6 +44,11 @@ type agentBuildParams struct {
 	// desired-state build so per-agent resolution does not rescan the store.
 	sessionBeads *sessionBeadSnapshot
 
+	// assignedWorkBeads is the actionable assigned-work snapshot for this
+	// build. Pool new-tier materialization uses it to avoid treating sessions
+	// that already own work as available generic capacity.
+	assignedWorkBeads []beads.Bead
+
 	// beadNames caches qualifiedName → session_name mappings resolved
 	// during this build cycle. Populated lazily by resolveSessionName.
 	beadNames map[string]string
diff --git a/cmd/gc/agent_env_path.go b/cmd/gc/agent_env_path.go
new file mode 100644
index 0000000000..072c72cdac
--- /dev/null
+++ b/cmd/gc/agent_env_path.go
@@ -0,0 +1,48 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// prependGCBinDirToPATH ensures that the directory containing the gc binary
+// is the first entry in env["PATH"]. If env["PATH"] is unset, falls back to
+// the calling process's PATH as the base.
+//
+// This protects spawned agents (which may write `gc` in shell prompts) from
+// PATH collisions with unrelated binaries — notably Homebrew's `graphviz`
+// package, which ships /opt/homebrew/bin/gc and breaks bare `gc` invocations
+// for any agent whose PATH happens to put /opt/homebrew/bin first.
+//
+// gcBin is the absolute path to the gc binary (typically the value the caller
+// also writes to env["GC_BIN"]). If empty or has no directory component, the
+// function is a no-op.
+func prependGCBinDirToPATH(env map[string]string, gcBin string) {
+	if gcBin == "" {
+		return
+	}
+	dir := filepath.Dir(gcBin)
+	if dir == "" || dir == "." {
+		return
+	}
+	sep := string(os.PathListSeparator)
+	base, ok := env["PATH"]
+	if !ok {
+		base = os.Getenv("PATH")
+	}
+	if base == "" {
+		env["PATH"] = dir
+		return
+	}
+
+	parts := strings.Split(base, sep)
+	entries := []string{dir}
+	for _, p := range parts {
+		if p == dir {
+			continue
+		}
+		entries = append(entries, p)
+	}
+	env["PATH"] = strings.Join(entries, sep)
+}
diff --git a/cmd/gc/agent_env_path_test.go b/cmd/gc/agent_env_path_test.go
new file mode 100644
index 0000000000..3b15db3f53
--- /dev/null
+++ b/cmd/gc/agent_env_path_test.go
@@ -0,0 +1,112 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestPrependGCBinDirToPATH_NoGCBin_NoOp(t *testing.T) {
+	env := map[string]string{"PATH": "/usr/bin:/bin"}
+	prependGCBinDirToPATH(env, "")
+	if env["PATH"] != "/usr/bin:/bin" {
+		t.Fatalf("PATH should be unchanged when GC_BIN empty, got %q", env["PATH"])
+	}
+}
+
+func TestPrependGCBinDirToPATH_AddsToExistingPATH(t *testing.T) {
+	env := map[string]string{"PATH": "/usr/bin:/bin"}
+	prependGCBinDirToPATH(env, "/Users/jbb/go/bin/gc")
+	want := "/Users/jbb/go/bin" + string(os.PathListSeparator) + "/usr/bin:/bin"
+	if env["PATH"] != want {
+		t.Fatalf("PATH=%q, want %q", env["PATH"], want)
+	}
+}
+
+func TestPrependGCBinDirToPATH_FallsBackToOSPATH(t *testing.T) {
+	env := map[string]string{}
+	t.Setenv("PATH", "/usr/bin:/bin")
+	prependGCBinDirToPATH(env, "/opt/gc/bin/gc")
+	want := "/opt/gc/bin" + string(os.PathListSeparator) + "/usr/bin:/bin"
+	if env["PATH"] != want {
+		t.Fatalf("PATH=%q, want %q", env["PATH"], want)
+	}
+}
+
+func TestPrependGCBinDirToPATH_ExplicitEmptyPATHUsesOnlyGCBinDir(t *testing.T) {
+	dir := "/opt/gc/bin"
+	env := map[string]string{"PATH": ""}
+	prependGCBinDirToPATH(env, filepath.Join(dir, "gc"))
+	if env["PATH"] != dir {
+		t.Fatalf("PATH=%q, want only gc bin dir %q", env["PATH"], dir)
+	}
+}
+
+func TestPrependGCBinDirToPATH_UnsetPATHWithEmptyOSPATHUsesOnlyGCBinDir(t *testing.T) {
+	dir := "/opt/gc/bin"
+	env := map[string]string{}
+	t.Setenv("PATH", "")
+	prependGCBinDirToPATH(env, filepath.Join(dir, "gc"))
+	if env["PATH"] != dir {
+		t.Fatalf("PATH=%q, want only gc bin dir %q", env["PATH"], dir)
+	}
+}
+
+func TestPrependGCBinDirToPATH_AlreadyFirst_NoDuplicate(t *testing.T) {
+	dir := "/Users/jbb/go/bin"
+	env := map[string]string{"PATH": dir + string(os.PathListSeparator) + "/usr/bin"}
+	prependGCBinDirToPATH(env, filepath.Join(dir, "gc"))
+	parts := strings.Split(env["PATH"], string(os.PathListSeparator))
+	if parts[0] != dir {
+		t.Fatalf("first PATH entry %q, want %q", parts[0], dir)
+	}
+	count := 0
+	for _, p := range parts {
+		if p == dir {
+			count++
+		}
+	}
+	if count != 1 {
+		t.Fatalf("dir %q should appear exactly once, found %d times in %q", dir, count, env["PATH"])
+	}
+}
+
+func TestPrependGCBinDirToPATH_PresentNotFirst_MovesToFront(t *testing.T) {
+	dir := "/Users/jbb/go/bin"
+	env := map[string]string{"PATH": "/opt/homebrew/bin" + string(os.PathListSeparator) + dir + string(os.PathListSeparator) + "/usr/bin"}
+	prependGCBinDirToPATH(env, filepath.Join(dir, "gc"))
+	parts := strings.Split(env["PATH"], string(os.PathListSeparator))
+	if parts[0] != dir {
+		t.Fatalf("first PATH entry %q, want %q (full PATH=%q)", parts[0], dir, env["PATH"])
+	}
+	count := 0
+	for _, p := range parts {
+		if p == dir {
+			count++
+		}
+	}
+	if count != 1 {
+		t.Fatalf("dir %q should appear exactly once, found %d times in %q", dir, count, env["PATH"])
+	}
+}
+
+func TestPrependGCBinDirToPATH_PreservesLeadingEmptyEntry(t *testing.T) {
+	dir := "/Users/jbb/go/bin"
+	sep := string(os.PathListSeparator)
+	env := map[string]string{"PATH": sep + "/usr/bin"}
+	prependGCBinDirToPATH(env, filepath.Join(dir, "gc"))
+	want := dir + sep + sep + "/usr/bin"
+	if env["PATH"] != want {
+		t.Fatalf("PATH=%q, want %q", env["PATH"], want)
+	}
+}
+
+func TestPrependGCBinDirToPATH_EmptyDir_NoOp(t *testing.T) {
+	// edge: GC_BIN is just "gc" with no directory part — skip prepend.
+	env := map[string]string{"PATH": "/usr/bin"}
+	prependGCBinDirToPATH(env, "gc")
+	if env["PATH"] != "/usr/bin" {
+		t.Fatalf("PATH should be unchanged when GC_BIN has no dir, got %q", env["PATH"])
+	}
+}
diff --git a/cmd/gc/api_state.go b/cmd/gc/api_state.go
index db26edae92..06e03a32a6 100644
--- a/cmd/gc/api_state.go
+++ b/cmd/gc/api_state.go
@@ -25,6 +25,7 @@ import (
 	"github.com/gastownhall/gascity/internal/mail"
 	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/workspacesvc"
 )
 
@@ -51,8 +52,17 @@ type controllerState struct {
 	services      workspacesvc.Registry
 	extmsgSvc     *extmsg.Services
 	adapterReg    *extmsg.AdapterRegistry
+	updateMu      sync.Mutex // serializes rebuild+swap so stale reloads cannot overtake newer mutations
+
+	// True after an API config mutation refreshes controller state ahead of the
+	// runtime reload loop. Runtime reloads from older revisions are ignored
+	// until the loop observes and applies the same or a newer on-disk config.
+	configMutationPending atomic.Bool
+	pendingConfigRev      string
 }
 
+var controllerStateInitRigDirIfReady = initDirIfReady
+
 type configMutationSnapshot struct {
 	cityPath   string
 	files      map[string][]byte
@@ -179,7 +189,7 @@ func (cs *controllerState) buildStores(cfg *config.City) map[string]beads.Store
 		if sharedLegacyFileStore != nil && scopeProvider == "file" && !scopeUsesFileStoreContract(scopeRoot) {
 			store = sharedLegacyFileStore
 		} else {
-			store = cs.openRigStore(scopeProvider, rig.Name, scopeRoot, rig.EffectivePrefix())
+			store = cs.openRigStore(scopeProvider, rig.Name, scopeRoot, rig.EffectivePrefix(), cfg)
 		}
 		stores[rig.Name] = wrapWithCachingStore(cs.cacheCtx, store, cs.eventProv)
 	}
@@ -187,7 +197,7 @@ func (cs *controllerState) buildStores(cfg *config.City) map[string]beads.Store
 }
 
 // openRigStore creates a bead store for a rig path using the given provider.
-func (cs *controllerState) openRigStore(provider, rigName, rigPath, prefix string) beads.Store {
+func (cs *controllerState) openRigStore(provider, rigName, rigPath, prefix string, cfg *config.City) beads.Store {
 	scopeRoot := resolveStoreScopeRoot(cs.cityPath, rigPath)
 	if strings.HasPrefix(provider, "exec:") {
 		s := beadsexec.NewStore(strings.TrimPrefix(provider, "exec:"))
@@ -207,7 +217,7 @@ func (cs *controllerState) openRigStore(provider, rigName, rigPath, prefix strin
 		}
 		return store
 	default: // "bd" or unrecognized
-		return bdStoreForRig(scopeRoot, cs.cityPath, cs.cfg)
+		return bdStoreForRig(scopeRoot, cs.cityPath, cfg, prefix)
 	}
 }
 
@@ -250,6 +260,29 @@ func (cs *controllerState) applyBeadEventToStores(evt events.Event) {
 		return
 	}
 	cs.mu.RLock()
+	stores := cs.beadEventStoresLocked(evt)
+	cs.mu.RUnlock()
+
+	for _, store := range stores {
+		if cached, ok := store.(*beads.CachingStore); ok {
+			cached.ApplyEvent(evt.Type, evt.Payload)
+		}
+	}
+	if evt.Actor != "cache-reconcile" {
+		cs.Poke()
+	}
+}
+
+func (cs *controllerState) beadEventStoresLocked(evt events.Event) []beads.Store {
+	if id := beadEventID(evt); id != "" && cs.cfg != nil {
+		if store, known := cs.beadEventConfiguredStoreLocked(id); known {
+			if store == nil {
+				return nil
+			}
+			return []beads.Store{store}
+		}
+	}
+
 	stores := make([]beads.Store, 0, len(cs.beadStores)+1)
 	for _, s := range cs.beadStores {
 		stores = append(stores, s)
@@ -257,21 +290,47 @@ func (cs *controllerState) applyBeadEventToStores(evt events.Event) {
 	if cs.cityBeadStore != nil {
 		stores = append(stores, cs.cityBeadStore)
 	}
-	cs.mu.RUnlock()
+	return stores
+}
 
-	for _, store := range stores {
-		if cached, ok := store.(*beads.CachingStore); ok {
-			cached.ApplyEvent(evt.Type, evt.Payload)
+func (cs *controllerState) beadEventConfiguredStoreLocked(id string) (beads.Store, bool) {
+	var matchedStore beads.Store
+	matchedLen := -1
+	match := func(prefix string, store beads.Store) {
+		if prefix == "" || !strings.HasPrefix(id, prefix+"-") {
+			return
+		}
+		if len(prefix) > matchedLen {
+			matchedLen = len(prefix)
+			matchedStore = store
 		}
 	}
-	if evt.Actor != "cache-reconcile" {
-		cs.Poke()
+	match(config.EffectiveHQPrefix(cs.cfg), cs.cityBeadStore)
+	for _, rig := range cs.cfg.Rigs {
+		match(rig.EffectivePrefix(), cs.beadStores[rig.Name])
+	}
+	return matchedStore, matchedLen >= 0
+}
+
+func beadEventID(evt events.Event) string {
+	id := strings.TrimSpace(evt.Subject)
+	if id == "" {
+		var payload struct {
+			ID string `json:"id"`
+		}
+		if err := json.Unmarshal(evt.Payload, &payload); err == nil {
+			id = strings.TrimSpace(payload.ID)
+		}
 	}
+	return id
 }
 
 // update replaces the config, session provider, and reopens stores.
 // Stores are built outside the lock to avoid blocking readers during I/O.
 func (cs *controllerState) update(cfg *config.City, sp runtime.Provider) {
+	cs.updateMu.Lock()
+	defer cs.updateMu.Unlock()
+
 	// Build new stores outside the lock (may do file I/O / subprocess spawns).
 	stores := cs.buildStores(cfg)
 	// Reopen city-level store for session beads and mail.
@@ -304,6 +363,197 @@ func (cs *controllerState) update(cfg *config.City, sp runtime.Provider) {
 	cs.mu.Unlock()
 }
 
+func (cs *controllerState) updateFromRuntime(cfg *config.City, sp runtime.Provider, revision string) {
+	if cs.configMutationPending.Load() {
+		matchesPending, stale := cs.runtimeUpdateStatusForPendingMutation(revision)
+		if stale {
+			return
+		}
+		if matchesPending {
+			if cs.runtimeUpdateDropsPendingRigs(cfg) {
+				return
+			}
+			if cs.runtimeUpdateCanReuseCurrentStores(cfg) {
+				cs.updateConfigAndProviderOnly(cfg, sp)
+				cs.clearConfigMutationPending()
+				return
+			}
+		}
+	} else if cs.runtimeUpdateRevisionIsStale(revision) {
+		return
+	}
+	if cs.runtimeUpdateCanReuseCurrentStores(cfg) {
+		cs.updateConfigAndProviderOnly(cfg, sp)
+		cs.clearConfigMutationPending()
+		return
+	}
+	cs.update(cfg, sp)
+	cs.clearConfigMutationPending()
+}
+
+func (cs *controllerState) updateConfigAndProviderOnly(cfg *config.City, sp runtime.Provider) {
+	cs.updateMu.Lock()
+	defer cs.updateMu.Unlock()
+
+	cs.mu.Lock()
+	cs.cfg = cfg
+	cs.sp = sp
+	cs.mu.Unlock()
+}
+
+func (cs *controllerState) runtimeUpdateCanReuseCurrentStores(next *config.City) bool {
+	cs.mu.RLock()
+	current := cs.cfg
+	cityStore := cs.cityBeadStore
+	stores := make(map[string]beads.Store, len(cs.beadStores))
+	for name, store := range cs.beadStores {
+		stores[name] = store
+	}
+	cs.mu.RUnlock()
+
+	if cityStore == nil || !sameStoreTopology(cs.cityPath, current, next) {
+		return false
+	}
+	for _, rig := range next.Rigs {
+		if strings.TrimSpace(rig.Path) == "" {
+			continue
+		}
+		if stores[rig.Name] == nil {
+			return false
+		}
+	}
+	return true
+}
+
+func (cs *controllerState) runtimeUpdateDropsPendingRigs(next *config.City) bool {
+	cs.mu.RLock()
+	current := cs.cfg
+	cs.mu.RUnlock()
+	return configDropsBoundRigs(current, next)
+}
+
+func (cs *controllerState) runtimeUpdateStatusForPendingMutation(revision string) (matchesPending, stale bool) {
+	pendingRev := cs.pendingConfigRevision()
+	if pendingRev == "" {
+		return false, true
+	}
+	if revision == "" {
+		return false, true
+	}
+	if revision == pendingRev {
+		return true, false
+	}
+	currentRev, err := cs.currentConfigRevision()
+	if err != nil || currentRev != revision {
+		return false, true
+	}
+	return false, false
+}
+
+func (cs *controllerState) runtimeUpdateRevisionIsStale(revision string) bool {
+	if revision == "" {
+		return false
+	}
+	currentRev, err := cs.currentConfigRevision()
+	return err != nil || currentRev != revision
+}
+
+func (cs *controllerState) pendingConfigRevision() string {
+	cs.mu.RLock()
+	defer cs.mu.RUnlock()
+	return cs.pendingConfigRev
+}
+
+func (cs *controllerState) currentConfigRevision() (string, error) {
+	if cs.cityPath == "" {
+		return "", nil
+	}
+	_, revision, err := cs.loadCurrentConfigSnapshot()
+	if err != nil {
+		return "", fmt.Errorf("loading current city config: %w", err)
+	}
+	return revision, nil
+}
+
+func (cs *controllerState) markConfigMutationPending(revision string) {
+	cs.mu.Lock()
+	cs.pendingConfigRev = revision
+	cs.mu.Unlock()
+	cs.configMutationPending.Store(true)
+}
+
+func (cs *controllerState) clearConfigMutationPending() {
+	cs.mu.Lock()
+	cs.pendingConfigRev = ""
+	cs.mu.Unlock()
+	cs.configMutationPending.Store(false)
+}
+
+type storeTopologyRig struct {
+	path   string
+	prefix string
+}
+
+func sameStoreTopology(cityPath string, current, next *config.City) bool {
+	if current == nil || next == nil {
+		return false
+	}
+	if strings.TrimSpace(current.Beads.Provider) != strings.TrimSpace(next.Beads.Provider) {
+		return false
+	}
+	if strings.TrimSpace(current.Mail.Provider) != strings.TrimSpace(next.Mail.Provider) {
+		return false
+	}
+	if config.EffectiveHQPrefix(current) != config.EffectiveHQPrefix(next) {
+		return false
+	}
+	currentRigs := storeTopologyRigs(cityPath, current.Rigs)
+	nextRigs := storeTopologyRigs(cityPath, next.Rigs)
+	if len(currentRigs) != len(nextRigs) {
+		return false
+	}
+	for name, currentRig := range currentRigs {
+		if nextRig, ok := nextRigs[name]; !ok || nextRig != currentRig {
+			return false
+		}
+	}
+	return true
+}
+
+func storeTopologyRigs(cityPath string, rigs []config.Rig) map[string]storeTopologyRig {
+	result := make(map[string]storeTopologyRig, len(rigs))
+	for _, rig := range rigs {
+		path := strings.TrimSpace(rig.Path)
+		if path != "" {
+			path = resolveStoreScopeRoot(cityPath, path)
+		}
+		result[rig.Name] = storeTopologyRig{
+			path:   path,
+			prefix: rig.EffectivePrefix(),
+		}
+	}
+	return result
+}
+
+func configDropsBoundRigs(current, next *config.City) bool {
+	if current == nil || next == nil {
+		return false
+	}
+	nextRigPaths := make(map[string]string, len(next.Rigs))
+	for _, rig := range next.Rigs {
+		nextRigPaths[rig.Name] = strings.TrimSpace(rig.Path)
+	}
+	for _, rig := range current.Rigs {
+		if strings.TrimSpace(rig.Path) == "" {
+			continue
+		}
+		if nextRigPaths[rig.Name] == "" {
+			return true
+		}
+	}
+	return false
+}
+
 // --- api.State implementation ---
 
 // Config returns the current city config snapshot.
@@ -530,6 +780,15 @@ func (cs *controllerState) CreateAgent(a config.Agent) error {
 	})
 }
 
+// WaitForAgentVisibility blocks until findAgent in the controller's hot-reloaded
+// config snapshot resolves the given qualified agent name. CreateAgent already
+// refreshes cs.cfg from disk, so the first check normally succeeds; the wait
+// preserves the HTTP contract that a successful POST /agents response can be
+// followed immediately by POST /sling against the same target.
+func (cs *controllerState) WaitForAgentVisibility(ctx context.Context, qualifiedName string) error {
+	return api.WaitForAgentVisibilityIn(ctx, cs.Config, qualifiedName)
+}
+
 // UpdateAgent partially updates an existing agent definition in city.toml.
 func (cs *controllerState) UpdateAgent(name string, patch api.AgentUpdate) error {
 	return cs.mutateAndPoke(func() error {
@@ -550,11 +809,39 @@ func (cs *controllerState) DeleteAgent(name string) error {
 
 // CreateRig adds a new rig to city.toml.
 func (cs *controllerState) CreateRig(r config.Rig) error {
+	if err := cs.initializeRigStoreForCreate(r); err != nil {
+		return err
+	}
 	return cs.mutateAndPoke(func() error {
 		return cs.editor.CreateRig(r)
 	})
 }
 
+func (cs *controllerState) initializeRigStoreForCreate(r config.Rig) error {
+	cityPath := strings.TrimSpace(cs.cityPath)
+	rigPath := strings.TrimSpace(r.Path)
+	if cityPath == "" || rigPath == "" {
+		return nil
+	}
+
+	cs.mu.RLock()
+	cfg := cs.cfg
+	cs.mu.RUnlock()
+	if cfg != nil {
+		for _, existing := range cfg.Rigs {
+			if existing.Name == r.Name {
+				return fmt.Errorf("%w: rig %q", configedit.ErrAlreadyExists, r.Name)
+			}
+		}
+	}
+
+	scopeRoot := resolveStoreScopeRoot(cityPath, rigPath)
+	if _, err := controllerStateInitRigDirIfReady(cityPath, scopeRoot, r.EffectivePrefix()); err != nil {
+		return fmt.Errorf("initializing rig %q beads: %w", r.Name, err)
+	}
+	return nil
+}
+
 // UpdateRig partially updates a rig in city.toml.
 func (cs *controllerState) UpdateRig(name string, patch api.RigUpdate) error {
 	return cs.mutateAndPoke(func() error {
@@ -739,7 +1026,8 @@ func (cs *controllerState) mutateAndPoke(mutate func() error) error {
 	if err := mutate(); err != nil {
 		return err
 	}
-	if err := cs.refreshConfigSnapshot(); err != nil {
+	revision, err := cs.refreshConfigSnapshot()
+	if err != nil {
 		if snapshot != nil {
 			if restoreErr := snapshot.restore(); restoreErr != nil {
 				restoreFailure := fmt.Errorf("restoring previous city config: %w", restoreErr)
@@ -748,6 +1036,7 @@ func (cs *controllerState) mutateAndPoke(mutate func() error) error {
 		}
 		return fmt.Errorf("refreshing updated city config: %w", err)
 	}
+	cs.markConfigMutationPending(revision)
 	if cs.configDirty != nil {
 		cs.configDirty.Store(true)
 	}
@@ -755,24 +1044,35 @@ func (cs *controllerState) mutateAndPoke(mutate func() error) error {
 	return nil
 }
 
-func (cs *controllerState) refreshConfigSnapshot() error {
+func (cs *controllerState) refreshConfigSnapshot() (string, error) {
 	if cs.cityPath == "" || cs.cfg == nil {
-		return nil
+		return "", nil
 	}
 
-	tomlPath := filepath.Join(cs.cityPath, "city.toml")
-	nextCfg, _, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath, extraConfigFiles...)
+	nextCfg, revision, err := cs.loadCurrentConfigSnapshot()
 	if err != nil {
-		return fmt.Errorf("loading updated city config: %w", err)
+		return "", fmt.Errorf("loading updated city config: %w", err)
+	}
+	if revision == "" {
+		return "", errors.New("computed empty config revision")
 	}
-	applyFeatureFlags(nextCfg)
-	applyRuntimeCityIdentity(nextCfg, cs.cityName)
 
 	cs.mu.RLock()
 	sp := cs.sp
 	cs.mu.RUnlock()
 	cs.update(nextCfg, sp)
-	return nil
+	return revision, nil
+}
+
+func (cs *controllerState) loadCurrentConfigSnapshot() (*config.City, string, error) {
+	nextCfg, prov, err := loadCityConfigWithBuiltinPacks(cs.cityPath, extraConfigFiles...)
+	if err != nil {
+		return nil, "", err
+	}
+	applyFeatureFlags(nextCfg)
+	applyRuntimeCityIdentity(nextCfg, cs.cityName)
+	revision := config.Revision(fsys.OSFS{}, prov, nextCfg, cs.cityPath)
+	return nextCfg, revision, nil
 }
 
 // Poke signals the controller to trigger an immediate reconciler tick.
@@ -787,6 +1087,45 @@ func (cs *controllerState) Poke() {
 	}
 }
 
+// WaitForSessionCommandable waits until the controller has reconciled an async
+// session create into a lifecycle state that can accept normal commands.
+func (cs *controllerState) WaitForSessionCommandable(ctx context.Context, sessionID string) (session.Info, error) {
+	store := cs.CityBeadStore()
+	if store == nil {
+		return session.Info{}, errors.New("city bead store is unavailable")
+	}
+	catalog, err := workerSessionCatalogWithConfig(cs.CityPath(), store, cs.SessionProvider(), cs.Config())
+	if err != nil {
+		return session.Info{}, err
+	}
+
+	ticker := time.NewTicker(100 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		info, err := catalog.Get(sessionID)
+		if err != nil {
+			return session.Info{}, err
+		}
+		if info.Closed {
+			return session.Info{}, fmt.Errorf("session is closed: %s", sessionID)
+		}
+		switch info.State {
+		case session.StateActive, session.StateAwake, session.StateAsleep, session.StateSuspended, session.StateQuarantined:
+			return info, nil
+		case session.StateCreating, "":
+		default:
+			return session.Info{}, fmt.Errorf("session %s reached non-commandable state %q", sessionID, info.State)
+		}
+
+		select {
+		case <-ctx.Done():
+			return session.Info{}, fmt.Errorf("session %s did not become commandable: %w", sessionID, ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
 // ServiceRegistry returns the workspace service registry.
 func (cs *controllerState) ServiceRegistry() workspacesvc.Registry {
 	cs.mu.RLock()
diff --git a/cmd/gc/api_state_test.go b/cmd/gc/api_state_test.go
index f78d033a58..231f938293 100644
--- a/cmd/gc/api_state_test.go
+++ b/cmd/gc/api_state_test.go
@@ -3,12 +3,15 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/api"
 	"github.com/gastownhall/gascity/internal/beads"
@@ -136,6 +139,441 @@ func TestControllerStateUpdate(t *testing.T) {
 	}
 }
 
+func TestControllerStateRuntimeUpdateDoesNotDropPendingMutationRigs(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"city1\"\n\n[beads]\nprovider = \"file\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: t.TempDir()}},
+	}
+	stale := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+	}
+
+	cs := newControllerState(context.Background(), current, runtime.NewFake(), events.NewFake(), "city1", cityDir)
+	cs.markConfigMutationPending("current-rev")
+
+	cs.updateFromRuntime(stale, runtime.NewFake(), "stale-rev")
+
+	if got := cs.Config(); got != current {
+		t.Fatalf("Config() = %+v, want pending mutation config with rig alpha", got)
+	}
+	if !cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker cleared by stale runtime update")
+	}
+
+	cs.updateFromRuntime(current, runtime.NewFake(), "current-rev")
+
+	if cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker not cleared after matching runtime update")
+	}
+}
+
+func TestControllerStateRuntimeUpdateDoesNotDropPendingMutationAgents(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"city1\"\n\n[beads]\nprovider = \"file\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	rigDir := t.TempDir()
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: rigDir}},
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "alpha", Provider: "bash"},
+			{Name: "helper", Dir: "alpha", Provider: "bash"},
+		},
+	}
+	stale := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: rigDir}},
+		Agents:    []config.Agent{{Name: "worker", Dir: "alpha", Provider: "bash"}},
+	}
+
+	cs := newControllerState(context.Background(), current, runtime.NewFake(), events.NewFake(), "city1", cityDir)
+	cs.markConfigMutationPending("current-rev")
+
+	cs.updateFromRuntime(stale, runtime.NewFake(), "stale-rev")
+
+	if got := cs.Config(); got != current {
+		t.Fatalf("Config() = %+v, want pending mutation config with helper agent", got)
+	}
+	if !cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker cleared by stale runtime update")
+	}
+
+	cs.updateFromRuntime(current, runtime.NewFake(), "current-rev")
+
+	if got := cs.Config(); got != current {
+		t.Fatalf("Config() = %+v, want matching runtime config applied", got)
+	}
+	if cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker not cleared after matching runtime update")
+	}
+}
+
+func TestControllerStateCreatedAgentVisibleAfterStaleRuntimeInterleaving(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "alpha")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatalf("mkdir rig: %v", err)
+	}
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Beads:     config.BeadsConfig{Provider: "file"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: rigDir}},
+		Agents:    []config.Agent{{Name: "worker", Dir: "alpha", Provider: "bash"}},
+	}
+	content, err := current.Marshal()
+	if err != nil {
+		t.Fatalf("marshal config: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), content, 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+
+	cs := newControllerState(context.Background(), current, runtime.NewFake(), events.NewFake(), "city1", cityDir)
+	if err := cs.CreateAgent(config.Agent{Name: "helper", Dir: "alpha", Provider: "bash"}); err != nil {
+		t.Fatalf("CreateAgent: %v", err)
+	}
+	pendingRev := cs.pendingConfigRevision()
+	if pendingRev == "" {
+		t.Fatal("CreateAgent did not mark a pending config revision")
+	}
+
+	stale := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Beads:     config.BeadsConfig{Provider: "file"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: rigDir}},
+		Agents:    []config.Agent{{Name: "worker", Dir: "alpha", Provider: "bash"}},
+	}
+	cs.updateFromRuntime(stale, runtime.NewFake(), pendingRev)
+	if got := cs.Config(); configHasAgent(got, "alpha/helper") {
+		t.Fatalf("stale runtime update did not hide alpha/helper; agents = %+v", got.Agents)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	waitErr := make(chan error, 1)
+	go func() {
+		waitErr <- cs.WaitForAgentVisibility(ctx, "alpha/helper")
+	}()
+
+	select {
+	case err := <-waitErr:
+		t.Fatalf("WaitForAgentVisibility returned before fresh runtime update: %v", err)
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	fresh, freshRev, err := cs.loadCurrentConfigSnapshot()
+	if err != nil {
+		t.Fatalf("load fresh config snapshot: %v", err)
+	}
+	cs.updateFromRuntime(fresh, runtime.NewFake(), freshRev)
+
+	if err := <-waitErr; err != nil {
+		t.Fatalf("WaitForAgentVisibility after stale runtime update: %v", err)
+	}
+	got := cs.Config()
+	if !configHasAgent(got, "alpha/helper") {
+		t.Fatalf("agents after stale runtime update = %+v, want alpha/helper still visible", got.Agents)
+	}
+}
+
+func configHasAgent(cfg *config.City, qualifiedName string) bool {
+	if cfg == nil {
+		return false
+	}
+	for _, agent := range cfg.Agents {
+		if agent.QualifiedName() == qualifiedName {
+			return true
+		}
+	}
+	return false
+}
+
+func TestControllerStateRuntimeUpdateIgnoresEmptyRevisionDuringPendingMutation(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"city1\"\n\n[beads]\nprovider = \"file\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	rigDir := t.TempDir()
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: rigDir}},
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "alpha", Provider: "bash"},
+			{Name: "helper", Dir: "alpha", Provider: "bash"},
+		},
+	}
+	stale := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs:      []config.Rig{{Name: "alpha", Path: rigDir}},
+		Agents:    []config.Agent{{Name: "worker", Dir: "alpha", Provider: "bash"}},
+	}
+
+	cs := newControllerState(context.Background(), current, runtime.NewFake(), events.NewFake(), "city1", cityDir)
+	cs.markConfigMutationPending("current-rev")
+
+	cs.updateFromRuntime(stale, runtime.NewFake(), "")
+
+	if got := cs.Config(); got != current {
+		t.Fatalf("Config() = %+v, want pending mutation config with helper agent", got)
+	}
+	if !cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker cleared by empty-revision runtime update")
+	}
+}
+
+func TestControllerStateRuntimeUpdateAcceptsBuiltinAwareRevision(t *testing.T) {
+	configureTestDoltIdentityEnv(t)
+	t.Setenv("GC_BEADS", "")
+
+	cityDir := shortSocketTempDir(t, "gc-state-runtime-builtin-")
+	cleanupManagedDoltTestCity(t, cityDir)
+	tomlPath := filepath.Join(cityDir, "city.toml")
+	if err := os.WriteFile(tomlPath, []byte("[workspace]\nname = \"test\"\n"), 0o644); err != nil {
+		t.Fatalf("write initial city.toml: %v", err)
+	}
+
+	initial, err := tryReloadConfig(tomlPath, "test", cityDir)
+	if err != nil {
+		t.Fatalf("initial tryReloadConfig: %v", err)
+	}
+	applyRuntimeCityIdentity(initial.Cfg, "test")
+	cs := newControllerState(context.Background(), initial.Cfg, runtime.NewFake(), events.NewFake(), "test", cityDir)
+
+	rigDir := t.TempDir()
+	updatedToml := fmt.Sprintf("[workspace]\nname = \"test\"\n\n[[rigs]]\nname = \"alpha\"\npath = %q\n", rigDir)
+	if err := os.WriteFile(tomlPath, []byte(updatedToml), 0o644); err != nil {
+		t.Fatalf("write updated city.toml: %v", err)
+	}
+	reloaded, err := tryReloadConfig(tomlPath, "test", cityDir)
+	if err != nil {
+		t.Fatalf("reloaded tryReloadConfig: %v", err)
+	}
+	applyRuntimeCityIdentity(reloaded.Cfg, "test")
+
+	cs.updateFromRuntime(reloaded.Cfg, runtime.NewFake(), reloaded.Revision)
+
+	if got := cs.Config().Rigs; len(got) != 1 || got[0].Name != "alpha" {
+		t.Fatalf("runtime update was not accepted; rigs = %#v", got)
+	}
+	requireControllerStateOrder(t, cs, "gate-sweep")
+}
+
+func TestControllerStateMutationRefreshKeepsBuiltinOrdersAndClearsPending(t *testing.T) {
+	configureTestDoltIdentityEnv(t)
+	t.Setenv("GC_BEADS", "")
+
+	cityDir := shortSocketTempDir(t, "gc-state-mutation-builtin-")
+	cleanupManagedDoltTestCity(t, cityDir)
+	tomlPath := filepath.Join(cityDir, "city.toml")
+	if err := os.WriteFile(tomlPath, []byte("[workspace]\nname = \"test\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+
+	initial, err := tryReloadConfig(tomlPath, "test", cityDir)
+	if err != nil {
+		t.Fatalf("tryReloadConfig: %v", err)
+	}
+	applyRuntimeCityIdentity(initial.Cfg, "test")
+	cs := newControllerState(context.Background(), initial.Cfg, runtime.NewFake(), events.NewFake(), "test", cityDir)
+
+	if err := cs.EnableOrder("gate-sweep", ""); err != nil {
+		t.Fatalf("EnableOrder: %v", err)
+	}
+	requireControllerStateOrder(t, cs, "gate-sweep")
+	if !cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker was not set")
+	}
+
+	reloaded, err := tryReloadConfig(tomlPath, "test", cityDir)
+	if err != nil {
+		t.Fatalf("tryReloadConfig after mutation: %v", err)
+	}
+	applyRuntimeCityIdentity(reloaded.Cfg, "test")
+	cs.updateFromRuntime(reloaded.Cfg, runtime.NewFake(), reloaded.Revision)
+
+	if cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker was not cleared by matching runtime update")
+	}
+	requireControllerStateOrder(t, cs, "gate-sweep")
+}
+
+func requireControllerStateOrder(t *testing.T, cs *controllerState, want string) {
+	t.Helper()
+
+	for _, order := range cs.Orders() {
+		if order.Name == want {
+			return
+		}
+	}
+	t.Fatalf("Orders() missing %q", want)
+}
+
+func TestControllerStateRuntimeUpdateAfterMutationPreservesCurrentStores(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "alpha")
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+	}
+	rigStore := beads.NewMemStore()
+	cityStore := beads.NewMemStore()
+	cs := &controllerState{
+		cfg:           current,
+		sp:            runtime.NewFake(),
+		beadStores:    map[string]beads.Store{"alpha": rigStore},
+		cityBeadStore: cityStore,
+		cityName:      "city1",
+		cityPath:      cityDir,
+	}
+	cs.markConfigMutationPending("next-rev")
+
+	next := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+	}
+	cs.updateFromRuntime(next, runtime.NewFake(), "next-rev")
+
+	if got := cs.BeadStore("alpha"); got != rigStore {
+		t.Fatalf("BeadStore(alpha) = %T %p, want original store %T %p", got, got, rigStore, rigStore)
+	}
+	if got := cs.CityBeadStore(); got != cityStore {
+		t.Fatalf("CityBeadStore() = %T %p, want original store %T %p", got, got, cityStore, cityStore)
+	}
+	if cs.Config() != next {
+		t.Fatal("Config() was not advanced to runtime snapshot")
+	}
+	if cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker not cleared after matching runtime update")
+	}
+}
+
+func TestControllerStateRuntimeUpdatePreservesCurrentStoresWithoutPendingMutation(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "alpha")
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+	}
+	rigStore := beads.NewMemStore()
+	cityStore := beads.NewMemStore()
+	cs := &controllerState{
+		cfg:           current,
+		sp:            runtime.NewFake(),
+		beadStores:    map[string]beads.Store{"alpha": rigStore},
+		cityBeadStore: cityStore,
+		cityName:      "city1",
+		cityPath:      cityDir,
+	}
+
+	next := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+	}
+	nextProvider := runtime.NewFake()
+	cs.updateFromRuntime(next, nextProvider, "")
+
+	if got := cs.BeadStore("alpha"); got != rigStore {
+		t.Fatalf("BeadStore(alpha) = %T %p, want original store %T %p", got, got, rigStore, rigStore)
+	}
+	if got := cs.CityBeadStore(); got != cityStore {
+		t.Fatalf("CityBeadStore() = %T %p, want original store %T %p", got, got, cityStore, cityStore)
+	}
+	if cs.Config() != next {
+		t.Fatal("Config() was not advanced to runtime snapshot")
+	}
+	if cs.SessionProvider() != nextProvider {
+		t.Fatal("SessionProvider() was not advanced to runtime provider")
+	}
+}
+
+func TestControllerStateRuntimeUpdateIgnoresStaleRevisionWithoutPendingMutation(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "alpha")
+	cityToml := fmt.Sprintf(`[workspace]
+name = "city1"
+
+[beads]
+provider = "file"
+
+[[rigs]]
+name = "alpha"
+path = %q
+prefix = "al"
+
+[[agent]]
+name = "worker"
+dir = "alpha"
+provider = "bash"
+`, rigDir)
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	current := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Beads:     config.BeadsConfig{Provider: "file"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+		Agents: []config.Agent{{Name: "worker", Dir: "alpha", Provider: "bash"}},
+	}
+	stale := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+		Beads:     config.BeadsConfig{Provider: "file"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+	}
+	originalProvider := runtime.NewFake()
+	cs := newControllerState(context.Background(), current, originalProvider, events.NewFake(), "city1", cityDir)
+
+	cs.updateFromRuntime(stale, runtime.NewFake(), "stale-rev")
+
+	if got := cs.Config(); got != current {
+		t.Fatalf("Config() = %+v, want current config with worker agent", got)
+	}
+	if cs.SessionProvider() != originalProvider {
+		t.Fatal("SessionProvider() advanced for stale runtime update")
+	}
+	if cs.configMutationPending.Load() {
+		t.Fatal("pending mutation marker set by stale runtime update")
+	}
+}
+
 func TestControllerStateCreateRigPokesReconciler(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 
@@ -167,6 +605,46 @@ func TestControllerStateCreateRigPokesReconciler(t *testing.T) {
 	}
 }
 
+func TestControllerStateCreateRigInitializesStoreBeforePublishing(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"city1\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	if err := ensureScopedFileStoreLayout(cityDir); err != nil {
+		t.Fatalf("enable scoped file store layout: %v", err)
+	}
+	if err := ensurePersistedScopeLocalFileStore(cityDir); err != nil {
+		t.Fatalf("init city store: %v", err)
+	}
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city1"},
+	}
+	cs := newControllerState(context.Background(), cfg, runtime.NewFake(), events.NewFake(), "city1", cityDir)
+
+	rigDir := filepath.Join(cityDir, "alpha")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatalf("mkdir rig: %v", err)
+	}
+	if err := cs.CreateRig(config.Rig{Name: "alpha", Path: rigDir, Prefix: "al"}); err != nil {
+		t.Fatalf("CreateRig: %v", err)
+	}
+
+	store := cs.BeadStore("alpha")
+	if store == nil {
+		t.Fatal("BeadStore(alpha) = nil")
+	}
+	created, err := store.Create(beads.Bead{Title: "first rig bead", Type: "task"})
+	if err != nil {
+		t.Fatalf("newly published rig store Create: %v", err)
+	}
+	if _, err := store.Get(created.ID); err != nil {
+		t.Fatalf("newly published rig store Get(%q): %v", created.ID, err)
+	}
+}
+
 func TestControllerStateMutationRollsBackWhenRefreshFails(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 
@@ -308,6 +786,133 @@ func TestControllerStateAppliesCacheReconcileBeadEventsToStores(t *testing.T) {
 	}
 }
 
+func TestControllerStateBeadEventsRespectStorePrefixes(t *testing.T) {
+	cityBacking := beads.NewMemStore()
+	rigBacking := beads.NewMemStore()
+	cityCache := beads.NewCachingStoreForTestWithPrefix(cityBacking, "mc", nil)
+	rigCache := beads.NewCachingStoreForTestWithPrefix(rigBacking, "ga", nil)
+	for name, cache := range map[string]*beads.CachingStore{
+		"city": cityCache,
+		"rig":  rigCache,
+	} {
+		if err := cache.Prime(context.Background()); err != nil {
+			t.Fatalf("Prime(%s): %v", name, err)
+		}
+	}
+
+	payload, err := json.Marshal(beads.Bead{
+		ID:     "mc-source",
+		Title:  "city source",
+		Status: "open",
+	})
+	if err != nil {
+		t.Fatalf("marshal city bead: %v", err)
+	}
+	cs := &controllerState{
+		cityBeadStore: cityCache,
+		beadStores:    map[string]beads.Store{"gascity": rigCache},
+		pokeCh:        make(chan struct{}, 1),
+	}
+
+	cs.applyBeadEventToStores(events.Event{
+		Type:    events.BeadCreated,
+		Actor:   "bd-hook",
+		Subject: "mc-source",
+		Payload: payload,
+	})
+
+	cityItems, err := cityCache.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("List city cache: %v", err)
+	}
+	if len(cityItems) != 1 || cityItems[0].ID != "mc-source" {
+		t.Fatalf("city cache items = %+v, want mc-source", cityItems)
+	}
+	rigItems, err := rigCache.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("List rig cache: %v", err)
+	}
+	if len(rigItems) != 0 {
+		t.Fatalf("rig cache items = %+v, want no city bead", rigItems)
+	}
+
+	payload, err = json.Marshal(beads.Bead{
+		ID:     "ga-rig",
+		Title:  "rig work",
+		Status: "open",
+	})
+	if err != nil {
+		t.Fatalf("marshal rig bead: %v", err)
+	}
+
+	cs.applyBeadEventToStores(events.Event{
+		Type:    events.BeadCreated,
+		Actor:   "bd-hook",
+		Subject: "ga-rig",
+		Payload: payload,
+	})
+
+	cityItems, err = cityCache.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("List city cache after rig event: %v", err)
+	}
+	if len(cityItems) != 1 || cityItems[0].ID != "mc-source" {
+		t.Fatalf("city cache items after rig event = %+v, want only mc-source", cityItems)
+	}
+	rigItems, err = rigCache.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("List rig cache after rig event: %v", err)
+	}
+	if len(rigItems) != 1 || rigItems[0].ID != "ga-rig" {
+		t.Fatalf("rig cache items after rig event = %+v, want ga-rig", rigItems)
+	}
+}
+
+func TestControllerStateBeadEventsUseScopePrefixWhenConfiguredPrefixDrifts(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "rigs", "repo")
+	if err := os.MkdirAll(filepath.Join(rigDir, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(rigDir, ".beads", "config.yaml"), []byte("issue_prefix: repo\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Rigs: []config.Rig{{Name: "repo", Path: "rigs/repo", Prefix: "ga"}}}
+	bdStore := bdStoreForRig(rigDir, cityDir, cfg, cfg.Rigs[0].EffectivePrefix())
+	rigCache := beads.NewCachingStoreForTestWithPrefix(beads.NewMemStore(), bdStore.IDPrefix(), nil)
+	if err := rigCache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime rig cache: %v", err)
+	}
+
+	payload, err := json.Marshal(beads.Bead{
+		ID:     "repo-owned",
+		Title:  "rig-owned work",
+		Status: "open",
+	})
+	if err != nil {
+		t.Fatalf("marshal rig bead: %v", err)
+	}
+	cs := &controllerState{
+		beadStores: map[string]beads.Store{"repo": rigCache},
+		pokeCh:     make(chan struct{}, 1),
+	}
+
+	cs.applyBeadEventToStores(events.Event{
+		Type:    events.BeadCreated,
+		Actor:   "bd-hook",
+		Subject: "repo-owned",
+		Payload: payload,
+	})
+
+	rigItems, err := rigCache.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("List rig cache: %v", err)
+	}
+	if len(rigItems) != 1 || rigItems[0].ID != "repo-owned" {
+		t.Fatalf("rig cache items = %+v, want repo-owned", rigItems)
+	}
+}
+
 func TestControllerStateBuildStoresUsesScopeLocalFileStores(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 
@@ -365,6 +970,80 @@ func TestControllerStateBuildStoresUsesScopeLocalFileStores(t *testing.T) {
 	}
 }
 
+func TestControllerStateAppliesBeadEventsOnlyToOwningCache(t *testing.T) {
+	cityBacking := beads.NewMemStore()
+	rigBacking := beads.NewMemStore()
+	cityStore := beads.NewCachingStoreForTest(cityBacking, nil)
+	rigStore := beads.NewCachingStoreForTest(rigBacking, nil)
+	if err := cityStore.Prime(context.Background()); err != nil {
+		t.Fatalf("city Prime: %v", err)
+	}
+	if err := rigStore.Prime(context.Background()); err != nil {
+		t.Fatalf("rig Prime: %v", err)
+	}
+
+	cs := &controllerState{
+		cfg: &config.City{
+			Workspace: config.Workspace{Name: "test-city", Prefix: "ct"},
+			Rigs:      []config.Rig{{Name: "rig1", Prefix: "rw"}},
+		},
+		cityName:      "test-city",
+		cityBeadStore: cityStore,
+		beadStores:    map[string]beads.Store{"rig1": rigStore},
+	}
+
+	cs.applyBeadEventToStores(events.Event{
+		Type:    events.BeadCreated,
+		Subject: "rw-1",
+		Payload: json.RawMessage(`{"id":"rw-1","title":"rig bead","status":"open","issue_type":"task","created_at":"2026-04-26T21:37:46Z"}`),
+	})
+
+	if _, err := cityStore.Get("rw-1"); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("city cache Get(rw-1) error = %v, want ErrNotFound", err)
+	}
+	if got, err := rigStore.Get("rw-1"); err != nil {
+		t.Fatalf("rig cache Get(rw-1): %v", err)
+	} else if got.Title != "rig bead" {
+		t.Fatalf("rig cache title = %q, want rig bead", got.Title)
+	}
+}
+
+func TestControllerStateAppliesHyphenatedPrefixEventsOnlyToOwningCache(t *testing.T) {
+	cityStore := beads.NewCachingStoreForTest(beads.NewMemStore(), nil)
+	rigStore := beads.NewCachingStoreForTest(beads.NewMemStore(), nil)
+	if err := cityStore.Prime(context.Background()); err != nil {
+		t.Fatalf("city Prime: %v", err)
+	}
+	if err := rigStore.Prime(context.Background()); err != nil {
+		t.Fatalf("rig Prime: %v", err)
+	}
+
+	cs := &controllerState{
+		cfg: &config.City{
+			Workspace: config.Workspace{Name: "test-city", Prefix: "mlcm"},
+			Rigs:      []config.Rig{{Name: "rig1", Prefix: "mc-mogbzvrs"}},
+		},
+		cityName:      "test-city",
+		cityBeadStore: cityStore,
+		beadStores:    map[string]beads.Store{"rig1": rigStore},
+	}
+
+	cs.applyBeadEventToStores(events.Event{
+		Type:    events.BeadCreated,
+		Subject: "mc-mogbzvrs-hiv.1",
+		Payload: json.RawMessage(`{"id":"mc-mogbzvrs-hiv.1","title":"rig bead","status":"open","issue_type":"task","created_at":"2026-04-26T21:37:46Z"}`),
+	})
+
+	if _, err := cityStore.Get("mc-mogbzvrs-hiv.1"); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("city cache Get(hyphenated rig bead) error = %v, want ErrNotFound", err)
+	}
+	if got, err := rigStore.Get("mc-mogbzvrs-hiv.1"); err != nil {
+		t.Fatalf("rig cache Get(hyphenated rig bead): %v", err)
+	} else if got.Title != "rig bead" {
+		t.Fatalf("rig cache title = %q, want rig bead", got.Title)
+	}
+}
+
 func TestControllerStateBuildStoresFileStoresUseLockFiles(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 
@@ -582,7 +1261,7 @@ func TestControllerStateOpenRigStoreFileOpenErrorDoesNotFallbackToBd(t *testing.
 	}
 
 	cs := &controllerState{cityPath: cityDir}
-	store := cs.openRigStore("file", "rig1", rigDir, "rg")
+	store := cs.openRigStore("file", "rig1", rigDir, "rg", nil)
 	if _, ok := store.(*beads.BdStore); ok {
 		t.Fatalf("openRigStore returned %T, want file-open failure instead of bd fallback", store)
 	}
@@ -1320,6 +1999,62 @@ func TestBuildStores_ExecProviderSetsPerRigEnv(t *testing.T) {
 	}
 }
 
+func TestBuildStoresBdProviderUsesPassedConfigForRigEnv(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "alpha")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	capturePath := filepath.Join(t.TempDir(), "bd.env")
+	binDir := t.TempDir()
+	fakeBD := filepath.Join(binDir, "bd")
+	script := "#!/bin/sh\n" +
+		"printf 'GC_RIG=%s\\nGC_RIG_ROOT=%s\\nBEADS_DIR=%s\\n' \"${GC_RIG:-}\" \"${GC_RIG_ROOT:-}\" \"${BEADS_DIR:-}\" > \"$BD_ENV_CAPTURE\"\n" +
+		"printf '[]\\n'\n"
+	if err := os.WriteFile(fakeBD, []byte(script), 0o755); err != nil {
+		t.Fatalf("write fake bd: %v", err)
+	}
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("BD_ENV_CAPTURE", capturePath)
+	t.Setenv("GC_BEADS", "bd")
+
+	staleCfg := &config.City{Workspace: config.Workspace{Name: "test-city"}}
+	nextCfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs: []config.Rig{{
+			Name:   "alpha",
+			Path:   rigDir,
+			Prefix: "al",
+		}},
+	}
+	cs := &controllerState{
+		cfg:      staleCfg,
+		cityName: "test-city",
+		cityPath: cityDir,
+	}
+
+	stores := cs.buildStores(nextCfg)
+	if stores["alpha"] == nil {
+		t.Fatal("buildStores did not create alpha store")
+	}
+
+	data, err := os.ReadFile(capturePath)
+	if err != nil {
+		t.Fatalf("read captured bd env: %v", err)
+	}
+	env := string(data)
+	if !strings.Contains(env, "GC_RIG=alpha\n") {
+		t.Fatalf("captured env missing GC_RIG=alpha; got:\n%s", env)
+	}
+	if !strings.Contains(env, "GC_RIG_ROOT="+rigDir+"\n") {
+		t.Fatalf("captured env missing rig root %q; got:\n%s", rigDir, env)
+	}
+	if !strings.Contains(env, "BEADS_DIR="+filepath.Join(rigDir, ".beads")+"\n") {
+		t.Fatalf("captured env missing rig BEADS_DIR; got:\n%s", env)
+	}
+}
+
 // Verify controllerState satisfies the api.State interface at compile time.
 // This uses a blank import check, not an explicit runtime assertion.
 var _ interface {
diff --git a/cmd/gc/assigned_work_scope.go b/cmd/gc/assigned_work_scope.go
new file mode 100644
index 0000000000..dee5a2aa4b
--- /dev/null
+++ b/cmd/gc/assigned_work_scope.go
@@ -0,0 +1,156 @@
+package main
+
+import (
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func assignedWorkStoreRefForAgent(cityPath string, cfg *config.City, agentCfg *config.Agent) string {
+	if cfg == nil || agentCfg == nil {
+		return ""
+	}
+	return configuredRigName(cityPath, agentCfg, cfg.Rigs)
+}
+
+func assignedWorkIndexReachableFromAgent(cityPath string, cfg *config.City, agentCfg *config.Agent, storeRefs []string, index int) bool {
+	if len(storeRefs) == 0 {
+		return true
+	}
+	if index < 0 || index >= len(storeRefs) {
+		return false
+	}
+	return storeRefs[index] == assignedWorkStoreRefForAgent(cityPath, cfg, agentCfg)
+}
+
+func filterAssignedWorkBeadsForPoolDemand(
+	cfg *config.City,
+	cityPath string,
+	sessionBeads []beads.Bead,
+	assignedWorkBeads []beads.Bead,
+	assignedWorkStoreRefs []string,
+) []beads.Bead {
+	if len(assignedWorkBeads) == 0 || len(assignedWorkStoreRefs) == 0 {
+		return assignedWorkBeads
+	}
+	if cfg == nil {
+		return assignedWorkBeads
+	}
+	assigneeToSessionBeadID := make(map[string]string)
+	sessionBeadTemplate := make(map[string]string)
+	for _, sb := range sessionBeads {
+		if sb.Status == "closed" {
+			continue
+		}
+		template := normalizedSessionTemplate(sb, cfg)
+		if template == "" {
+			template = strings.TrimSpace(sb.Metadata["template"])
+		}
+		if template != "" {
+			sessionBeadTemplate[sb.ID] = template
+		}
+		assigneeToSessionBeadID[sb.ID] = sb.ID
+		if sessionName := strings.TrimSpace(sb.Metadata["session_name"]); sessionName != "" {
+			assigneeToSessionBeadID[sessionName] = sb.ID
+		}
+		if identity := strings.TrimSpace(sb.Metadata["configured_named_identity"]); identity != "" {
+			assigneeToSessionBeadID[identity] = sb.ID
+		}
+	}
+	filtered := make([]beads.Bead, 0, len(assignedWorkBeads))
+	for i, wb := range assignedWorkBeads {
+		template := strings.TrimSpace(wb.Metadata["gc.routed_to"])
+		if template == "" {
+			if sessionBeadID := assigneeToSessionBeadID[strings.TrimSpace(wb.Assignee)]; sessionBeadID != "" {
+				template = sessionBeadTemplate[sessionBeadID]
+				if template == "" && len(cfg.Agents) == 1 {
+					template = cfg.Agents[0].QualifiedName()
+				}
+			}
+		}
+		if template == "" {
+			continue
+		}
+		agentCfg := findAgentByTemplate(cfg, template)
+		if agentCfg == nil {
+			continue
+		}
+		if assignedWorkIndexReachableFromAgent(cityPath, cfg, agentCfg, assignedWorkStoreRefs, i) {
+			filtered = append(filtered, wb)
+		}
+	}
+	return filtered
+}
+
+func filterAssignedWorkBeadsForSessionWake(
+	cfg *config.City,
+	cityPath string,
+	sessionBeads []beads.Bead,
+	assignedWorkBeads []beads.Bead,
+	assignedWorkStoreRefs []string,
+) []beads.Bead {
+	if len(assignedWorkBeads) == 0 || len(assignedWorkStoreRefs) == 0 {
+		return assignedWorkBeads
+	}
+	if cfg == nil {
+		return assignedWorkBeads
+	}
+	reachableRefsByAssignee := make(map[string]map[string]struct{})
+	add := func(identifier, storeRef string) {
+		identifier = strings.TrimSpace(identifier)
+		if identifier == "" {
+			return
+		}
+		refs := reachableRefsByAssignee[identifier]
+		if refs == nil {
+			refs = make(map[string]struct{})
+			reachableRefsByAssignee[identifier] = refs
+		}
+		refs[storeRef] = struct{}{}
+	}
+
+	for i := range cfg.NamedSessions {
+		identity := cfg.NamedSessions[i].QualifiedName()
+		spec, ok := findNamedSessionSpec(cfg, "", identity)
+		if !ok {
+			continue
+		}
+		add(identity, assignedWorkStoreRefForAgent(cityPath, cfg, spec.Agent))
+	}
+	for _, sb := range sessionBeads {
+		if sb.Status == "closed" {
+			continue
+		}
+		template := normalizedSessionTemplate(sb, cfg)
+		if template == "" {
+			template = strings.TrimSpace(sb.Metadata["template"])
+		}
+		agentCfg := findAgentByTemplate(cfg, template)
+		if agentCfg == nil {
+			continue
+		}
+		storeRef := assignedWorkStoreRefForAgent(cityPath, cfg, agentCfg)
+		add(sb.ID, storeRef)
+		add(sb.Metadata["session_name"], storeRef)
+		add(sb.Metadata["configured_named_identity"], storeRef)
+		add(template, storeRef)
+	}
+
+	filtered := make([]beads.Bead, 0, len(assignedWorkBeads))
+	for i, wb := range assignedWorkBeads {
+		if i >= len(assignedWorkStoreRefs) {
+			continue
+		}
+		assignee := strings.TrimSpace(wb.Assignee)
+		if assignee == "" {
+			continue
+		}
+		if refs := reachableRefsByAssignee[assignee]; refs != nil {
+			if _, ok := refs[assignedWorkStoreRefs[i]]; ok {
+				filtered = append(filtered, wb)
+			}
+		}
+	}
+	return filtered
+}
diff --git a/cmd/gc/assigned_work_scope_test.go b/cmd/gc/assigned_work_scope_test.go
new file mode 100644
index 0000000000..9c57fc24b9
--- /dev/null
+++ b/cmd/gc/assigned_work_scope_test.go
@@ -0,0 +1,168 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+func TestFilterAssignedWorkBeadsForSessionWakeKeepsOnlyReachableAssigneeSources(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "riga")
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "riga", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name: "worker",
+			Dir:  "riga",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "worker",
+			Dir:      "riga",
+			Mode:     "on_demand",
+		}},
+	}
+	sessions := []beads.Bead{{
+		ID:     "session-1",
+		Status: "open",
+		Type:   sessionBeadType,
+		Metadata: map[string]string{
+			"template":                  "riga/worker",
+			"session_name":              "worker-session",
+			"configured_named_identity": "riga/worker",
+		},
+	}}
+	work := []beads.Bead{
+		{ID: "city-named", Status: "open", Assignee: "riga/worker"},
+		{ID: "rig-named", Status: "open", Assignee: "riga/worker"},
+		{ID: "city-session", Status: "in_progress", Assignee: "session-1"},
+		{ID: "rig-session", Status: "in_progress", Assignee: "session-1"},
+	}
+	storeRefs := []string{"", "riga", "", "riga"}
+
+	got := filterAssignedWorkBeadsForSessionWake(cfg, cityPath, sessions, work, storeRefs)
+
+	if len(got) != 2 {
+		t.Fatalf("filtered work length = %d, want 2: %#v", len(got), got)
+	}
+	if got[0].ID != "rig-named" || got[1].ID != "rig-session" {
+		t.Fatalf("filtered work IDs = [%s %s], want [rig-named rig-session]", got[0].ID, got[1].ID)
+	}
+}
+
+func TestFilterAssignedWorkBeadsForPoolDemandKeepsDirectAssigneeAfterTemplateFallback(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name: "worker",
+		}},
+	}
+	sessions := []beads.Bead{{
+		ID:     "session-1",
+		Status: "open",
+		Type:   sessionBeadType,
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "worker-session",
+		},
+	}}
+	work := []beads.Bead{{
+		ID:       "direct-assigned",
+		Status:   "in_progress",
+		Assignee: "session-1",
+		Metadata: map[string]string{},
+	}}
+
+	got := filterAssignedWorkBeadsForPoolDemand(cfg, "", sessions, work, []string{""})
+
+	if len(got) != 1 || got[0].ID != "direct-assigned" {
+		t.Fatalf("filtered work = %#v, want direct-assigned work preserved through template fallback", got)
+	}
+}
+
+func TestFilterAssignedWorkBeadsForPoolDemandDropsDirectAssigneeFromUnreachableStore(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "riga")
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "riga", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name: "worker",
+		}},
+	}
+	sessions := []beads.Bead{{
+		ID:     "session-1",
+		Status: "open",
+		Type:   sessionBeadType,
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "worker-session",
+		},
+	}}
+	work := []beads.Bead{{
+		ID:       "rig-direct-assigned",
+		Status:   "in_progress",
+		Assignee: "session-1",
+		Metadata: map[string]string{},
+	}}
+
+	got := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessions, work, []string{"riga"})
+
+	if len(got) != 0 {
+		t.Fatalf("filtered work = %#v, want unreachable rig-store direct assignment dropped", got)
+	}
+}
+
+func TestSessionHasOpenAssignedWorkUsesOnlyReachableStore(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "riga")
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "riga", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name: "worker",
+			Dir:  "riga",
+		}},
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	session := beads.Bead{
+		ID:     "session-1",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"template":     "riga/worker",
+			"session_name": "worker-session",
+		},
+	}
+	if _, err := cityStore.Create(beads.Bead{
+		ID:       "city-work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	}); err != nil {
+		t.Fatalf("Create city work: %v", err)
+	}
+
+	has, err := sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, cityStore, map[string]beads.Store{"riga": rigStore}, session)
+	if err != nil {
+		t.Fatalf("sessionHasOpenAssignedWorkForReachableStore: %v", err)
+	}
+	if has {
+		t.Fatal("city-store assigned work should not count for a rig-scoped session")
+	}
+
+	if _, err := rigStore.Create(beads.Bead{
+		ID:       "rig-work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	}); err != nil {
+		t.Fatalf("Create rig work: %v", err)
+	}
+	has, err = sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, cityStore, map[string]beads.Store{"riga": rigStore}, session)
+	if err != nil {
+		t.Fatalf("sessionHasOpenAssignedWorkForReachableStore: %v", err)
+	}
+	if !has {
+		t.Fatal("rig-store assigned work should count for a rig-scoped session")
+	}
+}
diff --git a/cmd/gc/bd_env.go b/cmd/gc/bd_env.go
index 5136317722..823b9b0f68 100644
--- a/cmd/gc/bd_env.go
+++ b/cmd/gc/bd_env.go
@@ -3,6 +3,7 @@ package main
 import (
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"sort"
@@ -13,6 +14,7 @@ import (
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/doltauth"
+	"github.com/gastownhall/gascity/internal/execenv"
 	"github.com/gastownhall/gascity/internal/fsys"
 )
 
@@ -29,17 +31,99 @@ func bdCommandRunnerForCity(cityPath string) beads.CommandRunner {
 }
 
 func bdStoreForCity(dir, cityPath string) *beads.BdStore {
-	return beads.NewBdStore(dir, bdCommandRunnerForCity(cityPath))
+	cfg, err := loadCityConfig(cityPath, io.Discard)
+	if err != nil {
+		cfg = nil
+	}
+	return beads.NewBdStoreWithPrefix(dir, bdCommandRunnerForCity(cityPath), issuePrefixForScope(dir, cityPath, cfg))
 }
 
 // bdStoreForRig opens a bead store at rigDir using rig-level Dolt config
 // when available, falling back to city-level config. Use this when the rig
 // may have its own Dolt server (e.g., shared from another city).
-func bdStoreForRig(rigDir, cityPath string, cfg *config.City) *beads.BdStore {
-	return beads.NewBdStore(rigDir, bdCommandRunnerWithManagedRetry(cityPath, func(_ string) map[string]string {
+func bdStoreForRig(rigDir, cityPath string, cfg *config.City, knownPrefix ...string) *beads.BdStore {
+	prefix := issuePrefixForScope(rigDir, cityPath, cfg)
+	if prefix == "" {
+		for _, candidate := range knownPrefix {
+			if strings.TrimSpace(candidate) != "" {
+				prefix = candidate
+				break
+			}
+		}
+	}
+	return beads.NewBdStoreWithPrefix(rigDir, bdCommandRunnerForRig(cityPath, cfg, rigDir), prefix)
+}
+
+func controlBdStoreForCity(dir, cityPath string, cfg *config.City) *beads.BdStore {
+	return beads.NewBdStoreWithPrefix(dir, controlBdCommandRunnerForCity(cityPath), issuePrefixForScope(dir, cityPath, cfg))
+}
+
+func controlBdStoreForRig(rigDir, cityPath string, cfg *config.City, knownPrefix ...string) *beads.BdStore {
+	prefix := issuePrefixForScope(rigDir, cityPath, cfg)
+	if prefix == "" {
+		for _, candidate := range knownPrefix {
+			if strings.TrimSpace(candidate) != "" {
+				prefix = candidate
+				break
+			}
+		}
+	}
+	return beads.NewBdStoreWithPrefix(rigDir, controlBdCommandRunnerForRig(cityPath, cfg, rigDir), prefix)
+}
+
+func controlBdCommandRunnerForCity(cityPath string) beads.CommandRunner {
+	return bdCommandRunnerWithManagedRetry(cityPath, func(dir string) map[string]string {
+		env := bdRuntimeEnv(cityPath)
+		env["BEADS_DIR"] = filepath.Join(dir, ".beads")
+		applyControlBdEnv(env)
+		return env
+	})
+}
+
+func controlBdCommandRunnerForRig(cityPath string, cfg *config.City, rigDir string) beads.CommandRunner {
+	return bdCommandRunnerWithManagedRetry(cityPath, func(_ string) map[string]string {
 		env := bdRuntimeEnvForRig(cityPath, cfg, rigDir)
+		applyControlBdEnv(env)
 		return env
-	}))
+	})
+}
+
+func applyControlBdEnv(env map[string]string) {
+	env["BD_EXPORT_AUTO"] = "false"
+}
+
+func issuePrefixForScope(scopeRoot, cityPath string, cfg *config.City) string {
+	if prefix := readScopeIssuePrefix(scopeRoot); prefix != "" {
+		return prefix
+	}
+	if cfg == nil {
+		return ""
+	}
+	scopeRoot = filepath.Clean(scopeRoot)
+	if filepath.Clean(cityPath) == scopeRoot {
+		return config.EffectiveHQPrefix(cfg)
+	}
+	for i := range cfg.Rigs {
+		rigPath := resolveStoreScopeRoot(cityPath, cfg.Rigs[i].Path)
+		if filepath.Clean(rigPath) == scopeRoot {
+			return cfg.Rigs[i].EffectivePrefix()
+		}
+	}
+	return ""
+}
+
+func readScopeIssuePrefix(scopeRoot string) string {
+	prefix, ok, err := contract.ReadIssuePrefix(fsys.OSFS{}, filepath.Join(scopeRoot, ".beads", "config.yaml"))
+	if err != nil || !ok {
+		return ""
+	}
+	return prefix
+}
+
+func bdCommandRunnerForRig(cityPath string, cfg *config.City, rigDir string) beads.CommandRunner {
+	return bdCommandRunnerWithManagedRetry(cityPath, func(_ string) map[string]string {
+		return bdRuntimeEnvForRig(cityPath, cfg, rigDir)
+	})
 }
 
 func canonicalScopeDoltTarget(cityPath, scopeRoot string) (contract.DoltConnectionTarget, bool, error) {
@@ -152,7 +236,7 @@ var beadsExecCommandRunnerWithEnv = beads.ExecCommandRunnerWithEnv
 
 var recoverManagedBDCommand = func(cityPath string) error {
 	script := gcBeadsBdScriptPath(cityPath)
-	overrides := citylayout.CityRuntimeEnvMap(cityPath)
+	overrides := cityRuntimeEnvMapForCity(cityPath)
 	setProjectedDoltEnvEmpty(overrides)
 	environ := mergeRuntimeEnv(os.Environ(), overrides)
 	environ = append(environ, providerLifecycleDoltPathEnv(cityPath)...)
@@ -426,29 +510,12 @@ func bdRuntimeEnv(cityPath string) map[string]string {
 }
 
 func cityRuntimeEnvMapForCity(cityPath string) map[string]string {
-	env := citylayout.CityRuntimeEnvMap(cityPath)
-	if runtimeDir := trustedAmbientCityRuntimeDir(cityPath); runtimeDir != "" {
-		env["GC_CITY_RUNTIME_DIR"] = runtimeDir
-	}
-	return env
-}
-
-func trustedAmbientCityRuntimeDir(cityPath string) string {
-	runtimeDir := strings.TrimSpace(os.Getenv("GC_CITY_RUNTIME_DIR"))
-	if runtimeDir == "" {
-		return ""
-	}
-	for _, key := range []string{"GC_CITY_PATH", "GC_CITY"} {
-		if samePath(strings.TrimSpace(os.Getenv(key)), cityPath) {
-			return normalizePathForCompare(runtimeDir)
-		}
-	}
-	return ""
+	return citylayout.CityRuntimeEnvMapForRuntimeDir(cityPath, citylayout.TrustedAmbientCityRuntimeDir(cityPath))
 }
 
 func cityRuntimeProcessEnv(cityPath string) []string {
 	cityPath = normalizePathForCompare(cityPath)
-	overrides := citylayout.CityRuntimeEnvMap(cityPath)
+	overrides := cityRuntimeEnvMapForCity(cityPath)
 	if cityUsesBdStoreContract(cityPath) {
 		source := map[string]string{"BEADS_DOLT_AUTO_START": "0"}
 		if err := applyResolvedCityDoltEnv(source, cityPath, false); err != nil {
@@ -516,7 +583,7 @@ func cityForStoreDir(dir string) string {
 }
 
 func overlayEnvEntries(environ []string, overrides map[string]string) []string {
-	out := append([]string(nil), environ...)
+	out := execenv.FilterInherited(environ)
 	if len(overrides) == 0 {
 		return out
 	}
@@ -569,7 +636,7 @@ func mergeRuntimeEnv(environ []string, overrides map[string]string) []string {
 		}
 	}
 	sort.Strings(keys)
-	out := append([]string(nil), environ...)
+	out := execenv.FilterInherited(environ)
 	for _, key := range keys {
 		out = removeEnvKey(out, key)
 	}
diff --git a/cmd/gc/bd_env_test.go b/cmd/gc/bd_env_test.go
index 40da22e269..6ce644f0ae 100644
--- a/cmd/gc/bd_env_test.go
+++ b/cmd/gc/bd_env_test.go
@@ -32,6 +32,75 @@ func TestCityRuntimeProcessEnvStripsAmbientGCDolt(t *testing.T) {
 	}
 }
 
+func TestBdStoreForCityResolvesIDPrefixFromScopeConfig(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityDir, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(`[workspace]
+name = "Metro City"
+prefix = "mc"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, ".beads", "config.yaml"), []byte("issue_prefix: hq\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	store := bdStoreForCity(cityDir, cityDir)
+	if got := store.IDPrefix(); got != "hq" {
+		t.Fatalf("IDPrefix() = %q, want hq", got)
+	}
+}
+
+func TestBdStoreForRigResolvesIDPrefixFromScopeConfig(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "rigs", "repo")
+	if err := os.MkdirAll(filepath.Join(rigDir, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(rigDir, ".beads", "config.yaml"), []byte("issue_prefix: repo\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Rigs: []config.Rig{{Name: "repo", Path: "rigs/repo", Prefix: "ga"}}}
+
+	store := bdStoreForRig(rigDir, cityDir, cfg)
+	if got := store.IDPrefix(); got != "repo" {
+		t.Fatalf("IDPrefix() = %q, want repo", got)
+	}
+}
+
+func TestBdStoreForRigPrefersScopeConfigOverKnownPrefix(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "rigs", "repo")
+	if err := os.MkdirAll(filepath.Join(rigDir, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(rigDir, ".beads", "config.yaml"), []byte("issue_prefix: repo\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Rigs: []config.Rig{{Name: "repo", Path: "rigs/repo", Prefix: "ga"}}}
+
+	store := bdStoreForRig(rigDir, cityDir, cfg, "stale")
+	if got := store.IDPrefix(); got != "repo" {
+		t.Fatalf("IDPrefix() = %q, want repo", got)
+	}
+}
+
+func TestBdStoreForRigFallsBackToConfiguredEffectivePrefix(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "rigs", "repo")
+	if err := os.MkdirAll(rigDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Rigs: []config.Rig{{Name: "repo", Path: "rigs/repo", Prefix: "ga"}}}
+
+	store := bdStoreForRig(rigDir, cityDir, cfg)
+	if got := store.IDPrefix(); got != "ga" {
+		t.Fatalf("IDPrefix() = %q, want ga", got)
+	}
+}
+
 func TestBdRuntimeEnvIncludesDoltHost(t *testing.T) {
 	t.Setenv("GC_BEADS", "bd")
 	t.Setenv("GC_DOLT_HOST", "mini2.hippo-tilapia.ts.net")
diff --git a/cmd/gc/bd_testscript_test.go b/cmd/gc/bd_testscript_test.go
index 56d6dd13d0..91c6919331 100644
--- a/cmd/gc/bd_testscript_test.go
+++ b/cmd/gc/bd_testscript_test.go
@@ -63,6 +63,12 @@ func bdTestCmd() {
 		code = doBdShow(store, rest)
 	case "ready":
 		code = doBdReady(store, rest)
+	case "init", "config", "migrate":
+		// No-op stubs used by gc-beads-bd.sh during finalize. The
+		// file-backed store does not need schema seeding, so accept
+		// these and exit 0 to keep finalize green for tests that
+		// exercise the real localInitializer + finalizeInit path.
+		code = 0
 	default:
 		fmt.Fprintf(os.Stderr, "bd: unknown subcommand %q\n", subcmd)
 		code = 1
diff --git a/cmd/gc/beads_provider_lifecycle.go b/cmd/gc/beads_provider_lifecycle.go
index f7ce2f6284..fd1a72f61d 100644
--- a/cmd/gc/beads_provider_lifecycle.go
+++ b/cmd/gc/beads_provider_lifecycle.go
@@ -30,6 +30,26 @@ import (
 // break supervisor multi-tenancy where multiple cities share one process).
 var cityDoltConfigs sync.Map // cityPath → config.DoltConfig
 
+// providerOpSemaphores limits concurrent provider operations per city.
+// When dolt goes down, health checks and recovery attempts from multiple
+// callers can pile up. Without backpressure, all queued operations fire
+// simultaneously when dolt restarts, causing a thundering herd that
+// hammers the server back down. Each semaphore allows at most 1
+// concurrent provider operation per city (serialize lifecycle ops).
+var providerOpSemaphores sync.Map // cityPath → chan struct{}
+
+func cityDoltConfigHasLifecycleFields(cfg config.DoltConfig) bool {
+	return cfg.Host != "" || cfg.Port != 0 || cfg.ArchiveLevel != nil
+}
+
+func registerCityDoltConfig(cityPath string, cfg config.DoltConfig) {
+	cityDoltConfigs.Store(normalizePathForCompare(cityPath), cfg)
+}
+
+func clearCityDoltConfig(cityPath string) {
+	cityDoltConfigs.Delete(normalizePathForCompare(cityPath))
+}
+
 var resolveProviderLifecycleGCBinary = func() string {
 	if isTestBinary() {
 		return ""
@@ -47,6 +67,7 @@ var (
 	initDirIfReadyEnsureBeadsProvider = ensureBeadsProvider
 	initDirIfReadyInitAndHookDir      = initAndHookDir
 	initDirIfReadyRetryDelay          = time.Second
+	initAndHookDirWaitForScopeReady   = waitForBeadsScopeReadyAfterRecovery
 )
 
 const initDirIfReadyRetryLimit = 2
@@ -58,7 +79,9 @@ func isRetryableManagedDoltLifecycleError(err error) bool {
 	msg := strings.ToLower(err.Error())
 	return strings.Contains(msg, "dolt server exited during startup") ||
 		strings.Contains(msg, "did not become query-ready") ||
-		strings.Contains(msg, "signal: terminated")
+		strings.Contains(msg, "signal: terminated") ||
+		strings.Contains(msg, "table not found: issues") ||
+		strings.Contains(msg, "table not found: config")
 }
 
 // ── Consolidated lifecycle operations ────────────────────────────────────
@@ -91,10 +114,10 @@ func startBeadsLifecycle(cityPath, _ string, cfg *config.City, _ io.Writer) erro
 	// registration point — supervisor, standalone, and reload all flow
 	// through here. Always write (or clear) to handle config reload:
 	// removing [dolt] after a reload must not leave stale entries.
-	if cfg.Dolt.Host != "" || cfg.Dolt.Port != 0 {
-		cityDoltConfigs.Store(cityPath, cfg.Dolt)
+	if cityDoltConfigHasLifecycleFields(cfg.Dolt) {
+		registerCityDoltConfig(cityPath, cfg.Dolt)
 	} else {
-		cityDoltConfigs.Delete(cityPath)
+		clearCityDoltConfig(cityPath)
 	}
 	// Skip local Dolt startup only when canonical or compatibility topology
 	// says the city endpoint is external. Managed-local cities may not have a
@@ -218,6 +241,7 @@ func desiredScopeDoltConfigStateForInit(cityPath, dir, prefix string) (contract.
 	if strings.TrimSpace(dir) == "" || strings.TrimSpace(prefix) == "" {
 		return contract.ConfigState{}, false, nil
 	}
+	cityPath = normalizePathForCompare(cityPath)
 	cityDolt := config.DoltConfig{}
 	if cfg, err := loadCityConfig(cityPath, io.Discard); err == nil {
 		resolveRigPaths(cityPath, cfg.Rigs)
@@ -319,7 +343,8 @@ func defaultScopeDoltDatabase(cityPath, dir, prefix string) string {
 }
 
 func isReservedManagedDoltDatabase(name string) bool {
-	return strings.EqualFold(strings.TrimSpace(name), managedDoltProbeDatabase)
+	_, ok := managedDoltSystemDatabases[strings.ToLower(strings.TrimSpace(name))]
+	return ok
 }
 
 func canonicalScopeDoltDatabase(cityPath, dir, prefix string) string {
@@ -363,6 +388,14 @@ func initAndHookDir(cityPath, dir, prefix string) error {
 	if err := normalizeCanonicalBdScopeFilesForInit(cityPath, dir, prefix, doltDatabase); err != nil {
 		return err
 	}
+	if cityUsesBdStoreContract(cityPath) && currentManagedDoltPort(cityPath) != "" {
+		if err := syncManagedDoltPortMirrors(cityPath); err != nil {
+			return fmt.Errorf("sync managed dolt port mirrors after init: %w", err)
+		}
+		if err := initAndHookDirWaitForScopeReady(dir, cityPath, time.Now().Add(10*time.Second)); err != nil {
+			return fmt.Errorf("waiting for initialized bead scope readiness: %w", err)
+		}
+	}
 	// Non-fatal: hooks are convenience (event forwarding), not critical.
 	if err := installBeadHooks(dir); err != nil {
 		return fmt.Errorf("install hooks at %s: %w", dir, err)
@@ -370,6 +403,13 @@ func initAndHookDir(cityPath, dir, prefix string) error {
 	return nil
 }
 
+func shouldRetryExecBdInit(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), "bd schema not visible")
+}
+
 // resolveRigPaths resolves relative rig paths to absolute (relative to
 // cityPath). Mutates rigs in place. Must be called after loading city config
 // and before any access to rigs[i].Path for filesystem operations. Required
@@ -395,12 +435,20 @@ func resolveRigPaths(cityPath string, rigs []config.Rig) {
 
 // ensureBeadsProvider starts the bead store's backing service if needed.
 // For exec providers, fires "start". For file providers, always available.
+// Acquires a per-city semaphore to prevent concurrent start operations
+// from causing spawn storms.
 func ensureBeadsProvider(cityPath string) error {
 	if cityUsesBdStoreContract(cityPath) && strings.TrimSpace(os.Getenv("GC_DOLT")) == "skip" {
 		return nil
 	}
 	provider := beadsProvider(cityPath)
 	if strings.HasPrefix(provider, "exec:") {
+		release, err := acquireProviderSemaphoreForOp(cityPath, "start")
+		if err != nil {
+			return err
+		}
+		defer release()
+
 		script := strings.TrimPrefix(provider, "exec:")
 		managedBDProvider := samePath(script, gcBeadsBdScriptPath(cityPath))
 		if err := runProviderOpWithEnv(script, providerLifecycleProcessEnv(cityPath, provider), "start"); err != nil {
@@ -450,6 +498,13 @@ func shutdownBeadsProvider(cityPath string) error {
 // initBeadsForDir initializes bead store infrastructure in a directory.
 // Idempotent — skips if already initialized. Callers should use
 // initAndHookDir instead to ensure hooks are installed afterward.
+//
+// Every load-bearing exec path that invokes bd init locally ensures
+// BEADS_DIR=<dir>/.beads. bd init creates a .git/ as a side effect when
+// BEADS_DIR is unset (upstream gastownhall/beads cmd/bd/init.go), so generic
+// exec providers get the scope's bead directory in the subprocess env and
+// providers that run bd init elsewhere (for example gc-beads-k8s inside the
+// pod) must set it in their own wrapper before invoking bd init.
 func initBeadsForDir(cityPath, dir, prefix, doltDatabase string) error {
 	if cityUsesBdStoreContract(cityPath) && os.Getenv("GC_DOLT") == "skip" {
 		if err := seedDeferredManagedBeadsErr(cityPath, dir, prefix, doltDatabase); err != nil {
@@ -469,7 +524,9 @@ func initBeadsForDir(cityPath, dir, prefix, doltDatabase string) error {
 		script := strings.TrimPrefix(provider, "exec:")
 		if execProviderUsesCanonicalBdScopeFiles(provider) && !execProviderNeedsScopedDoltInit(provider) {
 			baseEnv := providerLifecycleProcessEnv(cityPath, provider)
-			overrides := map[string]string{}
+			overrides := map[string]string{
+				"BEADS_DIR": filepath.Join(dir, ".beads"),
+			}
 			canonicalDoltDatabase := strings.TrimSpace(doltDatabase)
 			if canonicalDoltDatabase == "" {
 				canonicalDoltDatabase = canonicalScopeDoltDatabase(cityPath, dir, prefix)
@@ -483,13 +540,50 @@ func initBeadsForDir(cityPath, dir, prefix, doltDatabase string) error {
 					return err
 				}
 			}
-			if err := runProviderOpWithEnv(script, overlayEnvEntries(baseEnv, overrides), args...); err != nil {
+			env := overlayEnvEntries(baseEnv, overrides)
+			if err := runProviderOpWithEnv(script, env, args...); err != nil {
+				if shouldRetryExecBdInit(err) {
+					for attempt := 0; attempt < 3; attempt++ {
+						time.Sleep(time.Second)
+						retryErr := runProviderOpWithEnv(script, env, args...)
+						if retryErr == nil {
+							return finalizeCanonicalBdScopeInit(cityPath, dir, prefix, canonicalDoltDatabase)
+						}
+						if !shouldRetryExecBdInit(retryErr) {
+							return retryErr
+						}
+						err = retryErr
+					}
+				}
 				return err
 			}
 			return finalizeCanonicalBdScopeInit(cityPath, dir, prefix, canonicalDoltDatabase)
 		}
 		if !execProviderNeedsScopedDoltInit(provider) {
-			return runProviderOp(script, cityPath, args...)
+			baseEnv := cityRuntimeProcessEnv(cityPath)
+			if strings.TrimSpace(cityPath) == "" {
+				baseEnv = os.Environ()
+			}
+			env := overlayEnvEntries(baseEnv, map[string]string{
+				"BEADS_DIR": filepath.Join(dir, ".beads"),
+			})
+			if err := runProviderOpWithEnv(script, env, args...); err != nil {
+				if shouldRetryExecBdInit(err) {
+					for attempt := 0; attempt < 3; attempt++ {
+						time.Sleep(time.Second)
+						retryErr := runProviderOpWithEnv(script, env, args...)
+						if retryErr == nil {
+							return nil
+						}
+						if !shouldRetryExecBdInit(retryErr) {
+							return retryErr
+						}
+						err = retryErr
+					}
+				}
+				return err
+			}
+			return nil
 		}
 		target, err := resolveConfiguredExecStoreTarget(cityPath, dir)
 		if err != nil {
@@ -550,6 +644,7 @@ func forcedScopeDoltConfigStateForInit(cityPath, dir, prefix string) (contract.C
 	if strings.TrimSpace(dir) == "" || strings.TrimSpace(prefix) == "" {
 		return contract.ConfigState{}, false, nil
 	}
+	cityPath = normalizePathForCompare(cityPath)
 	cityDolt := config.DoltConfig{}
 	if cfg, err := loadCityConfig(cityPath, io.Discard); err == nil {
 		resolveRigPaths(cityPath, cfg.Rigs)
@@ -590,12 +685,21 @@ func initFileStoreForDir(cityPath, dir string) error {
 // For exec providers, fires the "health" operation. For bd (dolt), runs
 // a three-layer health check and attempts recovery on failure. For file
 // provider, always healthy (no-op).
+//
+// Acquires a per-city semaphore to prevent concurrent health/recovery
+// operations from causing a thundering herd when dolt bounces.
 func healthBeadsProvider(cityPath string) error {
 	if cityUsesBdStoreContract(cityPath) && strings.TrimSpace(os.Getenv("GC_DOLT")) == "skip" {
 		return nil
 	}
 	provider := beadsProvider(cityPath)
 	if strings.HasPrefix(provider, "exec:") {
+		release, err := acquireProviderSemaphoreForOp(cityPath, "health")
+		if err != nil {
+			return err
+		}
+		defer release()
+
 		script := strings.TrimPrefix(provider, "exec:")
 		providerEnv := providerLifecycleProcessEnv(cityPath, provider)
 		if err := runProviderOpWithEnv(script, providerEnv, "health"); err != nil {
@@ -717,6 +821,7 @@ func configuredCityDoltTarget(cityPath string) (string, string, bool) {
 }
 
 func resolveConfiguredCityDoltTarget(cityPath string) (string, string, bool, bool) {
+	cityPath = normalizePathForCompare(cityPath)
 	resolved, err := contract.ResolveScopeConfigState(fsys.OSFS{}, cityPath, cityPath, "")
 	if err != nil {
 		var invalid *contract.InvalidCanonicalConfigError
@@ -888,6 +993,10 @@ func validateManagedDoltDatabaseName(path, doltDatabase string) (string, error)
 	return doltDatabase, nil
 }
 
+func isLegacyManagedDoltProbeDatabase(name string) bool {
+	return strings.EqualFold(strings.TrimSpace(name), managedDoltProbeDatabase)
+}
+
 func ensureCanonicalScopeMetadata(fs fsys.FS, scopeRoot, doltDatabase string, preserveExisting bool) error {
 	path := filepath.Join(scopeRoot, ".beads", "metadata.json")
 	preserveReservedExisting := false
@@ -898,9 +1007,10 @@ func ensureCanonicalScopeMetadata(fs fsys.FS, scopeRoot, doltDatabase string, pr
 			doltDatabase = strings.TrimSpace(existing)
 			if isReservedManagedDoltDatabase(doltDatabase) {
 				// New init paths reject this reserved name, but existing metadata
-				// may predate the reservation. Preserve it during startup
-				// normalization so operators can migrate the scope deliberately.
-				preserveReservedExisting = true
+				// may use the legacy probe database as its real bead store.
+				// Preserve only that one migration case; Dolt system databases
+				// are unsafe bead-store targets even when already pinned.
+				preserveReservedExisting = isLegacyManagedDoltProbeDatabase(doltDatabase)
 			}
 		}
 	}
@@ -1300,6 +1410,7 @@ func providerLifecycleProcessEnv(cityPath, provider string) []string {
 		"GC_DOLT_PID_FILE",
 		"GC_DOLT_LOCK_FILE",
 		"GC_DOLT_CONFIG_FILE",
+		"GC_DOLT_ARCHIVE_LEVEL",
 	} {
 		env = removeEnvKey(env, key)
 	}
@@ -1308,9 +1419,52 @@ func providerLifecycleProcessEnv(cityPath, provider string) []string {
 		env = removeEnvKey(env, "GC_BIN")
 		env = append(env, "GC_BIN="+gcBin)
 	}
+	// Propagate archive_level from city config so the managed dolt
+	// server inherits it without shell-script changes.
+	if v, ok := cityDoltConfigs.Load(cityPath); ok {
+		dc, _ := v.(config.DoltConfig)
+		if dc.ArchiveLevel != nil {
+			env = append(env, fmt.Sprintf("GC_DOLT_ARCHIVE_LEVEL=%d", *dc.ArchiveLevel))
+		}
+	}
 	return env
 }
 
+// acquireProviderSemaphore returns a per-city semaphore channel and waits
+// until a slot is available or ctx is canceled. Call the returned function to
+// release. Semaphore entries intentionally live for the process lifetime:
+// deleting an entry while a lifecycle operation is still running would allow a
+// second channel for the same city and break serialization. The map is bounded
+// by city roots seen by this controller process.
+// This serializes lifecycle operations per city to prevent thundering herd
+// when dolt bounces: without this, concurrent health checks all trigger
+// recovery simultaneously, spawning a storm of processes that overwhelm
+// dolt on restart.
+func acquireProviderSemaphore(ctx context.Context, cityPath string) (func(), error) {
+	cityPath = normalizePathForCompare(cityPath)
+	v, _ := providerOpSemaphores.LoadOrStore(cityPath, make(chan struct{}, 1))
+	sem := v.(chan struct{})
+	select {
+	case sem <- struct{}{}:
+		return func() { <-sem }, nil
+	case <-ctx.Done():
+		return nil, fmt.Errorf("waiting for provider lifecycle slot for %q: %w", cityPath, ctx.Err())
+	}
+}
+
+func acquireProviderSemaphoreForOp(cityPath, op string) (func(), error) {
+	ctx, cancel := context.WithTimeout(context.Background(), providerOpTimeout(op))
+	release, err := acquireProviderSemaphore(ctx, cityPath)
+	if err != nil {
+		cancel()
+		return nil, err
+	}
+	return func() {
+		release()
+		cancel()
+	}, nil
+}
+
 // providerOpTimeout returns the context timeout for a given lifecycle
 // operation. The "start" and "recover" operations get a longer timeout
 // because dolt server startup can take 30+ seconds for large data dirs.
diff --git a/cmd/gc/beads_provider_lifecycle_test.go b/cmd/gc/beads_provider_lifecycle_test.go
index 64ee4754dc..ec8ce9638b 100644
--- a/cmd/gc/beads_provider_lifecycle_test.go
+++ b/cmd/gc/beads_provider_lifecycle_test.go
@@ -41,6 +41,12 @@ func freeLoopbackPort(t *testing.T) string {
 	return strconv.Itoa(addr.Port)
 }
 
+func setScopedBeadsProviderForTest(t *testing.T, scopeRoot, provider string) {
+	t.Helper()
+	t.Setenv("GC_BEADS", provider)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", scopeRoot)
+}
+
 // TestEnsureBeadsProvider_file verifies that file provider is a no-op.
 func TestEnsureBeadsProvider_file(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
@@ -52,9 +58,10 @@ func TestEnsureBeadsProvider_file(t *testing.T) {
 
 // TestEnsureBeadsProvider_exec calls script with ensure-ready, exit 2 = no-op.
 func TestEnsureBeadsProvider_exec(t *testing.T) {
+	dir := t.TempDir()
 	script := writeTestScript(t, "ensure-ready", 2, "")
-	t.Setenv("GC_BEADS", "exec:"+script)
-	if err := ensureBeadsProvider(t.TempDir()); err != nil {
+	setScopedBeadsProviderForTest(t, dir, "exec:"+script)
+	if err := ensureBeadsProvider(dir); err != nil {
 		t.Fatalf("expected nil for exit 2, got %v", err)
 	}
 }
@@ -159,7 +166,43 @@ func TestProviderLifecycleProcessEnvProjectsResolvedGCBin(t *testing.T) {
 	}
 }
 
-func TestGcBeadsBdReadOnlyFallbackDoesNotDropProbeDatabase(t *testing.T) {
+func TestProviderLifecycleProcessEnvPropagatesArchiveLevel(t *testing.T) {
+	cityPath := t.TempDir()
+	normPath := normalizePathForCompare(cityPath)
+
+	level := 1
+	cityDoltConfigs.Store(normPath, config.DoltConfig{ArchiveLevel: &level})
+	t.Cleanup(func() { cityDoltConfigs.Delete(normPath) })
+
+	envEntries := providerLifecycleProcessEnv(cityPath, "exec:"+gcBeadsBdScriptPath(cityPath))
+	env := map[string]string{}
+	for _, entry := range envEntries {
+		key, value, ok := strings.Cut(entry, "=")
+		if ok {
+			env[key] = value
+		}
+	}
+	if got := env["GC_DOLT_ARCHIVE_LEVEL"]; got != "1" {
+		t.Fatalf("GC_DOLT_ARCHIVE_LEVEL = %q, want %q", got, "1")
+	}
+}
+
+func TestProviderLifecycleProcessEnvOmitsArchiveLevelWhenNil(t *testing.T) {
+	cityPath := t.TempDir()
+	normPath := normalizePathForCompare(cityPath)
+
+	cityDoltConfigs.Store(normPath, config.DoltConfig{})
+	t.Cleanup(func() { cityDoltConfigs.Delete(normPath) })
+
+	envEntries := providerLifecycleProcessEnv(cityPath, "exec:"+gcBeadsBdScriptPath(cityPath))
+	for _, entry := range envEntries {
+		if strings.HasPrefix(entry, "GC_DOLT_ARCHIVE_LEVEL=") {
+			t.Fatalf("GC_DOLT_ARCHIVE_LEVEL should not be set when ArchiveLevel is nil, got %q", entry)
+		}
+	}
+}
+
+func TestGcBeadsBdReadOnlyFallbackDoesNotTargetLegacyProbeDatabase(t *testing.T) {
 	cityPath := t.TempDir()
 	if err := MaterializeBuiltinPacks(cityPath); err != nil {
 		t.Fatalf("MaterializeBuiltinPacks: %v", err)
@@ -170,14 +213,55 @@ func TestGcBeadsBdReadOnlyFallbackDoesNotDropProbeDatabase(t *testing.T) {
 	}
 	script := string(scriptData)
 	assertNoManagedDoltProbeDrop(t, "gc-beads-bd read-only fallback", script)
-	if !strings.Contains(script, "CREATE TABLE IF NOT EXISTS __gc_probe.__probe") {
-		t.Fatalf("gc-beads-bd read-only fallback missing qualified persistent probe table")
+	assertNoManagedDoltProbeLegacyTarget(t, "gc-beads-bd read-only fallback", script)
+	for _, want := range []string{"SHOW DATABASES", managedDoltProbeTable, "performance_schema", "sys"} {
+		if !strings.Contains(script, want) {
+			t.Fatalf("gc-beads-bd read-only fallback missing %q", want)
+		}
+	}
+}
+
+func TestGcBeadsBdShellFallbackSanitizesArchiveLevel(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	scriptData, err := os.ReadFile(gcBeadsBdScriptPath(cityPath))
+	if err != nil {
+		t.Fatalf("ReadFile(gc-beads-bd): %v", err)
+	}
+	script := string(scriptData)
+	for _, forbidden := range []string{
+		`--archive-level "${GC_DOLT_ARCHIVE_LEVEL:-0}"`,
+		"archive_level: ${GC_DOLT_ARCHIVE_LEVEL:-0}",
+	} {
+		if strings.Contains(script, forbidden) {
+			t.Fatalf("gc-beads-bd shell fallback uses unsanitized archive level pattern %q", forbidden)
+		}
+	}
+	for _, want := range []string{
+		"archive_level=${GC_DOLT_ARCHIVE_LEVEL:-0}",
+		"*[!0-9]*",
+		"--archive-level \"$archive_level\"",
+		"archive_level: $archive_level",
+	} {
+		if !strings.Contains(script, want) {
+			t.Fatalf("gc-beads-bd shell fallback missing sanitized archive level pattern %q", want)
+		}
 	}
-	assertManagedDoltProbeWrites(t, "gc-beads-bd read-only fallback", script)
 }
 
 func TestGcBeadsBdInitRejectsManagedProbeDatabaseName(t *testing.T) {
-	for _, dbName := range []string{managedDoltProbeDatabase, strings.ToUpper(managedDoltProbeDatabase), " " + managedDoltProbeDatabase + " "} {
+	for _, dbName := range []string{
+		managedDoltProbeDatabase,
+		strings.ToUpper(managedDoltProbeDatabase),
+		" " + managedDoltProbeDatabase + " ",
+		"information_schema",
+		"mysql",
+		"dolt_cluster",
+		"performance_schema",
+		"sys",
+	} {
 		t.Run(dbName, func(t *testing.T) {
 			cityPath := t.TempDir()
 			scopePath := filepath.Join(cityPath, "rigs", "frontend")
@@ -203,14 +287,25 @@ func TestGcBeadsBdInitRejectsManagedProbeDatabaseName(t *testing.T) {
 	}
 }
 
-func TestEnsureCanonicalScopeMetadataRejectsManagedProbeDatabase(t *testing.T) {
-	scopePath := t.TempDir()
-	err := ensureCanonicalScopeMetadataForInit(fsys.OSFS{}, scopePath, managedDoltProbeDatabase)
-	if err == nil {
-		t.Fatalf("ensureCanonicalScopeMetadataForInit unexpectedly accepted %s", managedDoltProbeDatabase)
-	}
-	if !strings.Contains(err.Error(), "reserved pinned dolt_database") || !strings.Contains(err.Error(), "choose a different dolt_database") {
-		t.Fatalf("ensureCanonicalScopeMetadataForInit error = %v, want reserved database remediation", err)
+func TestEnsureCanonicalScopeMetadataRejectsManagedSystemDatabases(t *testing.T) {
+	for _, dbName := range []string{
+		managedDoltProbeDatabase,
+		"information_schema",
+		"mysql",
+		"dolt_cluster",
+		"performance_schema",
+		"sys",
+	} {
+		t.Run(dbName, func(t *testing.T) {
+			scopePath := t.TempDir()
+			err := ensureCanonicalScopeMetadataForInit(fsys.OSFS{}, scopePath, dbName)
+			if err == nil {
+				t.Fatalf("ensureCanonicalScopeMetadataForInit unexpectedly accepted %s", dbName)
+			}
+			if !strings.Contains(err.Error(), "reserved pinned dolt_database") || !strings.Contains(err.Error(), "choose a different dolt_database") {
+				t.Fatalf("ensureCanonicalScopeMetadataForInit error = %v, want reserved database remediation", err)
+			}
+		})
 	}
 }
 
@@ -245,6 +340,34 @@ func TestNormalizeCanonicalBdScopeFilesPreservesExistingManagedProbeDatabase(t *
 	}
 }
 
+func TestNormalizeCanonicalBdScopeFilesRejectsExistingManagedSystemDatabase(t *testing.T) {
+	cityPath := t.TempDir()
+	metadataPath := filepath.Join(cityPath, ".beads", "metadata.json")
+	if err := os.MkdirAll(filepath.Dir(metadataPath), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := contract.EnsureCanonicalMetadata(fsys.OSFS{}, metadataPath, contract.MetadataState{
+		Database:     "dolt",
+		Backend:      "dolt",
+		DoltMode:     "server",
+		DoltDatabase: "mysql",
+	}); err != nil {
+		t.Fatalf("EnsureCanonicalMetadata: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "config.yaml"), []byte("issue_prefix: hq\nissue-prefix: hq\ndolt.auto-start: true\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := &config.City{Workspace: config.Workspace{Name: "dogfood-city"}}
+	err := normalizeCanonicalBdScopeFiles(cityPath, cfg)
+	if err == nil {
+		t.Fatal("normalizeCanonicalBdScopeFiles() error = nil, want reserved metadata rejection")
+	}
+	if !strings.Contains(err.Error(), "reserved pinned dolt_database") || !strings.Contains(err.Error(), "mysql") {
+		t.Fatalf("normalizeCanonicalBdScopeFiles() error = %v, want mysql reserved metadata rejection", err)
+	}
+}
+
 func TestNormalizeCanonicalBdScopeFilesForInitPreservesExistingManagedProbeDatabase(t *testing.T) {
 	cityPath := t.TempDir()
 	metadataPath := filepath.Join(cityPath, ".beads", "metadata.json")
@@ -276,6 +399,224 @@ func TestNormalizeCanonicalBdScopeFilesForInitPreservesExistingManagedProbeDatab
 	}
 }
 
+func TestGcBeadsBdReadOnlyFallbackNoUserDatabaseIsDiagnostic(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	scriptData, err := os.ReadFile(gcBeadsBdScriptPath(cityPath))
+	if err != nil {
+		t.Fatalf("ReadFile(gc-beads-bd): %v", err)
+	}
+	prelude, _, ok := strings.Cut(string(scriptData), "# --- Main ---")
+	if !ok {
+		t.Fatal("gc-beads-bd script missing main marker")
+	}
+
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	if err := os.WriteFile(filepath.Join(binDir, "dolt"), []byte(`#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`), 0o755); err != nil {
+		t.Fatalf("WriteFile(dolt): %v", err)
+	}
+
+	harness := filepath.Join(t.TempDir(), "read-only-fallback.sh")
+	body := prelude + `
+GC_BIN=""
+GC_DOLT_HOST=""
+DOLT_PORT=3311
+DOLT_USER=root
+set +e
+check_read_only
+status=$?
+set -e
+printf 'status=%s\n' "$status"
+`
+	if err := os.WriteFile(harness, []byte(body), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command("sh", harness)
+	cmd.Env = append(sanitizedBaseEnv(
+		"INVOCATION_FILE="+invocationFile,
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+	), "GC_BIN=")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("check_read_only harness failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(string(out), "status=2") {
+		t.Fatalf("check_read_only output = %s, want diagnostic status 2", out)
+	}
+	if !strings.Contains(string(out), "no user database") {
+		t.Fatalf("check_read_only output = %s, want no-user-database diagnostic", out)
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("check_read_only ran write probe without user database:\n%s", invocation)
+	}
+}
+
+func TestGcBeadsBdHealthNoUserDatabaseWarnsAndContinues(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	scriptData, err := os.ReadFile(gcBeadsBdScriptPath(cityPath))
+	if err != nil {
+		t.Fatalf("ReadFile(gc-beads-bd): %v", err)
+	}
+	prelude, _, ok := strings.Cut(string(scriptData), "# --- Main ---")
+	if !ok {
+		t.Fatal("gc-beads-bd script missing main marker")
+	}
+
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	if err := os.WriteFile(filepath.Join(binDir, "dolt"), []byte(`#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`), 0o755); err != nil {
+		t.Fatalf("WriteFile(dolt): %v", err)
+	}
+
+	harness := filepath.Join(t.TempDir(), "health-fallback.sh")
+	body := prelude + `
+GC_BIN=""
+GC_DOLT_HOST=""
+DOLT_PORT=3311
+DOLT_USER=root
+tcp_check() { return 0; }
+do_query_probe() { return 0; }
+get_connection_count() { return 1; }
+set +e
+op_health
+status=$?
+set -e
+printf 'status=%s\n' "$status"
+`
+	if err := os.WriteFile(harness, []byte(body), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command("sh", harness)
+	cmd.Env = append(sanitizedBaseEnv(
+		"INVOCATION_FILE="+invocationFile,
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+	), "GC_BIN=")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("op_health harness failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(string(out), "status=0") {
+		t.Fatalf("op_health output = %s, want success status", out)
+	}
+	if !strings.Contains(string(out), "warning: dolt read-only probe inconclusive") {
+		t.Fatalf("op_health output = %s, want warning", out)
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("op_health ran write probe without user database:\n%s", invocation)
+	}
+}
+
+func TestGcBeadsBdReadOnlyHelperErrorIsDiagnostic(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	scriptData, err := os.ReadFile(gcBeadsBdScriptPath(cityPath))
+	if err != nil {
+		t.Fatalf("ReadFile(gc-beads-bd): %v", err)
+	}
+	prelude, _, ok := strings.Cut(string(scriptData), "# --- Main ---")
+	if !ok {
+		t.Fatal("gc-beads-bd script missing main marker")
+	}
+
+	gcBin := filepath.Join(t.TempDir(), "gc")
+	if err := os.WriteFile(gcBin, []byte(`#!/bin/sh
+set -eu
+case "$1 $2" in
+  "dolt-state read-only-check")
+    echo "gc dolt-state read-only-check: no user database available for managed Dolt read-only probe" >&2
+    exit 1
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 66
+    ;;
+esac
+`), 0o755); err != nil {
+		t.Fatalf("WriteFile(gc): %v", err)
+	}
+
+	harness := filepath.Join(t.TempDir(), "read-only-helper.sh")
+	body := prelude + fmt.Sprintf(`
+GC_BIN=%q
+GC_DOLT_HOST=""
+DOLT_PORT=3311
+DOLT_USER=root
+set +e
+check_read_only
+status=$?
+set -e
+printf 'status=%%s\n' "$status"
+`, gcBin)
+	if err := os.WriteFile(harness, []byte(body), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command("sh", harness)
+	cmd.Env = sanitizedBaseEnv("PATH=" + os.Getenv("PATH"))
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("check_read_only harness failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(string(out), "status=2") {
+		t.Fatalf("check_read_only output = %s, want diagnostic status 2", out)
+	}
+	if !strings.Contains(string(out), "no user database") {
+		t.Fatalf("check_read_only output = %s, want helper diagnostic", out)
+	}
+}
+
 func TestGcBeadsBdCleanupStaleLocksBoundsLsof(t *testing.T) {
 	cityPath := t.TempDir()
 	if err := MaterializeBuiltinPacks(cityPath); err != nil {
@@ -373,7 +714,7 @@ exit 0
 	if err := os.WriteFile(script, []byte(scriptBody), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	t.Setenv("GC_BEADS", "exec:"+script)
+	setScopedBeadsProviderForTest(t, cityPath, "exec:"+script)
 
 	if err := ensureBeadsProvider(cityPath); err != nil {
 		t.Fatalf("ensureBeadsProvider: %v", err)
@@ -508,9 +849,9 @@ dolt_port = "4406"
 
 func TestManagedDoltLifecycleOwnedReportsInvalidCityConfigForFileCity(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
-	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 
 	cityPath := t.TempDir()
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname =\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
@@ -531,7 +872,7 @@ func TestEnsureBeadsProvider_bd_skip(t *testing.T) {
 		t.Fatal(err)
 	}
 	MaterializeBuiltinPacks(dir) //nolint:errcheck
-	t.Setenv("GC_BEADS", "bd")
+	setScopedBeadsProviderForTest(t, dir, "bd")
 	t.Setenv("GC_DOLT", "skip")
 	if err := ensureBeadsProvider(dir); err != nil {
 		t.Fatalf("expected nil, got %v", err)
@@ -577,7 +918,7 @@ func TestEnsureBeadsProvider_bdAcceptsHealthyServerAfterStartError(t *testing.T)
 		t.Fatal(err)
 	}
 
-	t.Setenv("GC_BEADS", "bd")
+	setScopedBeadsProviderForTest(t, dir, "bd")
 
 	if err := ensureBeadsProvider(dir); err != nil {
 		t.Fatalf("ensureBeadsProvider = %v, want nil", err)
@@ -619,7 +960,7 @@ func TestEnsureBeadsProvider_execDoesNotMaskStartErrorWithHealth(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	t.Setenv("GC_BEADS", "exec:"+script)
+	setScopedBeadsProviderForTest(t, dir, "exec:"+script)
 
 	err := ensureBeadsProvider(dir)
 	if err == nil {
@@ -676,6 +1017,7 @@ func TestEnsureBeadsProvider_execDoesNotReclassifyProviderAfterStart(t *testing.
 	if err := os.Setenv("GC_BEADS", "exec:"+script); err != nil {
 		t.Fatalf("set GC_BEADS: %v", err)
 	}
+	t.Setenv("GC_BEADS_SCOPE_ROOT", dir)
 	t.Cleanup(func() {
 		if hadProvider {
 			_ = os.Setenv("GC_BEADS", originalProvider)
@@ -737,9 +1079,10 @@ func TestShutdownBeadsProvider_file(t *testing.T) {
 
 // TestShutdownBeadsProvider_exec calls script with shutdown, exit 2 = no-op.
 func TestShutdownBeadsProvider_exec(t *testing.T) {
+	dir := t.TempDir()
 	script := writeTestScript(t, "shutdown", 2, "")
-	t.Setenv("GC_BEADS", "exec:"+script)
-	if err := shutdownBeadsProvider(t.TempDir()); err != nil {
+	setScopedBeadsProviderForTest(t, dir, "exec:"+script)
+	if err := shutdownBeadsProvider(dir); err != nil {
 		t.Fatalf("expected nil for exit 2, got %v", err)
 	}
 }
@@ -752,6 +1095,7 @@ func TestShutdownBeadsProvider_bd_skip(t *testing.T) {
 	}
 	MaterializeBuiltinPacks(dir) //nolint:errcheck
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", dir)
 	t.Setenv("GC_DOLT", "skip")
 	if err := shutdownBeadsProvider(dir); err != nil {
 		t.Fatalf("expected nil, got %v", err)
@@ -1970,6 +2314,7 @@ func TestInitBeadsForDir_file(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_DOLT", "skip")
 	cityDir := t.TempDir()
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	if err := initBeadsForDir(cityDir, cityDir, "test", "test"); err != nil {
 		t.Fatalf("expected nil, got %v", err)
 	}
@@ -1996,6 +2341,7 @@ func TestInitBeadsForDir_fileScopedRigCreatesStore(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_DOLT", "skip")
 	cityDir := t.TempDir()
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	rigDir := filepath.Join(t.TempDir(), "rig1")
 	if err := os.MkdirAll(rigDir, 0o755); err != nil {
 		t.Fatal(err)
@@ -2022,6 +2368,7 @@ func TestInitBeadsForDir_fileLegacyRigPreservesSharedCityStore(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_DOLT", "skip")
 	cityDir := t.TempDir()
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	rigDir := filepath.Join(t.TempDir(), "rig1")
 	if err := os.MkdirAll(rigDir, 0o755); err != nil {
 		t.Fatal(err)
@@ -2056,6 +2403,7 @@ func TestInitBeadsForDir_exec(t *testing.T) {
 	writeMinimalCityToml(t, cityDir)
 	script := writeTestScript(t, "init", 2, "")
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	if err := initBeadsForDir(cityDir, cityDir, "prefix", "prefix"); err != nil {
 		t.Fatalf("expected nil for exit 2, got %v", err)
 	}
@@ -2072,6 +2420,7 @@ func TestInitBeadsForDir_execPassesCanonicalDoltDatabase(t *testing.T) {
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	if err := initBeadsForDir(cityDir, cityDir, "gc", "gascity"); err != nil {
 		t.Fatalf("expected nil, got %v", err)
 	}
@@ -2086,25 +2435,79 @@ func TestInitBeadsForDir_execPassesCanonicalDoltDatabase(t *testing.T) {
 	}
 }
 
-func TestRunProviderOpStripsAmbientGCDoltSkip(t *testing.T) {
-	cityDir := t.TempDir()
-	writeMinimalCityToml(t, cityDir)
+// TestInitBeadsForDirExecSetsBEADSDIR exercises the controller-side exec paths
+// that invoke bd init directly and asserts BEADS_DIR=<dir>/.beads is present in
+// the subprocess env. The k8s scoped path sets BEADS_DIR inside the provider
+// script itself; that behavior is covered by internal/runtime/k8s tests.
+// Regression for #399.
+func TestInitBeadsForDirExecSetsBEADSDIR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		scriptBase string
+		// cityToml uses dolt/rig config appropriate for the exec branch.
+		cityToml func(rigRel string) string
+	}{
+		{
+			name:       "gc-beads-bd canonical",
+			scriptBase: "gc-beads-bd",
+			cityToml: func(rigRel string) string {
+				return "[workspace]\nname = \"demo\"\n\n[[rigs]]\nname = \"r\"\npath = \"" + rigRel + "\"\nprefix = \"rg\"\n"
+			},
+		},
+		{
+			name:       "generic legacy exec",
+			scriptBase: "record-env",
+			cityToml: func(rigRel string) string {
+				return "[workspace]\nname = \"demo\"\n\n[[rigs]]\nname = \"r\"\npath = \"" + rigRel + "\"\nprefix = \"rg\"\n"
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cityDir := t.TempDir()
+			rigDir := filepath.Join(cityDir, "r")
+			if err := os.MkdirAll(rigDir, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(tc.cityToml("r")), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			logFile := filepath.Join(t.TempDir(), "env.log")
+			script := filepath.Join(t.TempDir(), tc.scriptBase)
+			content := fmt.Sprintf("#!/bin/sh\nif [ \"$1\" = init ]; then printf '%%s\\n' \"${BEADS_DIR:-<unset>}\" > %q; fi\nexit 0\n", logFile)
+			if err := os.WriteFile(script, []byte(content), 0o755); err != nil {
+				t.Fatal(err)
+			}
+
+			t.Setenv("GC_BEADS", "exec:"+script)
+			if err := initBeadsForDir(cityDir, rigDir, "rg", "rg-db"); err != nil {
+				t.Fatalf("initBeadsForDir: %v", err)
+			}
+
+			data, err := os.ReadFile(logFile)
+			if err != nil {
+				t.Fatalf("read env log: %v", err)
+			}
+			want := filepath.Join(rigDir, ".beads")
+			if got := strings.TrimSpace(string(data)); got != want {
+				t.Fatalf("BEADS_DIR = %q, want %q (bd init without BEADS_DIR creates .git as a side effect)", got, want)
+			}
+		})
+	}
+}
+
+func TestInitBeadsForDirExecWithoutCityPathPreservesAmbientEnv(t *testing.T) {
+	rigDir := t.TempDir()
 	logFile := filepath.Join(t.TempDir(), "env.log")
-	script := filepath.Join(t.TempDir(), "record-env.sh")
-	content := fmt.Sprintf(`#!/bin/sh
-printf '%%s|%%s|%%s|%%s
-' "${GC_DOLT:-}" "${GC_DOLT_HOST:-}" "${GC_DOLT_PORT:-}" "${GC_CITY_PATH:-}" > %q
-exit 0
-`, logFile)
+	script := filepath.Join(t.TempDir(), "record-env")
+	content := fmt.Sprintf("#!/bin/sh\nif [ \"$1\" = init ]; then printf '%%s|%%s\\n' \"${GC_DOLT_HOST:-}\" \"${BEADS_DIR:-<unset>}\" > %q; fi\nexit 0\n", logFile)
 	if err := os.WriteFile(script, []byte(content), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
-	t.Setenv("GC_BEADS", "bd")
-	t.Setenv("GC_DOLT", "skip")
-
-	if err := runProviderOp(script, cityDir, "init", cityDir, "gc", "hq"); err != nil {
-		t.Fatalf("runProviderOp: %v", err)
+	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_DOLT_HOST", "ambient-dolt")
+	if err := initBeadsForDir("", rigDir, "rg", ""); err != nil {
+		t.Fatalf("initBeadsForDir: %v", err)
 	}
 
 	data, err := os.ReadFile(logFile)
@@ -2112,25 +2515,119 @@ exit 0
 		t.Fatalf("read env log: %v", err)
 	}
 	parts := strings.Split(strings.TrimSpace(string(data)), "|")
-	if len(parts) != 4 {
-		t.Fatalf("captured env = %q, want 4 fields", strings.TrimSpace(string(data)))
+	if len(parts) != 2 {
+		t.Fatalf("env log = %q, want host|beads_dir", string(data))
 	}
-	if parts[0] != "" {
-		t.Fatalf("GC_DOLT leaked into provider env: %q", parts[0])
+	if got := parts[0]; got != "ambient-dolt" {
+		t.Fatalf("GC_DOLT_HOST = %q, want ambient-dolt", got)
 	}
-	if parts[3] != cityDir {
-		t.Fatalf("GC_CITY_PATH = %q, want %q", parts[3], cityDir)
+	if got, want := parts[1], filepath.Join(rigDir, ".beads"); got != want {
+		t.Fatalf("BEADS_DIR = %q, want %q", got, want)
 	}
 }
 
-func TestInitBeadsForDirExecGcBeadsBdPreservesCityRuntimeEnv(t *testing.T) {
-	cityDir := t.TempDir()
-	writeMinimalCityToml(t, cityDir)
-	logFile := filepath.Join(t.TempDir(), "env.log")
-	script := filepath.Join(t.TempDir(), "gc-beads-bd")
-	content := fmt.Sprintf(`#!/bin/sh
+func TestInitBeadsForDirExecPreventsStrayGitInit(t *testing.T) {
+	script := filepath.Join(t.TempDir(), "bd-like-provider.sh")
+	content := `#!/bin/sh
 set -eu
-case "$1" in
+op="$1"
+shift
+case "$op" in
+  init)
+    dir="$1"
+    mkdir -p "$dir/.beads"
+    if [ -z "${BEADS_DIR:-}" ]; then
+      mkdir -p "$dir/.git"
+    fi
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`
+	if err := os.WriteFile(script, []byte(content), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	rawDir := t.TempDir()
+	rawCmd := exec.Command(script, "init", rawDir, "raw")
+	rawCmd.Env = sanitizedBaseEnv()
+	rawOut, err := rawCmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("direct provider init failed: %v\n%s", err, rawOut)
+	}
+	if _, err := os.Stat(filepath.Join(rawDir, ".beads")); err != nil {
+		t.Fatalf("direct provider init did not create .beads: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(rawDir, ".git")); err != nil {
+		t.Fatalf("direct provider init did not emulate stray .git creation: %v", err)
+	}
+
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+	rigDir := filepath.Join(cityDir, "frontend")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("GC_BEADS", "exec:"+script)
+	if err := initBeadsForDir(cityDir, rigDir, "fe", "frontend-db"); err != nil {
+		t.Fatalf("initBeadsForDir: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(rigDir, ".beads")); err != nil {
+		t.Fatalf("initBeadsForDir did not create .beads: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(rigDir, ".git")); !os.IsNotExist(err) {
+		t.Fatalf("initBeadsForDir should prevent stray .git creation, stat err = %v", err)
+	}
+}
+
+func TestRunProviderOpStripsAmbientGCDoltSkip(t *testing.T) {
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+	logFile := filepath.Join(t.TempDir(), "env.log")
+	script := filepath.Join(t.TempDir(), "record-env.sh")
+	content := fmt.Sprintf(`#!/bin/sh
+printf '%%s|%%s|%%s|%%s
+' "${GC_DOLT:-}" "${GC_DOLT_HOST:-}" "${GC_DOLT_PORT:-}" "${GC_CITY_PATH:-}" > %q
+exit 0
+`, logFile)
+	if err := os.WriteFile(script, []byte(content), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
+	t.Setenv("GC_DOLT", "skip")
+
+	if err := runProviderOp(script, cityDir, "init", cityDir, "gc", "hq"); err != nil {
+		t.Fatalf("runProviderOp: %v", err)
+	}
+
+	data, err := os.ReadFile(logFile)
+	if err != nil {
+		t.Fatalf("read env log: %v", err)
+	}
+	parts := strings.Split(strings.TrimSpace(string(data)), "|")
+	if len(parts) != 4 {
+		t.Fatalf("captured env = %q, want 4 fields", strings.TrimSpace(string(data)))
+	}
+	if parts[0] != "" {
+		t.Fatalf("GC_DOLT leaked into provider env: %q", parts[0])
+	}
+	if parts[3] != cityDir {
+		t.Fatalf("GC_CITY_PATH = %q, want %q", parts[3], cityDir)
+	}
+}
+
+func TestInitBeadsForDirExecGcBeadsBdPreservesCityRuntimeEnv(t *testing.T) {
+	cityDir := t.TempDir()
+	writeMinimalCityToml(t, cityDir)
+	logFile := filepath.Join(t.TempDir(), "env.log")
+	script := filepath.Join(t.TempDir(), "gc-beads-bd")
+	content := fmt.Sprintf(`#!/bin/sh
+set -eu
+case "$1" in
   init)
     printf '%%s|%%s|%%s|%%s
 ' "${GC_CITY_PATH:-}" "${GC_CITY_RUNTIME_DIR:-}" "${GC_PACK_STATE_DIR:-}" "${GC_DOLT_DATA_DIR:-}" > %q
@@ -2146,6 +2643,7 @@ esac
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	t.Setenv("GC_CITY_PATH", "/wrong-city")
 	t.Setenv("GC_CITY_RUNTIME_DIR", "/wrong-runtime")
 	t.Setenv("GC_PACK_STATE_DIR", "/wrong-pack")
@@ -2222,6 +2720,7 @@ esac
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 
 	if err := initBeadsForDir(cityDir, cityDir, "gc", "hq"); err != nil {
 		t.Fatalf("initBeadsForDir: %v", err)
@@ -2304,6 +2803,7 @@ exit 0
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	if err := initBeadsForDir(cityDir, rigDir, "fe", "frontend-db"); err != nil {
 		t.Fatalf("initBeadsForDir: %v", err)
 	}
@@ -2338,6 +2838,7 @@ func TestInitBeadsForDir_execOmitsCanonicalDoltDatabaseWhenUnknown(t *testing.T)
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	if err := initBeadsForDir(cityDir, cityDir, "gc", ""); err != nil {
 		t.Fatalf("expected nil, got %v", err)
 	}
@@ -2381,6 +2882,7 @@ esac
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	if err := initBeadsForDir(cityDir, cityDir, "gc", ""); err != nil {
 		t.Fatalf("initBeadsForDir: %v", err)
 	}
@@ -2403,6 +2905,7 @@ func TestInitBeadsForDir_bd_skip(t *testing.T) {
 	}
 	MaterializeBuiltinPacks(dir) //nolint:errcheck
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", dir)
 	t.Setenv("GC_DOLT", "skip")
 	if err := initBeadsForDir(dir, dir, "test", "test"); err != nil {
 		t.Fatalf("expected nil, got %v", err)
@@ -2448,7 +2951,9 @@ esac
 		t.Fatal(err)
 	}
 
+	configureTestDoltIdentityEnv(t)
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	t.Setenv("PATH", strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)))
 	if err := initBeadsForDir(cityDir, cityDir, "gc", "hq"); err != nil {
 		t.Fatalf("initBeadsForDir: %v", err)
@@ -2502,7 +3007,9 @@ esac
 		t.Fatal(err)
 	}
 
+	configureTestDoltIdentityEnv(t)
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	t.Setenv("PATH", strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)))
 	t.Setenv("GC_CITY_PATH", "/wrong-city")
 	t.Setenv("GC_CITY_RUNTIME_DIR", "/wrong-runtime")
@@ -2618,6 +3125,7 @@ func TestStartBeadsLifecycleDoesNotMutateProcessDoltEnv(t *testing.T) {
 	_ = os.Unsetenv("BEADS_DOLT_SERVER_HOST")
 
 	cityPath := t.TempDir()
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -2729,6 +3237,133 @@ func TestGcBeadsBdStartUsesRootBeadsDataDir(t *testing.T) {
 	}
 }
 
+func TestGcBeadsBdStartRetriesAutoPortBindConflict(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	script := gcBeadsBdScriptPath(cityPath)
+
+	binDir := filepath.Join(t.TempDir(), "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	stateDir := t.TempDir()
+	attemptsFile := filepath.Join(stateDir, "attempts")
+	portsFile := filepath.Join(stateDir, "ports")
+
+	fakeDolt := filepath.Join(binDir, "dolt")
+	fakeDoltScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+attempts_file=%q
+ports_file=%q
+cmd="${1:-}"
+case "$cmd" in
+  config)
+    exit 0
+    ;;
+  --host)
+    count=0
+    if [ -f "$attempts_file" ]; then
+      count=$(cat "$attempts_file")
+    fi
+    [ "$count" -ge 2 ]
+    ;;
+  sql-server)
+    config_file=""
+    while [ "$#" -gt 0 ]; do
+      case "$1" in
+        --config)
+          shift
+          config_file="$1"
+          ;;
+      esac
+      shift || true
+    done
+    port=$(awk '/^[[:space:]]*port:/{print $2; exit}' "$config_file")
+    printf '%%s\n' "$port" >> "$ports_file"
+    count=0
+    if [ -f "$attempts_file" ]; then
+      count=$(cat "$attempts_file")
+    fi
+    count=$((count + 1))
+    printf '%%s\n' "$count" > "$attempts_file"
+    if [ "$count" -eq 1 ]; then
+      echo "Starting server with Config HP=\"0.0.0.0:${port}\"|T=\"300000\"|R=\"false\"|L=\"warning\""
+      echo "listen tcp 0.0.0.0:${port}: bind: address already in use"
+      exit 1
+    fi
+    sleep 60
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, attemptsFile, portsFile)
+	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	fakeNC := filepath.Join(binDir, "nc")
+	fakeNCScript := fmt.Sprintf(`#!/bin/sh
+attempts_file=%q
+count=0
+if [ -f "$attempts_file" ]; then
+  count=$(cat "$attempts_file")
+fi
+if [ "$count" -ge 2 ]; then
+  exit 0
+fi
+exit 1
+`, attemptsFile)
+	if err := os.WriteFile(fakeNC, []byte(fakeNCScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	scriptEnv := sanitizedBaseEnv(
+		"GC_CITY_PATH="+cityPath,
+		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
+	)
+	t.Cleanup(func() {
+		cmd := exec.Command(script, "stop")
+		cmd.Env = scriptEnv
+		_ = cmd.Run()
+	})
+
+	cmd := exec.Command(script, "start")
+	cmd.Env = scriptEnv
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("start: %v\n%s", err, out)
+	}
+
+	data, err := os.ReadFile(portsFile)
+	if err != nil {
+		t.Fatalf("read attempted ports: %v", err)
+	}
+	ports := strings.Fields(string(data))
+	if len(ports) != 2 {
+		t.Fatalf("attempted ports = %v, want two startup attempts", ports)
+	}
+	if ports[0] == ports[1] {
+		t.Fatalf("retry reused busy port %s", ports[0])
+	}
+
+	state, err := readDoltRuntimeStateFile(providerManagedDoltStatePath(cityPath))
+	if err != nil {
+		t.Fatalf("read provider state: %v", err)
+	}
+	if got := strconv.Itoa(state.Port); got != ports[1] {
+		t.Fatalf("provider state port = %q, want retry port %q", got, ports[1])
+	}
+}
+
 func TestGcBeadsBdInitRetriesRootStoreVerification(t *testing.T) {
 	cityPath := t.TempDir()
 	writeMinimalCityToml(t, cityPath)
@@ -2784,7 +3419,9 @@ esac
 		t.Fatal(err)
 	}
 
+	configureTestDoltIdentityEnv(t)
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("PATH", strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)))
 
 	if err := initBeadsForDir(cityPath, cityPath, "mc", "mc"); err != nil {
@@ -2856,6 +3493,7 @@ dolt.user: city-user
 	captureFile := filepath.Join(t.TempDir(), "init-env-city")
 	script := writeGcBeadsBdInitEnvCaptureScript(t, captureFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_DOLT_HOST", "ambient.invalid")
 	t.Setenv("GC_DOLT_PORT", "9999")
 	t.Setenv("GC_PACK_STATE_DIR", "/wrong/.gc/runtime/packs/dolt")
@@ -2909,6 +3547,7 @@ dolt.user: rig-user
 	captureFile := filepath.Join(t.TempDir(), "init-env-rig")
 	script := writeGcBeadsBdInitEnvCaptureScript(t, captureFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_DOLT_HOST", "ambient.invalid")
 	t.Setenv("GC_DOLT_PORT", "9999")
 	t.Setenv("GC_PACK_STATE_DIR", "/wrong/.gc/runtime/packs/dolt")
@@ -2981,6 +3620,7 @@ dolt.user: city-user
 	captureFile := filepath.Join(t.TempDir(), "init-env-inherited-rig")
 	script := writeGcBeadsBdInitEnvCaptureScript(t, captureFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_DOLT_HOST", "ambient.invalid")
 	t.Setenv("GC_DOLT_PORT", "9999")
 	if err := initAndHookDir(cityPath, rigPath, "fe"); err != nil {
@@ -3037,6 +3677,7 @@ esac
 		t.Fatal(err)
 	}
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_DOLT_HOST", "ambient.invalid")
 	t.Setenv("GC_DOLT_PORT", "9999")
 	t.Setenv("GC_PACK_STATE_DIR", "/wrong/.gc/runtime/packs/dolt")
@@ -3227,6 +3868,7 @@ esac
 		t.Fatal(err)
 	}
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_PACK_STATE_DIR", "/wrong/.gc/runtime/packs/dolt")
 	if err := ensureBeadsProvider(cityPath); err != nil {
 		t.Fatalf("ensureBeadsProvider: %v", err)
@@ -3259,6 +3901,7 @@ dolt.port: 3307
 		t.Fatal(err)
 	}
 	t.Setenv("GC_BEADS", "exec:"+writeGcBeadsBdInitEnvCaptureScript(t, filepath.Join(t.TempDir(), "should-not-run")))
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	if err := initAndHookDir(cityPath, cityPath, "gc"); err == nil || !strings.Contains(err.Error(), "invalid canonical city endpoint state") {
 		t.Fatalf("initAndHookDir() error = %v, want invalid canonical city endpoint state", err)
 	}
@@ -3300,6 +3943,7 @@ esac
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	if err := initAndHookDir(cityPath, cityPath, "gc"); err != nil {
 		t.Fatalf("initAndHookDir: %v", err)
 	}
@@ -3430,10 +4074,10 @@ esac
 			}
 
 			cmd := exec.Command(script, "init", cityPath, "gc", "gascity")
-			cmd.Env = sanitizedBaseEnv(
+			cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 				"GC_CITY_PATH="+cityPath,
 				"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-			)
+			)...)
 			out, err := cmd.CombinedOutput()
 			if err != nil {
 				t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
@@ -3596,7 +4240,9 @@ esac
 		t.Fatal(err)
 	}
 
+	configureTestDoltIdentityEnv(t)
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("PATH", strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)))
 	t.Setenv("GC_DOLT_HOST", "rig-db.example.com")
 	t.Setenv("GC_DOLT_PORT", "3307")
@@ -3612,14 +4258,15 @@ esac
 		"3307",
 		filepath.Join(rigDir, ".beads"),
 	}, "|")
-	for _, name := range []string{"config.env", "migrate.env"} {
-		data, err := os.ReadFile(filepath.Join(captureDir, name))
-		if err != nil {
-			t.Fatalf("read %s: %v", name, err)
-		}
-		if got := strings.TrimSpace(string(data)); got != wantPinned {
-			t.Fatalf("%s = %q, want %q", name, got, wantPinned)
-		}
+	data, err := os.ReadFile(filepath.Join(captureDir, "migrate.env"))
+	if err != nil {
+		t.Fatalf("read migrate.env: %v", err)
+	}
+	if got := strings.TrimSpace(string(data)); got != wantPinned {
+		t.Fatalf("migrate.env = %q, want %q", got, wantPinned)
+	}
+	if _, err := os.Stat(filepath.Join(captureDir, "config.env")); !os.IsNotExist(err) {
+		t.Fatalf("config.env exists after init; err=%v", err)
 	}
 	listData, err := os.ReadFile(filepath.Join(captureDir, "list.env"))
 	if err != nil {
@@ -3703,11 +4350,11 @@ esac
 	}
 
 	cmd := exec.Command(script, "init", cityPath, "gc", "gascity")
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"GC_BIN="+currentGCBinaryForTests(t),
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
@@ -3833,11 +4480,11 @@ esac
 	}
 
 	cmd := exec.Command(script, "init", cityPath, "gc", "gascity")
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"GC_BIN="+fakeGC,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
@@ -3922,11 +4569,11 @@ esac
 	}
 
 	cmd := exec.Command(script, "init", cityPath, "gc", "gascity")
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"GC_BIN="+currentGCBinaryForTests(t),
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
@@ -3986,10 +4633,10 @@ exit 0
 	}
 
 	cmd := exec.Command(script, "init", cityPath, "gc", "gascity")
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
@@ -4112,31 +4759,32 @@ esac
 	}
 
 	cmd := exec.Command(script, "init", cityPath, "gc", "gascity")
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"GC_BIN="+fakeGC,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
 	}
 
-	for _, name := range []string{"config-db.log", "migrate-db.log"} {
-		data, err := os.ReadFile(filepath.Join(captureDir, name))
-		if err != nil {
-			t.Fatalf("ReadFile(%s): %v", name, err)
-		}
-		lines := strings.Fields(string(data))
-		if len(lines) == 0 {
-			t.Fatalf("%s empty", name)
-		}
-		for _, line := range lines {
-			if line != "gascity" {
-				t.Fatalf("%s line = %q, want gascity", name, line)
-			}
+	data, err := os.ReadFile(filepath.Join(captureDir, "migrate-db.log"))
+	if err != nil {
+		t.Fatalf("ReadFile(migrate-db.log): %v", err)
+	}
+	lines := strings.Fields(string(data))
+	if len(lines) == 0 {
+		t.Fatal("migrate-db.log empty")
+	}
+	for _, line := range lines {
+		if line != "gascity" {
+			t.Fatalf("migrate-db.log line = %q, want gascity", line)
 		}
 	}
+	if _, err := os.Stat(filepath.Join(captureDir, "config-db.log")); !os.IsNotExist(err) {
+		t.Fatalf("config-db.log exists after init; err=%v", err)
+	}
 	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
 	if err != nil {
 		t.Fatalf("read metadata: %v", err)
@@ -4256,113 +4904,691 @@ esac
 	}
 
 	cmd := exec.Command(script, "init", cityPath, "gc", strings.ToUpper(managedDoltProbeDatabase))
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"GC_BIN="+fakeGC,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
+	}
+
+	data, err := os.ReadFile(filepath.Join(captureDir, "migrate-db.log"))
+	if err != nil {
+		t.Fatalf("ReadFile(migrate-db.log): %v", err)
+	}
+	lines := strings.Fields(string(data))
+	if len(lines) == 0 {
+		t.Fatal("migrate-db.log empty")
+	}
+	for _, line := range lines {
+		if line != strings.ToUpper(managedDoltProbeDatabase) {
+			t.Fatalf("migrate-db.log line = %q, want %s", line, strings.ToUpper(managedDoltProbeDatabase))
+		}
+	}
+	if _, err := os.Stat(filepath.Join(captureDir, "config-db.log")); !os.IsNotExist(err) {
+		t.Fatalf("config-db.log exists after init; err=%v", err)
+	}
+
+	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
+	if err != nil {
+		t.Fatalf("read metadata: %v", err)
+	}
+	metaText := string(metaData)
+	if !strings.Contains(metaText, `"dolt_database": "`+strings.ToUpper(managedDoltProbeDatabase)+`"`) || !strings.Contains(metaText, `"project_id": "backfilled-project-id"`) {
+		t.Fatalf("metadata = %s", metaText)
+	}
+}
+
+func TestEnforceCanonicalScopeMetadataForInitRepairsWrongDoltDatabaseFromExplicitCanonicalIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"), []byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"wrong-db","dolt_host":"127.0.0.1","dolt_user":"legacy","dolt_password":"secret","dolt_server_host":"legacy.example.com","dolt_server_port":"3307","dolt_server_user":"legacy-user","dolt_port":"4406"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := enforceCanonicalScopeMetadataForInit(fsys.OSFS{}, cityPath, "gascity"); err != nil {
+		t.Fatalf("enforceCanonicalScopeMetadataForInit: %v", err)
+	}
+
+	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
+	if err != nil {
+		t.Fatalf("read metadata: %v", err)
+	}
+	metaText := string(metaData)
+	if !strings.Contains(metaText, `"dolt_database": "gascity"`) {
+		t.Fatalf("metadata should be repaired to canonical database:\n%s", metaText)
+	}
+	for _, forbidden := range []string{"dolt_host", "dolt_user", "dolt_password", "dolt_server_host", "dolt_server_port", "dolt_server_user", "dolt_port"} {
+		if strings.Contains(metaText, forbidden) {
+			t.Fatalf("metadata should scrub deprecated field %s:\n%s", forbidden, metaText)
+		}
+	}
+}
+
+func TestEnforceCanonicalScopeMetadataForInitScrubsDeprecatedMetadataEndpointAuthFields(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"), []byte(`{"database":"legacy","backend":"legacy","dolt_mode":"embedded","dolt_database":"wrong-db","custom":"keep","dolt_host":"127.0.0.1","dolt_user":"legacy-user","dolt_password":"legacy-pass","dolt_server_host":"legacy.example.com","dolt_server_port":"3307","dolt_server_user":"legacy-server-user","dolt_port":"4406"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := enforceCanonicalScopeMetadataForInit(fsys.OSFS{}, cityPath, "gascity"); err != nil {
+		t.Fatalf("enforceCanonicalScopeMetadataForInit: %v", err)
+	}
+	if err := enforceCanonicalScopeMetadataForInit(fsys.OSFS{}, cityPath, "gascity"); err != nil {
+		t.Fatalf("second enforceCanonicalScopeMetadataForInit: %v", err)
+	}
+
+	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
+	if err != nil {
+		t.Fatalf("read metadata: %v", err)
+	}
+	var meta map[string]any
+	if err := json.Unmarshal(metaData, &meta); err != nil {
+		t.Fatalf("unmarshal metadata: %v", err)
+	}
+	for _, forbidden := range []string{"dolt_host", "dolt_user", "dolt_password", "dolt_server_host", "dolt_server_port", "dolt_server_user", "dolt_port"} {
+		if _, ok := meta[forbidden]; ok {
+			t.Fatalf("metadata should scrub %s: %s", forbidden, string(metaData))
+		}
+	}
+	for key, want := range map[string]string{
+		"database":      "dolt",
+		"backend":       "dolt",
+		"dolt_mode":     "server",
+		"dolt_database": "gascity",
+		"custom":        "keep",
+	} {
+		if got := strings.TrimSpace(fmt.Sprint(meta[key])); got != want {
+			t.Fatalf("%s = %q, want %q", key, got, want)
+		}
+	}
+}
+
+func TestGcBeadsBdInitPreservesMetadataIdentityWhenCanonicalUnknownAndDatabaseMustBeCreated(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"), []byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"gascity"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	script := gcBeadsBdScriptPath(cityPath)
+
+	binDir := filepath.Join(t.TempDir(), "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	sqlLog := filepath.Join(t.TempDir(), "dolt-sql.log")
+	createdFile := filepath.Join(t.TempDir(), "created-gascity")
+
+	fakeBd := filepath.Join(binDir, "bd")
+	fakeBdScript := `#!/bin/sh
+set -eu
+case "${1:-}" in
+  list|config|migrate)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`
+	if err := os.WriteFile(fakeBd, []byte(fakeBdScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeDolt := filepath.Join(binDir, "dolt")
+	fakeDoltScript := `#!/bin/sh
+set -eu
+query=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "-q" ]; then
+    query="$arg"
+    break
+  fi
+  prev="$arg"
+done
+printf '%s\n' "$query" >> "` + sqlLog + `"
+case "$query" in
+  'USE ` + "`gascity`" + `')
+    if [ -f "` + createdFile + `" ]; then
+      exit 0
+    fi
+    exit 1
+    ;;
+  'CREATE DATABASE IF NOT EXISTS ` + "`gascity`" + `')
+    : > "` + createdFile + `"
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`
+	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(script, "init", cityPath, "gc")
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
+		"GC_CITY_PATH="+cityPath,
+		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
+	)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
+	}
+
+	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
+	if err != nil {
+		t.Fatalf("read metadata: %v", err)
+	}
+	if got := string(metaData); !strings.Contains(got, `"dolt_database":"gascity"`) && !strings.Contains(got, `"dolt_database": "gascity"`) {
+		t.Fatalf("metadata should preserve existing database identity:\n%s", got)
+	}
+
+	sqlData, err := os.ReadFile(sqlLog)
+	if err != nil {
+		t.Fatalf("read sql log: %v", err)
+	}
+	sqlText := string(sqlData)
+	if !strings.Contains(sqlText, "CREATE DATABASE IF NOT EXISTS `gascity`") {
+		t.Fatalf("expected canonical database creation, got:\n%s", sqlText)
+	}
+	if strings.Contains(sqlText, "CREATE DATABASE IF NOT EXISTS `gc`") {
+		t.Fatalf("should not create prefix database when preserving metadata identity:\n%s", sqlText)
+	}
+}
+
+// TestGcBeadsBdInitFastPathRepairsRuntimeConfigDirectly guards the fix for
+// bd v1.0.3 rejecting DB-backed config writes during the managed fast path
+// after the schema already exists. In that state, the script should repair
+// issue_prefix and types.custom directly without falling back to bd init.
+func TestGcBeadsBdInitFastPathRepairsRuntimeConfigDirectly(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	// Seed metadata.json, simulating seedDeferredManagedBeadsBeforeProviderReadiness
+	// writing it before Dolt starts (the trigger for the fast path on a fresh city).
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"),
+		[]byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"hq"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	script := gcBeadsBdScriptPath(cityPath)
+
+	binDir := filepath.Join(t.TempDir(), "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	initArgsFile := filepath.Join(t.TempDir(), "unexpected-bd-init-args")
+	sqlLogFile := filepath.Join(t.TempDir(), "dolt-sql-args")
+	fakeBd := filepath.Join(binDir, "bd")
+	fakeBdScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+cmd="${1:-}"
+case "$cmd" in
+  config)
+    sub="${2:-}"
+    key="${3:-}"
+    if [ "$sub" = "set" ] && { [ "$key" = "issue_prefix" ] || [ "$key" = "types.custom" ]; }; then
+      echo "$key must not be set through bd config set" >&2
+      exit 2
+    fi
+    exit 0
+    ;;
+  init)
+    printf '%%s\n' "$@" > %q
+    echo "bd init fallback should not run" >&2
+    exit 2
+    ;;
+  migrate|list)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, initArgsFile)
+	if err := os.WriteFile(fakeBd, []byte(fakeBdScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeDolt := filepath.Join(binDir, "dolt")
+	fakeDoltScript := fmt.Sprintf("#!/bin/sh\nprintf '%%s\\n' \"$@\" >> %q\nexit 0\n", sqlLogFile)
+	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(script, "init", cityPath, "gc", "hq")
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
+		"GC_CITY_PATH="+cityPath,
+		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
+	)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
+	}
+
+	if data, err := os.ReadFile(initArgsFile); err == nil {
+		t.Fatalf("bd init fallback unexpectedly ran with argv:\n%s", data)
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("stat bd init argv: %v", err)
+	}
+
+	sqlData, err := os.ReadFile(sqlLogFile)
+	if err != nil {
+		t.Fatalf("read dolt SQL log: %v", err)
+	}
+	sqlText := string(sqlData)
+	for _, want := range []string{
+		"SELECT 1 FROM config LIMIT 1",
+		"USE `hq`",
+		"VALUES ('issue_prefix', 'gc') ON DUPLICATE KEY UPDATE",
+		"VALUES ('types.custom', 'molecule,convoy,message,event,gate,merge-request,agent,role,rig,session,spec,convergence') ON DUPLICATE KEY UPDATE",
+	} {
+		if !strings.Contains(sqlText, want) {
+			t.Fatalf("dolt SQL log missing %q:\n%s", want, sqlText)
+		}
+	}
+}
+
+func TestGcBeadsBdInitMetadataOnlyFallsThroughToForcedBdInitWithPinnedDatabaseWhenSchemaMissing(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"),
+		[]byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"hq"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	script := gcBeadsBdScriptPath(cityPath)
+
+	binDir := filepath.Join(t.TempDir(), "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	initArgsFile := filepath.Join(t.TempDir(), "bd-init-args")
+	initCountFile := filepath.Join(t.TempDir(), "bd-init-count")
+	sqlLogFile := filepath.Join(t.TempDir(), "dolt-sql-args")
+	fakeBd := filepath.Join(binDir, "bd")
+	fakeBdScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+cmd="${1:-}"
+case "$cmd" in
+  init)
+    has_force=false
+    for arg in "$@"; do
+      if [ "$arg" = "--force" ]; then
+        has_force=true
+      fi
+    done
+    if [ "$has_force" != "true" ]; then
+      echo "bd init fallback must force reinitialize existing workspace" >&2
+      exit 2
+    fi
+    printf '1\n' > %q
+    printf '%%s\n' "$@" > %q
+    exit 0
+    ;;
+  config|migrate|list)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, initCountFile, initArgsFile)
+	if err := os.WriteFile(fakeBd, []byte(fakeBdScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeDolt := filepath.Join(binDir, "dolt")
+	fakeDoltScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+query=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "-q" ]; then
+    query="$arg"
+    break
+  fi
+  prev="$arg"
+done
+printf '%%s\n' "$query" >> %q
+case "$query" in
+  'USE `+"`hq`"+`; SELECT 1 FROM config LIMIT 1')
+    if [ ! -f %q ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''types.custom'\'', '\''molecule,convoy,message,event,gate,merge-request,agent,role,rig,session,spec,convergence'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''issue_prefix'\'', '\''gc'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, sqlLogFile, initCountFile)
+	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(script, "init", cityPath, "gc", "hq")
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
+		"GC_CITY_PATH="+cityPath,
+		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
+	)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
+	}
+
+	data, err := os.ReadFile(initArgsFile)
+	if err != nil {
+		t.Fatalf("expected bd init fallback to run: %v", err)
+	}
+	got := string(data)
+	for _, want := range []string{"--force", "--server", "-p", "gc", "--database", "hq", cityPath} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("bd init argv missing %q:\n%s", want, got)
+		}
+	}
+	if strings.Contains(got, "-p hq") {
+		t.Fatalf("bd init should keep visible prefix gc while pinning database hq:\n%s", got)
+	}
+}
+
+func TestGcBeadsBdInitWaitsForSchemaVisibilityBeforeRuntimeRepair(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"),
+		[]byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"hq"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	script := gcBeadsBdScriptPath(cityPath)
+
+	binDir := filepath.Join(t.TempDir(), "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	probeCountFile := filepath.Join(t.TempDir(), "schema-probe-count")
+	fakeBd := filepath.Join(binDir, "bd")
+	fakeBdScript := `#!/bin/sh
+set -eu
+case "${1:-}" in
+  init|config|migrate|list)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`
+	if err := os.WriteFile(fakeBd, []byte(fakeBdScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeDolt := filepath.Join(binDir, "dolt")
+	fakeDoltScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+query=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "-q" ]; then
+    query="$arg"
+    break
+  fi
+  prev="$arg"
+done
+case "$query" in
+  'USE `+"`hq`"+`; SELECT 1 FROM config LIMIT 1')
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
+    fi
+    count=$((count + 1))
+    printf '%%s\n' "$count" > %q
+    if [ "$count" -lt 3 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''types.custom'\'', '\''molecule,convoy,message,event,gate,merge-request,agent,role,rig,session,spec,convergence'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    if [ ! -f %q ] || [ "$(cat %q)" -lt 3 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''issue_prefix'\'', '\''gc'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    if [ ! -f %q ] || [ "$(cat %q)" -lt 3 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, probeCountFile, probeCountFile, probeCountFile, probeCountFile, probeCountFile, probeCountFile, probeCountFile)
+	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(script, "init", cityPath, "gc", "hq")
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
+		"GC_CITY_PATH="+cityPath,
+		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
+	)...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
+	}
+
+	data, err := os.ReadFile(probeCountFile)
+	if err != nil {
+		t.Fatalf("read schema probe count: %v", err)
+	}
+	if got := strings.TrimSpace(string(data)); got != "3" {
+		t.Fatalf("schema probe count = %q, want 3", got)
+	}
+}
+
+func TestGcBeadsBdInitRetriesPlainInitWhenSchemaStillMissingAfterSuccess(t *testing.T) {
+	cityPath := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := MaterializeBuiltinPacks(cityPath); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks: %v", err)
+	}
+	script := gcBeadsBdScriptPath(cityPath)
+
+	binDir := filepath.Join(t.TempDir(), "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	initCountFile := filepath.Join(t.TempDir(), "bd-init-count")
+	initArgsFile := filepath.Join(t.TempDir(), "bd-init-args")
+	fakeBd := filepath.Join(binDir, "bd")
+	fakeBdScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+case "${1:-}" in
+  init)
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
+    fi
+    count=$((count + 1))
+    printf '%%s\n' "$count" > %q
+    printf '%%s\n' "$*" >> %q
+    exit 0
+    ;;
+  config|migrate|list)
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, initCountFile, initCountFile, initCountFile, initArgsFile)
+	if err := os.WriteFile(fakeBd, []byte(fakeBdScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	fakeDolt := filepath.Join(binDir, "dolt")
+	fakeDoltScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+query=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "-q" ]; then
+    query="$arg"
+    break
+  fi
+  prev="$arg"
+done
+case "$query" in
+  'USE `+"`hq`"+`')
+    exit 0
+    ;;
+  'CREATE DATABASE IF NOT EXISTS `+"`hq`"+`')
+    exit 0
+    ;;
+  'DROP DATABASE IF EXISTS `+"`beads_gc`"+`')
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; SELECT 1 FROM config LIMIT 1')
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
+    fi
+    if [ "$count" -lt 2 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''types.custom'\'', '\''molecule,convoy,message,event,gate,merge-request,agent,role,rig,session,spec,convergence'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
+    fi
+    if [ "$count" -lt 2 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''issue_prefix'\'', '\''gc'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
+    fi
+    if [ "$count" -lt 2 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+`, initCountFile, initCountFile, initCountFile, initCountFile, initCountFile, initCountFile)
+	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(script, "init", cityPath, "gc", "hq")
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
+		"GC_CITY_PATH="+cityPath,
+		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
 	}
 
-	for _, name := range []string{"config-db.log", "migrate-db.log"} {
-		data, err := os.ReadFile(filepath.Join(captureDir, name))
-		if err != nil {
-			t.Fatalf("ReadFile(%s): %v", name, err)
-		}
-		lines := strings.Fields(string(data))
-		if len(lines) == 0 {
-			t.Fatalf("%s empty", name)
-		}
-		for _, line := range lines {
-			if line != strings.ToUpper(managedDoltProbeDatabase) {
-				t.Fatalf("%s line = %q, want %s", name, line, strings.ToUpper(managedDoltProbeDatabase))
-			}
-		}
-	}
-
-	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
-	if err != nil {
-		t.Fatalf("read metadata: %v", err)
-	}
-	metaText := string(metaData)
-	if !strings.Contains(metaText, `"dolt_database": "`+strings.ToUpper(managedDoltProbeDatabase)+`"`) || !strings.Contains(metaText, `"project_id": "backfilled-project-id"`) {
-		t.Fatalf("metadata = %s", metaText)
-	}
-}
-
-func TestEnforceCanonicalScopeMetadataForInitRepairsWrongDoltDatabaseFromExplicitCanonicalIdentity(t *testing.T) {
-	cityPath := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"), []byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"wrong-db","dolt_host":"127.0.0.1","dolt_user":"legacy","dolt_password":"secret","dolt_server_host":"legacy.example.com","dolt_server_port":"3307","dolt_server_user":"legacy-user","dolt_port":"4406"}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := enforceCanonicalScopeMetadataForInit(fsys.OSFS{}, cityPath, "gascity"); err != nil {
-		t.Fatalf("enforceCanonicalScopeMetadataForInit: %v", err)
-	}
-
-	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
+	countData, err := os.ReadFile(initCountFile)
 	if err != nil {
-		t.Fatalf("read metadata: %v", err)
-	}
-	metaText := string(metaData)
-	if !strings.Contains(metaText, `"dolt_database": "gascity"`) {
-		t.Fatalf("metadata should be repaired to canonical database:\n%s", metaText)
-	}
-	for _, forbidden := range []string{"dolt_host", "dolt_user", "dolt_password", "dolt_server_host", "dolt_server_port", "dolt_server_user", "dolt_port"} {
-		if strings.Contains(metaText, forbidden) {
-			t.Fatalf("metadata should scrub deprecated field %s:\n%s", forbidden, metaText)
-		}
-	}
-}
-
-func TestEnforceCanonicalScopeMetadataForInitScrubsDeprecatedMetadataEndpointAuthFields(t *testing.T) {
-	cityPath := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"), []byte(`{"database":"legacy","backend":"legacy","dolt_mode":"embedded","dolt_database":"wrong-db","custom":"keep","dolt_host":"127.0.0.1","dolt_user":"legacy-user","dolt_password":"legacy-pass","dolt_server_host":"legacy.example.com","dolt_server_port":"3307","dolt_server_user":"legacy-server-user","dolt_port":"4406"}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := enforceCanonicalScopeMetadataForInit(fsys.OSFS{}, cityPath, "gascity"); err != nil {
-		t.Fatalf("enforceCanonicalScopeMetadataForInit: %v", err)
+		t.Fatalf("read init count: %v", err)
 	}
-	if err := enforceCanonicalScopeMetadataForInit(fsys.OSFS{}, cityPath, "gascity"); err != nil {
-		t.Fatalf("second enforceCanonicalScopeMetadataForInit: %v", err)
+	if got := strings.TrimSpace(string(countData)); got != "2" {
+		t.Fatalf("bd init count = %q, want 2", got)
 	}
 
-	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
+	argsData, err := os.ReadFile(initArgsFile)
 	if err != nil {
-		t.Fatalf("read metadata: %v", err)
-	}
-	var meta map[string]any
-	if err := json.Unmarshal(metaData, &meta); err != nil {
-		t.Fatalf("unmarshal metadata: %v", err)
+		t.Fatalf("read init args: %v", err)
 	}
-	for _, forbidden := range []string{"dolt_host", "dolt_user", "dolt_password", "dolt_server_host", "dolt_server_port", "dolt_server_user", "dolt_port"} {
-		if _, ok := meta[forbidden]; ok {
-			t.Fatalf("metadata should scrub %s: %s", forbidden, string(metaData))
+	gotArgs := string(argsData)
+	for _, want := range []string{"init --quiet --server -p gc --database hq"} {
+		if !strings.Contains(gotArgs, want) {
+			t.Fatalf("bd init retry args missing %q:\n%s", want, gotArgs)
 		}
 	}
-	for key, want := range map[string]string{
-		"database":      "dolt",
-		"backend":       "dolt",
-		"dolt_mode":     "server",
-		"dolt_database": "gascity",
-		"custom":        "keep",
-	} {
-		if got := strings.TrimSpace(fmt.Sprint(meta[key])); got != want {
-			t.Fatalf("%s = %q, want %q", key, got, want)
-		}
+	if strings.Contains(gotArgs, "--force") {
+		t.Fatalf("post-init schema retry should rerun plain init, got:\n%s", gotArgs)
 	}
 }
 
-func TestGcBeadsBdInitPreservesMetadataIdentityWhenCanonicalUnknownAndDatabaseMustBeCreated(t *testing.T) {
+func TestGcBeadsBdInitDropsMetadataBeforeRetryingInitAfterForcedFallback(t *testing.T) {
 	cityPath := t.TempDir()
 	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
 		t.Fatal(err)
@@ -4370,7 +5596,8 @@ func TestGcBeadsBdInitPreservesMetadataIdentityWhenCanonicalUnknownAndDatabaseMu
 	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"), []byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"gascity"}`), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(cityPath, ".beads", "metadata.json"),
+		[]byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"hq"}`), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -4384,27 +5611,42 @@ func TestGcBeadsBdInitPreservesMetadataIdentityWhenCanonicalUnknownAndDatabaseMu
 		t.Fatal(err)
 	}
 
-	sqlLog := filepath.Join(t.TempDir(), "dolt-sql.log")
-	createdFile := filepath.Join(t.TempDir(), "created-gascity")
-
+	initCountFile := filepath.Join(t.TempDir(), "bd-init-count")
+	initArgsFile := filepath.Join(t.TempDir(), "bd-init-args")
+	initStateFile := filepath.Join(t.TempDir(), "bd-init-state")
 	fakeBd := filepath.Join(binDir, "bd")
-	fakeBdScript := `#!/bin/sh
+	fakeBdScript := fmt.Sprintf(`#!/bin/sh
 set -eu
 case "${1:-}" in
-  list|config|migrate)
+  init)
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
+    fi
+    count=$((count + 1))
+    printf '%%s\n' "$count" > %q
+    if [ -f "$BEADS_DIR/metadata.json" ]; then
+      printf 'metadata=yes args=%%s\n' "$*" >> %q
+    else
+      printf 'metadata=no args=%%s\n' "$*" >> %q
+    fi
+    printf '%%s\n' "$*" >> %q
+    exit 0
+    ;;
+  config|migrate|list)
     exit 0
     ;;
   *)
     exit 0
     ;;
 esac
-`
+`, initCountFile, initCountFile, initCountFile, initStateFile, initStateFile, initArgsFile)
 	if err := os.WriteFile(fakeBd, []byte(fakeBdScript), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
 	fakeDolt := filepath.Join(binDir, "dolt")
-	fakeDoltScript := `#!/bin/sh
+	fakeDoltScript := fmt.Sprintf(`#!/bin/sh
 set -eu
 query=""
 prev=""
@@ -4415,55 +5657,64 @@ for arg in "$@"; do
   fi
   prev="$arg"
 done
-printf '%s\n' "$query" >> "` + sqlLog + `"
 case "$query" in
-  'USE ` + "`gascity`" + `')
-    if [ -f "` + createdFile + `" ]; then
-      exit 0
+  'USE `+"`hq`"+`')
+    exit 0
+    ;;
+  'CREATE DATABASE IF NOT EXISTS `+"`hq`"+`')
+    exit 0
+    ;;
+  'DROP DATABASE IF EXISTS `+"`beads_gc`"+`')
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; SELECT 1 FROM config LIMIT 1')
+    count=0
+    if [ -f %q ]; then
+      count=$(cat %q)
     fi
-    exit 1
+    if [ "$count" -lt 2 ]; then
+      echo "table not found: config" >&2
+      exit 1
+    fi
+    exit 0
     ;;
-  'CREATE DATABASE IF NOT EXISTS ` + "`gascity`" + `')
-    : > "` + createdFile + `"
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''types.custom'\'', '\''molecule,convoy,message,event,gate,merge-request,agent,role,rig,session,spec,convergence'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
+    exit 0
+    ;;
+  'USE `+"`hq`"+`; INSERT INTO config (`+"`key`"+`, value) VALUES ('\''issue_prefix'\'', '\''gc'\'') ON DUPLICATE KEY UPDATE value = VALUES(value)')
     exit 0
     ;;
   *)
     exit 0
     ;;
 esac
-`
+`, initCountFile, initCountFile)
 	if err := os.WriteFile(fakeDolt, []byte(fakeDoltScript), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
-	cmd := exec.Command(script, "init", cityPath, "gc")
-	cmd.Env = sanitizedBaseEnv(
+	cmd := exec.Command(script, "init", cityPath, "gc", "hq")
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
 	}
 
-	metaData, err := os.ReadFile(filepath.Join(cityPath, ".beads", "metadata.json"))
-	if err != nil {
-		t.Fatalf("read metadata: %v", err)
-	}
-	if got := string(metaData); !strings.Contains(got, `"dolt_database":"gascity"`) && !strings.Contains(got, `"dolt_database": "gascity"`) {
-		t.Fatalf("metadata should preserve existing database identity:\n%s", got)
-	}
-
-	sqlData, err := os.ReadFile(sqlLog)
+	stateData, err := os.ReadFile(initStateFile)
 	if err != nil {
-		t.Fatalf("read sql log: %v", err)
-	}
-	sqlText := string(sqlData)
-	if !strings.Contains(sqlText, "CREATE DATABASE IF NOT EXISTS `gascity`") {
-		t.Fatalf("expected canonical database creation, got:\n%s", sqlText)
+		t.Fatalf("read init state: %v", err)
 	}
-	if strings.Contains(sqlText, "CREATE DATABASE IF NOT EXISTS `gc`") {
-		t.Fatalf("should not create prefix database when preserving metadata identity:\n%s", sqlText)
+	gotState := string(stateData)
+	for _, want := range []string{
+		"metadata=yes args=init --force --quiet --server -p gc --database hq",
+		"metadata=no args=init --quiet --server -p gc --database hq",
+	} {
+		if !strings.Contains(gotState, want) {
+			t.Fatalf("init state missing %q:\n%s", want, gotState)
+		}
 	}
 }
 
@@ -4696,6 +5947,7 @@ dolt.auto-start: false
 func TestValidateCanonicalCompatDoltDriftRejectsCityMismatch(t *testing.T) {
 	cityPath := t.TempDir()
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	if err := os.MkdirAll(filepath.Join(cityPath, ".beads"), 0o700); err != nil {
 		t.Fatal(err)
 	}
@@ -4790,6 +6042,8 @@ esac
 	if err := os.WriteFile(fakeDolt, []byte(fakeScript), 0o755); err != nil {
 		t.Fatal(err)
 	}
+	invocationFile := filepath.Join(t.TempDir(), "gc-invocations.log")
+	fakeGC := writeFakeManagedConfigWriterGC(t, binDir, invocationFile)
 
 	compatPort := reserveRandomTCPPort(t)
 	compatListener := startTCPListenerProcess(t, compatPort)
@@ -4810,6 +6064,7 @@ esac
 
 	env := sanitizedBaseEnv(
 		"GC_CITY_PATH="+cityPath,
+		"GC_BIN="+fakeGC,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
 	)
 	runStart := func() {
@@ -4912,7 +6167,7 @@ data_dir: "$data_dir"
 behavior:
   auto_gc_behavior:
     enable: true
-    archive_level: 1
+    archive_level: 0
 EOF
     ;;
   "dolt-state allocate-port")
@@ -5167,7 +6422,7 @@ data_dir: "$data_dir"
 behavior:
   auto_gc_behavior:
     enable: true
-    archive_level: 1
+    archive_level: 0
 EOF
     printf '12345\n' > "$pid_file"
     printf '{"running":true,"pid":12345,"port":%%s,"data_dir":"%%s","started_at":"2026-04-14T00:00:00Z"}\n' "$port" "$data_dir" > "$state_file"
@@ -6408,7 +7663,7 @@ func TestManagedDoltConfigGoWriterMatchesShellFallbackSemantics(t *testing.T) {
 		t.Fatal(err)
 	}
 	goConfigPath := filepath.Join(t.TempDir(), "go", "dolt-config.yaml")
-	if err := writeManagedDoltConfigFile(goConfigPath, "0.0.0.0", "3311", filepath.Join(cityPath, ".beads", "dolt"), "info"); err != nil {
+	if err := writeManagedDoltConfigFile(goConfigPath, "0.0.0.0", "3311", filepath.Join(cityPath, ".beads", "dolt"), "info", 0); err != nil {
 		t.Fatalf("writeManagedDoltConfigFile: %v", err)
 	}
 
@@ -6623,13 +7878,15 @@ INNERPY
     exit 0
     ;;
 esac
-`
+	`
 	if err := os.WriteFile(fakeDolt, []byte(fakeScript), 0o755); err != nil {
 		t.Fatal(err)
 	}
+	gcBin := currentGCBinaryForTests(t)
 
 	env := sanitizedBaseEnv(
 		"GC_CITY_PATH="+cityPath,
+		"GC_BIN="+gcBin,
 		"GC_DOLT_PORT="+port,
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
 	)
@@ -6772,7 +8029,7 @@ INNERPY
     exit 0
     ;;
 esac
-`, countFile, filepath.Join(cityPath, ".beads", "dolt"), deletedMarkerFile)
+	`, countFile, filepath.Join(cityPath, ".beads", "dolt"), deletedMarkerFile)
 	if err := os.WriteFile(fakeDolt, []byte(fakeScript), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -6949,10 +8206,6 @@ esac
 	}
 	initialStartCount := readDoltStartCountForTest(t, countFile)
 
-	realNC, err := exec.LookPath("nc")
-	if err != nil {
-		t.Skip("nc not installed")
-	}
 	shimDir := filepath.Join(t.TempDir(), "shim")
 	if err := os.MkdirAll(shimDir, 0o755); err != nil {
 		t.Fatal(err)
@@ -6962,13 +8215,12 @@ esac
 	shim := fmt.Sprintf(`#!/bin/sh
 set -eu
 probe_file=%q
-real_nc=%q
 if [ ! -f "$probe_file" ]; then
   : > "$probe_file"
   exit 1
 fi
-exec "$real_nc" "$@"
-`, probeFile, realNC)
+exit 0
+`, probeFile)
 	if err := os.WriteFile(shimPath, []byte(shim), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -7003,6 +8255,7 @@ func TestValidateCanonicalCompatDoltDriftRejectsInheritedRigCompatOverrideWithRe
 	rigRel := "frontend"
 	rigPath := filepath.Join(cityPath, rigRel)
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	for _, dir := range []string{cityPath, rigPath} {
 		if err := os.MkdirAll(filepath.Join(dir, ".beads"), 0o700); err != nil {
 			t.Fatal(err)
@@ -7056,6 +8309,7 @@ func TestValidateCanonicalCompatDoltDriftRejectsInheritedRigCompatOverride(t *te
 	cityPath := t.TempDir()
 	rigPath := filepath.Join(cityPath, "frontend")
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	for _, dir := range []string{cityPath, rigPath} {
 		if err := os.MkdirAll(filepath.Join(dir, ".beads"), 0o700); err != nil {
 			t.Fatal(err)
@@ -7116,6 +8370,7 @@ dolt.port: 3307
 	}
 
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	cfg := &config.City{
 		Workspace: config.Workspace{Name: "test-city"},
 		Dolt:      config.DoltConfig{Host: "compat-db.example.com", Port: 4406},
@@ -7264,6 +8519,7 @@ dolt.auto-start: false
 	}
 
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	cfg := &config.City{Workspace: config.Workspace{Name: "test-city"}}
 	if err := startBeadsLifecycle(cityPath, "test-city", cfg, io.Discard); err == nil || !strings.Contains(err.Error(), "invalid canonical city endpoint state") {
 		t.Fatalf("startBeadsLifecycle() error = %v, want invalid canonical city endpoint state", err)
@@ -7295,6 +8551,7 @@ dolt.auto-start: false
 	}
 
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	cfg := &config.City{
 		Workspace: config.Workspace{Name: "test-city"},
 		Rigs:      []config.Rig{{Name: "frontend", Path: rigPath, Prefix: "fe"}},
@@ -7307,6 +8564,7 @@ dolt.auto-start: false
 func TestStartBeadsLifecycleRegistersDoltConfig(t *testing.T) {
 	cityPath := t.TempDir()
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_DOLT", "skip")
 	t.Setenv("GC_DOLT_HOST", "")
 	_ = os.Unsetenv("GC_DOLT_HOST")
@@ -7329,6 +8587,40 @@ func TestStartBeadsLifecycleRegistersDoltConfig(t *testing.T) {
 	}
 }
 
+func TestStartBeadsLifecycleRegistersArchiveLevelOnlyDoltConfig(t *testing.T) {
+	realCity := t.TempDir()
+	aliasRoot := t.TempDir()
+	aliasCity := filepath.Join(aliasRoot, "city-link")
+	if err := os.Symlink(realCity, aliasCity); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", aliasCity)
+	t.Setenv("GC_DOLT", "skip")
+
+	archiveLevel := 1
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Dolt:      config.DoltConfig{ArchiveLevel: &archiveLevel},
+	}
+	if err := startBeadsLifecycle(aliasCity, "test-city", cfg, io.Discard); err != nil {
+		t.Fatalf("startBeadsLifecycle: %v", err)
+	}
+	t.Cleanup(func() { cityDoltConfigs.Delete(normalizePathForCompare(realCity)) })
+
+	envEntries := providerLifecycleProcessEnv(realCity, "exec:"+gcBeadsBdScriptPath(realCity))
+	env := map[string]string{}
+	for _, entry := range envEntries {
+		key, value, ok := strings.Cut(entry, "=")
+		if ok {
+			env[key] = value
+		}
+	}
+	if got := env["GC_DOLT_ARCHIVE_LEVEL"]; got != "1" {
+		t.Fatalf("GC_DOLT_ARCHIVE_LEVEL = %q, want 1", got)
+	}
+}
+
 func TestStartBeadsLifecycleManagedDeferredDoesNotRequireRuntimeState(t *testing.T) {
 	cityPath := t.TempDir()
 	rigPath := filepath.Join(cityPath, "rig")
@@ -7373,6 +8665,7 @@ func TestStartBeadsLifecycleManagedDeferredDoesNotRequireRuntimeState(t *testing
 	}
 
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	cfg := &config.City{
 		Workspace: config.Workspace{Name: "test-city"},
 		Rigs:      []config.Rig{{Name: "rig", Path: rigPath, Prefix: "rg"}},
@@ -7422,6 +8715,7 @@ dolt.port: "4406"
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 
 	// Defensively ensure the call log does not pre-exist. t.TempDir()
 	// provides a fresh directory, but other test-global resolution paths
@@ -7467,6 +8761,7 @@ dolt.port: "4406"
 	}
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	if err := shutdownBeadsProvider(cityPath); err != nil {
 		t.Fatalf("shutdownBeadsProvider() error = %v", err)
 	}
@@ -7498,6 +8793,7 @@ func TestStartBeadsLifecycleSkipsProviderForExternalHost(t *testing.T) {
 	}
 
 	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 	t.Setenv("GC_DOLT_HOST", "operator-override.example.com")
 	t.Setenv("GC_DOLT_PORT", "5511")
 	t.Setenv("BEADS_DOLT_SERVER_HOST", "operator-override.example.com")
@@ -7704,11 +9000,11 @@ esac
 	}
 
 	cmd := exec.Command(script, "init", rigPath, "fe", "fe")
-	cmd.Env = sanitizedBaseEnv(
+	cmd.Env = sanitizedBaseEnv(append(gcBeadsBdTestHomeEnv(t),
 		"GC_CITY_PATH="+cityPath,
 		"GC_BIN="+currentGCBinaryForTests(t),
 		"PATH="+strings.Join([]string{binDir, os.Getenv("PATH")}, string(os.PathListSeparator)),
-	)
+	)...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("gc-beads-bd init failed: %v\n%s", err, out)
@@ -7867,3 +9163,186 @@ func TestGcBeadsBdStartFallsBackToShellManagedConfigWriterWhenGCBinUnset(t *test
 		t.Fatalf("provider state port = %d, want non-zero", state.Port)
 	}
 }
+
+func TestAcquireProviderSemaphore_SerializesConcurrentOps(t *testing.T) {
+	t.Parallel()
+	cityPath := t.TempDir()
+
+	// First acquire succeeds immediately.
+	release1, err := acquireProviderSemaphore(context.Background(), cityPath)
+	if err != nil {
+		t.Fatalf("acquireProviderSemaphore first: %v", err)
+	}
+
+	// Second acquire should block.
+	acquired := make(chan struct{})
+	go func() {
+		release2, err := acquireProviderSemaphore(context.Background(), cityPath)
+		if err != nil {
+			return
+		}
+		close(acquired)
+		release2()
+	}()
+
+	select {
+	case <-acquired:
+		t.Fatal("second acquire succeeded while first still held")
+	case <-time.After(50 * time.Millisecond):
+		// Expected — still blocked.
+	}
+
+	// Release first — second should unblock.
+	release1()
+
+	select {
+	case <-acquired:
+		// Expected.
+	case <-time.After(2 * time.Second):
+		t.Fatal("second acquire did not unblock after release")
+	}
+}
+
+func TestAcquireProviderSemaphore_IndependentCities(t *testing.T) {
+	t.Parallel()
+	city1 := t.TempDir()
+	city2 := t.TempDir()
+
+	release1, err := acquireProviderSemaphore(context.Background(), city1)
+	if err != nil {
+		t.Fatalf("acquireProviderSemaphore city1: %v", err)
+	}
+	defer release1()
+
+	// Different city should not block.
+	acquired := make(chan struct{})
+	go func() {
+		release2, err := acquireProviderSemaphore(context.Background(), city2)
+		if err != nil {
+			return
+		}
+		close(acquired)
+		release2()
+	}()
+
+	select {
+	case <-acquired:
+		// Expected — different cities are independent.
+	case <-time.After(2 * time.Second):
+		t.Fatal("acquire for different city blocked unexpectedly")
+	}
+}
+
+func TestAcquireProviderSemaphoreHonorsContextDeadline(t *testing.T) {
+	t.Parallel()
+	cityPath := t.TempDir()
+
+	release1, err := acquireProviderSemaphore(context.Background(), cityPath)
+	if err != nil {
+		t.Fatalf("acquireProviderSemaphore first: %v", err)
+	}
+	defer release1()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+	defer cancel()
+	release2, err := acquireProviderSemaphore(ctx, cityPath)
+	if err == nil {
+		release2()
+		t.Fatal("second acquire succeeded while first still held")
+	}
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("acquireProviderSemaphore error = %v, want context deadline", err)
+	}
+}
+
+func TestEnsureBeadsProviderSerializesConcurrentExecStarts(t *testing.T) {
+	cityPath := t.TempDir()
+	script := filepath.Join(cityPath, "provider.sh")
+	lockDir := filepath.Join(cityPath, "provider.lock")
+	callLog := filepath.Join(cityPath, "provider.log")
+	scriptBody := fmt.Sprintf(`#!/bin/sh
+set -eu
+if [ "$1" = "start" ]; then
+  if ! mkdir %q 2>/dev/null; then
+    echo "overlap" >&2
+    exit 1
+  fi
+  echo "start" >> %q
+  sleep 0.1
+  rmdir %q
+  exit 0
+fi
+exit 2
+`, lockDir, callLog, lockDir)
+	if err := os.WriteFile(script, []byte(scriptBody), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
+
+	errs := make(chan error, 2)
+	for range 2 {
+		go func() {
+			errs <- ensureBeadsProvider(cityPath)
+		}()
+	}
+	for range 2 {
+		if err := <-errs; err != nil {
+			t.Fatalf("ensureBeadsProvider: %v", err)
+		}
+	}
+
+	data, err := os.ReadFile(callLog)
+	if err != nil {
+		t.Fatalf("read call log: %v", err)
+	}
+	if got := strings.Count(string(data), "start"); got != 2 {
+		t.Fatalf("start call count = %d, want 2; log:\n%s", got, data)
+	}
+}
+
+func TestHealthBeadsProviderSerializesConcurrentExecHealthChecks(t *testing.T) {
+	cityPath := t.TempDir()
+	script := filepath.Join(cityPath, "provider.sh")
+	lockDir := filepath.Join(cityPath, "provider.lock")
+	callLog := filepath.Join(cityPath, "provider.log")
+	scriptBody := fmt.Sprintf(`#!/bin/sh
+set -eu
+if [ "$1" = "health" ]; then
+  if ! mkdir %q 2>/dev/null; then
+    echo "overlap" >&2
+    exit 1
+  fi
+  echo "health" >> %q
+  sleep 0.1
+  rmdir %q
+  exit 0
+fi
+exit 2
+`, lockDir, callLog, lockDir)
+	if err := os.WriteFile(script, []byte(scriptBody), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
+
+	errs := make(chan error, 2)
+	for range 2 {
+		go func() {
+			errs <- healthBeadsProvider(cityPath)
+		}()
+	}
+	for range 2 {
+		if err := <-errs; err != nil {
+			t.Fatalf("healthBeadsProvider: %v", err)
+		}
+	}
+
+	data, err := os.ReadFile(callLog)
+	if err != nil {
+		t.Fatalf("read call log: %v", err)
+	}
+	if got := strings.Count(string(data), "health"); got != 2 {
+		t.Fatalf("health call count = %d, want 2; log:\n%s", got, data)
+	}
+}
diff --git a/cmd/gc/build_desired_state.go b/cmd/gc/build_desired_state.go
index 721f29ddf4..6051e5b0c8 100644
--- a/cmd/gc/build_desired_state.go
+++ b/cmd/gc/build_desired_state.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"log"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -23,36 +24,61 @@ import (
 // can pass ScaleCheckCounts to ComputePoolDesiredStates without re-running
 // scale_check commands.
 type DesiredStateResult struct {
-	State             map[string]TemplateParams
-	BaseState         map[string]TemplateParams
-	ScaleCheckCounts  map[string]int // nil when store is nil or scale_check not run
-	PoolDesiredCounts map[string]int // runtime-owned demand snapshot; reused on stable patrol ticks when still fresh
-	WorkSet           map[string]bool
-	AssignedWorkBeads []beads.Bead // actionable assigned work: in_progress or ready+assigned
+	State            map[string]TemplateParams
+	BaseState        map[string]TemplateParams
+	ScaleCheckCounts map[string]int // nil when store is nil or scale_check not run
+	// ScaleCheckPartialTemplates records all templates whose bead-backed demand
+	// probe failed. PoolScaleCheckPartialTemplates drives generic pool retention;
+	// NamedScaleCheckPartialTemplates only protects configured named sessions.
+	ScaleCheckPartialTemplates      map[string]bool
+	PoolScaleCheckPartialTemplates  map[string]bool
+	NamedScaleCheckPartialTemplates map[string]bool
+	PoolDesiredCounts               map[string]int // runtime-owned demand snapshot; reused on stable patrol ticks when still fresh
+	WorkSet                         map[string]bool
+	AssignedWorkBeads               []beads.Bead // actionable assigned work, plus stranded pool work that needs release
 	// AssignedWorkStores is aligned by index with AssignedWorkBeads, so later
 	// mutation paths update rig-owned work in the right store even when
 	// independent stores produce overlapping bead IDs.
 	AssignedWorkStores []beads.Store
+	// AssignedWorkStoreRefs is aligned by index with AssignedWorkBeads.
+	// The empty string means city store; non-empty values are rig names.
+	// Consumers that decide whether a specific agent should run must use
+	// this scope before treating a bead as reachable work for that agent.
+	AssignedWorkStoreRefs []string
 	// NamedSessionDemand records which named-session identities have active
-	// demand — either direct assignee demand (Assignee == identity) or
-	// work_query-detected ready work. The reconciler merges this into
-	// poolDesired so that on-demand named sessions remain config-eligible
-	// even when no gc.routed_to metadata exists for the template.
+	// direct assignee demand (Assignee == identity). The reconciler merges this
+	// into poolDesired so that on-demand named sessions remain config-eligible.
 	NamedSessionDemand map[string]bool
-	// StoreQueryPartial is true when one or more bead store queries failed
-	// during assigned-work snapshot collection. When set, the reconciler must NOT
-	// drain sessions based on the (incomplete) desired state — a transient
-	// store failure would cause running sessions to be falsely orphaned
-	// and interrupted via Ctrl-C.
+	// StoreQueryPartial is true when one or more bead store work queries
+	// failed. When set, the reconciler must NOT drain sessions based on the
+	// incomplete desired state — a transient failure would cause running
+	// sessions to be falsely orphaned and interrupted via Ctrl-C.
 	StoreQueryPartial bool
-	BeaconTime        time.Time
+	// SessionQueryPartial is true when session-bead snapshot loading failed.
+	// Orphan-release and drain decisions must treat this like an incomplete
+	// work snapshot because missing live session beads make assigned work look
+	// orphaned.
+	SessionQueryPartial bool
+	BeaconTime          time.Time
+}
+
+func (r DesiredStateResult) snapshotQueryPartial() bool {
+	return r.StoreQueryPartial || r.SessionQueryPartial
 }
 
 type poolEvalWork struct {
-	agentIdx int
-	sp       scaleParams
-	poolDir  string
-	env      map[string]string
+	agentIdx  int
+	sp        scaleParams
+	poolDir   string
+	env       map[string]string
+	newDemand bool
+}
+
+type defaultScaleCheckTarget struct {
+	template string
+	storeKey string
+	store    beads.Store
+	err      error
 }
 
 func evaluatePendingPools(
@@ -60,7 +86,7 @@ func evaluatePendingPools(
 	pendingPools []poolEvalWork,
 	stderr io.Writer,
 	trace *sessionReconcilerTraceCycle,
-) []int {
+) ([]int, []bool) {
 	type poolEvalResult struct {
 		desired int
 		err     error
@@ -80,12 +106,19 @@ func evaluatePendingPools(
 		template := cfg.Agents[pw.agentIdx].QualifiedName()
 		agentName := cfg.Agents[pw.agentIdx].Name
 		agentIndex := pw.agentIdx
-		go func(idx int, template, agentName string, agentIndex int, sp scaleParams, dir string) {
+		newDemand := pw.newDemand
+		go func(idx int, template, agentName string, agentIndex int, sp scaleParams, dir string, newDemand bool) {
 			defer wg.Done()
 			sem <- struct{}{}
 			defer func() { <-sem }()
 			started := time.Now()
-			d, err := evaluatePool(agentName, sp, dir, probeEnv, shellScaleCheck)
+			var d int
+			var err error
+			if newDemand {
+				d, err = evaluatePoolNewDemand(agentName, sp, dir, probeEnv, shellScaleCheck)
+			} else {
+				d, err = evaluatePool(agentName, sp, dir, probeEnv, shellScaleCheck)
+			}
 			evalResults[idx] = poolEvalResult{desired: d, err: err}
 			if trace != nil {
 				outcome := "success"
@@ -102,36 +135,48 @@ func evaluatePendingPools(
 					"agent_index":    agentIndex,
 				}, "")
 			}
-		}(j, template, agentName, agentIndex, sp, pw.poolDir)
+		}(j, template, agentName, agentIndex, sp, pw.poolDir, newDemand)
 	}
 	wg.Wait()
 
 	counts := make([]int, len(pendingPools))
+	partials := make([]bool, len(pendingPools))
 	for j, pw := range pendingPools {
 		pr := evalResults[j]
 		if pr.err != nil {
-			fmt.Fprintf(stderr, "buildDesiredState: %v (using min=%d)\n", pr.err, pw.sp.Min) //nolint:errcheck
+			partials[j] = true
+			if pw.newDemand {
+				fmt.Fprintf(stderr, "buildDesiredState: %v (using new demand=0)\n", pr.err) //nolint:errcheck
+			} else {
+				fmt.Fprintf(stderr, "buildDesiredState: %v (using min=%d)\n", pr.err, pw.sp.Min) //nolint:errcheck
+			}
 		}
 		counts[j] = pr.desired
 	}
-	return counts
+	return counts, partials
 }
 
-// evaluatePendingPoolsMap is like evaluatePendingPools but returns a map
-// from agent qualified name → desired count. Used to feed scale_check
-// results into ComputePoolDesiredStates.
+// evaluatePendingPoolsMap is like evaluatePendingPools but returns a map from
+// agent qualified name to scale_check count. In bead-backed reconciliation the
+// count is additive new demand; legacy no-store callers still use desired
+// counts.
 func evaluatePendingPoolsMap(
 	cfg *config.City,
 	pendingPools []poolEvalWork,
 	stderr io.Writer,
 	trace *sessionReconcilerTraceCycle,
-) map[string]int {
-	counts := evaluatePendingPools(cfg, pendingPools, stderr, trace)
+) (map[string]int, map[string]bool) {
+	counts, partials := evaluatePendingPools(cfg, pendingPools, stderr, trace)
 	m := make(map[string]int, len(counts))
+	var partialTemplates map[string]bool
 	for j, pw := range pendingPools {
-		m[cfg.Agents[pw.agentIdx].QualifiedName()] = counts[j]
+		template := cfg.Agents[pw.agentIdx].QualifiedName()
+		m[template] = counts[j]
+		if partials[j] {
+			partialTemplates = markScaleCheckPartialTemplate(partialTemplates, template)
+		}
 	}
-	return m
+	return m, partialTemplates
 }
 
 // buildDesiredState computes the desired session state from config,
@@ -147,6 +192,9 @@ func evaluatePendingPoolsMap(
 // ACP route registration, and session bead auto-creation. These are safe
 // to repeat because hooks are installed to stable filesystem paths,
 // ACP routing is idempotent, and bead creation is deduplicated by template.
+// Rig-scoped agents with an implicit default scale_check require rigStores;
+// when rigStores is missing, they report zero new demand plus a diagnostic
+// rather than counting work from the wrong store.
 func buildDesiredState(
 	cityName, cityPath string,
 	beaconTime time.Time,
@@ -156,14 +204,18 @@ func buildDesiredState(
 	stderr io.Writer,
 ) DesiredStateResult {
 	var sessionBeads *sessionBeadSnapshot
+	var sessionQueryPartial bool
 	if store != nil {
 		var err error
 		sessionBeads, err = loadSessionBeadSnapshot(store)
 		if err != nil {
 			fmt.Fprintf(stderr, "buildDesiredState: listing session beads: %v\n", err) //nolint:errcheck
+			sessionQueryPartial = true
 		}
 	}
-	return buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, store, nil, sessionBeads, nil, stderr)
+	result := buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, store, nil, sessionBeads, nil, stderr)
+	result.SessionQueryPartial = result.SessionQueryPartial || sessionQueryPartial
+	return result
 }
 
 func buildDesiredStateWithSessionBeads(
@@ -189,6 +241,8 @@ func buildDesiredStateWithSessionBeads(
 
 	desired := make(map[string]TemplateParams)
 	var pendingPools []poolEvalWork
+	var defaultScaleTargets []defaultScaleCheckTarget
+	var defaultNamedScaleTargets []defaultScaleCheckTarget
 
 	for i := range cfg.Agents {
 		if cfg.Agents[i].Suspended {
@@ -216,10 +270,16 @@ func buildDesiredStateWithSessionBeads(
 				continue
 			}
 			// Named-session materialization is handled in the named-session pass,
-			// but generic scale_check/min demand for the backing template still
-			// creates ephemeral capacity through the pool pipeline.
+			// but explicit scale_check/min demand for the backing template still
+			// creates ephemeral capacity through the pool pipeline. The implicit
+			// routed-work scale_check feeds named demand separately so it does
+			// not create a parallel generic worker for the same backing template.
 			poolDir := agentCommandDir(cityPath, &cfg.Agents[i], cfg.Rigs)
-			pendingPools = append(pendingPools, poolEvalWork{agentIdx: i, sp: sp, poolDir: poolDir})
+			if store != nil && strings.TrimSpace(cfg.Agents[i].ScaleCheck) == "" {
+				defaultNamedScaleTargets = append(defaultNamedScaleTargets, defaultScaleCheckTargetForAgent(cityPath, cfg, &cfg.Agents[i], store, rigStores))
+				continue
+			}
+			pendingPools = append(pendingPools, poolEvalWork{agentIdx: i, sp: sp, poolDir: poolDir, newDemand: store != nil})
 			continue
 		}
 
@@ -227,25 +287,31 @@ func buildDesiredStateWithSessionBeads(
 		if rigName != "" && suspendedRigPaths[filepath.Clean(rigRootForName(rigName, cfg.Rigs))] {
 			continue
 		}
-		// Pool agent: collect scale-check inputs. Legacy no-store mode uses
-		// them directly; bead-backed mode falls back to them when work-bead
-		// listing fails so transient store errors do not collapse demand to 0.
+		// Pool agent: collect scale_check inputs. Legacy no-store mode uses
+		// them as desired counts; bead-backed mode uses them as authoritative
+		// new unassigned demand while assigned work drives resume requests.
 		poolDir := agentCommandDir(cityPath, &cfg.Agents[i], cfg.Rigs)
-		pendingPools = append(pendingPools, poolEvalWork{agentIdx: i, sp: sp, poolDir: poolDir, env: controllerQueryRuntimeEnv(cityPath, cfg, &cfg.Agents[i])})
+		if store != nil && strings.TrimSpace(cfg.Agents[i].ScaleCheck) == "" {
+			defaultScaleTargets = append(defaultScaleTargets, defaultScaleCheckTargetForAgent(cityPath, cfg, &cfg.Agents[i], store, rigStores))
+			continue
+		}
+		pendingPools = append(pendingPools, poolEvalWork{agentIdx: i, sp: sp, poolDir: poolDir, env: controllerQueryRuntimeEnv(cityPath, cfg, &cfg.Agents[i]), newDemand: store != nil})
 	}
 
-	// scale_check runs in parallel for all pool agents — the authoritative
-	// demand signal for new sessions. Computed once, returned in result.
-	scaleCheckCounts := evaluatePendingPoolsMap(cfg, pendingPools, stderr, trace)
-
 	// Collect work beads with assignees — used for both pool demand and
 	// named session on_demand wake. Hoisted out of the store block so
 	// the named session section can also use it.
 	var assignedWorkBeads []beads.Bead
 	var assignedWorkStores []beads.Store
+	var assignedWorkStoreRefs []string
 	var storePartial bool
+	var scaleCheckCounts map[string]int
+	var poolScaleCheckPartialTemplates map[string]bool
+	var namedScaleCheckPartialTemplates map[string]bool
+	var scaleCheckPartialTemplates map[string]bool
+	var namedDefaultDemand map[string]bool
 	if store != nil {
-		assignedWorkBeads, assignedWorkStores, storePartial = collectAssignedWorkBeadsWithStores(cfg, store, rigStores, suspendedRigPaths)
+		assignedWorkBeads, assignedWorkStores, assignedWorkStoreRefs, storePartial = collectAssignedWorkBeadsWithStores(cfg, store, rigStores, suspendedRigPaths, sessionBeads)
 		if storePartial {
 			fmt.Fprintf(stderr, "assignedWorkBeads: PARTIAL — store query failed, drain decisions suppressed\n") //nolint:errcheck
 		}
@@ -257,7 +323,34 @@ func buildDesiredStateWithSessionBeads(
 		} else {
 			fmt.Fprintf(stderr, "assignedWorkBeads: 0 beads (rigStores=%d)\n", len(rigStores)) //nolint:errcheck
 		}
-		poolDesiredStates := ComputePoolDesiredStatesTraced(cfg, assignedWorkBeads, sessionBeads.Open(), scaleCheckCounts, trace)
+		scaleCheckCounts, poolScaleCheckPartialTemplates = evaluatePendingPoolsMap(cfg, pendingPools, stderr, trace)
+		if len(defaultScaleTargets) > 0 {
+			defaultCounts, partialTemplates, errs := defaultScaleCheckCounts(defaultScaleTargets)
+			for _, err := range errs {
+				fmt.Fprintf(stderr, "buildDesiredState: %v (using new demand=0)\n", err) //nolint:errcheck
+			}
+			poolScaleCheckPartialTemplates = mergeScaleCheckPartialTemplates(poolScaleCheckPartialTemplates, partialTemplates)
+			for template, count := range defaultCounts {
+				scaleCheckCounts[template] = count
+			}
+		}
+		if len(defaultNamedScaleTargets) > 0 {
+			var namedErrs []error
+			var partialTemplates map[string]bool
+			namedDefaultDemand, partialTemplates, namedErrs = defaultNamedSessionDemand(defaultNamedScaleTargets, cfg, cityName)
+			for _, err := range namedErrs {
+				fmt.Fprintf(stderr, "buildDesiredState: %v (using named demand=false)\n", err) //nolint:errcheck
+			}
+			namedScaleCheckPartialTemplates = mergeScaleCheckPartialTemplates(namedScaleCheckPartialTemplates, partialTemplates)
+		}
+		scaleCheckPartialTemplates = mergeScaleCheckPartialTemplates(scaleCheckPartialTemplates, poolScaleCheckPartialTemplates)
+		scaleCheckPartialTemplates = mergeScaleCheckPartialTemplates(scaleCheckPartialTemplates, namedScaleCheckPartialTemplates)
+		if len(scaleCheckPartialTemplates) > 0 {
+			fmt.Fprintf(stderr, "scaleCheck: PARTIAL — scale_check failed for %s, retaining affected sessions\n", strings.Join(sortedBoolMapKeys(scaleCheckPartialTemplates), ",")) //nolint:errcheck
+		}
+		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, sessionBeads.Open(), assignedWorkBeads, assignedWorkStoreRefs)
+		bp.assignedWorkBeads = poolWorkBeads
+		poolDesiredStates := ComputePoolDesiredStatesTraced(cfg, poolWorkBeads, sessionBeads.Open(), scaleCheckCounts, trace)
 		for _, poolState := range poolDesiredStates {
 			cfgAgent := findAgentByTemplate(cfg, poolState.Template)
 			if cfgAgent == nil {
@@ -271,6 +364,7 @@ func buildDesiredStateWithSessionBeads(
 		}
 	} else {
 		// No store — use scale_check counts directly.
+		scaleCheckCounts, _ = evaluatePendingPoolsMap(cfg, pendingPools, stderr, trace)
 		for _, pw := range pendingPools {
 			desiredCount := scaleCheckCounts[cfg.Agents[pw.agentIdx].QualifiedName()]
 			for slot := 1; slot <= desiredCount; slot++ {
@@ -295,9 +389,9 @@ func buildDesiredStateWithSessionBeads(
 	}
 
 	// Named sessions: materialize session beads for configured [[named_session]]
-	// entries. "always" mode sessions are unconditionally materialized; "on_demand"
-	// sessions are materialized only when they already have a canonical bead or
-	// when their work query returns ready work.
+	// entries. "always" mode sessions are unconditionally materialized;
+	// "on_demand" sessions are materialized only when they already have a
+	// canonical bead or direct assigned work.
 	namedSpecs := make(map[string]namedSessionSpec)
 	for i := range cfg.NamedSessions {
 		identity := cfg.NamedSessions[i].QualifiedName()
@@ -311,54 +405,37 @@ func buildDesiredStateWithSessionBeads(
 		namedSpecs[identity] = spec
 	}
 	namedWorkReady := make(map[string]bool, len(namedSpecs))
+	for identity := range namedDefaultDemand {
+		if _, ok := namedSpecs[identity]; ok {
+			namedWorkReady[identity] = true
+		}
+	}
 	// Check assigned work beads: if any work bead's Assignee matches a named
 	// session's identity, that session has direct demand.
 	//
 	// Raw gc.routed_to metadata is intentionally NOT treated as direct named
-	// demand here. Routed metadata feeds the named agent's work_query, and the
-	// on-demand session only materializes from that path once the work is
-	// actually actionable. This keeps blocked or merely routed work from
-	// waking/materializing the named session prematurely.
-	for identity := range namedSpecs {
-		for _, wb := range assignedWorkBeads {
+	// demand here. The controller only uses assignment/readiness state; routed
+	// metadata is consumed by the agent-side gc hook path.
+	for identity, spec := range namedSpecs {
+		for i, wb := range assignedWorkBeads {
 			if wb.Status != "open" && wb.Status != "in_progress" {
 				continue
 			}
 			assignee := strings.TrimSpace(wb.Assignee)
-			if assignee == identity {
-				fmt.Fprintf(stderr, "namedWorkReady: %s matched by bead %s (assignee=%s status=%s)\n", identity, wb.ID, assignee, wb.Status) //nolint:errcheck
-				namedWorkReady[identity] = true
-				break
+			if assignee != identity {
+				continue
+			}
+			if !assignedWorkIndexReachableFromAgent(cityPath, cfg, spec.Agent, assignedWorkStoreRefs, i) {
+				continue
 			}
+			fmt.Fprintf(stderr, "namedWorkReady: %s matched by bead %s (assignee=%s status=%s)\n", identity, wb.ID, assignee, wb.Status) //nolint:errcheck
+			namedWorkReady[identity] = true
+			break
 		}
 	}
 	if len(assignedWorkBeads) > 0 {
 		fmt.Fprintf(stderr, "namedWorkReady: %d assigned beads, %d named specs, ready=%v\n", len(assignedWorkBeads), len(namedSpecs), namedWorkReady) //nolint:errcheck
 	}
-	for identity, spec := range namedSpecs {
-		if spec.Mode == "always" || namedWorkReady[identity] || !namedSessionAllowsControllerWorkQuery(cityPath, cfg, spec) {
-			continue
-		}
-		// Controller-side work_query demand stays intentionally narrow.
-		// Generic city-scoped named sessions materialize from direct continuity
-		// (canonical bead or explicit assignee demand), while rig-scoped named
-		// sessions still probe here so the controller validates rig-local query
-		// env such as scoped Dolt credentials.
-		wq := spec.Agent.EffectiveWorkQuery()
-		if wq == "" {
-			continue
-		}
-		wq = expandAgentCommandTemplate(cityPath, cityName, spec.Agent, cfg.Rigs, "work_query", wq, stderr)
-		dir := agentCommandDir(cityPath, spec.Agent, cfg.Rigs)
-		probeEnv := controllerQueryRuntimeEnv(cityPath, cfg, spec.Agent)
-		out, err := shellScaleCheck(prefixShellEnv(controllerQueryPrefixEnv(probeEnv), wq), dir, probeEnv)
-		if err != nil {
-			continue
-		}
-		if workQueryHasReadyWork(strings.TrimSpace(out)) {
-			namedWorkReady[identity] = true
-		}
-	}
 	for identity, spec := range namedSpecs {
 		canonicalBead, hasCanonical := findCanonicalNamedSessionBead(bp.sessionBeads, spec)
 		if !hasCanonical {
@@ -407,17 +484,21 @@ func buildDesiredStateWithSessionBeads(
 	// Phase 2: discover session beads created outside config iteration
 	// (e.g., by "gc session new"). Include them in desired state if they
 	// have a valid template and are not held/closed.
-	applySessionBeadDesiredOverlay(bp, cfg, desired, suspendedRigPaths, stderr)
+	applySessionBeadDesiredOverlay(bp, cfg, desired, suspendedRigPaths, poolScaleCheckPartialTemplates, namedScaleCheckPartialTemplates, stderr)
 
 	return DesiredStateResult{
-		State:              desired,
-		BaseState:          baseDesired,
-		ScaleCheckCounts:   scaleCheckCounts,
-		AssignedWorkBeads:  assignedWorkBeads,
-		AssignedWorkStores: assignedWorkStores,
-		NamedSessionDemand: namedWorkReady,
-		StoreQueryPartial:  storePartial,
-		BeaconTime:         beaconTime,
+		State:                           desired,
+		BaseState:                       baseDesired,
+		ScaleCheckCounts:                scaleCheckCounts,
+		ScaleCheckPartialTemplates:      scaleCheckPartialTemplates,
+		PoolScaleCheckPartialTemplates:  poolScaleCheckPartialTemplates,
+		NamedScaleCheckPartialTemplates: namedScaleCheckPartialTemplates,
+		AssignedWorkBeads:               assignedWorkBeads,
+		AssignedWorkStores:              assignedWorkStores,
+		AssignedWorkStoreRefs:           assignedWorkStoreRefs,
+		NamedSessionDemand:              namedWorkReady,
+		StoreQueryPartial:               storePartial,
+		BeaconTime:                      beaconTime,
 	}
 }
 
@@ -450,9 +531,11 @@ func applySessionBeadDesiredOverlay(
 	cfg *config.City,
 	desired map[string]TemplateParams,
 	suspendedRigPaths map[string]bool,
+	poolScaleCheckPartialTemplates map[string]bool,
+	namedScaleCheckPartialTemplates map[string]bool,
 	stderr io.Writer,
 ) {
-	realizedRoots := discoverSessionBeadsWithRoots(bp, cfg, desired, suspendedRigPaths, stderr)
+	realizedRoots := discoverSessionBeadsWithRoots(bp, cfg, desired, suspendedRigPaths, poolScaleCheckPartialTemplates, namedScaleCheckPartialTemplates, stderr)
 	realizeDependencyFloors(bp, cfg, desired, realizedRoots, suspendedRigPaths, stderr)
 }
 
@@ -481,21 +564,20 @@ func refreshDesiredStateWithSessionBeads(
 
 	bp := newAgentBuildParams(cityName, cityPath, cfg, sp, result.BeaconTime, store, stderr)
 	bp.sessionBeads = sessionBeads
-	applySessionBeadDesiredOverlay(bp, cfg, refreshed.State, buildSuspendedRigPaths(cfg), stderr)
+	applySessionBeadDesiredOverlay(bp, cfg, refreshed.State, buildSuspendedRigPaths(cfg), result.PoolScaleCheckPartialTemplates, result.NamedScaleCheckPartialTemplates, stderr)
 	return refreshed
 }
 
 // collectAssignedWorkBeads queries each store (city + rigs) for actionable
 // assigned work. It includes in-progress assigned work plus open assigned
 // work that is actually ready. Routed-but-unassigned pool queue work is
-// intentionally excluded here; new session demand comes from scale_check
-// (and work_query as a defense-in-depth wake signal), while this helper is
-// only for preserving sessions that already own actionable work.
+// intentionally excluded here, except stranded in-progress pool work with no
+// assignee is included so reconciliation can reopen it for normal claiming.
 func collectAssignedWorkBeads(
 	cfg *config.City,
 	cityStore beads.Store,
 ) ([]beads.Bead, bool) {
-	result, _, partial := collectAssignedWorkBeadsWithStores(cfg, cityStore, nil, nil)
+	result, _, _, partial := collectAssignedWorkBeadsWithStores(cfg, cityStore, nil, nil, nil)
 	return result, partial
 }
 
@@ -504,42 +586,547 @@ func collectAssignedWorkBeadsWithStores(
 	cityStore beads.Store,
 	rigStores map[string]beads.Store,
 	suspendedRigPaths map[string]bool,
-) ([]beads.Bead, []beads.Store, bool) {
+	sessionBeads *sessionBeadSnapshot,
+) ([]beads.Bead, []beads.Store, []string, bool) {
 	// Use CachingStore-wrapped stores. Creating raw bdStoreForCity per rig
 	// spawns bd subprocesses on every tick, saturating dolt.
-	stores := []beads.Store{cityStore}
+	type workStore struct {
+		store beads.Store
+		ref   string
+	}
+	stores := []workStore{{store: cityStore}}
 	for _, rig := range cfg.Rigs {
 		if suspendedRigPaths[filepath.Clean(rig.Path)] {
 			continue
 		}
 		if s, ok := rigStores[rig.Name]; ok {
-			stores = append(stores, s)
+			stores = append(stores, workStore{store: s, ref: rig.Name})
 		}
 	}
 
+	type storeAssignedWorkResult struct {
+		beads     []beads.Bead
+		stores    []beads.Store
+		storeRefs []string
+		errs      []error
+	}
+	results := make([]storeAssignedWorkResult, len(stores))
+	var wg sync.WaitGroup
+	for idx, source := range stores {
+		idx, source := idx, source
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			var result []beads.Bead
+			var resultStores []beads.Store
+			var resultStoreRefs []string
+			var errs []error
+			seen := make(map[string]struct{})
+			// In-progress beads with an assignee (active work), plus stranded
+			// unassigned pool work that needs to be reopened. This pass runs
+			// across every store before any ready handoff probes, so already
+			// active work never waits behind unrelated ready scans.
+			if inProgress, err := listForControllerDemand(source.store, beads.ListQuery{Status: "in_progress"}); err == nil {
+				appendInProgressWorkUnique(cfg, &result, &resultStores, &resultStoreRefs, inProgress, seen, source.store, source.ref)
+			} else {
+				errs = append(errs, fmt.Errorf("List(in_progress): %w", err))
+				if beads.IsPartialResult(err) && len(inProgress) > 0 {
+					appendInProgressWorkUnique(cfg, &result, &resultStores, &resultStoreRefs, inProgress, seen, source.store, source.ref)
+				}
+			}
+			results[idx] = storeAssignedWorkResult{beads: result, stores: resultStores, storeRefs: resultStoreRefs, errs: errs}
+		}()
+	}
+	wg.Wait()
+
 	var result []beads.Bead
 	var resultStores []beads.Store
+	var resultStoreRefs []string
 	var partial bool
-	for _, s := range stores {
-		seen := make(map[string]struct{})
-		// In-progress beads with an assignee (active work).
-		if inProgress, err := s.List(beads.ListQuery{Status: "in_progress", Live: true}); err == nil {
-			appendAssignedUnique(&result, &resultStores, inProgress, seen, s)
-		} else {
-			log.Printf("collectAssignedWorkBeads: List(in_progress) failed: %v", err)
+	for _, r := range results {
+		result = append(result, r.beads...)
+		resultStores = append(resultStores, r.stores...)
+		resultStoreRefs = append(resultStoreRefs, r.storeRefs...)
+		for _, err := range r.errs {
+			log.Printf("collectAssignedWorkBeads: %v", err)
 			partial = true
 		}
-		// Ready beads with an assignee (queued direct handoff work that is
-		// actually runnable, not merely open). This is a lifecycle gate, so
-		// bypass the cache when a CachingStore wrapper is present.
-		if ready, err := beads.ReadyLive(s); err == nil {
-			appendAssignedUnique(&result, &resultStores, ready, seen, s)
-		} else {
-			log.Printf("collectAssignedWorkBeads: Ready() failed: %v", err)
+	}
+	skipReadyAssignees := assignedWorkAssigneeSet(result)
+	expandSkipAssigneesWithSessionIdentities(skipReadyAssignees, sessionBeads)
+	assignees := readyAssignedWorkAssignees(cfg, sessionBeads, skipReadyAssignees)
+	if len(skipReadyAssignees) > 0 && len(assignees) == 0 {
+		return result, resultStores, resultStoreRefs, partial
+	}
+
+	readyResults := make([]storeAssignedWorkResult, len(stores))
+	for idx, source := range stores {
+		idx, source := idx, source
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			var ready []beads.Bead
+			var err error
+			var errs []error
+			if len(assignees) == 0 {
+				ready, err = readyForControllerDemandQuery(source.store, beads.ReadyQuery{Limit: assignedWorkReadyLimit(cfg)})
+				if err != nil {
+					errs = append(errs, fmt.Errorf("Ready(): %w", err))
+				}
+			} else {
+				for _, assignee := range assignees {
+					part, partErr := readyForControllerDemandQuery(source.store, beads.ReadyQuery{Assignee: assignee, Limit: assignedWorkReadyLimit(cfg)})
+					if partErr != nil {
+						errs = append(errs, fmt.Errorf("Ready(assignee=%q): %w", assignee, partErr))
+					}
+					ready = append(ready, part...)
+				}
+			}
+			var readyBeads []beads.Bead
+			var readyStores []beads.Store
+			var readyStoreRefs []string
+			seen := make(map[string]struct{})
+			appendAssignedUnique(&readyBeads, &readyStores, &readyStoreRefs, ready, seen, source.store, source.ref)
+			readyResults[idx] = storeAssignedWorkResult{beads: readyBeads, stores: readyStores, storeRefs: readyStoreRefs, errs: errs}
+		}()
+	}
+	wg.Wait()
+	for _, r := range readyResults {
+		result = append(result, r.beads...)
+		resultStores = append(resultStores, r.stores...)
+		resultStoreRefs = append(resultStoreRefs, r.storeRefs...)
+		for _, err := range r.errs {
+			log.Printf("collectAssignedWorkBeads: %v", err)
 			partial = true
 		}
 	}
-	return result, resultStores, partial
+	return result, resultStores, resultStoreRefs, partial
+}
+
+func assignedWorkReadyLimit(cfg *config.City) int {
+	if cfg == nil {
+		return config.DefaultMaxWakesPerTick
+	}
+	return cfg.Daemon.MaxWakesPerTickOrDefault()
+}
+
+func assignedWorkAssigneeSet(work []beads.Bead) map[string]struct{} {
+	if len(work) == 0 {
+		return nil
+	}
+	result := make(map[string]struct{})
+	for _, bead := range work {
+		assignee := strings.TrimSpace(bead.Assignee)
+		if assignee == "" {
+			continue
+		}
+		if bead.Status != "open" && bead.Status != "in_progress" {
+			continue
+		}
+		result[assignee] = struct{}{}
+	}
+	return result
+}
+
+func expandSkipAssigneesWithSessionIdentities(skip map[string]struct{}, sessionBeads *sessionBeadSnapshot) {
+	if len(skip) == 0 || sessionBeads == nil {
+		return
+	}
+	for _, session := range sessionBeads.Open() {
+		ids := []string{
+			session.ID,
+			session.Metadata["session_name"],
+			session.Metadata["configured_named_identity"],
+		}
+		matched := false
+		for _, id := range ids {
+			if _, ok := skip[strings.TrimSpace(id)]; ok {
+				matched = true
+				break
+			}
+		}
+		if !matched {
+			continue
+		}
+		for _, id := range ids {
+			id = strings.TrimSpace(id)
+			if id != "" {
+				skip[id] = struct{}{}
+			}
+		}
+	}
+}
+
+func readyAssignedWorkAssignees(cfg *config.City, sessionBeads *sessionBeadSnapshot, skip map[string]struct{}) []string {
+	seen := make(map[string]struct{})
+	var result []string
+	add := func(value string) {
+		value = strings.TrimSpace(value)
+		if value == "" {
+			return
+		}
+		if _, ok := skip[value]; ok {
+			return
+		}
+		if _, ok := seen[value]; ok {
+			return
+		}
+		seen[value] = struct{}{}
+		result = append(result, value)
+	}
+	if sessionBeads != nil {
+		for _, session := range sessionBeads.Open() {
+			if session.Status == "closed" {
+				continue
+			}
+			add(session.ID)
+			add(session.Metadata["session_name"])
+			add(session.Metadata["configured_named_identity"])
+		}
+	}
+	if cfg != nil {
+		for i := range cfg.NamedSessions {
+			if cfg.NamedSessions[i].Mode != "on_demand" {
+				continue
+			}
+			add(cfg.NamedSessions[i].QualifiedName())
+		}
+	}
+	return result
+}
+
+func defaultScaleCheckTargetForAgent(
+	cityPath string,
+	cfg *config.City,
+	agentCfg *config.Agent,
+	cityStore beads.Store,
+	rigStores map[string]beads.Store,
+) defaultScaleCheckTarget {
+	target := defaultScaleCheckTarget{
+		template: agentCfg.QualifiedName(),
+		storeKey: "city",
+		store:    cityStore,
+	}
+	rigName := configuredRigName(cityPath, agentCfg, cfg.Rigs)
+	if rigName == "" {
+		return target
+	}
+	target.storeKey = "rig:" + rigName
+	if rigStores != nil {
+		if rigStore := rigStores[rigName]; rigStore != nil {
+			target.store = rigStore
+			return target
+		}
+	}
+	target.store = nil
+	target.err = fmt.Errorf("default scale_check %s: rig store %q unavailable", target.template, rigName)
+	return target
+}
+
+func defaultScaleCheckCounts(targets []defaultScaleCheckTarget) (map[string]int, map[string]bool, []error) {
+	counts := make(map[string]int, len(targets))
+	if len(targets) == 0 {
+		return counts, nil, nil
+	}
+
+	type scaleStoreGroup struct {
+		store     beads.Store
+		templates map[string]struct{}
+	}
+	groups := make(map[string]*scaleStoreGroup)
+	var errs []error
+	var partialTemplates map[string]bool
+	for _, target := range targets {
+		template := strings.TrimSpace(target.template)
+		if template == "" {
+			continue
+		}
+		counts[template] = 0
+		if target.err != nil {
+			errs = append(errs, target.err)
+			partialTemplates = markScaleCheckPartialTemplate(partialTemplates, template)
+		}
+		if target.store == nil {
+			if target.err == nil {
+				errs = append(errs, fmt.Errorf("default scale_check %s: store unavailable", template))
+			}
+			partialTemplates = markScaleCheckPartialTemplate(partialTemplates, template)
+			continue
+		}
+		key := strings.TrimSpace(target.storeKey)
+		if key == "" {
+			key = fmt.Sprintf("%p", target.store)
+		}
+		group := groups[key]
+		if group == nil {
+			group = &scaleStoreGroup{store: target.store, templates: make(map[string]struct{})}
+			groups[key] = group
+		}
+		group.templates[template] = struct{}{}
+	}
+
+	for key, group := range groups {
+		ready, err := readyForControllerDemand(group.store)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("default scale_check %s templates=%s: Ready(): %w", key, strings.Join(sortedStringSet(group.templates), ","), err))
+			partialTemplates = markScaleCheckPartialSet(partialTemplates, group.templates)
+			if !beads.IsPartialResult(err) || len(ready) == 0 {
+				continue
+			}
+		}
+		for _, b := range ready {
+			if strings.TrimSpace(b.Assignee) != "" {
+				continue
+			}
+			template := strings.TrimSpace(b.Metadata["gc.routed_to"])
+			if _, ok := group.templates[template]; ok {
+				counts[template]++
+			}
+		}
+	}
+	return counts, partialTemplates, errs
+}
+
+func defaultNamedSessionDemand(targets []defaultScaleCheckTarget, cfg *config.City, cityName string) (map[string]bool, map[string]bool, []error) {
+	demand := make(map[string]bool)
+	if len(targets) == 0 || cfg == nil {
+		return demand, nil, nil
+	}
+
+	type scaleStoreGroup struct {
+		store     beads.Store
+		templates map[string]struct{}
+	}
+	groups := make(map[string]*scaleStoreGroup)
+	var errs []error
+	var partialTemplates map[string]bool
+	for _, target := range targets {
+		template := strings.TrimSpace(target.template)
+		if template == "" {
+			continue
+		}
+		if target.err != nil {
+			errs = append(errs, target.err)
+			partialTemplates = markScaleCheckPartialTemplate(partialTemplates, template)
+		}
+		if target.store == nil {
+			if target.err == nil {
+				errs = append(errs, fmt.Errorf("default scale_check %s: store unavailable", template))
+			}
+			partialTemplates = markScaleCheckPartialTemplate(partialTemplates, template)
+			continue
+		}
+		key := strings.TrimSpace(target.storeKey)
+		if key == "" {
+			key = fmt.Sprintf("%p", target.store)
+		}
+		group := groups[key]
+		if group == nil {
+			group = &scaleStoreGroup{store: target.store, templates: make(map[string]struct{})}
+			groups[key] = group
+		}
+		group.templates[template] = struct{}{}
+	}
+
+	namedByIdentity := make(map[string]namedSessionSpec)
+	identitiesByTemplate := make(map[string][]string)
+	for i := range cfg.NamedSessions {
+		identity := cfg.NamedSessions[i].QualifiedName()
+		spec, ok := findNamedSessionSpec(cfg, cityName, identity)
+		if !ok || spec.Mode == "always" {
+			continue
+		}
+		template := strings.TrimSpace(namedSessionBackingTemplate(spec))
+		if template == "" {
+			continue
+		}
+		namedByIdentity[spec.Identity] = spec
+		identitiesByTemplate[template] = append(identitiesByTemplate[template], spec.Identity)
+	}
+
+	for key, group := range groups {
+		ready, err := readyForControllerDemand(group.store)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("default scale_check %s templates=%s: Ready(): %w", key, strings.Join(sortedStringSet(group.templates), ","), err))
+			partialTemplates = markScaleCheckPartialSet(partialTemplates, group.templates)
+			if !beads.IsPartialResult(err) || len(ready) == 0 {
+				continue
+			}
+		}
+		for _, b := range ready {
+			if strings.TrimSpace(b.Assignee) != "" {
+				continue
+			}
+			routedTo := strings.TrimSpace(b.Metadata["gc.routed_to"])
+			if routedTo == "" {
+				continue
+			}
+			if spec, ok := namedByIdentity[routedTo]; ok {
+				template := strings.TrimSpace(namedSessionBackingTemplate(spec))
+				if _, targetTemplate := group.templates[template]; targetTemplate {
+					demand[spec.Identity] = true
+				}
+				continue
+			}
+			if _, targetTemplate := group.templates[routedTo]; !targetTemplate {
+				continue
+			}
+			identities := identitiesByTemplate[routedTo]
+			if len(identities) == 1 {
+				demand[identities[0]] = true
+			}
+		}
+	}
+	return demand, partialTemplates, errs
+}
+
+func markScaleCheckPartialTemplate(partials map[string]bool, template string) map[string]bool {
+	template = strings.TrimSpace(template)
+	if template == "" {
+		return partials
+	}
+	if partials == nil {
+		partials = make(map[string]bool)
+	}
+	partials[template] = true
+	return partials
+}
+
+func markScaleCheckPartialSet(partials map[string]bool, templates map[string]struct{}) map[string]bool {
+	for template := range templates {
+		partials = markScaleCheckPartialTemplate(partials, template)
+	}
+	return partials
+}
+
+func mergeScaleCheckPartialTemplates(dst, src map[string]bool) map[string]bool {
+	for template, partial := range src {
+		if partial {
+			dst = markScaleCheckPartialTemplate(dst, template)
+		}
+	}
+	return dst
+}
+
+func sortedBoolMapKeys(values map[string]bool) []string {
+	out := make([]string, 0, len(values))
+	for value, include := range values {
+		if include {
+			out = append(out, value)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+func retainScaleCheckPartialPoolDesired(counts map[string]int, sessionBeads *sessionBeadSnapshot, partialTemplates map[string]bool) map[string]int {
+	if len(partialTemplates) == 0 || sessionBeads == nil {
+		return counts
+	}
+	retained := make(map[string]int)
+	for _, b := range sessionBeads.Open() {
+		template := strings.TrimSpace(b.Metadata["template"])
+		if !partialTemplates[template] || !isPoolManagedSessionBead(b) || !scaleCheckPartialSessionRetainable(b) {
+			continue
+		}
+		retained[template]++
+	}
+	if len(retained) == 0 {
+		return counts
+	}
+	if counts == nil {
+		counts = make(map[string]int)
+	}
+	for template, count := range retained {
+		if counts[template] < count {
+			counts[template] = count
+		}
+	}
+	return counts
+}
+
+// Preserve dormant affected-template beads during transient scale_check
+// failures, but do not count them as awake demand.
+func scaleCheckPartialSessionPreservable(b beads.Bead) bool {
+	switch strings.TrimSpace(b.Metadata["state"]) {
+	case "", "active", "awake", "creating", "asleep", "stopped", "suspended", "quarantined", "draining", "drained", "archived":
+		return true
+	default:
+		return isPendingPoolCreate(b)
+	}
+}
+
+func scaleCheckPartialSessionRetainable(b beads.Bead) bool {
+	switch strings.TrimSpace(b.Metadata["state"]) {
+	case "active", "awake", "creating":
+		return true
+	default:
+		return isPendingPoolCreate(b)
+	}
+}
+
+func sortedStringSet(values map[string]struct{}) []string {
+	out := make([]string, 0, len(values))
+	for value := range values {
+		out = append(out, value)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func listForControllerDemand(store beads.Store, query beads.ListQuery) ([]beads.Bead, error) {
+	if _, ok := store.(interface {
+		CachedList(beads.ListQuery) ([]beads.Bead, bool)
+	}); ok {
+		cacheQuery := query
+		cacheQuery.Live = false
+		return store.List(cacheQuery)
+	}
+	liveQuery := query
+	liveQuery.Live = true
+	return store.List(liveQuery)
+}
+
+func readyForControllerDemand(store beads.Store) ([]beads.Bead, error) {
+	// Controller demand reads are intentionally cache-tolerant, not
+	// authoritative lifecycle gates; CachedReady falls back whenever the cache
+	// has dirty or unknown dependency coverage.
+	if cached, ok := store.(interface {
+		CachedReady() ([]beads.Bead, bool)
+	}); ok {
+		if ready, ok := cached.CachedReady(); ok {
+			return ready, nil
+		}
+	}
+	return beads.ReadyLive(store)
+}
+
+func readyForControllerDemandQuery(store beads.Store, query beads.ReadyQuery) ([]beads.Bead, error) {
+	if cached, ok := store.(interface {
+		CachedReady() ([]beads.Bead, bool)
+	}); ok {
+		if ready, ok := cached.CachedReady(); ok {
+			return filterReadyForControllerDemand(ready, query), nil
+		}
+	}
+	return store.Ready(query)
+}
+
+func filterReadyForControllerDemand(ready []beads.Bead, query beads.ReadyQuery) []beads.Bead {
+	if query == (beads.ReadyQuery{}) {
+		return ready
+	}
+	result := make([]beads.Bead, 0, len(ready))
+	for _, bead := range ready {
+		if query.Assignee != "" && bead.Assignee != query.Assignee {
+			continue
+		}
+		result = append(result, bead)
+		if query.Limit > 0 && len(result) >= query.Limit {
+			break
+		}
+	}
+	return result
 }
 
 // mergeNamedSessionDemand ensures that named-session assignee demand is
@@ -567,27 +1154,45 @@ func mergeNamedSessionDemand(poolDesired map[string]int, namedDemand map[string]
 	}
 }
 
-func appendAssignedUnique(dst *[]beads.Bead, stores *[]beads.Store, beadList []beads.Bead, seen map[string]struct{}, store beads.Store) {
+func appendInProgressWorkUnique(cfg *config.City, dst *[]beads.Bead, stores *[]beads.Store, storeRefs *[]string, beadList []beads.Bead, seen map[string]struct{}, store beads.Store, storeRef string) {
 	for _, b := range beadList {
-		if strings.TrimSpace(b.Assignee) == "" {
-			continue
-		}
-		// Session beads are not actionable work — filter them at the source
-		// so all consumers see only real tasks. Message beads are NOT filtered
-		// here because they represent mail that should wake/materialize sessions;
-		// idle nudge filters messages locally since mail nudging is handled
-		// separately by the mail system.
-		if b.Type == sessionBeadType {
+		if strings.TrimSpace(b.Assignee) == "" && !isRecoverableUnassignedInProgressPoolWork(cfg, b) {
 			continue
 		}
-		if _, ok := seen[b.ID]; ok {
+		appendWorkUnique(dst, stores, storeRefs, b, seen, store, storeRef)
+	}
+}
+
+func appendAssignedUnique(dst *[]beads.Bead, stores *[]beads.Store, storeRefs *[]string, beadList []beads.Bead, seen map[string]struct{}, store beads.Store, storeRef string) {
+	for _, b := range beadList {
+		if strings.TrimSpace(b.Assignee) == "" {
 			continue
 		}
-		seen[b.ID] = struct{}{}
-		*dst = append(*dst, b)
-		if stores != nil {
-			*stores = append(*stores, store)
-		}
+		appendWorkUnique(dst, stores, storeRefs, b, seen, store, storeRef)
+	}
+}
+
+func appendWorkUnique(dst *[]beads.Bead, stores *[]beads.Store, storeRefs *[]string, b beads.Bead, seen map[string]struct{}, store beads.Store, storeRef string) {
+	// Invariant: dst, stores, and storeRefs are kept index-aligned by this
+	// shared growth path and the shared seen guard.
+	// Session beads are not actionable work — filter them at the source
+	// so all consumers see only real tasks. Message beads are NOT filtered
+	// here because they represent mail that should wake/materialize sessions;
+	// idle nudge filters messages locally since mail nudging is handled
+	// separately by the mail system.
+	if b.Type == sessionBeadType {
+		return
+	}
+	if _, ok := seen[b.ID]; ok {
+		return
+	}
+	seen[b.ID] = struct{}{}
+	*dst = append(*dst, b)
+	if stores != nil {
+		*stores = append(*stores, store)
+	}
+	if storeRefs != nil {
+		*storeRefs = append(*storeRefs, storeRef)
 	}
 }
 
@@ -620,7 +1225,7 @@ func discoverSessionBeads(
 	desired map[string]TemplateParams,
 	stderr io.Writer,
 ) {
-	discoverSessionBeadsWithRoots(bp, cfg, desired, nil, stderr)
+	discoverSessionBeadsWithRoots(bp, cfg, desired, nil, nil, nil, stderr)
 }
 
 func discoverSessionBeadsWithRoots(
@@ -628,6 +1233,8 @@ func discoverSessionBeadsWithRoots(
 	cfg *config.City,
 	desired map[string]TemplateParams,
 	suspendedRigPaths map[string]bool,
+	poolScaleCheckPartialTemplates map[string]bool,
+	namedScaleCheckPartialTemplates map[string]bool,
 	stderr io.Writer,
 ) map[string]bool {
 	sessionBeads := bp.sessionBeads
@@ -659,13 +1266,13 @@ func discoverSessionBeadsWithRoots(
 		// but we still need the bead in desired state so the reconciler
 		// doesn't classify it as orphaned. Only skip if we can't resolve
 		// the template.
-		template := b.Metadata["template"]
-		if template == "" {
-			template = b.Metadata["common_name"]
-		}
+		template := resolvedSessionTemplate(b, cfg)
 		if template == "" {
 			continue
 		}
+		poolScaleCheckPartial := poolScaleCheckPartialTemplates[template]
+		namedScaleCheckPartial := namedScaleCheckPartialTemplates[template] && isNamedSessionBead(b)
+		scaleCheckPartial := scaleCheckPartialSessionPreservable(b) && (poolScaleCheckPartial || namedScaleCheckPartial)
 		// Find the config agent for this template.
 		cfgAgent := findAgentByTemplate(cfg, template)
 		if cfgAgent == nil {
@@ -690,10 +1297,11 @@ func discoverSessionBeadsWithRoots(
 		if isEphemeralSessionBeadForAgent(b, cfgAgent) {
 			manualSession := isManualSessionBeadForAgent(b, cfgAgent)
 			creating := b.Metadata["state"] == "creating"
-			if isPoolManagedSessionBead(b) && !manualSession && !isNamedSessionBead(b) && !creating {
+			pendingCreate := isPendingPoolCreate(b)
+			if isPoolManagedSessionBead(b) && !manualSession && !isNamedSessionBead(b) && !creating && !pendingCreate && !scaleCheckPartial {
 				continue
 			}
-			if !manualSession && !desiredHasTemplate(desired, template) {
+			if !manualSession && (!creating || isStaleCreating(b)) && !desiredHasTemplate(desired, template) && !pendingCreate && !scaleCheckPartial {
 				continue
 			}
 		}
@@ -724,7 +1332,7 @@ func discoverSessionBeadsWithRoots(
 			// inputs aligned across buildDesiredState paths. Named beads
 			// intentionally pass through with the base shape (see
 			// canonicalSessionIdentity).
-			resolveAgent, sessionQualifiedName = canonicalSessionIdentity(cfgAgent, b)
+			resolveAgent, sessionQualifiedName = canonicalSessionIdentityWithConfig(cfg, cfgAgent, b)
 		}
 		fpExtra := buildFingerprintExtra(resolveAgent)
 		tp, err := resolveTemplateForSessionBead(bp, resolveAgent, sessionQualifiedName, fpExtra, b)
@@ -756,6 +1364,10 @@ func discoverSessionBeadsWithRoots(
 	return roots
 }
 
+func isPendingPoolCreate(b beads.Bead) bool {
+	return isPoolManagedSessionBead(b) && strings.TrimSpace(b.Metadata["pending_create_claim"]) == boolMetadata(true)
+}
+
 func realizeDependencyFloors(
 	bp *agentBuildParams,
 	cfg *config.City,
@@ -786,7 +1398,7 @@ func realizeDependencyFloors(
 			if agentInSuspendedRig(bp.cityPath, depAgent, cfg.Rigs, suspendedRigPaths) {
 				continue
 			}
-			ensureDependencyOnlyTemplate(bp, depAgent, desired, stderr)
+			ensureDependencyOnlyTemplate(bp, cfg, depAgent, desired, stderr)
 			visit(dep)
 		}
 	}
@@ -797,6 +1409,7 @@ func realizeDependencyFloors(
 
 func ensureDependencyOnlyTemplate(
 	bp *agentBuildParams,
+	cfg *config.City,
 	cfgAgent *config.Agent,
 	desired map[string]TemplateParams,
 	stderr io.Writer,
@@ -804,6 +1417,11 @@ func ensureDependencyOnlyTemplate(
 	if cfgAgent == nil || !cfgAgent.SupportsGenericEphemeralSessions() || desiredHasTemplate(desired, cfgAgent.QualifiedName()) {
 		return
 	}
+	qualifiedName := cfgAgent.QualifiedName()
+	if err := validateAgentSessionTransportForBuild(bp, cfgAgent, qualifiedName); err != nil {
+		fmt.Fprintf(stderr, "buildDesiredState: dependency floor %q: %v (skipping)\n", qualifiedName, err) //nolint:errcheck
+		return
+	}
 
 	if bp.beadStore == nil {
 		name := cfgAgent.Name
@@ -828,7 +1446,6 @@ func ensureDependencyOnlyTemplate(
 	// Bead selection keys off the configured base template, not the pool-
 	// instance form, because normalizedSessionTemplate reads the bead's
 	// "template" metadata which is always the base.
-	qualifiedName := cfgAgent.QualifiedName()
 	sessionBead, err := selectOrCreateDependencyPoolSessionBead(bp, cfgAgent, qualifiedName)
 	if err != nil {
 		fmt.Fprintf(stderr, "buildDesiredState: dependency floor %q: %v (skipping)\n", qualifiedName, err) //nolint:errcheck
@@ -840,7 +1457,7 @@ func ensureDependencyOnlyTemplate(
 	// Otherwise GC_ALIAS would be the base "rig/dog" here and "rig/dog-1"
 	// on the realize path, oscillating across ticks and triggering the
 	// reconciler's config-drift drain on the live dependency-floor session.
-	resolveAgent, resolveQN := canonicalSessionIdentity(cfgAgent, sessionBead)
+	resolveAgent, resolveQN := canonicalSessionIdentityWithConfig(cfg, cfgAgent, sessionBead)
 	// Dep-floor slot-1 fallback. The guard triggers when the helper returned
 	// the BASE form — meaning no pool_slot was stamped yet. Keying off
 	// resolveQN (a stable value) rather than pointer identity keeps the
@@ -898,6 +1515,10 @@ func realizePoolDesiredSessions(
 	stderr io.Writer,
 ) {
 	qualifiedName := cfgAgent.QualifiedName()
+	if err := validateAgentSessionTransportForBuild(bp, cfgAgent, qualifiedName); err != nil {
+		fmt.Fprintf(stderr, "buildDesiredState: pool %q: %v (skipping)\n", qualifiedName, err) //nolint:errcheck
+		return
+	}
 	used := make(map[string]bool)
 	usedSlots := make(map[int]bool)
 	for _, request := range poolState.Requests {
@@ -987,6 +1608,10 @@ func resolveTemplateForSessionBead(
 //   - Instance-expanding agent without a slot stamp → (cfgAgent,
 //     cfgAgent.QualifiedName()); realize will claim and stamp later.
 func canonicalSessionIdentity(cfgAgent *config.Agent, bead beads.Bead) (*config.Agent, string) {
+	return canonicalSessionIdentityWithConfig(nil, cfgAgent, bead)
+}
+
+func canonicalSessionIdentityWithConfig(cfg *config.City, cfgAgent *config.Agent, bead beads.Bead) (*config.Agent, string) {
 	if cfgAgent == nil {
 		return nil, ""
 	}
@@ -996,7 +1621,7 @@ func canonicalSessionIdentity(cfgAgent *config.Agent, bead beads.Bead) (*config.
 	if !cfgAgent.SupportsInstanceExpansion() {
 		return cfgAgent, cfgAgent.QualifiedName()
 	}
-	slot := existingPoolSlot(cfgAgent, bead)
+	slot := existingPoolSlotWithConfig(cfg, cfgAgent, bead)
 	if slot <= 0 {
 		return cfgAgent, cfgAgent.QualifiedName()
 	}
@@ -1095,23 +1720,139 @@ func existingPoolSlot(cfgAgent *config.Agent, sessionBead beads.Bead) int {
 			return slot
 		}
 	}
-	agentName := strings.TrimSpace(sessionBeadAgentName(sessionBead))
-	if agentName == "" || cfgAgent == nil {
+	if cfgAgent == nil {
 		return 0
 	}
-	if slot := resolvePoolSlot(agentName, cfgAgent.QualifiedName()); slot > 0 {
+	if slot := resolvePersistedPoolIdentitySlot(cfgAgent, true, sessionBeadAgentName(sessionBead), sessionBead.Metadata["alias"]); slot > 0 {
 		return slot
 	}
-	if slot := resolvePoolSlot(agentName, cfgAgent.Name); slot > 0 {
-		return slot
+	if strings.TrimSpace(sessionBead.Metadata["alias"]) == "" && !beadOwnsPoolSessionName(sessionBead) {
+		if slot := resolvePersistedPoolIdentitySlot(cfgAgent, true, sessionBead.Metadata["session_name"]); slot > 0 {
+			return slot
+		}
+	}
+	return 0
+}
+
+func resolvePersistedPoolIdentitySlot(cfgAgent *config.Agent, allowLocalIdentity bool, candidates ...string) int {
+	if cfgAgent == nil {
+		return 0
+	}
+	for _, name := range candidates {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		if slot := resolvePoolSlot(name, cfgAgent.QualifiedName()); slot > 0 {
+			return slot
+		}
+		if cfgAgent.BindingName != "" {
+			if slot := resolvePoolSlot(name, cfgAgent.BindingQualifiedName()); slot > 0 {
+				return slot
+			}
+		}
+		if cfgAgent.BindingName == "" && allowLocalIdentity {
+			if slot := resolvePoolSlot(name, cfgAgent.Name); slot > 0 {
+				return slot
+			}
+		}
+		for idx, themed := range cfgAgent.NamepoolNames {
+			themed = strings.TrimSpace(themed)
+			if themed == "" {
+				continue
+			}
+			if themed == name {
+				return idx + 1
+			}
+			if strings.TrimSpace(cfgAgent.QualifiedInstanceName(themed)) == name {
+				return idx + 1
+			}
+		}
+	}
+	return 0
+}
+
+func poolSlotHasConfiguredBound(cfgAgent *config.Agent) bool {
+	if cfgAgent == nil {
+		return false
+	}
+	if len(cfgAgent.NamepoolNames) > 0 {
+		return true
+	}
+	if maxSessions := cfgAgent.EffectiveMaxActiveSessions(); maxSessions != nil {
+		return true
+	}
+	return false
+}
+
+func inBoundsPoolSlot(cfgAgent *config.Agent, slot int) bool {
+	if cfgAgent == nil || slot <= 0 || !poolSlotHasConfiguredBound(cfgAgent) {
+		return false
+	}
+	if len(cfgAgent.NamepoolNames) > 0 && slot > len(cfgAgent.NamepoolNames) {
+		return false
+	}
+	if maxSessions := cfgAgent.EffectiveMaxActiveSessions(); maxSessions != nil && *maxSessions > 0 && slot > *maxSessions {
+		return false
+	}
+	return true
+}
+
+func existingPoolSlotWithConfig(cfg *config.City, cfgAgent *config.Agent, sessionBead beads.Bead) int {
+	if cfgAgent == nil {
+		return 0
 	}
-	for idx, themed := range cfgAgent.NamepoolNames {
-		if strings.TrimSpace(themed) == agentName {
-			return idx + 1
+	storedTemplateMatches := cfg == nil || storedTemplateMatchesPoolTemplate(sessionBeadStoredTemplate(sessionBead), cfgAgent.QualifiedName(), cfg)
+	agentSlot := resolvePersistedPoolIdentitySlot(cfgAgent, storedTemplateMatches, sessionBeadAgentName(sessionBead))
+	aliasSlot := resolvePersistedPoolIdentitySlot(cfgAgent, storedTemplateMatches, sessionBead.Metadata["alias"])
+	sessionNameSlot := 0
+	if storedTemplateMatches && strings.TrimSpace(sessionBead.Metadata["alias"]) == "" && !beadOwnsPoolSessionName(sessionBead) {
+		sessionNameSlot = resolvePersistedPoolIdentitySlot(cfgAgent, true, sessionBead.Metadata["session_name"])
+	}
+	if sessionBead.Metadata["pool_slot"] != "" {
+		if slot, err := strconv.Atoi(strings.TrimSpace(sessionBead.Metadata["pool_slot"])); err == nil && slot > 0 {
+			if agentSlot > 0 && agentSlot == aliasSlot && agentSlot != slot {
+				return agentSlot
+			}
+			if !storedTemplateMatches && agentSlot == 0 && aliasSlot == 0 {
+				return 0
+			}
+			if !inBoundsPoolSlot(cfgAgent, slot) {
+				if agentSlot > 0 {
+					return agentSlot
+				}
+				if aliasSlot > 0 {
+					return aliasSlot
+				}
+				if sessionNameSlot > 0 {
+					return sessionNameSlot
+				}
+				if poolSlotHasConfiguredBound(cfgAgent) {
+					return 0
+				}
+			}
+			return slot
 		}
-		if cfgAgent.Dir != "" && strings.TrimSpace(cfgAgent.QualifiedInstanceName(themed)) == agentName {
-			return idx + 1
+	}
+	if poolSlotHasConfiguredBound(cfgAgent) {
+		if agentSlot > 0 && !inBoundsPoolSlot(cfgAgent, agentSlot) {
+			agentSlot = 0
 		}
+		if aliasSlot > 0 && !inBoundsPoolSlot(cfgAgent, aliasSlot) {
+			aliasSlot = 0
+		}
+		if sessionNameSlot > 0 && !inBoundsPoolSlot(cfgAgent, sessionNameSlot) {
+			sessionNameSlot = 0
+		}
+	}
+	if agentSlot > 0 {
+		return agentSlot
+	}
+	if aliasSlot > 0 {
+		return aliasSlot
+	}
+	if sessionNameSlot > 0 {
+		return sessionNameSlot
 	}
 	return 0
 }
@@ -1158,6 +1899,9 @@ func selectOrCreatePoolSessionBead(
 		if isNamedSessionBead(bead) {
 			continue
 		}
+		if sessionBeadHasAssignedWork(bp.assignedWorkBeads, bead) {
+			continue
+		}
 		if used[bead.ID] {
 			continue
 		}
@@ -1168,7 +1912,23 @@ func selectOrCreatePoolSessionBead(
 			return bead, nil
 		}
 	}
-	return createPoolSessionBead(bp.beadStore, template, bp.sessionBeads)
+	return createPoolSessionBead(bp.beadStore, template, bp.sessionBeads, poolSessionCreateStartedAt(bp))
+}
+
+func sessionBeadHasAssignedWork(workBeads []beads.Bead, sessionBead beads.Bead) bool {
+	for _, wb := range workBeads {
+		assignee := strings.TrimSpace(wb.Assignee)
+		if assignee == "" || (wb.Status != "open" && wb.Status != "in_progress") {
+			continue
+		}
+		if assignee == sessionBead.ID || assignee == strings.TrimSpace(sessionBead.Metadata["session_name"]) {
+			return true
+		}
+		if namedIdentity := strings.TrimSpace(sessionBead.Metadata["configured_named_identity"]); namedIdentity != "" && assignee == namedIdentity {
+			return true
+		}
+	}
+	return false
 }
 
 func selectOrCreateDependencyPoolSessionBead(
@@ -1196,7 +1956,11 @@ func selectOrCreateDependencyPoolSessionBead(
 			return bead, nil
 		}
 	}
-	return createPoolSessionBead(bp.beadStore, template, bp.sessionBeads)
+	return createPoolSessionBead(bp.beadStore, template, bp.sessionBeads, poolSessionCreateStartedAt(bp))
+}
+
+func poolSessionCreateStartedAt(_ *agentBuildParams) time.Time {
+	return time.Now().UTC()
 }
 
 func agentInSuspendedRig(
@@ -1212,16 +1976,6 @@ func agentInSuspendedRig(
 	return suspendedRigPaths[filepath.Clean(rigRootForName(rigName, rigs))]
 }
 
-func namedSessionAllowsControllerWorkQuery(cityPath string, cfg *config.City, spec namedSessionSpec) bool {
-	if cfg == nil || spec.Agent == nil {
-		return false
-	}
-	if spec.Named != nil && strings.TrimSpace(spec.Named.Dir) != "" {
-		return true
-	}
-	return configuredRigName(cityPath, spec.Agent, cfg.Rigs) != ""
-}
-
 // prepareTemplateResolution installs any hook-backed files that must exist
 // before resolveTemplate fingerprints CopyFiles. This keeps generated hook
 // files from looking like config drift on the next reconcile tick.
@@ -1247,10 +2001,28 @@ func prepareTemplateResolution(bp *agentBuildParams, cfgAgent *config.Agent, qua
 }
 
 func resolveTemplatePrepared(bp *agentBuildParams, cfgAgent *config.Agent, qualifiedName string, fpExtra map[string]string) (TemplateParams, error) {
+	if err := validateAgentSessionTransportForBuild(bp, cfgAgent, qualifiedName); err != nil {
+		return TemplateParams{}, err
+	}
 	prepareTemplateResolution(bp, cfgAgent, qualifiedName, bp.stderr)
 	return resolveTemplate(bp, cfgAgent, qualifiedName, fpExtra)
 }
 
+func validateAgentSessionTransportForBuild(bp *agentBuildParams, cfgAgent *config.Agent, qualifiedName string) error {
+	if bp == nil || cfgAgent == nil {
+		return nil
+	}
+	resolved, err := config.ResolveProvider(cfgAgent, bp.workspace, bp.providers, bp.lookPath)
+	if err != nil {
+		return fmt.Errorf("agent %q: %w", qualifiedName, err)
+	}
+	transport := config.ResolveSessionCreateTransport(cfgAgent.Session, resolved)
+	if err := validateResolvedSessionTransport(resolved, transport, bp.sp); err != nil {
+		return fmt.Errorf("agent %q: %w", qualifiedName, err)
+	}
+	return nil
+}
+
 // installAgentSideEffects performs idempotent side effects for a resolved
 // agent: hook installation and ACP route registration. Called from
 // buildDesiredState on every tick; safe to repeat.
diff --git a/cmd/gc/build_desired_state_test.go b/cmd/gc/build_desired_state_test.go
index e7e54f1e6c..d8bf142ee7 100644
--- a/cmd/gc/build_desired_state_test.go
+++ b/cmd/gc/build_desired_state_test.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/beads/contract"
+	"github.com/gastownhall/gascity/internal/clock"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/runtime"
@@ -28,6 +29,131 @@ func (s listFailStore) List(_ beads.ListQuery) ([]beads.Bead, error) {
 	return nil, errors.New("list failed")
 }
 
+type readyFailStore struct {
+	beads.Store
+	readyCalls int
+}
+
+func (s *readyFailStore) Ready(...beads.ReadyQuery) ([]beads.Bead, error) {
+	s.readyCalls++
+	return nil, errors.New("backing ready should not be used")
+}
+
+type readyStaticStore struct {
+	beads.Store
+	ready      []beads.Bead
+	readyCalls int
+}
+
+func (s *readyStaticStore) Ready(...beads.ReadyQuery) ([]beads.Bead, error) {
+	s.readyCalls++
+	out := make([]beads.Bead, len(s.ready))
+	copy(out, s.ready)
+	return out, nil
+}
+
+type readyQueryRecordingStore struct {
+	*beads.MemStore
+	readyQueries []beads.ReadyQuery
+}
+
+func (s *readyQueryRecordingStore) Ready(query ...beads.ReadyQuery) ([]beads.Bead, error) {
+	if len(query) == 0 {
+		s.readyQueries = append(s.readyQueries, beads.ReadyQuery{})
+	} else {
+		s.readyQueries = append(s.readyQueries, query[0])
+	}
+	return s.MemStore.Ready(query...)
+}
+
+type demandListCountingStore struct {
+	beads.Store
+	liveInProgressLists int
+	liveOpenMolecules   int
+}
+
+func (s *demandListCountingStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Live && query.Status == "in_progress" {
+		s.liveInProgressLists++
+	}
+	if query.Live && query.Status == "open" && query.Type == "molecule" {
+		s.liveOpenMolecules++
+	}
+	return s.Store.List(query)
+}
+
+type demandRefreshFailStore struct {
+	beads.Store
+	failNextGet         bool
+	liveInProgressLists int
+}
+
+func (s *demandRefreshFailStore) Get(id string) (beads.Bead, error) {
+	if s.failNextGet {
+		s.failNextGet = false
+		return beads.Bead{}, errors.New("transient get failure")
+	}
+	return s.Store.Get(id)
+}
+
+func (s *demandRefreshFailStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Live && query.Status == "in_progress" {
+		s.liveInProgressLists++
+	}
+	return s.Store.List(query)
+}
+
+type partialAssignedWorkStore struct {
+	*beads.MemStore
+	partialInProgress bool
+	partialReady      bool
+}
+
+type controllerDemandPartialStore struct {
+	*beads.MemStore
+}
+
+func (s *controllerDemandPartialStore) Ready(query ...beads.ReadyQuery) ([]beads.Bead, error) {
+	rows, err := s.MemStore.Ready(query...)
+	if err != nil {
+		return nil, err
+	}
+	if len(query) == 0 {
+		return rows, &beads.PartialResultError{Op: "bd ready", Err: errors.New("skipped corrupt controller demand bead")}
+	}
+	return rows, nil
+}
+
+type acpOnlyDesiredStateProvider struct {
+	*runtime.Fake
+}
+
+func (p *acpOnlyDesiredStateProvider) SupportsTransport(transport string) bool {
+	return transport == config.SessionTransportACP
+}
+
+func (s *partialAssignedWorkStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	rows, err := s.MemStore.List(query)
+	if err != nil {
+		return nil, err
+	}
+	if s.partialInProgress && query.Status == "in_progress" && query.Live {
+		return rows, &beads.PartialResultError{Op: "bd list", Err: errors.New("skipped corrupt in-progress bead")}
+	}
+	return rows, nil
+}
+
+func (s *partialAssignedWorkStore) Ready(query ...beads.ReadyQuery) ([]beads.Bead, error) {
+	rows, err := s.MemStore.Ready(query...)
+	if err != nil {
+		return nil, err
+	}
+	if s.partialReady {
+		return rows, &beads.PartialResultError{Op: "bd ready", Err: errors.New("skipped corrupt ready bead")}
+	}
+	return rows, nil
+}
+
 func TestCollectAssignedWorkBeads_IncludesReadyOpenAssignedHandoff(t *testing.T) {
 	store := beads.NewMemStore()
 	handoff, err := store.Create(beads.Bead{
@@ -59,6 +185,96 @@ func TestCollectAssignedWorkBeads_IncludesReadyOpenAssignedHandoff(t *testing.T)
 	}
 }
 
+func TestCollectAssignedWorkBeadsUsesCachedReadyReadModel(t *testing.T) {
+	backing := &readyFailStore{Store: beads.NewMemStore()}
+	handoff, err := backing.Create(beads.Bead{
+		Title:    "merge me",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "repo/refinery",
+	})
+	if err != nil {
+		t.Fatalf("create handoff bead: %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	got, _ := collectAssignedWorkBeads(&config.City{}, cache)
+	if len(got) != 1 || got[0].ID != handoff.ID {
+		t.Fatalf("collectAssignedWorkBeads returned %#v, want [%s]", got, handoff.ID)
+	}
+	if backing.readyCalls != 0 {
+		t.Fatalf("backing Ready calls = %d, want cached demand read", backing.readyCalls)
+	}
+}
+
+func TestCollectAssignedWorkBeadsUsesCachedInProgressReadModel(t *testing.T) {
+	backing := &demandListCountingStore{Store: beads.NewMemStore()}
+	work, err := backing.Create(beads.Bead{
+		Title:    "active handoff",
+		Type:     "task",
+		Status:   "in_progress",
+		Assignee: "repo/refinery",
+	})
+	if err != nil {
+		t.Fatalf("create active bead: %v", err)
+	}
+	if err := backing.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("set active bead in_progress: %v", err)
+	}
+	work, err = backing.Get(work.ID)
+	if err != nil {
+		t.Fatalf("reload active bead: %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	got, _ := collectAssignedWorkBeads(&config.City{}, cache)
+	if len(got) != 1 || got[0].ID != work.ID {
+		t.Fatalf("collectAssignedWorkBeads returned %#v, want [%s]", got, work.ID)
+	}
+	if backing.liveInProgressLists != 0 {
+		t.Fatalf("live in_progress list calls = %d, want cached demand read", backing.liveInProgressLists)
+	}
+}
+
+func TestCollectAssignedWorkBeadsFallsBackLiveWhenCachedInProgressDirty(t *testing.T) {
+	backing := &demandRefreshFailStore{Store: beads.NewMemStore()}
+	work, err := backing.Create(beads.Bead{
+		Title: "handoff becomes active",
+		Type:  "task",
+	})
+	if err != nil {
+		t.Fatalf("create active bead: %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	status := "in_progress"
+	assignee := "repo/refinery"
+	backing.failNextGet = true
+	if err := cache.Update(work.ID, beads.UpdateOpts{Status: &status, Assignee: &assignee}); err != nil {
+		t.Fatalf("Update(active): %v", err)
+	}
+
+	got, partial := collectAssignedWorkBeads(&config.City{}, cache)
+	if partial {
+		t.Fatal("collectAssignedWorkBeads reported partial with successful live fallback")
+	}
+	if len(got) != 1 || got[0].ID != work.ID || got[0].Status != "in_progress" || got[0].Assignee != "repo/refinery" {
+		t.Fatalf("collectAssignedWorkBeads returned %#v, want live in-progress %s", got, work.ID)
+	}
+	if backing.liveInProgressLists != 1 {
+		t.Fatalf("live in_progress list calls = %d, want dirty cache fallback", backing.liveInProgressLists)
+	}
+}
+
 func TestCollectAssignedWorkBeads_ExcludesBlockedOpenAssignedHandoff(t *testing.T) {
 	store := beads.NewMemStore()
 	blocker, err := store.Create(beads.Bead{
@@ -88,6 +304,334 @@ func TestCollectAssignedWorkBeads_ExcludesBlockedOpenAssignedHandoff(t *testing.
 	}
 }
 
+func TestDefaultScaleCheckCountsUsesCachedReadyReadModel(t *testing.T) {
+	backing := &readyFailStore{Store: beads.NewMemStore()}
+	if _, err := backing.Create(beads.Bead{
+		Title:  "queued routed work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "gascity/workflows.codex-min",
+		},
+	}); err != nil {
+		t.Fatalf("create routed bead: %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	counts, _, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{{
+		template: "gascity/workflows.codex-min",
+		storeKey: "rig:gascity",
+		store:    cache,
+	}})
+	if len(errs) != 0 {
+		t.Fatalf("defaultScaleCheckCounts errs = %v", errs)
+	}
+	if got := counts["gascity/workflows.codex-min"]; got != 1 {
+		t.Fatalf("defaultScaleCheckCounts = %d, want 1", got)
+	}
+	if backing.readyCalls != 0 {
+		t.Fatalf("backing Ready calls = %d, want cached demand read", backing.readyCalls)
+	}
+}
+
+func TestDefaultScaleCheckCountsIgnoresOpenMoleculeContainers(t *testing.T) {
+	backing := &demandListCountingStore{Store: beads.NewMemStore()}
+	if _, err := backing.Create(beads.Bead{
+		Title:  "workflow root",
+		Type:   "molecule",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "gascity/workflows.codex-min",
+		},
+	}); err != nil {
+		t.Fatalf("create molecule bead: %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	counts, _, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{{
+		template: "gascity/workflows.codex-min",
+		storeKey: "rig:gascity",
+		store:    cache,
+	}})
+	if len(errs) != 0 {
+		t.Fatalf("defaultScaleCheckCounts errs = %v", errs)
+	}
+	if got := counts["gascity/workflows.codex-min"]; got != 0 {
+		t.Fatalf("defaultScaleCheckCounts = %d, want molecule container ignored", got)
+	}
+	if backing.liveOpenMolecules != 0 {
+		t.Fatalf("live open molecule list calls = %d, want no molecule demand query", backing.liveOpenMolecules)
+	}
+}
+
+func TestDefaultScaleCheckCountsHonorsCachedWriteThroughDependencies(t *testing.T) {
+	backing := &readyFailStore{Store: beads.NewMemStore()}
+	blocker, err := backing.Create(beads.Bead{
+		Title:  "blocked earlier step",
+		Type:   "task",
+		Status: "open",
+	})
+	if err != nil {
+		t.Fatalf("create blocker: %v", err)
+	}
+	blocked, err := backing.Create(beads.Bead{
+		Title:  "future routed work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "gascity/workflows.codex-max",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create blocked: %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+	if err := cache.DepAdd(blocked.ID, blocker.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd: %v", err)
+	}
+
+	counts, _, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{{
+		template: "gascity/workflows.codex-max",
+		storeKey: "rig:gascity",
+		store:    cache,
+	}})
+	if len(errs) != 0 {
+		t.Fatalf("defaultScaleCheckCounts errs = %v", errs)
+	}
+	if got := counts["gascity/workflows.codex-max"]; got != 0 {
+		t.Fatalf("defaultScaleCheckCounts = %d, want blocked future work excluded", got)
+	}
+	if backing.readyCalls != 0 {
+		t.Fatalf("backing Ready calls = %d, want cached demand read", backing.readyCalls)
+	}
+}
+
+func TestDefaultScaleCheckCountsFallsBackWhenCachedEventDepsUnknown(t *testing.T) {
+	backing := &readyStaticStore{
+		Store: beads.NewMemStore(),
+		ready: []beads.Bead{{
+			ID:     "gc-ready",
+			Title:  "ready routed work",
+			Type:   "task",
+			Status: "open",
+			Metadata: map[string]string{
+				"gc.routed_to": "gascity/workflows.codex-max",
+			},
+		}},
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+	cache.ApplyEvent("bead.created", []byte(`{"id":"gc-blocked","status":"open","metadata":{"gc.routed_to":"gascity/workflows.codex-max"}}`))
+
+	counts, _, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{{
+		template: "gascity/workflows.codex-max",
+		storeKey: "rig:gascity",
+		store:    cache,
+	}})
+	if len(errs) != 0 {
+		t.Fatalf("defaultScaleCheckCounts errs = %v", errs)
+	}
+	if got := counts["gascity/workflows.codex-max"]; got != 1 {
+		t.Fatalf("defaultScaleCheckCounts = %d, want live ready fallback count only", got)
+	}
+	if backing.readyCalls != 1 {
+		t.Fatalf("backing Ready calls = %d, want one live ready fallback", backing.readyCalls)
+	}
+}
+
+func TestDefaultScaleCheckCountsUsesPartialReadyRows(t *testing.T) {
+	store := &partialAssignedWorkStore{MemStore: beads.NewMemStore(), partialReady: true}
+	if _, err := store.Create(beads.Bead{
+		Title:  "queued routed work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "gascity/workflows.codex-max",
+		},
+	}); err != nil {
+		t.Fatalf("create routed bead: %v", err)
+	}
+
+	counts, partialTemplates, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{{
+		template: "gascity/workflows.codex-max",
+		storeKey: "rig:gascity",
+		store:    store,
+	}})
+	if got := counts["gascity/workflows.codex-max"]; got != 1 {
+		t.Fatalf("defaultScaleCheckCounts = %d, want survivor row counted", got)
+	}
+	if len(errs) != 1 || !beads.IsPartialResult(errs[0]) {
+		t.Fatalf("defaultScaleCheckCounts errs = %v, want partial-result diagnostic", errs)
+	}
+	if !partialTemplates["gascity/workflows.codex-max"] {
+		t.Fatalf("partialTemplates = %v, want affected template marked partial", partialTemplates)
+	}
+}
+
+func TestDefaultScaleCheckCountsReadyErrorNamesAffectedTemplates(t *testing.T) {
+	store := &readyFailStore{Store: beads.NewMemStore()}
+
+	_, partialTemplates, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{
+		{template: "gascity/workflows.codex-min", storeKey: "rig:gascity", store: store},
+		{template: "gascity/workflows.codex-max", storeKey: "rig:gascity", store: store},
+	})
+	if len(errs) != 1 {
+		t.Fatalf("defaultScaleCheckCounts errs = %v, want one grouped Ready diagnostic", errs)
+	}
+	msg := errs[0].Error()
+	for _, want := range []string{"rig:gascity", "gascity/workflows.codex-min", "gascity/workflows.codex-max"} {
+		if !strings.Contains(msg, want) {
+			t.Fatalf("defaultScaleCheckCounts err = %q, want affected template %q", msg, want)
+		}
+	}
+	for _, want := range []string{"gascity/workflows.codex-min", "gascity/workflows.codex-max"} {
+		if !partialTemplates[want] {
+			t.Fatalf("partialTemplates = %v, want %q marked partial", partialTemplates, want)
+		}
+	}
+}
+
+func TestDefaultNamedSessionDemandUsesPartialReadyRows(t *testing.T) {
+	store := &partialAssignedWorkStore{MemStore: beads.NewMemStore(), partialReady: true}
+	if _, err := store.Create(beads.Bead{
+		Title:  "queued worker work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "worker",
+		},
+	}); err != nil {
+		t.Fatalf("create routed bead: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name: "worker",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "primary",
+			Template: "worker",
+			Mode:     "on_demand",
+		}},
+	}
+
+	demand, partialTemplates, errs := defaultNamedSessionDemand([]defaultScaleCheckTarget{{
+		template: "worker",
+		storeKey: "rig:gascity",
+		store:    store,
+	}}, cfg, "test-city")
+	if !demand["primary"] {
+		t.Fatalf("defaultNamedSessionDemand[primary] = false, want survivor row counted")
+	}
+	if len(errs) != 1 || !beads.IsPartialResult(errs[0]) {
+		t.Fatalf("defaultNamedSessionDemand errs = %v, want partial-result diagnostic", errs)
+	}
+	msg := errs[0].Error()
+	for _, want := range []string{"rig:gascity", "worker"} {
+		if !strings.Contains(msg, want) {
+			t.Fatalf("defaultNamedSessionDemand err = %q, want affected template %q", msg, want)
+		}
+	}
+	if !partialTemplates["worker"] {
+		t.Fatalf("partialTemplates = %v, want worker marked partial", partialTemplates)
+	}
+}
+
+func TestDefaultScaleCheckCountsReportsMissingRigStore(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{
+		Rigs: []config.Rig{{
+			Name: "repo",
+			Path: filepath.Join(cityPath, "repos", "repo"),
+		}},
+	}
+	agent := &config.Agent{Name: "worker", Dir: filepath.Join("repos", "repo")}
+	cityStore := beads.NewMemStore()
+	if _, err := cityStore.Create(beads.Bead{
+		Title:  "wrong-store routed work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "repos/repo/worker",
+		},
+	}); err != nil {
+		t.Fatalf("create city routed bead: %v", err)
+	}
+	target := defaultScaleCheckTargetForAgent(cityPath, cfg, agent, cityStore, nil)
+
+	counts, partialTemplates, errs := defaultScaleCheckCounts([]defaultScaleCheckTarget{target})
+	if got := counts["repos/repo/worker"]; got != 0 {
+		t.Fatalf("defaultScaleCheckCounts = %d, want 0", got)
+	}
+	if len(errs) != 1 {
+		t.Fatalf("defaultScaleCheckCounts errs = %v, want one missing rig-store diagnostic", errs)
+	}
+	if !strings.Contains(errs[0].Error(), `rig store "repo" unavailable`) {
+		t.Fatalf("defaultScaleCheckCounts err = %v, want missing rig-store diagnostic", errs[0])
+	}
+	if !partialTemplates["repos/repo/worker"] {
+		t.Fatalf("partialTemplates = %v, want missing rig-store template marked partial", partialTemplates)
+	}
+}
+
+func TestBuildDesiredStateDefaultScaleCheckMissingRigStoreReportsZeroDemand(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "rig-owned routed work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "repos/repo/worker",
+		},
+	}); err != nil {
+		t.Fatalf("create city routed bead: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs: []config.Rig{{
+			Name: "repo",
+			Path: filepath.Join(cityPath, "repos", "repo"),
+		}},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               filepath.Join("repos", "repo"),
+			StartCommand:      "true",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(1),
+		}},
+	}
+
+	var stderr strings.Builder
+	got := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, &stderr)
+	if demand := got.ScaleCheckCounts["repos/repo/worker"]; demand != 0 {
+		t.Fatalf("ScaleCheckCounts[repos/repo/worker] = %d, want 0 without rig store", demand)
+	}
+	if got.StoreQueryPartial {
+		t.Fatalf("StoreQueryPartial = true, want false for scoped default scale_check failure")
+	}
+	if !got.ScaleCheckPartialTemplates["repos/repo/worker"] {
+		t.Fatalf("ScaleCheckPartialTemplates = %v, want missing rig-store template marked partial", got.ScaleCheckPartialTemplates)
+	}
+	if len(got.State) != 0 {
+		t.Fatalf("desired sessions = %d, want none without rig store demand", len(got.State))
+	}
+	if !strings.Contains(stderr.String(), `rig store "repo" unavailable`) {
+		t.Fatalf("stderr = %q, want missing rig-store diagnostic", stderr.String())
+	}
+}
+
 func TestCollectAssignedWorkBeads_ExcludesRoutedToMetadataWithoutAssignee(t *testing.T) {
 	t.Parallel()
 	store := beads.NewMemStore()
@@ -153,9 +697,337 @@ func TestCollectAssignedWorkBeads_ExcludesSessionBeads(t *testing.T) {
 	}
 }
 
-func TestCollectAssignedWorkBeadsWithStores_TracksRigStore(t *testing.T) {
-	cityStore := beads.NewMemStore()
-	rigStore := beads.NewMemStore()
+func TestCollectAssignedWorkBeads_PreservesPartialInProgressSurvivors(t *testing.T) {
+	t.Parallel()
+
+	store := &partialAssignedWorkStore{
+		MemStore:          beads.NewMemStore(),
+		partialInProgress: true,
+	}
+	work, err := store.Create(beads.Bead{
+		Title:    "assigned active work",
+		Type:     "task",
+		Assignee: "worker-1",
+	})
+	if err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("set work in_progress: %v", err)
+	}
+	work, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("reload work bead: %v", err)
+	}
+
+	got, stores, storeRefs, partial := collectAssignedWorkBeadsWithStores(&config.City{}, store, nil, nil, nil)
+	if !partial {
+		t.Fatal("partial = false, want true")
+	}
+	if len(got) != 1 || got[0].ID != work.ID {
+		t.Fatalf("collectAssignedWorkBeadsWithStores returned %#v, want partial survivor %s", got, work.ID)
+	}
+	if len(stores) != 1 || stores[0] != store {
+		t.Fatalf("stores = %#v, want source store for partial survivor", stores)
+	}
+	if len(storeRefs) != 1 || storeRefs[0] != "" {
+		t.Fatalf("storeRefs = %#v, want city store ref for partial survivor", storeRefs)
+	}
+}
+
+func TestCollectAssignedWorkBeads_PreservesPartialReadySurvivors(t *testing.T) {
+	t.Parallel()
+
+	store := &partialAssignedWorkStore{
+		MemStore:     beads.NewMemStore(),
+		partialReady: true,
+	}
+	work, err := store.Create(beads.Bead{
+		Title:    "assigned ready work",
+		Type:     "task",
+		Assignee: "worker-1",
+	})
+	if err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+
+	got, stores, storeRefs, partial := collectAssignedWorkBeadsWithStores(&config.City{}, store, nil, nil, nil)
+	if !partial {
+		t.Fatal("partial = false, want true")
+	}
+	if len(got) != 1 || got[0].ID != work.ID {
+		t.Fatalf("collectAssignedWorkBeadsWithStores returned %#v, want partial ready survivor %s", got, work.ID)
+	}
+	if len(stores) != 1 || stores[0] != store {
+		t.Fatalf("stores = %#v, want source store for partial survivor", stores)
+	}
+	if len(storeRefs) != 1 || storeRefs[0] != "" {
+		t.Fatalf("storeRefs = %#v, want city store ref for partial survivor", storeRefs)
+	}
+}
+
+func TestCollectAssignedWorkBeads_SkipsReadyProbeForInProgressAssignee(t *testing.T) {
+	store := &readyQueryRecordingStore{MemStore: beads.NewMemStore()}
+	session, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker-session",
+			"template":     "worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	work, err := store.Create(beads.Bead{
+		Title:    "active work",
+		Type:     "task",
+		Assignee: "worker-session",
+	})
+	if err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("mark work in_progress: %v", err)
+	}
+	work, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("reload work: %v", err)
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{session})
+
+	got, _, _, partial := collectAssignedWorkBeadsWithStores(&config.City{}, store, nil, nil, snapshot)
+	if partial {
+		t.Fatal("collectAssignedWorkBeadsWithStores reported partial results")
+	}
+	if len(got) != 1 || got[0].ID != work.ID {
+		t.Fatalf("got = %#v, want in-progress work %s", got, work.ID)
+	}
+	if len(store.readyQueries) != 0 {
+		t.Fatalf("Ready queried while in-progress work was already known: %#v", store.readyQueries)
+	}
+}
+
+func TestCollectAssignedWorkBeads_SkipsCityReadyProbeForRigInProgressAssignee(t *testing.T) {
+	cityStore := &readyQueryRecordingStore{MemStore: beads.NewMemStore()}
+	rigStore := &readyQueryRecordingStore{MemStore: beads.NewMemStore()}
+	session, err := cityStore.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker-session",
+			"template":     "worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	work, err := rigStore.Create(beads.Bead{
+		Title:    "active rig work",
+		Type:     "task",
+		Assignee: "worker-session",
+	})
+	if err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+	if err := rigStore.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("mark work in_progress: %v", err)
+	}
+	work, err = rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("reload work: %v", err)
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{session})
+
+	got, _, _, partial := collectAssignedWorkBeadsWithStores(
+		&config.City{Rigs: []config.Rig{{Name: "repo", Path: "repo"}}},
+		cityStore,
+		map[string]beads.Store{"repo": rigStore},
+		nil,
+		snapshot,
+	)
+	if partial {
+		t.Fatal("collectAssignedWorkBeadsWithStores reported partial results")
+	}
+	if len(got) != 1 || got[0].ID != work.ID {
+		t.Fatalf("got = %#v, want rig in-progress work %s", got, work.ID)
+	}
+	if len(cityStore.readyQueries) != 0 || len(rigStore.readyQueries) != 0 {
+		t.Fatalf("Ready queried while cross-store in-progress work was already known: city=%#v rig=%#v", cityStore.readyQueries, rigStore.readyQueries)
+	}
+}
+
+func TestCollectAssignedWorkBeads_ReadyProbeStillRunsForOtherAssignees(t *testing.T) {
+	store := &readyQueryRecordingStore{MemStore: beads.NewMemStore()}
+	activeSession, err := store.Create(beads.Bead{
+		Title:  "active worker session",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker-active",
+			"template":     "worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create active session bead: %v", err)
+	}
+	readySession, err := store.Create(beads.Bead{
+		Title:  "ready worker session",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker-ready",
+			"template":     "worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create ready session bead: %v", err)
+	}
+	activeWork, err := store.Create(beads.Bead{
+		Title:    "active work",
+		Type:     "task",
+		Assignee: "worker-active",
+	})
+	if err != nil {
+		t.Fatalf("create active work bead: %v", err)
+	}
+	if err := store.Update(activeWork.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("mark active work in_progress: %v", err)
+	}
+	activeWork, err = store.Get(activeWork.ID)
+	if err != nil {
+		t.Fatalf("reload active work: %v", err)
+	}
+	readyWork, err := store.Create(beads.Bead{
+		Title:    "ready work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "worker-ready",
+	})
+	if err != nil {
+		t.Fatalf("create ready work bead: %v", err)
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{activeSession, readySession})
+
+	got, _, _, partial := collectAssignedWorkBeadsWithStores(&config.City{}, store, nil, nil, snapshot)
+	if partial {
+		t.Fatal("collectAssignedWorkBeadsWithStores reported partial results")
+	}
+	gotIDs := make(map[string]bool)
+	for _, bead := range got {
+		gotIDs[bead.ID] = true
+	}
+	for _, want := range []string{activeWork.ID, readyWork.ID} {
+		if !gotIDs[want] {
+			t.Fatalf("collected work IDs = %#v, want %s", gotIDs, want)
+		}
+	}
+	queried := make(map[string]bool)
+	for _, query := range store.readyQueries {
+		queried[query.Assignee] = true
+	}
+	if queried["worker-active"] || queried[activeSession.ID] {
+		t.Fatalf("Ready queries = %#v, want no probe for active assignee", store.readyQueries)
+	}
+	if !queried["worker-ready"] {
+		t.Fatalf("Ready queries = %#v, want probe for worker-ready", store.readyQueries)
+	}
+}
+
+func TestCollectAssignedWorkBeads_ReadyProbeIncludesActiveSessionAssignees(t *testing.T) {
+	store := &readyQueryRecordingStore{MemStore: beads.NewMemStore()}
+	activeSession, err := store.Create(beads.Bead{
+		Title:  "active worker session",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker-active",
+			"template":     "worker",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create active session bead: %v", err)
+	}
+	sleepySession, err := store.Create(beads.Bead{
+		Title:  "sleepy worker session",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker-sleepy",
+			"template":     "worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create sleepy session bead: %v", err)
+	}
+	readyWork, err := store.Create(beads.Bead{
+		Title:    "ready active work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "worker-active",
+	})
+	if err != nil {
+		t.Fatalf("create ready work bead: %v", err)
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{activeSession, sleepySession})
+
+	got, _, _, partial := collectAssignedWorkBeadsWithStores(&config.City{}, store, nil, nil, snapshot)
+	if partial {
+		t.Fatal("collectAssignedWorkBeadsWithStores reported partial results")
+	}
+	if len(got) != 1 || got[0].ID != readyWork.ID {
+		t.Fatalf("got = %#v, want ready active-session work %s", got, readyWork.ID)
+	}
+	queried := make(map[string]bool)
+	for _, query := range store.readyQueries {
+		queried[query.Assignee] = true
+	}
+	if !queried["worker-active"] {
+		t.Fatalf("Ready queries = %#v, want probe for active session assignee", store.readyQueries)
+	}
+}
+
+func TestReadyAssignedWorkAssigneesExcludeBroadIdentities(t *testing.T) {
+	got := readyAssignedWorkAssignees(&config.City{
+		Agents: []config.Agent{{
+			Dir:  "repo",
+			Name: "worker",
+		}},
+		NamedSessions: []config.NamedSession{
+			{Template: "mayor", Mode: "always"},
+			{Dir: "repo", Template: "named-worker", Mode: "on_demand"},
+		},
+	}, nil, nil)
+
+	for _, disallowed := range []string{"repo/worker", "mayor"} {
+		for _, value := range got {
+			if value == disallowed {
+				t.Fatalf("ready assignees = %#v, want no broad identity %q", got, disallowed)
+			}
+		}
+	}
+	foundNamed := false
+	for _, value := range got {
+		if value == "repo/named-worker" {
+			foundNamed = true
+		}
+	}
+	if !foundNamed {
+		t.Fatalf("ready assignees = %#v, want on-demand named-session identity", got)
+	}
+}
+
+func TestCollectAssignedWorkBeadsWithStores_TracksRigStore(t *testing.T) {
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
 	work, err := rigStore.Create(beads.Bead{
 		Title:    "assigned rig work",
 		Type:     "task",
@@ -173,11 +1045,12 @@ func TestCollectAssignedWorkBeadsWithStores_TracksRigStore(t *testing.T) {
 		t.Fatalf("reload rig work bead: %v", err)
 	}
 
-	got, stores, partial := collectAssignedWorkBeadsWithStores(
+	got, stores, storeRefs, partial := collectAssignedWorkBeadsWithStores(
 		&config.City{Rigs: []config.Rig{{Name: "repo", Path: "/repo"}}},
 		cityStore,
 		map[string]beads.Store{"repo": rigStore},
 		nil,
+		nil,
 	)
 	if partial {
 		t.Fatal("partial = true, want false")
@@ -188,6 +1061,9 @@ func TestCollectAssignedWorkBeadsWithStores_TracksRigStore(t *testing.T) {
 	if len(stores) != 1 || stores[0] != rigStore {
 		t.Fatalf("stores = %#v, want [rig store]", stores)
 	}
+	if len(storeRefs) != 1 || storeRefs[0] != "repo" {
+		t.Fatalf("storeRefs = %#v, want [repo]", storeRefs)
+	}
 }
 
 func TestCollectAssignedWorkBeadsWithStores_PreservesCrossStoreIDCollisions(t *testing.T) {
@@ -229,11 +1105,12 @@ func TestCollectAssignedWorkBeadsWithStores_PreservesCrossStoreIDCollisions(t *t
 		t.Fatalf("test setup expected overlapping city/rig IDs, got city %q rig %q", cityWork.ID, rigWork.ID)
 	}
 
-	got, stores, partial := collectAssignedWorkBeadsWithStores(
+	got, stores, storeRefs, partial := collectAssignedWorkBeadsWithStores(
 		&config.City{Rigs: []config.Rig{{Name: "repo", Path: "/repo"}}},
 		cityStore,
 		map[string]beads.Store{"repo": rigStore},
 		nil,
+		nil,
 	)
 	if partial {
 		t.Fatal("partial = true, want false")
@@ -244,12 +1121,21 @@ func TestCollectAssignedWorkBeadsWithStores_PreservesCrossStoreIDCollisions(t *t
 	if len(stores) != len(got) {
 		t.Fatalf("stores length = %d, want %d", len(stores), len(got))
 	}
+	if len(storeRefs) != len(got) {
+		t.Fatalf("storeRefs length = %d, want %d", len(storeRefs), len(got))
+	}
 	if got[0].ID != cityWork.ID || stores[0] != cityStore {
 		t.Fatalf("first collected work = (%s, %#v), want city work/store", got[0].ID, stores[0])
 	}
+	if storeRefs[0] != "" {
+		t.Fatalf("first store ref = %q, want city ref", storeRefs[0])
+	}
 	if got[1].ID != rigWork.ID || stores[1] != rigStore {
 		t.Fatalf("second collected work = (%s, %#v), want rig work/store", got[1].ID, stores[1])
 	}
+	if storeRefs[1] != "repo" {
+		t.Fatalf("second store ref = %q, want repo", storeRefs[1])
+	}
 }
 
 func TestBuildDesiredState_UsesAgentHookOverride(t *testing.T) {
@@ -281,6 +1167,49 @@ func TestBuildDesiredState_UsesAgentHookOverride(t *testing.T) {
 	}
 }
 
+func TestBuildDesiredStateRejectsExplicitTmuxAgentWhenSessionProviderCannotRouteTmux(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city", Provider: "opencode"},
+		Session:   config.SessionConfig{Provider: config.SessionTransportACP},
+		Providers: map[string]config.ProviderSpec{
+			"opencode": {
+				Command:     "echo",
+				Args:        []string{"provider"},
+				ACPCommand:  "echo",
+				ACPArgs:     []string{"acp"},
+				PromptMode:  "none",
+				SupportsACP: boolPtr(true),
+			},
+		},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Provider:          "opencode",
+			Session:           config.SessionTransportTmux,
+			MaxActiveSessions: intPtr(1),
+			ScaleCheck:        "printf 1",
+		}},
+	}
+	store := beads.NewMemStore()
+	sp := &acpOnlyDesiredStateProvider{Fake: runtime.NewFake()}
+	var stderr strings.Builder
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, sp, store, &stderr)
+	if len(dsResult.State) != 0 {
+		t.Fatalf("desired state size = %d, want 0: %#v", len(dsResult.State), dsResult.State)
+	}
+	beads, err := store.ListByLabel(sessionBeadLabel, 0)
+	if err != nil {
+		t.Fatalf("ListByLabel(%q): %v", sessionBeadLabel, err)
+	}
+	if len(beads) != 0 {
+		t.Fatalf("session bead count = %d, want 0: %#v", len(beads), beads)
+	}
+	if got := stderr.String(); !strings.Contains(got, "cannot route tmux sessions") {
+		t.Fatalf("stderr = %q, want tmux routing rejection", got)
+	}
+}
+
 func TestBuildDesiredState_InstallsGeminiHooksBeforeFingerprinting(t *testing.T) {
 	cityPath := t.TempDir()
 	cfg := &config.City{
@@ -600,7 +1529,99 @@ func TestBuildDesiredState_MinZeroDefaultScaleCheckRoutedWorkCreatesPoolSession(
 	}
 }
 
-func TestBuildDesiredState_OnDemandNamedSession_RoutedMetadataAloneDoesNotMaterialize(t *testing.T) {
+func TestBuildDesiredState_PoolInFlightSessionsPreservePartialScaleDemand(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	const template = "worker"
+
+	for i := 0; i < 5; i++ {
+		if _, err := store.Create(beads.Bead{
+			Title:  fmt.Sprintf("queued work %d", i+1),
+			Type:   "task",
+			Status: "open",
+			Metadata: map[string]string{
+				"gc.routed_to": template,
+			},
+		}); err != nil {
+			t.Fatalf("create queued work: %v", err)
+		}
+	}
+	var inFlightSessionIDs []string
+	for i := 0; i < 2; i++ {
+		session, err := store.Create(beads.Bead{
+			Title:  template,
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel, "agent:" + template},
+			Metadata: map[string]string{
+				"template":             template,
+				"agent_name":           template,
+				"state":                "asleep",
+				"pending_create_claim": boolMetadata(true),
+				poolManagedMetadataKey: boolMetadata(true),
+			},
+		})
+		if err != nil {
+			t.Fatalf("create pending pool session: %v", err)
+		}
+		if err := store.SetMetadata(session.ID, "session_name", PoolSessionName(template, session.ID)); err != nil {
+			t.Fatalf("set session_name: %v", err)
+		}
+		inFlightSessionIDs = append(inFlightSessionIDs, session.ID)
+	}
+	sessionSnapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		t.Fatalf("load session snapshot: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              template,
+			StartCommand:      "true",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(10),
+		}},
+	}
+
+	var stderr strings.Builder
+	dsResult := buildDesiredStateWithSessionBeads(
+		"test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		store, nil, sessionSnapshot, nil, &stderr,
+	)
+
+	if got := dsResult.ScaleCheckCounts[template]; got != 5 {
+		t.Fatalf("ScaleCheckCounts[%s] = %d, want 5", template, got)
+	}
+	desired := 0
+	for _, tp := range dsResult.State {
+		if tp.TemplateName == template {
+			desired++
+		}
+	}
+	if desired != 5 {
+		t.Fatalf("%s desired sessions = %d, want 5 with two in-flight plus three new; stderr:\n%s", template, desired, stderr.String())
+	}
+	desiredSessionNames := make(map[string]bool)
+	for _, tp := range dsResult.State {
+		if tp.TemplateName == template {
+			desiredSessionNames[tp.SessionName] = true
+		}
+	}
+	for _, id := range inFlightSessionIDs {
+		name := PoolSessionName(template, id)
+		if !desiredSessionNames[name] {
+			t.Fatalf("desired state did not preserve in-flight session %s (%s); desired=%#v", id, name, desiredSessionNames)
+		}
+	}
+	sessions, err := store.ListByLabel(sessionBeadLabel, 0)
+	if err != nil {
+		t.Fatalf("list session beads: %v", err)
+	}
+	if len(sessions) != 5 {
+		t.Fatalf("stored session beads = %d, want 5 total", len(sessions))
+	}
+}
+
+func TestBuildDesiredState_OnDemandNamedSession_DefaultRoutedWorkMaterializesNamedSession(t *testing.T) {
 	cityPath := t.TempDir()
 	store := beads.NewMemStore()
 	if _, err := store.Create(beads.Bead{
@@ -628,11 +1649,150 @@ func TestBuildDesiredState_OnDemandNamedSession_RoutedMetadataAloneDoesNotMateri
 	}
 
 	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	foundNamed := false
+	foundGeneric := false
 	for _, tp := range dsResult.State {
 		if tp.TemplateName == "mayor" {
-			t.Fatalf("routed metadata alone should not materialize on-demand named session: %+v", tp)
+			if tp.ConfiguredNamedIdentity == "mayor" {
+				foundNamed = true
+				continue
+			}
+			foundGeneric = true
 		}
 	}
+	if !foundNamed {
+		t.Fatal("default routed work should materialize the on-demand named session")
+	}
+	if foundGeneric {
+		t.Fatal("default routed work should not create a parallel generic session for the named template")
+	}
+	if !dsResult.NamedSessionDemand["mayor"] {
+		t.Fatal("NamedSessionDemand should record default routed work for mayor")
+	}
+}
+
+func TestBuildDesiredState_OnDemandNamedSession_DefaultRoutedTemplateMaterializesSingletonIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "queued worker work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "worker",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "primary",
+			Template: "worker",
+			Mode:     "on_demand",
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	foundNamed := false
+	for _, tp := range dsResult.State {
+		if tp.TemplateName != "worker" {
+			continue
+		}
+		if tp.ConfiguredNamedIdentity == "primary" {
+			foundNamed = true
+			continue
+		}
+		t.Fatalf("routed singleton template created generic worker session: %+v", tp)
+	}
+	if !foundNamed {
+		t.Fatal("default routed work should materialize the singleton named identity for worker")
+	}
+	if !dsResult.NamedSessionDemand["primary"] {
+		t.Fatal("NamedSessionDemand should record singleton identity demand")
+	}
+}
+
+func TestBuildDesiredState_OnDemandNamedSession_DefaultRoutedTemplateDoesNotPickAmbiguousIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "queued worker work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "worker",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{
+			{Name: "primary", Template: "worker", Mode: "on_demand"},
+			{Name: "secondary", Template: "worker", Mode: "on_demand"},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	if dsResult.NamedSessionDemand["primary"] || dsResult.NamedSessionDemand["secondary"] {
+		t.Fatalf("ambiguous template route recorded named demand: %v", dsResult.NamedSessionDemand)
+	}
+	for _, tp := range dsResult.State {
+		switch tp.ConfiguredNamedIdentity {
+		case "primary", "secondary":
+			t.Fatalf("ambiguous template route materialized named identity: %+v", tp)
+		}
+	}
+}
+
+func TestBuildDesiredState_OnDemandNamedSession_DefaultRoutedNoMatchDoesNotMaterialize(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "queued unmatched work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": "missing",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "primary",
+			Template: "worker",
+			Mode:     "on_demand",
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	if dsResult.NamedSessionDemand["primary"] {
+		t.Fatal("unmatched route should not record named-session demand")
+	}
+	if len(dsResult.State) != 0 {
+		t.Fatalf("unmatched route should not materialize sessions: %+v", dsResult.State)
+	}
 }
 
 func TestBuildDesiredState_OnDemandNamedSession_DirectAssigneeMaterializes(t *testing.T) {
@@ -673,6 +1833,169 @@ func TestBuildDesiredState_OnDemandNamedSession_DirectAssigneeMaterializes(t *te
 	}
 }
 
+func TestBuildDesiredState_OnDemandNamedSession_IgnoresUnreachableAssignedWork(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "riga")
+	if err := os.MkdirAll(rigPath, 0o755); err != nil {
+		t.Fatalf("create rig dir: %v", err)
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	if _, err := cityStore.Create(beads.Bead{
+		Title:    "assigned mayor work in city store",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "riga/mayor",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs:      []config.Rig{{Name: "riga", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name:              "mayor",
+			Dir:               "riga",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+			Dir:      "riga",
+			Mode:     "on_demand",
+		}},
+	}
+
+	dsResult := buildDesiredStateWithSessionBeads(
+		"test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		cityStore, map[string]beads.Store{"riga": rigStore}, nil, nil, io.Discard,
+	)
+	for _, tp := range dsResult.State {
+		if tp.TemplateName == "riga/mayor" || tp.ConfiguredNamedIdentity == "riga/mayor" {
+			t.Fatalf("unreachable city-store assignee should not materialize rig named session: %+v", tp)
+		}
+	}
+	if dsResult.NamedSessionDemand["riga/mayor"] {
+		t.Fatal("unreachable city-store assignee should not record named-session demand")
+	}
+}
+
+func TestBuildDesiredState_OnDemandNamedSession_ReachabilityUsesPerBeadSourceNotID(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "riga")
+	if err := os.MkdirAll(rigPath, 0o755); err != nil {
+		t.Fatalf("create rig dir: %v", err)
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	cityWork, err := cityStore.Create(beads.Bead{
+		Title:    "phantom city work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "riga/mayor",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rigWork, err := rigStore.Create(beads.Bead{
+		Title:    "same ID rig work for another session",
+		Type:     "task",
+		Status:   "open",
+		Assignee: "riga/other",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cityWork.ID != rigWork.ID {
+		t.Fatalf("test setup expected overlapping city/rig IDs, got city %q rig %q", cityWork.ID, rigWork.ID)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs:      []config.Rig{{Name: "riga", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name:              "mayor",
+			Dir:               "riga",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+			Dir:      "riga",
+			Mode:     "on_demand",
+		}},
+	}
+
+	dsResult := buildDesiredStateWithSessionBeads(
+		"test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		cityStore, map[string]beads.Store{"riga": rigStore}, nil, nil, io.Discard,
+	)
+	if dsResult.NamedSessionDemand["riga/mayor"] {
+		t.Fatal("same-ID rig bead should not make the city-store assignment reachable")
+	}
+}
+
+func TestBuildDesiredState_RigPoolIgnoresAssignedWorkInUnreachableStore(t *testing.T) {
+	cityPath := t.TempDir()
+	rigPath := filepath.Join(cityPath, "riga")
+	if err := os.MkdirAll(rigPath, 0o755); err != nil {
+		t.Fatalf("create rig dir: %v", err)
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	sessionBead, err := cityStore.Create(beads.Bead{
+		Title:  "asleep rig worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:riga/worker"},
+		Metadata: map[string]string{
+			"template":     "riga/worker",
+			"session_name": "worker-gc-1",
+			"state":        "asleep",
+			"pool_managed": "true",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	work, err := cityStore.Create(beads.Bead{
+		Title:    "unreachable city work for rig worker",
+		Type:     "task",
+		Assignee: sessionBead.ID,
+		Metadata: map[string]string{"gc.routed_to": "riga/worker"},
+	})
+	if err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+	if err := cityStore.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("set work in_progress: %v", err)
+	}
+	sessionSnapshot, err := loadSessionBeadSnapshot(cityStore)
+	if err != nil {
+		t.Fatalf("load session snapshot: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs:      []config.Rig{{Name: "riga", Path: rigPath}},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               "riga",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(5),
+			ScaleCheck:        "printf 0",
+		}},
+	}
+
+	dsResult := buildDesiredStateWithSessionBeads(
+		"test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		cityStore, map[string]beads.Store{"riga": rigStore}, sessionSnapshot, nil, io.Discard,
+	)
+	for _, tp := range dsResult.State {
+		if tp.TemplateName == "riga/worker" {
+			t.Fatalf("unreachable city-store work should not resume rig pool session: %+v", tp)
+		}
+	}
+}
+
 func TestBuildDesiredState_AlwaysNamedSession_MaterializesWithoutWorkBeads(t *testing.T) {
 	cityPath := t.TempDir()
 	store := beads.NewMemStore()
@@ -694,6 +2017,12 @@ func TestBuildDesiredState_AlwaysNamedSession_MaterializesWithoutWorkBeads(t *te
 	found := false
 	for _, tp := range dsResult.State {
 		if tp.TemplateName == "mayor" {
+			if tp.ConfiguredNamedIdentity != "mayor" {
+				t.Fatalf("ConfiguredNamedIdentity = %q, want mayor", tp.ConfiguredNamedIdentity)
+			}
+			if tp.ConfiguredNamedMode != "always" {
+				t.Fatalf("ConfiguredNamedMode = %q, want always", tp.ConfiguredNamedMode)
+			}
 			found = true
 			break
 		}
@@ -1086,7 +2415,7 @@ func TestBuildDesiredState_OnDemandNamedSession_ScaleCheckNonIntegerDoesNotFallT
 	}
 }
 
-func TestBuildDesiredState_OnDemandNamedSession_WorkQueryUsesExplicitRigPassword(t *testing.T) {
+func TestBuildDesiredState_OnDemandNamedSession_RigWorkQueryDoesNotMaterialize(t *testing.T) {
 	t.Setenv("GC_BEADS", "bd")
 	t.Setenv("GC_DOLT_USER", "")
 	t.Setenv("GC_DOLT_PASSWORD", "")
@@ -1150,8 +2479,8 @@ func TestBuildDesiredState_OnDemandNamedSession_WorkQueryUsesExplicitRigPassword
 			break
 		}
 	}
-	if !found {
-		t.Fatal("on-demand rig named session should materialize when work_query sees rig-scoped password")
+	if found {
+		t.Fatal("on-demand rig named session materialized from controller-side work_query")
 	}
 }
 
@@ -1431,7 +2760,7 @@ func TestBuildDesiredState_ManualImplicitPoolSessionsStayDesired(t *testing.T) {
 			Labels: []string{sessionBeadLabel, "template:helper"},
 			Metadata: map[string]string{
 				"template":             "helper",
-				"session_name":         "s-mc-4wq",
+				"session_name":         "s-real-world-app-4wq",
 				"state":                "creating",
 				"manual_session":       "true",
 				"pending_create_claim": "true",
@@ -1443,7 +2772,7 @@ func TestBuildDesiredState_ManualImplicitPoolSessionsStayDesired(t *testing.T) {
 			Labels: []string{sessionBeadLabel, "template:helper"},
 			Metadata: map[string]string{
 				"template":             "helper",
-				"session_name":         "s-mc-bmr",
+				"session_name":         "s-real-world-app-bmr",
 				"alias":                "hal",
 				"state":                "suspended",
 				"manual_session":       "true",
@@ -1481,7 +2810,7 @@ func TestBuildDesiredState_ManualImplicitPoolSessionsStayDesired(t *testing.T) {
 
 	dsResult := buildDesiredState("my-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
 	desired := dsResult.State
-	for _, sn := range []string{"s-mc-4wq", "s-mc-bmr"} {
+	for _, sn := range []string{"s-real-world-app-4wq", "s-real-world-app-bmr"} {
 		tp, ok := desired[sn]
 		if !ok {
 			t.Fatalf("expected manual helper session %q in desired state, got keys %v", sn, mapKeys(desired))
@@ -1493,38 +2822,278 @@ func TestBuildDesiredState_ManualImplicitPoolSessionsStayDesired(t *testing.T) {
 			t.Fatalf("desired[%q].ManualSession = false, want true", sn)
 		}
 	}
-	if got := desired["s-mc-bmr"].Alias; got != "hal" {
-		t.Fatalf("desired[s-mc-bmr].Alias = %q, want hal", got)
+	if got := desired["s-real-world-app-bmr"].Alias; got != "hal" {
+		t.Fatalf("desired[s-real-world-app-bmr].Alias = %q, want hal", got)
 	}
 }
 
-func TestBuildDesiredState_DrainedPoolManagedSessionIsNotRediscovered(t *testing.T) {
+func TestBuildDesiredState_ScaleCheckErrorRetainsOnlyAffectedPoolSessions(t *testing.T) {
 	cityPath := t.TempDir()
 	store := beads.NewMemStore()
-	if _, err := store.Create(beads.Bead{
-		Title:  "claude",
+	workerSession := beads.Bead{
+		ID:     "session-worker",
+		Title:  "worker",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:claude"},
+		Status: "open",
+		Labels: []string{sessionBeadLabel, "template:worker"},
 		Metadata: map[string]string{
-			"template":     "claude",
-			"agent_name":   "claude",
-			"session_name": "s-gc-drained",
-			"state":        "asleep",
-			"sleep_reason": "drained",
-			"pool_managed": "true",
+			"session_name":         "worker-bd-123",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "awake",
+		},
+	}
+	helperSession := beads.Bead{
+		ID:     "session-helper",
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"session_name":         "helper-bd-123",
+			"template":             "helper",
+			"agent_name":           "helper",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "awake",
 		},
-	}); err != nil {
-		t.Fatal(err)
 	}
 	cfg := &config.City{
-		Agents: []config.Agent{{
-			Name:              "claude",
-			MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(5),
-		}},
+		Agents: []config.Agent{
+			{
+				Name:              "worker",
+				StartCommand:      "echo",
+				ScaleCheck:        "exit 42",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(3),
+			},
+			{
+				Name:              "helper",
+				StartCommand:      "echo",
+				ScaleCheck:        "printf 0",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(3),
+			},
+		},
 	}
 
-	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
-	desired := dsResult.State
+	var stderr strings.Builder
+	result := buildDesiredStateWithSessionBeads(
+		"test-city",
+		cityPath,
+		time.Now().UTC(),
+		cfg,
+		runtime.NewFake(),
+		store,
+		nil,
+		newSessionBeadSnapshot([]beads.Bead{workerSession, helperSession}),
+		nil,
+		&stderr,
+	)
+
+	if result.StoreQueryPartial {
+		t.Fatalf("StoreQueryPartial = true, want false for scoped scale_check failure; stderr=%s", stderr.String())
+	}
+	if !result.ScaleCheckPartialTemplates["worker"] {
+		t.Fatalf("ScaleCheckPartialTemplates[worker] = false, want true; templates=%v stderr=%s", result.ScaleCheckPartialTemplates, stderr.String())
+	}
+	if !result.PoolScaleCheckPartialTemplates["worker"] {
+		t.Fatalf("PoolScaleCheckPartialTemplates[worker] = false, want true; templates=%v", result.PoolScaleCheckPartialTemplates)
+	}
+	if result.ScaleCheckPartialTemplates["helper"] {
+		t.Fatalf("ScaleCheckPartialTemplates[helper] = true, want false; templates=%v", result.ScaleCheckPartialTemplates)
+	}
+	if _, ok := result.State["worker-bd-123"]; !ok {
+		t.Fatalf("affected worker session not retained in desired state: keys=%v stderr=%s", mapKeys(result.State), stderr.String())
+	}
+	if _, ok := result.State["helper-bd-123"]; ok {
+		t.Fatalf("unaffected helper session retained despite clean zero demand: keys=%v", mapKeys(result.State))
+	}
+	if got := result.ScaleCheckCounts["worker"]; got != 0 {
+		t.Fatalf("ScaleCheckCounts[worker] = %d, want 0 on failed new-demand probe", got)
+	}
+}
+
+func TestBuildDesiredState_ScaleCheckErrorPreservesDormantAffectedPoolSessionWithoutWakeDemand(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	workerSession := beads.Bead{
+		ID:     "session-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel, "template:worker"},
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-123",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "asleep",
+		},
+	}
+	helperSession := beads.Bead{
+		ID:     "session-helper",
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"session_name":         "helper-bd-123",
+			"template":             "helper",
+			"agent_name":           "helper",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "asleep",
+		},
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{
+				Name:              "worker",
+				StartCommand:      "echo",
+				ScaleCheck:        "exit 42",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(3),
+			},
+			{
+				Name:              "helper",
+				StartCommand:      "echo",
+				ScaleCheck:        "printf 0",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(3),
+			},
+		},
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{workerSession, helperSession})
+
+	var stderr strings.Builder
+	result := buildDesiredStateWithSessionBeads(
+		"test-city",
+		cityPath,
+		time.Now().UTC(),
+		cfg,
+		runtime.NewFake(),
+		store,
+		nil,
+		snapshot,
+		nil,
+		&stderr,
+	)
+
+	if result.StoreQueryPartial {
+		t.Fatalf("StoreQueryPartial = true, want false for scoped scale_check failure; stderr=%s", stderr.String())
+	}
+	if _, ok := result.State["worker-bd-123"]; !ok {
+		t.Fatalf("dormant affected worker session not preserved in desired state: keys=%v stderr=%s", mapKeys(result.State), stderr.String())
+	}
+	if _, ok := result.State["helper-bd-123"]; ok {
+		t.Fatalf("unaffected dormant helper session retained despite clean zero demand: keys=%v", mapKeys(result.State))
+	}
+
+	poolDesired := retainScaleCheckPartialPoolDesired(
+		PoolDesiredCounts(ComputePoolDesiredStates(cfg, nil, snapshot.Open(), result.ScaleCheckCounts)),
+		snapshot,
+		result.PoolScaleCheckPartialTemplates,
+	)
+	if got := poolDesired["worker"]; got != 0 {
+		t.Fatalf("poolDesired[worker] = %d, want dormant preservation without wake demand", got)
+	}
+}
+
+func TestBuildDesiredState_NamedScaleCheckPartialDoesNotRetainGenericPoolSession(t *testing.T) {
+	cityPath := t.TempDir()
+	store := &controllerDemandPartialStore{MemStore: beads.NewMemStore()}
+	poolSession := beads.Bead{
+		ID:     "session-worker-pool",
+		Title:  "worker pool",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel, "template:worker"},
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-123",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "awake",
+		},
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "echo",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(3),
+		}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "primary",
+			Template: "worker",
+			Mode:     "on_demand",
+		}},
+	}
+
+	var stderr strings.Builder
+	result := buildDesiredStateWithSessionBeads(
+		"test-city",
+		cityPath,
+		time.Now().UTC(),
+		cfg,
+		runtime.NewFake(),
+		store,
+		nil,
+		newSessionBeadSnapshot([]beads.Bead{poolSession}),
+		nil,
+		&stderr,
+	)
+
+	if result.StoreQueryPartial {
+		t.Fatalf("StoreQueryPartial = true, want false for scoped named scale_check failure; stderr=%s", stderr.String())
+	}
+	if !result.ScaleCheckPartialTemplates["worker"] {
+		t.Fatalf("ScaleCheckPartialTemplates[worker] = false, want named-session partial recorded; templates=%v stderr=%s", result.ScaleCheckPartialTemplates, stderr.String())
+	}
+	if result.PoolScaleCheckPartialTemplates["worker"] {
+		t.Fatalf("PoolScaleCheckPartialTemplates[worker] = true, want false for named-session partial; templates=%v", result.PoolScaleCheckPartialTemplates)
+	}
+	if !result.NamedScaleCheckPartialTemplates["worker"] {
+		t.Fatalf("NamedScaleCheckPartialTemplates[worker] = false, want true; templates=%v", result.NamedScaleCheckPartialTemplates)
+	}
+	if _, ok := result.State["worker-bd-123"]; ok {
+		t.Fatalf("generic pool session retained by named-session partial: keys=%v stderr=%s", mapKeys(result.State), stderr.String())
+	}
+}
+
+func TestBuildDesiredState_DrainedPoolManagedSessionIsNotRediscovered(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "claude",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:claude"},
+		Metadata: map[string]string{
+			"template":     "claude",
+			"agent_name":   "claude",
+			"session_name": "s-gc-drained",
+			"state":        "asleep",
+			"sleep_reason": "drained",
+			"pool_managed": "true",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "claude",
+			MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(5),
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	desired := dsResult.State
 
 	if _, ok := desired["s-gc-drained"]; ok {
 		t.Fatalf("drained pool-managed session should not be rediscovered into desired state")
@@ -1825,159 +3394,673 @@ func TestBuildDesiredState_StoreBackedPoolUsesLogicalInstanceIdentity(t *testing
 	}
 }
 
-func TestBuildDesiredState_StoreBackedPoolUsesQualifiedInstanceNameForBindings(t *testing.T) {
+func TestBuildDesiredState_StoreBackedPoolUsesQualifiedInstanceNameForBindings(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "ops worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:ops.worker"},
+		Metadata: map[string]string{
+			"template":     "ops.worker",
+			"session_name": "ops-worker-1",
+			"agent_name":   "ops.worker",
+			"state":        "active",
+			"pool_managed": "true",
+		},
+	}); err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			BindingName:       "ops",
+			WorkDir:           ".gc/worktrees/{{.AgentBase}}",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(2),
+			ScaleCheck:        "printf 1",
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	var got TemplateParams
+	found := false
+	for _, tp := range dsResult.State {
+		if tp.TemplateName == "ops.worker" {
+			got = tp
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("desired state missing binding-qualified pool session: keys=%v", mapKeys(dsResult.State))
+	}
+
+	wantInstance := cfg.Agents[0].QualifiedInstanceName("worker-1")
+	if got.InstanceName != wantInstance {
+		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, wantInstance)
+	}
+	if got.Alias != wantInstance {
+		t.Fatalf("Alias = %q, want %q", got.Alias, wantInstance)
+	}
+	if got.Env["GC_AGENT"] != wantInstance {
+		t.Fatalf("GC_AGENT = %q, want %q", got.Env["GC_AGENT"], wantInstance)
+	}
+	wantWorkDir := filepath.Join(cityPath, ".gc", "worktrees", "ops.worker-1")
+	if got.WorkDir != wantWorkDir {
+		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, wantWorkDir)
+	}
+}
+
+func TestBuildDesiredState_RecoversPoolTemplateFromAliasOnlyBindingIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "ops furiosa",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "ops-furiosa-session",
+			"alias":        "frontend/ops.furiosa",
+			"pool_slot":    "1",
+			"pool_managed": "true",
+			"state":        "active",
+		},
+	}); err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:          "worker",
+			Dir:           "frontend",
+			BindingName:   "ops",
+			NamepoolNames: []string{"furiosa", "nux"},
+			WorkDir:       ".gc/worktrees/{{.AgentBase}}",
+			ScaleCheck:    "printf 1",
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	got, ok := dsResult.State["ops-furiosa-session"]
+	if !ok {
+		t.Fatalf("desired state missing alias-only pool session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.TemplateName != "frontend/ops.worker" {
+		t.Fatalf("TemplateName = %q, want %q", got.TemplateName, "frontend/ops.worker")
+	}
+	wantInstance := cfg.Agents[0].QualifiedInstanceName("furiosa")
+	if got.InstanceName != wantInstance {
+		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, wantInstance)
+	}
+	if got.Alias != wantInstance {
+		t.Fatalf("Alias = %q, want %q", got.Alias, wantInstance)
+	}
+	if got.Env["GC_AGENT"] != wantInstance {
+		t.Fatalf("GC_AGENT = %q, want %q", got.Env["GC_AGENT"], wantInstance)
+	}
+	wantWorkDir := filepath.Join(cityPath, ".gc", "worktrees", "ops.furiosa")
+	if got.WorkDir != wantWorkDir {
+		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, wantWorkDir)
+	}
+}
+
+func TestBuildDesiredState_PendingCreatePoolSessionUsesConcreteBeadIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	workDir := filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant-adhoc-abc123")
+	if _, err := store.Create(beads.Bead{
+		Title:  "adhoc ant",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:demo/ant"},
+		Metadata: map[string]string{
+			"template":              "demo/ant",
+			"session_name":          "ant-adhoc-abc123",
+			"session_name_explicit": boolMetadata(true),
+			"agent_name":            "demo/ant-adhoc-abc123",
+			"session_origin":        "manual",
+			"pending_create_claim":  boolMetadata(true),
+			"state":                 "creating",
+			"work_dir":              workDir,
+		},
+	}); err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}},
+		Agents: []config.Agent{{
+			Name:              "ant",
+			Dir:               "demo",
+			Provider:          "test-agent",
+			StartCommand:      "true",
+			WorkDir:           ".gc/worktrees/{{.Rig}}/ants/{{.AgentBase}}",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(4),
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	got, ok := dsResult.State["ant-adhoc-abc123"]
+	if !ok {
+		t.Fatalf("desired state missing pending create session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.TemplateName != "demo/ant" {
+		t.Fatalf("TemplateName = %q, want %q", got.TemplateName, "demo/ant")
+	}
+	if got.InstanceName != "demo/ant-adhoc-abc123" {
+		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, "demo/ant-adhoc-abc123")
+	}
+	if got.WorkDir != workDir {
+		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, workDir)
+	}
+	if got.Env["GC_ALIAS"] != "demo/ant-adhoc-abc123" {
+		t.Fatalf("GC_ALIAS = %q, want %q", got.Env["GC_ALIAS"], "demo/ant-adhoc-abc123")
+	}
+}
+
+func TestBuildDesiredState_PendingCreatePoolSessionStaysDesiredWithoutScaleDemand(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	sessionName := "workflows__codex-max-mc-new"
+	if _, err := store.Create(beads.Bead{
+		Title:  "codex-max",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:gascity/workflows.codex-max-1"},
+		Metadata: map[string]string{
+			"template":             "gascity/workflows.codex-max",
+			"session_name":         sessionName,
+			"agent_name":           "gascity/workflows.codex-max-1",
+			"session_origin":       "ephemeral",
+			"pool_managed":         boolMetadata(true),
+			"pool_slot":            "1",
+			"pending_create_claim": boolMetadata(true),
+			"state":                "stopped",
+		},
+	}); err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "gascity", Path: filepath.Join(cityPath, "repos", "gascity")}},
+		Agents: []config.Agent{{
+			Name:              "workflows.codex-max",
+			Dir:               "gascity",
+			Provider:          "test-agent",
+			StartCommand:      "true",
+			WorkDir:           ".",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(5),
+			ScaleCheck:        "printf 0",
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	if got := dsResult.ScaleCheckCounts["gascity/workflows.codex-max"]; got != 0 {
+		t.Fatalf("ScaleCheckCounts[gascity/workflows.codex-max] = %d, want 0", got)
+	}
+	got, ok := dsResult.State[sessionName]
+	if !ok {
+		t.Fatalf("desired state missing pending-create pool session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.TemplateName != "gascity/workflows.codex-max" {
+		t.Fatalf("TemplateName = %q, want gascity/workflows.codex-max", got.TemplateName)
+	}
+	if got.InstanceName != sessionName {
+		t.Fatalf("InstanceName = %q, want existing session name %q", got.InstanceName, sessionName)
+	}
+}
+
+func TestBuildDesiredState_PendingCreatePoolSessionCountsTowardScaleDemand(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	const template = "worker"
+	sessionName := "worker-mc-starting"
+	for i := 0; i < 2; i++ {
+		if _, err := store.Create(beads.Bead{
+			Title:  fmt.Sprintf("queued work %d", i+1),
+			Type:   "task",
+			Status: "open",
+			Metadata: map[string]string{
+				"gc.routed_to": template,
+			},
+		}); err != nil {
+			t.Fatalf("create queued work: %v", err)
+		}
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:  template,
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:worker-1"},
+		Metadata: map[string]string{
+			"template":                  template,
+			"session_name":              sessionName,
+			"agent_name":                "worker-1",
+			"session_origin":            "ephemeral",
+			"pool_managed":              boolMetadata(true),
+			"pool_slot":                 "1",
+			"pending_create_claim":      boolMetadata(true),
+			"pending_create_started_at": time.Now().UTC().Format(time.RFC3339),
+			"state":                     "creating",
+		},
+	}); err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              template,
+			StartCommand:      "true",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(5),
+		}},
+	}
+	sessionSnapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		t.Fatalf("load session snapshot: %v", err)
+	}
+
+	trace := newPoolDesiredStateTestTrace(template)
+	var stderr strings.Builder
+	dsResult := buildDesiredStateWithSessionBeads(
+		"test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(),
+		store, nil, sessionSnapshot, trace, &stderr,
+	)
+	if got := dsResult.ScaleCheckCounts[template]; got != 2 {
+		t.Fatalf("ScaleCheckCounts[%s] = %d, want 2", template, got)
+	}
+	// The trace pins the buildDesiredState integration point: the pending
+	// create consumes one scale-demand slot before anonymous new requests are
+	// materialized.
+	if got := trace.decisionCounts[string(TraceSitePoolInFlightReuse)]; got != 1 {
+		t.Fatalf("in-flight reuse trace decisions = %d, want 1; stderr:\n%s", got, stderr.String())
+	}
+	rec := poolTraceDecision(t, trace, TraceSitePoolInFlightReuse)
+	for key, want := range map[string]int{
+		"scale_check":   2,
+		"in_flight":     1,
+		"reused":        1,
+		"anonymous_new": 1,
+	} {
+		if got := poolTraceFieldInt(t, rec.Fields, key); got != want {
+			t.Fatalf("%s = %d, want %d", key, got, want)
+		}
+	}
+
+	var templateCount int
+	existing, ok := dsResult.State[sessionName]
+	if !ok {
+		t.Fatalf("desired state missing pending-create pool session: keys=%v", mapKeys(dsResult.State))
+	}
+	for _, tp := range dsResult.State {
+		if tp.TemplateName == template {
+			templateCount++
+		}
+	}
+	if templateCount != 2 {
+		t.Fatalf("desired %s sessions = %d, want 2; keys=%v", template, templateCount, mapKeys(dsResult.State))
+	}
+	var anonymousNew *TemplateParams
+	for name, tp := range dsResult.State {
+		if tp.TemplateName == template && name != sessionName {
+			tpCopy := tp
+			anonymousNew = &tpCopy
+			break
+		}
+	}
+	if anonymousNew == nil {
+		t.Fatalf("desired state missing anonymous new pool session: keys=%v", mapKeys(dsResult.State))
+	}
+	if existing.InstanceName != "worker-1" {
+		t.Fatalf("existing InstanceName = %q, want worker-1", existing.InstanceName)
+	}
+	if existing.PoolSlot != 1 {
+		t.Fatalf("existing PoolSlot = %d, want 1", existing.PoolSlot)
+	}
+	if anonymousNew.PoolSlot != 2 {
+		t.Fatalf("anonymous new PoolSlot = %d, want 2", anonymousNew.PoolSlot)
+	}
+}
+
+func TestBuildDesiredState_LegacyAliaslessEphemeralPoolSessionFallsBackToSessionNameIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "legacy ant",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:demo/ant"},
+		Metadata: map[string]string{
+			"template":       "demo/ant",
+			"agent_name":     "demo/ant",
+			"session_name":   "s-gc-legacy",
+			"session_origin": "ephemeral",
+			"state":          "creating",
+			"work_dir":       filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant"),
+		},
+	}); err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}},
+		Agents: []config.Agent{{
+			Name:              "ant",
+			Dir:               "demo",
+			Provider:          "test-agent",
+			StartCommand:      "true",
+			WorkDir:           ".gc/worktrees/{{.Rig}}/ants/{{.AgentBase}}",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(4),
+		}},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	got, ok := dsResult.State["s-gc-legacy"]
+	if !ok {
+		t.Fatalf("desired state missing legacy session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.InstanceName != "demo/s-gc-legacy" {
+		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, "demo/s-gc-legacy")
+	}
+	wantWorkDir := filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "s-gc-legacy")
+	if got.WorkDir != wantWorkDir {
+		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, wantWorkDir)
+	}
+}
+
+func TestBuildDesiredState_RediscoveriesUniqueLegacyLocalPoolTemplate(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "worker-5",
+			"state":        "creating",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(1)},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	got, ok := dsResult.State["worker-5"]
+	if !ok {
+		t.Fatalf("desired state missing legacy local session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.TemplateName != "frontend/worker" {
+		t.Fatalf("TemplateName = %q, want %q", got.TemplateName, "frontend/worker")
+	}
+}
+
+func TestBuildDesiredState_DoesNotRediscoverAmbiguousLegacyLocalPoolTemplate(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "worker-5",
+			"state":        "creating",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	if _, ok := dsResult.State["worker-5"]; ok {
+		t.Fatalf("desired state %#v unexpectedly rediscovered ambiguous local pool template", dsResult.State["worker-5"])
+	}
+}
+
+func TestBuildDesiredState_RecoversPoolTemplateFromAgentNameOnlyLegacyLocalIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"agent_name":   "worker-5",
+			"session_name": "worker-5",
+			"state":        "creating",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(1)},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	got, ok := dsResult.State["worker-5"]
+	if !ok {
+		t.Fatalf("desired state missing agent_name-only legacy session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.TemplateName != "frontend/worker" {
+		t.Fatalf("TemplateName = %q, want %q", got.TemplateName, "frontend/worker")
+	}
+}
+
+func TestBuildDesiredState_DoesNotRecoverPoolTemplateFromAmbiguousLegacyLocalAlias(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"alias":        "worker-5",
+			"session_name": "worker-5",
+			"state":        "creating",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	if _, ok := dsResult.State["worker-5"]; ok {
+		t.Fatalf("desired state %#v unexpectedly recovered ambiguous local alias identity", dsResult.State["worker-5"])
+	}
+}
+
+func TestBuildDesiredState_RediscoveriesLegacyCommonNamePoolTemplate(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"common_name":  "worker",
+			"session_name": "worker-5",
+			"state":        "creating",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(1)},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	got, ok := dsResult.State["worker-5"]
+	if !ok {
+		t.Fatalf("desired state missing legacy common_name session: keys=%v", mapKeys(dsResult.State))
+	}
+	if got.TemplateName != "frontend/worker" {
+		t.Fatalf("TemplateName = %q, want %q", got.TemplateName, "frontend/worker")
+	}
+}
+
+func TestBuildDesiredState_DoesNotRediscoverFreshCreatingOutOfBoundsQualifiedPoolIdentity(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"agent_name":   "frontend/worker-7",
+			"session_name": "custom-worker-7",
+			"state":        "creating",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+		},
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+	if _, ok := dsResult.State["custom-worker-7"]; ok {
+		t.Fatalf("desired state %#v unexpectedly kept fresh out-of-bounds qualified pool identity", dsResult.State["custom-worker-7"])
+	}
+}
+
+func TestBuildDesiredState_DoesNotRediscoverZeroCapacityQualifiedPoolIdentity(t *testing.T) {
 	cityPath := t.TempDir()
 	store := beads.NewMemStore()
 	if _, err := store.Create(beads.Bead{
-		Title:  "ops worker",
+		Title:  "worker session",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:ops.worker"},
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":     "ops.worker",
-			"session_name": "ops-worker-1",
-			"agent_name":   "ops.worker",
-			"state":        "active",
-			"pool_managed": "true",
+			"agent_name":   "frontend/worker-1",
+			"session_name": "custom-worker-1",
+			"state":        "creating",
 		},
 	}); err != nil {
-		t.Fatalf("create session bead: %v", err)
+		t.Fatal(err)
 	}
 	cfg := &config.City{
-		Agents: []config.Agent{{
-			Name:              "worker",
-			BindingName:       "ops",
-			WorkDir:           ".gc/worktrees/{{.AgentBase}}",
-			MinActiveSessions: intPtr(0),
-			MaxActiveSessions: intPtr(2),
-			ScaleCheck:        "printf 1",
-		}},
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(0)},
+		},
 	}
 
 	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
-	var got TemplateParams
-	found := false
-	for _, tp := range dsResult.State {
-		if tp.TemplateName == "ops.worker" {
-			got = tp
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("desired state missing binding-qualified pool session: keys=%v", mapKeys(dsResult.State))
-	}
-
-	wantInstance := cfg.Agents[0].QualifiedInstanceName("worker-1")
-	if got.InstanceName != wantInstance {
-		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, wantInstance)
-	}
-	if got.Alias != wantInstance {
-		t.Fatalf("Alias = %q, want %q", got.Alias, wantInstance)
-	}
-	if got.Env["GC_AGENT"] != wantInstance {
-		t.Fatalf("GC_AGENT = %q, want %q", got.Env["GC_AGENT"], wantInstance)
-	}
-	wantWorkDir := filepath.Join(cityPath, ".gc", "worktrees", "ops.worker-1")
-	if got.WorkDir != wantWorkDir {
-		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, wantWorkDir)
+	if _, ok := dsResult.State["custom-worker-1"]; ok {
+		t.Fatalf("desired state %#v unexpectedly kept zero-capacity qualified pool identity", dsResult.State["custom-worker-1"])
 	}
 }
 
-func TestBuildDesiredState_PendingCreatePoolSessionUsesConcreteBeadIdentity(t *testing.T) {
+func TestBuildDesiredState_DoesNotRediscoverStaleCreatingLegacyPoolTemplate(t *testing.T) {
 	cityPath := t.TempDir()
 	store := beads.NewMemStore()
-	workDir := filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant-adhoc-abc123")
 	if _, err := store.Create(beads.Bead{
-		Title:  "adhoc ant",
+		Title:  "worker session",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:demo/ant"},
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":              "demo/ant",
-			"session_name":          "ant-adhoc-abc123",
-			"session_name_explicit": boolMetadata(true),
-			"agent_name":            "demo/ant-adhoc-abc123",
-			"session_origin":        "manual",
-			"pending_create_claim":  boolMetadata(true),
-			"state":                 "creating",
-			"work_dir":              workDir,
+			"common_name":               "worker",
+			"session_name":              "worker-7",
+			"state":                     "creating",
+			"pending_create_started_at": time.Now().Add(-staleCreatingStateTimeout - time.Minute).UTC().Format(time.RFC3339),
 		},
 	}); err != nil {
-		t.Fatalf("create session bead: %v", err)
+		t.Fatal(err)
 	}
 	cfg := &config.City{
-		Rigs: []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}},
-		Agents: []config.Agent{{
-			Name:              "ant",
-			Dir:               "demo",
-			Provider:          "test-agent",
-			StartCommand:      "true",
-			WorkDir:           ".gc/worktrees/{{.Rig}}/ants/{{.AgentBase}}",
-			MinActiveSessions: intPtr(0),
-			MaxActiveSessions: intPtr(4),
-		}},
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(1)},
+		},
 	}
 
 	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
-	got, ok := dsResult.State["ant-adhoc-abc123"]
-	if !ok {
-		t.Fatalf("desired state missing pending create session: keys=%v", mapKeys(dsResult.State))
-	}
-	if got.TemplateName != "demo/ant" {
-		t.Fatalf("TemplateName = %q, want %q", got.TemplateName, "demo/ant")
+	if _, ok := dsResult.State["worker-7"]; ok {
+		t.Fatalf("desired state %#v unexpectedly kept stale creating legacy pool bead", dsResult.State["worker-7"])
 	}
-	if got.InstanceName != "demo/ant-adhoc-abc123" {
-		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, "demo/ant-adhoc-abc123")
+}
+
+func TestBuildDesiredState_DoesNotPreserveOutOfBoundsBoundedPoolSlotWithoutIdentity(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+		},
 	}
-	if got.WorkDir != workDir {
-		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, workDir)
+	cfgAgent := &cfg.Agents[0]
+	bead := beads.Bead{
+		Metadata: map[string]string{
+			"template":  "frontend/worker",
+			"pool_slot": "99",
+		},
 	}
-	if got.Env["GC_ALIAS"] != "demo/ant-adhoc-abc123" {
-		t.Fatalf("GC_ALIAS = %q, want %q", got.Env["GC_ALIAS"], "demo/ant-adhoc-abc123")
+
+	if slot := existingPoolSlotWithConfig(cfg, cfgAgent, bead); slot != 0 {
+		t.Fatalf("existingPoolSlotWithConfig(out-of-bounds bounded slot) = %d, want 0", slot)
 	}
 }
 
-func TestBuildDesiredState_LegacyAliaslessEphemeralPoolSessionFallsBackToSessionNameIdentity(t *testing.T) {
+func TestBuildDesiredState_DoesNotRecoverOutOfBoundsAliasOnlyBoundedPoolSlot(t *testing.T) {
 	cityPath := t.TempDir()
 	store := beads.NewMemStore()
 	if _, err := store.Create(beads.Bead{
-		Title:  "legacy ant",
+		Title:  "worker session",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:demo/ant"},
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":       "demo/ant",
-			"agent_name":     "demo/ant",
-			"session_name":   "s-gc-legacy",
-			"session_origin": "ephemeral",
-			"state":          "creating",
-			"work_dir":       filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant"),
+			"template":     "frontend/worker",
+			"alias":        "frontend/worker-7",
+			"session_name": "custom-worker-7",
+			"state":        "active",
 		},
 	}); err != nil {
-		t.Fatalf("create session bead: %v", err)
+		t.Fatal(err)
 	}
 	cfg := &config.City{
-		Rigs: []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}},
-		Agents: []config.Agent{{
-			Name:              "ant",
-			Dir:               "demo",
-			Provider:          "test-agent",
-			StartCommand:      "true",
-			WorkDir:           ".gc/worktrees/{{.Rig}}/ants/{{.AgentBase}}",
-			MinActiveSessions: intPtr(0),
-			MaxActiveSessions: intPtr(4),
-		}},
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", Provider: "test-agent", StartCommand: "true", WorkDir: ".", MaxActiveSessions: intPtr(5)},
+		},
 	}
 
 	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
-	got, ok := dsResult.State["s-gc-legacy"]
-	if !ok {
-		t.Fatalf("desired state missing legacy session: keys=%v", mapKeys(dsResult.State))
+	if _, ok := dsResult.State["custom-worker-7"]; ok {
+		t.Fatalf("desired state %#v unexpectedly preserved out-of-bounds alias-only pool identity", dsResult.State["custom-worker-7"])
 	}
-	if got.InstanceName != "demo/s-gc-legacy" {
-		t.Fatalf("InstanceName = %q, want %q", got.InstanceName, "demo/s-gc-legacy")
+}
+
+func TestClaimPoolSlot_PreservesStampedOutOfBoundsLiveIdentity(t *testing.T) {
+	cfgAgent := &config.Agent{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)}
+	bead := beads.Bead{
+		Metadata: map[string]string{
+			"pool_slot":  "7",
+			"agent_name": "frontend/worker-7",
+			"alias":      "frontend/worker-7",
+		},
 	}
-	wantWorkDir := filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "s-gc-legacy")
-	if got.WorkDir != wantWorkDir {
-		t.Fatalf("WorkDir = %q, want %q", got.WorkDir, wantWorkDir)
+
+	if slot := existingPoolSlot(cfgAgent, bead); slot != 7 {
+		t.Fatalf("existingPoolSlot(stamped live slot) = %d, want 7", slot)
+	}
+	used := map[int]bool{}
+	if slot := claimPoolSlot(cfgAgent, bead, used); slot != 7 {
+		t.Fatalf("claimPoolSlot(stamped live slot) = %d, want 7", slot)
 	}
 }
 
@@ -2346,6 +4429,40 @@ func TestSelectOrCreatePoolSessionBead_SkipsDrained(t *testing.T) {
 	}
 }
 
+func TestSelectOrCreatePoolSessionBead_UsesFreshCreateTimeNotBeaconTime(t *testing.T) {
+	store := beads.NewMemStore()
+	snapshot := &sessionBeadSnapshot{}
+	cfgAgent := config.Agent{Name: "claude", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}
+	anchor := time.Now().UTC()
+	oldBeacon := anchor.Add(-2 * staleCreatingStateTimeout)
+	beforeCreate := anchor.Add(-time.Second)
+	bp := &agentBuildParams{
+		beadStore:    store,
+		sessionBeads: snapshot,
+		agents:       []config.Agent{cfgAgent},
+		beaconTime:   oldBeacon,
+	}
+
+	result, err := selectOrCreatePoolSessionBead(bp, "claude", nil, map[string]bool{})
+	if err != nil {
+		t.Fatalf("selectOrCreatePoolSessionBead: %v", err)
+	}
+	startedAt, err := time.Parse(time.RFC3339, result.Metadata["pending_create_started_at"])
+	if err != nil {
+		t.Fatalf("parse pending_create_started_at %q: %v", result.Metadata["pending_create_started_at"], err)
+	}
+	if startedAt.Before(beforeCreate) {
+		t.Fatalf("pending_create_started_at = %s, want current create time after %s", startedAt, beforeCreate)
+	}
+	if !startedAt.After(oldBeacon.Add(staleCreatingStateTimeout)) {
+		t.Fatalf("pending_create_started_at = %s, want independent from stale beacon %s", startedAt, oldBeacon)
+	}
+	result.CreatedAt = oldBeacon
+	if staleCreatingState(result, &clock.Fake{Time: startedAt.Add(30 * time.Second)}) {
+		t.Fatal("fresh pool session was stale when row CreatedAt matched old controller beacon")
+	}
+}
+
 func TestSelectOrCreatePoolSessionBead_ReusesPreferredDrained(t *testing.T) {
 	store := beads.NewMemStore()
 	drained, err := store.Create(beads.Bead{
@@ -2455,6 +4572,46 @@ func TestSelectOrCreatePoolSessionBead_ReusesAvailableForNewTier(t *testing.T) {
 	}
 }
 
+func TestSelectOrCreatePoolSessionBead_SkipsAssignedForNewTier(t *testing.T) {
+	store := beads.NewMemStore()
+	assigned, err := store.Create(beads.Bead{
+		Title:  "claude",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "claude",
+			"agent_name":   "claude",
+			"session_name": "claude-assigned",
+			"state":        "active",
+			"pool_managed": "true",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	snapshot := &sessionBeadSnapshot{}
+	snapshot.add(assigned)
+	cfgAgent := config.Agent{Name: "claude", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}
+	bp := &agentBuildParams{
+		beadStore:    store,
+		sessionBeads: snapshot,
+		agents:       []config.Agent{cfgAgent},
+		assignedWorkBeads: []beads.Bead{{
+			ID:       "w-assigned",
+			Status:   "in_progress",
+			Assignee: assigned.ID,
+		}},
+	}
+
+	result, err := selectOrCreatePoolSessionBead(bp, "claude", nil, map[string]bool{})
+	if err != nil {
+		t.Fatalf("selectOrCreatePoolSessionBead: %v", err)
+	}
+	if result.ID == assigned.ID {
+		t.Fatal("new-tier should not reuse a session bead that has assigned work")
+	}
+}
+
 func TestSelectOrCreatePoolSessionBead_SkipsAsleepBeads(t *testing.T) {
 	// An asleep pool session should NOT be reused for new demand.
 	// The reconciler should create a fresh session instead.
@@ -2470,7 +4627,7 @@ func TestSelectOrCreatePoolSessionBead_SkipsAsleepBeads(t *testing.T) {
 		Labels: []string{sessionBeadLabel, "template:polecat"},
 		Metadata: map[string]string{
 			"template":     "polecat",
-			"session_name": "polecat-mc-old",
+			"session_name": "polecat-real-world-app-old",
 			"state":        "asleep",
 			"pool_managed": "true",
 		},
@@ -2506,7 +4663,7 @@ func TestSelectOrCreatePoolSessionBead_ReusesActiveBeforeCreatingNew(t *testing.
 		Labels: []string{sessionBeadLabel, "template:polecat"},
 		Metadata: map[string]string{
 			"template":     "polecat",
-			"session_name": "polecat-mc-live",
+			"session_name": "polecat-real-world-app-live",
 			"state":        "active",
 			"pool_managed": "true",
 		},
@@ -2542,7 +4699,7 @@ func TestSelectOrCreatePoolSessionBead_ReusesCreatingBeforeCreatingNew(t *testin
 		Labels: []string{sessionBeadLabel, "template:polecat"},
 		Metadata: map[string]string{
 			"template":     "polecat",
-			"session_name": "polecat-mc-new",
+			"session_name": "polecat-real-world-app-new",
 			"state":        "creating",
 			"pool_managed": "true",
 		},
@@ -2579,7 +4736,7 @@ func TestSelectOrCreatePoolSessionBead_SkipsAsleepButReusesActive(t *testing.T)
 		Labels: []string{sessionBeadLabel, "template:polecat"},
 		Metadata: map[string]string{
 			"template":     "polecat",
-			"session_name": "polecat-mc-old",
+			"session_name": "polecat-real-world-app-old",
 			"state":        "asleep",
 			"pool_managed": "true",
 		},
@@ -2593,7 +4750,7 @@ func TestSelectOrCreatePoolSessionBead_SkipsAsleepButReusesActive(t *testing.T)
 		Labels: []string{sessionBeadLabel, "template:polecat"},
 		Metadata: map[string]string{
 			"template":     "polecat",
-			"session_name": "polecat-mc-live",
+			"session_name": "polecat-real-world-app-live",
 			"state":        "active",
 			"pool_managed": "true",
 		},
@@ -2860,6 +5017,82 @@ func TestEnsureDependencyOnlyTemplate_StoreBackedUsesInstanceIdentity(t *testing
 	}
 }
 
+func TestBuildDesiredState_DependencyFloorIgnoresConfigBlindLegacySlotRecovery(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{
+				Name:              "db",
+				Dir:               "gascity",
+				StartCommand:      "true",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(3),
+				ScaleCheck:        "printf 0",
+			},
+			{
+				Name:              "api",
+				Dir:               "gascity",
+				StartCommand:      "true",
+				MinActiveSessions: intPtr(0),
+				MaxActiveSessions: intPtr(3),
+				ScaleCheck:        "printf 0",
+				DependsOn:         []string{"gascity/db"},
+			},
+		},
+	}
+
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "api",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:gascity/api"},
+		Metadata: map[string]string{
+			"template":     "gascity/api",
+			"agent_name":   "gascity/api",
+			"session_name": "s-api-root",
+			"state":        "active",
+			"pool_managed": "true",
+			"pool_slot":    "1",
+		},
+	}); err != nil {
+		t.Fatalf("seed api root bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:  "db",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"agent_name":      "db-2",
+			"session_name":    "s-db-dep-legacy",
+			"state":           "active",
+			"dependency_only": "true",
+			"pool_managed":    "true",
+		},
+	}); err != nil {
+		t.Fatalf("seed dependency-only db bead: %v", err)
+	}
+
+	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
+
+	var tp TemplateParams
+	var found bool
+	for _, entry := range dsResult.State {
+		if entry.TemplateName == "gascity/db" && entry.DependencyOnly {
+			tp = entry
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("store-backed dependency floor for db not found: %+v", dsResult.State)
+	}
+
+	if got, want := tp.Env["GC_ALIAS"], "gascity/db-1"; got != want {
+		t.Fatalf("store-backed dep-floor GC_ALIAS = %q, want %q when legacy bead lacks matching template metadata", got, want)
+	}
+}
+
 // TestBuildDesiredState_PoolBeadIdentityAgreesAcrossRealizeAndCanonicalHelper
 // is the round-trip regression for PR #833's canonicalization. It locks in the
 // actual invariant the fix promises: a pool-managed session bead produces the
@@ -3030,11 +5263,7 @@ func TestBuildDesiredState_RigScopedScaleCheckExpandsRigTemplate(t *testing.T) {
 	}
 }
 
-// TestBuildDesiredState_NamedSessionWorkQueryExpandsRigTemplate verifies that
-// {{.Rig}} in a named-session agent's work_query is substituted before the
-// controller's work-readiness probe runs — regression test for #793, named
-// session path at build_desired_state.go:341.
-func TestBuildDesiredState_NamedSessionWorkQueryExpandsRigTemplate(t *testing.T) {
+func TestBuildDesiredState_NamedSessionWorkQueryDoesNotDriveControllerDemand(t *testing.T) {
 	cityPath := t.TempDir()
 	rigDir := filepath.Join(cityPath, "alpha")
 	if err := os.MkdirAll(rigDir, 0o755); err != nil {
@@ -3050,11 +5279,7 @@ func TestBuildDesiredState_NamedSessionWorkQueryExpandsRigTemplate(t *testing.T)
 			StartCommand:      "true",
 			MinActiveSessions: intPtr(0),
 			MaxActiveSessions: intPtr(1),
-			// work_query must produce non-empty output for on_demand demand.
-			// When {{.Rig}} is expanded the echo yields "alpha", which is
-			// treated as ready work. Unexpanded, the literal "{{.Rig}}" is
-			// still non-empty — so to discriminate, use a grep filter.
-			WorkQuery: "echo {{.Rig}} | grep alpha",
+			WorkQuery:         "echo {{.Rig}} | grep alpha",
 		}},
 		NamedSessions: []config.NamedSession{{
 			Template: "alpha/dog",
@@ -3064,7 +5289,7 @@ func TestBuildDesiredState_NamedSessionWorkQueryExpandsRigTemplate(t *testing.T)
 
 	dsResult := buildDesiredState("test-city", cityPath, time.Now().UTC(), cfg, runtime.NewFake(), store, io.Discard)
 
-	if !dsResult.NamedSessionDemand["alpha/dog"] {
-		t.Errorf("NamedSessionDemand[alpha/dog] = false, want true (work_query {{.Rig}} should expand to alpha and grep match)")
+	if dsResult.NamedSessionDemand["alpha/dog"] {
+		t.Fatal("NamedSessionDemand[alpha/dog] came from controller-side work_query")
 	}
 }
diff --git a/cmd/gc/city_layout.go b/cmd/gc/city_layout.go
index 19cc886a6a..42a30631c1 100644
--- a/cmd/gc/city_layout.go
+++ b/cmd/gc/city_layout.go
@@ -1,9 +1,7 @@
 package main
 
 import (
-	"path/filepath"
-
-	"github.com/gastownhall/gascity/internal/citylayout"
+	"github.com/gastownhall/gascity/internal/cityinit"
 	"github.com/gastownhall/gascity/internal/fsys"
 )
 
@@ -12,52 +10,17 @@ func ensureCityScaffold(cityPath string) error {
 }
 
 func ensureCityScaffoldFS(fs fsys.FS, cityPath string) error {
-	for _, rel := range []string{
-		citylayout.RuntimeRoot,
-		citylayout.CacheRoot,
-		citylayout.SystemRoot,
-		filepath.Join(citylayout.RuntimeRoot, "runtime"),
-	} {
-		if err := fs.MkdirAll(filepath.Join(cityPath, rel), 0o755); err != nil {
-			return err
-		}
-	}
-	// Touch events.jsonl so gc doctor doesn't warn and events are ready.
-	eventsPath := filepath.Join(cityPath, citylayout.RuntimeRoot, "events.jsonl")
-	if _, err := fs.Stat(eventsPath); err != nil {
-		_ = fs.WriteFile(eventsPath, nil, 0o644)
-	}
-	return nil
+	return cityinit.EnsureCityScaffoldFS(fs, cityPath)
 }
 
 func cityAlreadyInitializedFS(fs fsys.FS, cityPath string) bool {
-	if fi, err := fs.Stat(filepath.Join(cityPath, citylayout.CityConfigFile)); err == nil && !fi.IsDir() {
-		return true
-	}
-	return cityHasScaffoldFS(fs, cityPath)
+	return cityinit.CityAlreadyInitializedFS(fs, cityPath)
 }
 
 func cityHasScaffoldFS(fs fsys.FS, cityPath string) bool {
-	requiredDirs := []string{
-		filepath.Join(cityPath, citylayout.RuntimeRoot),
-		filepath.Join(cityPath, citylayout.RuntimeRoot, "cache"),
-		filepath.Join(cityPath, citylayout.RuntimeRoot, "runtime"),
-		filepath.Join(cityPath, citylayout.RuntimeRoot, "system"),
-	}
-	for _, dir := range requiredDirs {
-		fi, err := fs.Stat(dir)
-		if err != nil || !fi.IsDir() {
-			return false
-		}
-	}
-	fi, err := fs.Stat(filepath.Join(cityPath, citylayout.RuntimeRoot, "events.jsonl"))
-	return err == nil && !fi.IsDir()
+	return cityinit.CityHasScaffoldFS(fs, cityPath)
 }
 
 func cityCanResumeInitFS(fs fsys.FS, cityPath string) bool {
-	fi, err := fs.Stat(filepath.Join(cityPath, citylayout.CityConfigFile))
-	if err != nil || fi.IsDir() {
-		return false
-	}
-	return cityHasScaffoldFS(fs, cityPath)
+	return cityinit.CityCanResumeInitFS(fs, cityPath)
 }
diff --git a/cmd/gc/city_registry.go b/cmd/gc/city_registry.go
index ed1fbd7486..5d3a8e16c5 100644
--- a/cmd/gc/city_registry.go
+++ b/cmd/gc/city_registry.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
@@ -11,6 +12,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/api"
 	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/pathutil"
 	"github.com/gastownhall/gascity/internal/supervisor"
 )
 
@@ -58,9 +60,12 @@ type cityRegistry struct {
 	snap     atomic.Pointer[citySnapshot]
 
 	// init/backoff state (co-protected by citiesMu)
-	initStatus   map[string]cityInitProgress
-	initFailures map[string]*initFailRecord
-	panicHistory map[string]*panicRecord
+	initStatus           map[string]cityInitProgress
+	initFailures         map[string]*initFailRecord
+	panicHistory         map[string]*panicRecord
+	pendingRequestIDs    map[string]string    // city path → request_id for async correlation
+	recentlyUnregistered map[string]time.Time // city path → unregister time (grace period for event delivery)
+	supervisorRecorder   events.Recorder      // supervisor-level event recorder for city lifecycle events
 
 	gen uint64 // monotonic generation counter
 }
@@ -68,10 +73,12 @@ type cityRegistry struct {
 // newCityRegistry creates a registry initialized with an empty snapshot.
 func newCityRegistry() *cityRegistry {
 	r := &cityRegistry{
-		cities:       make(map[string]*managedCity),
-		initStatus:   make(map[string]cityInitProgress),
-		initFailures: make(map[string]*initFailRecord),
-		panicHistory: make(map[string]*panicRecord),
+		cities:               make(map[string]*managedCity),
+		initStatus:           make(map[string]cityInitProgress),
+		initFailures:         make(map[string]*initFailRecord),
+		panicHistory:         make(map[string]*panicRecord),
+		pendingRequestIDs:    make(map[string]string),
+		recentlyUnregistered: make(map[string]time.Time),
 	}
 	// Initialize with empty snapshot to prevent nil-dereference panic
 	// if an API request arrives before the first reconciliation tick.
@@ -85,6 +92,74 @@ func newCityRegistry() *cityRegistry {
 	return r
 }
 
+// StorePendingRequestID stores a request_id for async correlation.
+func (r *cityRegistry) StorePendingRequestID(cityPath, requestID string) error {
+	key := pendingRequestKey(cityPath)
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).StorePendingCityRequestID(key, requestID); err != nil {
+		if errors.Is(err, supervisor.ErrPendingCityRequestExists) {
+			return api.ErrPendingRequestExists
+		}
+		return err
+	}
+
+	r.citiesMu.Lock()
+	r.pendingRequestIDs[key] = requestID
+	r.citiesMu.Unlock()
+	return nil
+}
+
+// ConsumePendingRequestID returns and removes the pending request_id for a city path.
+func (r *cityRegistry) ConsumePendingRequestID(cityPath string) (string, bool, error) {
+	key := pendingRequestKey(cityPath)
+	r.citiesMu.Lock()
+	id, ok := r.pendingRequestIDs[key]
+	if ok {
+		if _, _, err := supervisor.NewRegistry(supervisor.RegistryPath()).ConsumePendingCityRequestID(key); err != nil {
+			r.citiesMu.Unlock()
+			return id, true, err
+		}
+		delete(r.pendingRequestIDs, key)
+		r.citiesMu.Unlock()
+		return id, true, nil
+	}
+	r.citiesMu.Unlock()
+
+	id, ok, err := supervisor.NewRegistry(supervisor.RegistryPath()).ConsumePendingCityRequestID(key)
+	if err != nil {
+		return "", false, err
+	}
+	return id, ok, nil
+}
+
+func pendingRequestKey(cityPath string) string {
+	return pathutil.NormalizePathForCompare(cityPath)
+}
+
+// SetSupervisorRecorder installs the supervisor-level event recorder.
+func (r *cityRegistry) SetSupervisorRecorder(rec events.Recorder) {
+	r.citiesMu.Lock()
+	defer r.citiesMu.Unlock()
+	r.supervisorRecorder = rec
+}
+
+// SupervisorEventRecorder returns the supervisor-level event recorder.
+func (r *cityRegistry) SupervisorEventRecorder() events.Recorder {
+	r.citiesMu.Lock()
+	defer r.citiesMu.Unlock()
+	return r.supervisorRecorder
+}
+
+// MarkRecentlyUnregistered records a city path for transient event
+// provider inclusion so SSE clients can observe completion events
+// after the city is removed from the registry.
+func (r *cityRegistry) MarkRecentlyUnregistered(cityPath string) {
+	r.citiesMu.Lock()
+	defer r.citiesMu.Unlock()
+	r.recentlyUnregistered[cityPath] = time.Now()
+}
+
+const recentlyUnregisteredGrace = 2 * time.Minute
+
 // Add inserts or replaces a city. Caller must not hold citiesMu.
 func (r *cityRegistry) Add(path string, mc *managedCity) {
 	r.citiesMu.Lock()
@@ -236,6 +311,26 @@ func (r *cityRegistry) TransientCityEventProviders() map[string]events.Provider
 		}
 	}
 
+	// Include recently-unregistered cities so SSE clients can
+	// observe completion events after the city leaves the registry.
+	r.citiesMu.Lock()
+	now := time.Now()
+	for path, ts := range r.recentlyUnregistered {
+		if now.Sub(ts) > recentlyUnregisteredGrace {
+			delete(r.recentlyUnregistered, path)
+			continue
+		}
+		name := filepath.Base(path)
+		if _, already := running[name]; already {
+			continue
+		}
+		if _, already := paths[name]; already {
+			continue
+		}
+		paths[name] = path
+	}
+	r.citiesMu.Unlock()
+
 	out := make(map[string]events.Provider, len(paths))
 	for name, path := range paths {
 		evPath := filepath.Join(path, ".gc", "events.jsonl")
diff --git a/cmd/gc/city_registry_test.go b/cmd/gc/city_registry_test.go
index a35623b3e8..52a7651298 100644
--- a/cmd/gc/city_registry_test.go
+++ b/cmd/gc/city_registry_test.go
@@ -1,13 +1,16 @@
 package main
 
 import (
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
 	"sync"
+	"syscall"
 	"testing"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/api"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/supervisor"
 )
@@ -26,6 +29,123 @@ func TestCityRegistryEmptySnapshot(t *testing.T) {
 	}
 }
 
+func TestCityRegistryPendingRequestIDCanonicalizesPath(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	reg := newCityRegistry()
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	linkPath := filepath.Join(t.TempDir(), "city-link")
+	if err := os.Symlink(cityPath, linkPath); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := reg.StorePendingRequestID(linkPath, "req-city"); err != nil {
+		t.Fatal(err)
+	}
+
+	got, ok, err := reg.ConsumePendingRequestID(cityPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok {
+		t.Fatal("pending request ID not found by canonical path")
+	}
+	if got != "req-city" {
+		t.Fatalf("request ID = %q, want req-city", got)
+	}
+}
+
+func TestCityRegistryStorePendingRequestIDRejectsDuplicatePath(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	reg := newCityRegistry()
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := reg.StorePendingRequestID(cityPath, "req-first"); err != nil {
+		t.Fatal(err)
+	}
+	err := reg.StorePendingRequestID(cityPath, "req-second")
+	if !errors.Is(err, api.ErrPendingRequestExists) {
+		t.Fatalf("StorePendingRequestID duplicate error = %v, want ErrPendingRequestExists", err)
+	}
+
+	got, ok, err := reg.ConsumePendingRequestID(cityPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok || got != "req-first" {
+		t.Fatalf("consumed pending request = (%q, %t), want req-first true", got, ok)
+	}
+}
+
+func TestCityRegistryConsumePendingRequestIDIsAtomic(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	reg := newCityRegistry()
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := reg.StorePendingRequestID(cityPath, "req-city"); err != nil {
+		t.Fatal(err)
+	}
+
+	lockPath := supervisor.RegistryPath() + ".lock"
+	lockFile, err := os.OpenFile(lockPath, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer lockFile.Close() //nolint:errcheck
+	if err := syscall.Flock(int(lockFile.Fd()), syscall.LOCK_EX); err != nil {
+		t.Fatal(err)
+	}
+
+	type result struct {
+		id  string
+		ok  bool
+		err error
+	}
+	start := make(chan struct{})
+	results := make(chan result, 2)
+	for range 2 {
+		go func() {
+			<-start
+			id, ok, err := reg.ConsumePendingRequestID(cityPath)
+			results <- result{id: id, ok: ok, err: err}
+		}()
+	}
+
+	close(start)
+	time.Sleep(50 * time.Millisecond)
+	if err := syscall.Flock(int(lockFile.Fd()), syscall.LOCK_UN); err != nil {
+		t.Fatal(err)
+	}
+
+	first := <-results
+	second := <-results
+	if first.err != nil {
+		t.Fatal(first.err)
+	}
+	if second.err != nil {
+		t.Fatal(second.err)
+	}
+	consumed := 0
+	for _, got := range []result{first, second} {
+		if got.ok {
+			consumed++
+			if got.id != "req-city" {
+				t.Fatalf("request ID = %q, want req-city", got.id)
+			}
+		}
+	}
+	if consumed != 1 {
+		t.Fatalf("consumed request ID %d times, want exactly once; first=%+v second=%+v", consumed, first, second)
+	}
+}
+
 func TestCityRegistryAddRemove(t *testing.T) {
 	reg := newCityRegistry()
 
diff --git a/cmd/gc/city_runtime.go b/cmd/gc/city_runtime.go
index 828df44b2d..e85c774e02 100644
--- a/cmd/gc/city_runtime.go
+++ b/cmd/gc/city_runtime.go
@@ -27,6 +27,15 @@ import (
 	"github.com/gastownhall/gascity/internal/workspacesvc"
 )
 
+// reloadOrderDrainTimeout bounds how long config reload will wait for
+// the outgoing order dispatcher's in-flight goroutines before replacing
+// it. Reload runs on the tick loop, so a larger budget would stall all
+// other subsystems. Dispatchers that do not drain within this budget are
+// retained and drained again during controller shutdown; orphan tracking
+// beads are still compensated by the next startup sweep if shutdown also
+// cannot wait long enough.
+const reloadOrderDrainTimeout = 1 * time.Second
+
 // CityRuntime holds all running state for a single city's reconciliation
 // loop. It encapsulates the per-city lifecycle that was previously spread
 // across runController and controllerLoop. A machine-wide supervisor can
@@ -49,12 +58,15 @@ type CityRuntime struct {
 	buildFn                 func(*config.City, runtime.Provider, beads.Store) DesiredStateResult
 	buildFnWithSessionBeads func(*config.City, runtime.Provider, beads.Store, map[string]beads.Store, *sessionBeadSnapshot, *sessionReconcilerTraceCycle) DesiredStateResult
 
-	dops  drainOps
-	ct    crashTracker
-	it    idleTracker
-	wg    wispGC
-	od    orderDispatcher
-	trace *sessionReconcilerTraceManager
+	dops                    drainOps
+	ct                      crashTracker
+	it                      idleTracker
+	wg                      wispGC
+	od                      orderDispatcher
+	retiredOrderDispatchers []orderDispatcher
+	trace                   *sessionReconcilerTraceManager
+
+	orderSweepWatchdogLast time.Time
 
 	rec events.Recorder
 	cs  *controllerState // nil when controller-managed bead stores are unavailable
@@ -68,8 +80,10 @@ type CityRuntime struct {
 	standaloneRigStores map[string]beads.Store
 
 	// Bead-driven reconciler state (Phase 2f).
-	sessionDrains  *drainTracker // in-memory drain tracker; nil when bead reconciler disabled
-	demandSnapshot *runtimeDemandSnapshot
+	sessionDrains     *drainTracker // in-memory drain tracker; nil when bead reconciler disabled
+	asyncStartLimiter *asyncStartLimiter
+	asyncStarts       asyncStartTracker
+	demandSnapshot    *runtimeDemandSnapshot
 
 	convHandler         *convergence.Handler     // nil until bead store available
 	convStoreAdapter    *convergenceStoreAdapter // typed reference; avoids type assertions in tick/reconcile
@@ -81,9 +95,10 @@ type CityRuntime struct {
 	onStarted           func()
 	onStatus            func(string)
 
-	shutdownOnce   sync.Once
-	logPrefix      string // "gc start" or "gc supervisor"
-	stdout, stderr io.Writer
+	shutdownOnce             sync.Once
+	preserveSessionsShutdown atomic.Bool
+	logPrefix                string // "gc start" or "gc supervisor"
+	stdout, stderr           io.Writer
 }
 
 const runtimeDemandSnapshotMaxAge = 30 * time.Second
@@ -204,6 +219,7 @@ func newCityRuntime(p CityRuntimeParams) *CityRuntime {
 		poolSessions:            p.PoolSessions,
 		poolDeathHandlers:       p.PoolDeathHandlers,
 		suspendedNames:          suspendedNames,
+		asyncStartLimiter:       newAsyncStartLimiter(maxParallelStartsPerTick(p.Cfg)),
 		convergenceReqCh:        p.ConvergenceReqCh,
 		reloadReqCh: func() chan reloadRequest {
 			if p.ReloadReqCh != nil {
@@ -374,6 +390,21 @@ func (cr *CityRuntime) run(ctx context.Context) {
 		return
 	}
 
+	cr.applyStartupConfigReload(ctx, dirty, &lastProviderName, cityRoot)
+	if ctx.Err() != nil {
+		return
+	}
+
+	// Dispatch due orders before startup session reconciliation. A cold-start
+	// reconcile can take minutes when it has stale or config-drifted sessions;
+	// due event/condition formulas should not wait behind that maintenance work.
+	cr.safeTick(func() {
+		cr.dispatchOrders(ctx, cityRoot)
+	}, "startup-orders")
+	if ctx.Err() != nil {
+		return
+	}
+
 	// Session bead sync BEFORE reconciliation: ensures beads exist for
 	// the reconciler to read/write hashes. Uses ListByLabel (indexed,
 	// fast even before CachingStore is primed).
@@ -395,6 +426,7 @@ func (cr *CityRuntime) run(ctx context.Context) {
 			}
 		}()
 
+		cleanupDeadRuntimeSessionCorpses(sessionBeads, cr.sessionDrains, cr.sp, cr.stderr)
 		// Reap stale session beads from a previous run before building desired
 		// state, so desired state does not reference already-closed beads (#742).
 		if reapStaleSessionBeads(cr.cityBeadStore(), cr.sp, cr.sessionDrains, clock.Real{}, cr.stderr) > 0 {
@@ -668,12 +700,17 @@ func (cr *CityRuntime) tick(
 		}
 	}
 
+	// Order dispatch is intentionally before the expensive session reconcile
+	// phases so due formulas are not starved by slow startup/config drift work.
+	cr.dispatchOrders(ctx, cityRoot)
+
 	// Session bead sync BEFORE reconciliation (one-tick state lag; see run()).
 	// Post-reconcile sync was intentionally removed: the daemon's next tick
 	// corrects bead state, and the pre-reconcile sync is sufficient for
 	// the reconciler to read/write hashes during reconciliation.
 	// Reap open session beads whose tmux session is dead before loading demand
 	// so stale names cannot block desired-state computation (#742).
+	cleanupDeadRuntimeSessionCorpses(sessionBeads, cr.sessionDrains, cr.sp, cr.stderr)
 	if reapStaleSessionBeads(cr.cityBeadStore(), cr.sp, cr.sessionDrains, clock.Real{}, cr.stderr) > 0 {
 		sessionBeads = cr.loadSessionBeadSnapshot()
 	}
@@ -728,11 +765,6 @@ func (cr *CityRuntime) tick(
 		}
 	}
 
-	// Order dispatch.
-	if cr.od != nil {
-		cr.od.dispatch(ctx, cityRoot, time.Now())
-	}
-
 	if cr.svc != nil {
 		cr.svc.Tick(ctx, time.Now())
 	}
@@ -757,6 +789,42 @@ func (cr *CityRuntime) tick(
 	tickCompleted = true
 }
 
+func (cr *CityRuntime) dispatchOrders(ctx context.Context, cityRoot string) {
+	if ctx.Err() != nil {
+		return
+	}
+	now := time.Now()
+	cr.runOrderTrackingSweepWatchdog(now)
+	if cr.od != nil {
+		cr.od.dispatch(ctx, cityRoot, now)
+	}
+}
+
+func (cr *CityRuntime) runOrderTrackingSweepWatchdog(now time.Time) {
+	if !cr.orderSweepWatchdogLast.IsZero() && now.Sub(cr.orderSweepWatchdogLast) < orderTrackingSweepWatchdogInterval {
+		return
+	}
+	cr.orderSweepWatchdogLast = now
+
+	store := cr.cityBeadStore()
+	if store == nil {
+		return
+	}
+	onlyOrders := map[string]struct{}{
+		orderTrackingSweepOrder: {},
+	}
+	n, err := sweepStaleOrderTracking(store, now, orderTrackingSweepWatchdogStaleAfter, onlyOrders, orderTrackingWatchdogMetadataInitiator)
+	if err != nil {
+		if cr.stderr != nil {
+			fmt.Fprintf(cr.stderr, "%s: order tracking sweep watchdog: %v\n", cr.logPrefix, err) //nolint:errcheck // best-effort stderr
+		}
+		return
+	}
+	if n > 0 && cr.stderr != nil {
+		fmt.Fprintf(cr.stderr, "%s: order tracking sweep watchdog closed %d stale tracking bead(s)\n", cr.logPrefix, n) //nolint:errcheck // best-effort stderr
+	}
+}
+
 func (cr *CityRuntime) handleReloadRequest(req *reloadRequest) {
 	if req == nil {
 		return
@@ -817,6 +885,24 @@ func (cr *CityRuntime) reloadConfig(
 	cr.reloadConfigTraced(ctx, lastProviderName, cityRoot, nil, reloadSourceWatch)
 }
 
+func (cr *CityRuntime) applyStartupConfigReload(
+	ctx context.Context,
+	dirty *atomic.Bool,
+	lastProviderName *string,
+	cityRoot string,
+) {
+	if cr.tomlPath == "" || cityRoot == "" || cr.configRev == "" || lastProviderName == nil || ctx.Err() != nil {
+		return
+	}
+	if dirty != nil {
+		dirty.Swap(false)
+	}
+	reply := cr.reloadConfigTraced(ctx, lastProviderName, cityRoot, nil, reloadSourceWatch)
+	if reply.Outcome == reloadOutcomeFailed && dirty != nil {
+		dirty.Store(true)
+	}
+}
+
 func (cr *CityRuntime) reloadConfigTraced(
 	ctx context.Context,
 	lastProviderName *string,
@@ -899,12 +985,6 @@ func (cr *CityRuntime) reloadConfigTraced(
 		}
 	}
 
-	// System formulas/orders now arrive via the core bootstrap pack.
-	// gc-beads-bd ships inside the bd pack's assets/scripts/ and is
-	// materialized alongside the rest of the pack content.
-	if err := MaterializeBuiltinPacks(cityRoot); err != nil {
-		appendWarning(fmt.Sprintf("config reload: materializing builtin packs: %v", err))
-	}
 	if err := config.ValidateRigs(nextCfg.Rigs, config.EffectiveHQPrefix(nextCfg)); err != nil {
 		appendWarning(fmt.Sprintf("config reload: %v", err))
 	}
@@ -1026,6 +1106,21 @@ func (cr *CityRuntime) reloadConfigTraced(
 		cr.wg = nil
 	}
 
+	// Drain the outgoing dispatcher before replacing it so in-flight
+	// dispatchOne goroutines persist their tracking-bead outcomes against
+	// the store they were scheduled against. Reload runs on the same
+	// goroutine as tick, so no concurrent dispatch can create a new
+	// in-flight signal on this dispatcher while drain observes it. The
+	// reload budget is capped at reloadOrderDrainTimeout so a wedged exec
+	// order cannot stall the tick loop; timed-out dispatchers are retained
+	// and drained again during shutdown.
+	// Deriving from ctx (the tick ctx) lets a shutdown racing with reload
+	// short-circuit the drain instead of waiting the full 1s.
+	if cr.od != nil {
+		drainCtx, drainCancel := context.WithTimeout(ctx, reloadOrderDrainTimeout)
+		cr.drainOutgoingOrderDispatcher(drainCtx, cr.od)
+		drainCancel()
+	}
 	cr.od = buildOrderDispatcher(cityRoot, nextCfg, cr.rec, cr.stderr)
 
 	cr.serviceStateMu.Lock()
@@ -1035,7 +1130,7 @@ func (cr *CityRuntime) reloadConfigTraced(
 	cr.serviceStateMu.Unlock()
 
 	if cr.cs != nil {
-		cr.cs.update(nextCfg, nextSp)
+		cr.cs.updateFromRuntime(nextCfg, nextSp, result.Revision)
 	}
 	if cr.svc != nil {
 		if err := cr.svc.Reload(); err != nil {
@@ -1149,15 +1244,19 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 	}
 
 	if sessionBeads == nil {
-		sessionBeads = cr.loadSessionBeadSnapshot()
+		var sessionQueryPartial bool
+		sessionBeads, sessionQueryPartial = cr.loadSessionBeadSnapshotWithPartial()
+		result.SessionQueryPartial = result.SessionQueryPartial || sessionQueryPartial
 	}
 	rigStores := cr.rigBeadStores()
 	assignedWorkBeads := result.AssignedWorkBeads
-	if released := releaseOrphanedPoolAssignments(store, cr.cfg, sessionBeads.Open(), assignedWorkBeads, result.AssignedWorkStores); len(released) > 0 {
+	assignedWorkStoreRefs := result.AssignedWorkStoreRefs
+	released := releaseOrphanedPoolAssignmentsWhenSnapshotsComplete(store, cr.cfg, cr.cityPath, sessionBeads.Open(), result, rigStores)
+	if len(released) > 0 {
 		for _, r := range released {
 			fmt.Fprintf(cr.stderr, "released orphaned pool work: %s\n", r.ID) //nolint:errcheck
 		}
-		assignedWorkBeads = filterReleasedAssignedWorkBeads(assignedWorkBeads, released)
+		assignedWorkBeads, assignedWorkStoreRefs = filterReleasedAssignedWorkSnapshot(assignedWorkBeads, assignedWorkStoreRefs, released)
 	}
 	// poolDesired determines how many sessions should be AWAKE. Uses the
 	// same scale_check counts that buildDesiredState already computed (no
@@ -1165,8 +1264,13 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 	// work beads + new tier from scale_check + min fill.
 	poolDesired := result.PoolDesiredCounts
 	if poolDesired == nil {
-		poolDesired = PoolDesiredCounts(ComputePoolDesiredStatesTraced(
-			cr.cfg, assignedWorkBeads, sessionBeads.Open(), result.ScaleCheckCounts, trace))
+		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cr.cfg, cr.cityPath, sessionBeads.Open(), assignedWorkBeads, assignedWorkStoreRefs)
+		poolDesired = retainScaleCheckPartialPoolDesired(
+			PoolDesiredCounts(ComputePoolDesiredStatesTraced(
+				cr.cfg, poolWorkBeads, sessionBeads.Open(), result.ScaleCheckCounts, trace)),
+			sessionBeads,
+			result.PoolScaleCheckPartialTemplates,
+		)
 	}
 	// Merge named-session assignee demand so on-demand named sessions with
 	// direct work (Assignee match, no gc.routed_to) stay config-eligible.
@@ -1191,9 +1295,11 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 		desiredState,
 		cr.cfg,
 		cr.sp,
-		result.StoreQueryPartial,
+		result.snapshotQueryPartial(),
 	) > 0 {
-		sessionBeads = cr.loadSessionBeadSnapshot()
+		var sessionQueryPartial bool
+		sessionBeads, sessionQueryPartial = cr.loadSessionBeadSnapshotWithPartial()
+		result.SessionQueryPartial = result.SessionQueryPartial || sessionQueryPartial
 	}
 	open := sessionBeads.Open()
 
@@ -1202,19 +1308,16 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 
 	cfgNames := configuredSessionNamesWithSnapshot(cr.cfg, cityName, sessionBeads)
 
-	readyWaitSet, err := prepareWaitWakeStateForCity(cr.cityPath, store, time.Now())
+	readyWaitSet, err := prepareWaitWakeStateForCityWithSnapshot(cr.cityPath, store, time.Now(), sessionBeads)
 	if err != nil {
 		fmt.Fprintf(cr.stderr, "%s: preparing waits: %v\n", cr.logPrefix, err) //nolint:errcheck
 		readyWaitSet = nil
 	}
 
-	// workSet: defense-in-depth wake signal from work_query. When work_query
-	// detects pending work but scale_check hasn't caught up yet, workSet
-	// ensures at least one session wakes without waiting for the next tick.
-	workSet := result.WorkSet
-	if workSet == nil {
-		workSet = computeWorkSet(cr.cfg, shellScaleCheck, cityName, cr.cityPath, store, sessionBeads, cr.stderr)
-	}
+	// Controller wake demand comes from assigned-work scans and scale_check.
+	// work_query remains the agent-side gc hook claim path; running every
+	// work_query here can block assigned-work resumes behind unrelated probes.
+	workSet := make(map[string]bool)
 	if trace != nil {
 		templateNames := make(map[string]struct{})
 		openCounts := make(map[string]int)
@@ -1259,13 +1362,19 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 			})
 		}
 		trace.RecordCycleInputSnapshot(map[string]any{
-			"desired_session_count": len(desiredState),
-			"open_session_count":    len(open),
-			"scale_check_counts":    result.ScaleCheckCounts,
-			"pool_desired":          poolDesired,
-			"ready_wait_count":      len(readyWaitSet),
-			"work_set_count":        len(workSet),
-			"store_query_partial":   result.StoreQueryPartial,
+			"desired_session_count":               len(desiredState),
+			"open_session_count":                  len(open),
+			"scale_check_counts":                  result.ScaleCheckCounts,
+			"pool_desired":                        poolDesired,
+			"ready_wait_count":                    len(readyWaitSet),
+			"work_set_count":                      len(workSet),
+			"store_query_partial":                 result.StoreQueryPartial,
+			"scale_check_query_partial":           len(result.ScaleCheckPartialTemplates) > 0,
+			"scale_check_partial_templates":       sortedBoolMapKeys(result.ScaleCheckPartialTemplates),
+			"pool_scale_check_partial_templates":  sortedBoolMapKeys(result.PoolScaleCheckPartialTemplates),
+			"named_scale_check_partial_templates": sortedBoolMapKeys(result.NamedScaleCheckPartialTemplates),
+			"session_query_partial":               result.SessionQueryPartial,
+			"snapshot_query_partial":              result.snapshotQueryPartial(),
 		})
 		for _, agent := range cr.cfg.Agents {
 			template := agent.QualifiedName()
@@ -1292,15 +1401,21 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 		}
 	}
 
-	reconcileSessionBeadsTraced(
+	awakeAssignedWorkBeads := filterAssignedWorkBeadsForSessionWake(cr.cfg, cr.cityPath, open, assignedWorkBeads, assignedWorkStoreRefs)
+	reconcileSessionBeadsTracedWithNamedDemand(
 		ctx, cr.cityPath, open, desiredState, cfgNames, cr.cfg, cr.sp, store,
 		cr.dops,
-		assignedWorkBeads, rigStores, readyWaitSet, cr.sessionDrains, poolDesired,
-		result.StoreQueryPartial,
+		awakeAssignedWorkBeads, rigStores, readyWaitSet, cr.sessionDrains, poolDesired,
+		result.NamedSessionDemand,
+		result.snapshotQueryPartial(),
 		workSet, cityName,
 		cr.it, clock.Real{}, cr.rec, cr.cfg.Session.StartupTimeoutDuration(),
 		cr.cfg.Daemon.DriftDrainTimeoutDuration(),
 		cr.stdout, cr.stderr, trace,
+		withAsyncStartExecution(),
+		withAsyncStartFollowUp(cr.requestAsyncStartFollowUpTick),
+		withAsyncStartLimiter(cr.ensureAsyncStartLimiter()),
+		withAsyncStartTracker(&cr.asyncStarts),
 	)
 	cr.requestDeferredDrainFollowUpTick()
 	if trace != nil {
@@ -1315,16 +1430,36 @@ func (cr *CityRuntime) beadReconcileTick(ctx context.Context, result DesiredStat
 			})
 		}
 	}
-	if err := dispatchReadyWaitNudges(cr.cityPath, store, cr.sp, time.Now()); err != nil {
+	dispatchSessionBeads, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		fmt.Fprintf(cr.stderr, "%s: dispatching wait nudges: %v\n", cr.logPrefix, err) //nolint:errcheck
+	} else if err := dispatchReadyWaitNudgesWithSnapshot(cr.cityPath, store, time.Now(), dispatchSessionBeads); err != nil {
 		fmt.Fprintf(cr.stderr, "%s: dispatching wait nudges: %v\n", cr.logPrefix, err) //nolint:errcheck
 	}
 
+	// Drain queued nudges for ACP sessions in-process. The nudge
+	// poller (gc nudge poll) skips ACP sessions because it spawns a
+	// separate process without in-process ACP connections. The
+	// reconciler runs inside the supervisor and holds the live
+	// provider, so it can deliver directly.
+	acpTargets := buildACPNudgeTargets(cr.cityPath, cr.cfg, result, sessionBeads)
+	if len(acpTargets) > 0 {
+		if _, err := drainACPQueuedNudges(cr.cityPath, cr.sp, acpTargets, time.Now()); err != nil {
+			fmt.Fprintf(cr.stderr, "%s: draining ACP nudges: %v\n", cr.logPrefix, err) //nolint:errcheck
+		}
+	}
+
 	// Idle recovery: detect pool sessions stuck at the prompt after
 }
 
 func filterReleasedAssignedWorkBeads(assignedWorkBeads []beads.Bead, released []releasedPoolAssignment) []beads.Bead {
+	filtered, _ := filterReleasedAssignedWorkSnapshot(assignedWorkBeads, nil, released)
+	return filtered
+}
+
+func filterReleasedAssignedWorkSnapshot(assignedWorkBeads []beads.Bead, assignedWorkStoreRefs []string, released []releasedPoolAssignment) ([]beads.Bead, []string) {
 	if len(assignedWorkBeads) == 0 || len(released) == 0 {
-		return assignedWorkBeads
+		return assignedWorkBeads, assignedWorkStoreRefs
 	}
 	releasedIndexes := make(map[int]struct{}, len(released))
 	for _, r := range released {
@@ -1337,16 +1472,28 @@ func filterReleasedAssignedWorkBeads(assignedWorkBeads []beads.Bead, released []
 		}
 	}
 	if len(releasedIndexes) == 0 {
-		return assignedWorkBeads
+		return assignedWorkBeads, assignedWorkStoreRefs
 	}
 	filtered := make([]beads.Bead, 0, len(assignedWorkBeads)-len(releasedIndexes))
+	var filteredStoreRefs []string
+	// Preserve AssignedWorkBeads/AssignedWorkStoreRefs index alignment when
+	// both slices are complete; otherwise drop refs rather than guess.
+	if len(assignedWorkStoreRefs) == len(assignedWorkBeads) {
+		filteredStoreRefs = make([]string, 0, len(assignedWorkStoreRefs)-len(releasedIndexes))
+	}
 	for i, wb := range assignedWorkBeads {
 		if _, ok := releasedIndexes[i]; ok {
 			continue
 		}
 		filtered = append(filtered, wb)
+		if filteredStoreRefs != nil {
+			filteredStoreRefs = append(filteredStoreRefs, assignedWorkStoreRefs[i])
+		}
 	}
-	return filtered
+	if filteredStoreRefs == nil {
+		filteredStoreRefs = assignedWorkStoreRefs
+	}
+	return filtered, filteredStoreRefs
 }
 
 func (cr *CityRuntime) requestDeferredDrainFollowUpTick() {
@@ -1362,6 +1509,44 @@ func (cr *CityRuntime) requestDeferredDrainFollowUpTick() {
 	}
 }
 
+func (cr *CityRuntime) ensureAsyncStartLimiter() *asyncStartLimiter {
+	capacity := maxParallelStartsPerTick(cr.cfg)
+	if cr.asyncStartLimiter == nil {
+		cr.asyncStartLimiter = newAsyncStartLimiter(capacity)
+	} else {
+		cr.asyncStartLimiter.resize(capacity)
+	}
+	return cr.asyncStartLimiter
+}
+
+func (cr *CityRuntime) requestAsyncStartFollowUpTick() {
+	if cr == nil {
+		return
+	}
+	// Async completion can commit, rollback, or reject stale work; each case
+	// should prompt one cheap reconciliation pass to observe the new reality.
+	select {
+	case cr.pokeCh <- struct{}{}:
+	default:
+	}
+}
+
+func (cr *CityRuntime) waitForAsyncStarts() {
+	if cr == nil {
+		return
+	}
+	timeout := time.Duration(0)
+	if cr.cfg != nil {
+		timeout = cr.cfg.Daemon.ShutdownTimeoutDuration()
+	}
+	if timeout <= 0 {
+		timeout = 5 * time.Second
+	}
+	if !cr.asyncStarts.wait(timeout) && cr.stderr != nil {
+		fmt.Fprintf(cr.stderr, "%s: async session starts still running after %s; continuing shutdown\n", cr.logPrefix, timeout) //nolint:errcheck // best-effort stderr
+	}
+}
+
 func sweepUndesiredPoolSessionBeads(
 	store beads.Store,
 	rigStores map[string]beads.Store,
@@ -1374,6 +1559,7 @@ func sweepUndesiredPoolSessionBeads(
 	if store == nil || sessionBeads == nil || cfg == nil || storeQueryPartial {
 		return 0
 	}
+	startupTimeout := cfg.Session.StartupTimeoutDuration()
 	var candidates []beads.Bead
 	for _, bead := range sessionBeads.Open() {
 		if bead.Status == "closed" {
@@ -1389,11 +1575,11 @@ func sweepUndesiredPoolSessionBeads(
 			continue
 		}
 		// Don't sweep beads that the reconciler still considers "start
-		// requested" — their work assignment window hasn't opened. Mirrors
-		// sessionStartRequested (session_reconcile.go) exactly so the two
-		// loops agree about ownership:
-		//   - pending_create_claim=true: in-flight create claim, protected
-		//     regardless of age until the lifecycle clears it.
+		// requested" — their work assignment window hasn't opened. The
+		// pending_create_claim lease mirrors the reconciler's recovery model:
+		// fresh start-in-flight and never-started queue entries are protected,
+		// but once that lease expires the crashed creator must not strand the
+		// pool slot forever.
 		//   - state=creating: protected until staleCreatingState would
 		//     return true (i.e., until staleCreatingStateTimeout has
 		//     elapsed; zero CreatedAt is treated as stale, matching
@@ -1402,10 +1588,10 @@ func sweepUndesiredPoolSessionBeads(
 		// on the same tick it's created (no work assigned →
 		// GCSweepSessionBeads closes it), spinning the pool in a rapid
 		// create→sweep→recreate loop.
-		if strings.TrimSpace(bead.Metadata["pending_create_claim"]) == "true" {
+		if pendingCreateClaimStillLeasedForSweep(bead, startupTimeout) {
 			continue
 		}
-		if strings.TrimSpace(bead.Metadata["state"]) == "creating" && !isStaleCreating(bead.CreatedAt) {
+		if strings.TrimSpace(bead.Metadata["state"]) == "creating" && !isStaleCreating(bead) {
 			continue
 		}
 		// Age grace period for the post-creating, pre-wake window. After
@@ -1468,21 +1654,33 @@ func sweepUndesiredPoolSessionBeads(
 	return len(GCSweepSessionBeads(store, rigStores, candidates))
 }
 
+// pendingCreateClaimStillLeasedForSweep keeps pending_create_claim protection
+// aligned with the reconciler: start-in-flight claims stay protected for the
+// provider-start lease, never-started creates get the longer queue lease, and
+// stale claims stop blocking pool-slot recovery.
+func pendingCreateClaimStillLeasedForSweep(bead beads.Bead, startupTimeout time.Duration) bool {
+	return pendingCreateLeaseActive(bead, nil, startupTimeout)
+}
+
 // isStaleCreating mirrors staleCreatingState in session_reconcile.go without
-// requiring a clock.Clock dependency: a zero CreatedAt is treated as stale,
-// and otherwise the bead is stale once staleCreatingStateTimeout has elapsed.
-// Keeping this shape identical to the reconciler's predicate means the sweep
-// and the reconciler agree about which in-flight create beads are still alive.
-func isStaleCreating(createdAt time.Time) bool {
-	if createdAt.IsZero() {
+// requiring a clock.Clock dependency. It prefers the per-attempt
+// pending_create_started_at marker and falls back to CreatedAt for older beads
+// so the sweep and reconciler agree about which in-flight create beads are
+// still alive.
+func isStaleCreating(bead beads.Bead) bool {
+	now := time.Now()
+	if started, ok := parseRFC3339Metadata(bead.Metadata["pending_create_started_at"]); ok {
+		return !now.Before(started.Add(staleCreatingStateTimeout))
+	}
+	if bead.CreatedAt.IsZero() {
 		return true
 	}
-	return time.Since(createdAt) >= staleCreatingStateTimeout
+	return !now.Before(bead.CreatedAt.Add(staleCreatingStateTimeout))
 }
 
-// parseRFC3339Metadata parses an RFC3339 timestamp metadata value. A missing
-// or unparseable value returns ok=false; the caller treats that as "no per-
-// start marker present" so older beads (pre-creation_complete_at rollout)
+// parseRFC3339Metadata parses an RFC3339 timestamp metadata value. A missing,
+// zero, or unparseable value returns ok=false; the caller treats that as "no
+// per-start marker present" so older beads (pre-creation_complete_at rollout)
 // fall through to the default sweepable path rather than being protected
 // indefinitely.
 func parseRFC3339Metadata(v string) (time.Time, bool) {
@@ -1494,6 +1692,9 @@ func parseRFC3339Metadata(v string) (time.Time, bool) {
 	if err != nil {
 		return time.Time{}, false
 	}
+	if t.IsZero() {
+		return time.Time{}, false
+	}
 	return t, true
 }
 
@@ -1523,9 +1724,10 @@ func (cr *CityRuntime) controlDispatcherTick(ctx context.Context) {
 	)
 	desiredState := wfcResult.State
 	cfgNames := configuredSessionNamesWithSnapshot(filteredCfg, cr.cityName, sessionBeads)
-	_, updated := syncSessionBeadsWithSnapshot(
+	_, updated := syncSessionBeadsWithSnapshotAndRigStores(
 		cr.cityPath,
 		store,
+		cr.rigBeadStores(),
 		desiredState,
 		cr.sp,
 		cfgNames,
@@ -1536,13 +1738,18 @@ func (cr *CityRuntime) controlDispatcherTick(ctx context.Context) {
 		sessionBeads,
 	)
 	open := filterSessionBeadsByName(updated, cfgNames)
-	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(
-		filteredCfg, wfcResult.AssignedWorkBeads, open, wfcResult.ScaleCheckCounts))
+	poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(filteredCfg, cr.cityPath, open, wfcResult.AssignedWorkBeads, wfcResult.AssignedWorkStoreRefs)
+	poolDesired := retainScaleCheckPartialPoolDesired(
+		PoolDesiredCounts(ComputePoolDesiredStates(
+			filteredCfg, poolWorkBeads, open, wfcResult.ScaleCheckCounts)),
+		newSessionBeadSnapshot(open),
+		wfcResult.PoolScaleCheckPartialTemplates,
+	)
 	if poolDesired == nil {
 		poolDesired = make(map[string]int)
 	}
 	mergeNamedSessionDemand(poolDesired, wfcResult.NamedSessionDemand, filteredCfg)
-	reconcileSessionBeadsAtPath(
+	reconcileSessionBeadsAtPathWithNamedDemand(
 		ctx,
 		cr.cityPath,
 		open,
@@ -1557,6 +1764,7 @@ func (cr *CityRuntime) controlDispatcherTick(ctx context.Context) {
 		nil, // control-dispatcher ticks only need ownership continuity, not main-tick assigned/ready snapshots
 		cr.sessionDrains,
 		poolDesired,
+		wfcResult.NamedSessionDemand,
 		false, // storeQueryPartial: config-change path doesn't query work beads
 		nil,   // workSet: not computed for config-change reconcile
 		cr.cityName,
@@ -1575,8 +1783,8 @@ func (cr *CityRuntime) controlDispatcherTick(ctx context.Context) {
 func (cr *CityRuntime) syncBeadsAndUpdateIndex(desiredState map[string]TemplateParams, sessionBeads *sessionBeadSnapshot) *sessionBeadSnapshot {
 	store := cr.cityBeadStore()
 	cfgNames := configuredSessionNamesWithSnapshot(cr.cfg, cr.cityName, sessionBeads)
-	_, updated := syncSessionBeadsWithSnapshot(
-		cr.cityPath, store, desiredState, cr.sp, cfgNames, cr.cfg, clock.Real{}, cr.stderr, cr.sessionDrains != nil, sessionBeads,
+	_, updated := syncSessionBeadsWithSnapshotAndRigStores(
+		cr.cityPath, store, cr.rigBeadStores(), desiredState, cr.sp, cfgNames, cr.cfg, clock.Real{}, cr.stderr, cr.sessionDrains != nil, sessionBeads,
 	)
 	return updated
 }
@@ -1600,16 +1808,21 @@ func (cr *CityRuntime) rigBeadStores() map[string]beads.Store {
 }
 
 func (cr *CityRuntime) loadSessionBeadSnapshot() *sessionBeadSnapshot {
+	sessionBeads, _ := cr.loadSessionBeadSnapshotWithPartial()
+	return sessionBeads
+}
+
+func (cr *CityRuntime) loadSessionBeadSnapshotWithPartial() (*sessionBeadSnapshot, bool) {
 	store := cr.cityBeadStore()
 	if store == nil {
-		return nil
+		return nil, false
 	}
 	sessionBeads, err := loadSessionBeadSnapshot(store)
 	if err != nil {
 		fmt.Fprintf(cr.stderr, "%s: loading session beads: %v\n", cr.logPrefix, err) //nolint:errcheck
-		return nil
+		return nil, true
 	}
-	return sessionBeads
+	return sessionBeads, false
 }
 
 func filterSessionBeadsByName(snapshot *sessionBeadSnapshot, names map[string]bool) []beads.Bead {
@@ -1647,13 +1860,18 @@ func (cr *CityRuntime) loadDemandSnapshot(
 		if sessionBeads != nil {
 			openSessionBeads = sessionBeads.Open()
 		}
-		result.PoolDesiredCounts = PoolDesiredCounts(ComputePoolDesiredStatesTraced(
-			cr.cfg, result.AssignedWorkBeads, openSessionBeads, result.ScaleCheckCounts, trace))
+		poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cr.cfg, cr.cityPath, openSessionBeads, result.AssignedWorkBeads, result.AssignedWorkStoreRefs)
+		result.PoolDesiredCounts = retainScaleCheckPartialPoolDesired(
+			PoolDesiredCounts(ComputePoolDesiredStatesTraced(
+				cr.cfg, poolWorkBeads, openSessionBeads, result.ScaleCheckCounts, trace)),
+			sessionBeads,
+			result.PoolScaleCheckPartialTemplates,
+		)
 		if result.PoolDesiredCounts == nil {
 			result.PoolDesiredCounts = make(map[string]int)
 		}
 		mergeNamedSessionDemand(result.PoolDesiredCounts, result.NamedSessionDemand, cr.cfg)
-		result.WorkSet = computeWorkSet(cr.cfg, shellScaleCheck, cr.cityName, cr.cityPath, cr.cityBeadStore(), sessionBeads, cr.stderr)
+		result.WorkSet = make(map[string]bool)
 		cr.demandSnapshot = &runtimeDemandSnapshot{
 			createdAt:          time.Now(),
 			sessionFingerprint: sessionFingerprint,
@@ -1697,7 +1915,7 @@ func demandSnapshotDemandSourcesEventBacked(cfg *config.City) bool {
 		return false
 	}
 	for i := range cfg.Agents {
-		if strings.TrimSpace(cfg.Agents[i].ScaleCheck) != "" || strings.TrimSpace(cfg.Agents[i].WorkQuery) != "" {
+		if strings.TrimSpace(cfg.Agents[i].ScaleCheck) != "" {
 			return false
 		}
 	}
@@ -1788,20 +2006,99 @@ func (cr *CityRuntime) beginTraceCycle(trigger, detail string, sessionBeads *ses
 	return cr.trace.beginCycle(info, cr.cfg, sessionBeads)
 }
 
+func (cr *CityRuntime) drainOutgoingOrderDispatcher(ctx context.Context, od orderDispatcher) {
+	if od == nil {
+		return
+	}
+	if od.drain(ctx) {
+		return
+	}
+	cr.retiredOrderDispatchers = append(cr.retiredOrderDispatchers, od)
+}
+
+func (cr *CityRuntime) drainOrderDispatchers(ctx context.Context) {
+	var retained []orderDispatcher
+	if cr.od != nil && !cr.od.drain(ctx) {
+		retained = append(retained, cr.od)
+	}
+	for _, od := range cr.retiredOrderDispatchers {
+		if od == nil {
+			continue
+		}
+		if !od.drain(ctx) {
+			retained = append(retained, od)
+		}
+	}
+	cr.retiredOrderDispatchers = retained
+}
+
+func orderShutdownDrainTimeout(total time.Duration) time.Duration {
+	if total <= 0 {
+		return 0
+	}
+	if total < reloadOrderDrainTimeout {
+		return total
+	}
+	return reloadOrderDrainTimeout
+}
+
+func (cr *CityRuntime) recordPreservedShutdownTrace() {
+	trace := cr.beginTraceCycle("shutdown", "preserve_sessions", nil)
+	if trace == nil {
+		return
+	}
+	trace.recordOperation("lifecycle.shutdown.preserve_sessions", "", "", "", "retained", string(TraceOutcomeApplied), traceRecordPayload{
+		"city_path": cr.cityPath,
+		"city_name": cr.cityName,
+		"reason":    "supervisor_shutdown_preserve_mode",
+	}, "")
+	trace.end(TraceCompletionCompleted, traceRecordPayload{
+		"phase":     "shutdown",
+		"mode":      "preserve_sessions",
+		"city_name": cr.cityName,
+		"reason":    "supervisor_shutdown_preserve_mode",
+	})
+}
+
 // shutdown performs graceful two-pass agent shutdown for this city.
 // Safe to call multiple times (e.g., from both panic recovery and
 // normal shutdown) — only the first call takes effect.
 func (cr *CityRuntime) shutdown() {
 	cr.shutdownOnce.Do(func() {
+		cr.waitForAsyncStarts()
+		preserveSessions := cr.preserveSessionsShutdown.Load()
+		if preserveSessions {
+			cr.recordPreservedShutdownTrace()
+		}
 		if cr.trace != nil {
 			_ = cr.trace.Close()
 		}
 		if cr.svc != nil {
+			// Workspace-service proxies are process-group-bound, not preserved
+			// agent sessions. Close them so the next supervisor can reacquire
+			// their sockets and ports during re-adoption.
 			if err := cr.svc.Close(); err != nil {
 				fmt.Fprintf(cr.stderr, "%s: service shutdown: %v\n", cr.logPrefix, err) //nolint:errcheck // best-effort stderr
 			}
 		}
-		timeout := cr.cfg.Daemon.ShutdownTimeoutDuration()
+		if preserveSessions {
+			fmt.Fprintf(cr.stdout, "Preserving agent sessions for supervisor re-adoption.\n") //nolint:errcheck // best-effort stdout
+			return
+		}
+		// Drain order dispatchers with a small cap before stopping sessions.
+		// Use a fresh context because the tick ctx is already canceled at this
+		// point, which would make drain a no-op. shutdown_timeout remains the
+		// graceful session-stop budget; order drain does not silently halve it.
+		// Orphaned tracking beads (if drain times out) are closed by
+		// sweepOrphanedOrderTrackingRetry on next start.
+		total := cr.cfg.Daemon.ShutdownTimeoutDuration()
+		gracefulTimeout := total
+		if cr.od != nil || len(cr.retiredOrderDispatchers) > 0 {
+			drainTimeout := orderShutdownDrainTimeout(total)
+			drainCtx, drainCancel := context.WithTimeout(context.Background(), drainTimeout)
+			cr.drainOrderDispatchers(drainCtx)
+			drainCancel()
+		}
 		running, listErr := cr.sp.ListRunning("")
 		if listErr != nil {
 			if runtime.IsPartialListError(listErr) {
@@ -1810,6 +2107,12 @@ func (cr *CityRuntime) shutdown() {
 				fmt.Fprintf(cr.stderr, "%s: shutdown session listing failed: %v\n", cr.logPrefix, listErr) //nolint:errcheck // best-effort stderr
 			}
 		}
-		gracefulStopAll(running, cr.sp, timeout, cr.rec, cr.cfg, cr.cityBeadStore(), cr.stdout, cr.stderr)
+		store := cr.cityBeadStore()
+		markCityStopSessionSleepReason(store, cr.stderr)
+		gracefulStopAll(running, cr.sp, gracefulTimeout, cr.rec, cr.cfg, store, cr.stdout, cr.stderr)
 	})
 }
+
+func (cr *CityRuntime) preserveSessionsOnShutdown() {
+	cr.preserveSessionsShutdown.Store(true)
+}
diff --git a/cmd/gc/city_runtime_test.go b/cmd/gc/city_runtime_test.go
index 059bc246e9..49c4ca439c 100644
--- a/cmd/gc/city_runtime_test.go
+++ b/cmd/gc/city_runtime_test.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -18,6 +19,7 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/orders"
 	"github.com/gastownhall/gascity/internal/runtime"
 	sessionauto "github.com/gastownhall/gascity/internal/runtime/auto"
 )
@@ -69,6 +71,35 @@ func TestSweepUndesiredPoolSessionBeads_KeepsRunningSessionsOpen(t *testing.T) {
 	}
 }
 
+// newTestCityRuntime builds a CityRuntime and registers a cleanup that
+// cancels in-flight dispatched orders before invoking shutdown. Do NOT
+// add a duplicate t.Cleanup(cr.shutdown) in callers — t.Cleanup is LIFO,
+// and a duplicate would consume cr.shutdownOnce before this wrapper's
+// cancel runs, reintroducing the .gc/ RemoveAll race.
+func newTestCityRuntime(t *testing.T, params CityRuntimeParams) *CityRuntime {
+	t.Helper()
+
+	cr := newCityRuntime(params)
+	t.Cleanup(func() {
+		// Tests pass context.Background to cr.tick, so dispatched orders
+		// cannot be canceled via tick ctx propagation. Type-assert to the
+		// concrete dispatcher (only it spawns subprocess goroutines that
+		// need cancellation; test fakes have nothing to interrupt).
+		cancelInflight(cr.od)
+		for _, od := range cr.retiredOrderDispatchers {
+			cancelInflight(od)
+		}
+		cr.shutdown()
+	})
+	return cr
+}
+
+func cancelInflight(od orderDispatcher) {
+	if m, ok := od.(*memoryOrderDispatcher); ok {
+		m.cancel()
+	}
+}
+
 func TestFilterReleasedAssignedWorkBeads_PreservesSameIDUnreleasedWork(t *testing.T) {
 	assigned := []beads.Bead{
 		{ID: "gc-1", Title: "released city work"},
@@ -104,6 +135,17 @@ func TestFilterReleasedAssignedWorkBeads_IgnoresMismatchedReleasedIndex(t *testi
 	}
 }
 
+type sessionSnapshotListFailStore struct {
+	beads.Store
+}
+
+func (s sessionSnapshotListFailStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == sessionBeadLabel {
+		return nil, errors.New("session snapshot unavailable")
+	}
+	return s.Store.List(query)
+}
+
 func TestCityRuntimeRequestDeferredDrainFollowUpTick_PokesOnce(t *testing.T) {
 	cr := &CityRuntime{
 		sessionDrains: newDrainTracker(),
@@ -132,6 +174,45 @@ func TestCityRuntimeRequestDeferredDrainFollowUpTick_PokesOnce(t *testing.T) {
 	}
 }
 
+func TestCityRuntimeShutdownMarksCityStopSleepReason(t *testing.T) {
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title:  "control-dispatcher",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "control-dispatcher",
+			"template":     "control-dispatcher",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cr := &CityRuntime{
+		cfg: &config.City{
+			Workspace: config.Workspace{Name: "test-city"},
+			Daemon:    config.DaemonConfig{ShutdownTimeout: "0s"},
+		},
+		sp:                  runtime.NewFake(),
+		rec:                 events.Discard,
+		standaloneCityStore: store,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
+	}
+
+	cr.shutdown()
+
+	got, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Metadata["sleep_reason"] != sleepReasonCityStop {
+		t.Fatalf("sleep_reason = %q, want %q", got.Metadata["sleep_reason"], sleepReasonCityStop)
+	}
+}
+
 func TestCityRuntimeDemandSnapshotReusesStablePatrolDemand(t *testing.T) {
 	buildCalls := 0
 	cr := &CityRuntime{
@@ -195,10 +276,402 @@ func TestCityRuntimeDemandSnapshotReusesStablePatrolDemand(t *testing.T) {
 	}
 }
 
+func TestCityRuntimeDemandSnapshotRetainsOnlyPoolScaleCheckPartials(t *testing.T) {
+	sessionBeads := newSessionBeadSnapshot([]beads.Bead{{
+		ID:     "session-worker",
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-123",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "awake",
+		},
+	}})
+
+	tests := []struct {
+		name   string
+		result DesiredStateResult
+		want   int
+	}{
+		{
+			name: "pool partial retains awake pool session",
+			result: DesiredStateResult{
+				State:                          map[string]TemplateParams{},
+				ScaleCheckCounts:               map[string]int{"worker": 0},
+				ScaleCheckPartialTemplates:     map[string]bool{"worker": true},
+				PoolScaleCheckPartialTemplates: map[string]bool{"worker": true},
+			},
+			want: 1,
+		},
+		{
+			name: "named partial does not retain generic pool session",
+			result: DesiredStateResult{
+				State:                           map[string]TemplateParams{},
+				ScaleCheckCounts:                map[string]int{"worker": 0},
+				ScaleCheckPartialTemplates:      map[string]bool{"worker": true},
+				NamedScaleCheckPartialTemplates: map[string]bool{"worker": true},
+			},
+			want: 0,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cr := &CityRuntime{
+				cityName: "test-city",
+				cityPath: t.TempDir(),
+				cfg: &config.City{
+					Workspace: config.Workspace{Name: "test-city"},
+					Agents: []config.Agent{{
+						Name:              "worker",
+						MinActiveSessions: intPtr(0),
+						MaxActiveSessions: intPtr(5),
+					}},
+				},
+				cs: &controllerState{
+					eventProv: events.NewFake(),
+				},
+				stderr: io.Discard,
+			}
+			cr.buildFnWithSessionBeads = func(*config.City, runtime.Provider, beads.Store, map[string]beads.Store, *sessionBeadSnapshot, *sessionReconcilerTraceCycle) DesiredStateResult {
+				return tc.result
+			}
+
+			snapshot := cr.loadDemandSnapshot(sessionBeads, nil, "poke", false)
+
+			if got := snapshot.result.PoolDesiredCounts["worker"]; got != tc.want {
+				t.Fatalf("PoolDesiredCounts[worker] = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestCityRuntimeAsyncStartLimiterUsesMaxWakesPerTick(t *testing.T) {
+	maxWakes := 7
+	cfg := &config.City{Daemon: config.DaemonConfig{MaxWakesPerTick: &maxWakes}}
+	cr := &CityRuntime{cfg: cfg}
+
+	if got := cr.ensureAsyncStartLimiter().capacity(); got != maxWakes {
+		t.Fatalf("limiter cap = %d, want %d", got, maxWakes)
+	}
+
+	maxWakes = 2
+	if got := cr.ensureAsyncStartLimiter().capacity(); got != maxWakes {
+		t.Fatalf("limiter cap after config change = %d, want %d", got, maxWakes)
+	}
+}
+
+func TestCityRuntimeAsyncStartLimiterResizePreservesInFlightBudget(t *testing.T) {
+	maxWakes := 3
+	cfg := &config.City{Daemon: config.DaemonConfig{MaxWakesPerTick: &maxWakes}}
+	cr := &CityRuntime{cfg: cfg}
+	limiter := cr.ensureAsyncStartLimiter()
+
+	var releases []func()
+	for i := 0; i < maxWakes; i++ {
+		release, reserved, outcome := reserveAsyncStartSlot(context.Background(), limiter)
+		if !reserved {
+			t.Fatalf("reserve initial slot = %s, want success", outcome)
+		}
+		releases = append(releases, release)
+	}
+
+	maxWakes = 2
+	resized := cr.ensureAsyncStartLimiter()
+	if resized != limiter {
+		t.Fatal("resized limiter should preserve the same in-flight reservation counter")
+	}
+	if got := resized.capacity(); got != maxWakes {
+		t.Fatalf("resized cap = %d, want %d", got, maxWakes)
+	}
+	if _, reserved, outcome := reserveAsyncStartSlot(context.Background(), resized); reserved || outcome != "deferred_by_async_start_limit" {
+		t.Fatalf("reserve while old slots exceed resized cap = reserved %v outcome %q, want deferred", reserved, outcome)
+	}
+
+	releases[0]()
+	if _, reserved, outcome := reserveAsyncStartSlot(context.Background(), resized); reserved || outcome != "deferred_by_async_start_limit" {
+		t.Fatalf("reserve at resized cap = reserved %v outcome %q, want deferred", reserved, outcome)
+	}
+	releases[1]()
+	release, reserved, outcome := reserveAsyncStartSlot(context.Background(), resized)
+	if !reserved {
+		t.Fatalf("reserve below resized cap = %s, want success", outcome)
+	}
+	release()
+	releases[2]()
+}
+
+type recordingOrderDispatcher struct {
+	called      atomic.Bool
+	calls       atomic.Int32
+	onDispatch  func(context.Context, string, time.Time)
+	drainCalls  int
+	drainCtxErr error
+}
+
+func (r *recordingOrderDispatcher) dispatch(ctx context.Context, cityRoot string, now time.Time) {
+	r.calls.Add(1)
+	r.called.Store(true)
+	if r.onDispatch != nil {
+		r.onDispatch(ctx, cityRoot, now)
+	}
+}
+
+func (r *recordingOrderDispatcher) drain(ctx context.Context) bool {
+	r.drainCalls++
+	r.drainCtxErr = ctx.Err()
+	return true
+}
+
+type blockingOrderDispatcher struct {
+	mu         sync.Mutex
+	drainCalls int
+	ctxErrs    []error
+	release    chan struct{}
+	drained    chan struct{}
+}
+
+func newBlockingOrderDispatcher() *blockingOrderDispatcher {
+	return &blockingOrderDispatcher{
+		release: make(chan struct{}),
+		drained: make(chan struct{}, 16),
+	}
+}
+
+func (b *blockingOrderDispatcher) dispatch(context.Context, string, time.Time) {}
+
+func (b *blockingOrderDispatcher) drain(ctx context.Context) bool {
+	b.mu.Lock()
+	b.drainCalls++
+	b.ctxErrs = append(b.ctxErrs, ctx.Err())
+	b.mu.Unlock()
+	b.drained <- struct{}{}
+	select {
+	case <-b.release:
+		return true
+	case <-ctx.Done():
+		return false
+	}
+}
+
+func (b *blockingOrderDispatcher) waitForDrainCalls(t *testing.T, want int) {
+	t.Helper()
+	deadline := time.After(500 * time.Millisecond)
+	for {
+		b.mu.Lock()
+		got := b.drainCalls
+		b.mu.Unlock()
+		if got >= want {
+			return
+		}
+		select {
+		case <-b.drained:
+		case <-deadline:
+			t.Fatalf("drainCalls = %d, want at least %d", got, want)
+		}
+	}
+}
+
+func (b *blockingOrderDispatcher) drainContextErrors() []error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return append([]error(nil), b.ctxErrs...)
+}
+
+func TestCityRuntimeTickDispatchesOrdersBeforeDemandSnapshot(t *testing.T) {
+	store := beads.NewMemStore()
+	od := &recordingOrderDispatcher{}
+	cr := &CityRuntime{
+		cityName:            "test-city",
+		cityPath:            t.TempDir(),
+		cfg:                 &config.City{Workspace: config.Workspace{Name: "test-city"}},
+		sp:                  runtime.NewFake(),
+		standaloneCityStore: store,
+		od:                  od,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
+	}
+	cr.buildFnWithSessionBeads = func(*config.City, runtime.Provider, beads.Store, map[string]beads.Store, *sessionBeadSnapshot, *sessionReconcilerTraceCycle) DesiredStateResult {
+		if !od.called.Load() {
+			t.Fatal("order dispatch should happen before demand snapshot build")
+		}
+		return DesiredStateResult{State: map[string]TemplateParams{}}
+	}
+
+	var dirty atomic.Bool
+	var lastProviderName string
+	var prevPoolRunning map[string]bool
+	cr.tick(context.Background(), &dirty, &lastProviderName, cr.cityPath, &prevPoolRunning, "patrol")
+
+	if !od.called.Load() {
+		t.Fatal("order dispatcher was not called")
+	}
+}
+
+func TestCityRuntimeRunDispatchesOrdersBeforeStartupReconcile(t *testing.T) {
+	cityPath := t.TempDir()
+	tomlPath := filepath.Join(cityPath, "city.toml")
+	writeCityRuntimeConfig(t, tomlPath, "fake")
+
+	cfg, err := config.Load(osFS{}, tomlPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	sp := runtime.NewFake()
+	od := &recordingOrderDispatcher{}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	var started atomic.Bool
+	cr := newCityRuntime(CityRuntimeParams{
+		CityPath: cityPath,
+		CityName: "test-city",
+		TomlPath: tomlPath,
+		Cfg:      cfg,
+		SP:       sp,
+		BuildFn: func(*config.City, runtime.Provider, beads.Store) DesiredStateResult {
+			if !od.called.Load() {
+				t.Fatal("order dispatch should happen before startup reconcile")
+			}
+			return DesiredStateResult{State: map[string]TemplateParams{}}
+		},
+		Dops: newDrainOps(sp),
+		Rec:  events.Discard,
+		OnStarted: func() {
+			started.Store(true)
+			cancel()
+		},
+		Stdout: io.Discard,
+		Stderr: io.Discard,
+	})
+	cr.od = od
+
+	cs := newControllerState(context.Background(), cfg, sp, events.NewFake(), "test-city", cityPath)
+	cs.cityBeadStore = beads.NewMemStore()
+	cr.setControllerState(cs)
+
+	cr.run(ctx)
+
+	if !started.Load() {
+		t.Fatal("OnStarted was not called")
+	}
+	if got := od.calls.Load(); got != 1 {
+		t.Fatalf("order dispatch calls = %d, want 1", got)
+	}
+}
+
+func TestCityRuntimeRunStartupOrderDispatchPanicIsRecovered(t *testing.T) {
+	cityPath := t.TempDir()
+	tomlPath := filepath.Join(cityPath, "city.toml")
+	writeCityRuntimeConfig(t, tomlPath, "fake")
+
+	cfg, err := config.Load(osFS{}, tomlPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	sp := runtime.NewFake()
+	od := &recordingOrderDispatcher{
+		onDispatch: func(context.Context, string, time.Time) {
+			panic("startup order boom")
+		},
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	var stderr bytes.Buffer
+	var started atomic.Bool
+	cr := newCityRuntime(CityRuntimeParams{
+		CityPath: cityPath,
+		CityName: "test-city",
+		TomlPath: tomlPath,
+		Cfg:      cfg,
+		SP:       sp,
+		BuildFn: func(*config.City, runtime.Provider, beads.Store) DesiredStateResult {
+			return DesiredStateResult{State: map[string]TemplateParams{}}
+		},
+		Dops: newDrainOps(sp),
+		Rec:  events.Discard,
+		OnStarted: func() {
+			started.Store(true)
+			cancel()
+		},
+		Stdout: io.Discard,
+		Stderr: &stderr,
+	})
+	cr.od = od
+
+	cs := newControllerState(context.Background(), cfg, sp, events.NewFake(), "test-city", cityPath)
+	cs.cityBeadStore = beads.NewMemStore()
+	cr.setControllerState(cs)
+
+	cr.run(ctx)
+
+	if !started.Load() {
+		t.Fatal("OnStarted was not called after recovered startup order panic")
+	}
+	if got := od.calls.Load(); got != 1 {
+		t.Fatalf("order dispatch calls = %d, want 1", got)
+	}
+	if !strings.Contains(stderr.String(), "trigger=startup-orders") {
+		t.Fatalf("stderr = %q, want startup-orders panic trigger", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "startup order boom") {
+		t.Fatalf("stderr = %q, want recovered panic detail", stderr.String())
+	}
+}
+
+func TestOrderTrackingSweepWatchdogOnlyClosesSweepOrderTracking(t *testing.T) {
+	store := beads.NewMemStore()
+	sweepTracking, err := store.Create(beads.Bead{
+		Title:  "order:" + orderTrackingSweepOrder,
+		Labels: []string{"order-run:" + orderTrackingSweepOrder, labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatalf("Create(sweep): %v", err)
+	}
+	mergeTracking, err := store.Create(beads.Bead{
+		Title:  "order:pr-merge-queue",
+		Labels: []string{"order-run:pr-merge-queue", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatalf("Create(merge): %v", err)
+	}
+
+	cr := &CityRuntime{
+		cityName:            "test-city",
+		cfg:                 &config.City{Workspace: config.Workspace{Name: "test-city"}},
+		standaloneCityStore: store,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
+		logPrefix:           "gc test",
+	}
+	cr.runOrderTrackingSweepWatchdog(time.Now().Add(orderTrackingSweepWatchdogStaleAfter + time.Second))
+
+	gotSweep, err := store.Get(sweepTracking.ID)
+	if err != nil {
+		t.Fatalf("Get(sweep): %v", err)
+	}
+	if gotSweep.Status != "closed" {
+		t.Fatalf("sweep tracking status = %s, want closed", gotSweep.Status)
+	}
+	gotMerge, err := store.Get(mergeTracking.ID)
+	if err != nil {
+		t.Fatalf("Get(merge): %v", err)
+	}
+	if gotMerge.Status != "open" {
+		t.Fatalf("merge tracking status = %s, want open", gotMerge.Status)
+	}
+}
+
 func TestCityRuntimeDemandSnapshotRefreshesWhenDemandCommandsAreCustom(t *testing.T) {
 	cases := []struct {
-		name  string
-		agent config.Agent
+		name       string
+		agent      config.Agent
+		wantBuilds int
 	}{
 		{
 			name: "custom scale_check",
@@ -206,6 +679,7 @@ func TestCityRuntimeDemandSnapshotRefreshesWhenDemandCommandsAreCustom(t *testin
 				Name:       "worker",
 				ScaleCheck: "test -f external-queue && echo 1 || echo 0",
 			},
+			wantBuilds: 2,
 		},
 		{
 			name: "custom work_query",
@@ -213,6 +687,7 @@ func TestCityRuntimeDemandSnapshotRefreshesWhenDemandCommandsAreCustom(t *testin
 				Name:      "worker",
 				WorkQuery: "gh issue list --json number --limit 1",
 			},
+			wantBuilds: 1,
 		},
 	}
 
@@ -240,13 +715,40 @@ func TestCityRuntimeDemandSnapshotRefreshesWhenDemandCommandsAreCustom(t *testin
 			_ = cr.loadDemandSnapshot(sessionBeads, nil, "patrol", false)
 			_ = cr.loadDemandSnapshot(sessionBeads, nil, "patrol", false)
 
-			if buildCalls != 2 {
-				t.Fatalf("buildDesiredState call count = %d, want 2 when demand command is not event-backed", buildCalls)
+			if buildCalls != tc.wantBuilds {
+				t.Fatalf("buildDesiredState call count = %d, want %d", buildCalls, tc.wantBuilds)
 			}
 		})
 	}
 }
 
+func TestCityRuntimeDemandSnapshotDoesNotRunControllerWorkQuery(t *testing.T) {
+	cr := &CityRuntime{
+		cityName: "test-city",
+		cityPath: t.TempDir(),
+		cfg: &config.City{
+			Workspace: config.Workspace{Name: "test-city"},
+			Agents: []config.Agent{{
+				Name:      "worker",
+				WorkQuery: `printf '[{"id":"work-1"}]'`,
+			}},
+		},
+		cs: &controllerState{
+			eventProv: events.NewFake(),
+		},
+		stderr: io.Discard,
+	}
+	cr.buildFnWithSessionBeads = func(*config.City, runtime.Provider, beads.Store, map[string]beads.Store, *sessionBeadSnapshot, *sessionReconcilerTraceCycle) DesiredStateResult {
+		return DesiredStateResult{State: map[string]TemplateParams{}}
+	}
+
+	snapshot := cr.loadDemandSnapshot(newSessionBeadSnapshot(nil), nil, "patrol", false)
+
+	if len(snapshot.result.WorkSet) != 0 {
+		t.Fatalf("WorkSet = %#v, want empty; controller demand must not run work_query", snapshot.result.WorkSet)
+	}
+}
+
 func TestCityRuntimeDemandSnapshotReplaysACPRoutesOnCacheHit(t *testing.T) {
 	defaultSP := runtime.NewFake()
 	acpSP := runtime.NewFake()
@@ -547,44 +1049,266 @@ func TestSweepUndesiredPoolSessionBeads_SkipsAwakeStateInPreWakeWindow(t *testin
 		runtime.NewFake(),
 		false,
 	)
-	if closed != 0 {
-		t.Fatalf("closed = %d, want 0 — state=awake in pre-wake window must receive same protection as state=active", closed)
+	if closed != 0 {
+		t.Fatalf("closed = %d, want 0 — state=awake in pre-wake window must receive same protection as state=active", closed)
+	}
+}
+
+// Recovery of an already-active bead (recoverRunningPendingCreate path:
+// state=active + pending_create_claim=true + alive runtime) must produce
+// a fresh creation_complete_at so the healed bead stays protected in the
+// pre-wake window on the following tick. This test asserts the sweep's
+// side of that contract — a state=active bead with a fresh
+// creation_complete_at and empty last_woke_at survives the sweep.
+func TestSweepUndesiredPoolSessionBeads_SkipsRecoveredActiveBead(t *testing.T) {
+	store := beads.NewMemStore()
+	bead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:worker"},
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-recovered",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			// Post-recovery shape: state was already active, recovery just
+			// cleared pending_create_claim and stamped a fresh marker.
+			"state":                "active",
+			"state_reason":         "creation_complete",
+			"creation_complete_at": time.Now().UTC().Format(time.RFC3339),
+			"last_woke_at":         "",
+			// Historical counters survive recovery.
+			"wake_attempts":      "1",
+			"continuation_epoch": "1",
+			"generation":         "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
+
+	closed := sweepUndesiredPoolSessionBeads(
+		store,
+		nil,
+		sessionBeads,
+		nil,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		runtime.NewFake(),
+		false,
+	)
+	if closed != 0 {
+		t.Fatalf("closed = %d, want 0 — recovered active bead with fresh marker must survive pre-wake", closed)
+	}
+}
+
+// Crashed-then-recently-restarted beads: wake_attempts/churn_count are
+// preserved across a successful restart (CommitStartedPatch does not reset
+// them), so the post-create guard CANNOT be keyed on those counters or a
+// legitimate restart after a prior crash would fall into the same spin
+// loop. Gating on a fresh creation_complete_at lets a just-restarted bead
+// survive the pre-wake window even when its historical counters are
+// non-zero.
+func TestSweepUndesiredPoolSessionBeads_SkipsFreshRestartAfterPriorCrash(t *testing.T) {
+	store := beads.NewMemStore()
+	bead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:worker"},
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-restart-after-crash",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			// Just-restarted after a prior crash: state transitioned back
+			// to active with a fresh creation_complete_at, but historical
+			// failure counters remain because clearWakeFailures only fires
+			// after the session is stable-long-enough.
+			"state":                "active",
+			"state_reason":         "creation_complete",
+			"creation_complete_at": time.Now().UTC().Format(time.RFC3339),
+			"wake_attempts":        "2",
+			"churn_count":          "1",
+			"continuation_epoch":   "1",
+			"generation":           "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
+
+	closed := sweepUndesiredPoolSessionBeads(
+		store,
+		nil,
+		sessionBeads,
+		nil,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		runtime.NewFake(),
+		false,
+	)
+	if closed != 0 {
+		t.Fatalf("closed = %d, want 0 — fresh restart after prior crash must survive the pre-wake window", closed)
+	}
+}
+
+// Crashed beads (state=active, last_woke_at="" cleared by checkStability,
+// creation_complete_at stale because the last successful start was long
+// ago) MUST be sweepable. checkStability/checkChurn/start-failure do not
+// touch creation_complete_at, so an old marker is the signal that the
+// state=active+empty-last_woke_at shape came from a crash-clear rather
+// than a fresh start.
+func TestSweepUndesiredPoolSessionBeads_SweepsCrashedActiveBead(t *testing.T) {
+	store := beads.NewMemStore()
+	bead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:worker"},
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-crashed",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "active",
+			"state_reason":         "creation_complete",
+			"creation_complete_at": time.Now().Add(-2 * time.Minute).UTC().Format(time.RFC3339),
+			"last_woke_at":         "",
+			"wake_attempts":        "1",
+			"continuation_epoch":   "1",
+			"generation":           "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
+
+	closed := sweepUndesiredPoolSessionBeads(
+		store,
+		nil,
+		sessionBeads,
+		nil,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		runtime.NewFake(),
+		false,
+	)
+	if closed != 1 {
+		t.Fatalf("closed = %d, want 1 — crashed bead with stale creation_complete_at must be swept", closed)
+	}
+}
+
+func TestSweepUndesiredPoolSessionBeads_SkipsPendingCreateClaim(t *testing.T) {
+	store := beads.NewMemStore()
+	bead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:worker"},
+		Metadata: map[string]string{
+			"session_name":         "worker-bd-123",
+			"template":             "worker",
+			"agent_name":           "worker",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"pending_create_claim": "true",
+			"continuation_epoch":   "1",
+			"generation":           "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
+
+	closed := sweepUndesiredPoolSessionBeads(
+		store,
+		nil,
+		sessionBeads,
+		nil,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		runtime.NewFake(),
+		false,
+	)
+	if closed != 0 {
+		t.Fatalf("closed = %d, want 0 — pending_create_claim must be preserved", closed)
+	}
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("bead with pending_create_claim was swept closed: %+v", got)
+	}
+}
+
+// #1460: pending_create_claim stays protected only for the pending-create
+// lease. Once a never-started create ages past that lease, the sweep must
+// reap it instead of preserving the pool slot forever.
+func TestSweepUndesiredPoolSessionBeads_SweepsExpiredPendingCreateClaimLease(t *testing.T) {
+	store := beads.NewMemStore()
+	now := time.Now().UTC()
+	bead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:worker"},
+		Metadata: map[string]string{
+			"session_name":              "worker-bd-stale-claim",
+			"template":                  "worker",
+			"agent_name":                "worker",
+			"pool_slot":                 "1",
+			"state":                     "creating",
+			poolManagedMetadataKey:      boolMetadata(true),
+			"pending_create_claim":      "true",
+			"pending_create_started_at": pendingCreateStartedAtNow(now.Add(-(pendingCreateNeverStartedTimeout + time.Second))),
+			"continuation_epoch":        "1",
+			"generation":                "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	bead.CreatedAt = now.Add(-24 * time.Hour)
+	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
+
+	closed := sweepUndesiredPoolSessionBeads(
+		store,
+		nil,
+		sessionBeads,
+		nil,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		runtime.NewFake(),
+		false,
+	)
+	if closed != 1 {
+		t.Fatalf("closed = %d, want 1 — expired pending_create_claim lease must be reaped", closed)
 	}
 }
 
-// Recovery of an already-active bead (recoverRunningPendingCreate path:
-// state=active + pending_create_claim=true + alive runtime) must produce
-// a fresh creation_complete_at so the healed bead stays protected in the
-// pre-wake window on the following tick. This test asserts the sweep's
-// side of that contract — a state=active bead with a fresh
-// creation_complete_at and empty last_woke_at survives the sweep.
-func TestSweepUndesiredPoolSessionBeads_SkipsRecoveredActiveBead(t *testing.T) {
+func TestSweepUndesiredPoolSessionBeads_UsesPendingCreateStartedAtForCreatingState(t *testing.T) {
 	store := beads.NewMemStore()
+	now := time.Now().UTC()
 	bead, err := store.Create(beads.Bead{
 		Title:  "worker",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
-			"session_name":         "worker-bd-recovered",
-			"template":             "worker",
-			"agent_name":           "worker",
-			"pool_slot":            "1",
-			poolManagedMetadataKey: boolMetadata(true),
-			// Post-recovery shape: state was already active, recovery just
-			// cleared pending_create_claim and stamped a fresh marker.
-			"state":                "active",
-			"state_reason":         "creation_complete",
-			"creation_complete_at": time.Now().UTC().Format(time.RFC3339),
-			"last_woke_at":         "",
-			// Historical counters survive recovery.
-			"wake_attempts":      "1",
-			"continuation_epoch": "1",
-			"generation":         "1",
+			"session_name":              "worker-bd-fresh-create",
+			"template":                  "worker",
+			"agent_name":                "worker",
+			"pool_slot":                 "1",
+			poolManagedMetadataKey:      boolMetadata(true),
+			"state":                     "creating",
+			"pending_create_started_at": pendingCreateStartedAtNow(now.Add(-30 * time.Second)),
+			"continuation_epoch":        "1",
+			"generation":                "1",
 		},
 	})
 	if err != nil {
 		t.Fatalf("Create: %v", err)
 	}
+	bead.CreatedAt = now.Add(-2 * time.Minute)
 	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
 
 	closed := sweepUndesiredPoolSessionBeads(
@@ -597,38 +1321,38 @@ func TestSweepUndesiredPoolSessionBeads_SkipsRecoveredActiveBead(t *testing.T) {
 		false,
 	)
 	if closed != 0 {
-		t.Fatalf("closed = %d, want 0 — recovered active bead with fresh marker must survive pre-wake", closed)
+		t.Fatalf("closed = %d, want 0 — fresh pending_create_started_at must keep old creating bead alive", closed)
 	}
 }
 
-// Crashed-then-recently-restarted beads: wake_attempts/churn_count are
-// preserved across a successful restart (CommitStartedPatch does not reset
-// them), so the post-create guard CANNOT be keyed on those counters or a
-// legitimate restart after a prior crash would fall into the same spin
-// loop. Gating on a fresh creation_complete_at lets a just-restarted bead
-// survive the pre-wake window even when its historical counters are
-// non-zero.
-func TestSweepUndesiredPoolSessionBeads_SkipsFreshRestartAfterPriorCrash(t *testing.T) {
+func TestIsStaleCreatingTreatsZeroPendingCreateStartedAtAsMissing(t *testing.T) {
+	now := time.Now().UTC()
+	bead := beads.Bead{
+		Metadata: map[string]string{
+			"state":                     "creating",
+			"pending_create_started_at": (time.Time{}).UTC().Format(time.RFC3339),
+		},
+		CreatedAt: now,
+	}
+
+	if isStaleCreating(bead) {
+		t.Fatal("zero pending_create_started_at should fall back to fresh CreatedAt")
+	}
+}
+
+func TestSweepUndesiredPoolSessionBeads_ClosesStoppedSessions(t *testing.T) {
 	store := beads.NewMemStore()
 	bead, err := store.Create(beads.Bead{
 		Title:  "worker",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
-			"session_name":         "worker-bd-restart-after-crash",
+			"session_name":         "worker-bd-123",
 			"template":             "worker",
 			"agent_name":           "worker",
 			"pool_slot":            "1",
 			poolManagedMetadataKey: boolMetadata(true),
-			// Just-restarted after a prior crash: state transitioned back
-			// to active with a fresh creation_complete_at, but historical
-			// failure counters remain because clearWakeFailures only fires
-			// after the session is stable-long-enough.
-			"state":                "active",
-			"state_reason":         "creation_complete",
-			"creation_complete_at": time.Now().UTC().Format(time.RFC3339),
-			"wake_attempts":        "2",
-			"churn_count":          "1",
+			"state":                "drained",
 			"continuation_epoch":   "1",
 			"generation":           "1",
 		},
@@ -647,40 +1371,45 @@ func TestSweepUndesiredPoolSessionBeads_SkipsFreshRestartAfterPriorCrash(t *test
 		runtime.NewFake(),
 		false,
 	)
-	if closed != 0 {
-		t.Fatalf("closed = %d, want 0 — fresh restart after prior crash must survive the pre-wake window", closed)
+	if closed != 1 {
+		t.Fatalf("closed = %d, want 1", closed)
+	}
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("stopped pool bead status = %q, want closed", got.Status)
 	}
 }
 
-// Crashed beads (state=active, last_woke_at="" cleared by checkStability,
-// creation_complete_at stale because the last successful start was long
-// ago) MUST be sweepable. checkStability/checkChurn/start-failure do not
-// touch creation_complete_at, so an old marker is the signal that the
-// state=active+empty-last_woke_at shape came from a crash-clear rather
-// than a fresh start.
-func TestSweepUndesiredPoolSessionBeads_SweepsCrashedActiveBead(t *testing.T) {
+func TestSweepUndesiredPoolSessionBeads_KeepsAssignedSessionsOpen(t *testing.T) {
 	store := beads.NewMemStore()
 	bead, err := store.Create(beads.Bead{
 		Title:  "worker",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
-			"session_name":         "worker-bd-crashed",
+			"session_name":         "worker-bd-123",
 			"template":             "worker",
 			"agent_name":           "worker",
 			"pool_slot":            "1",
 			poolManagedMetadataKey: boolMetadata(true),
-			"state":                "active",
-			"state_reason":         "creation_complete",
-			"creation_complete_at": time.Now().Add(-2 * time.Minute).UTC().Format(time.RFC3339),
-			"last_woke_at":         "",
-			"wake_attempts":        "1",
+			"state":                "asleep",
 			"continuation_epoch":   "1",
 			"generation":           "1",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatalf("Create session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:    "assigned work",
+		Type:     "task",
+		Status:   "in_progress",
+		Assignee: "worker-bd-123",
+	}); err != nil {
+		t.Fatalf("Create work bead: %v", err)
 	}
 	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
 
@@ -693,12 +1422,19 @@ func TestSweepUndesiredPoolSessionBeads_SweepsCrashedActiveBead(t *testing.T) {
 		runtime.NewFake(),
 		false,
 	)
-	if closed != 1 {
-		t.Fatalf("closed = %d, want 1 — crashed bead with stale creation_complete_at must be swept", closed)
+	if closed != 0 {
+		t.Fatalf("closed = %d, want 0", closed)
+	}
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("assigned pool bead was swept closed: %+v", got)
 	}
 }
 
-func TestSweepUndesiredPoolSessionBeads_SkipsPendingCreateClaim(t *testing.T) {
+func TestSweepUndesiredPoolSessionBeads_SkipsPartialAssignedSnapshot(t *testing.T) {
 	store := beads.NewMemStore()
 	bead, err := store.Create(beads.Bead{
 		Title:  "worker",
@@ -710,7 +1446,7 @@ func TestSweepUndesiredPoolSessionBeads_SkipsPendingCreateClaim(t *testing.T) {
 			"agent_name":           "worker",
 			"pool_slot":            "1",
 			poolManagedMetadataKey: boolMetadata(true),
-			"pending_create_claim": "true",
+			"state":                "drained",
 			"continuation_epoch":   "1",
 			"generation":           "1",
 		},
@@ -727,66 +1463,108 @@ func TestSweepUndesiredPoolSessionBeads_SkipsPendingCreateClaim(t *testing.T) {
 		nil,
 		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
 		runtime.NewFake(),
-		false,
+		true,
 	)
 	if closed != 0 {
-		t.Fatalf("closed = %d, want 0 — pending_create_claim must be preserved", closed)
+		t.Fatalf("closed = %d, want 0", closed)
 	}
 	got, err := store.Get(bead.ID)
 	if err != nil {
 		t.Fatalf("Get: %v", err)
 	}
 	if got.Status == "closed" {
-		t.Fatalf("bead with pending_create_claim was swept closed: %+v", got)
+		t.Fatalf("partial assigned-work snapshot should suppress sweep: %+v", got)
 	}
 }
 
-// pending_create_claim is an authoritative ownership flag for the lifecycle
-// reconciler (sessionStartRequested in session_reconcile.go). The sweep must
-// honor that contract regardless of age — expiring it here would let the
-// sweep close a bead the reconciler still considers live.
-func TestSweepUndesiredPoolSessionBeads_SkipsStalePendingCreateClaim(t *testing.T) {
+func TestCityRuntimeBeadReconcileTick_TransientStoreQueryPartialKeepsRunningPoolSessionUntilRecoveryTick(t *testing.T) {
 	store := beads.NewMemStore()
-	bead, err := store.Create(beads.Bead{
+	session, err := store.Create(beads.Bead{
 		Title:  "worker",
 		Type:   sessionBeadType,
+		Status: "open",
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
-			"session_name":         "worker-bd-stale-claim",
+			"session_name":         "worker-bd-123",
 			"template":             "worker",
 			"agent_name":           "worker",
 			"pool_slot":            "1",
 			poolManagedMetadataKey: boolMetadata(true),
-			"pending_create_claim": "true",
+			"state":                "awake",
 			"continuation_epoch":   "1",
 			"generation":           "1",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatalf("Create session bead: %v", err)
 	}
-	bead.CreatedAt = time.Now().Add(-2 * time.Minute)
-	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
 
-	closed := sweepUndesiredPoolSessionBeads(
-		store,
-		nil,
-		sessionBeads,
-		nil,
-		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
-		runtime.NewFake(),
-		false,
-	)
-	if closed != 0 {
-		t.Fatalf("closed = %d, want 0 — pending_create_claim must remain authoritative regardless of age", closed)
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker-bd-123", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	cr := &CityRuntime{
+		cityPath:            t.TempDir(),
+		cityName:            "maintainer-city",
+		cfg:                 &config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}}},
+		sp:                  sp,
+		standaloneCityStore: store,
+		sessionDrains:       newDrainTracker(),
+		rec:                 events.Discard,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
+	}
+
+	partialResult := DesiredStateResult{
+		State:             map[string]TemplateParams{},
+		ScaleCheckCounts:  map[string]int{"worker": 0},
+		StoreQueryPartial: true,
+	}
+	cr.beadReconcileTick(context.Background(), partialResult, newSessionBeadSnapshot([]beads.Bead{session}), nil)
+
+	afterPartial, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after partial tick: %v", err)
+	}
+	if afterPartial.Status == "closed" {
+		t.Fatalf("partial tick closed running session: %+v", afterPartial)
+	}
+	if !sp.IsRunning("worker-bd-123") {
+		t.Fatal("partial tick should not stop the running worker")
+	}
+
+	recoveredResult := DesiredStateResult{
+		State:            map[string]TemplateParams{},
+		ScaleCheckCounts: map[string]int{"worker": 0},
+		AssignedWorkBeads: []beads.Bead{
+			workBead("ga-live", "worker", "worker-bd-123", "in_progress", 5),
+		},
+	}
+	cr.beadReconcileTick(context.Background(), recoveredResult, cr.loadSessionBeadSnapshot(), nil)
+
+	afterRecovered, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after recovered tick: %v", err)
+	}
+	if afterRecovered.Status == "closed" {
+		t.Fatalf("recovered tick closed running session: %+v", afterRecovered)
+	}
+	if state := afterRecovered.Metadata["state"]; state == "drained" || state == "asleep" {
+		t.Fatalf("recovered tick state = %q, want active/awake", state)
+	}
+	if !sp.IsRunning("worker-bd-123") {
+		t.Fatal("recovered tick should keep the worker running")
 	}
 }
 
-func TestSweepUndesiredPoolSessionBeads_ClosesStoppedSessions(t *testing.T) {
+func TestCityRuntimeBeadReconcileTick_ScaleCheckPartialKeepsOnlyAffectedPoolSession(t *testing.T) {
 	store := beads.NewMemStore()
-	bead, err := store.Create(beads.Bead{
+	worker, err := store.Create(beads.Bead{
+		ID:     "session-worker",
 		Title:  "worker",
 		Type:   sessionBeadType,
+		Status: "open",
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
 			"session_name":         "worker-bd-123",
@@ -794,42 +1572,101 @@ func TestSweepUndesiredPoolSessionBeads_ClosesStoppedSessions(t *testing.T) {
 			"agent_name":           "worker",
 			"pool_slot":            "1",
 			poolManagedMetadataKey: boolMetadata(true),
-			"state":                "drained",
-			"continuation_epoch":   "1",
+			"state":                "awake",
 			"generation":           "1",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatalf("Create worker session: %v", err)
+	}
+	helper, err := store.Create(beads.Bead{
+		ID:     "session-helper",
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel, "agent:helper"},
+		Metadata: map[string]string{
+			"session_name":         "helper-bd-123",
+			"template":             "helper",
+			"agent_name":           "helper",
+			"pool_slot":            "1",
+			poolManagedMetadataKey: boolMetadata(true),
+			"state":                "awake",
+			"generation":           "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create helper session: %v", err)
 	}
-	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
 
-	closed := sweepUndesiredPoolSessionBeads(
-		store,
-		nil,
-		sessionBeads,
-		nil,
-		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
-		runtime.NewFake(),
-		false,
-	)
-	if closed != 1 {
-		t.Fatalf("closed = %d, want 1", closed)
+	sp := runtime.NewFake()
+	for _, name := range []string{"worker-bd-123", "helper-bd-123"} {
+		if err := sp.Start(context.Background(), name, runtime.Config{}); err != nil {
+			t.Fatalf("Start(%s): %v", name, err)
+		}
 	}
-	got, err := store.Get(bead.ID)
-	if err != nil {
-		t.Fatalf("Get: %v", err)
+
+	cityPath := t.TempDir()
+	cfg := &config.City{Agents: []config.Agent{
+		{
+			Name:              "worker",
+			StartCommand:      "echo",
+			ScaleCheck:        "exit 42",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(5),
+		},
+		{
+			Name:              "helper",
+			StartCommand:      "echo",
+			ScaleCheck:        "printf 0",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(5),
+		},
+	}}
+	cr := &CityRuntime{
+		cityPath:            cityPath,
+		cityName:            "maintainer-city",
+		cfg:                 cfg,
+		sp:                  sp,
+		standaloneCityStore: store,
+		sessionDrains:       newDrainTracker(),
+		rec:                 events.Discard,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
 	}
-	if got.Status != "closed" {
-		t.Fatalf("stopped pool bead status = %q, want closed", got.Status)
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{worker, helper})
+	var stderr strings.Builder
+	result := buildDesiredStateWithSessionBeads("maintainer-city", cityPath, time.Now().UTC(), cfg, sp, store, nil, snapshot, nil, &stderr)
+	if result.StoreQueryPartial {
+		t.Fatalf("StoreQueryPartial = true, want false for scoped scale_check failure; stderr=%s", stderr.String())
+	}
+	if !result.ScaleCheckPartialTemplates["worker"] || result.ScaleCheckPartialTemplates["helper"] {
+		t.Fatalf("ScaleCheckPartialTemplates = %v, want only worker", result.ScaleCheckPartialTemplates)
+	}
+	cr.beadReconcileTick(context.Background(), result, snapshot, nil)
+
+	if drain := cr.sessionDrains.get(worker.ID); drain != nil {
+		t.Fatalf("affected worker session was scheduled for drain: reason=%s", drain.reason)
+	}
+	if cr.sessionDrains.get(helper.ID) == nil {
+		t.Fatal("unaffected helper session was not scheduled for drain")
+	}
+	if !sp.IsRunning("worker-bd-123") {
+		t.Fatal("affected worker session should remain running")
+	}
+	if !sp.IsRunning("helper-bd-123") {
+		t.Fatal("helper drain should be asynchronous and not stop immediately")
 	}
 }
 
-func TestSweepUndesiredPoolSessionBeads_KeepsAssignedSessionsOpen(t *testing.T) {
+func TestCityRuntimeBeadReconcileTick_ScaleCheckPartialPreservesDormantAffectedPoolSessionWithoutDrain(t *testing.T) {
 	store := beads.NewMemStore()
-	bead, err := store.Create(beads.Bead{
+	worker, err := store.Create(beads.Bead{
+		ID:     "session-worker",
 		Title:  "worker",
 		Type:   sessionBeadType,
+		Status: "open",
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
 			"session_name":         "worker-bd-123",
@@ -838,119 +1675,138 @@ func TestSweepUndesiredPoolSessionBeads_KeepsAssignedSessionsOpen(t *testing.T)
 			"pool_slot":            "1",
 			poolManagedMetadataKey: boolMetadata(true),
 			"state":                "asleep",
-			"continuation_epoch":   "1",
 			"generation":           "1",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create session bead: %v", err)
+		t.Fatalf("Create worker session: %v", err)
 	}
-	if _, err := store.Create(beads.Bead{
-		Title:    "assigned work",
-		Type:     "task",
-		Status:   "in_progress",
-		Assignee: "worker-bd-123",
-	}); err != nil {
-		t.Fatalf("Create work bead: %v", err)
+
+	sp := runtime.NewFake()
+	cityPath := t.TempDir()
+	cfg := &config.City{Agents: []config.Agent{{
+		Name:              "worker",
+		StartCommand:      "echo",
+		ScaleCheck:        "exit 42",
+		MinActiveSessions: intPtr(0),
+		MaxActiveSessions: intPtr(5),
+	}}}
+	cr := &CityRuntime{
+		cityPath:            cityPath,
+		cityName:            "maintainer-city",
+		cfg:                 cfg,
+		sp:                  sp,
+		standaloneCityStore: store,
+		sessionDrains:       newDrainTracker(),
+		rec:                 events.Discard,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
 	}
-	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
 
-	closed := sweepUndesiredPoolSessionBeads(
-		store,
-		nil,
-		sessionBeads,
-		nil,
-		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
-		runtime.NewFake(),
-		false,
-	)
-	if closed != 0 {
-		t.Fatalf("closed = %d, want 0", closed)
+	snapshot := newSessionBeadSnapshot([]beads.Bead{worker})
+	var stderr strings.Builder
+	result := buildDesiredStateWithSessionBeads("maintainer-city", cityPath, time.Now().UTC(), cfg, sp, store, nil, snapshot, nil, &stderr)
+	if _, ok := result.State["worker-bd-123"]; !ok {
+		t.Fatalf("affected dormant worker session not preserved in desired state: keys=%v stderr=%s", mapKeys(result.State), stderr.String())
 	}
-	got, err := store.Get(bead.ID)
+
+	cr.beadReconcileTick(context.Background(), result, snapshot, nil)
+
+	if drain := cr.sessionDrains.get(worker.ID); drain != nil {
+		t.Fatalf("affected dormant worker session was scheduled for drain: reason=%s", drain.reason)
+	}
+	got, err := store.Get(worker.ID)
 	if err != nil {
-		t.Fatalf("Get: %v", err)
+		t.Fatalf("Get worker session: %v", err)
 	}
 	if got.Status == "closed" {
-		t.Fatalf("assigned pool bead was swept closed: %+v", got)
+		t.Fatalf("affected dormant worker session was closed: %+v", got)
+	}
+	if state := got.Metadata["state"]; state != "asleep" {
+		t.Fatalf("affected dormant worker state = %q, want asleep", state)
+	}
+	if sp.IsRunning("worker-bd-123") {
+		t.Fatal("affected dormant worker should not be woken by scale_check retention")
 	}
 }
 
-func TestSweepUndesiredPoolSessionBeads_SkipsPartialAssignedSnapshot(t *testing.T) {
+func TestCityRuntimeBeadReconcileTick_StoreQueryPartialDoesNotReleaseAssignedWork(t *testing.T) {
 	store := beads.NewMemStore()
-	bead, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "agent:worker"},
+	work, err := store.Create(beads.Bead{
+		ID:       "ga-live",
+		Title:    "live assigned work from partial snapshot",
+		Type:     "task",
+		Status:   "in_progress",
+		Assignee: "worker-session",
 		Metadata: map[string]string{
-			"session_name":         "worker-bd-123",
-			"template":             "worker",
-			"agent_name":           "worker",
-			"pool_slot":            "1",
-			poolManagedMetadataKey: boolMetadata(true),
-			"state":                "drained",
-			"continuation_epoch":   "1",
-			"generation":           "1",
+			"gc.routed_to": "worker",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatalf("Create work bead: %v", err)
 	}
-	sessionBeads := newSessionBeadSnapshot([]beads.Bead{bead})
+	inProgress := "in_progress"
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatalf("mark work in_progress: %v", err)
+	}
+	work.Status = inProgress
 
-	closed := sweepUndesiredPoolSessionBeads(
-		store,
-		nil,
-		sessionBeads,
-		nil,
-		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
-		runtime.NewFake(),
-		true,
-	)
-	if closed != 0 {
-		t.Fatalf("closed = %d, want 0", closed)
+	cr := &CityRuntime{
+		cityPath:            t.TempDir(),
+		cityName:            "maintainer-city",
+		cfg:                 &config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}}},
+		sp:                  runtime.NewFake(),
+		standaloneCityStore: store,
+		sessionDrains:       newDrainTracker(),
+		rec:                 events.Discard,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
 	}
-	got, err := store.Get(bead.ID)
+
+	cr.beadReconcileTick(context.Background(), DesiredStateResult{
+		State:              map[string]TemplateParams{},
+		ScaleCheckCounts:   map[string]int{"worker": 0},
+		AssignedWorkBeads:  []beads.Bead{work},
+		AssignedWorkStores: []beads.Store{store},
+		StoreQueryPartial:  true,
+	}, newSessionBeadSnapshot(nil), nil)
+
+	got, err := store.Get(work.ID)
 	if err != nil {
-		t.Fatalf("Get: %v", err)
+		t.Fatalf("Get work after partial tick: %v", err)
 	}
-	if got.Status == "closed" {
-		t.Fatalf("partial assigned-work snapshot should suppress sweep: %+v", got)
+	if got.Status != "in_progress" || got.Assignee != "worker-session" {
+		t.Fatalf("partial assigned-work snapshot released work: status=%q assignee=%q", got.Status, got.Assignee)
 	}
 }
 
-func TestCityRuntimeBeadReconcileTick_TransientStoreQueryPartialKeepsRunningPoolSessionUntilRecoveryTick(t *testing.T) {
-	store := beads.NewMemStore()
-	session, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   sessionBeadType,
-		Status: "open",
-		Labels: []string{sessionBeadLabel, "agent:worker"},
+func TestCityRuntimeBeadReconcileTick_SessionQueryPartialDoesNotReleaseAssignedWork(t *testing.T) {
+	base := beads.NewMemStore()
+	store := sessionSnapshotListFailStore{Store: base}
+	work, err := base.Create(beads.Bead{
+		ID:       "ga-live",
+		Title:    "live assigned work from partial session snapshot",
+		Type:     "task",
+		Status:   "in_progress",
+		Assignee: "worker-session",
 		Metadata: map[string]string{
-			"session_name":         "worker-bd-123",
-			"template":             "worker",
-			"agent_name":           "worker",
-			"pool_slot":            "1",
-			poolManagedMetadataKey: boolMetadata(true),
-			"state":                "awake",
-			"continuation_epoch":   "1",
-			"generation":           "1",
+			"gc.routed_to": "worker",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create session bead: %v", err)
+		t.Fatalf("Create work bead: %v", err)
 	}
-
-	sp := runtime.NewFake()
-	if err := sp.Start(context.Background(), "worker-bd-123", runtime.Config{}); err != nil {
-		t.Fatalf("Start: %v", err)
+	inProgress := "in_progress"
+	if err := base.Update(work.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatalf("mark work in_progress: %v", err)
 	}
+	work.Status = inProgress
 
 	cr := &CityRuntime{
 		cityPath:            t.TempDir(),
 		cityName:            "maintainer-city",
 		cfg:                 &config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}}},
-		sp:                  sp,
+		sp:                  runtime.NewFake(),
 		standaloneCityStore: store,
 		sessionDrains:       newDrainTracker(),
 		rec:                 events.Discard,
@@ -958,45 +1814,19 @@ func TestCityRuntimeBeadReconcileTick_TransientStoreQueryPartialKeepsRunningPool
 		stderr:              io.Discard,
 	}
 
-	partialResult := DesiredStateResult{
-		State:             map[string]TemplateParams{},
-		ScaleCheckCounts:  map[string]int{"worker": 0},
-		StoreQueryPartial: true,
-	}
-	cr.beadReconcileTick(context.Background(), partialResult, newSessionBeadSnapshot([]beads.Bead{session}), nil)
-
-	afterPartial, err := store.Get(session.ID)
-	if err != nil {
-		t.Fatalf("Get after partial tick: %v", err)
-	}
-	if afterPartial.Status == "closed" {
-		t.Fatalf("partial tick closed running session: %+v", afterPartial)
-	}
-	if !sp.IsRunning("worker-bd-123") {
-		t.Fatal("partial tick should not stop the running worker")
-	}
-
-	recoveredResult := DesiredStateResult{
-		State:            map[string]TemplateParams{},
-		ScaleCheckCounts: map[string]int{"worker": 0},
-		AssignedWorkBeads: []beads.Bead{
-			workBead("ga-live", "worker", "worker-bd-123", "in_progress", 5),
-		},
-	}
-	cr.beadReconcileTick(context.Background(), recoveredResult, cr.loadSessionBeadSnapshot(), nil)
+	cr.beadReconcileTick(context.Background(), DesiredStateResult{
+		State:              map[string]TemplateParams{},
+		ScaleCheckCounts:   map[string]int{"worker": 0},
+		AssignedWorkBeads:  []beads.Bead{work},
+		AssignedWorkStores: []beads.Store{store},
+	}, nil, nil)
 
-	afterRecovered, err := store.Get(session.ID)
+	got, err := base.Get(work.ID)
 	if err != nil {
-		t.Fatalf("Get after recovered tick: %v", err)
-	}
-	if afterRecovered.Status == "closed" {
-		t.Fatalf("recovered tick closed running session: %+v", afterRecovered)
-	}
-	if state := afterRecovered.Metadata["state"]; state == "drained" || state == "asleep" {
-		t.Fatalf("recovered tick state = %q, want active/awake", state)
+		t.Fatalf("Get work after partial tick: %v", err)
 	}
-	if !sp.IsRunning("worker-bd-123") {
-		t.Fatal("recovered tick should keep the worker running")
+	if got.Status != "in_progress" || got.Assignee != "worker-session" {
+		t.Fatalf("partial session snapshot released work: status=%q assignee=%q", got.Status, got.Assignee)
 	}
 }
 
@@ -1091,7 +1921,7 @@ func TestCityRuntimeBeadReconcileTick_KeepsAssignedPoolWorkerAwake(t *testing.T)
 		Status: "open",
 		Labels: []string{sessionBeadLabel, "agent:gascity/claude"},
 		Metadata: map[string]string{
-			"session_name":         "claude-mc-live",
+			"session_name":         "claude-real-world-app-live",
 			"template":             "gascity/claude",
 			"agent_name":           "gascity/claude",
 			"pool_slot":            "1",
@@ -1106,7 +1936,7 @@ func TestCityRuntimeBeadReconcileTick_KeepsAssignedPoolWorkerAwake(t *testing.T)
 	}
 
 	sp := runtime.NewFake()
-	if err := sp.Start(context.Background(), "claude-mc-live", runtime.Config{}); err != nil {
+	if err := sp.Start(context.Background(), "claude-real-world-app-live", runtime.Config{}); err != nil {
 		t.Fatalf("Start: %v", err)
 	}
 
@@ -1126,7 +1956,7 @@ func TestCityRuntimeBeadReconcileTick_KeepsAssignedPoolWorkerAwake(t *testing.T)
 		State:            map[string]TemplateParams{},
 		ScaleCheckCounts: map[string]int{"gascity/claude": 0},
 		AssignedWorkBeads: []beads.Bead{
-			workBead("ga-live", "gascity/claude", "claude-mc-live", "in_progress", 5),
+			workBead("ga-live", "gascity/claude", "claude-real-world-app-live", "in_progress", 5),
 		},
 	}
 
@@ -1143,7 +1973,7 @@ func TestCityRuntimeBeadReconcileTick_KeepsAssignedPoolWorkerAwake(t *testing.T)
 	if state := got.Metadata["state"]; state == "drained" || state == "asleep" {
 		t.Fatalf("assigned pool worker state = %q, want active/awake", state)
 	}
-	if !sp.IsRunning("claude-mc-live") {
+	if !sp.IsRunning("claude-real-world-app-live") {
 		t.Fatal("assigned pool worker should still be running")
 	}
 }
@@ -1156,7 +1986,7 @@ func TestCityRuntimeBeadReconcileTick_SweepRespectsLiveAssignedWork(t *testing.T
 		Status: "open",
 		Labels: []string{sessionBeadLabel, "agent:worker"},
 		Metadata: map[string]string{
-			"session_name":         "worker-mc-live",
+			"session_name":         "worker-real-world-app-live",
 			"template":             "worker",
 			"agent_name":           "worker",
 			"pool_slot":            "1",
@@ -1179,7 +2009,7 @@ func TestCityRuntimeBeadReconcileTick_SweepRespectsLiveAssignedWork(t *testing.T
 		Title:    "future work",
 		Type:     "task",
 		Status:   "open",
-		Assignee: "worker-mc-live",
+		Assignee: "worker-real-world-app-live",
 		Metadata: map[string]string{"gc.routed_to": "worker"},
 	}); err != nil {
 		t.Fatalf("Create work bead: %v", err)
@@ -1493,7 +2323,7 @@ func TestCityRuntimeReloadProviderSwapPreservesDrainTracker(t *testing.T) {
 	}
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -1542,7 +2372,7 @@ func TestCityRuntimeReloadProviderSwapFailsOnPartialSessionListing(t *testing.T)
 	}
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -1592,7 +2422,7 @@ func TestCityRuntimeReloadProviderSwapFailsOnSessionListingError(t *testing.T) {
 	}
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -1639,7 +2469,7 @@ func TestCityRuntimeReloadAllowsRegistryAliasDifferentFromWorkspaceName(t *testi
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "machine-alias",
 		TomlPath: tomlPath,
@@ -1683,7 +2513,7 @@ func TestCityRuntimeReloadLifecycleFailureKeepsOldConfig(t *testing.T) {
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:  cityPath,
 		CityName:  "test-city",
 		TomlPath:  tomlPath,
@@ -1768,7 +2598,7 @@ func TestCityRuntimeReloadRetriesTransientLifecycleFailure(t *testing.T) {
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:  cityPath,
 		CityName:  "test-city",
 		TomlPath:  tomlPath,
@@ -1860,7 +2690,7 @@ func TestCityRuntimeReloadStrictWarningsReturnedOnFailure(t *testing.T) {
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:  cityPath,
 		CityName:  "test-city",
 		TomlPath:  tomlPath,
@@ -1934,7 +2764,7 @@ func TestCityRuntimeReloadNonStrictWarningsReturnedOnValidationFailure(t *testin
 	}
 	sp := runtime.NewFake()
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:  cityPath,
 		CityName:  "test-city",
 		TomlPath:  tomlPath,
@@ -2022,36 +2852,208 @@ func TestCityRuntimeHandleReloadRequestInitializesConfigDirty(t *testing.T) {
 		doneCh:     make(chan reloadControlReply, 1),
 	}
 	cr := &CityRuntime{
-		pokeCh: make(chan struct{}, 1),
+		pokeCh: make(chan struct{}, 1),
+	}
+
+	cr.handleReloadRequest(req)
+
+	if cr.configDirty == nil {
+		t.Fatal("configDirty was not initialized")
+	}
+	if !cr.configDirty.Load() {
+		t.Fatal("configDirty = false, want reload request to mark dirty")
+	}
+	if cr.activeReload != req {
+		t.Fatal("activeReload was not recorded")
+	}
+	select {
+	case <-cr.pokeCh:
+	default:
+		t.Fatal("reload request did not enqueue poke")
+	}
+	select {
+	case reply := <-acceptedCh:
+		if reply.Outcome != reloadOutcomeAccepted {
+			t.Fatalf("reply.Outcome = %q, want %q", reply.Outcome, reloadOutcomeAccepted)
+		}
+	default:
+		t.Fatal("reload request did not receive accepted reply")
+	}
+}
+
+func TestCityRuntimeReloadSameRevisionIsNoOp(t *testing.T) {
+	cityPath := t.TempDir()
+	tomlPath := filepath.Join(cityPath, "city.toml")
+	writeCityRuntimeConfig(t, tomlPath, "fake")
+
+	cfg, configRev := loadCityRuntimeControllerConfig(t, cityPath)
+
+	sp := runtime.NewFake()
+	var stdout bytes.Buffer
+	cr := newTestCityRuntime(t, CityRuntimeParams{
+		CityPath:  cityPath,
+		CityName:  "test-city",
+		TomlPath:  tomlPath,
+		ConfigRev: configRev,
+		Cfg:       cfg,
+		SP:        sp,
+		BuildFn: func(*config.City, runtime.Provider, beads.Store) DesiredStateResult {
+			return DesiredStateResult{State: map[string]TemplateParams{}}
+		},
+		Dops:   newDrainOps(sp),
+		Rec:    events.Discard,
+		Stdout: &stdout,
+		Stderr: io.Discard,
+	})
+
+	oldCfg := cr.cfg
+	lastProviderName := "fake"
+	cr.reloadConfig(context.Background(), &lastProviderName, cityPath)
+
+	if cr.cfg != oldCfg {
+		t.Fatal("same-revision reload should keep existing config pointer")
+	}
+	if cr.configRev != configRev {
+		t.Fatalf("configRev = %q, want %q", cr.configRev, configRev)
+	}
+	if lastProviderName != "fake" {
+		t.Fatalf("lastProviderName = %q, want fake", lastProviderName)
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty for same-revision reload", stdout.String())
+	}
+}
+
+func TestCityRuntimeReloadRetainsTimedOutDispatcherForShutdownDrain(t *testing.T) {
+	cityPath := t.TempDir()
+	tomlPath := filepath.Join(cityPath, "city.toml")
+	writeCityRuntimeConfig(t, tomlPath, "fake")
+
+	cfg, configRev := loadCityRuntimeControllerConfig(t, cityPath)
+
+	od := newBlockingOrderDispatcher()
+	var stdout bytes.Buffer
+	cr := &CityRuntime{
+		cityPath:   cityPath,
+		cityName:   "test-city",
+		tomlPath:   tomlPath,
+		configRev:  configRev,
+		cfg:        cfg,
+		sp:         runtime.NewFake(),
+		dops:       newDrainOps(runtime.NewFake()),
+		od:         od,
+		rec:        events.Discard,
+		logPrefix:  "gc start",
+		stdout:     &stdout,
+		stderr:     io.Discard,
+		configName: "test-city",
+	}
+
+	writeCityRuntimeConfigWithShutdownTimeout(t, tomlPath, "fake", "1s")
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	lastProviderName := "fake"
+	cr.reloadConfig(ctx, &lastProviderName, cityPath)
+	od.waitForDrainCalls(t, 1)
+
+	shutdownDone := make(chan struct{})
+	go func() {
+		cr.shutdown()
+		close(shutdownDone)
+	}()
+	od.waitForDrainCalls(t, 2)
+	close(od.release)
+	select {
+	case <-shutdownDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("shutdown did not return after retained dispatcher was released")
+	}
+}
+
+func TestCityRuntimeReloadDrainShortCircuitsOnTickContextCancel(t *testing.T) {
+	cityPath := t.TempDir()
+	tomlPath := filepath.Join(cityPath, "city.toml")
+	writeCityRuntimeConfig(t, tomlPath, "fake")
+
+	cfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	configRev := config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
+
+	od := newBlockingOrderDispatcher()
+	cr := &CityRuntime{
+		cityPath:   cityPath,
+		cityName:   "test-city",
+		tomlPath:   tomlPath,
+		configRev:  configRev,
+		cfg:        cfg,
+		sp:         runtime.NewFake(),
+		dops:       newDrainOps(runtime.NewFake()),
+		od:         od,
+		rec:        events.Discard,
+		logPrefix:  "gc start",
+		stdout:     io.Discard,
+		stderr:     io.Discard,
+		configName: "test-city",
+	}
+
+	writeCityRuntimeConfigWithShutdownTimeout(t, tomlPath, "fake", "1s")
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	lastProviderName := "fake"
+	start := time.Now()
+	cr.reloadConfig(ctx, &lastProviderName, cityPath)
+	if elapsed := time.Since(start); elapsed > 200*time.Millisecond {
+		t.Fatalf("reload drain took %s after tick context cancellation, want <200ms", elapsed)
 	}
+	errs := od.drainContextErrors()
+	if len(errs) == 0 || !errors.Is(errs[0], context.Canceled) {
+		t.Fatalf("drain ctx error = %v, want context.Canceled", errs)
+	}
+	close(od.release)
+}
 
-	cr.handleReloadRequest(req)
+func TestCityRuntimeReloadDrainBoundedByTimeout(t *testing.T) {
+	cityPath := t.TempDir()
+	tomlPath := filepath.Join(cityPath, "city.toml")
+	writeCityRuntimeConfig(t, tomlPath, "fake")
 
-	if cr.configDirty == nil {
-		t.Fatal("configDirty was not initialized")
-	}
-	if !cr.configDirty.Load() {
-		t.Fatal("configDirty = false, want reload request to mark dirty")
-	}
-	if cr.activeReload != req {
-		t.Fatal("activeReload was not recorded")
-	}
-	select {
-	case <-cr.pokeCh:
-	default:
-		t.Fatal("reload request did not enqueue poke")
+	cfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
 	}
-	select {
-	case reply := <-acceptedCh:
-		if reply.Outcome != reloadOutcomeAccepted {
-			t.Fatalf("reply.Outcome = %q, want %q", reply.Outcome, reloadOutcomeAccepted)
-		}
-	default:
-		t.Fatal("reload request did not receive accepted reply")
+	configRev := config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
+
+	od := newBlockingOrderDispatcher()
+	cr := &CityRuntime{
+		cityPath:   cityPath,
+		cityName:   "test-city",
+		tomlPath:   tomlPath,
+		configRev:  configRev,
+		cfg:        cfg,
+		sp:         runtime.NewFake(),
+		dops:       newDrainOps(runtime.NewFake()),
+		od:         od,
+		rec:        events.Discard,
+		logPrefix:  "gc start",
+		stdout:     io.Discard,
+		stderr:     io.Discard,
+		configName: "test-city",
+	}
+
+	writeCityRuntimeConfigWithShutdownTimeout(t, tomlPath, "fake", "1s")
+	lastProviderName := "fake"
+	start := time.Now()
+	cr.reloadConfig(context.Background(), &lastProviderName, cityPath)
+	elapsed := time.Since(start)
+	if elapsed < reloadOrderDrainTimeout || elapsed > reloadOrderDrainTimeout+500*time.Millisecond {
+		t.Fatalf("reload elapsed = %s, want bounded near %s", elapsed, reloadOrderDrainTimeout)
 	}
+	close(od.release)
 }
 
-func TestCityRuntimeReloadSameRevisionIsNoOp(t *testing.T) {
+func TestCityRuntimeRunReloadsConfigBeforeStartupReconcile(t *testing.T) {
 	cityPath := t.TempDir()
 	tomlPath := filepath.Join(cityPath, "city.toml")
 	writeCityRuntimeConfig(t, tomlPath, "fake")
@@ -2062,8 +3064,26 @@ func TestCityRuntimeReloadSameRevisionIsNoOp(t *testing.T) {
 	}
 	configRev := config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
 
+	if err := os.WriteFile(tomlPath, []byte(`[workspace]
+name = "test-city"
+
+[beads]
+provider = "file"
+
+[session]
+provider = "fake"
+
+[[agent]]
+name = "fresh-agent"
+`), 0o644); err != nil {
+		t.Fatalf("write updated config: %v", err)
+	}
+
 	sp := runtime.NewFake()
-	var stdout bytes.Buffer
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	var sawFreshAgent atomic.Bool
 	cr := newCityRuntime(CityRuntimeParams{
 		CityPath:  cityPath,
 		CityName:  "test-city",
@@ -2071,30 +3091,28 @@ func TestCityRuntimeReloadSameRevisionIsNoOp(t *testing.T) {
 		ConfigRev: configRev,
 		Cfg:       cfg,
 		SP:        sp,
-		BuildFn: func(*config.City, runtime.Provider, beads.Store) DesiredStateResult {
+		BuildFn: func(cfg *config.City, _ runtime.Provider, _ beads.Store) DesiredStateResult {
+			for _, agent := range cfg.Agents {
+				if agent.Name == "fresh-agent" {
+					sawFreshAgent.Store(true)
+				}
+			}
+			cancel()
 			return DesiredStateResult{State: map[string]TemplateParams{}}
 		},
 		Dops:   newDrainOps(sp),
 		Rec:    events.Discard,
-		Stdout: &stdout,
+		Stdout: io.Discard,
 		Stderr: io.Discard,
 	})
+	cs := newControllerState(context.Background(), cfg, sp, events.NewFake(), "test-city", cityPath)
+	cs.cityBeadStore = beads.NewMemStore()
+	cr.setControllerState(cs)
 
-	oldCfg := cr.cfg
-	lastProviderName := "fake"
-	cr.reloadConfig(context.Background(), &lastProviderName, cityPath)
+	cr.run(ctx)
 
-	if cr.cfg != oldCfg {
-		t.Fatal("same-revision reload should keep existing config pointer")
-	}
-	if cr.configRev != configRev {
-		t.Fatalf("configRev = %q, want %q", cr.configRev, configRev)
-	}
-	if lastProviderName != "fake" {
-		t.Fatalf("lastProviderName = %q, want fake", lastProviderName)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout = %q, want empty for same-revision reload", stdout.String())
+	if !sawFreshAgent.Load() {
+		t.Fatalf("startup did not see reloaded fresh-agent; agents = %#v", cr.cfg.Agents)
 	}
 }
 
@@ -2109,7 +3127,7 @@ func TestNewCityRuntimeUsesRegisteredAliasForEffectiveIdentity(t *testing.T) {
 	}
 
 	sp := runtime.NewFake()
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "machine-alias",
 		TomlPath: tomlPath,
@@ -2140,14 +3158,10 @@ func TestCityRuntimeReloadKeepsRegisteredAliasForEffectiveIdentity(t *testing.T)
 	tomlPath := filepath.Join(cityPath, "city.toml")
 	writeCityRuntimeConfigNamed(t, tomlPath, "declared-city", "fake")
 
-	cfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath)
-	if err != nil {
-		t.Fatalf("load config: %v", err)
-	}
-	configRev := config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
+	cfg, configRev := loadCityRuntimeControllerConfig(t, cityPath)
 
 	sp := runtime.NewFake()
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:  cityPath,
 		CityName:  "machine-alias",
 		TomlPath:  tomlPath,
@@ -2193,18 +3207,14 @@ func TestCityRuntimeManualReloadReplyWaitsForTickCompletion(t *testing.T) {
 	tomlPath := filepath.Join(cityPath, "city.toml")
 	writeCityRuntimeConfig(t, tomlPath, "fake")
 
-	cfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath)
-	if err != nil {
-		t.Fatalf("load config: %v", err)
-	}
-	configRev := config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
+	cfg, configRev := loadCityRuntimeControllerConfig(t, cityPath)
 
 	doneCh := make(chan reloadControlReply, 1)
 	dirty := &atomic.Bool{}
 	dirty.Store(true)
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:    cityPath,
 		CityName:    "test-city",
 		TomlPath:    tomlPath,
@@ -2271,7 +3281,7 @@ func TestCityRuntimeReloadRestartsConfigWatcherWithNewPackTargets(t *testing.T)
 	dirty := &atomic.Bool{}
 	pokeCh := make(chan struct{}, 8)
 	var stdout, stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:     cityPath,
 		CityName:     "test-city",
 		TomlPath:     tomlPath,
@@ -2339,18 +3349,14 @@ func TestCityRuntimeManualReloadPanicAfterReloadKeepsReloadReplyAndClears(t *tes
 	tomlPath := filepath.Join(cityPath, "city.toml")
 	writeCityRuntimeConfig(t, tomlPath, "fake")
 
-	cfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath)
-	if err != nil {
-		t.Fatalf("load config: %v", err)
-	}
-	configRev := config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
+	cfg, configRev := loadCityRuntimeControllerConfig(t, cityPath)
 
 	doneCh := make(chan reloadControlReply, 1)
 	dirty := &atomic.Bool{}
 	dirty.Store(true)
 	sp := runtime.NewFake()
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:    cityPath,
 		CityName:    "test-city",
 		TomlPath:    tomlPath,
@@ -2405,7 +3411,7 @@ func TestCityRuntimeWatchReloadPanicRestoresDirty(t *testing.T) {
 	dirty.Store(true)
 	sp := runtime.NewFake()
 	var stderr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath:    cityPath,
 		CityName:    "test-city",
 		TomlPath:    tomlPath,
@@ -2448,9 +3454,10 @@ func TestCityRuntimeRunStopsBeforeStartedWhenCanceledDuringStartup(t *testing.T)
 	sp := runtime.NewFake()
 	var stdout bytes.Buffer
 	var started bool
+	od := &recordingOrderDispatcher{}
 
 	ctx, cancel := context.WithCancel(context.Background())
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -2466,6 +3473,7 @@ func TestCityRuntimeRunStopsBeforeStartedWhenCanceledDuringStartup(t *testing.T)
 		Stdout:    &stdout,
 		Stderr:    io.Discard,
 	})
+	cr.od = od
 
 	cs := newControllerState(context.Background(), cfg, sp, events.NewFake(), "test-city", cityPath)
 	cs.cityBeadStore = beads.NewMemStore()
@@ -2476,6 +3484,9 @@ func TestCityRuntimeRunStopsBeforeStartedWhenCanceledDuringStartup(t *testing.T)
 	if started {
 		t.Fatal("OnStarted called after cancellation")
 	}
+	if got := od.calls.Load(); got != 1 {
+		t.Fatalf("order dispatch calls = %d, want startup dispatch before cancellation", got)
+	}
 	if strings.Contains(stdout.String(), "City started.") {
 		t.Fatalf("stdout = %q, want no started banner after cancellation", stdout.String())
 	}
@@ -2566,7 +3577,7 @@ func TestCityRuntimeRun_PanicInStartupDoesNotShutdownCity(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -2635,7 +3646,7 @@ func TestCityRuntimeRun_RetriesStartupAfterRecoveredPanicBeforeStarted(t *testin
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -2730,7 +3741,7 @@ func TestCityRuntimeRun_ConvergenceStartupErrorDoesNotBlockStarted(t *testing.T)
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -2791,7 +3802,7 @@ func TestCityRuntimeRun_RetriesConvergenceStartupUntilIndexPopulated(t *testing.
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -2862,7 +3873,7 @@ func TestCityRuntimeRunShutsDownSessionsOnContextCancel(t *testing.T) {
 
 	var stdout bytes.Buffer
 	ctx, cancel := context.WithCancel(context.Background())
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "test-city",
 		TomlPath: tomlPath,
@@ -2902,6 +3913,253 @@ func TestCityRuntimeRunShutsDownSessionsOnContextCancel(t *testing.T) {
 	}
 }
 
+// orderingFakeProvider appends "stop:<name>" to seq when Stop is called so
+// tests can assert ordering relative to other lifecycle events.
+type orderingFakeProvider struct {
+	*runtime.Fake
+	mu  sync.Mutex
+	seq []string
+}
+
+func (p *orderingFakeProvider) Stop(name string) error {
+	p.mu.Lock()
+	p.seq = append(p.seq, "stop:"+name)
+	p.mu.Unlock()
+	return p.Fake.Stop(name)
+}
+
+func (p *orderingFakeProvider) events() []string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return append([]string(nil), p.seq...)
+}
+
+type interruptStopsProvider struct {
+	*runtime.Fake
+}
+
+func (p *interruptStopsProvider) Interrupt(name string) error {
+	if err := p.Fake.Interrupt(name); err != nil {
+		return err
+	}
+	return p.Stop(name)
+}
+
+// TestCityRuntimeShutdownDrainsOrderDispatch verifies shutdown invokes
+// orderDispatcher.drain with a fresh (non-canceled) context before
+// stopping sessions — regression for #991.
+func TestCityRuntimeShutdownDrainsOrderDispatch(t *testing.T) {
+	cfg := &config.City{}
+	cfg.Daemon.ShutdownTimeout = "1s"
+
+	sp := runtime.NewFake()
+	od := &recordingOrderDispatcher{}
+
+	var stdout, stderr bytes.Buffer
+	cr := &CityRuntime{
+		cfg:       cfg,
+		sp:        sp,
+		od:        od,
+		rec:       events.Discard,
+		logPrefix: "gc start",
+		stdout:    &stdout,
+		stderr:    &stderr,
+	}
+
+	cr.shutdown()
+
+	if od.drainCalls != 1 {
+		t.Fatalf("drainCalls = %d, want 1", od.drainCalls)
+	}
+	if od.drainCtxErr != nil {
+		t.Fatalf("drain received a canceled ctx (%v); shutdown must pass a fresh context", od.drainCtxErr)
+	}
+}
+
+func TestCityRuntimeShutdownPreservesFullGracefulBudgetWithOrders(t *testing.T) {
+	cfg := &config.City{}
+	cfg.Daemon.ShutdownTimeout = "1s"
+
+	sp := &interruptStopsProvider{Fake: runtime.NewFake()}
+	if err := sp.Start(context.Background(), "probe", runtime.Config{}); err != nil {
+		t.Fatalf("start session: %v", err)
+	}
+	od := &recordingOrderDispatcher{}
+
+	var stdout, stderr bytes.Buffer
+	cr := &CityRuntime{
+		cfg:       cfg,
+		sp:        sp,
+		od:        od,
+		rec:       events.Discard,
+		logPrefix: "gc start",
+		stdout:    &stdout,
+		stderr:    &stderr,
+	}
+
+	cr.shutdown()
+
+	if !strings.Contains(stdout.String(), "waiting 1s") {
+		t.Fatalf("stdout = %q, want full 1s graceful session budget", stdout.String())
+	}
+}
+
+// TestCityRuntimeShutdownBlockedDispatchPersistsOutcomeBeforeGracefulStop
+// is the AC regression for #991: "a blocked/fake dispatch cannot let
+// controller exit before the tracking bead is closed or failure metadata
+// is persisted." It starts a real memoryOrderDispatcher, wedges its exec
+// until after shutdown is invoked, and asserts both that the tracking
+// bead is closed before shutdown returns AND that session Stop happens
+// AFTER the dispatch finishes — proving drain blocks gracefulStopAll.
+func TestCityRuntimeShutdownBlockedDispatchPersistsOutcomeBeforeGracefulStop(t *testing.T) {
+	store := beads.NewMemStore()
+	release := make(chan struct{})
+	execStarted := make(chan struct{})
+	execDone := make(chan struct{})
+
+	fakeExec := func(_ context.Context, _, _ string, _ []string) ([]byte, error) {
+		close(execStarted)
+		<-release
+		close(execDone)
+		return []byte("ok\n"), nil
+	}
+
+	ad := buildOrderDispatcherFromListExec(
+		[]orders.Order{{Name: "blocked", Trigger: "cooldown", Interval: "2m", Exec: "scripts/blocked.sh"}},
+		store, nil, fakeExec, nil,
+	)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	<-execStarted
+
+	sp := &orderingFakeProvider{Fake: runtime.NewFake()}
+	if err := sp.Start(context.Background(), "probe", runtime.Config{}); err != nil {
+		t.Fatalf("start session: %v", err)
+	}
+
+	cfg := &config.City{}
+	cfg.Daemon.ShutdownTimeout = "200ms"
+
+	var stdout, stderr bytes.Buffer
+	cr := &CityRuntime{
+		cfg:       cfg,
+		sp:        sp,
+		od:        ad,
+		rec:       events.Discard,
+		logPrefix: "gc start",
+		stdout:    &stdout,
+		stderr:    &stderr,
+	}
+
+	shutdownDone := make(chan struct{})
+	go func() {
+		cr.shutdown()
+		close(shutdownDone)
+	}()
+
+	// shutdown must not return while exec is blocked.
+	select {
+	case <-shutdownDone:
+		t.Fatal("shutdown returned before drain waited for in-flight dispatch")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	// Session must not have been stopped yet — drain is still waiting.
+	if got := sp.events(); len(got) != 0 {
+		t.Fatalf("session lifecycle ran before drain completed: %v", got)
+	}
+
+	close(release)
+	<-execDone
+
+	select {
+	case <-shutdownDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("shutdown did not return after dispatch completed")
+	}
+
+	// Tracking bead outcome must be persisted before shutdown returned.
+	all, err := store.ListByLabel("order-run:blocked", 0, beads.IncludeClosed)
+	if err != nil {
+		t.Fatalf("ListByLabel: %v", err)
+	}
+	foundExecLabel := false
+	for _, b := range all {
+		for _, l := range b.Labels {
+			if l == "exec" {
+				foundExecLabel = true
+			}
+		}
+	}
+	if !foundExecLabel {
+		t.Fatalf("tracking bead missing exec outcome label after shutdown; beads=%+v", all)
+	}
+
+	// gracefulStopAll must have run after drain.
+	got := sp.events()
+	if len(got) == 0 || got[0] != "stop:probe" {
+		t.Fatalf("expected stop:probe after drain, got %v", got)
+	}
+}
+
+func TestCityRuntimeShutdownPreservesFullGracefulBudgetWhenNoOrders(t *testing.T) {
+	cfg := &config.City{}
+	cfg.Daemon.ShutdownTimeout = "1s"
+
+	sp := &interruptStopsProvider{Fake: runtime.NewFake()}
+	if err := sp.Start(context.Background(), "probe", runtime.Config{}); err != nil {
+		t.Fatalf("start session: %v", err)
+	}
+	var stdout, stderr bytes.Buffer
+	cr := &CityRuntime{
+		cfg:       cfg,
+		sp:        sp,
+		rec:       events.Discard,
+		logPrefix: "gc start",
+		stdout:    &stdout,
+		stderr:    &stderr,
+	}
+
+	cr.shutdown()
+
+	if !strings.Contains(stdout.String(), "waiting 1s") {
+		t.Fatalf("stdout = %q, want full 1s graceful session budget", stdout.String())
+	}
+}
+
+func TestCityRuntimeShutdownZeroTimeoutDoesNotWaitForOrderDrain(t *testing.T) {
+	cfg := &config.City{}
+	cfg.Daemon.ShutdownTimeout = "0s"
+
+	od := newBlockingOrderDispatcher()
+	var stdout, stderr bytes.Buffer
+	cr := &CityRuntime{
+		cfg:       cfg,
+		sp:        runtime.NewFake(),
+		od:        od,
+		rec:       events.Discard,
+		logPrefix: "gc start",
+		stdout:    &stdout,
+		stderr:    &stderr,
+	}
+
+	done := make(chan struct{})
+	go func() {
+		cr.shutdown()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("shutdown waited on order drain despite shutdown_timeout=0s")
+	}
+	close(od.release)
+}
+
 func TestCityRuntimeShutdownWarnsWhenSessionListingIsPartial(t *testing.T) {
 	sp := &partialListPoolProvider{
 		Fake:      runtime.NewFake(),
@@ -2944,17 +4202,37 @@ func TestCityRuntimeShutdownWarnsWhenSessionListingIsPartial(t *testing.T) {
 
 func writeCityRuntimeConfig(t *testing.T, tomlPath, provider string) {
 	t.Helper()
+	clearInheritedBeadsEnv(t)
 	writeCityRuntimeConfigNamed(t, tomlPath, "test-city", provider)
 }
 
+func loadCityRuntimeControllerConfig(t *testing.T, cityPath string) (*config.City, string) {
+	t.Helper()
+	cfg, prov, err := loadCityConfigWithBuiltinPacks(cityPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	applyFeatureFlags(cfg)
+	return cfg, config.Revision(fsys.OSFS{}, prov, cfg, cityPath)
+}
+
 func writeCityRuntimeConfigNamed(t *testing.T, tomlPath, name, provider string) {
 	t.Helper()
+	clearInheritedBeadsEnv(t)
 	data := []byte("[workspace]\nname = \"" + name + "\"\n\n[beads]\nprovider = \"file\"\n\n[session]\nprovider = \"" + provider + "\"\n")
 	if err := os.WriteFile(tomlPath, data, 0o644); err != nil {
 		t.Fatalf("write config: %v", err)
 	}
 }
 
+func writeCityRuntimeConfigWithShutdownTimeout(t *testing.T, tomlPath, provider, timeout string) {
+	t.Helper()
+	data := []byte("[workspace]\nname = \"test-city\"\n\n[beads]\nprovider = \"file\"\n\n[session]\nprovider = \"" + provider + "\"\n\n[daemon]\nshutdown_timeout = \"" + timeout + "\"\n")
+	if err := os.WriteFile(tomlPath, data, 0o644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+}
+
 func warningsContain(warnings []string, substr string) bool {
 	for _, warning := range warnings {
 		if strings.Contains(warning, substr) {
@@ -2966,6 +4244,7 @@ func warningsContain(warnings []string, substr string) bool {
 
 func writeCityRuntimeConfigWithIncludes(t *testing.T, tomlPath string, includes []string) {
 	t.Helper()
+	clearInheritedBeadsEnv(t)
 	var quoted []string
 	for _, include := range includes {
 		quoted = append(quoted, fmt.Sprintf("%q", include))
diff --git a/cmd/gc/city_status_snapshot.go b/cmd/gc/city_status_snapshot.go
index d736b69c58..e1dfd56c35 100644
--- a/cmd/gc/city_status_snapshot.go
+++ b/cmd/gc/city_status_snapshot.go
@@ -56,6 +56,17 @@ func openCityStatusStore(cityPath string, stderr io.Writer) (beads.Store, int) {
 }
 
 func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath string, store beads.Store, stderr io.Writer) cityStatusSnapshot {
+	return collectCityStatusSnapshotFromStoreSnapshot(sp, cfg, cityPath, store, loadStatusSessionSnapshot(store), stderr)
+}
+
+func collectCityStatusSnapshotFromStoreSnapshot(
+	sp runtime.Provider,
+	cfg *config.City,
+	cityPath string,
+	store beads.Store,
+	statusSnapshot *sessionBeadSnapshot,
+	stderr io.Writer,
+) cityStatusSnapshot {
 	suspended := os.Getenv("GC_SUSPENDED") == "1"
 	if cfg != nil {
 		suspended = citySuspended(cfg)
@@ -66,6 +77,7 @@ func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath s
 		Suspended:  suspended,
 	}
 	snapshot.CityName = loadedCityName(cfg, cityPath)
+	registerStatusProviderACPRoutes(sp, statusSnapshot, snapshot.CityName, cfg)
 	if cfg == nil {
 		return snapshot
 	}
@@ -109,8 +121,8 @@ func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath s
 			scaleLabel := fmt.Sprintf("scaled (min=%d, %s)", sp0.Min, maxDisplay)
 			headerShown := false
 			for _, qualifiedInstance := range discoverPoolInstances(a.Name, a.Dir, sp0, &a, snapshot.CityName, cfg.Workspace.SessionTemplate, sp) {
-				sn := cliSessionName(cityPath, snapshot.CityName, qualifiedInstance, cfg.Workspace.SessionTemplate)
-				obs := observeSessionTargetWithWarning("gc status", cityPath, store, sp, cfg, sn, stderr)
+				target := statusObservationTargetForIdentity(statusSnapshot, snapshot.CityName, qualifiedInstance, cfg.Workspace.SessionTemplate)
+				obs := observeSessionTargetWithWarning("gc status", cityPath, store, sp, cfg, target, stderr)
 				_, instanceName := config.ParseQualifiedName(qualifiedInstance)
 				row := cityStatusAgentRow{
 					Agent: StatusAgentJSON{
@@ -121,7 +133,7 @@ func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath s
 						Suspended:     suspended || obs.Suspended,
 						Pool:          nil,
 					},
-					SessionName: sn,
+					SessionName: target.runtimeSessionName,
 					GroupName:   a.QualifiedName(),
 					Expanded:    true,
 				}
@@ -139,8 +151,8 @@ func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath s
 			continue
 		}
 
-		sn := cliSessionName(cityPath, snapshot.CityName, a.QualifiedName(), cfg.Workspace.SessionTemplate)
-		obs := observeSessionTargetWithWarning("gc status", cityPath, store, sp, cfg, sn, stderr)
+		target := statusObservationTargetForIdentity(statusSnapshot, snapshot.CityName, a.QualifiedName(), cfg.Workspace.SessionTemplate)
+		obs := observeSessionTargetWithWarning("gc status", cityPath, store, sp, cfg, target, stderr)
 		snapshot.Agents = append(snapshot.Agents, cityStatusAgentRow{
 			Agent: StatusAgentJSON{
 				Name:          a.Name,
@@ -149,7 +161,7 @@ func collectCityStatusSnapshot(sp runtime.Provider, cfg *config.City, cityPath s
 				Running:       obs.Running,
 				Suspended:     suspended || obs.Suspended,
 			},
-			SessionName: sn,
+			SessionName: target.runtimeSessionName,
 			GroupName:   a.QualifiedName(),
 			Expanded:    false,
 		})
diff --git a/cmd/gc/city_status_snapshot_test.go b/cmd/gc/city_status_snapshot_test.go
index ee91c9f4a1..e90f375ccd 100644
--- a/cmd/gc/city_status_snapshot_test.go
+++ b/cmd/gc/city_status_snapshot_test.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"io"
 	"path/filepath"
@@ -94,6 +95,252 @@ func (s *failingStatusStore) Get(id string) (beads.Bead, error) {
 	return s.MemStore.Get(id)
 }
 
+type getSpyStatusStore struct {
+	*beads.MemStore
+	ids []string
+}
+
+func (s *getSpyStatusStore) Get(id string) (beads.Bead, error) {
+	s.ids = append(s.ids, id)
+	return s.MemStore.Get(id)
+}
+
+func TestCityStatusAgentObservationDoesNotResolveRuntimeNamesThroughStore(t *testing.T) {
+	sp := runtime.NewFake()
+	store := &getSpyStatusStore{MemStore: beads.NewMemStore()}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Agents: []config.Agent{
+			{Name: "dog", MaxActiveSessions: intPtr(2)},
+		},
+	}
+
+	snapshot := collectCityStatusSnapshot(sp, cfg, "/home/user/city", store, io.Discard)
+	if len(snapshot.Agents) != 2 {
+		t.Fatalf("agents = %d, want 2", len(snapshot.Agents))
+	}
+	if len(store.ids) != 0 {
+		t.Fatalf("status observation performed bead Get calls for runtime names: %v", store.ids)
+	}
+}
+
+func TestCityStatusUsesBeadBackedRuntimeNameForSingletonAgent(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "custom-mayor", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "mayor",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "agent:mayor"},
+		Metadata: map[string]string{
+			"agent_name":   "mayor",
+			"template":     "mayor",
+			"session_name": "custom-mayor",
+			"state":        "active",
+		},
+	}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Agents:    []config.Agent{{Name: "mayor", MaxActiveSessions: intPtr(1)}},
+	}
+
+	snapshot := collectCityStatusSnapshot(sp, cfg, "/home/user/city", store, io.Discard)
+	if len(snapshot.Agents) != 1 {
+		t.Fatalf("agents = %d, want 1", len(snapshot.Agents))
+	}
+	if !snapshot.Agents[0].Agent.Running {
+		t.Fatalf("singleton agent running = false, want true with bead-backed runtime name")
+	}
+	if got := snapshot.Agents[0].SessionName; got != "custom-mayor" {
+		t.Fatalf("SessionName = %q, want %q", got, "custom-mayor")
+	}
+}
+
+func TestCityStatusUsesSessionBackedObservationForSuspendedCustomRuntimeName(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "custom-mayor", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "mayor",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "agent:mayor"},
+		Metadata: map[string]string{
+			"agent_name":   "mayor",
+			"template":     "mayor",
+			"session_name": "custom-mayor",
+			"state":        string(session.StateSuspended),
+		},
+	}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Agents:    []config.Agent{{Name: "mayor", MaxActiveSessions: intPtr(1)}},
+	}
+
+	snapshot := collectCityStatusSnapshot(sp, cfg, "/home/user/city", store, io.Discard)
+	if len(snapshot.Agents) != 1 {
+		t.Fatalf("agents = %d, want 1", len(snapshot.Agents))
+	}
+	if !snapshot.Agents[0].Agent.Running {
+		t.Fatalf("running = false, want true")
+	}
+	if !snapshot.Agents[0].Agent.Suspended {
+		t.Fatalf("suspended = false, want true from session-backed observation")
+	}
+}
+
+func TestCityStatusUsesStatusSnapshotToRouteACPDrainMetadata(t *testing.T) {
+	oldBuild := buildSessionProviderByName
+	t.Cleanup(func() { buildSessionProviderByName = oldBuild })
+
+	defaultSP := runtime.NewFake()
+	acpSP := runtime.NewFake()
+	buildSessionProviderByName = func(name string, _ config.SessionConfig, _, _ string) (runtime.Provider, error) {
+		if name == "acp" {
+			return acpSP, nil
+		}
+		return defaultSP, nil
+	}
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Session:   config.SessionConfig{Provider: "fake"},
+		Agents:    []config.Agent{{Name: "reviewer", Session: "acp", MaxActiveSessions: intPtr(1)}},
+	}
+	sp := newStatusSessionProviderForCity(cfg, t.TempDir())
+	if err := acpSP.Start(context.Background(), "custom-reviewer", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := acpSP.SetMeta("custom-reviewer", "GC_DRAIN", "123"); err != nil {
+		t.Fatalf("SetMeta: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "reviewer",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "agent:reviewer"},
+		Metadata: map[string]string{
+			"agent_name":   "reviewer",
+			"template":     "reviewer",
+			"transport":    "acp",
+			"session_name": "custom-reviewer",
+			"state":        string(session.StateActive),
+		},
+	}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	snapshot := collectCityStatusSnapshot(sp, cfg, "/home/user/city", store, io.Discard)
+	if len(snapshot.Agents) != 1 {
+		t.Fatalf("agents = %d, want 1", len(snapshot.Agents))
+	}
+	if !snapshot.Agents[0].Agent.Running {
+		t.Fatalf("running = false, want true")
+	}
+
+	var stdout bytes.Buffer
+	renderCityStatusText(snapshot, newDrainOps(sp), &stdout)
+	if !strings.Contains(stdout.String(), "running  (draining)") {
+		t.Fatalf("stdout = %q, want draining status for ACP-backed custom runtime name", stdout.String())
+	}
+}
+
+func TestCityStatusUsesBeadBackedRuntimeNameForPoolInstance(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "custom-dog-1", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "dog",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "agent:dog-1"},
+		Metadata: map[string]string{
+			"agent_name":   "dog-1",
+			"template":     "dog",
+			"session_name": "custom-dog-1",
+			"pool_slot":    "1",
+			"state":        "active",
+		},
+	}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Agents: []config.Agent{
+			{Name: "dog", MaxActiveSessions: intPtr(2)},
+		},
+	}
+
+	snapshot := collectCityStatusSnapshot(sp, cfg, "/home/user/city", store, io.Discard)
+	if len(snapshot.Agents) != 2 {
+		t.Fatalf("agents = %d, want 2", len(snapshot.Agents))
+	}
+	if got := snapshot.Agents[0].Agent.QualifiedName; got != "dog-1" {
+		t.Fatalf("first QualifiedName = %q, want dog-1", got)
+	}
+	if !snapshot.Agents[0].Agent.Running {
+		t.Fatalf("pool instance dog-1 running = false, want true with bead-backed runtime name")
+	}
+	if got := snapshot.Agents[0].SessionName; got != "custom-dog-1" {
+		t.Fatalf("dog-1 SessionName = %q, want %q", got, "custom-dog-1")
+	}
+	if snapshot.Agents[1].Agent.Running {
+		t.Fatalf("pool instance dog-2 running = true, want false")
+	}
+}
+
+func TestCityStatusUsesBeadBackedRuntimeNameForStampedPoolSlotBead(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "custom-dog-1", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "dog",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "agent:frontend/dog"},
+		Metadata: map[string]string{
+			"agent_name":   "frontend/dog",
+			"template":     "frontend/dog",
+			"session_name": "custom-dog-1",
+			"pool_slot":    "1",
+			"state":        "active",
+		},
+	}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Rigs:      []config.Rig{{Name: "frontend", Path: "/tmp/frontend"}},
+		Agents: []config.Agent{
+			{Name: "dog", Dir: "frontend", MaxActiveSessions: intPtr(2)},
+		},
+	}
+
+	snapshot := collectCityStatusSnapshot(sp, cfg, "/home/user/city", store, io.Discard)
+	if len(snapshot.Agents) != 2 {
+		t.Fatalf("agents = %d, want 2", len(snapshot.Agents))
+	}
+	if got := snapshot.Agents[0].Agent.QualifiedName; got != "frontend/dog-1" {
+		t.Fatalf("first QualifiedName = %q, want frontend/dog-1", got)
+	}
+	if !snapshot.Agents[0].Agent.Running {
+		t.Fatalf("pool instance frontend/dog-1 running = false, want true with stamped pool-slot bead")
+	}
+	if got := snapshot.Agents[0].SessionName; got != "custom-dog-1" {
+		t.Fatalf("frontend/dog-1 SessionName = %q, want %q", got, "custom-dog-1")
+	}
+}
+
 func TestCityStatusNamedSessionLookupErrorsAreSurfaced(t *testing.T) {
 	sp := runtime.NewFake()
 	dops := newFakeDrainOps()
diff --git a/cmd/gc/cityinit_exact_output_test.go b/cmd/gc/cityinit_exact_output_test.go
new file mode 100644
index 0000000000..92943a9176
--- /dev/null
+++ b/cmd/gc/cityinit_exact_output_test.go
@@ -0,0 +1,68 @@
+package main
+
+import (
+	"bytes"
+	"io"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestCityInitExactOutput_DefaultScaffold(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+
+	code := doInit(fsys.NewFake(), "/bright-lights", defaultWizardConfig(), "", &stdout, &stderr)
+
+	if code != 0 {
+		t.Fatalf("doInit code = %d, want 0", code)
+	}
+	const wantStdout = "[1/8] Creating runtime scaffold\n" +
+		"[2/8] Installing hooks (Claude Code)\n" +
+		"[3/8] Writing default prompts\n" +
+		"[4/8] Writing pack.toml\n" +
+		"[5/8] Writing city configuration\n" +
+		"Welcome to Gas City!\n" +
+		"Initialized city \"bright-lights\" with default mayor agent.\n"
+	if stdout.String() != wantStdout {
+		t.Fatalf("stdout = %q, want %q", stdout.String(), wantStdout)
+	}
+	if stderr.String() != "" {
+		t.Fatalf("stderr = %q, want empty", stderr.String())
+	}
+}
+
+func TestCityInitExactOutput_CommandProviderSkipReadiness(t *testing.T) {
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_DOLT", "skip")
+	disableBootstrapForTests(t)
+
+	oldRegister := registerCityWithSupervisorTestHook
+	registerCityWithSupervisorTestHook = func(_ string, _ string, _ io.Writer, _ io.Writer) (bool, int) {
+		return true, 0
+	}
+	t.Cleanup(func() { registerCityWithSupervisorTestHook = oldRegister })
+
+	var stdout, stderr bytes.Buffer
+	code := cmdInitWithOptions([]string{filepath.Join(t.TempDir(), "bright-lights")}, "codex", "", "", &stdout, &stderr, true)
+
+	if code != 0 {
+		t.Fatalf("cmdInitWithOptions code = %d, want 0", code)
+	}
+	const wantStdout = "[1/8] Creating runtime scaffold\n" +
+		"[2/8] Installing hooks (Claude Code)\n" +
+		"[3/8] Writing default prompts\n" +
+		"[4/8] Writing pack.toml\n" +
+		"[5/8] Writing city configuration\n" +
+		"Welcome to Gas City!\n" +
+		"Initialized city \"bright-lights\" with default provider \"codex\".\n" +
+		"[6/8] Skipping provider readiness checks\n" +
+		"[7/8] Registering city with supervisor\n"
+	if stdout.String() != wantStdout {
+		t.Fatalf("stdout = %q, want %q", stdout.String(), wantStdout)
+	}
+	if stderr.String() != "" {
+		t.Fatalf("stderr = %q, want empty", stderr.String())
+	}
+}
diff --git a/cmd/gc/cityinit_impl.go b/cmd/gc/cityinit_impl.go
index 9a2c8bc0dc..168d65488e 100644
--- a/cmd/gc/cityinit_impl.go
+++ b/cmd/gc/cityinit_impl.go
@@ -1,552 +1,166 @@
 package main
 
-// cityinit.Initializer implementation. Bridges the domain interface
-// declared in internal/cityinit to the concrete scaffold + finalize
-// helpers in this package. Supplied to api.NewSupervisorMux at
-// construction so POST /v0/city calls Init in-process — no
-// subprocess, no 30-second deadline, no stderr-scraping.
-//
-// The long-term plan is to move doInit/finalizeInit and their
-// helpers into internal/cityinit so the domain logic physically
-// lives in the object model (per engdocs/architecture/api-control-plane.md §1). This
-// bridge is the minimum viable unblocker: the HTTP API no longer
-// shells out, both surfaces drive the same in-process code path via
-// the same typed contract, and the refactor of where the body lives
-// is a follow-up.
-
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
-	"os"
 	"path/filepath"
-	"sort"
-	"strings"
-	"syscall"
 
 	"github.com/gastownhall/gascity/internal/api"
 	"github.com/gastownhall/gascity/internal/cityinit"
 	"github.com/gastownhall/gascity/internal/citylayout"
-	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/fsys"
-	"github.com/gastownhall/gascity/internal/supervisor"
 )
 
-// localInitializer implements cityinit.Initializer by dispatching to
-// this package's existing doInit + finalizeInit functions.
-type localInitializer struct{}
-
-// NewInitializer returns the Initializer the supervisor uses to
-// service POST /v0/city. Exported so `gc supervisor run` can wire it
-// into api.NewSupervisorMux.
-func NewInitializer() cityinit.Initializer {
-	return localInitializer{}
-}
-
-func ensureCityEventLog(cityPath string) {
-	if fr, err := events.NewFileRecorder(filepath.Join(cityPath, ".gc", "events.jsonl"), io.Discard); err == nil {
-		fr.Close() //nolint:errcheck // best-effort
-	}
+func newCityInitService() (*cityinit.Service, error) {
+	return cityinit.NewService(cityinit.ServiceDeps{
+		FS:              fsys.OSScaffoldFS{},
+		Initializer:     initializerAdapter{},
+		Registry:        registryAdapter{},
+		Reloader:        reloaderAdapter{},
+		LifecycleEvents: cityInitLifecycleEvents{stderr: io.Discard},
+	})
 }
 
-func recordCityEvent(cityPath, eventType, subject string, payload any) {
-	fr, err := events.NewFileRecorder(filepath.Join(cityPath, ".gc", "events.jsonl"), io.Discard)
-	if err != nil {
-		return
-	}
-	defer fr.Close() //nolint:errcheck // best-effort
+type initializerAdapter struct{}
 
-	raw, err := json.Marshal(payload)
-	if err != nil {
-		return
-	}
-	fr.Record(events.Event{
-		Type:    eventType,
-		Actor:   "gc",
-		Subject: subject,
-		Payload: raw,
-	})
+func (initializerAdapter) Scaffold(ctx context.Context, req cityinit.InitRequest) error {
+	return cityInitDoInit(ctx, req)
 }
 
-type scaffoldRollbackEntry struct {
-	mode       os.FileMode
-	data       []byte
-	linkTarget string
+func (initializerAdapter) Finalize(ctx context.Context, req cityinit.InitRequest) error {
+	return cityInitFinalize(ctx, req)
 }
 
-type scaffoldSnapshot struct {
-	root    string
-	entries map[string]scaffoldRollbackEntry
+type registryAdapter struct{}
+
+func (registryAdapter) Register(_ context.Context, dir, nameOverride string) error {
+	return registerCityForAPI(dir, nameOverride)
 }
 
-type scaffoldRollbackState struct {
-	root   string
-	before map[string]scaffoldRollbackEntry
-	after  map[string]scaffoldRollbackEntry
+func (registryAdapter) Find(ctx context.Context, name string) (cityinit.RegisteredCity, error) {
+	return cityInitFindRegisteredCity(ctx, name)
 }
 
-func captureScaffoldSnapshot(root string) (*scaffoldSnapshot, error) {
-	snapshot := &scaffoldSnapshot{
-		root:    root,
-		entries: make(map[string]scaffoldRollbackEntry),
-	}
-	for _, rel := range scaffoldManagedPaths() {
-		if err := snapshot.capture(rel); err != nil {
-			return nil, err
-		}
-	}
-	return snapshot, nil
+func (registryAdapter) Unregister(ctx context.Context, city cityinit.RegisteredCity) error {
+	return cityInitUnregisterCity(ctx, city)
 }
 
-func scaffoldManagedPaths() []string {
-	seen := make(map[string]struct{}, len(initConventionDirs)+5)
-	paths := make([]string, 0, len(initConventionDirs)+5)
-	add := func(rel string) {
-		if rel == "" {
-			return
-		}
-		if _, ok := seen[rel]; ok {
-			return
-		}
-		seen[rel] = struct{}{}
-		paths = append(paths, rel)
-	}
+type reloaderAdapter struct{}
 
-	add(citylayout.RuntimeRoot)
-	add("hooks")
-	add(citylayout.CityConfigFile)
-	add("pack.toml")
-	add(".gitignore")
-	for _, rel := range initConventionDirs {
-		add(rel)
-	}
-	return paths
+func (reloaderAdapter) Reload() error {
+	return reloadSupervisorNoWaitHook()
 }
 
-func newScaffoldRollbackState(root string) (*scaffoldRollbackState, error) {
-	snapshot, err := captureScaffoldSnapshot(root)
-	if err != nil {
-		return nil, err
-	}
-	return &scaffoldRollbackState{
-		root:   root,
-		before: snapshot.entries,
-	}, nil
+func (reloaderAdapter) ReloadAfterUnregister() error {
+	return reloadSupervisorNoWaitHook()
 }
 
-func (s *scaffoldSnapshot) capture(rel string) error {
-	abs := filepath.Join(s.root, rel)
-	_, err := os.Lstat(abs)
-	if os.IsNotExist(err) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("snapshot %q: %w", abs, err)
-	}
-	return filepath.Walk(abs, func(path string, info os.FileInfo, walkErr error) error {
-		if walkErr != nil {
-			return fmt.Errorf("snapshot %q: %w", path, walkErr)
-		}
-		relPath, err := filepath.Rel(s.root, path)
-		if err != nil {
-			return fmt.Errorf("relative path for %q: %w", path, err)
-		}
-		entry := scaffoldRollbackEntry{mode: info.Mode()}
-		if info.Mode()&os.ModeSymlink != 0 {
-			target, err := os.Readlink(path)
-			if err != nil {
-				return fmt.Errorf("readlink %q: %w", path, err)
-			}
-			entry.linkTarget = target
-		} else if !info.IsDir() {
-			data, err := os.ReadFile(path)
-			if err != nil {
-				return fmt.Errorf("read %q: %w", path, err)
-			}
-			entry.data = data
-		}
-		s.entries[filepath.Clean(relPath)] = entry
-		return nil
-	})
+type cityInitLifecycleEvents struct {
+	stderr io.Writer
 }
 
-func (s *scaffoldRollbackState) markScaffoldState() error {
-	snapshot, err := captureScaffoldSnapshot(s.root)
+func (e cityInitLifecycleEvents) EnsureCityLog(cityPath string) error {
+	fr, err := events.NewFileRecorder(filepath.Join(cityPath, citylayout.RuntimeRoot, "events.jsonl"), e.stderrOrDiscard())
 	if err != nil {
 		return err
 	}
-	s.after = snapshot.entries
+	if err := fr.Close(); err != nil {
+		return fmt.Errorf("closing event log: %w", err)
+	}
 	return nil
 }
 
-func rollbackEntryEqual(a, b scaffoldRollbackEntry) bool {
-	return a.mode == b.mode && a.linkTarget == b.linkTarget && bytes.Equal(a.data, b.data)
+func (e cityInitLifecycleEvents) CityCreated(cityPath, name string) error {
+	return e.record(cityPath, events.CityCreated, name, api.CityLifecyclePayload{Name: name, Path: cityPath})
 }
 
-func restoreRollbackEntry(abs string, entry scaffoldRollbackEntry) error {
-	switch {
-	case entry.mode.IsDir():
-		return os.MkdirAll(abs, entry.mode.Perm())
-	case entry.mode&os.ModeSymlink != 0:
-		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
-			return err
-		}
-		if err := os.Remove(abs); err != nil && !os.IsNotExist(err) {
-			return err
-		}
-		return os.Symlink(entry.linkTarget, abs)
-	default:
-		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
-			return err
-		}
-		return os.WriteFile(abs, entry.data, entry.mode.Perm())
-	}
+func (e cityInitLifecycleEvents) CityUnregisterRequested(city cityinit.RegisteredCity) error {
+	return e.record(city.Path, events.CityUnregisterRequested, city.Name, api.CityLifecyclePayload{Name: city.Name, Path: city.Path})
 }
 
-func (s *scaffoldRollbackState) restore() error {
-	current, err := captureScaffoldSnapshot(s.root)
+func (e cityInitLifecycleEvents) record(cityPath, eventType, subject string, payload api.CityLifecyclePayload) error {
+	fr, err := events.NewFileRecorder(filepath.Join(cityPath, citylayout.RuntimeRoot, "events.jsonl"), e.stderrOrDiscard())
 	if err != nil {
 		return err
 	}
-
-	var errs []error
-	var createdDirs []string
-	for rel, after := range s.after {
-		before, hadBefore := s.before[rel]
-		currentEntry, existsNow := current.entries[rel]
-		switch {
-		case !hadBefore:
-			if after.mode.IsDir() {
-				createdDirs = append(createdDirs, rel)
-				continue
-			}
-			if existsNow && rollbackEntryEqual(currentEntry, after) {
-				if err := os.Remove(filepath.Join(s.root, rel)); err != nil && !os.IsNotExist(err) {
-					errs = append(errs, fmt.Errorf("remove %q: %w", filepath.Join(s.root, rel), err))
-				}
-			}
-		case rollbackEntryEqual(before, after):
-			continue
-		default:
-			if after.mode.IsDir() {
-				continue
-			}
-			if existsNow && rollbackEntryEqual(currentEntry, after) {
-				if err := restoreRollbackEntry(filepath.Join(s.root, rel), before); err != nil {
-					errs = append(errs, fmt.Errorf("restore %q: %w", filepath.Join(s.root, rel), err))
-				}
-			}
-		}
-	}
-
-	for rel, before := range s.before {
-		if _, hadAfter := s.after[rel]; hadAfter {
-			continue
-		}
-		if before.mode.IsDir() {
-			continue
-		}
-		if _, existsNow := current.entries[rel]; existsNow {
-			continue
-		}
-		if err := restoreRollbackEntry(filepath.Join(s.root, rel), before); err != nil {
-			errs = append(errs, fmt.Errorf("restore %q: %w", filepath.Join(s.root, rel), err))
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		if closeErr := fr.Close(); closeErr != nil {
+			return errors.Join(err, fmt.Errorf("closing event log: %w", closeErr))
 		}
+		return err
 	}
-
-	sort.Slice(createdDirs, func(i, j int) bool {
-		return len(createdDirs[i]) > len(createdDirs[j])
+	fr.Record(events.Event{
+		Type:    eventType,
+		Actor:   "gc",
+		Subject: subject,
+		Payload: raw,
 	})
-	for _, rel := range createdDirs {
-		if err := os.Remove(filepath.Join(s.root, rel)); err != nil && !os.IsNotExist(err) {
-			if errors.Is(err, syscall.ENOTEMPTY) {
-				continue
-			}
-			errs = append(errs, fmt.Errorf("remove %q: %w", filepath.Join(s.root, rel), err))
-		}
-	}
-
-	if len(errs) > 0 {
-		return errors.Join(errs...)
+	if err := fr.Close(); err != nil {
+		return fmt.Errorf("closing event log: %w", err)
 	}
 	return nil
 }
 
-// Scaffold runs the fast portion of city creation so the HTTP API
-// handler can return 202 Accepted without blocking on the slow
-// finalize work. Writes the on-disk shape (via doInit), then
-// registers the city with the supervisor so the reconciler picks
-// it up on its next tick. The reconciler owns finalize from there;
-// readiness is signaled via city.ready / city.init_failed events on
-// the supervisor event bus (see internal/api/event_payloads.go).
-func (localInitializer) Scaffold(_ context.Context, req cityinit.InitRequest) (*cityinit.InitResult, error) {
-	if err := validateInitRequest(&req); err != nil {
-		return nil, err
-	}
-	dir := req.Dir
-	dirExisted := false
-	var rollbackState *scaffoldRollbackState
-	if _, err := os.Stat(dir); err == nil {
-		dirExisted = true
-		rollbackState, err = newScaffoldRollbackState(dir)
-		if err != nil {
-			return nil, fmt.Errorf("snapshot rollback state for %q: %w", dir, err)
-		}
-	} else if !os.IsNotExist(err) {
-		return nil, fmt.Errorf("stat directory %q: %w", dir, err)
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return nil, fmt.Errorf("creating directory %q: %w", dir, err)
-	}
-
-	wiz := wizardConfig{
-		configName:       req.ConfigName,
-		provider:         req.Provider,
-		startCommand:     req.StartCommand,
-		bootstrapProfile: req.BootstrapProfile,
-	}
-	if wiz.configName == "" {
-		wiz.configName = "tutorial"
-	}
-
-	if cityHasScaffoldFS(fsys.OSFS{}, dir) {
-		return nil, cityinit.ErrAlreadyInitialized
-	}
-	if code := doInit(fsys.OSFS{}, dir, wiz, req.NameOverride, io.Discard, io.Discard); code != 0 {
-		if dirExisted && rollbackState != nil {
-			if markErr := rollbackState.markScaffoldState(); markErr != nil {
-				return nil, errors.Join(fmt.Errorf("scaffold failed (exit %d)", code), fmt.Errorf("snapshot scaffold state for rollback: %w", markErr))
-			}
-			if cleanupErr := rollbackState.restore(); cleanupErr != nil {
-				return nil, errors.Join(fmt.Errorf("scaffold failed (exit %d)", code), fmt.Errorf("restoring existing directory after scaffold failure: %w", cleanupErr))
-			}
-		}
-		if code == initExitAlreadyInitialized {
-			return nil, cityinit.ErrAlreadyInitialized
-		}
-		return nil, fmt.Errorf("scaffold failed (exit %d)", code)
-	}
-
-	cityName := resolveCityName(req.NameOverride, "", dir)
-
-	// Create .gc/events.jsonl immediately before registration. Two reasons:
-	//
-	// 1. The supervisor event multiplexer (see
-	//    internal/api/supervisor.go:buildMultiplexer) includes
-	//    transient-city event providers via
-	//    TransientCityEventSource. With the file in place, a
-	//    subscriber to /v0/events/stream that connects right after
-	//    POST returns 202 sees a non-empty multiplexer and can
-	//    replay events via after_cursor=0.
-	//
-	// 2. The supervisor event stream's no-providers precheck rejects
-	//    subscriptions with 503 when the multiplexer is empty. By
-	//    populating at least one event log before registration,
-	//    POST /v0/city → subscribe works even when no other cities
-	//    exist yet (the fresh-supervisor scenario).
-	//
-	// The file creation is best-effort. city.created itself is emitted
-	// only after registration succeeds so synchronous failures do not
-	// leak a "created" event for a city the supervisor never adopted.
-	ensureCityEventLog(dir)
-	if dirExisted && rollbackState != nil {
-		if err := rollbackState.markScaffoldState(); err != nil {
-			return nil, fmt.Errorf("snapshot scaffold state for %q: %w", dir, err)
-		}
+func (e cityInitLifecycleEvents) stderrOrDiscard() io.Writer {
+	if e.stderr != nil {
+		return e.stderr
 	}
-
-	// Register the city with the supervisor without blocking on the
-	// reconciler's tick. The standard registerCityWithSupervisor
-	// waits for prepareCityForSupervisor to complete, which is the
-	// very blocking behavior the async POST /v0/city contract
-	// exists to avoid.
-	if err := registerCityForAPI(dir, req.NameOverride); err != nil {
-		if dirExisted {
-			if rollbackState != nil {
-				if cleanupErr := rollbackState.restore(); cleanupErr != nil {
-					return nil, errors.Join(fmt.Errorf("register with supervisor: %w", err), fmt.Errorf("restoring existing directory after failed registration: %w", cleanupErr))
-				}
-			}
-		} else if cleanupErr := os.RemoveAll(dir); cleanupErr != nil {
-			return nil, errors.Join(fmt.Errorf("register with supervisor: %w", err), fmt.Errorf("cleaning scaffold after failed registration: %w", cleanupErr))
-		}
-		return nil, fmt.Errorf("register with supervisor: %w", err)
-	}
-	recordCityEvent(dir, events.CityCreated, cityName, api.CityCreatedPayload{Name: cityName, Path: dir})
-	reloadSupervisorNoWaitHook()
-
-	return &cityinit.InitResult{
-		CityName:     cityName,
-		CityPath:     dir,
-		ProviderUsed: req.Provider,
-	}, nil
+	return io.Discard
 }
 
-// Init scaffolds + finalizes a new city. Errors are mapped to the
-// typed sentinels in package cityinit so callers (HTTP API, future
-// in-process consumers) can pattern-match via errors.Is.
-func (localInitializer) Init(_ context.Context, req cityinit.InitRequest) (*cityinit.InitResult, error) {
-	if err := validateInitRequest(&req); err != nil {
-		return nil, err
-	}
-	dir := req.Dir
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return nil, fmt.Errorf("creating directory %q: %w", dir, err)
-	}
-
+func cityInitDoInit(_ context.Context, req cityinit.InitRequest) error {
 	wiz := wizardConfig{
 		configName:       req.ConfigName,
 		provider:         req.Provider,
 		startCommand:     req.StartCommand,
 		bootstrapProfile: req.BootstrapProfile,
 	}
-	if wiz.configName == "" {
-		wiz.configName = "tutorial"
-	}
-
-	// Check for an already-initialized directory BEFORE calling
-	// doInit so we can return ErrAlreadyInitialized without also
-	// writing "gc init: already initialized" to stderr (the CLI
-	// path wants that; the API does not).
-	if cityHasScaffoldFS(fsys.OSFS{}, dir) {
-		return nil, cityinit.ErrAlreadyInitialized
-	}
-
-	// doInit writes directly to io.Writer arguments (CLI progress
-	// narration). The API path discards those; error return is
-	// carried as an exit code, which we translate into typed
-	// sentinels below.
-	if code := doInit(fsys.OSFS{}, dir, wiz, req.NameOverride, io.Discard, io.Discard); code != 0 {
+	if code := doInit(fsys.OSFS{}, req.Dir, wiz, req.NameOverride, io.Discard, io.Discard); code != 0 {
 		if code == initExitAlreadyInitialized {
-			return nil, cityinit.ErrAlreadyInitialized
+			return cityinit.ErrAlreadyInitialized
 		}
-		return nil, fmt.Errorf("scaffold failed (exit %d)", code)
+		return fmt.Errorf("scaffold failed (exit %d)", code)
 	}
+	return nil
+}
 
-	// finalizeInit likewise writes to io.Writer and returns 0/1.
-	// Discard its narration; the HTTP response conveys structured
-	// errors via the sentinel types.
-	if code := finalizeInit(dir, io.Discard, io.Discard, initFinalizeOptions{
+func cityInitFinalize(_ context.Context, req cityinit.InitRequest) error {
+	if code := finalizeInit(req.Dir, io.Discard, io.Discard, initFinalizeOptions{
 		skipProviderReadiness: req.SkipProviderReadiness,
 		showProgress:          false,
 		commandName:           "gc init",
 	}); code != 0 {
-		// finalizeInit's current contract is "blocked, check
-		// stderr". Without a structured return type we can't map
-		// to specific sentinels; future work splits this out.
-		return nil, fmt.Errorf("finalize failed (exit %d)", code)
+		return fmt.Errorf("finalize failed (exit %d)", code)
 	}
-
-	cityName := resolveCityName(req.NameOverride, "", dir)
-	return &cityinit.InitResult{
-		CityName:     cityName,
-		CityPath:     dir,
-		ProviderUsed: req.Provider,
-	}, nil
+	return nil
 }
 
-// Unregister removes the city's registry entry and signals the
-// supervisor to reconcile. Fire-and-forget: returns as soon as the
-// registry file is updated and the reload signal is sent. The
-// supervisor reconciler discovers the missing entry on its next
-// tick, stops the city's controller, and emits city.unregistered
-// (or city.unregister_failed on stop failure). See cmd_supervisor.go
-// for the reconciler side.
-//
-// Looks the city up by name. The registry is keyed by path on disk,
-// so we scan entries to find the one whose effective name matches.
-// Name collisions would violate the registry's uniqueness invariant
-// and are rejected at Register time; we take the first match.
-//
-// Emits city.unregister_requested to the city's event log before
-// unregistering so /v0/events/stream subscribers see the start of
-// the teardown. Once the registry entry is gone, the transient
-// event-provider lookup (cityRegistry.TransientCityEventProviders)
-// will still surface this city to new subscribers via its snap.all
-// entry until the reconciler fully drops it.
-func (localInitializer) Unregister(_ context.Context, req cityinit.UnregisterRequest) (*cityinit.UnregisterResult, error) {
-	name := strings.TrimSpace(req.CityName)
-	if name == "" {
-		return nil, fmt.Errorf("%w: city_name is required", cityinit.ErrNotRegistered)
-	}
-
+func cityInitFindRegisteredCity(_ context.Context, name string) (cityinit.RegisteredCity, error) {
 	reg := newSupervisorRegistry()
 	entries, err := reg.List()
 	if err != nil {
-		return nil, fmt.Errorf("reading supervisor registry: %w", err)
+		return cityinit.RegisteredCity{}, err
 	}
-	var match supervisor.CityEntry
-	var found bool
-	for _, e := range entries {
-		if e.EffectiveName() == name {
-			match = e
-			found = true
-			break
+	for _, entry := range entries {
+		if entry.EffectiveName() == name {
+			return cityinit.RegisteredCity{
+				Name: entry.EffectiveName(),
+				Path: entry.Path,
+			}, nil
 		}
 	}
-	if !found {
-		return nil, fmt.Errorf("%w: %q", cityinit.ErrNotRegistered, name)
-	}
-
-	if err := reg.Unregister(match.Path); err != nil {
-		// Should not happen — we just read this entry — but wrap to
-		// satisfy the ErrNotRegistered contract if it does.
-		if errors.Is(err, os.ErrNotExist) {
-			return nil, fmt.Errorf("%w: %q: %w", cityinit.ErrNotRegistered, name, err)
-		}
-		return nil, fmt.Errorf("removing %q from supervisor registry: %w", name, err)
-	}
-	recordCityEvent(
-		match.Path,
-		events.CityUnregisterRequested,
-		match.EffectiveName(),
-		api.CityUnregisterRequestedPayload{Name: match.EffectiveName(), Path: match.Path},
-	)
-
-	// Wake the reconciler; same fire-and-forget signal the Scaffold
-	// path uses. If the supervisor isn't reachable the periodic
-	// ticker picks up the change on its next interval.
-	reloadSupervisorNoWait()
-
-	return &cityinit.UnregisterResult{
-		CityName: match.EffectiveName(),
-		CityPath: match.Path,
-	}, nil
+	return cityinit.RegisteredCity{}, fmt.Errorf("%w: %q", cityinit.ErrNotRegistered, name)
 }
 
-// validateInitRequest performs the membership / mutual-exclusion
-// checks that the HTTP layer previously did inline. Keeping them in
-// the bridge means the CLI also benefits from the same validation
-// when its call site moves (follow-up).
-func validateInitRequest(req *cityinit.InitRequest) error {
-	if req.Dir == "" {
-		return fmt.Errorf("%w: dir is required", cityinit.ErrInvalidProvider)
-	}
-	if !filepath.IsAbs(req.Dir) {
-		return fmt.Errorf("dir must be absolute: %q", req.Dir)
-	}
-	if req.Provider == "" && req.StartCommand == "" {
-		return fmt.Errorf("%w: provider or start_command required", cityinit.ErrInvalidProvider)
+func cityInitUnregisterCity(_ context.Context, city cityinit.RegisteredCity) error {
+	err := newSupervisorRegistry().Unregister(city.Path)
+	if errors.Is(err, cityinit.ErrNotRegistered) {
+		return fmt.Errorf("%w: %s", cityinit.ErrNotRegistered, city.Name)
 	}
-	if req.Provider != "" && req.StartCommand != "" {
-		return fmt.Errorf("%w: provider and start_command are mutually exclusive", cityinit.ErrInvalidProvider)
-	}
-	if req.Provider != "" {
-		if _, ok := config.BuiltinProviders()[req.Provider]; !ok {
-			return fmt.Errorf("%w: unknown provider %q", cityinit.ErrInvalidProvider, req.Provider)
-		}
-	}
-	if req.BootstrapProfile != "" {
-		// normalizeBootstrapProfile accepts every spelling the CLI
-		// and HTTP API currently support; reuse it here so the two
-		// projections can't disagree.
-		if _, err := normalizeBootstrapProfile(req.BootstrapProfile); err != nil {
-			return fmt.Errorf("%w: %w", cityinit.ErrInvalidBootstrapProfile, err)
-		}
-	}
-	return nil
+	return err
 }
diff --git a/cmd/gc/cityinit_impl_test.go b/cmd/gc/cityinit_impl_test.go
index b941ef99c1..5f95678bce 100644
--- a/cmd/gc/cityinit_impl_test.go
+++ b/cmd/gc/cityinit_impl_test.go
@@ -15,6 +15,15 @@ import (
 	"github.com/gastownhall/gascity/internal/supervisor"
 )
 
+func mustNewCityInitService(t *testing.T) *cityinit.Service {
+	t.Helper()
+	svc, err := newCityInitService()
+	if err != nil {
+		t.Fatalf("newCityInitService: %v", err)
+	}
+	return svc
+}
+
 type fakeSupervisorRegistry struct {
 	entries       []supervisor.CityEntry
 	listErr       error
@@ -37,101 +46,24 @@ func (f *fakeSupervisorRegistry) Unregister(string) error {
 	return f.unregisterErr
 }
 
-func TestValidateInitRequest(t *testing.T) {
-	absDir := filepath.Join(t.TempDir(), "city")
-	tests := []struct {
-		name         string
-		req          cityinit.InitRequest
-		wantErr      error
-		wantContains string
-	}{
-		{
-			name:    "missing dir",
-			req:     cityinit.InitRequest{Provider: "codex"},
-			wantErr: cityinit.ErrInvalidProvider,
-		},
-		{
-			name:         "relative dir",
-			req:          cityinit.InitRequest{Dir: "relative", Provider: "codex"},
-			wantContains: "dir must be absolute",
-		},
-		{
-			name:    "missing provider and start command",
-			req:     cityinit.InitRequest{Dir: absDir},
-			wantErr: cityinit.ErrInvalidProvider,
-		},
-		{
-			name:         "provider and start command are mutually exclusive",
-			req:          cityinit.InitRequest{Dir: absDir, Provider: "codex", StartCommand: "custom-agent"},
-			wantErr:      cityinit.ErrInvalidProvider,
-			wantContains: "mutually exclusive",
-		},
-		{
-			name:    "unknown provider",
-			req:     cityinit.InitRequest{Dir: absDir, Provider: "not-a-provider"},
-			wantErr: cityinit.ErrInvalidProvider,
-		},
-		{
-			name:    "bad bootstrap profile",
-			req:     cityinit.InitRequest{Dir: absDir, Provider: "codex", BootstrapProfile: "moon-base"},
-			wantErr: cityinit.ErrInvalidBootstrapProfile,
-		},
-		{
-			name:    "builtin provider",
-			req:     cityinit.InitRequest{Dir: absDir, Provider: "codex"},
-			wantErr: nil,
-		},
-		{
-			name:    "custom start command",
-			req:     cityinit.InitRequest{Dir: absDir, StartCommand: "custom-agent"},
-			wantErr: nil,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateInitRequest(&tc.req)
-			if tc.wantErr == nil {
-				if tc.wantContains != "" {
-					if err == nil || !strings.Contains(err.Error(), tc.wantContains) {
-						t.Fatalf("validateInitRequest() error = %v, want message containing %q", err, tc.wantContains)
-					}
-					return
-				}
-				if err != nil {
-					t.Fatalf("validateInitRequest() error = %v, want nil", err)
-				}
-				return
-			}
-			if !errors.Is(err, tc.wantErr) {
-				t.Fatalf("validateInitRequest() error = %v, want %v", err, tc.wantErr)
-			}
-			if tc.wantContains != "" {
-				if err == nil || !strings.Contains(err.Error(), tc.wantContains) {
-					t.Fatalf("validateInitRequest() error = %v, want message containing %q", err, tc.wantContains)
-				}
-			}
-		})
-	}
-}
-
-func TestLocalInitializerScaffoldCreatesCityRegistersAndEmitsCreated(t *testing.T) {
+func TestCityInitServiceScaffoldCreatesCityRegistersAndEmitsCreated(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 	cityPath := filepath.Join(t.TempDir(), "api-city")
 	reloadSawCreated := 0
 
 	oldReloadSupervisorNoWaitHook := reloadSupervisorNoWaitHook
-	reloadSupervisorNoWaitHook = func() {
+	reloadSupervisorNoWaitHook = func() error {
 		evts, err := events.ReadFiltered(filepath.Join(cityPath, ".gc", "events.jsonl"), events.Filter{Type: events.CityCreated})
 		if err == nil {
 			reloadSawCreated = len(evts)
 		}
+		return nil
 	}
 	t.Cleanup(func() {
 		reloadSupervisorNoWaitHook = oldReloadSupervisorNoWaitHook
 	})
 
-	result, err := localInitializer{}.Scaffold(context.Background(), cityinit.InitRequest{
+	result, err := mustNewCityInitService(t).Scaffold(context.Background(), cityinit.InitRequest{
 		Dir:              cityPath,
 		Provider:         "codex",
 		BootstrapProfile: bootstrapProfileSingleHostCompat,
@@ -167,7 +99,7 @@ func TestLocalInitializerScaffoldCreatesCityRegistersAndEmitsCreated(t *testing.
 	if len(evts) != 1 {
 		t.Fatalf("city.created events = %d, want 1: %+v", len(evts), evts)
 	}
-	var payload api.CityCreatedPayload
+	var payload api.CityLifecyclePayload
 	if err := json.Unmarshal(evts[0].Payload, &payload); err != nil {
 		t.Fatalf("unmarshal city.created payload: %v", err)
 	}
@@ -179,7 +111,7 @@ func TestLocalInitializerScaffoldCreatesCityRegistersAndEmitsCreated(t *testing.
 		t.Fatalf("reload saw %d city.created events, want 1 before wake", reloadSawCreated)
 	}
 
-	_, err = localInitializer{}.Scaffold(context.Background(), cityinit.InitRequest{
+	_, err = mustNewCityInitService(t).Scaffold(context.Background(), cityinit.InitRequest{
 		Dir:      cityPath,
 		Provider: "codex",
 	})
@@ -188,7 +120,33 @@ func TestLocalInitializerScaffoldCreatesCityRegistersAndEmitsCreated(t *testing.
 	}
 }
 
-func TestLocalInitializerScaffoldDoesNotEmitCreatedWhenRegisterFails(t *testing.T) {
+func TestCityInitServiceScaffoldReturnsReloadWarning(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+
+	oldReloadSupervisorNoWaitHook := reloadSupervisorNoWaitHook
+	reloadSupervisorNoWaitHook = func() error {
+		return errors.New("reload unavailable")
+	}
+	t.Cleanup(func() {
+		reloadSupervisorNoWaitHook = oldReloadSupervisorNoWaitHook
+	})
+
+	result, err := mustNewCityInitService(t).Scaffold(context.Background(), cityinit.InitRequest{
+		Dir:              cityPath,
+		Provider:         "codex",
+		BootstrapProfile: bootstrapProfileSingleHostCompat,
+		NameOverride:     "api-city",
+	})
+	if err != nil {
+		t.Fatalf("Scaffold: %v", err)
+	}
+	if result.ReloadWarning != "reload unavailable" {
+		t.Fatalf("ReloadWarning = %q, want reload unavailable", result.ReloadWarning)
+	}
+}
+
+func TestCityInitServiceScaffoldDoesNotEmitCreatedWhenRegisterFails(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 	cityPath := filepath.Join(t.TempDir(), "api-city")
 
@@ -200,7 +158,7 @@ func TestLocalInitializerScaffoldDoesNotEmitCreatedWhenRegisterFails(t *testing.
 		newSupervisorRegistry = oldNewSupervisorRegistry
 	})
 
-	_, err := localInitializer{}.Scaffold(context.Background(), cityinit.InitRequest{
+	_, err := mustNewCityInitService(t).Scaffold(context.Background(), cityinit.InitRequest{
 		Dir:              cityPath,
 		Provider:         "codex",
 		BootstrapProfile: bootstrapProfileSingleHostCompat,
@@ -222,7 +180,7 @@ func TestLocalInitializerScaffoldDoesNotEmitCreatedWhenRegisterFails(t *testing.
 	}
 }
 
-func TestLocalInitializerScaffoldPreservesExistingDirectoryWhenRegisterFails(t *testing.T) {
+func TestCityInitServiceScaffoldPreservesExistingDirectoryWhenRegisterFails(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 	cityPath := filepath.Join(t.TempDir(), "api-city")
 	keepPath := filepath.Join(cityPath, "keep.txt")
@@ -248,7 +206,7 @@ func TestLocalInitializerScaffoldPreservesExistingDirectoryWhenRegisterFails(t *
 		newSupervisorRegistry = oldNewSupervisorRegistry
 	})
 
-	_, err := localInitializer{}.Scaffold(context.Background(), cityinit.InitRequest{
+	_, err := mustNewCityInitService(t).Scaffold(context.Background(), cityinit.InitRequest{
 		Dir:              cityPath,
 		Provider:         "codex",
 		BootstrapProfile: bootstrapProfileSingleHostCompat,
@@ -283,7 +241,7 @@ func TestLocalInitializerScaffoldPreservesExistingDirectoryWhenRegisterFails(t *
 	}
 
 	newSupervisorRegistry = oldNewSupervisorRegistry
-	result, err := localInitializer{}.Scaffold(context.Background(), cityinit.InitRequest{
+	result, err := mustNewCityInitService(t).Scaffold(context.Background(), cityinit.InitRequest{
 		Dir:              cityPath,
 		Provider:         "codex",
 		BootstrapProfile: bootstrapProfileSingleHostCompat,
@@ -297,12 +255,13 @@ func TestLocalInitializerScaffoldPreservesExistingDirectoryWhenRegisterFails(t *
 	}
 }
 
-func TestLocalInitializerInitScaffoldsAndFinalizes(t *testing.T) {
+func TestCityInitServiceInitScaffoldsAndFinalizes(t *testing.T) {
 	skipSlowCmdGCTest(t, "runs the full local init scaffold/finalize path; run make test-cmd-gc-process for full coverage")
 	configureTestDoltIdentityEnv(t)
+	configureRealBdAndDoltPath(t)
 	cityPath := filepath.Join(t.TempDir(), "init-city")
 
-	result, err := localInitializer{}.Init(context.Background(), cityinit.InitRequest{
+	result, err := mustNewCityInitService(t).Init(context.Background(), cityinit.InitRequest{
 		Dir:                   cityPath,
 		StartCommand:          "true",
 		NameOverride:          "init-city",
@@ -318,7 +277,7 @@ func TestLocalInitializerInitScaffoldsAndFinalizes(t *testing.T) {
 		t.Fatalf(".gc missing after Init finalization: %v", err)
 	}
 
-	_, err = localInitializer{}.Init(context.Background(), cityinit.InitRequest{
+	_, err = mustNewCityInitService(t).Init(context.Background(), cityinit.InitRequest{
 		Dir:          cityPath,
 		StartCommand: "true",
 	})
@@ -327,7 +286,7 @@ func TestLocalInitializerInitScaffoldsAndFinalizes(t *testing.T) {
 	}
 }
 
-func TestLocalInitializerUnregisterRemovesRegistryAndEmitsEvent(t *testing.T) {
+func TestCityInitServiceUnregisterRemovesRegistryAndEmitsEvent(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 	cityPath := filepath.Join(t.TempDir(), "bright-lights")
 	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
@@ -338,7 +297,7 @@ func TestLocalInitializerUnregisterRemovesRegistryAndEmitsEvent(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	result, err := localInitializer{}.Unregister(context.Background(), cityinit.UnregisterRequest{
+	result, err := mustNewCityInitService(t).Unregister(context.Background(), cityinit.UnregisterRequest{
 		CityName: " bright-lights ",
 	})
 	if err != nil {
@@ -367,7 +326,7 @@ func TestLocalInitializerUnregisterRemovesRegistryAndEmitsEvent(t *testing.T) {
 	if evts[0].Actor != "gc" || evts[0].Subject != "bright-lights" {
 		t.Fatalf("event actor/subject = %q/%q, want gc/bright-lights", evts[0].Actor, evts[0].Subject)
 	}
-	var payload api.CityUnregisterRequestedPayload
+	var payload api.CityLifecyclePayload
 	if err := json.Unmarshal(evts[0].Payload, &payload); err != nil {
 		t.Fatalf("unmarshal payload: %v", err)
 	}
@@ -377,7 +336,37 @@ func TestLocalInitializerUnregisterRemovesRegistryAndEmitsEvent(t *testing.T) {
 	assertSameTestPath(t, payload.Path, cityPath)
 }
 
-func TestLocalInitializerUnregisterDoesNotEmitEventWhenRegistryWriteFails(t *testing.T) {
+func TestCityInitServiceUnregisterReturnsReloadWarning(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+	cityPath := filepath.Join(t.TempDir(), "bright-lights")
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	if err := reg.Register(cityPath, "bright-lights"); err != nil {
+		t.Fatal(err)
+	}
+
+	oldReloadSupervisorNoWaitHook := reloadSupervisorNoWaitHook
+	reloadSupervisorNoWaitHook = func() error {
+		return errors.New("reload unavailable")
+	}
+	t.Cleanup(func() {
+		reloadSupervisorNoWaitHook = oldReloadSupervisorNoWaitHook
+	})
+
+	result, err := mustNewCityInitService(t).Unregister(context.Background(), cityinit.UnregisterRequest{
+		CityName: "bright-lights",
+	})
+	if err != nil {
+		t.Fatalf("Unregister: %v", err)
+	}
+	if result.ReloadWarning != "reload unavailable" {
+		t.Fatalf("ReloadWarning = %q, want reload unavailable", result.ReloadWarning)
+	}
+}
+
+func TestCityInitServiceUnregisterDoesNotEmitEventWhenRegistryWriteFails(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 	cityPath := filepath.Join(t.TempDir(), "bright-lights")
 	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
@@ -398,7 +387,7 @@ func TestLocalInitializerUnregisterDoesNotEmitEventWhenRegistryWriteFails(t *tes
 		newSupervisorRegistry = oldNewSupervisorRegistry
 	})
 
-	_, err := localInitializer{}.Unregister(context.Background(), cityinit.UnregisterRequest{
+	_, err := mustNewCityInitService(t).Unregister(context.Background(), cityinit.UnregisterRequest{
 		CityName: "bright-lights",
 	})
 	if err == nil || !strings.Contains(err.Error(), "removing \"bright-lights\" from supervisor registry") {
@@ -414,15 +403,15 @@ func TestLocalInitializerUnregisterDoesNotEmitEventWhenRegistryWriteFails(t *tes
 	}
 }
 
-func TestLocalInitializerUnregisterMissingCity(t *testing.T) {
+func TestCityInitServiceUnregisterMissingCity(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 
-	_, err := localInitializer{}.Unregister(context.Background(), cityinit.UnregisterRequest{CityName: "missing"})
+	_, err := mustNewCityInitService(t).Unregister(context.Background(), cityinit.UnregisterRequest{CityName: "missing"})
 	if !errors.Is(err, cityinit.ErrNotRegistered) {
 		t.Fatalf("Unregister missing error = %v, want ErrNotRegistered", err)
 	}
 
-	_, err = localInitializer{}.Unregister(context.Background(), cityinit.UnregisterRequest{})
+	_, err = mustNewCityInitService(t).Unregister(context.Background(), cityinit.UnregisterRequest{})
 	if !errors.Is(err, cityinit.ErrNotRegistered) {
 		t.Fatalf("Unregister blank error = %v, want ErrNotRegistered", err)
 	}
diff --git a/cmd/gc/cmd_agent_test.go b/cmd/gc/cmd_agent_test.go
index d9c2dbdf5f..4cae7f6549 100644
--- a/cmd/gc/cmd_agent_test.go
+++ b/cmd/gc/cmd_agent_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/formula"
+	"github.com/gastownhall/gascity/internal/formulatest"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/molecule"
 )
@@ -810,10 +811,9 @@ name = "test-city"
 }
 
 func TestLoadCityConfigFSAppliesFeatureFlags(t *testing.T) {
-	oldFormulaV2 := formula.IsFormulaV2Enabled()
+	formulatest.HoldV2ForTest(t)
 	oldGraphApply := molecule.IsGraphApplyEnabled()
 	t.Cleanup(func() {
-		formula.SetFormulaV2Enabled(oldFormulaV2)
 		molecule.SetGraphApplyEnabled(oldGraphApply)
 	})
 
diff --git a/cmd/gc/cmd_bd.go b/cmd/gc/cmd_bd.go
index 702f0111d8..fa315987d2 100644
--- a/cmd/gc/cmd_bd.go
+++ b/cmd/gc/cmd_bd.go
@@ -24,7 +24,11 @@ rig directory to find the correct .beads database. This command resolves
 the rig automatically from the --rig flag or by detecting the bead prefix
 in the arguments.
 
-All arguments after "gc bd" are forwarded to bd unchanged.`,
+All arguments after "gc bd" are forwarded to bd unchanged.
+
+gc bd forces BD_EXPORT_AUTO=false to prevent bd's git auto-export hook
+from wedging the wrapper after printing command output. If you need
+auto-export behavior, invoke bd directly.`,
 		Example: `  gc bd --rig my-project list
   gc bd --rig my-project create "New task"
   gc bd show my-project-abc          # auto-detects rig from bead prefix
@@ -62,6 +66,9 @@ func bdCommandEnv(cityPath string, cfg *config.City, target execStoreTarget) []s
 	overrides["GC_STORE_ROOT"] = target.ScopeRoot
 	overrides["GC_STORE_SCOPE"] = target.ScopeKind
 	overrides["GC_BEADS_PREFIX"] = target.Prefix
+	// GC owns the Dolt-backed beads lifecycle; bd's git auto-export can run
+	// after command output and wedge the wrapper on git staging failures.
+	overrides["BD_EXPORT_AUTO"] = "false"
 	return mergeRuntimeEnv(os.Environ(), overrides)
 }
 
@@ -108,8 +115,11 @@ func doBd(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gc bd: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	if !providerUsesBdStoreContract(rawBeadsProviderForScope(target.ScopeRoot, cityPath)) {
-		fmt.Fprintln(stderr, "gc bd: only supported for bd-backed beads providers") //nolint:errcheck // best-effort stderr
+	if provider := rawBeadsProviderForScope(target.ScopeRoot, cityPath); !providerUsesBdStoreContract(provider) {
+		fmt.Fprintf(stderr, "gc bd: only supported for bd-backed beads providers (resolved %q for %s)\n", provider, target.ScopeRoot) //nolint:errcheck // best-effort stderr
+		if hint := bdProviderMismatchHint(target.ScopeRoot, provider); hint != "" {
+			fmt.Fprintf(stderr, "  hint: %s\n", hint) //nolint:errcheck // best-effort stderr
+		}
 		return 1
 	}
 
@@ -126,7 +136,7 @@ func doBd(args []string, stdout, stderr io.Writer) int {
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = stdout
 	cmd.Stderr = stderr
-	cmd.Env = bdCommandEnv(cityPath, cfg, target)
+	cmd.Env = workQueryEnvForDir(bdCommandEnv(cityPath, cfg, target), cmd.Dir)
 
 	if err := cmd.Run(); err != nil {
 		var exitErr *exec.ExitError
@@ -204,6 +214,19 @@ func resolveBdScopeTarget(cfg *config.City, cityPath, rigName string, args []str
 		return bdRigScopeTarget(cityPath, rig), nil
 	}
 
+	cityTarget := bdCityScopeTarget(cityPath, cfg)
+	cityPrefix := config.EffectiveHQPrefix(cfg)
+	if cityPrefix != "" {
+		for _, arg := range args {
+			if strings.HasPrefix(arg, "-") || beadPrefix(cfg, arg) != cityPrefix {
+				continue
+			}
+			if bdBeadExists(cityPath, cityTarget, arg) {
+				return cityTarget, nil
+			}
+		}
+	}
+
 	// Auto-detect from bead IDs in args, but only accept candidates that
 	// actually exist in the resolved rig store. This keeps hyphenated flag
 	// values and other non-ID args from silently retargeting the command.
@@ -231,15 +254,11 @@ func resolveBdScopeTarget(cfg *config.City, cityPath, rigName string, args []str
 		return bdRigScopeTarget(cityPath, rig), nil
 	}
 
-	return execStoreTarget{
-		ScopeRoot: resolveStoreScopeRoot(cityPath, cityPath),
-		ScopeKind: "city",
-		Prefix:    config.EffectiveHQPrefix(cfg),
-	}, nil
+	return cityTarget, nil
 }
 
 func bdRigForArg(cfg *config.City, arg string) (config.Rig, bool) {
-	if prefix := beadPrefix(arg); prefix != "" {
+	if prefix := beadPrefix(cfg, arg); prefix != "" {
 		return findRigByPrefix(cfg, prefix)
 	}
 	return config.Rig{}, false
@@ -261,3 +280,11 @@ func bdRigScopeTarget(cityPath string, rig config.Rig) execStoreTarget {
 		RigName:   rig.Name,
 	}
 }
+
+func bdCityScopeTarget(cityPath string, cfg *config.City) execStoreTarget {
+	return execStoreTarget{
+		ScopeRoot: resolveStoreScopeRoot(cityPath, cityPath),
+		ScopeKind: "city",
+		Prefix:    config.EffectiveHQPrefix(cfg),
+	}
+}
diff --git a/cmd/gc/cmd_bd_store_bridge.go b/cmd/gc/cmd_bd_store_bridge.go
index 2a7ab5b5ec..80fa42099d 100644
--- a/cmd/gc/cmd_bd_store_bridge.go
+++ b/cmd/gc/cmd_bd_store_bridge.go
@@ -196,6 +196,11 @@ func runBdStoreBridge(op string, args []string, dir, host, port, user string, st
 			return fmt.Errorf("usage: close <id>")
 		}
 		return store.Close(args[0])
+	case "reopen":
+		if len(args) < 1 {
+			return fmt.Errorf("usage: reopen <id>")
+		}
+		return store.Reopen(args[0])
 	case "list":
 		query := beads.ListQuery{AllowScan: true}
 		for _, arg := range args {
@@ -305,6 +310,7 @@ func bdStoreBridgeEnv(dir, host, port, user, password string) map[string]string
 		"BEADS_DOLT_SERVER_HOST",
 		"BEADS_DOLT_SERVER_PORT",
 		"BEADS_DOLT_SERVER_USER",
+		"BD_EXPORT_AUTO",
 		"GC_BEADS",
 		"GC_BEADS_PREFIX",
 		"GC_DOLT_DATABASE",
@@ -325,6 +331,7 @@ func bdStoreBridgeEnv(dir, host, port, user, password string) map[string]string
 	env["GC_DOLT_PASSWORD"] = password
 	env["BEADS_DOLT_PASSWORD"] = password
 	env["BEADS_DOLT_AUTO_START"] = "0"
+	env["BD_EXPORT_AUTO"] = "false"
 	return env
 }
 
diff --git a/cmd/gc/cmd_bd_store_bridge_test.go b/cmd/gc/cmd_bd_store_bridge_test.go
index 5b7ea9e637..9067cc4d8c 100644
--- a/cmd/gc/cmd_bd_store_bridge_test.go
+++ b/cmd/gc/cmd_bd_store_bridge_test.go
@@ -48,10 +48,12 @@ BEADS_DOLT_SERVER_DATABASE=%s
 BEADS_CREDENTIALS_FILE=%s
 GC_BEADS=%s
 GC_BEADS_PREFIX=%s
+BD_EXPORT_AUTO=%s
 ' \
   "${BEADS_DIR:-}" "${GC_DOLT_HOST:-}" "${GC_DOLT_PORT:-}" "${GC_DOLT_USER:-}" "${GC_DOLT_PASSWORD:-}" \
   "${BEADS_DOLT_SERVER_HOST:-}" "${BEADS_DOLT_SERVER_PORT:-}" "${BEADS_DOLT_SERVER_USER:-}" "${BEADS_DOLT_PASSWORD:-}" \
-  "${BEADS_DOLT_SERVER_DATABASE:-}" "${BEADS_CREDENTIALS_FILE:-}" "${GC_BEADS:-}" "${GC_BEADS_PREFIX:-}" > "` + envFile + `"
+  "${BEADS_DOLT_SERVER_DATABASE:-}" "${BEADS_CREDENTIALS_FILE:-}" "${GC_BEADS:-}" "${GC_BEADS_PREFIX:-}" \
+  "${BD_EXPORT_AUTO:-}" > "` + envFile + `"
 printf '%s
 ' "$*" > "` + argsFile + `"
 case "${1:-}" in
@@ -153,6 +155,9 @@ func TestBdStoreBridgeCreateCmdProjectsCanonicalEnvAndClearsAmbientAuthority(t *
 	if got := envMap["GC_BEADS_PREFIX"]; got != "" {
 		t.Fatalf("GC_BEADS_PREFIX = %q, want empty after sanitization\n%s", got, string(envText))
 	}
+	if got := envMap["BD_EXPORT_AUTO"]; got != "false" {
+		t.Fatalf("BD_EXPORT_AUTO = %q, want false to suppress bridge auto-export\n%s", got, string(envText))
+	}
 
 	argsText, err := os.ReadFile(argsFile)
 	if err != nil {
diff --git a/cmd/gc/cmd_bd_test.go b/cmd/gc/cmd_bd_test.go
index a83f1b1d58..65c171bc26 100644
--- a/cmd/gc/cmd_bd_test.go
+++ b/cmd/gc/cmd_bd_test.go
@@ -468,6 +468,69 @@ set -eu
 	}
 }
 
+func TestGcBdSuppressesBdAutoExportForJsonShowAndUpdate(t *testing.T) {
+	origCityFlag := cityFlag
+	origRigFlag := rigFlag
+	defer func() {
+		cityFlag = origCityFlag
+		rigFlag = origRigFlag
+	}()
+	cityFlag = ""
+	rigFlag = ""
+
+	cityDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityDir, ".beads"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(`[workspace]
+name = "demo"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	binDir := t.TempDir()
+	script := filepath.Join(binDir, "bd")
+	if err := os.WriteFile(script, []byte(`#!/bin/sh
+set -eu
+if [ "${BD_EXPORT_AUTO:-}" != "false" ]; then
+  echo "BD_EXPORT_AUTO=${BD_EXPORT_AUTO:-}" >&2
+  exit 73
+fi
+case "${1:-}" in
+  show)
+    printf '[{"id":"gc-1","title":"ok"}]\n'
+    ;;
+  update)
+    printf '{"id":"gc-1","status":"in_progress"}\n'
+    ;;
+  *)
+    exit 2
+    ;;
+esac
+`), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("GC_CITY_PATH", cityDir)
+	t.Setenv("BD_EXPORT_AUTO", "true")
+
+	for _, args := range [][]string{
+		{"show", "gc-1", "--json"},
+		{"update", "gc-1", "--claim", "--json"},
+	} {
+		var stdout, stderr bytes.Buffer
+		if got := doBd(args, &stdout, &stderr); got != 0 {
+			t.Fatalf("doBd(%v) = %d, want 0; stdout=%q stderr=%q", args, got, stdout.String(), stderr.String())
+		}
+		if strings.TrimSpace(stdout.String()) == "" {
+			t.Fatalf("doBd(%v) produced empty stdout", args)
+		}
+		if stderr.String() != "" {
+			t.Fatalf("doBd(%v) stderr = %q, want empty", args, stderr.String())
+		}
+	}
+}
+
 func TestGcBdDoesNotAutoRouteHyphenatedFlagValue(t *testing.T) {
 	origCityFlag := cityFlag
 	origRigFlag := rigFlag
@@ -614,6 +677,61 @@ provider = "file"
 	}
 }
 
+// TestGcBdRejectsStaleFileMarkerWithDiagnosticHint asserts the error when
+// a scope has a stale .gc/beads.json (file-store marker) but no
+// .beads/metadata.json (bd-store marker): gc rejects with a hint that
+// names the offending marker and suggests the fix. Regression for the
+// post-#899 behavior change where stale migration artifacts silently
+// reclassified rigs as file-backed with no diagnostic.
+func TestGcBdRejectsStaleFileMarkerWithDiagnosticHint(t *testing.T) {
+	origCityFlag := cityFlag
+	origRigFlag := rigFlag
+	defer func() {
+		cityFlag = origCityFlag
+		rigFlag = origRigFlag
+	}()
+	cityFlag = ""
+	rigFlag = ""
+
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "legacy-rig")
+	if err := os.MkdirAll(filepath.Join(rigDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(`[workspace]
+name = "demo"
+
+[beads]
+provider = "bd"
+
+[[rigs]]
+name = "legacy-rig"
+path = "legacy-rig"
+prefix = "lg"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(rigDir, ".gc", "beads.json"), []byte(`{"seq":1,"beads":[]}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_CITY_PATH", cityDir)
+
+	var stdout, stderr bytes.Buffer
+	if got := doBd([]string{"--rig", "legacy-rig", "list"}, &stdout, &stderr); got == 0 {
+		t.Fatalf("doBd() = %d, want non-zero", got)
+	}
+	out := stderr.String()
+	if !strings.Contains(out, `resolved "file"`) {
+		t.Fatalf("stderr = %q, want named provider in error", out)
+	}
+	if !strings.Contains(out, ".gc/beads.json") {
+		t.Fatalf("stderr = %q, want named marker in hint", out)
+	}
+	if !strings.Contains(out, ".beads/metadata.json") {
+		t.Fatalf("stderr = %q, want named fix in hint", out)
+	}
+}
+
 func TestGcBdAllowsRigPassthroughForBdBackedRigUnderFileCity(t *testing.T) {
 	origCityFlag := cityFlag
 	origRigFlag := rigFlag
@@ -831,7 +949,7 @@ func TestManagedBdRigProviderStoreRecoversAfterHardKillPortRebind(t *testing.T)
 	if err != nil {
 		t.Fatalf("providerStore.Create after rebind: %v", err)
 	}
-	if got := beadPrefix(rebound.ID); got != "fe" {
+	if got := beadPrefix(nil, rebound.ID); got != "fe" {
 		t.Fatalf("provider rebind bead prefix = %q, want %q", got, "fe")
 	}
 
@@ -882,7 +1000,7 @@ func TestManagedBdRigStoreConsistentAcrossRawBdGcBdAndProviderStore(t *testing.T
 	if err != nil {
 		t.Fatalf("providerStore.Create: %v", err)
 	}
-	if got := beadPrefix(providerBead.ID); got != "fe" {
+	if got := beadPrefix(nil, providerBead.ID); got != "fe" {
 		t.Fatalf("provider rig bead prefix = %q, want %q", got, "fe")
 	}
 	rawShow := runRawBDFromDir(t, bdPath, rawDir, "show", "--json", providerBead.ID)
@@ -1010,7 +1128,7 @@ func TestManagedBdCityStoreConsistentAcrossRawBdGcBdAndProviderStore(t *testing.
 	}
 
 	rawID := parseCreatedBeadID(t, runRawBDFromDir(t, bdPath, rawDir, "create", "--json", "raw city bead", "-t", "task"))
-	if got := beadPrefix(rawID); got != "gc" {
+	if got := beadPrefix(nil, rawID); got != "gc" {
 		t.Fatalf("raw city bead prefix = %q, want %q", got, "gc")
 	}
 	providerStore, err := openStoreAtForCity(cityPath, cityPath)
@@ -1036,7 +1154,7 @@ func TestManagedBdCityStoreConsistentAcrossRawBdGcBdAndProviderStore(t *testing.
 	if err != nil {
 		t.Fatalf("providerStore.Create: %v", err)
 	}
-	if got := beadPrefix(providerBead.ID); got != "gc" {
+	if got := beadPrefix(nil, providerBead.ID); got != "gc" {
 		t.Fatalf("provider city bead prefix = %q, want %q", got, "gc")
 	}
 	rawShow := runRawBDFromDir(t, bdPath, rawDir, "show", "--json", providerBead.ID)
@@ -1072,7 +1190,7 @@ func TestFreshManagedBdCityInitSeedsPinnedHQDatabaseAndKeepsGCPrefix(t *testing.
 		t.Fatalf("MkdirAll(rawDir): %v", err)
 	}
 	rawID := parseCreatedBeadID(t, runRawBDFromDir(t, bdPath, rawDir, "create", "--json", "fresh city bead", "-t", "task"))
-	if got := beadPrefix(rawID); got != "gc" {
+	if got := beadPrefix(nil, rawID); got != "gc" {
 		t.Fatalf("raw city bead prefix = %q, want %q", got, "gc")
 	}
 	providerStore, err := openStoreAtForCity(cityPath, cityPath)
@@ -1083,7 +1201,7 @@ func TestFreshManagedBdCityInitSeedsPinnedHQDatabaseAndKeepsGCPrefix(t *testing.
 	if err != nil {
 		t.Fatalf("providerStore.Create: %v", err)
 	}
-	if got := beadPrefix(providerBead.ID); got != "gc" {
+	if got := beadPrefix(nil, providerBead.ID); got != "gc" {
 		t.Fatalf("provider city bead prefix = %q, want %q", got, "gc")
 	}
 }
@@ -1283,6 +1401,38 @@ func TestResolveBdScopeTargetUsesEnclosingRig(t *testing.T) {
 	}
 }
 
+func TestResolveBdScopeTargetRoutesExistingCityBeadFromRigCwd(t *testing.T) {
+	origProbe := bdBeadExists
+	defer func() { bdBeadExists = origProbe }()
+	bdBeadExists = func(_ string, target execStoreTarget, beadID string) bool {
+		return target.ScopeKind == "city" && beadID == "mc-city1"
+	}
+
+	cityDir := filepath.Join(t.TempDir(), "city")
+	rigDir := filepath.Join(cityDir, "frontend")
+	if err := os.MkdirAll(filepath.Join(rigDir, "nested"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "maintainer-city", Prefix: "mc"},
+		Rigs:      []config.Rig{{Name: "frontend", Path: "frontend", Prefix: "fr"}},
+	}
+	setCwd(t, filepath.Join(rigDir, "nested"))
+
+	got, err := resolveBdScopeTarget(cfg, cityDir, "", []string{"show", "mc-city1"})
+	if err != nil {
+		t.Fatalf("resolveBdScopeTarget() error = %v", err)
+	}
+	want := execStoreTarget{
+		ScopeRoot: cityDir,
+		ScopeKind: "city",
+		Prefix:    "mc",
+	}
+	if got != want {
+		t.Fatalf("resolveBdScopeTarget() = %#v, want %#v", got, want)
+	}
+}
+
 func TestGcBdRespectsRawCityFlag(t *testing.T) {
 	origCityFlag := cityFlag
 	origRigFlag := rigFlag
@@ -1490,6 +1640,8 @@ set -eu
 	origPath := os.Getenv("PATH")
 	t.Setenv("PATH", binDir+string(os.PathListSeparator)+origPath)
 	t.Setenv("CAPTURE_PATH", capture)
+	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	t.Setenv("GC_DOLT_PORT", "9999")
 
 	var stdout, stderr bytes.Buffer
diff --git a/cmd/gc/cmd_beads_city_test.go b/cmd/gc/cmd_beads_city_test.go
index 25f865b927..b5e00d8fbc 100644
--- a/cmd/gc/cmd_beads_city_test.go
+++ b/cmd/gc/cmd_beads_city_test.go
@@ -286,6 +286,7 @@ func TestDoBeadsCityUseExternalStopsManagedLocalProvider(t *testing.T) {
 	verifyCityExternalEndpoint = func(contract.ConfigState, string, string) error { return nil }
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	var stdout, stderr bytes.Buffer
 	code := doBeadsCityEndpoint(fsys.OSFS{}, cityDir, cityEndpointOptions{
 		External:        true,
@@ -331,6 +332,7 @@ func TestDoBeadsCityUseExternalValidationFailureDoesNotStopManagedLocalProvider(
 	verifyCityExternalEndpoint = func(contract.ConfigState, string, string) error { return fmt.Errorf("nope") }
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	var stdout, stderr bytes.Buffer
 	code := doBeadsCityEndpoint(fsys.OSFS{}, cityDir, cityEndpointOptions{
 		External: true,
@@ -387,6 +389,7 @@ func TestDoBeadsCityUseExternalStopFailureKeepsExternalConfig(t *testing.T) {
 	verifyCityExternalEndpoint = func(contract.ConfigState, string, string) error { return nil }
 
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityDir)
 	var stdout, stderr bytes.Buffer
 	code := doBeadsCityEndpoint(fsys.OSFS{}, cityDir, cityEndpointOptions{
 		External:        true,
diff --git a/cmd/gc/cmd_citystatus.go b/cmd/gc/cmd_citystatus.go
index 43f1c41073..8e5e5c510f 100644
--- a/cmd/gc/cmd_citystatus.go
+++ b/cmd/gc/cmd_citystatus.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -105,12 +106,17 @@ func cmdCityStatus(args []string, jsonOutput bool, stdout, stderr io.Writer) int
 		return 1
 	}
 
-	sp := newSessionProvider()
+	store, code := openCityStatusStore(cityPath, stderr)
+	if code != 0 {
+		return code
+	}
+	statusSnapshot := loadStatusSessionSnapshot(store)
+	sp := newStatusSessionProviderForCityWithSnapshot(cfg, cityPath, statusSnapshot)
 	dops := newDrainOps(sp)
 	if jsonOutput {
-		return doCityStatusJSON(sp, cfg, cityPath, stdout, stderr)
+		return doCityStatusJSONWithStoreAndSnapshot(sp, cfg, cityPath, store, statusSnapshot, stdout, stderr)
 	}
-	return doCityStatus(sp, dops, cfg, cityPath, stdout, stderr)
+	return doCityStatusWithStoreAndSnapshot(sp, dops, cfg, cityPath, store, statusSnapshot, stdout, stderr)
 }
 
 func observeSessionTargetWithWarning(
@@ -119,16 +125,63 @@ func observeSessionTargetWithWarning(
 	store beads.Store,
 	sp runtime.Provider,
 	cfg *config.City,
-	target string,
+	target statusObservationTarget,
 	stderr io.Writer,
 ) worker.LiveObservation {
-	obs, err := observeSessionTargetForStatus(cityPath, store, sp, cfg, target)
+	if store != nil && target.sessionID != "" {
+		handle, err := workerHandleForSessionWithConfig(cityPath, store, sp, cfg, target.sessionID)
+		if err == nil {
+			obs, err := worker.ObserveHandle(context.Background(), handle)
+			if err == nil {
+				return obs
+			}
+		}
+	}
+
+	// Status already passes a concrete runtime session name. Resolving that
+	// string back through the bead store turns stopped pool instances such as
+	// "dog-1" into invalid bd show lookups, which can block the overview.
+	obs, err := observeSessionTargetForStatus(cityPath, nil, sp, cfg, target.runtimeSessionName)
 	if err != nil && stderr != nil {
-		fmt.Fprintf(stderr, "%s: observing %q: %v\n", cmdName, target, err) //nolint:errcheck // best-effort stderr
+		fmt.Fprintf(stderr, "%s: observing %q: %v\n", cmdName, target.runtimeSessionName, err) //nolint:errcheck // best-effort stderr
 	}
 	return obs
 }
 
+type statusObservationTarget struct {
+	runtimeSessionName string
+	sessionID          string
+}
+
+func loadStatusSessionSnapshot(store beads.Store) *sessionBeadSnapshot {
+	snapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		return nil
+	}
+	return snapshot
+}
+
+func statusObservationTargetForIdentity(
+	snapshot *sessionBeadSnapshot,
+	cityName string,
+	identity string,
+	sessionTemplate string,
+) statusObservationTarget {
+	if snapshot != nil {
+		if bead, ok := snapshot.FindSessionBeadByTemplate(identity); ok {
+			if sessionName := strings.TrimSpace(bead.Metadata["session_name"]); sessionName != "" {
+				return statusObservationTarget{
+					runtimeSessionName: sessionName,
+					sessionID:          bead.ID,
+				}
+			}
+		}
+	}
+	return statusObservationTarget{
+		runtimeSessionName: sessionName(nil, cityName, identity, sessionTemplate),
+	}
+}
+
 func namedSessionBlockedBySuspension(cfg *config.City, agentCfg *config.Agent, suspendedRigs map[string]bool) bool {
 	if cfg == nil {
 		return false
@@ -155,8 +208,19 @@ func doCityStatus(
 	if code != 0 {
 		return code
 	}
+	return doCityStatusWithStoreAndSnapshot(sp, dops, cfg, cityPath, store, loadStatusSessionSnapshot(store), stdout, stderr)
+}
 
-	snapshot := collectCityStatusSnapshot(sp, cfg, cityPath, store, stderr)
+func doCityStatusWithStoreAndSnapshot(
+	sp runtime.Provider,
+	dops drainOps,
+	cfg *config.City,
+	cityPath string,
+	store beads.Store,
+	statusSnapshot *sessionBeadSnapshot,
+	stdout, stderr io.Writer,
+) int {
+	snapshot := collectCityStatusSnapshotFromStoreSnapshot(sp, cfg, cityPath, store, statusSnapshot, stderr)
 	renderCityStatusText(snapshot, dops, stdout)
 
 	if store != nil {
@@ -186,8 +250,18 @@ func doCityStatusJSON(
 	if code != 0 {
 		return code
 	}
+	return doCityStatusJSONWithStoreAndSnapshot(sp, cfg, cityPath, store, loadStatusSessionSnapshot(store), stdout, stderr)
+}
 
-	snapshot := collectCityStatusSnapshot(sp, cfg, cityPath, store, stderr)
+func doCityStatusJSONWithStoreAndSnapshot(
+	sp runtime.Provider,
+	cfg *config.City,
+	cityPath string,
+	store beads.Store,
+	statusSnapshot *sessionBeadSnapshot,
+	stdout, stderr io.Writer,
+) int {
+	snapshot := collectCityStatusSnapshotFromStoreSnapshot(sp, cfg, cityPath, store, statusSnapshot, stderr)
 	if store != nil {
 		sessions, err := collectCitySessionCounts(cityPath, store, sp, cfg)
 		if err != nil {
diff --git a/cmd/gc/cmd_commands.go b/cmd/gc/cmd_commands.go
index d35201be79..efe478cc93 100644
--- a/cmd/gc/cmd_commands.go
+++ b/cmd/gc/cmd_commands.go
@@ -16,6 +16,8 @@ import (
 	"github.com/spf13/cobra"
 )
 
+const docgenSkipAnnotation = "gc.docgen.skip"
+
 func addDiscoveredCommandsToRoot(root *cobra.Command, entries []config.DiscoveredCommand, cityPath, cityName string, stdout, stderr io.Writer, warnOnCollision bool) {
 	core := coreCommandNames(root)
 	grouped := make(map[string][]config.DiscoveredCommand)
@@ -46,8 +48,9 @@ func addDiscoveredCommandsToRoot(root *cobra.Command, entries []config.Discovere
 
 func newDiscoveredNamespaceCmd(binding string, entries []config.DiscoveredCommand, cityPath, cityName string, stdout, stderr io.Writer) *cobra.Command {
 	ns := &cobra.Command{
-		Use:   binding,
-		Short: fmt.Sprintf("Commands from the %s import", binding),
+		Use:         binding,
+		Short:       fmt.Sprintf("Commands from the %s import", binding),
+		Annotations: map[string]string{docgenSkipAnnotation: "true"},
 		RunE: func(c *cobra.Command, _ []string) error {
 			return c.Help()
 		},
diff --git a/cmd/gc/cmd_config.go b/cmd/gc/cmd_config.go
index 30852eba9c..2260c582af 100644
--- a/cmd/gc/cmd_config.go
+++ b/cmd/gc/cmd_config.go
@@ -27,13 +27,22 @@ func loadConfigCommandCityConfig(cityPath string) (*config.City, *config.Provena
 }
 
 func loadCityConfigWithBuiltinPacks(cityPath string, includes ...string) (*config.City, *config.Provenance, error) {
+	allIncludes, err := cityConfigIncludesWithBuiltinPacks(cityPath, includes...)
+	if err != nil {
+		return nil, nil, err
+	}
+	return config.LoadWithIncludes(fsys.OSFS{}, filepath.Join(cityPath, "city.toml"), allIncludes...)
+}
+
+func cityConfigIncludesWithBuiltinPacks(cityPath string, includes ...string) ([]string, error) {
 	if err := MaterializeBuiltinPacks(cityPath); err != nil {
-		return nil, nil, fmt.Errorf("materializing builtin packs: %w", err)
+		return nil, fmt.Errorf("materializing builtin packs: %w", err)
 	}
-	allIncludes := make([]string, 0, len(includes)+3)
+	builtinIncludes := builtinPackIncludes(cityPath)
+	allIncludes := make([]string, 0, len(includes)+len(builtinIncludes))
 	allIncludes = append(allIncludes, includes...)
-	allIncludes = append(allIncludes, builtinPackIncludes(cityPath)...)
-	return config.LoadWithIncludes(fsys.OSFS{}, filepath.Join(cityPath, "city.toml"), allIncludes...)
+	allIncludes = append(allIncludes, builtinIncludes...)
+	return allIncludes, nil
 }
 
 func newConfigCmd(stdout, stderr io.Writer) *cobra.Command {
diff --git a/cmd/gc/cmd_convoy_dispatch.go b/cmd/gc/cmd_convoy_dispatch.go
index e727b660a1..635a81da6c 100644
--- a/cmd/gc/cmd_convoy_dispatch.go
+++ b/cmd/gc/cmd_convoy_dispatch.go
@@ -8,6 +8,7 @@ import (
 	"maps"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strings"
 	"syscall"
 
@@ -117,25 +118,90 @@ func runControlDispatcher(beadID string, stdout, stderr io.Writer) error {
 		return err
 	}
 
-	// Try all stores (city + rigs) to find the bead.
-	store, bead, err := findBeadAcrossStores(cityPath, beadID, stderr)
+	// Manual control dispatch keeps the operator convenience of resolving a
+	// bead ID across city and rig stores.
+	store, bead, storePath, err := findBeadAcrossStores(cityPath, beadID, stderr)
 	if err != nil {
 		return fmt.Errorf("loading bead %s: %w", beadID, err)
 	}
 
-	opts := dispatch.ProcessOptions{CityPath: cityPath}
+	return runControlDispatcherWithStore(cityPath, storePath, store, bead, beadID, stdout, stderr)
+}
+
+func runControlDispatcherInStore(cityPath, storePath, beadID string, stdout, stderr io.Writer) error {
+	if cityPath == "" {
+		var err error
+		cityPath, err = resolveCity()
+		if err != nil {
+			return err
+		}
+	}
+	if storePath == "" {
+		storePath = cityPath
+	}
+
+	cfg, err := loadCityConfig(cityPath, stderr)
+	if err != nil {
+		return err
+	}
+	resolveRigPaths(cityPath, cfg.Rigs)
+	store, err := openControlStoreAtForCity(storePath, cityPath, cfg)
+	if err != nil {
+		return fmt.Errorf("opening scoped control store %q: %w", storePath, err)
+	}
+	bead, err := store.Get(beadID)
+	if err != nil {
+		return fmt.Errorf("loading bead %s from scoped control store %q: %w", beadID, storePath, err)
+	}
+
+	return runControlDispatcherWithStoreAndConfig(cityPath, storePath, store, bead, beadID, cfg, stdout, stderr)
+}
+
+func runControlDispatcherWithStore(cityPath, storePath string, store beads.Store, bead beads.Bead, beadID string, stdout, stderr io.Writer) error {
+	return runControlDispatcherWithStoreAndConfig(cityPath, storePath, store, bead, beadID, nil, stdout, stderr)
+}
+
+func runControlDispatcherWithStoreAndConfig(cityPath, storePath string, store beads.Store, bead beads.Bead, beadID string, cfg *config.City, stdout, stderr io.Writer) error {
+	restoreTraceWarnings := useWorkflowTraceWarnings(stderr)
+	defer restoreTraceWarnings()
+	var cfgLoadErr error
+	if cfg == nil {
+		cfg, cfgLoadErr = loadCityConfig(cityPath, stderr)
+		if cfg != nil {
+			resolveRigPaths(cityPath, cfg.Rigs)
+		}
+	}
+	if cfg != nil {
+		warnLegacyWorkflowTracePath(cityPath, cfg.Rigs, stderr)
+	} else {
+		warnLegacyWorkflowTracePath(cityPath, nil, stderr)
+	}
+
+	opts := dispatch.ProcessOptions{CityPath: cityPath, StorePath: storePath}
 	opts.Tracef = workflowTracef
 	loadCfg := false
 	switch bead.Metadata["gc.kind"] {
 	case "check", "fanout", "retry-eval", "retry", "ralph":
 		loadCfg = true
+	case "workflow-finalize":
+		// Need cfg to resolve "city:<name>" / "rig:<name>" store refs when
+		// closing parent source beads in their native stores.
+		loadCfg = true
 	}
 	if loadCfg {
-		cfg, err := loadCityConfig(cityPath, stderr)
-		if err != nil {
-			return err
+		if cfg == nil {
+			if cfgLoadErr != nil {
+				return cfgLoadErr
+			}
+			return fmt.Errorf("loading city config for %s: unavailable after warning-only load", cityPath)
+		}
+		opts.ResolveStoreRef = makeStoreRefResolver(cityPath, cfg)
+		if bead.Metadata["gc.kind"] == "workflow-finalize" {
+			sourceWorkflowCtx, cancelSourceWorkflowCtx := sourceWorkflowCommandContext()
+			defer cancelSourceWorkflowCtx()
+			opts.SourceWorkflowLock = makeSourceWorkflowLocker(sourceWorkflowCtx, cityPath, cfg, storePath)
+			opts.SourceWorkflowStores = makeSourceWorkflowStoresLister(cityPath, cfg)
 		}
-		resolveRigPaths(cityPath, cfg.Rigs)
 		switch bead.Metadata["gc.kind"] {
 		case "check", "fanout":
 			opts.FormulaSearchPaths = workflowFormulaSearchPaths(cfg, bead)
@@ -179,43 +245,171 @@ func runControlDispatcher(beadID string, stdout, stderr io.Writer) error {
 	return nil
 }
 
+// makeStoreRefResolver returns a dispatch.ProcessOptions.ResolveStoreRef
+// closure for the given city. The resolver maps "city:<name>" and
+// "rig:<name>" gc.source_store_ref values to a beads.Store rooted at the
+// matching scope. processWorkflowFinalize uses it to walk the source bead
+// chain across store boundaries so a successful rig-scope workflow closes
+// the city-scope source bead that spawned it (e.g. PR-review "Adopt PR"
+// requests).
+func makeStoreRefResolver(cityPath string, cfg *config.City) func(string) (beads.Store, error) {
+	cityName := loadedCityName(cfg, cityPath)
+	return func(ref string) (beads.Store, error) {
+		ref = strings.TrimSpace(ref)
+		if ref == "" {
+			return nil, fmt.Errorf("empty store ref")
+		}
+		switch {
+		case strings.HasPrefix(ref, "city:"):
+			name := strings.TrimSpace(strings.TrimPrefix(ref, "city:"))
+			// "city:" without a name still resolves to this city's store -
+			// older callers stamp ambiguous refs and the only reachable city
+			// from a control-dispatcher is the one it was launched in.
+			if name != "" && cityName != "" && name != cityName {
+				return nil, fmt.Errorf("city ref %q does not match this city %q", ref, cityName)
+			}
+			return openStoreAtForCity(cityPath, cityPath)
+		case strings.HasPrefix(ref, "rig:"):
+			name := strings.TrimSpace(strings.TrimPrefix(ref, "rig:"))
+			if name == "" {
+				return nil, fmt.Errorf("rig ref %q missing rig name", ref)
+			}
+			if cfg == nil {
+				return nil, fmt.Errorf("no city config available to resolve %q", ref)
+			}
+			for _, rig := range cfg.Rigs {
+				if rig.Name != name {
+					continue
+				}
+				return openControlStoreAtForCity(rig.Path, cityPath, cfg)
+			}
+			return nil, fmt.Errorf("rig %q not found in city config", name)
+		default:
+			return nil, fmt.Errorf("unsupported store ref scheme: %q", ref)
+		}
+	}
+}
+
+func makeSourceWorkflowLocker(ctx context.Context, cityPath string, cfg *config.City, defaultStorePath string) func(storeRef, sourceBeadID string, fn func() error) error {
+	return func(storeRef, sourceBeadID string, fn func() error) error {
+		return sourceworkflow.WithLock(ctx, cityPath, sourceWorkflowLockScopeForStoreRef(cityPath, cfg, defaultStorePath, storeRef), sourceBeadID, fn)
+	}
+}
+
+func makeSourceWorkflowStoresLister(cityPath string, cfg *config.City) func() ([]dispatch.SourceWorkflowStore, error) {
+	return makeSourceWorkflowStoresListerWithOpenStore(cityPath, cfg, func(dir string) (beads.Store, error) {
+		return openStoreAtForCity(dir, cityPath)
+	})
+}
+
+func makeSourceWorkflowStoresListerWithOpenStore(cityPath string, cfg *config.City, openStore func(string) (beads.Store, error)) func() ([]dispatch.SourceWorkflowStore, error) {
+	var (
+		loaded  bool
+		stores  []dispatch.SourceWorkflowStore
+		loadErr error
+	)
+	return func() ([]dispatch.SourceWorkflowStore, error) {
+		if loaded {
+			return stores, loadErr
+		}
+		loaded = true
+		views, skips, err := openSourceWorkflowStoresWith(cfg, cityPath, "", openStore)
+		if err != nil {
+			loadErr = err
+			return nil, err
+		}
+		if len(skips) > 0 {
+			msg := formatSourceWorkflowStoreSkips(skips)
+			workflowTracef("source-workflow stores warning=%q", msg)
+			loadErr = errors.New(msg)
+			return nil, loadErr
+		}
+		cityName := loadedCityName(cfg, cityPath)
+		stores = make([]dispatch.SourceWorkflowStore, 0, len(views))
+		for _, view := range views {
+			stores = append(stores, dispatch.SourceWorkflowStore{
+				Store:    view.store,
+				StoreRef: workflowStoreRefForDir(view.path, cityPath, cityName, cfg),
+			})
+		}
+		return stores, nil
+	}
+}
+
+func sourceWorkflowLockScopeForStoreRef(cityPath string, cfg *config.City, defaultStorePath string, storeRef string) string {
+	return sourceworkflow.LockScopeForStoreRef(cityPath, defaultStorePath, storeRef, func(rigName string) (string, bool) {
+		if cfg != nil {
+			for _, rig := range cfg.Rigs {
+				if rig.Name != rigName {
+					continue
+				}
+				return rig.Path, true
+			}
+		}
+		return "", false
+	})
+}
+
+func openControlStoreAtForCity(storePath, cityPath string, cfg *config.City) (beads.Store, error) {
+	scopeRoot := resolveStoreScopeRoot(cityPath, storePath)
+	provider := rawBeadsProviderForScope(scopeRoot, cityPath)
+	if provider == "file" || strings.HasPrefix(provider, "exec:") {
+		return openStoreAtForCity(storePath, cityPath)
+	}
+	if samePath(scopeRoot, cityPath) {
+		return controlBdStoreForCity(scopeRoot, cityPath, cfg), nil
+	}
+	if cfg != nil {
+		for _, rig := range cfg.Rigs {
+			rigPath := rig.Path
+			if !filepath.IsAbs(rigPath) {
+				rigPath = filepath.Join(cityPath, rigPath)
+			}
+			if samePath(rigPath, scopeRoot) {
+				return controlBdStoreForRig(scopeRoot, cityPath, cfg), nil
+			}
+		}
+	}
+	// A bd-backed scope can outlive its rig entry in city.toml. Control paths
+	// still need write-capable bd commands with auto-export suppressed.
+	return controlBdStoreForRig(scopeRoot, cityPath, cfg), nil
+}
+
 // findBeadAcrossStores tries the city store first, then all rig stores,
 // returning the store and bead on first match.
-func findBeadAcrossStores(cityPath, beadID string, warningWriter io.Writer) (beads.Store, beads.Bead, error) {
+func findBeadAcrossStores(cityPath, beadID string, warningWriter io.Writer) (beads.Store, beads.Bead, string, error) {
 	// Try city store first.
 	cityStore, err := openStoreAtForCity(cityPath, cityPath)
 	if err != nil {
-		return nil, beads.Bead{}, fmt.Errorf("opening city store: %w", err)
+		return nil, beads.Bead{}, "", fmt.Errorf("opening city store: %w", err)
 	}
-	if bead, err := cityStore.Get(beadID); err == nil {
-		return cityStore, bead, nil
+	if b, err := cityStore.Get(beadID); err == nil {
+		return cityStore, b, cityPath, nil
 	} else if !errors.Is(err, beads.ErrNotFound) {
-		return nil, beads.Bead{}, fmt.Errorf("getting bead %q from %s: %w", beadID, cityPath, err)
+		return nil, beads.Bead{}, "", fmt.Errorf("getting bead %q from %s: %w", beadID, cityPath, err)
 	}
 
 	// Try rig stores.
 	cfg, err := loadCityConfig(cityPath, warningWriter)
 	if err != nil {
-		return nil, beads.Bead{}, err
+		return nil, beads.Bead{}, "", fmt.Errorf("getting bead %q: not in city store, and config unavailable: %w", beadID, err)
 	}
-	for _, dir := range convoyStoreCandidates(cfg, cityPath, beadID) {
-		if dir == cityPath {
-			continue
-		}
-		store, err := openStoreAtForCity(dir, cityPath)
+	resolveRigPaths(cityPath, cfg.Rigs)
+	for _, rig := range cfg.Rigs {
+		store, err := openControlStoreAtForCity(rig.Path, cityPath, cfg)
 		if err != nil {
-			return nil, beads.Bead{}, fmt.Errorf("opening store %s: %w", dir, err)
+			return nil, beads.Bead{}, "", fmt.Errorf("opening rig store %q: %w", rig.Name, err)
 		}
 		bead, err := store.Get(beadID)
 		if err != nil {
 			if errors.Is(err, beads.ErrNotFound) {
 				continue
 			}
-			return nil, beads.Bead{}, fmt.Errorf("getting bead %q from %s: %w", beadID, dir, err)
+			return nil, beads.Bead{}, "", fmt.Errorf("getting bead %q from %s: %w", beadID, rig.Path, err)
 		}
-		return store, bead, nil
+		return store, bead, rig.Path, nil
 	}
-	return nil, beads.Bead{}, fmt.Errorf("getting bead %q: %w", beadID, beads.ErrNotFound)
+	return nil, beads.Bead{}, "", fmt.Errorf("getting bead %q: %w", beadID, beads.ErrNotFound)
 }
 
 func findUniqueBeadAcrossStoresView(cityPath, beadID string) (convoyStoreView, beads.Bead, error) {
@@ -408,14 +602,14 @@ func newConvoyDeleteCmd(stdout, stderr io.Writer) *cobra.Command {
 	var deleteBeads bool
 	cmd := &cobra.Command{
 		Use:   "delete <convoy-id>",
-		Short: "Close and optionally delete a convoy and all its beads",
-		Long: `Close all open beads in a convoy, then optionally delete them.
+		Short: "Close or delete a convoy and all its beads",
+		Long: `Close all open beads in a convoy, or delete them.
 
 Searches all stores (city + rigs) for the convoy root and all beads
 with matching gc.root_bead_id. Without --force, shows a preview.
 
 By default, beads are closed with gc.outcome=skipped. Use --delete to
-also remove them from the store after closing.`,
+remove them from the store via bd delete --cascade --force.`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(_ *cobra.Command, args []string) error {
 			if cmdWorkflowDelete(args[0], force, deleteBeads, stdout, stderr) != 0 {
@@ -425,7 +619,7 @@ also remove them from the store after closing.`,
 		},
 	}
 	cmd.Flags().BoolVarP(&force, "force", "f", false, "Actually close/delete (without this, shows preview)")
-	cmd.Flags().BoolVar(&deleteBeads, "delete", false, "Also delete beads from the store after closing")
+	cmd.Flags().BoolVar(&deleteBeads, "delete", false, "Delete beads from the store instead of closing")
 	return cmd
 }
 
@@ -482,6 +676,14 @@ func newConvoyReopenSourceCmd(stdout, stderr io.Writer) *cobra.Command {
 	return cmd
 }
 
+type workflowStoreMatch struct {
+	store  beads.Store
+	beads  []beads.Bead
+	label  string
+	path   string
+	runner beads.CommandRunner
+}
+
 func cmdWorkflowDelete(workflowID string, force, deleteBeads bool, stdout, stderr io.Writer) int {
 	cityPath, err := resolveCity()
 	if err != nil {
@@ -493,16 +695,12 @@ func cmdWorkflowDelete(workflowID string, force, deleteBeads bool, stdout, stder
 		fmt.Fprintf(stderr, "gc workflow delete: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
+	resolveRigPaths(cityPath, cfg.Rigs)
 
-	type storeMatch struct {
-		store beads.Store
-		beads []beads.Bead
-		label string
-	}
-	var matches []storeMatch
+	var matches []workflowStoreMatch
 
 	stores, err := openConvoyStores(cfg, cityPath, workflowID, func(dir string) (beads.Store, error) {
-		return openStoreAtForCity(dir, cityPath)
+		return openControlStoreAtForCity(dir, cityPath, cfg)
 	})
 	if err != nil {
 		fmt.Fprintf(stderr, "gc workflow delete: %v\n", err) //nolint:errcheck // best-effort stderr
@@ -513,10 +711,12 @@ func cmdWorkflowDelete(workflowID string, force, deleteBeads bool, stdout, stder
 		if len(found) == 0 {
 			continue
 		}
-		matches = append(matches, storeMatch{
-			store: info.store,
-			beads: found,
-			label: workflowDeleteStoreLabel(cfg, cityPath, info.path),
+		matches = append(matches, workflowStoreMatch{
+			store:  info.store,
+			beads:  found,
+			label:  workflowDeleteStoreLabel(cfg, cityPath, info.path),
+			path:   info.path,
+			runner: workflowDeleteRunnerForPath(cfg, cityPath, info.path),
 		})
 	}
 
@@ -549,41 +749,62 @@ func cmdWorkflowDelete(workflowID string, force, deleteBeads bool, stdout, stder
 		return 0
 	}
 
-	// Phase 1: Batch close all open beads with gc.outcome=skipped.
+	if deleteBeads {
+		deleted, err := deleteWorkflowMatches(matches)
+		if err != nil {
+			fmt.Fprintf(stderr, "  batch delete: %v\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+		fmt.Fprintf(stdout, "Deleted %d beads\n", deleted) //nolint:errcheck // best-effort stdout
+		return 0
+	}
+
+	closed := closeWorkflowMatches(matches)
+	fmt.Fprintf(stdout, "Closed %d open beads\n", closed) //nolint:errcheck // best-effort stdout
+	return 0
+}
+
+func closeWorkflowMatches(matches []workflowStoreMatch) int {
 	closed := 0
 	for _, m := range matches {
 		ids := workflowBeadIDs(m.beads)
 		n, _ := m.store.CloseAll(ids, map[string]string{"gc.outcome": "skipped"})
 		closed += n
 	}
-	fmt.Fprintf(stdout, "Closed %d open beads\n", closed) //nolint:errcheck // best-effort stdout
+	return closed
+}
 
-	if !deleteBeads {
-		return 0
+func workflowDeleteRunnerForPath(cfg *config.City, cityPath, scopePath string) beads.CommandRunner {
+	if samePath(scopePath, cityPath) {
+		return bdCommandRunnerForCity(cityPath)
 	}
+	return bdCommandRunnerForRig(cityPath, cfg, scopePath)
+}
 
+func deleteWorkflowMatches(matches []workflowStoreMatch) (int, error) {
 	deleted := 0
-	deleteFailed := false
 	for _, m := range matches {
-		count, errs := deleteWorkflowBeads(m.store, workflowBeadIDs(m.beads))
-		deleted += count
-		for _, err := range errs {
-			deleteFailed = true
-			fmt.Fprintf(stderr, "  delete %s: %v\n", m.label, err) //nolint:errcheck // best-effort stderr
+		if m.runner == nil {
+			return deleted, fmt.Errorf("%s: delete runner missing", m.label)
 		}
+		ids := workflowBeadIDs(m.beads)
+		args := append([]string{"delete"}, ids...)
+		args = append(args, "--cascade", "--force")
+		if _, err := m.runner(m.path, "bd", args...); err != nil {
+			return deleted, fmt.Errorf("%s: %w", m.label, err)
+		}
+		deleted += len(ids)
 	}
-	fmt.Fprintf(stdout, "Deleted %d beads\n", deleted) //nolint:errcheck // best-effort stdout
-	if deleteFailed {
-		return 1
-	}
-	return 0
+	return deleted, nil
 }
 
 type sourceWorkflowStoreMatch struct {
-	label string
-	store beads.Store
-	roots []beads.Bead
-	beads []beads.Bead
+	label  string
+	store  beads.Store
+	roots  []beads.Bead
+	beads  []beads.Bead
+	path   string
+	runner beads.CommandRunner
 }
 
 type sourceWorkflowStoreSelector struct {
@@ -708,7 +929,7 @@ func applySourceWorkflowMatchCleanup(match sourceWorkflowStoreMatch, deleteBeads
 	if !deleteBeads {
 		return closed, deleted, incomplete
 	}
-	count, errs := deleteWorkflowBeads(match.store, ids)
+	count, errs := deleteSourceWorkflowMatchBeads(match, ids)
 	deleted += count
 	for _, deleteErr := range errs {
 		incomplete = true
@@ -717,6 +938,13 @@ func applySourceWorkflowMatchCleanup(match sourceWorkflowStoreMatch, deleteBeads
 	return closed, deleted, incomplete
 }
 
+func deleteSourceWorkflowMatchBeads(match sourceWorkflowStoreMatch, ids []string) (int, []error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	return deleteWorkflowBeads(match.store, ids)
+}
+
 func cmdWorkflowDeleteSource(sourceBeadID string, selector sourceWorkflowStoreSelector, apply, deleteBeads bool, stdout, stderr io.Writer) int {
 	cityPath, err := resolveCity()
 	if err != nil {
@@ -1049,28 +1277,107 @@ func collectSourceWorkflowMatches(cfg *config.City, cityPath, sourceBeadID, sour
 	if err != nil {
 		return nil, skips, err
 	}
-	matches := make([]sourceWorkflowStoreMatch, 0, len(stores))
-	for _, info := range stores {
-		rootStoreRef := workflowStoreRefForDir(info.path, cityPath, loadedCityName(cfg, cityPath), cfg)
-		roots, err := sourceworkflow.ListLiveRoots(info.store, sourceBeadID, sourceStoreRef, rootStoreRef)
-		if err != nil {
-			return nil, skips, err
+	matchesByLabel := map[string]sourceWorkflowStoreMatch{}
+	visited := map[string]struct{}{}
+	cityName := loadedCityName(cfg, cityPath)
+
+	var collect func(string, string) error
+	collect = func(currentSourceID, currentSourceStoreRef string) error {
+		currentSourceID = strings.TrimSpace(currentSourceID)
+		if currentSourceID == "" {
+			return nil
 		}
-		if len(roots) == 0 {
+		for _, info := range stores {
+			rootStoreRef := workflowStoreRefForDir(info.path, cityPath, cityName, cfg)
+			// Downward delete-source walks key by root store plus source
+			// identity. The upward finalize walk in internal/dispatch only
+			// needs source store plus bead ID because each hop has one parent.
+			visitKey := rootStoreRef + "\x00" + currentSourceStoreRef + "\x00" + currentSourceID
+			if _, ok := visited[visitKey]; ok {
+				continue
+			}
+			visited[visitKey] = struct{}{}
+			roots, err := sourceworkflow.ListLiveRoots(info.store, currentSourceID, currentSourceStoreRef, rootStoreRef)
+			if err != nil {
+				return err
+			}
+			if len(roots) > 0 {
+				beadSet := make([]beads.Bead, 0, len(roots))
+				for _, root := range roots {
+					beadSet = append(beadSet, findWorkflowBeads(info.store, root.ID)...)
+				}
+				mergeSourceWorkflowMatch(matchesByLabel, sourceWorkflowStoreMatch{
+					label:  workflowDeleteStoreLabel(cfg, cityPath, info.path),
+					store:  info.store,
+					roots:  roots,
+					beads:  uniqueBeads(beadSet),
+					path:   info.path,
+					runner: workflowDeleteRunnerForPath(cfg, cityPath, info.path),
+				})
+			}
+			children, err := sourceWorkflowChildSources(info.store, currentSourceID, currentSourceStoreRef, rootStoreRef)
+			if err != nil {
+				return err
+			}
+			for _, child := range children {
+				if err := collect(child.ID, rootStoreRef); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	}
+	if err := collect(sourceBeadID, sourceStoreRef); err != nil {
+		return nil, skips, err
+	}
+	matches := make([]sourceWorkflowStoreMatch, 0, len(matchesByLabel))
+	for _, match := range matchesByLabel {
+		match.roots = uniqueBeads(match.roots)
+		match.beads = uniqueBeads(match.beads)
+		matches = append(matches, match)
+	}
+	return matches, skips, nil
+}
+
+func mergeSourceWorkflowMatch(matches map[string]sourceWorkflowStoreMatch, next sourceWorkflowStoreMatch) {
+	if next.label == "" {
+		return
+	}
+	current := matches[next.label]
+	if current.label == "" {
+		matches[next.label] = next
+		return
+	}
+	current.roots = append(current.roots, next.roots...)
+	current.beads = append(current.beads, next.beads...)
+	matches[next.label] = current
+}
+
+func sourceWorkflowChildSources(store beads.Store, sourceBeadID, sourceStoreRef, rootStoreRef string) ([]beads.Bead, error) {
+	sourceBeadID = strings.TrimSpace(sourceBeadID)
+	if store == nil || sourceBeadID == "" {
+		return nil, nil
+	}
+	candidates, err := store.List(beads.ListQuery{
+		IncludeClosed: true,
+		Metadata: map[string]string{
+			"gc.source_bead_id": sourceBeadID,
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	children := make([]beads.Bead, 0, len(candidates))
+	for _, candidate := range candidates {
+		if candidate.ID == "" || sourceworkflow.IsWorkflowRoot(candidate) {
 			continue
 		}
-		beadSet := make([]beads.Bead, 0, len(roots))
-		for _, root := range roots {
-			beadSet = append(beadSet, findWorkflowBeads(info.store, root.ID)...)
+		if !sourceworkflow.WorkflowMatchesSource(candidate, sourceBeadID, sourceStoreRef, rootStoreRef) {
+			continue
 		}
-		matches = append(matches, sourceWorkflowStoreMatch{
-			label: workflowDeleteStoreLabel(cfg, cityPath, info.path),
-			store: info.store,
-			roots: roots,
-			beads: uniqueBeads(beadSet),
-		})
+		children = append(children, candidate)
 	}
-	return matches, skips, nil
+	return children, nil
 }
 
 func sourceWorkflowMatchLabels(matches []sourceWorkflowStoreMatch) []string {
diff --git a/cmd/gc/cmd_convoy_dispatch_test.go b/cmd/gc/cmd_convoy_dispatch_test.go
index ac506f78e3..0fc0390e26 100644
--- a/cmd/gc/cmd_convoy_dispatch_test.go
+++ b/cmd/gc/cmd_convoy_dispatch_test.go
@@ -2,12 +2,14 @@ package main
 
 import (
 	"bytes"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"maps"
 	"os"
 	"path/filepath"
+	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -98,6 +100,183 @@ func TestOpenSourceWorkflowStoresFailsOnlyWhenEverythingBroken(t *testing.T) {
 	}
 }
 
+func TestWorkflowFinalizeRetriesWhenSourceWorkflowStoreScanSkipsLiveRoot(t *testing.T) {
+	cityPath := "/city"
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs: []config.Rig{
+			{Name: "alpha", Path: "rigs/alpha"},
+			{Name: "broken", Path: "rigs/broken"},
+		},
+	}
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	brokenStore := beads.NewMemStore()
+
+	citySource, err := cityStore.Create(beads.Bead{Title: "Adopt PR", Type: "task"})
+	if err != nil {
+		t.Fatalf("Create(city source): %v", err)
+	}
+	rigLaunch, err := rigStore.Create(beads.Bead{
+		Title: "Rig launch",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.source_bead_id":   citySource.ID,
+			"gc.source_store_ref": "city:test-city",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(rig launch): %v", err)
+	}
+	workflow, err := rigStore.Create(beads.Bead{
+		Title: "mol-adopt-pr-v2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   rigLaunch.ID,
+			"gc.source_store_ref": "rig:alpha",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(workflow): %v", err)
+	}
+	cleanup, err := rigStore.Create(beads.Bead{
+		Title: "cleanup",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.outcome": "pass",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(cleanup): %v", err)
+	}
+	if err := rigStore.Close(cleanup.ID); err != nil {
+		t.Fatalf("Close(cleanup): %v", err)
+	}
+	finalizer, err := rigStore.Create(beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(finalizer): %v", err)
+	}
+	if err := rigStore.DepAdd(finalizer.ID, cleanup.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd(finalizer->cleanup): %v", err)
+	}
+	if err := rigStore.DepAdd(workflow.ID, finalizer.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd(workflow->finalizer): %v", err)
+	}
+	hiddenRoot, err := brokenStore.Create(beads.Bead{
+		Title: "hidden live workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                                "workflow",
+			"gc.formula_contract":                    "graph.v2",
+			"gc.source_bead_id":                      citySource.ID,
+			sourceworkflow.SourceStoreRefMetadataKey: "city:test-city",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(hidden root): %v", err)
+	}
+
+	openStore := func(dir string) (beads.Store, error) {
+		switch filepath.Clean(dir) {
+		case filepath.Clean(cityPath):
+			return cityStore, nil
+		case filepath.Clean(filepath.Join(cityPath, "rigs/alpha")):
+			return rigStore, nil
+		case filepath.Clean(filepath.Join(cityPath, "rigs/broken")):
+			return nil, fmt.Errorf("simulated broken rig with live root %s", hiddenRoot.ID)
+		default:
+			return nil, fmt.Errorf("unexpected store path %s", dir)
+		}
+	}
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test-city":
+			return cityStore, nil
+		case "rig:alpha":
+			return rigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown ref %s", ref)
+		}
+	}
+
+	_, err = dispatch.ProcessControl(rigStore, finalizer, dispatch.ProcessOptions{
+		ResolveStoreRef:      resolver,
+		SourceWorkflowStores: makeSourceWorkflowStoresListerWithOpenStore(cityPath, cfg, openStore),
+		SourceWorkflowLock:   func(_ string, _ string, fn func() error) error { return fn() },
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) err = nil, want retryable skipped-store error")
+	}
+	if !strings.Contains(err.Error(), "source-workflow singleton scan skipped") {
+		t.Fatalf("ProcessControl error = %v, want skipped-store scan error", err)
+	}
+
+	workflowAfter, err := rigStore.Get(workflow.ID)
+	if err != nil {
+		t.Fatalf("Get(workflow): %v", err)
+	}
+	if workflowAfter.Status == "closed" {
+		t.Fatal("workflow status = closed; want open so singleton scans still see the retrying root")
+	}
+	finalizerAfter, err := rigStore.Get(finalizer.ID)
+	if err != nil {
+		t.Fatalf("Get(finalizer): %v", err)
+	}
+	if finalizerAfter.Status == "closed" {
+		t.Fatal("finalizer status = closed; want open so source-chain closure retries after skipped scan")
+	}
+	rigLaunchAfter, err := rigStore.Get(rigLaunch.ID)
+	if err != nil {
+		t.Fatalf("Get(rig launch): %v", err)
+	}
+	if rigLaunchAfter.Status == "closed" {
+		t.Fatal("rig launch status = closed; want open until all source-workflow stores are scanned")
+	}
+	citySourceAfter, err := cityStore.Get(citySource.ID)
+	if err != nil {
+		t.Fatalf("Get(city source): %v", err)
+	}
+	if citySourceAfter.Status == "closed" {
+		t.Fatal("city source status = closed; want open while a skipped store may contain a live root")
+	}
+	hiddenRootAfter, err := brokenStore.Get(hiddenRoot.ID)
+	if err != nil {
+		t.Fatalf("Get(hidden root): %v", err)
+	}
+	if hiddenRootAfter.Status == "closed" {
+		t.Fatal("hidden root status = closed; want unchanged")
+	}
+}
+
+func TestSourceWorkflowLockScopeForStoreRefUsesSharedHelper(t *testing.T) {
+	cityPath := "/city"
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "alpha", Path: "rigs/alpha"},
+		},
+	}
+
+	got := sourceWorkflowLockScopeForStoreRef(cityPath, cfg, "", "rig:alpha")
+	want := sourceworkflow.LockScopeForStoreRef(cityPath, "", "rig:alpha", func(rigName string) (string, bool) {
+		if rigName != "alpha" {
+			return "", false
+		}
+		return "rigs/alpha", true
+	})
+	if got != want {
+		t.Fatalf("sourceWorkflowLockScopeForStoreRef = %q, want shared helper scope %q", got, want)
+	}
+}
+
 type closeAllFailStore struct {
 	beads.Store
 	failOn map[string]struct{}
@@ -185,8 +364,8 @@ func TestDecorateDynamicFragmentRecipeSupportsExplicitPerStepAgents(t *testing.T
 	if control.Assignee != config.ControlDispatcherAgentName {
 		t.Fatalf("review scope-check assignee = %q, want %q", control.Assignee, config.ControlDispatcherAgentName)
 	}
-	if control.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-		t.Fatalf("review scope-check gc.routed_to = %q, want %q", control.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+	if got := control.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("review scope-check gc.routed_to = %q, want empty direct dispatcher assignee", got)
 	}
 	if control.Metadata[graphExecutionRouteMetaKey] != "reviewer" {
 		t.Fatalf("review scope-check execution route = %q, want reviewer", control.Metadata[graphExecutionRouteMetaKey])
@@ -313,6 +492,104 @@ func TestFindWorkflowBeadsResolvesLogicalWorkflowID(t *testing.T) {
 	}
 }
 
+func TestDeleteWorkflowMatchesUsesCascadeWithoutPreClose(t *testing.T) {
+	store := beads.NewMemStore()
+	root, err := store.Create(beads.Bead{
+		Title: "Workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind": "workflow",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(root): %v", err)
+	}
+	child, err := store.Create(beads.Bead{
+		Title: "Child",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.root_bead_id": root.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(child): %v", err)
+	}
+
+	var gotDir, gotName string
+	var gotArgs []string
+	deleted, err := deleteWorkflowMatches([]workflowStoreMatch{{
+		store: store,
+		beads: []beads.Bead{root, child},
+		label: "city",
+		path:  "/city",
+		runner: func(dir, name string, args ...string) ([]byte, error) {
+			gotDir = dir
+			gotName = name
+			gotArgs = append([]string(nil), args...)
+			return nil, nil
+		},
+	}})
+	if err != nil {
+		t.Fatalf("deleteWorkflowMatches: %v", err)
+	}
+	if deleted != 2 {
+		t.Fatalf("deleted = %d, want 2", deleted)
+	}
+	if gotDir != "/city" || gotName != "bd" {
+		t.Fatalf("runner target = (%q, %q), want (/city, bd)", gotDir, gotName)
+	}
+	wantArgs := []string{"delete", root.ID, child.ID, "--cascade", "--force"}
+	if !slices.Equal(gotArgs, wantArgs) {
+		t.Fatalf("delete args = %#v, want %#v", gotArgs, wantArgs)
+	}
+	for _, id := range []string{root.ID, child.ID} {
+		after, err := store.Get(id)
+		if err != nil {
+			t.Fatalf("Get(%s): %v", id, err)
+		}
+		if after.Status != "open" || after.Metadata["gc.outcome"] == "skipped" {
+			t.Fatalf("bead %s mutated before delete: status=%q metadata=%#v", id, after.Status, after.Metadata)
+		}
+	}
+}
+
+func TestDeleteWorkflowMatchesFailureDoesNotCloseBeads(t *testing.T) {
+	store := beads.NewMemStore()
+	root, err := store.Create(beads.Bead{
+		Title: "Workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind": "workflow",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(root): %v", err)
+	}
+
+	deleted, err := deleteWorkflowMatches([]workflowStoreMatch{{
+		store: store,
+		beads: []beads.Bead{root},
+		label: "city",
+		path:  "/city",
+		runner: func(string, string, ...string) ([]byte, error) {
+			return nil, fmt.Errorf("delete failed")
+		},
+	}})
+	if err == nil {
+		t.Fatal("deleteWorkflowMatches returned nil error, want delete failure")
+	}
+	if deleted != 0 {
+		t.Fatalf("deleted = %d, want 0 after failed delete", deleted)
+	}
+	after, err := store.Get(root.ID)
+	if err != nil {
+		t.Fatalf("Get(root): %v", err)
+	}
+	if after.Status != "open" || after.Metadata["gc.outcome"] == "skipped" {
+		t.Fatalf("root mutated after failed delete: status=%q metadata=%#v", after.Status, after.Metadata)
+	}
+}
+
 func TestCmdWorkflowDeleteSourceClosesMatchedRootsAndClearsWorkflowID(t *testing.T) {
 	cityDir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
@@ -320,6 +597,7 @@ func TestCmdWorkflowDeleteSourceClosesMatchedRootsAndClearsWorkflowID(t *testing
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -394,46 +672,86 @@ func TestCmdWorkflowDeleteSourceClosesMatchedRootsAndClearsWorkflowID(t *testing
 	}
 }
 
-func TestCmdWorkflowDeleteSourceClosesGraphV2OnlyRoot(t *testing.T) {
-	// Regression: after the ListLiveRoots contract fix, the singleton
-	// scanner surfaces graph.v2-only roots (marked with
-	// gc.formula_contract=graph.v2 and no gc.kind=workflow). But
-	// findWorkflowBeads — the cleanup collector called from
-	// collectSourceWorkflowMatches — still required gc.kind=workflow, so
-	// delete-source would list the root and close nothing. This is the
-	// exact root shape #720 exists to recover.
+func TestCmdWorkflowDeleteSourceFollowsRigLaunchSourceChain(t *testing.T) {
 	cityDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+	rigDir := filepath.Join(cityDir, "rigs", "alpha")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(rigDir): %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(`[workspace]
+name = "test-city"
+
+[daemon]
+formula_v2 = true
+
+[[rigs]]
+name = "alpha"
+path = "rigs/alpha"
+prefix = "BL"
+`), 0o644); err != nil {
 		t.Fatalf("write city.toml: %v", err)
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
 
-	store, err := openStoreAtForCity(cityDir, cityDir)
+	if err := ensureScopedFileStoreLayout(cityDir); err != nil {
+		t.Fatalf("ensureScopedFileStoreLayout: %v", err)
+	}
+	if err := ensurePersistedScopeLocalFileStore(cityDir); err != nil {
+		t.Fatalf("ensurePersistedScopeLocalFileStore(city): %v", err)
+	}
+	if err := os.MkdirAll(filepath.Join(rigDir, ".gc"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(rig .gc): %v", err)
+	}
+	if err := ensurePersistedScopeLocalFileStore(rigDir); err != nil {
+		t.Fatalf("ensurePersistedScopeLocalFileStore(rig): %v", err)
+	}
+
+	cityStore, err := openStoreAtForCity(cityDir, cityDir)
 	if err != nil {
-		t.Fatalf("openStoreAtForCity: %v", err)
+		t.Fatalf("openStoreAtForCity(city): %v", err)
 	}
-	source, err := store.Create(beads.Bead{Title: "Source", Type: "task", Status: "in_progress"})
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
 	if err != nil {
-		t.Fatalf("Create(source): %v", err)
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
 	}
-	// graph.v2-only root: no gc.kind=workflow label.
-	root, err := store.Create(beads.Bead{
-		Title:  "Graph workflow",
+	citySource, err := cityStore.Create(beads.Bead{Title: "City source", Type: "task", Status: "open"})
+	if err != nil {
+		t.Fatalf("Create(city source): %v", err)
+	}
+	if err := cityStore.SetMetadata(citySource.ID, "workflow_id", "wf-stale"); err != nil {
+		t.Fatalf("SetMetadata(city workflow_id): %v", err)
+	}
+	rigLaunch, err := rigStore.Create(beads.Bead{
+		Title:  "Rig launch",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.source_bead_id":                      citySource.ID,
+			sourceworkflow.SourceStoreRefMetadataKey: "city:test-city",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(rig launch): %v", err)
+	}
+	root, err := rigStore.Create(beads.Bead{
+		Title:  "Workflow",
 		Type:   "task",
 		Status: "in_progress",
 		Metadata: map[string]string{
-			"gc.formula_contract": "graph.v2",
-			"gc.source_bead_id":   source.ID,
+			"gc.formula_contract":                    "graph.v2",
+			"gc.source_bead_id":                      rigLaunch.ID,
+			sourceworkflow.SourceStoreRefMetadataKey: "rig:alpha",
 		},
 	})
 	if err != nil {
 		t.Fatalf("Create(root): %v", err)
 	}
-	child, err := store.Create(beads.Bead{
+	child, err := rigStore.Create(beads.Bead{
 		Title:  "Child",
 		Type:   "task",
 		Status: "open",
@@ -444,60 +762,155 @@ func TestCmdWorkflowDeleteSourceClosesGraphV2OnlyRoot(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Create(child): %v", err)
 	}
-	if err := store.SetMetadata(source.ID, "workflow_id", root.ID); err != nil {
-		t.Fatalf("SetMetadata(workflow_id): %v", err)
-	}
 
 	var stdout, stderr bytes.Buffer
-	if code := cmdWorkflowDeleteSource(source.ID, sourceWorkflowStoreSelector{}, true, false, &stdout, &stderr); code != 0 {
-		t.Fatalf("cmdWorkflowDeleteSource = %d; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	selector := sourceWorkflowStoreSelector{storeRef: "city:test-city"}
+	if code := cmdWorkflowDeleteSource(citySource.ID, selector, true, false, &stdout, &stderr); code != 0 {
+		t.Fatalf("cmdWorkflowDeleteSource returned %d; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
 	}
 	if !strings.Contains(stdout.String(), "result=cleaned") {
 		t.Fatalf("stdout = %q, want cleaned result", stdout.String())
 	}
-
-	reloaded, err := openStoreAtForCity(cityDir, cityDir)
+	if stderr.Len() != 0 {
+		t.Fatalf("stderr = %q, want empty", stderr.String())
+	}
+	reloadedRig, err := openStoreAtForCity(rigDir, cityDir)
 	if err != nil {
-		t.Fatalf("openStoreAtForCity(reload): %v", err)
+		t.Fatalf("openStoreAtForCity(rig reload): %v", err)
 	}
-	updatedRoot, err := reloaded.Get(root.ID)
+	updatedRoot, err := reloadedRig.Get(root.ID)
 	if err != nil {
 		t.Fatalf("Get(root): %v", err)
 	}
 	if updatedRoot.Status != "closed" {
-		t.Fatalf("root status = %q, want closed (graph.v2-only root must be collected by findWorkflowBeads)", updatedRoot.Status)
+		t.Fatalf("root status = %q, want closed", updatedRoot.Status)
 	}
-	updatedChild, err := reloaded.Get(child.ID)
+	updatedChild, err := reloadedRig.Get(child.ID)
 	if err != nil {
 		t.Fatalf("Get(child): %v", err)
 	}
 	if updatedChild.Status != "closed" {
 		t.Fatalf("child status = %q, want closed", updatedChild.Status)
 	}
-	updatedSource, err := reloaded.Get(source.ID)
+	reloadedCity, err := openStoreAtForCity(cityDir, cityDir)
 	if err != nil {
-		t.Fatalf("Get(source): %v", err)
+		t.Fatalf("openStoreAtForCity(city reload): %v", err)
 	}
-	if got := strings.TrimSpace(updatedSource.Metadata["workflow_id"]); got != "" {
-		t.Fatalf("source workflow_id = %q, want cleared", got)
+	updatedCitySource, err := reloadedCity.Get(citySource.ID)
+	if err != nil {
+		t.Fatalf("Get(city source): %v", err)
+	}
+	if got := strings.TrimSpace(updatedCitySource.Metadata["workflow_id"]); got != "" {
+		t.Fatalf("city source workflow_id = %q, want empty", got)
 	}
 }
 
-func TestCmdWorkflowReopenSourceClearsRoutedToForResling(t *testing.T) {
-	// Regression: reopen-source is the documented recovery path for a
-	// closed/assigned source bead whose workflow died. It cleared
-	// workflow_id + status + assignee but left gc.routed_to populated.
-	// sling.CheckBeadState treats a bead with gc.routed_to == target as
-	// already-routed and short-circuits on idempotency — so a re-sling
-	// of the recovered bead to the same target appeared to succeed while
-	// producing no live workflow. Operators following the cleanup hint
-	// ended up silently stuck.
-	cityDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n"), 0o644); err != nil {
-		t.Fatalf("write city.toml: %v", err)
+func TestCmdWorkflowDeleteSourceClosesGraphV2OnlyRoot(t *testing.T) {
+	// Regression: after the ListLiveRoots contract fix, the singleton
+	// scanner surfaces graph.v2-only roots (marked with
+	// gc.formula_contract=graph.v2 and no gc.kind=workflow). But
+	// findWorkflowBeads — the cleanup collector called from
+	// collectSourceWorkflowMatches — still required gc.kind=workflow, so
+	// delete-source would list the root and close nothing. This is the
+	// exact root shape #720 exists to recover.
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
+	prevCityFlag := cityFlag
+	cityFlag = ""
+	t.Cleanup(func() { cityFlag = prevCityFlag })
+
+	store, err := openStoreAtForCity(cityDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity: %v", err)
+	}
+	source, err := store.Create(beads.Bead{Title: "Source", Type: "task", Status: "in_progress"})
+	if err != nil {
+		t.Fatalf("Create(source): %v", err)
+	}
+	// graph.v2-only root: no gc.kind=workflow label.
+	root, err := store.Create(beads.Bead{
+		Title:  "Graph workflow",
+		Type:   "task",
+		Status: "in_progress",
+		Metadata: map[string]string{
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   source.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(root): %v", err)
+	}
+	child, err := store.Create(beads.Bead{
+		Title:  "Child",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.root_bead_id": root.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(child): %v", err)
+	}
+	if err := store.SetMetadata(source.ID, "workflow_id", root.ID); err != nil {
+		t.Fatalf("SetMetadata(workflow_id): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	if code := cmdWorkflowDeleteSource(source.ID, sourceWorkflowStoreSelector{}, true, false, &stdout, &stderr); code != 0 {
+		t.Fatalf("cmdWorkflowDeleteSource = %d; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "result=cleaned") {
+		t.Fatalf("stdout = %q, want cleaned result", stdout.String())
+	}
+
+	reloaded, err := openStoreAtForCity(cityDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(reload): %v", err)
+	}
+	updatedRoot, err := reloaded.Get(root.ID)
+	if err != nil {
+		t.Fatalf("Get(root): %v", err)
+	}
+	if updatedRoot.Status != "closed" {
+		t.Fatalf("root status = %q, want closed (graph.v2-only root must be collected by findWorkflowBeads)", updatedRoot.Status)
+	}
+	updatedChild, err := reloaded.Get(child.ID)
+	if err != nil {
+		t.Fatalf("Get(child): %v", err)
+	}
+	if updatedChild.Status != "closed" {
+		t.Fatalf("child status = %q, want closed", updatedChild.Status)
+	}
+	updatedSource, err := reloaded.Get(source.ID)
+	if err != nil {
+		t.Fatalf("Get(source): %v", err)
+	}
+	if got := strings.TrimSpace(updatedSource.Metadata["workflow_id"]); got != "" {
+		t.Fatalf("source workflow_id = %q, want cleared", got)
+	}
+}
+
+func TestCmdWorkflowReopenSourceClearsRoutedToForResling(t *testing.T) {
+	// Regression: reopen-source is the documented recovery path for a
+	// closed/assigned source bead whose workflow died. It cleared
+	// workflow_id + status + assignee but left gc.routed_to populated.
+	// sling.CheckBeadState treats a bead with gc.routed_to == target as
+	// already-routed and short-circuits on idempotency — so a re-sling
+	// of the recovered bead to the same target appeared to succeed while
+	// producing no live workflow. Operators following the cleanup hint
+	// ended up silently stuck.
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -556,6 +969,7 @@ func TestCmdWorkflowReopenSourceConflictsWhenLiveRootExists(t *testing.T) {
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -597,6 +1011,7 @@ func TestCmdWorkflowDeleteSourcePreviewDoesNotClearStaleMetadata(t *testing.T) {
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -693,6 +1108,7 @@ func TestRunWorkflowReopenSourceConflictPropagatesExitCode(t *testing.T) {
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -802,8 +1218,11 @@ func TestDecorateDynamicFragmentRecipePreservesPoolFallbackAndScopeMetadata(t *t
 	if control.Metadata["gc.scope_role"] != "control" {
 		t.Fatalf("control gc.scope_role = %q, want control", control.Metadata["gc.scope_role"])
 	}
-	if control.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-		t.Fatalf("control gc.routed_to = %q, want %q", control.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+	if control.Assignee != config.ControlDispatcherAgentName {
+		t.Fatalf("control assignee = %q, want %q", control.Assignee, config.ControlDispatcherAgentName)
+	}
+	if got := control.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("control gc.routed_to = %q, want empty direct dispatcher assignee", got)
 	}
 	if control.Metadata[graphExecutionRouteMetaKey] != "frontend/reviewer" {
 		t.Fatalf("control execution route = %q, want frontend/reviewer", control.Metadata[graphExecutionRouteMetaKey])
@@ -916,12 +1335,1188 @@ func TestDecorateDynamicFragmentRecipeMarksRetryEvalAsScopedControl(t *testing.T
 	if eval.Metadata["gc.scope_role"] != "control" {
 		t.Fatalf("retry-eval gc.scope_role = %q, want control", eval.Metadata["gc.scope_role"])
 	}
-}
+}
+
+func TestRunWorkflowServeProcessesReadyControlBeadsThenExits(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevControl := controlDispatcherServe
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		controlDispatcherServe = prevControl
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	cdAgent := config.Agent{Name: config.ControlDispatcherAgentName}
+	wantQuery := workflowServeControlReadyQuery(cdAgent, "control-dispatcher")
+	var gotQueries []string
+	var gotDirs []string
+	var gotEnv []map[string]string
+	var controlled []string
+	sequence := [][]hookBead{
+		{{ID: "gc-ctrl-1", Metadata: map[string]string{"gc.kind": "scope-check"}}},
+		{{ID: "gc-ctrl-2", Metadata: map[string]string{"gc.kind": "workflow-finalize"}}},
+	}
+
+	workflowServeList = func(workQuery, dir string, env map[string]string) ([]hookBead, error) {
+		gotQueries = append(gotQueries, workQuery)
+		gotDirs = append(gotDirs, dir)
+		gotEnv = append(gotEnv, maps.Clone(env))
+		if len(sequence) == 0 {
+			return nil, nil
+		}
+		next := sequence[0]
+		sequence = sequence[1:]
+		return next, nil
+	}
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
+		controlled = append(controlled, beadID)
+		return nil
+	}
+
+	if err := runWorkflowServe("", false, io.Discard, io.Discard); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	if !slices.Equal(controlled, []string{"gc-ctrl-1", "gc-ctrl-2"}) {
+		t.Fatalf("controlled beads = %#v, want two ready control beads in order", controlled)
+	}
+	if len(gotQueries) != 3 {
+		t.Fatalf("workflowServeList calls = %d, want 3", len(gotQueries))
+	}
+	for i, got := range gotQueries {
+		if got != wantQuery {
+			t.Fatalf("workflowServeList query[%d] = %q, want %q", i, got, wantQuery)
+		}
+	}
+	for i, got := range gotDirs {
+		if canonicalTestPath(got) != canonicalTestPath(cityDir) {
+			t.Fatalf("workflowServeList dir[%d] = %q, want %q", i, got, cityDir)
+		}
+	}
+	for i, env := range gotEnv {
+		if env["GC_STORE_ROOT"] != cityDir {
+			t.Fatalf("workflowServeList env[%d] GC_STORE_ROOT = %q, want %q", i, env["GC_STORE_ROOT"], cityDir)
+		}
+		if env["GC_STORE_SCOPE"] != "city" {
+			t.Fatalf("workflowServeList env[%d] GC_STORE_SCOPE = %q, want city", i, env["GC_STORE_SCOPE"])
+		}
+	}
+}
+
+func TestRunWorkflowServeDrainsReadyBatchBeforeRequery(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevControl := controlDispatcherServe
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		controlDispatcherServe = prevControl
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	var controlled []string
+	calls := 0
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		calls++
+		switch calls {
+		case 1:
+			return []hookBead{
+				{ID: "gc-ctrl-1", Metadata: map[string]string{"gc.kind": "scope-check"}},
+				{ID: "gc-ctrl-2", Metadata: map[string]string{"gc.kind": "workflow-finalize"}},
+			}, nil
+		default:
+			return nil, nil
+		}
+	}
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
+		controlled = append(controlled, beadID)
+		return nil
+	}
+
+	if err := runWorkflowServe("", false, io.Discard, io.Discard); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	if !slices.Equal(controlled, []string{"gc-ctrl-1", "gc-ctrl-2"}) {
+		t.Fatalf("controlled beads = %#v, want ready batch drained in order", controlled)
+	}
+	if calls != 2 {
+		t.Fatalf("workflowServeList calls = %d, want first ready batch plus idle check", calls)
+	}
+}
+
+func TestRunWorkflowServeRoutesTraceOpenWarningsToCommandStderr(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	tracePath := filepath.Join(t.TempDir(), "missing", "workflow-trace.log")
+	t.Setenv("GC_WORKFLOW_TRACE", tracePath)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		return nil, nil
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if count := strings.Count(got, "opening workflow trace"); count != 1 {
+		t.Fatalf("warning count = %d, want 1; stderr=%q", count, got)
+	}
+	wantPrefix := fmt.Sprintf("gc convoy control --serve: warning: opening workflow trace %q:", tracePath)
+	if !strings.Contains(got, wantPrefix) {
+		t.Fatalf("stderr = %q, want warning prefix %q", got, wantPrefix)
+	}
+}
+
+func TestRunWorkflowServeWarnsOnLegacyTracePath(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_WORKFLOW_TRACE", filepath.Join(cityDir, "control-dispatcher-trace.log"))
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		return nil, nil
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if !strings.Contains(got, "legacy control-dispatcher trace path") {
+		t.Fatalf("stderr = %q, want legacy-trace warning", got)
+	}
+	if !strings.Contains(got, "change or unset GC_WORKFLOW_TRACE") {
+		t.Fatalf("stderr = %q, want explicit override guidance", got)
+	}
+	if !strings.Contains(got, filepath.Join(cityDir, ".gc", "runtime", "control-dispatcher-trace.log")) {
+		t.Fatalf("stderr = %q, want canonical runtime trace path guidance", got)
+	}
+}
+
+func TestRunWorkflowServeWarnsWhenLegacyTraceFileStillExists(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	legacyTracePath := filepath.Join(cityDir, "control-dispatcher-trace.log")
+	if err := os.WriteFile(legacyTracePath, []byte("stale\n"), 0o644); err != nil {
+		t.Fatalf("write legacy trace: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		return nil, nil
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if !strings.Contains(got, "legacy control-dispatcher trace file") {
+		t.Fatalf("stderr = %q, want legacy-trace artifact warning", got)
+	}
+	if !strings.Contains(got, legacyTracePath) {
+		t.Fatalf("stderr = %q, want legacy trace path %q", got, legacyTracePath)
+	}
+	if !strings.Contains(got, filepath.Join(cityDir, ".gc", "runtime", "control-dispatcher-trace.log")) {
+		t.Fatalf("stderr = %q, want canonical runtime trace path guidance", got)
+	}
+	if !strings.Contains(got, "restart or recycle the control-dispatcher session") {
+		t.Fatalf("stderr = %q, want restart guidance for still-growing legacy trace", got)
+	}
+}
+
+func TestRunWorkflowServeWarnsWhenLegacyRigTraceFileStillExists(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n\n[[rigs]]\nname = \"alpha\"\npath = \"rigs/alpha\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	rigRoot := filepath.Join(cityDir, "rigs", "alpha")
+	if err := os.MkdirAll(rigRoot, 0o755); err != nil {
+		t.Fatalf("mkdir rig root: %v", err)
+	}
+	legacyTracePath := filepath.Join(rigRoot, "control-dispatcher-trace.log")
+	if err := os.WriteFile(legacyTracePath, []byte("stale\n"), 0o644); err != nil {
+		t.Fatalf("write legacy rig trace: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_RIG_ROOT", "")
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		return nil, nil
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if !strings.Contains(got, legacyTracePath) {
+		t.Fatalf("stderr = %q, want legacy rig trace path %q", got, legacyTracePath)
+	}
+	if !strings.Contains(got, "legacy control-dispatcher trace file") {
+		t.Fatalf("stderr = %q, want legacy rig trace warning", got)
+	}
+}
+
+func TestRunWorkflowServeWarnsWhenLegacyEnvRigTraceFileStillExistsOutsideConfiguredRigs(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n\n[[rigs]]\nname = \"alpha\"\npath = \"rigs/alpha\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	rigRoot := filepath.Join(cityDir, "rigs", "beta")
+	if err := os.MkdirAll(rigRoot, 0o755); err != nil {
+		t.Fatalf("mkdir rig root: %v", err)
+	}
+	legacyTracePath := filepath.Join(rigRoot, "control-dispatcher-trace.log")
+	if err := os.WriteFile(legacyTracePath, []byte("stale\n"), 0o644); err != nil {
+		t.Fatalf("write legacy env rig trace: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_RIG_ROOT", rigRoot)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		return nil, nil
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if !strings.Contains(got, legacyTracePath) {
+		t.Fatalf("stderr = %q, want undeclared rig trace path %q", got, legacyTracePath)
+	}
+	if !strings.Contains(got, "legacy control-dispatcher trace file") {
+		t.Fatalf("stderr = %q, want undeclared rig trace warning", got)
+	}
+}
+
+func TestRunControlDispatcherWithStoreRoutesRalphTraceWarningToStderr(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	checkPath := filepath.Join(cityDir, "pass-check.sh")
+	if err := os.WriteFile(checkPath, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("write pass-check.sh: %v", err)
+	}
+	t.Setenv("GC_WORKFLOW_TRACE", filepath.Join(t.TempDir(), "missing", "workflow-trace.log"))
+
+	store := beads.NewMemStore()
+	workflow, err := store.Create(beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create workflow bead: %v", err)
+	}
+	logical, err := store.Create(beads.Bead{
+		Title: "logical",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.step_id":      "implement",
+			"gc.max_attempts": "1",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create logical bead: %v", err)
+	}
+	run1, err := store.Create(beads.Bead{
+		Title: "run 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "run",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "1",
+			"gc.step_ref":        "implement.run.1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create run bead: %v", err)
+	}
+	check1, err := store.Create(beads.Bead{
+		Title: "check 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "1",
+			"gc.step_ref":        "implement.check.1",
+			"gc.check_mode":      "exec",
+			"gc.check_path":      checkPath,
+			"gc.check_timeout":   "30s",
+			"gc.max_attempts":    "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create check bead: %v", err)
+	}
+	if err := store.DepAdd(check1.ID, run1.ID, "blocks"); err != nil {
+		t.Fatalf("add check->run dep: %v", err)
+	}
+	if err := store.DepAdd(logical.ID, check1.ID, "blocks"); err != nil {
+		t.Fatalf("add logical->check dep: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	if err := runControlDispatcherWithStore(cityDir, cityDir, store, check1, check1.ID, &stdout, &stderr); err != nil {
+		t.Fatalf("runControlDispatcherWithStore: %v", err)
+	}
+
+	gotStderr := stderr.String()
+	if count := strings.Count(gotStderr, "opening workflow trace"); count != 1 {
+		t.Fatalf("warning count = %d, want 1; stderr=%q", count, gotStderr)
+	}
+	if !strings.Contains(gotStderr, "gc convoy control --serve: warning: opening workflow trace") {
+		t.Fatalf("stderr = %q, want workflow trace warning prefix", gotStderr)
+	}
+	if gotStdout := stdout.String(); !strings.Contains(gotStdout, "action=pass") {
+		t.Fatalf("stdout = %q, want processed pass action", gotStdout)
+	}
+	checkAfter, err := store.Get(check1.ID)
+	if err != nil {
+		t.Fatalf("reload check bead: %v", err)
+	}
+	if checkAfter.Status != "closed" || checkAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("check bead = status %q outcome %q, want closed/pass", checkAfter.Status, checkAfter.Metadata["gc.outcome"])
+	}
+}
+
+func TestRunControlDispatcherWithStoreWarnsOnLegacyTracePath(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	checkPath := filepath.Join(cityDir, "pass-check.sh")
+	if err := os.WriteFile(checkPath, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("write pass-check.sh: %v", err)
+	}
+	legacyTracePath := filepath.Join(cityDir, "control-dispatcher-trace.log")
+	t.Setenv("GC_WORKFLOW_TRACE", legacyTracePath)
+
+	store := beads.NewMemStore()
+	workflow, err := store.Create(beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create workflow bead: %v", err)
+	}
+	logical, err := store.Create(beads.Bead{
+		Title: "logical",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.step_id":      "implement",
+			"gc.max_attempts": "1",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create logical bead: %v", err)
+	}
+	run1, err := store.Create(beads.Bead{
+		Title: "run 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "run",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "1",
+			"gc.step_ref":        "implement.run.1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create run bead: %v", err)
+	}
+	check1, err := store.Create(beads.Bead{
+		Title: "check 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "1",
+			"gc.step_ref":        "implement.check.1",
+			"gc.check_mode":      "exec",
+			"gc.check_path":      checkPath,
+			"gc.check_timeout":   "30s",
+			"gc.max_attempts":    "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create check bead: %v", err)
+	}
+	if err := store.DepAdd(check1.ID, run1.ID, "blocks"); err != nil {
+		t.Fatalf("add check->run dep: %v", err)
+	}
+	if err := store.DepAdd(logical.ID, check1.ID, "blocks"); err != nil {
+		t.Fatalf("add logical->check dep: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	if err := runControlDispatcherWithStore(cityDir, cityDir, store, check1, check1.ID, &stdout, &stderr); err != nil {
+		t.Fatalf("runControlDispatcherWithStore: %v", err)
+	}
+
+	got := stderr.String()
+	if !strings.Contains(got, legacyTracePath) {
+		t.Fatalf("stderr = %q, want legacy trace path %q", got, legacyTracePath)
+	}
+	if !strings.Contains(got, "change or unset GC_WORKFLOW_TRACE") {
+		t.Fatalf("stderr = %q, want explicit override guidance", got)
+	}
+}
+
+func TestRunWorkflowServeDedupsTraceWarningsAcrossNestedControlDispatch(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	checkPath := filepath.Join(cityDir, "pass-check.sh")
+	if err := os.WriteFile(checkPath, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("write pass-check.sh: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_WORKFLOW_TRACE", filepath.Join(t.TempDir(), "missing", "workflow-trace.log"))
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevControl := controlDispatcherServe
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		controlDispatcherServe = prevControl
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	store := beads.NewMemStore()
+	newCheckBead := func(stepID string) string {
+		t.Helper()
+		workflow, err := store.Create(beads.Bead{
+			Title: "workflow " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":             "workflow",
+				"gc.formula_contract": "graph.v2",
+			},
+		})
+		if err != nil {
+			t.Fatalf("create workflow bead for %s: %v", stepID, err)
+		}
+		logical, err := store.Create(beads.Bead{
+			Title: "logical " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":         "ralph",
+				"gc.step_id":      stepID,
+				"gc.max_attempts": "1",
+				"gc.root_bead_id": workflow.ID,
+			},
+		})
+		if err != nil {
+			t.Fatalf("create logical bead for %s: %v", stepID, err)
+		}
+		run, err := store.Create(beads.Bead{
+			Title: "run " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":            "run",
+				"gc.step_id":         stepID,
+				"gc.ralph_step_id":   stepID,
+				"gc.attempt":         "1",
+				"gc.step_ref":        stepID + ".run.1",
+				"gc.root_bead_id":    workflow.ID,
+				"gc.logical_bead_id": logical.ID,
+			},
+		})
+		if err != nil {
+			t.Fatalf("create run bead for %s: %v", stepID, err)
+		}
+		check, err := store.Create(beads.Bead{
+			Title: "check " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":            "check",
+				"gc.step_id":         stepID,
+				"gc.ralph_step_id":   stepID,
+				"gc.attempt":         "1",
+				"gc.step_ref":        stepID + ".check.1",
+				"gc.check_mode":      "exec",
+				"gc.check_path":      checkPath,
+				"gc.check_timeout":   "30s",
+				"gc.max_attempts":    "1",
+				"gc.root_bead_id":    workflow.ID,
+				"gc.logical_bead_id": logical.ID,
+			},
+		})
+		if err != nil {
+			t.Fatalf("create check bead for %s: %v", stepID, err)
+		}
+		if err := store.DepAdd(check.ID, run.ID, "blocks"); err != nil {
+			t.Fatalf("add check->run dep for %s: %v", stepID, err)
+		}
+		if err := store.DepAdd(logical.ID, check.ID, "blocks"); err != nil {
+			t.Fatalf("add logical->check dep for %s: %v", stepID, err)
+		}
+		return check.ID
+	}
+
+	checkOneID := newCheckBead("implement-a")
+	checkTwoID := newCheckBead("implement-b")
+	sequence := [][]hookBead{
+		{{ID: checkOneID, Metadata: map[string]string{"gc.kind": "check"}}},
+		{{ID: checkTwoID, Metadata: map[string]string{"gc.kind": "check"}}},
+	}
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		if len(sequence) == 0 {
+			return nil, nil
+		}
+		next := sequence[0]
+		sequence = sequence[1:]
+		return next, nil
+	}
+	controlDispatcherServe = func(cityPath, storePath, beadID string, stdout, stderr io.Writer) error {
+		bead, err := store.Get(beadID)
+		if err != nil {
+			return err
+		}
+		return runControlDispatcherWithStore(cityPath, storePath, store, bead, beadID, stdout, stderr)
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if count := strings.Count(got, "opening workflow trace"); count != 1 {
+		t.Fatalf("warning count = %d, want 1 across nested control dispatch; stderr=%q", count, got)
+	}
+}
+
+func TestRunWorkflowServeDedupsLegacyTraceWarningsAcrossNestedControlDispatch(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	checkPath := filepath.Join(cityDir, "pass-check.sh")
+	if err := os.WriteFile(checkPath, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("write pass-check.sh: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_WORKFLOW_TRACE", filepath.Join(cityDir, "control-dispatcher-trace.log"))
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevControl := controlDispatcherServe
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		controlDispatcherServe = prevControl
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	store := beads.NewMemStore()
+	newCheckBead := func(stepID string) string {
+		t.Helper()
+		workflow, err := store.Create(beads.Bead{
+			Title: "workflow " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":             "workflow",
+				"gc.formula_contract": "graph.v2",
+			},
+		})
+		if err != nil {
+			t.Fatalf("create workflow bead for %s: %v", stepID, err)
+		}
+		logical, err := store.Create(beads.Bead{
+			Title: "logical " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":         "ralph",
+				"gc.step_id":      stepID,
+				"gc.max_attempts": "1",
+				"gc.root_bead_id": workflow.ID,
+			},
+		})
+		if err != nil {
+			t.Fatalf("create logical bead for %s: %v", stepID, err)
+		}
+		run, err := store.Create(beads.Bead{
+			Title: "run " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":            "run",
+				"gc.step_id":         stepID,
+				"gc.ralph_step_id":   stepID,
+				"gc.attempt":         "1",
+				"gc.step_ref":        stepID + ".run.1",
+				"gc.root_bead_id":    workflow.ID,
+				"gc.logical_bead_id": logical.ID,
+			},
+		})
+		if err != nil {
+			t.Fatalf("create run bead for %s: %v", stepID, err)
+		}
+		check, err := store.Create(beads.Bead{
+			Title: "check " + stepID,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":            "check",
+				"gc.step_id":         stepID,
+				"gc.ralph_step_id":   stepID,
+				"gc.attempt":         "1",
+				"gc.step_ref":        stepID + ".check.1",
+				"gc.check_mode":      "exec",
+				"gc.check_path":      checkPath,
+				"gc.check_timeout":   "30s",
+				"gc.max_attempts":    "1",
+				"gc.root_bead_id":    workflow.ID,
+				"gc.logical_bead_id": logical.ID,
+			},
+		})
+		if err != nil {
+			t.Fatalf("create check bead for %s: %v", stepID, err)
+		}
+		if err := store.DepAdd(check.ID, run.ID, "blocks"); err != nil {
+			t.Fatalf("add check->run dep for %s: %v", stepID, err)
+		}
+		if err := store.DepAdd(logical.ID, check.ID, "blocks"); err != nil {
+			t.Fatalf("add logical->check dep for %s: %v", stepID, err)
+		}
+		return check.ID
+	}
+
+	checkOneID := newCheckBead("implement-a")
+	checkTwoID := newCheckBead("implement-b")
+	sequence := [][]hookBead{
+		{{ID: checkOneID, Metadata: map[string]string{"gc.kind": "check"}}},
+		{{ID: checkTwoID, Metadata: map[string]string{"gc.kind": "check"}}},
+	}
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		if len(sequence) == 0 {
+			return nil, nil
+		}
+		next := sequence[0]
+		sequence = sequence[1:]
+		return next, nil
+	}
+	controlDispatcherServe = func(cityPath, storePath, beadID string, stdout, stderr io.Writer) error {
+		bead, err := store.Get(beadID)
+		if err != nil {
+			return err
+		}
+		return runControlDispatcherWithStore(cityPath, storePath, store, bead, beadID, stdout, stderr)
+	}
+
+	var stderr bytes.Buffer
+	if err := runWorkflowServe("", false, io.Discard, &stderr); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	got := stderr.String()
+	if count := strings.Count(got, "legacy control-dispatcher trace path"); count != 1 {
+		t.Fatalf("warning count = %d, want 1 across nested control dispatch; stderr=%q", count, got)
+	}
+}
+
+func TestWorkflowServeControlReadyQueryUsesControlTiers(t *testing.T) {
+	query := workflowServeControlReadyQuery(config.Agent{Name: config.ControlDispatcherAgentName})
+	if strings.Contains(query, "GC_SESSION_ORIGIN") {
+		t.Fatalf("workflowServeControlReadyQuery should not gate legacy routes on session origin: %q", query)
+	}
+	if strings.Contains(query, "bd list --status in_progress") {
+		t.Fatalf("workflowServeControlReadyQuery should not return in-progress control beads: %q", query)
+	}
+	if !strings.Contains(query, "BD_EXPORT_AUTO=false") {
+		t.Fatalf("workflowServeControlReadyQuery should disable bd auto-export: %q", query)
+	}
+	for _, want := range []string{
+		`bd --readonly --sandbox ready --assignee="$cand"`,
+		`bd --readonly --sandbox ready --metadata-field "gc.routed_to=$GC_CONTROL_TARGET" --unassigned`,
+		`bd --readonly --sandbox ready --metadata-field "gc.routed_to=$GC_CONTROL_LEGACY_TARGET" --unassigned`,
+	} {
+		if !strings.Contains(query, want) {
+			t.Fatalf("workflowServeControlReadyQuery missing %q in %q", want, query)
+		}
+	}
+	if !strings.Contains(query, `--limit=20`) {
+		t.Fatalf("workflowServeControlReadyQuery missing scan limit: %q", query)
+	}
+}
+
+func TestWorkflowServeControlReadyQueryIgnoresInProgressAssigned(t *testing.T) {
+	query := workflowServeControlReadyQuery(config.Agent{Name: config.ControlDispatcherAgentName, Dir: "gascity"})
+	out := runWorkflowServeShellQueryForTest(t, query, map[string]string{
+		"GC_SESSION_NAME":   "gascity--control-dispatcher",
+		"GC_ALIAS":          "gascity/control-dispatcher",
+		"GC_SESSION_ORIGIN": "named",
+	}, `#!/bin/sh
+set -eu
+case "$*" in
+  "list --status in_progress --assignee=gascity--control-dispatcher --json --limit=20")
+    printf '[{"id":"ga-in-progress"}]'
+    ;;
+  "--readonly --sandbox ready --assignee=gascity--control-dispatcher --json --limit=20")
+    printf '[{"id":"ga-ready"}]'
+    ;;
+  "--readonly --sandbox ready --metadata-field gc.routed_to=gascity/control-dispatcher --unassigned --json --limit=20")
+    printf '[{"id":"ga-routed"}]'
+    ;;
+  *)
+    printf '[]'
+    ;;
+esac
+`)
+	assertJSONEqual(t, out, `[{"id":"ga-ready"},{"id":"ga-routed"}]`)
+}
+
+func TestWorkflowServeControlReadyQueryIncludesMetadataRoutedWorkAfterAssignedPending(t *testing.T) {
+	query := workflowServeControlReadyQuery(config.Agent{Name: config.ControlDispatcherAgentName, Dir: "gascity"})
+	out := runWorkflowServeShellQueryForTest(t, query, map[string]string{
+		"GC_SESSION_NAME": "gascity--control-dispatcher",
+		"GC_ALIAS":        "gascity/control-dispatcher",
+	}, `#!/bin/sh
+set -eu
+case "$*" in
+  "--readonly --sandbox ready --assignee=gascity--control-dispatcher --json --limit=20")
+    printf '[{"id":"ga-pending","metadata":{"gc.kind":"retry"}}]'
+    ;;
+  "--readonly --sandbox ready --metadata-field gc.routed_to=gascity/control-dispatcher --unassigned --json --limit=20")
+    printf '[{"id":"ga-ready","metadata":{"gc.kind":"scope-check"}}]'
+    ;;
+  *)
+    printf '[]'
+    ;;
+esac
+`)
+	assertJSONEqual(t, out, `[{"id":"ga-pending","metadata":{"gc.kind":"retry"}},{"id":"ga-ready","metadata":{"gc.kind":"scope-check"}}]`)
+}
+
+func TestWorkflowServeControlReadyQueryPreservesQueryPriorityWhenMerging(t *testing.T) {
+	query := workflowServeControlReadyQuery(config.Agent{Name: config.ControlDispatcherAgentName, Dir: "gascity"})
+	out := runWorkflowServeShellQueryForTest(t, query, map[string]string{
+		"GC_SESSION_NAME": "gascity--control-dispatcher",
+		"GC_ALIAS":        "gascity/control-dispatcher",
+	}, `#!/bin/sh
+set -eu
+case "$*" in
+  "--readonly --sandbox ready --assignee=gascity--control-dispatcher --json --limit=20")
+    printf '[{"id":"ga-z-assigned"},{"id":"ga-dup","source":"assigned"}]'
+    ;;
+  "--readonly --sandbox ready --metadata-field gc.routed_to=gascity/control-dispatcher --unassigned --json --limit=20")
+    printf '[{"id":"ga-a-routed"},{"id":"ga-dup","source":"routed"}]'
+    ;;
+  *)
+    printf '[]'
+    ;;
+esac
+`)
+	assertJSONEqual(t, out, `[{"id":"ga-z-assigned"},{"id":"ga-dup","source":"assigned"},{"id":"ga-a-routed"}]`)
+}
+
+func TestWorkflowServeControlReadyQueryUsesConfiguredRuntimeNameWhenEnvIsManualSession(t *testing.T) {
+	query := workflowServeControlReadyQuery(
+		config.Agent{Name: config.ControlDispatcherAgentName, Dir: "gascity"},
+		"gascity--control-dispatcher",
+	)
+	out := runWorkflowServeShellQueryForTest(t, query, map[string]string{
+		"GC_SESSION_ID":     "mc-manual",
+		"GC_SESSION_NAME":   "s-mc-manual",
+		"GC_AGENT":          "s-mc-manual",
+		"GC_SESSION_ORIGIN": "manual",
+	}, `#!/bin/sh
+set -eu
+case "$*" in
+  "--readonly --sandbox ready --assignee=gascity--control-dispatcher --json --limit=20")
+    printf '[{"id":"ga-control-ready"}]'
+    ;;
+  *)
+    echo "unexpected first control query: $*" >&2
+    exit 42
+    ;;
+esac
+`)
+	assertJSONEqual(t, out, `[{"id":"ga-control-ready"}]`)
+}
+
+func TestWorkflowServeControlReadyQueryPrioritizesConfiguredRuntimeName(t *testing.T) {
+	query := workflowServeControlReadyQuery(
+		config.Agent{Name: config.ControlDispatcherAgentName, Dir: "gascity"},
+		"gascity--control-dispatcher",
+	)
+	tmp := t.TempDir()
+	logPath := filepath.Join(tmp, "bd.log")
+	bdPath := filepath.Join(tmp, "bd")
+	if err := os.WriteFile(bdPath, []byte(`#!/bin/sh
+set -eu
+[ "${BD_EXPORT_AUTO:-}" = "false" ] || {
+  echo "BD_EXPORT_AUTO=${BD_EXPORT_AUTO:-}" >&2
+  exit 43
+}
+printf '%s\n' "$*" >> "$BD_LOG"
+case "$*" in
+  "--readonly --sandbox ready --assignee=gascity--control-dispatcher --json --limit=20")
+    printf '[{"id":"ga-control-ready"}]'
+    ;;
+  *)
+    printf '[]'
+    ;;
+esac
+`), 0o755); err != nil {
+		t.Fatalf("write fake bd: %v", err)
+	}
+	out, err := shellWorkQueryWithEnv(query, t.TempDir(), []string{
+		"PATH=" + tmp + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"BD_LOG=" + logPath,
+		"GC_SESSION_ID=mc-manual",
+		"GC_SESSION_NAME=s-mc-manual",
+		"GC_AGENT=s-mc-manual",
+		"GC_SESSION_ORIGIN=manual",
+	})
+	if err != nil {
+		t.Fatalf("run workflow serve query: %v", err)
+	}
+	assertJSONEqual(t, out, `[{"id":"ga-control-ready"}]`)
+	logData, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("read bd log: %v", err)
+	}
+	firstCall, _, _ := strings.Cut(strings.TrimSpace(string(logData)), "\n")
+	if want := "--readonly --sandbox ready --assignee=gascity--control-dispatcher --json --limit=20"; firstCall != want {
+		t.Fatalf("first bd call = %q, want %q; all calls:\n%s", firstCall, want, string(logData))
+	}
+}
+
+func TestWorkflowServeControlReadyQueryQuotesMetadataFallbackTarget(t *testing.T) {
+	query := workflowServeControlReadyQuery(config.Agent{Name: config.ControlDispatcherAgentName, Dir: "my rig"})
+	tmp := t.TempDir()
+	argsPath := filepath.Join(tmp, "matched.args")
+	out := runWorkflowServeShellQueryForTest(t, query, map[string]string{
+		"BD_MATCHED_ARGS": argsPath,
+	}, `#!/bin/sh
+set -eu
+if [ "$#" -eq 8 ] &&
+   [ "$1" = "--readonly" ] &&
+   [ "$2" = "--sandbox" ] &&
+   [ "$3" = "ready" ] &&
+   [ "$4" = "--metadata-field" ] &&
+   [ "$5" = "gc.routed_to=my rig/control-dispatcher" ] &&
+   [ "$6" = "--unassigned" ] &&
+   [ "$7" = "--json" ] &&
+   [ "$8" = "--limit=20" ]; then
+  printf '%s\n' "$@" > "$BD_MATCHED_ARGS"
+  printf '[{"id":"ga-routed"}]'
+  exit 0
+fi
+printf '[]'
+`)
+	assertJSONEqual(t, out, `[{"id":"ga-routed"}]`)
+	argsData, err := os.ReadFile(argsPath)
+	if err != nil {
+		t.Fatalf("read matched args: %v", err)
+	}
+	gotArgs := strings.Split(strings.TrimSpace(string(argsData)), "\n")
+	wantArgs := []string{"--readonly", "--sandbox", "ready", "--metadata-field", "gc.routed_to=my rig/control-dispatcher", "--unassigned", "--json", "--limit=20"}
+	if !slices.Equal(gotArgs, wantArgs) {
+		t.Fatalf("matched bd args = %#v, want %#v", gotArgs, wantArgs)
+	}
+}
+
+func TestWorkflowServeControlReadyQueryUsesLegacyRouteForNamedSessions(t *testing.T) {
+	query := workflowServeControlReadyQuery(config.Agent{Name: config.ControlDispatcherAgentName, Dir: "gascity"})
+	out := runWorkflowServeShellQueryForTest(t, query, map[string]string{
+		"GC_SESSION_NAME":   "gascity--control-dispatcher",
+		"GC_ALIAS":          "gascity/control-dispatcher",
+		"GC_SESSION_ORIGIN": "named",
+	}, `#!/bin/sh
+set -eu
+case "$*" in
+  "--readonly --sandbox ready --metadata-field gc.routed_to=gascity/workflow-control --unassigned --json --limit=20")
+    printf '[{"id":"ga-legacy-route"}]'
+    ;;
+  *)
+    printf '[]'
+    ;;
+esac
+`)
+	assertJSONEqual(t, out, `[{"id":"ga-legacy-route"}]`)
+}
+
+func runWorkflowServeShellQueryForTest(t *testing.T, query string, env map[string]string, bdScript string) string {
+	t.Helper()
+
+	tmp := t.TempDir()
+	bdPath := filepath.Join(tmp, "bd")
+	if err := os.WriteFile(bdPath, []byte(bdScript), 0o755); err != nil {
+		t.Fatalf("write fake bd: %v", err)
+	}
+
+	queryEnv := []string{"PATH=" + tmp + string(os.PathListSeparator) + os.Getenv("PATH")}
+	for key, value := range env {
+		queryEnv = append(queryEnv, key+"="+value)
+	}
+	out, err := shellWorkQueryWithEnv(query, t.TempDir(), queryEnv)
+	if err != nil {
+		t.Fatalf("run workflow serve query: %v", err)
+	}
+	return out
+}
+
+func assertJSONEqual(t *testing.T, got, want string) {
+	t.Helper()
+	var gotValue any
+	if err := json.Unmarshal([]byte(got), &gotValue); err != nil {
+		t.Fatalf("unmarshal got JSON %q: %v", got, err)
+	}
+	var wantValue any
+	if err := json.Unmarshal([]byte(want), &wantValue); err != nil {
+		t.Fatalf("unmarshal want JSON %q: %v", want, err)
+	}
+	if !reflect.DeepEqual(gotValue, wantValue) {
+		t.Fatalf("JSON output = %s, want %s", got, want)
+	}
+}
+
+// TestRunWorkflowServeOverridesInheritedCityBeadsDir is a regression test for
+// #514: the serve path must pass rig-scoped env to work query subprocesses,
+// not inherit a city-scoped BEADS_DIR from the parent.
+func TestRunWorkflowServeOverridesInheritedCityBeadsDir(t *testing.T) {
+	clearGCEnv(t)
+	t.Setenv("GC_TMUX_SESSION", "host-session")
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "myrig-repo")
+
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := fmt.Sprintf("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n\n[[rigs]]\nname = \"myrig\"\npath = %q\n\n[[agent]]\nname = \"worker\"\ndir = \"myrig\"\n", rigDir)
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("GC_CITY", cityDir)
+	// Pollute parent env with a city-scoped BEADS_DIR. Without the fix,
+	// this value leaks into work query subprocesses.
+	cityBeads := filepath.Join(cityDir, ".beads")
+	t.Setenv("BEADS_DIR", cityBeads)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevControl := controlDispatcherServe
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		controlDispatcherServe = prevControl
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	var capturedEnv map[string]string
+	workflowServeList = func(_, _ string, env map[string]string) ([]hookBead, error) {
+		capturedEnv = maps.Clone(env)
+		return nil, nil // no work: exits immediately
+	}
+	controlDispatcherServe = func(_, _, _ string, _ io.Writer, _ io.Writer) error {
+		return nil
+	}
+
+	if err := runWorkflowServe("worker", false, io.Discard, io.Discard); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	if capturedEnv == nil {
+		t.Fatal("workflowServeList received nil env, want rig-scoped env")
+	}
+	wantBeads := filepath.Join(rigDir, ".beads")
+	if got := capturedEnv["BEADS_DIR"]; got != wantBeads {
+		t.Fatalf("BEADS_DIR = %q, want rig store %q", got, wantBeads)
+	}
+	if capturedEnv["BEADS_DIR"] == cityBeads {
+		t.Fatalf("BEADS_DIR inherited city store %q", cityBeads)
+	}
+	if got := capturedEnv["GC_STORE_ROOT"]; got != rigDir {
+		t.Fatalf("GC_STORE_ROOT = %q, want rig root %q", got, rigDir)
+	}
+	if got := capturedEnv["GC_STORE_SCOPE"]; got != "rig" {
+		t.Fatalf("GC_STORE_SCOPE = %q, want rig", got)
+	}
+}
+
+func TestRunWorkflowServeProcessesControlBeadsInAgentStoreScope(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "myrig-repo")
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := fmt.Sprintf(`[workspace]
+name = "test-city"
 
-func TestRunWorkflowServeProcessesReadyControlBeadsThenExits(t *testing.T) {
-	cityDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
-		t.Fatalf("write city.toml: %v", err)
+[daemon]
+formula_v2 = true
+
+[[rigs]]
+name = "myrig"
+path = %q
+`, rigDir)
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
 	}
 	t.Setenv("GC_CITY", cityDir)
 
@@ -941,63 +2536,226 @@ func TestRunWorkflowServeProcessesReadyControlBeadsThenExits(t *testing.T) {
 		workflowServeIdlePollAttempts = prevAttempts
 	})
 
-	// The tiered query has sh -c wrapper; workflowServeQuery replaces the
-	// first --limit=1 with --limit=20 for scan width.
-	cdAgent := config.Agent{Name: config.ControlDispatcherAgentName}
-	wantQuery := workflowServeQuery(cdAgent.EffectiveWorkQuery())
-	var gotQueries []string
-	var gotDirs []string
-	var gotEnv []map[string]string
-	var controlled []string
-	sequence := [][]hookBead{
-		{{ID: "gc-ctrl-1", Metadata: map[string]string{"gc.kind": "scope-check"}}},
-		{{ID: "gc-ctrl-2", Metadata: map[string]string{"gc.kind": "workflow-finalize"}}},
-	}
-
-	workflowServeList = func(workQuery, dir string, env map[string]string) ([]hookBead, error) {
-		gotQueries = append(gotQueries, workQuery)
-		gotDirs = append(gotDirs, dir)
-		gotEnv = append(gotEnv, maps.Clone(env))
-		if len(sequence) == 0 {
-			return nil, nil
+	calls := 0
+	var queryDir string
+	workflowServeList = func(_, dir string, _ map[string]string) ([]hookBead, error) {
+		calls++
+		queryDir = dir
+		if calls == 1 {
+			return []hookBead{{ID: "gc-rig-control", Metadata: map[string]string{"gc.kind": "scope-check"}}}, nil
 		}
-		next := sequence[0]
-		sequence = sequence[1:]
-		return next, nil
+		return nil, nil
 	}
-	controlDispatcherServe = func(beadID string, _ io.Writer, _ io.Writer) error {
-		controlled = append(controlled, beadID)
+
+	var gotCityPath, gotStorePath, gotBeadID string
+	controlDispatcherServe = func(cityPath, storePath, beadID string, _ io.Writer, _ io.Writer) error {
+		gotCityPath = cityPath
+		gotStorePath = storePath
+		gotBeadID = beadID
 		return nil
 	}
 
-	if err := runWorkflowServe("", false, io.Discard, io.Discard); err != nil {
+	if err := runWorkflowServe("myrig/control-dispatcher", false, io.Discard, io.Discard); err != nil {
 		t.Fatalf("runWorkflowServe: %v", err)
 	}
+	if canonicalTestPath(queryDir) != canonicalTestPath(rigDir) {
+		t.Fatalf("query dir = %q, want rig root %q", queryDir, rigDir)
+	}
+	if canonicalTestPath(gotCityPath) != canonicalTestPath(cityDir) {
+		t.Fatalf("control cityPath = %q, want %q", gotCityPath, cityDir)
+	}
+	if canonicalTestPath(gotStorePath) != canonicalTestPath(rigDir) {
+		t.Fatalf("control storePath = %q, want rig root %q", gotStorePath, rigDir)
+	}
+	if gotBeadID != "gc-rig-control" {
+		t.Fatalf("control beadID = %q, want gc-rig-control", gotBeadID)
+	}
+}
 
-	if !slices.Equal(controlled, []string{"gc-ctrl-1", "gc-ctrl-2"}) {
-		t.Fatalf("controlled beads = %#v, want two ready control beads in order", controlled)
+func TestOpenControlStoreDisablesAutoExportWithoutSandboxingWrites(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "myrig-repo")
+	if err := os.MkdirAll(filepath.Join(cityDir, ".beads"), 0o755); err != nil {
+		t.Fatal(err)
 	}
-	if len(gotQueries) != 3 {
-		t.Fatalf("workflowServeList calls = %d, want 3", len(gotQueries))
+	if err := os.MkdirAll(filepath.Join(rigDir, ".beads"), 0o755); err != nil {
+		t.Fatal(err)
 	}
-	for i, got := range gotQueries {
-		if got != wantQuery {
-			t.Fatalf("workflowServeList query[%d] = %q, want %q", i, got, wantQuery)
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs:      []config.Rig{{Name: "myrig", Path: rigDir}},
+	}
+	t.Setenv("GC_BEADS", "bd")
+
+	var calls [][]string
+	var envs []map[string]string
+	prevRunner := beadsExecCommandRunnerWithEnv
+	beadsExecCommandRunnerWithEnv = func(env map[string]string) beads.CommandRunner {
+		envs = append(envs, maps.Clone(env))
+		return func(_ string, name string, args ...string) ([]byte, error) {
+			if name != "bd" {
+				return nil, fmt.Errorf("unexpected command %q", name)
+			}
+			calls = append(calls, append([]string(nil), args...))
+			return []byte(`[]`), nil
 		}
 	}
-	for i, got := range gotDirs {
-		if canonicalTestPath(got) != canonicalTestPath(cityDir) {
-			t.Fatalf("workflowServeList dir[%d] = %q, want %q", i, got, cityDir)
+	t.Cleanup(func() { beadsExecCommandRunnerWithEnv = prevRunner })
+
+	status := "closed"
+	cityStore, err := openControlStoreAtForCity(cityDir, cityDir, cfg)
+	if err != nil {
+		t.Fatalf("openControlStoreAtForCity(city): %v", err)
+	}
+	if err := cityStore.Update("ga-city-control", beads.UpdateOpts{Status: &status}); err != nil {
+		t.Fatalf("city control update: %v", err)
+	}
+	rigStore, err := openControlStoreAtForCity(rigDir, cityDir, cfg)
+	if err != nil {
+		t.Fatalf("openControlStoreAtForCity(rig): %v", err)
+	}
+	if err := rigStore.Update("ga-rig-control", beads.UpdateOpts{Status: &status}); err != nil {
+		t.Fatalf("rig control update: %v", err)
+	}
+
+	if len(calls) != 2 {
+		t.Fatalf("bd calls = %#v, want two update calls", calls)
+	}
+	if len(envs) != 2 {
+		t.Fatalf("bd envs = %#v, want two command environments", envs)
+	}
+	for i, call := range calls {
+		if len(call) < 1 || call[0] != "update" {
+			t.Fatalf("bd call = %#v, want update ...", call)
+		}
+		if slices.Contains(call, "--sandbox") {
+			t.Fatalf("bd call = %#v, write-capable control stores must not use --sandbox", call)
+		}
+		if got := envs[i]["BD_EXPORT_AUTO"]; got != "false" {
+			t.Fatalf("bd env %d BD_EXPORT_AUTO = %q, want false", i, got)
 		}
 	}
-	for i, env := range gotEnv {
-		if env["GC_STORE_ROOT"] != cityDir {
-			t.Fatalf("workflowServeList env[%d] GC_STORE_ROOT = %q, want %q", i, env["GC_STORE_ROOT"], cityDir)
+}
+
+func TestOpenControlStoreAtForCityPreservesFileAndExecProviderStores(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "rigs", "frontend")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeExecStoreCityConfig(t, cityDir, "metro-city", "ct", []config.Rig{{
+		Name:   "frontend",
+		Path:   "rigs/frontend",
+		Prefix: "fe",
+	}})
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "metro-city", Prefix: "ct"},
+		Rigs: []config.Rig{{
+			Name:   "frontend",
+			Path:   "rigs/frontend",
+			Prefix: "fe",
+		}},
+	}
+
+	t.Run("file", func(t *testing.T) {
+		t.Setenv("GC_BEADS", "file")
+		t.Setenv("GC_BEADS_SCOPE_ROOT", "")
+		store, err := openControlStoreAtForCity(rigDir, cityDir, cfg)
+		if err != nil {
+			t.Fatalf("openControlStoreAtForCity(file): %v", err)
 		}
-		if env["GC_STORE_SCOPE"] != "city" {
-			t.Fatalf("workflowServeList env[%d] GC_STORE_SCOPE = %q, want city", i, env["GC_STORE_SCOPE"])
+		if _, ok := store.(*beads.FileStore); !ok {
+			t.Fatalf("control store = %T, want *beads.FileStore for file provider", store)
+		}
+	})
+
+	t.Run("exec", func(t *testing.T) {
+		captureDir := t.TempDir()
+		script := writeExecCaptureScript(t, captureDir)
+		provider := "exec:" + script
+		t.Setenv("GC_BEADS", provider)
+		t.Setenv("GC_BEADS_SCOPE_ROOT", "")
+
+		store, err := openControlStoreAtForCity(rigDir, cityDir, cfg)
+		if err != nil {
+			t.Fatalf("openControlStoreAtForCity(exec): %v", err)
+		}
+		if _, err := store.Create(beads.Bead{Title: "rig"}); err != nil {
+			t.Fatalf("exec control Create: %v", err)
+		}
+		env := readExecCaptureEnv(t, filepath.Join(captureDir, "frontend.env"))
+		if got := env["GC_PROVIDER"]; got != provider {
+			t.Fatalf("exec GC_PROVIDER = %q, want %q", got, provider)
+		}
+		if got := env["GC_STORE_SCOPE"]; got != "rig" {
+			t.Fatalf("exec GC_STORE_SCOPE = %q, want rig", got)
+		}
+	})
+}
+
+func TestOpenControlStoreAtForCityUsesControlRunnerForStaleBdScope(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	staleRigDir := filepath.Join(cityDir, "rigs", "removed")
+	if err := os.MkdirAll(filepath.Join(staleRigDir, ".beads"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(staleRigDir, ".beads", "metadata.json"), []byte(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":"removed"}`), 0o644); err != nil {
+		t.Fatalf("write stale rig metadata: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Rigs:      []config.Rig{{Name: "active", Path: "rigs/active"}},
+	}
+	t.Setenv("GC_BEADS", "bd")
+
+	var calls [][]string
+	var envs []map[string]string
+	prevRunner := beadsExecCommandRunnerWithEnv
+	beadsExecCommandRunnerWithEnv = func(env map[string]string) beads.CommandRunner {
+		envs = append(envs, maps.Clone(env))
+		return func(_ string, name string, args ...string) ([]byte, error) {
+			if name != "bd" {
+				return nil, fmt.Errorf("unexpected command %q", name)
+			}
+			calls = append(calls, append([]string(nil), args...))
+			return []byte(`[]`), nil
 		}
 	}
+	t.Cleanup(func() { beadsExecCommandRunnerWithEnv = prevRunner })
+
+	status := "closed"
+	store, err := openControlStoreAtForCity(staleRigDir, cityDir, cfg)
+	if err != nil {
+		t.Fatalf("openControlStoreAtForCity(stale rig): %v", err)
+	}
+	if err := store.Update("ga-stale-control", beads.UpdateOpts{Status: &status}); err != nil {
+		t.Fatalf("stale rig control update: %v", err)
+	}
+
+	if len(calls) != 1 {
+		t.Fatalf("bd calls = %#v, want one update call", calls)
+	}
+	if len(envs) != 1 {
+		t.Fatalf("bd envs = %#v, want one command environment", envs)
+	}
+	if call := calls[0]; len(call) < 1 || call[0] != "update" {
+		t.Fatalf("bd call = %#v, want update ...", calls[0])
+	}
+	if slices.Contains(calls[0], "--sandbox") {
+		t.Fatalf("bd call = %#v, write-capable control stores must not use --sandbox", calls[0])
+	}
+	if got := envs[0]["BD_EXPORT_AUTO"]; got != "false" {
+		t.Fatalf("BD_EXPORT_AUTO = %q, want false", got)
+	}
+	if got := envs[0]["BEADS_DIR"]; got != filepath.Join(staleRigDir, ".beads") {
+		t.Fatalf("BEADS_DIR = %q, want stale rig store", got)
+	}
+	if got := envs[0]["GC_RIG_ROOT"]; got != staleRigDir {
+		t.Fatalf("GC_RIG_ROOT = %q, want stale rig root", got)
+	}
 }
 
 func TestRunWorkflowServeUsesGCTemplateForSessionContext(t *testing.T) {
@@ -1059,7 +2817,7 @@ max = 5
 		gotDir = dir
 		return nil, nil
 	}
-	controlDispatcherServe = func(_ string, _ io.Writer, _ io.Writer) error {
+	controlDispatcherServe = func(_, _, _ string, _ io.Writer, _ io.Writer) error {
 		t.Fatal("controlDispatcherServe should not run when no control work is returned")
 		return nil
 	}
@@ -1113,7 +2871,7 @@ func TestRunWorkflowServeRetriesBrieflyAfterProcessingBeforeIdleExit(t *testing.
 			return nil, nil
 		}
 	}
-	controlDispatcherServe = func(beadID string, _ io.Writer, _ io.Writer) error {
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
 		controlled = append(controlled, beadID)
 		return nil
 	}
@@ -1165,7 +2923,7 @@ func TestRunWorkflowServeSkipsPendingControlBeadAndProcessesLaterReady(t *testin
 			return nil, nil
 		}
 	}
-	controlDispatcherServe = func(beadID string, _ io.Writer, _ io.Writer) error {
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
 		attempted = append(attempted, beadID)
 		if beadID == "gc-pending" {
 			return dispatch.ErrControlPending
@@ -1186,6 +2944,65 @@ func TestRunWorkflowServeSkipsPendingControlBeadAndProcessesLaterReady(t *testin
 	}
 }
 
+func TestRunWorkflowServeSkipsLegacyOversizedControlAndProcessesLaterReady(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	prevCityFlag := cityFlag
+	prevList := workflowServeList
+	prevControl := controlDispatcherServe
+	prevInterval := workflowServeIdlePollInterval
+	prevAttempts := workflowServeIdlePollAttempts
+	cityFlag = ""
+	workflowServeIdlePollInterval = 0
+	workflowServeIdlePollAttempts = 0
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		workflowServeList = prevList
+		controlDispatcherServe = prevControl
+		workflowServeIdlePollInterval = prevInterval
+		workflowServeIdlePollAttempts = prevAttempts
+	})
+
+	var attempted []string
+	var processed []string
+	calls := 0
+	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
+		calls++
+		switch calls {
+		case 1:
+			return []hookBead{
+				{ID: "gc-legacy", Metadata: map[string]string{"gc.kind": "ralph"}},
+				{ID: "gc-ready", Metadata: map[string]string{"gc.kind": "scope-check"}},
+			}, nil
+		default:
+			return nil, nil
+		}
+	}
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
+		attempted = append(attempted, beadID)
+		if beadID == "gc-legacy" {
+			return fmt.Errorf("gc-legacy: recording attempt log: setting metadata on %q: failed to record event: old_value is too large", beadID)
+		}
+		processed = append(processed, beadID)
+		return nil
+	}
+
+	if err := runWorkflowServe("", false, io.Discard, io.Discard); err != nil {
+		t.Fatalf("runWorkflowServe: %v", err)
+	}
+
+	if !slices.Equal(attempted, []string{"gc-legacy", "gc-ready"}) {
+		t.Fatalf("attempted beads = %#v, want legacy oversized control skipped before ready bead is processed", attempted)
+	}
+	if !slices.Equal(processed, []string{"gc-ready"}) {
+		t.Fatalf("processed beads = %#v, want only later ready bead to be processed", processed)
+	}
+}
+
 func TestRunWorkflowServeReturnsQueryError(t *testing.T) {
 	cityDir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n\n[daemon]\nformula_v2 = true\n"), 0o644); err != nil {
@@ -1206,7 +3023,7 @@ func TestRunWorkflowServeReturnsQueryError(t *testing.T) {
 	workflowServeList = func(_, _ string, _ map[string]string) ([]hookBead, error) {
 		return nil, os.ErrDeadlineExceeded
 	}
-	controlDispatcherServe = func(string, io.Writer, io.Writer) error {
+	controlDispatcherServe = func(_, _, _ string, _ io.Writer, _ io.Writer) error {
 		t.Fatal("controlDispatcherServe should not be called on query failure")
 		return nil
 	}
@@ -1293,7 +3110,7 @@ func TestRunWorkflowServeFollowUsesSweepFallback(t *testing.T) {
 			return nil, nil
 		}
 	}
-	controlDispatcherServe = func(beadID string, _ io.Writer, _ io.Writer) error {
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
 		processed = append(processed, beadID)
 		return os.ErrDeadlineExceeded
 	}
@@ -1301,8 +3118,9 @@ func TestRunWorkflowServeFollowUsesSweepFallback(t *testing.T) {
 	wfcAgent := config.Agent{Name: "control-dispatcher", MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(1)}
 	err := runWorkflowServeFollow(
 		wfcAgent,
-		wfcAgent.EffectiveWorkQuery(),
 		t.TempDir(),
+		t.TempDir(),
+		wfcAgent.EffectiveWorkQuery(),
 		nil,
 		io.Discard,
 	)
@@ -1375,7 +3193,7 @@ func TestRunWorkflowServeFollowResetsBackoffForProcessedEventAndPending(t *testi
 			return nil, nil
 		}
 	}
-	controlDispatcherServe = func(beadID string, _ io.Writer, _ io.Writer) error {
+	controlDispatcherServe = func(_, _ string, beadID string, _ io.Writer, _ io.Writer) error {
 		if beadID == "gc-pending" {
 			return dispatch.ErrControlPending
 		}
@@ -1383,7 +3201,7 @@ func TestRunWorkflowServeFollowResetsBackoffForProcessedEventAndPending(t *testi
 	}
 
 	agent := config.Agent{Name: "control-dispatcher"}
-	err := runWorkflowServeFollow(agent, agent.EffectiveWorkQuery(), t.TempDir(), nil, io.Discard)
+	err := runWorkflowServeFollow(agent, t.TempDir(), t.TempDir(), agent.EffectiveWorkQuery(), nil, io.Discard)
 	if !errors.Is(err, stopErr) {
 		t.Fatalf("runWorkflowServeFollow error = %v, want %v", err, stopErr)
 	}
@@ -1481,8 +3299,11 @@ func TestDecorateDynamicFragmentRecipeSynthesizesInheritedScopeChecks(t *testing
 	if control.Metadata["gc.scope_ref"] != "body" {
 		t.Fatalf("review scope-check gc.scope_ref = %q, want body", control.Metadata["gc.scope_ref"])
 	}
-	if control.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-		t.Fatalf("review scope-check gc.routed_to = %q, want %q", control.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+	if control.Assignee != config.ControlDispatcherAgentName {
+		t.Fatalf("review scope-check assignee = %q, want %q", control.Assignee, config.ControlDispatcherAgentName)
+	}
+	if got := control.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("review scope-check gc.routed_to = %q, want empty direct dispatcher assignee", got)
 	}
 	if control.Metadata[graphExecutionRouteMetaKey] != "reviewer" {
 		t.Fatalf("review scope-check execution route = %q, want reviewer", control.Metadata[graphExecutionRouteMetaKey])
@@ -1790,7 +3611,7 @@ name = "test-city"
 	}
 	t.Setenv("GC_BEADS", "exec:/definitely/missing/provider")
 
-	_, _, err := findBeadAcrossStores(cityPath, "gc-missing", io.Discard)
+	_, _, _, err := findBeadAcrossStores(cityPath, "gc-missing", io.Discard)
 	if err == nil {
 		t.Fatal("findBeadAcrossStores() error = nil, want provider failure")
 	}
@@ -1820,6 +3641,7 @@ prefix = "BL"
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -1938,6 +3760,7 @@ prefix = "BL"
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -2059,6 +3882,7 @@ prefix = "BL"
 	}
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	prevCityFlag := cityFlag
 	cityFlag = ""
 	t.Cleanup(func() { cityFlag = prevCityFlag })
@@ -2203,6 +4027,72 @@ func TestDeleteWorkflowBeadsRemovesDepsBeforeDelete(t *testing.T) {
 	}
 }
 
+func TestApplySourceWorkflowMatchCleanupDeletesOnlyCollectedWorkflowBeads(t *testing.T) {
+	store := beads.NewMemStore()
+	first, err := store.Create(beads.Bead{Title: "workflow first", Type: "task"})
+	if err != nil {
+		t.Fatalf("Create(first): %v", err)
+	}
+	second, err := store.Create(beads.Bead{Title: "workflow second", Type: "task"})
+	if err != nil {
+		t.Fatalf("Create(second): %v", err)
+	}
+	outside, err := store.Create(beads.Bead{Title: "outside follow-up", Type: "task"})
+	if err != nil {
+		t.Fatalf("Create(outside): %v", err)
+	}
+	if err := store.DepAdd(first.ID, outside.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd(first->outside): %v", err)
+	}
+	if err := store.DepAdd(outside.ID, second.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd(outside->second): %v", err)
+	}
+
+	runnerCalled := false
+	runner := func(_ string, _ string, _ ...string) ([]byte, error) {
+		runnerCalled = true
+		return []byte("ok"), nil
+	}
+
+	var stderr bytes.Buffer
+	closed, deleted, incomplete := applySourceWorkflowMatchCleanup(sourceWorkflowStoreMatch{
+		label:  "rig:gascity",
+		store:  store,
+		beads:  []beads.Bead{first, second},
+		path:   "/repo",
+		runner: runner,
+	}, true, &stderr)
+	if incomplete {
+		t.Fatalf("cleanup incomplete; stderr=%s", stderr.String())
+	}
+	if closed != 2 || deleted != 2 {
+		t.Fatalf("closed/deleted = %d/%d, want 2/2", closed, deleted)
+	}
+	if runnerCalled {
+		t.Fatal("cleanup used bd cascade runner; want explicit in-process deletion of collected IDs")
+	}
+	for _, id := range []string{first.ID, second.ID} {
+		if _, err := store.Get(id); err == nil {
+			t.Fatalf("Get(%s) succeeded after delete", id)
+		}
+	}
+	if got, err := store.Get(outside.ID); err != nil {
+		t.Fatalf("Get(outside): %v", err)
+	} else if got.Status != "open" {
+		t.Fatalf("outside status = %q, want open", got.Status)
+	}
+	if down, err := store.DepList(outside.ID, "down"); err != nil {
+		t.Fatalf("DepList(outside, down): %v", err)
+	} else if len(down) != 0 {
+		t.Fatalf("outside down deps = %#v, want none after collected bead deletion", down)
+	}
+	if up, err := store.DepList(outside.ID, "up"); err != nil {
+		t.Fatalf("DepList(outside, up): %v", err)
+	} else if len(up) != 0 {
+		t.Fatalf("outside up deps = %#v, want none after collected bead deletion", up)
+	}
+}
+
 type failingDeleteStore struct {
 	*beads.MemStore
 	failID       string
@@ -2423,6 +4313,131 @@ func TestWaitForRelevantWorkflowWakeTraceIncludesBackoffState(t *testing.T) {
 	}
 }
 
+func TestWorkflowTracefWarnsOnceWhenTracePathCannotBeOpened(t *testing.T) {
+	tracePath := filepath.Join(t.TempDir(), "missing", "workflow-trace.log")
+	t.Setenv("GC_WORKFLOW_TRACE", tracePath)
+
+	var stderr bytes.Buffer
+	restoreWarnings := useWorkflowTraceWarnings(&stderr)
+	defer restoreWarnings()
+
+	workflowTracef("first write")
+	workflowTracef("second write")
+
+	got := stderr.String()
+	if count := strings.Count(got, "opening workflow trace"); count != 1 {
+		t.Fatalf("warning count = %d, want 1; stderr=%q", count, got)
+	}
+	if !strings.Contains(got, tracePath) {
+		t.Fatalf("stderr = %q, want missing trace path %q", got, tracePath)
+	}
+}
+
+func TestWorkflowTracefFallsBackToSlingTrace(t *testing.T) {
+	tracePath := filepath.Join(t.TempDir(), "workflow-trace.log")
+	t.Setenv("GC_SLING_TRACE", tracePath)
+
+	workflowTracef("fallback trace")
+
+	traceBytes, err := os.ReadFile(tracePath)
+	if err != nil {
+		t.Fatalf("read trace: %v", err)
+	}
+	if !strings.Contains(string(traceBytes), "fallback trace") {
+		t.Fatalf("trace = %q, want fallback trace payload", traceBytes)
+	}
+}
+
+func TestWorkflowTracefUsesRFC3339NanoTimestamp(t *testing.T) {
+	tracePath := filepath.Join(t.TempDir(), "workflow-trace.log")
+	t.Setenv("GC_WORKFLOW_TRACE", tracePath)
+
+	fixedNow := time.Date(2026, 5, 5, 22, 12, 34, 345678901, time.UTC)
+	prevNow := workflowTraceNow
+	workflowTraceNow = func() time.Time { return fixedNow }
+	defer func() {
+		workflowTraceNow = prevNow
+	}()
+
+	workflowTracef("precise trace")
+
+	traceBytes, err := os.ReadFile(tracePath)
+	if err != nil {
+		t.Fatalf("read trace: %v", err)
+	}
+
+	line := strings.TrimSpace(string(traceBytes))
+	wantPrefix := fixedNow.Format(time.RFC3339Nano) + " "
+	if !strings.HasPrefix(line, wantPrefix) {
+		t.Fatalf("trace = %q, want prefix %q", line, wantPrefix)
+	}
+}
+
+func TestWorkflowTraceWarningScopeResetsAcrossTopLevelInstalls(t *testing.T) {
+	badPath := filepath.Join(t.TempDir(), "missing", "workflow-trace.log")
+	var stderr bytes.Buffer
+
+	restoreOne := useWorkflowTraceWarnings(&stderr)
+	workflowTraceWarnOpenFailure(badPath, os.ErrNotExist)
+	restoreOne()
+
+	restoreTwo := useWorkflowTraceWarnings(&stderr)
+	workflowTraceWarnOpenFailure(badPath, os.ErrNotExist)
+	restoreTwo()
+
+	if count := strings.Count(stderr.String(), "opening workflow trace"); count != 2 {
+		t.Fatalf("warning count = %d, want 2 across separate top-level installs; stderr=%q", count, stderr.String())
+	}
+}
+
+func TestWorkflowTraceWarningRestoreSupportsOutOfOrderRelease(t *testing.T) {
+	badPath := filepath.Join(t.TempDir(), "missing", "workflow-trace.log")
+	var outer bytes.Buffer
+	var inner bytes.Buffer
+	var fresh bytes.Buffer
+
+	restoreOuter := useWorkflowTraceWarnings(&outer)
+	restoreInner := useWorkflowTraceWarnings(&inner)
+
+	restoreOuter()
+	workflowTraceWarnOpenFailure(badPath, os.ErrNotExist)
+	restoreInner()
+
+	if outer.Len() != 0 {
+		t.Fatalf("outer stderr = %q, want no warning after out-of-order outer restore", outer.String())
+	}
+	if count := strings.Count(inner.String(), "opening workflow trace"); count != 1 {
+		t.Fatalf("inner warning count = %d, want 1 after out-of-order outer restore; stderr=%q", count, inner.String())
+	}
+
+	restoreFresh := useWorkflowTraceWarnings(&fresh)
+	workflowTraceWarnOpenFailure(badPath, os.ErrNotExist)
+	restoreFresh()
+	if count := strings.Count(fresh.String(), "opening workflow trace"); count != 1 {
+		t.Fatalf("fresh warning count = %d, want 1 after scopes reset; stderr=%q", count, fresh.String())
+	}
+}
+
+func TestWorkflowTraceWarnfDedupsMatchingInactiveScopeWriter(t *testing.T) {
+	var outer bytes.Buffer
+	var inner bytes.Buffer
+
+	restoreOuter := useWorkflowTraceWarnings(&outer)
+	defer restoreOuter()
+	restoreInner := useWorkflowTraceWarnings(&inner)
+	defer restoreInner()
+
+	workflowTraceWarnf(&outer, "duplicate", "outer warning\n")
+	workflowTraceWarnf(&outer, "duplicate", "outer warning\n")
+
+	if count := strings.Count(outer.String(), "outer warning"); count != 1 {
+		t.Fatalf("outer warning count = %d, want 1; stderr=%q", count, outer.String())
+	}
+	if inner.Len() != 0 {
+		t.Fatalf("inner stderr = %q, want no warning for outer-scope writer", inner.String())
+	}
+}
+
 func TestFollowSleepDurationHandlesPathologicalInputs(t *testing.T) {
 	prevSweep := workflowServeWakeSweepInterval
 	prevMax := workflowServeMaxIdleSleep
diff --git a/cmd/gc/cmd_doctor.go b/cmd/gc/cmd_doctor.go
index 9b937ecced..2d2dab87ab 100644
--- a/cmd/gc/cmd_doctor.go
+++ b/cmd/gc/cmd_doctor.go
@@ -172,6 +172,12 @@ func doDoctor(fix, verbose bool, stdout, stderr io.Writer) int {
 	d.Register(doctor.NewBinaryCheck("jq", "", exec.LookPath))
 	d.Register(doctor.NewBinaryCheck("pgrep", "", exec.LookPath))
 	d.Register(doctor.NewBinaryCheck("lsof", "", exec.LookPath))
+	// beads.role must be set before any bd command runs; check it here so
+	// the missing-role error appears before the downstream data/Dolt checks
+	// that will all fail for the same root cause.
+	if initNeedsBdTooling(cityPath) {
+		d.Register(&doctor.BeadsRoleCheck{})
+	}
 
 	// Controller check + session checks (gated by controller state).
 	controllerRunning := doctor.IsControllerRunning(cityPath)
@@ -193,6 +199,7 @@ func doDoctor(fix, verbose bool, stdout, stderr io.Writer) int {
 	if cfgErr == nil {
 		d.Register(doctor.NewBDSplitStoreCheck(cityPath))
 		d.Register(doctor.NewBeadsStoreCheck(cityPath, storeFactory))
+		d.Register(newV2RoutedToNamespaceCheck(cfg, cityPath, storeFactory))
 		d.Register(&sessionModelDoctorCheck{cfg: cfg, cityPath: cityPath, newStore: storeFactory})
 	}
 	skipCityDoltCheck := os.Getenv("GC_DOLT") == "skip" || (!scopeUsesManagedBdStoreContract(cityPath, cityPath) && !workspaceNeedsCityDoltCheck(cityPath, cfg))
@@ -208,6 +215,16 @@ func doDoctor(fix, verbose bool, stdout, stderr io.Writer) int {
 	d.Register(doctor.NewScopedDoltVersionCheckForConfig(cityPath, skipManagedDoltCheck, cfg, cfgErr))
 	d.Register(&doctor.EventsLogCheck{})
 	d.Register(doctor.NewEventLogSizeCheck())
+	// Worktree checks deliberately run even when cfgErr != nil — they
+	// only need the city path, and a broken city.toml is exactly when
+	// silent disk-fill is most likely. The zero-value DoctorConfig
+	// produces sensible 10/50 GB defaults via its accessor methods.
+	var doctorCfg config.DoctorConfig
+	if cfg != nil {
+		doctorCfg = cfg.Doctor
+	}
+	d.Register(doctor.NewWorktreeDiskSizeCheck(doctorCfg))
+	d.Register(doctor.NewNestedWorktreePruneCheck(doctorCfg))
 
 	// Custom types check — city store.
 	d.Register(doctor.NewCustomTypesCheck(cityPath, "city"))
diff --git a/cmd/gc/cmd_dolt_cleanup.go b/cmd/gc/cmd_dolt_cleanup.go
new file mode 100644
index 0000000000..710785f8d8
--- /dev/null
+++ b/cmd/gc/cmd_dolt_cleanup.go
@@ -0,0 +1,1035 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/spf13/cobra"
+)
+
+// CleanupSchemaVersion is the stable schema identifier for the JSON output of
+// `gc dolt-cleanup --json`. Documented in AD-04 designer Wireframe 6.
+const CleanupSchemaVersion = "gc.dolt.cleanup.v1"
+
+// CleanupReport is the typed JSON output of `gc dolt-cleanup`.
+//
+// Fields are populated incrementally: the port section is filled from the
+// AD-04 §4.1 discovery chain; rigs_protected, dropped, purge, reaped are
+// populated by their respective steps as they come online. The shape is
+// stable from day one — empty arrays and zero structs render as `[]` /
+// `{...}` so callers can rely on the schema across versions.
+type CleanupReport struct {
+	Schema        string                 `json:"schema"`
+	Port          CleanupPortReport      `json:"port"`
+	RigsProtected []CleanupRigProtection `json:"rigs_protected"`
+	ForceBlockers []CleanupForceBlocker  `json:"force_blockers"`
+	Dropped       CleanupDroppedReport   `json:"dropped"`
+	Purge         CleanupPurgeReport     `json:"purge"`
+	Reaped        CleanupReapedReport    `json:"reaped"`
+	Summary       CleanupSummary         `json:"summary"`
+	Errors        []CleanupError         `json:"errors"`
+}
+
+// CleanupPortReport is the resolved-port section of the JSON envelope.
+type CleanupPortReport struct {
+	Resolved int    `json:"resolved"`
+	Source   string `json:"source"`
+	Fallback bool   `json:"fallback"`
+}
+
+// CleanupRigProtection records a registered rig DB whose name will not be
+// dropped even if it appears in the orphan scan.
+type CleanupRigProtection struct {
+	Rig string `json:"rig"`
+	DB  string `json:"db"`
+}
+
+// CleanupForceBlocker records a condition that would block a future forced
+// cleanup but does not make dry-run output an error.
+type CleanupForceBlocker struct {
+	Kind  string `json:"kind"`
+	Name  string `json:"name,omitempty"`
+	Error string `json:"error"`
+}
+
+// CleanupDroppedReport summarizes the drop step.
+type CleanupDroppedReport struct {
+	Count      int   `json:"count"`
+	BytesFreed int64 `json:"bytes_freed"`
+	// Names lists the databases the drop step targeted: the candidates in
+	// dry-run, the actually-dropped names in --force. Order follows the
+	// SHOW DATABASES result.
+	Names   []string             `json:"names"`
+	Failed  []CleanupDropFailure `json:"failed"`
+	Skipped []DoltDropSkip       `json:"skipped"`
+}
+
+// CleanupDropFailure records a single drop step that did not complete.
+type CleanupDropFailure struct {
+	Name  string `json:"name"`
+	Error string `json:"error"`
+}
+
+// CleanupPurgeReport summarizes the purge step.
+type CleanupPurgeReport struct {
+	OK bool `json:"ok"`
+	// BytesReclaimed is an estimate in dry-run mode and confirmed reclaimed
+	// bytes in --force mode. Failed forced purge calls do not contribute.
+	BytesReclaimed int64 `json:"bytes_reclaimed"`
+}
+
+// CleanupReapedReport summarizes the orphan-process reap step.
+type CleanupReapedReport struct {
+	Count         int   `json:"count"`
+	ProtectedPIDs []int `json:"protected_pids"`
+	// VanishedPIDs records reap targets missing before any signal was sent.
+	// Post-SIGTERM disappearance is counted as a successful reap because this
+	// process sent the termination signal and the process exited before SIGKILL.
+	VanishedPIDs []int `json:"vanished_pids"`
+	// Targets records the PIDs the reaper identified as test orphans (the
+	// reap candidates). Populated in both dry-run and --force; --force
+	// additionally drives Count to reflect actually-killed processes.
+	Targets []CleanupReapTarget `json:"targets"`
+	Errors  []string            `json:"errors"`
+}
+
+// CleanupReapTarget is a single orphan dolt sql-server process the reaper
+// identified for termination.
+type CleanupReapTarget struct {
+	PID        int    `json:"pid"`
+	ConfigPath string `json:"config_path"`
+}
+
+// CleanupSummary aggregates totals across the three steps.
+type CleanupSummary struct {
+	BytesFreedDisk int64 `json:"bytes_freed_disk"`
+	BytesFreedRSS  int64 `json:"bytes_freed_rss"`
+	ErrorsTotal    int   `json:"errors_total"`
+}
+
+// CleanupError is a single error entry tagged with the stage that produced
+// it. Stage values are e.g. "drop", "purge", "reap", "port".
+type CleanupError struct {
+	Stage string `json:"stage"`
+	Kind  string `json:"kind,omitempty"`
+	Name  string `json:"name,omitempty"`
+	Error string `json:"error"`
+}
+
+const (
+	cleanupErrorKindInvalidMaxOrphanDBs = "invalid-max-orphan-dbs"
+	cleanupErrorKindMaxOrphanRefusal    = "max-orphan-refusal"
+	cleanupErrorKindRigProtection       = "rig-protection"
+)
+
+// MarshalJSON ensures slices serialize as `[]` rather than `null` for empty
+// values. The JSON contract documents these as always-present arrays.
+func (r CleanupReport) MarshalJSON() ([]byte, error) {
+	type alias CleanupReport
+	if r.RigsProtected == nil {
+		r.RigsProtected = []CleanupRigProtection{}
+	}
+	if r.ForceBlockers == nil {
+		r.ForceBlockers = []CleanupForceBlocker{}
+	}
+	if r.Dropped.Failed == nil {
+		r.Dropped.Failed = []CleanupDropFailure{}
+	}
+	if r.Dropped.Skipped == nil {
+		r.Dropped.Skipped = []DoltDropSkip{}
+	}
+	if r.Reaped.ProtectedPIDs == nil {
+		r.Reaped.ProtectedPIDs = []int{}
+	}
+	if r.Reaped.VanishedPIDs == nil {
+		r.Reaped.VanishedPIDs = []int{}
+	}
+	if r.Reaped.Targets == nil {
+		r.Reaped.Targets = []CleanupReapTarget{}
+	}
+	if r.Reaped.Errors == nil {
+		r.Reaped.Errors = []string{}
+	}
+	if r.Dropped.Names == nil {
+		r.Dropped.Names = []string{}
+	}
+	if r.Errors == nil {
+		r.Errors = []CleanupError{}
+	}
+	return json.Marshal(alias(r))
+}
+
+// cleanupOptions bundles the inputs to runDoltCleanup so the command body
+// stays Cobra-free and testable. The Cobra command builds an options value
+// from flags and city state and hands it off.
+//
+// DiscoverProcesses and KillProcess are injection points for tests; in
+// production they default to the /proc walker and syscall.Kill respectively.
+// HomeDir defaults to the live $HOME and seeds ~/.gotmp/Test* recognition.
+// TempDir defaults to the live os.TempDir() and lets the reaper recognize
+// Go test temp roots and known Gas City test prefixes on hosts where TMPDIR
+// is not /tmp.
+type cleanupOptions struct {
+	Flag           string
+	CityPort       int
+	PortResolution PortResolution
+	Rigs           []resolverRig
+	FS             fsys.FS
+	JSON           bool
+	Probe          bool
+	Force          bool
+	Host           string
+	HomeDir        string
+	TempDir        string
+	MaxOrphanDBs   int
+
+	// StalePrefixes overrides defaultStaleDatabasePrefixes when non-empty.
+	// Set by tests; production passes nil and falls back to the built-in.
+	StalePrefixes []string
+
+	// DoltClient is the SQL surface used by the drop and purge stages. When
+	// nil, those stages no-op (the report still renders, just without DB
+	// operations) — useful for tests that exercise the port resolver and
+	// reaper in isolation.
+	DoltClient CleanupDoltClient
+	// DoltClientOpenErr records a failed attempt to open the production SQL
+	// client. Tests that intentionally omit DoltClient leave this nil.
+	DoltClientOpenErr error
+
+	DiscoverProcesses func() ([]DoltProcInfo, error)
+	ActiveTestRoots   []string
+	KillProcess       func(pid int, sig syscall.Signal) error
+	ReapGracePeriod   time.Duration
+}
+
+// runDoltCleanup is the testable core of the `gc dolt-cleanup` command. It
+// applies the AD-04 §4.1 port-resolution chain, optionally probes the
+// resolved port, runs the orphan-process reaper, and writes either a
+// CleanupReport JSON envelope or a human-readable summary to stdout.
+// Returns the exit code.
+//
+// Drop and purge stages are populated when a Dolt SQL client is available;
+// otherwise the report still renders with errors describing the unreachable
+// data plane.
+func runDoltCleanup(opts cleanupOptions, stdout, stderr io.Writer) int {
+	if opts.MaxOrphanDBs < 0 {
+		report := CleanupReport{Schema: CleanupSchemaVersion}
+		recordCleanupErrorKind(
+			&report,
+			"config",
+			cleanupErrorKindInvalidMaxOrphanDBs,
+			"--max-orphan-dbs",
+			fmt.Errorf("--max-orphan-dbs must be non-negative, got %d", opts.MaxOrphanDBs),
+		)
+		emitReport(report, PortResolution{}, opts, stdout, stderr)
+		return 1
+	}
+
+	resolution := cleanupPortResolution(opts)
+	opts.PortResolution = resolution
+	protections, protectionErrors := rigProtections(opts.Rigs, opts.FS)
+
+	report := CleanupReport{
+		Schema: CleanupSchemaVersion,
+		Port: CleanupPortReport{
+			Resolved: resolution.Port,
+			Source:   resolution.Source,
+			Fallback: resolution.Fallback,
+		},
+		RigsProtected: protections,
+	}
+	for _, e := range protectionErrors {
+		recordCleanupForceBlocker(&report, cleanupErrorKindRigProtection, e.rig, e.err)
+	}
+	if opts.Force {
+		for _, e := range protectionErrors {
+			recordCleanupErrorKind(&report, "rig", cleanupErrorKindRigProtection, e.rig, e.err)
+		}
+	}
+	recordUnsafeRigDatabaseNames(&report)
+
+	if fatalAttempt, err := fatalPortResolutionAttempt(resolution); err != nil {
+		fatalResolution := resolution
+		fatalResolution.Port = 0
+		fatalResolution.Source = fatalAttempt.Source
+		fatalResolution.Fallback = false
+		report.Port = CleanupPortReport{
+			Resolved: 0,
+			Source:   fatalAttempt.Source,
+			Fallback: false,
+		}
+		recordCleanupError(&report, "port", fatalAttempt.Source, err)
+		emitReport(report, fatalResolution, opts, stdout, stderr)
+		return 1
+	}
+
+	if opts.Probe {
+		host := opts.Host
+		if host == "" {
+			host = "127.0.0.1"
+		}
+		if err := probeDoltPort(host, resolution.Port); err != nil {
+			report.Errors = append(report.Errors, CleanupError{
+				Stage: "port",
+				Error: err.Error(),
+			})
+			report.Summary.ErrorsTotal++
+			emitReport(report, resolution, opts, stdout, stderr)
+			return 1
+		}
+	}
+
+	if runDropStage(&report, opts) {
+		runPurgeStage(&report, opts)
+		runReapStage(&report, opts)
+	}
+	report.Summary.BytesFreedDisk = report.Purge.BytesReclaimed
+
+	emitReport(report, resolution, opts, stdout, stderr)
+	if opts.DoltClientOpenErr != nil {
+		return 1
+	}
+	return 0
+}
+
+func cleanupPortResolution(opts cleanupOptions) PortResolution {
+	if opts.PortResolution.Port != 0 || opts.PortResolution.Source != "" || len(opts.PortResolution.Tried) != 0 {
+		return opts.PortResolution
+	}
+	return ResolveDoltPort(PortResolverInput{
+		Flag:     opts.Flag,
+		CityPort: opts.CityPort,
+		Rigs:     opts.Rigs,
+		FS:       opts.FS,
+	})
+}
+
+func recordCleanupError(report *CleanupReport, stage, name string, err error) {
+	recordCleanupErrorKind(report, stage, "", name, err)
+}
+
+func recordCleanupErrorKind(report *CleanupReport, stage, kind, name string, err error) {
+	entry := CleanupError{Stage: stage, Kind: kind, Error: err.Error()}
+	if name != "" {
+		entry.Name = name
+	}
+	report.Errors = append(report.Errors, entry)
+	report.Summary.ErrorsTotal++
+}
+
+func recordCleanupForceBlocker(report *CleanupReport, kind, name string, err error) {
+	entry := CleanupForceBlocker{Kind: kind, Error: err.Error()}
+	if name != "" {
+		entry.Name = name
+	}
+	report.ForceBlockers = append(report.ForceBlockers, entry)
+}
+
+// runReapStage discovers live `dolt sql-server` processes, classifies them
+// against the rig-port and test-config-path allowlists, and (when --force is
+// set) sends SIGTERM followed by SIGKILL after a grace period. Errors are
+// recorded into the CleanupReport but do not abort the run — partial reap
+// progress is more useful than failing the whole stage.
+func runReapStage(report *CleanupReport, opts cleanupOptions) {
+	discover := opts.DiscoverProcesses
+	if discover == nil {
+		discover = discoverDoltProcesses
+	}
+	procs, err := discover()
+	if err != nil {
+		report.Errors = append(report.Errors, CleanupError{Stage: "reap", Error: err.Error()})
+		report.Summary.ErrorsTotal++
+		report.Reaped.Errors = append(report.Reaped.Errors, err.Error())
+		return
+	}
+
+	rigPorts := protectedDoltPortsForReap(opts)
+	tempDir := opts.TempDir
+	if tempDir == "" {
+		tempDir = os.TempDir()
+	}
+	activeTestRoots := opts.ActiveTestRoots
+	if activeTestRoots == nil {
+		activeTestRoots = discoverActiveTestRoots(opts.HomeDir, tempDir)
+	}
+	plan := planOrphanReap(procs, rigPorts, opts.HomeDir, tempDir, activeTestRoots)
+
+	report.Reaped.ProtectedPIDs = nil
+	for _, p := range plan.Protected {
+		report.Reaped.ProtectedPIDs = append(report.Reaped.ProtectedPIDs, p.PID)
+	}
+	report.Reaped.Targets = nil
+	for _, t := range plan.Reap {
+		report.Reaped.Targets = append(report.Reaped.Targets, CleanupReapTarget{PID: t.PID, ConfigPath: t.ConfigPath})
+	}
+
+	if !opts.Force {
+		report.Reaped.Count = len(plan.Reap)
+		report.Summary.BytesFreedRSS = sumReapTargetRSS(plan.Reap, nil)
+		return
+	}
+
+	killFn := opts.KillProcess
+	if killFn == nil {
+		killFn = killProcess
+	}
+	grace := opts.ReapGracePeriod
+	if grace <= 0 {
+		grace = 250 * time.Millisecond
+	}
+
+	reaped := 0
+	gone := make(map[int]bool, len(plan.Reap))
+	sigtermSent := make(map[int]bool, len(plan.Reap))
+	for _, target := range plan.Reap {
+		switch revalidateReapTarget(report, discover, target, rigPorts, opts.HomeDir, tempDir, activeTestRoots, "SIGTERM") {
+		case reapRevalidationEligible:
+		case reapRevalidationVanished:
+			appendVanishedPID(report, target.PID)
+			continue
+		default:
+			continue
+		}
+		if err := killFn(target.PID, syscall.SIGTERM); err != nil {
+			if errors.Is(err, syscall.ESRCH) {
+				gone[target.PID] = true
+			} else {
+				recordReapSignalError(report, target.PID, syscall.SIGTERM, err)
+			}
+			continue
+		}
+		sigtermSent[target.PID] = true
+	}
+	if grace > 0 {
+		time.Sleep(grace)
+	}
+
+	for _, target := range plan.Reap {
+		if gone[target.PID] || !sigtermSent[target.PID] {
+			continue
+		}
+		switch revalidateReapTarget(report, discover, target, rigPorts, opts.HomeDir, tempDir, activeTestRoots, "SIGKILL") {
+		case reapRevalidationEligible:
+		case reapRevalidationVanished:
+			gone[target.PID] = true
+			continue
+		default:
+			continue
+		}
+		if err := killFn(target.PID, syscall.SIGKILL); err != nil {
+			if errors.Is(err, syscall.ESRCH) {
+				gone[target.PID] = true
+			} else {
+				recordReapSignalError(report, target.PID, syscall.SIGKILL, err)
+			}
+			continue
+		}
+		gone[target.PID] = true
+	}
+	for _, target := range plan.Reap {
+		if gone[target.PID] {
+			reaped++
+		}
+	}
+	report.Reaped.Count = reaped
+	report.Summary.BytesFreedRSS = sumReapTargetRSS(plan.Reap, gone)
+}
+
+func protectedDoltPortsForReap(opts cleanupOptions) map[int]string {
+	ports := loadRigDoltPorts(opts.Rigs, opts.FS)
+	if opts.PortResolution.Port <= 0 {
+		return ports
+	}
+	if opts.PortResolution.Fallback {
+		return ports
+	}
+	source := opts.PortResolution.Source
+	if source == "" {
+		source = "selected"
+	}
+	if _, ok := ports[opts.PortResolution.Port]; !ok {
+		ports[opts.PortResolution.Port] = source
+	}
+	return ports
+}
+
+type reapRevalidationStatus int
+
+const (
+	reapRevalidationEligible reapRevalidationStatus = iota
+	reapRevalidationProtected
+	reapRevalidationVanished
+	reapRevalidationError
+)
+
+func revalidateReapTarget(report *CleanupReport, discover func() ([]DoltProcInfo, error), target ReapTarget, rigPorts map[int]string, homeDir, tempDir string, activeTestRoots []string, signalName string) reapRevalidationStatus {
+	refreshed, err := discover()
+	if err != nil {
+		recordReapRevalidationError(report, signalName, err)
+		return reapRevalidationError
+	}
+	for _, proc := range refreshed {
+		if proc.PID != target.PID {
+			continue
+		}
+		recheck := classifyDoltProcess(proc, rigPorts, homeDir, tempDir, activeTestRoots)
+		if recheck.Action != "reap" || recheck.ConfigPath != target.ConfigPath || !sameReapProcessIdentity(target, proc) {
+			appendProtectedPID(report, target.PID)
+			return reapRevalidationProtected
+		}
+		return reapRevalidationEligible
+	}
+	return reapRevalidationVanished
+}
+
+func sameReapProcessIdentity(target ReapTarget, proc DoltProcInfo) bool {
+	return target.StartTimeTicks != 0 && proc.StartTimeTicks == target.StartTimeTicks
+}
+
+func recordReapRevalidationError(report *CleanupReport, signalName string, err error) {
+	msg := fmt.Sprintf("revalidate before %s: %v", signalName, err)
+	report.Reaped.Errors = append(report.Reaped.Errors, msg)
+	report.Errors = append(report.Errors, CleanupError{
+		Stage: "reap",
+		Error: msg,
+	})
+	report.Summary.ErrorsTotal++
+}
+
+func sumReapTargetRSS(targets []ReapTarget, include map[int]bool) int64 {
+	var total int64
+	for _, target := range targets {
+		if include != nil && !include[target.PID] {
+			continue
+		}
+		if target.RSSBytes > 0 {
+			total += target.RSSBytes
+		}
+	}
+	return total
+}
+
+func fatalPortResolutionError(resolution PortResolution) error {
+	_, err := fatalPortResolutionAttempt(resolution)
+	return err
+}
+
+func fatalPortResolutionAttempt(resolution PortResolution) (PortResolutionAttempt, error) {
+	for _, attempt := range resolution.Tried {
+		if attempt.Status != "error" {
+			continue
+		}
+		if attempt.Source != flagDoltPortSource && attempt.Source != cityConfigDoltPortSource && !isRigPortFileSource(attempt.Source) {
+			continue
+		}
+		if attempt.Detail != "" {
+			return attempt, errors.New(attempt.Detail)
+		}
+		return attempt, fmt.Errorf("%s resolution failed", attempt.Source)
+	}
+	return PortResolutionAttempt{}, nil
+}
+
+func isRigPortFileSource(source string) bool {
+	return filepath.Base(source) == "dolt-server.port" && filepath.Base(filepath.Dir(source)) == ".beads"
+}
+
+func appendProtectedPID(report *CleanupReport, pid int) {
+	for _, existing := range report.Reaped.ProtectedPIDs {
+		if existing == pid {
+			return
+		}
+	}
+	report.Reaped.ProtectedPIDs = append(report.Reaped.ProtectedPIDs, pid)
+}
+
+func appendVanishedPID(report *CleanupReport, pid int) {
+	for _, existing := range report.Reaped.VanishedPIDs {
+		if existing == pid {
+			return
+		}
+	}
+	report.Reaped.VanishedPIDs = append(report.Reaped.VanishedPIDs, pid)
+}
+
+func recordReapSignalError(report *CleanupReport, pid int, sig syscall.Signal, err error) {
+	sigName := reapSignalName(sig)
+	report.Reaped.Errors = append(report.Reaped.Errors, fmt.Sprintf("pid %d %s: %v", pid, sigName, err))
+	report.Errors = append(report.Errors, CleanupError{
+		Stage: "reap",
+		Name:  fmt.Sprintf("pid %d", pid),
+		Error: fmt.Sprintf("%s: %v", sigName, err),
+	})
+	report.Summary.ErrorsTotal++
+}
+
+func reapSignalName(sig syscall.Signal) string {
+	switch sig {
+	case syscall.SIGTERM:
+		return "SIGTERM"
+	case syscall.SIGKILL:
+		return "SIGKILL"
+	default:
+		return sig.String()
+	}
+}
+
+func emitReport(report CleanupReport, resolution PortResolution, opts cleanupOptions, stdout, stderr io.Writer) {
+	if opts.JSON {
+		data, err := json.Marshal(report)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc dolt-cleanup: marshal report: %v\n", err) //nolint:errcheck
+			return
+		}
+		fmt.Fprintln(stdout, string(data)) //nolint:errcheck
+		return
+	}
+
+	emitHumanReport(report, resolution, opts, stdout)
+}
+
+// emitHumanReport writes the operator-facing wireframe to stdout. Output is
+// plain text with small unicode glyphs (⚠ ✓ ✖) — no ANSI escapes — so it
+// behaves correctly under NO_COLOR or when piped to a file.
+func emitHumanReport(report CleanupReport, resolution PortResolution, opts cleanupOptions, stdout io.Writer) {
+	host := opts.Host
+	if host == "" {
+		host = "127.0.0.1"
+	}
+	switch {
+	case resolution.Port <= 0:
+		fmt.Fprintln(stdout, "✖ Dolt server port: unresolved") //nolint:errcheck
+		fmt.Fprintln(stdout, "  Tried sources, in order:")     //nolint:errcheck
+		for _, attempt := range resolution.Tried {
+			fmt.Fprintf(stdout, "    %-46s  %s\n", attempt.Source, attemptStatusLabel(attempt)) //nolint:errcheck
+		}
+	case resolution.Fallback:
+		fmt.Fprintf(stdout, "⚠ Dolt server port: %d (legacy default — fallback)\n", resolution.Port) //nolint:errcheck
+		fmt.Fprintln(stdout, "  Tried sources, in order:")                                           //nolint:errcheck
+		for _, attempt := range resolution.Tried {
+			fmt.Fprintf(stdout, "    %-46s  %s\n", attempt.Source, attemptStatusLabel(attempt)) //nolint:errcheck
+		}
+	default:
+		fmt.Fprintf(stdout, "Dolt server: %s:%d (resolved from %s)\n", host, resolution.Port, resolution.Source) //nolint:errcheck
+	}
+
+	emitDroppedSection(report, stdout)
+	emitOrphansSection(report, stdout)
+	emitProtectedSection(report, stdout)
+	emitForceBlockersSection(report, stdout)
+	emitErrorsOrSummary(report, opts, stdout)
+	if !opts.Force {
+		fmt.Fprintln(stdout, "")                              //nolint:errcheck
+		fmt.Fprintln(stdout, "Re-run with --force to apply.") //nolint:errcheck
+	}
+}
+
+func emitDroppedSection(report CleanupReport, stdout io.Writer) {
+	fmt.Fprintln(stdout, "")                                                         //nolint:errcheck
+	fmt.Fprintf(stdout, "DROPPED-DATABASE DIRECTORIES (%d)\n", report.Dropped.Count) //nolint:errcheck
+	if len(report.Dropped.Names) == 0 {
+		fmt.Fprintln(stdout, "  (none)") //nolint:errcheck
+		return
+	}
+	for _, name := range report.Dropped.Names {
+		fmt.Fprintf(stdout, "  %s\n", name) //nolint:errcheck
+	}
+	for _, f := range report.Dropped.Failed {
+		fmt.Fprintf(stdout, "  ✖ %s — %s\n", f.Name, f.Error) //nolint:errcheck
+	}
+	for _, s := range report.Dropped.Skipped {
+		fmt.Fprintf(stdout, "  skipped %s — %s\n", s.Name, s.Reason) //nolint:errcheck
+	}
+}
+
+func emitOrphansSection(report CleanupReport, stdout io.Writer) {
+	fmt.Fprintln(stdout, "")                                                                   //nolint:errcheck
+	fmt.Fprintf(stdout, "ORPHAN dolt sql-server PROCESSES (%d)\n", len(report.Reaped.Targets)) //nolint:errcheck
+	if len(report.Reaped.Targets) == 0 {
+		fmt.Fprintln(stdout, "  (none)") //nolint:errcheck
+		return
+	}
+	for _, t := range report.Reaped.Targets {
+		path := t.ConfigPath
+		if path == "" {
+			path = "(no --config flag)"
+		}
+		fmt.Fprintf(stdout, "  PID %d  %s\n", t.PID, path) //nolint:errcheck
+	}
+}
+
+func emitProtectedSection(report CleanupReport, stdout io.Writer) {
+	fmt.Fprintln(stdout, "")          //nolint:errcheck
+	fmt.Fprintln(stdout, "PROTECTED") //nolint:errcheck
+	if len(report.RigsProtected) == 0 && len(report.Reaped.ProtectedPIDs) == 0 {
+		fmt.Fprintln(stdout, "  (none)") //nolint:errcheck
+		return
+	}
+	for _, rp := range report.RigsProtected {
+		fmt.Fprintf(stdout, "  rig %q → DB %q\n", rp.Rig, rp.DB) //nolint:errcheck
+	}
+	for _, pid := range report.Reaped.ProtectedPIDs {
+		fmt.Fprintf(stdout, "  PID %d (active server or non-test path)\n", pid) //nolint:errcheck
+	}
+}
+
+func emitForceBlockersSection(report CleanupReport, stdout io.Writer) {
+	if len(report.ForceBlockers) == 0 {
+		return
+	}
+	fmt.Fprintln(stdout, "")                                                //nolint:errcheck
+	fmt.Fprintf(stdout, "FORCE BLOCKERS (%d)\n", len(report.ForceBlockers)) //nolint:errcheck
+	for _, blocker := range report.ForceBlockers {
+		if blocker.Name != "" {
+			fmt.Fprintf(stdout, "  [%s] %s - %s\n", blocker.Kind, blocker.Name, blocker.Error) //nolint:errcheck
+		} else {
+			fmt.Fprintf(stdout, "  [%s] %s\n", blocker.Kind, blocker.Error) //nolint:errcheck
+		}
+	}
+}
+
+func emitErrorsOrSummary(report CleanupReport, opts cleanupOptions, stdout io.Writer) {
+	fmt.Fprintln(stdout, "") //nolint:errcheck
+	if len(report.Errors) > 0 {
+		fmt.Fprintf(stdout, "ERRORS (%d)\n", len(report.Errors)) //nolint:errcheck
+		for _, e := range report.Errors {
+			if e.Name != "" {
+				fmt.Fprintf(stdout, "  [%s] %s — %s\n", e.Stage, e.Name, e.Error) //nolint:errcheck
+			} else {
+				fmt.Fprintf(stdout, "  [%s] %s\n", e.Stage, e.Error) //nolint:errcheck
+			}
+		}
+		fmt.Fprintln(stdout, "") //nolint:errcheck
+	}
+
+	fmt.Fprintln(stdout, "SUMMARY") //nolint:errcheck
+	verb := "would free"
+	if opts.Force {
+		verb = "freed"
+	}
+	fmt.Fprintf(stdout, "  Disk %s:    %s\n", verb, formatBytes(report.Purge.BytesReclaimed))                   //nolint:errcheck
+	fmt.Fprintf(stdout, "  Drops:         %d (failed: %d)\n", report.Dropped.Count, len(report.Dropped.Failed)) //nolint:errcheck
+	purgeStatus := "skipped"
+	if opts.Force {
+		if report.Purge.OK {
+			purgeStatus = "ok"
+		} else {
+			purgeStatus = "failed"
+		}
+	}
+	fmt.Fprintf(stdout, "  Purge:         %s\n", purgeStatus)                                                           //nolint:errcheck
+	fmt.Fprintf(stdout, "  Reaped:        %d (protected: %d)\n", report.Reaped.Count, len(report.Reaped.ProtectedPIDs)) //nolint:errcheck
+	fmt.Fprintf(stdout, "  Errors:        %d\n", report.Summary.ErrorsTotal)                                            //nolint:errcheck
+}
+
+// formatBytes formats a byte count as "N B", "N.N KiB", "N.N MiB", or
+// "N.N GiB" — the binary-prefix scale operators expect for disk
+// reclamation reports.
+func formatBytes(n int64) string {
+	const (
+		KiB int64 = 1 << 10
+		MiB int64 = 1 << 20
+		GiB int64 = 1 << 30
+	)
+	switch {
+	case n >= GiB:
+		return fmt.Sprintf("%.1f GiB", float64(n)/float64(GiB))
+	case n >= MiB:
+		return fmt.Sprintf("%.1f MiB", float64(n)/float64(MiB))
+	case n >= KiB:
+		return fmt.Sprintf("%.1f KiB", float64(n)/float64(KiB))
+	default:
+		return fmt.Sprintf("%d B", n)
+	}
+}
+
+func attemptStatusLabel(a PortResolutionAttempt) string {
+	switch a.Status {
+	case "found":
+		return "← " + a.Detail
+	case "error":
+		if a.Detail != "" {
+			return "error: " + a.Detail
+		}
+		return "error"
+	case "not-provided":
+		return "not provided"
+	case "not-set":
+		return "not set"
+	case "not-found":
+		return "not found"
+	default:
+		return a.Status
+	}
+}
+
+func probeDoltPort(host string, port int) error {
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
+	conn, err := net.DialTimeout("tcp", addr, 250*time.Millisecond)
+	if err != nil {
+		return fmt.Errorf("dolt server at %s unreachable: %w", addr, err)
+	}
+	_ = conn.Close()
+	return nil
+}
+
+// newDoltCleanupCmd builds the `gc dolt-cleanup` Cobra command.
+//
+// Top-level (not under a `dolt` parent) because the existing `dolt` pack
+// binding owns that namespace. The pack's `gc dolt cleanup` script can
+// delegate to this Go-side command once feature parity lands.
+func newDoltCleanupCmd(stdout, stderr io.Writer) *cobra.Command {
+	var (
+		portFlag     string
+		jsonOut      bool
+		probe        bool
+		force        bool
+		maxOrphanDBs int
+	)
+
+	cmd := &cobra.Command{
+		Use:   "dolt-cleanup",
+		Short: "Find and remove orphaned Dolt databases (Go-side core)",
+		Long: `gc dolt-cleanup is the Go-side implementation of the operational Dolt
+cleanup tool. It resolves the Dolt server port via the AD-04 chain
+(--port > city dolt.port > <rigRoot>/.beads/dolt-server.port > 3307),
+drops stale test/agent databases, calls DOLT_PURGE_DROPPED_DATABASES
+to reclaim disk, and reaps orphaned dolt sql-server processes left
+over from leaked test harnesses. Invalid explicit ports and unreadable
+or invalid city/rig port settings fail closed before cleanup stages run;
+only absent rig port files can reach the legacy default. The legacy
+default is a connection fallback only; it does not protect port 3307
+from orphan-process reaping.
+
+Dry-run by default. Pass --force to actually drop, purge, and kill.
+Pass --max-orphan-dbs with --force to refuse all destructive cleanup
+stages if the live apply-time stale database count exceeds the
+scan-time threshold. The default 0 disables this guard; negative values
+are rejected before any city lookup or cleanup stage runs.
+Active rig dolt servers, registered rig databases, active test temp roots,
+and processes outside the test-config-path allowlist (/tmp/Test*,
+os.TempDir()/Test*, known Gas City test prefixes, ~/.gotmp/Test*) are always
+protected — see the PROTECTED section of the
+report. Destructive drops are limited to known stale test database name
+shapes and conservative SQL identifier characters; skipped stale matches
+are reported in dropped.skipped. Rig dolt_database names used for purge
+must use the same identifier shape: ASCII letters, digits, underscores,
+and non-leading hyphens. Missing or silent rig metadata disables forced
+drop/purge because the live database name cannot be proven safe.
+
+JSON envelope schema is stable: gc.dolt.cleanup.v1. Automation that
+uses --json must inspect summary.errors_total and errors, and must also
+refuse to invoke --force when dry-run force_blockers is non-empty.
+force_blockers reports conditions that would block forced cleanup without
+incrementing errors_total. The rig-protection blocker is intentionally
+global: missing or silent rig metadata prevents forced drop/purge because
+the command cannot prove all registered rig databases are protected.
+Cleanup stage errors are reported in the envelope even when the command
+can still return successfully after emitting the report.`,
+		Args: cobra.NoArgs,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			if maxOrphanDBs < 0 {
+				err := fmt.Errorf("--max-orphan-dbs must be >= 0")
+				if jsonOut {
+					report := CleanupReport{Schema: CleanupSchemaVersion}
+					recordCleanupErrorKind(&report, "options", cleanupErrorKindInvalidMaxOrphanDBs, "", err)
+					emitReport(report, PortResolution{}, cleanupOptions{JSON: true}, stdout, stderr)
+				} else {
+					fmt.Fprintf(stderr, "gc dolt-cleanup: %v\n", err) //nolint:errcheck
+				}
+				return errExit
+			}
+			cityPath, err := resolveCity()
+			if err != nil {
+				fmt.Fprintf(stderr, "gc dolt-cleanup: %v\n", err) //nolint:errcheck
+				return errExit
+			}
+			cfg, err := loadCityConfig(cityPath, stderr)
+			if err != nil {
+				fmt.Fprintf(stderr, "gc dolt-cleanup: %v\n", err) //nolint:errcheck
+				return errExit
+			}
+			rigs := loadResolverRigs(cityPath, cfg)
+			homeDir, _ := os.UserHomeDir()
+			opts := cleanupOptions{
+				Flag:         portFlag,
+				CityPort:     cfg.Dolt.Port,
+				Rigs:         rigs,
+				FS:           fsys.OSFS{},
+				JSON:         jsonOut,
+				Probe:        probe,
+				Force:        force,
+				Host:         cfg.Dolt.Host,
+				HomeDir:      homeDir,
+				TempDir:      os.TempDir(),
+				MaxOrphanDBs: maxOrphanDBs,
+			}
+
+			// Resolve the port first so we can open a Dolt connection at the
+			// right address. Failed opens are reported by runDoltCleanup inside
+			// the typed cleanup envelope.
+			resolution := ResolveDoltPort(PortResolverInput{
+				Flag: opts.Flag, CityPort: opts.CityPort, Rigs: opts.Rigs, FS: opts.FS,
+			})
+			opts.PortResolution = resolution
+			host := opts.Host
+			if host == "" {
+				host = "127.0.0.1"
+			}
+			if fatalPortResolutionError(resolution) == nil {
+				client, openErr := newSQLCleanupDoltClient(host, strconv.Itoa(resolution.Port))
+				if openErr != nil {
+					opts.DoltClientOpenErr = openErr
+				} else {
+					opts.DoltClient = client
+					defer client.Close() //nolint:errcheck
+				}
+			}
+
+			if code := runDoltCleanup(opts, stdout, stderr); code != 0 {
+				return errExit
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&portFlag, "port", "", "override the resolved Dolt port")
+	cmd.Flags().BoolVar(&jsonOut, "json", false, "emit JSON envelope (gc.dolt.cleanup.v1)")
+	cmd.Flags().BoolVar(&probe, "probe", false, "TCP-probe the resolved port; fail if unreachable")
+	cmd.Flags().BoolVar(&force, "force", false, "actually drop, purge, and kill orphaned resources (default: dry-run)")
+	cmd.Flags().IntVar(&maxOrphanDBs, "max-orphan-dbs", 0, "with --force, refuse cleanup when live stale database count exceeds this limit")
+	return cmd
+}
+
+// rigProtections projects the resolver's rig list into the JSON-envelope
+// rigs_protected entries. The DB name is read from each rig's
+// <rigPath>/.beads/metadata.json `dolt_database` field. Missing, silent,
+// unreadable, or corrupt metadata is returned as an error so forced destructive
+// work can fail closed instead of pretending the fallback is the live DB
+// identity. Order is HQ-first to match the port-resolution preference.
+func rigProtections(rigs []resolverRig, fs fsys.FS) ([]CleanupRigProtection, []rigProtectionError) {
+	out := make([]CleanupRigProtection, 0, len(rigs))
+	var errs []rigProtectionError
+	for _, r := range orderRigsHQFirst(rigs) {
+		resolution := resolveRigDoltDatabase(r, fs)
+		out = append(out, CleanupRigProtection{Rig: r.Name, DB: resolution.name})
+		if resolution.err != nil {
+			errs = append(errs, rigProtectionError{rig: r.Name, err: resolution.err})
+		}
+	}
+	return out, errs
+}
+
+type rigProtectionError struct {
+	rig string
+	err error
+}
+
+func recordUnsafeRigDatabaseNames(report *CleanupReport) {
+	for _, rp := range report.RigsProtected {
+		if validDoltDatabaseIdentifier(rp.DB) {
+			continue
+		}
+		err := fmt.Errorf("rig %q dolt_database %q is not cleanup-safe", rp.Rig, rp.DB)
+		recordCleanupForceBlocker(report, cleanupErrorKindRigProtection, rp.Rig, err)
+		recordCleanupErrorKind(report, "rig", cleanupErrorKindRigProtection, rp.Rig, err)
+	}
+}
+
+func hasRigProtectionError(report *CleanupReport) bool {
+	for _, e := range report.Errors {
+		if e.Kind == cleanupErrorKindRigProtection || e.Stage == "rig" {
+			return true
+		}
+	}
+	return false
+}
+
+// rigDoltDatabaseName returns the rig's dolt database name as recorded in its
+// metadata.json, falling back to rig.Name only as a report label when metadata
+// is missing or silent.
+func rigDoltDatabaseName(r resolverRig, fs fsys.FS) string {
+	return resolveRigDoltDatabase(r, fs).name
+}
+
+type rigDoltDatabaseResolution struct {
+	name string
+	err  error
+}
+
+func resolveRigDoltDatabase(r resolverRig, fs fsys.FS) rigDoltDatabaseResolution {
+	if fs == nil {
+		return rigDoltDatabaseResolution{
+			name: r.Name,
+			err:  fmt.Errorf("missing filesystem for rig metadata; cannot verify live dolt database name"),
+		}
+	}
+	metadataPath := filepath.Join(r.Path, ".beads", "metadata.json")
+	data, err := fs.ReadFile(metadataPath)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return rigDoltDatabaseResolution{
+				name: r.Name,
+				err:  fmt.Errorf("missing rig metadata %s; cannot verify live dolt database name", metadataPath),
+			}
+		}
+		return rigDoltDatabaseResolution{
+			name: r.Name,
+			err:  fmt.Errorf("read rig metadata %s: %w", metadataPath, err),
+		}
+	}
+	var meta map[string]any
+	if err := json.Unmarshal(data, &meta); err != nil {
+		return rigDoltDatabaseResolution{
+			name: r.Name,
+			err:  fmt.Errorf("parse rig metadata %s: %w", metadataPath, err),
+		}
+	}
+	if db, ok := meta["dolt_database"]; ok {
+		s := strings.TrimSpace(fmt.Sprint(db))
+		if s != "" && s != "<nil>" {
+			return rigDoltDatabaseResolution{name: s}
+		}
+	}
+	return rigDoltDatabaseResolution{
+		name: r.Name,
+		err:  fmt.Errorf("rig metadata %s lacks dolt_database; cannot verify live dolt database name", metadataPath),
+	}
+}
+
+// loadResolverRigs builds the resolver's rig list from a city config. The HQ
+// rig (the city itself) is added first so it wins the AD-04 §4.1 tie when
+// multiple <rigRoot>/.beads/dolt-server.port files exist; non-HQ rigs follow
+// in city.toml order. Paths are resolved to absolute form via
+// resolveRigPaths so the resolver's filesystem reads work regardless of how
+// the rig was registered.
+func loadResolverRigs(cityPath string, cfg *config.City) []resolverRig {
+	rigs := make([]config.Rig, len(cfg.Rigs))
+	copy(rigs, cfg.Rigs)
+	resolveRigPaths(cityPath, rigs)
+
+	out := make([]resolverRig, 0, len(rigs)+1)
+	out = append(out, resolverRig{
+		Name: cfg.EffectiveCityName(),
+		Path: cityPath,
+		HQ:   true,
+	})
+	for _, r := range rigs {
+		out = append(out, resolverRig{
+			Name: r.Name,
+			Path: r.Path,
+			HQ:   false,
+		})
+	}
+	return out
+}
diff --git a/cmd/gc/cmd_dolt_cleanup_test.go b/cmd/gc/cmd_dolt_cleanup_test.go
new file mode 100644
index 0000000000..52c468989d
--- /dev/null
+++ b/cmd/gc/cmd_dolt_cleanup_test.go
@@ -0,0 +1,1462 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"syscall"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestCleanupReportJSONShape(t *testing.T) {
+	r := CleanupReport{
+		Schema: "gc.dolt.cleanup.v1",
+		Port: CleanupPortReport{
+			Resolved: 28231,
+			Source:   "/city/.beads/dolt-server.port",
+			Fallback: false,
+		},
+		Dropped: CleanupDroppedReport{
+			Skipped: []DoltDropSkip{{
+				Name:   "testdb.invalid",
+				Reason: DropSkipReasonInvalidIdentifier,
+			}},
+		},
+	}
+	data, err := json.Marshal(r)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	got := string(data)
+
+	wantKeys := []string{
+		`"schema":"gc.dolt.cleanup.v1"`,
+		`"port":{`,
+		`"rigs_protected":[]`,
+		`"force_blockers":[]`,
+		`"dropped":{`,
+		`"purge":{`,
+		`"reaped":{`,
+		`"summary":{`,
+		`"errors":[]`,
+		`"skipped":[{"name":"testdb.invalid","reason":"invalid-identifier"}]`,
+	}
+	for _, key := range wantKeys {
+		if !strings.Contains(got, key) {
+			t.Errorf("JSON missing %q\nfull JSON:\n%s", key, got)
+		}
+	}
+	for _, key := range []string{`"Name":"testdb.invalid"`, `"Reason":"invalid-identifier"`} {
+		if strings.Contains(got, key) {
+			t.Errorf("JSON leaked Go field name %q\nfull JSON:\n%s", key, got)
+		}
+	}
+}
+
+func TestDoltCleanupCmdRejectsNegativeMaxOrphanDBsBeforeCityResolution(t *testing.T) {
+	t.Chdir(t.TempDir())
+
+	var stdout, stderr bytes.Buffer
+	cmd := newDoltCleanupCmd(&stdout, &stderr)
+	cmd.SetArgs([]string{"--json", "--max-orphan-dbs", "-1"})
+
+	err := cmd.Execute()
+	if err == nil {
+		t.Fatalf("Execute succeeded; want negative --max-orphan-dbs rejected")
+	}
+	out := stdout.String()
+	if !strings.Contains(out, `"kind":"invalid-max-orphan-dbs"`) {
+		t.Fatalf("stdout missing structured max-orphan validation kind:\nstdout=%s\nstderr=%s", out, stderr.String())
+	}
+	if strings.Contains(stderr.String(), "not in a Gas City workspace") {
+		t.Fatalf("negative max-orphan validation happened after city resolution:\nstdout=%s\nstderr=%s", out, stderr.String())
+	}
+}
+
+func TestRunDoltCleanupRejectsNegativeMaxOrphanDBs(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		JSON:         true,
+		MaxOrphanDBs: -1,
+	}
+
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code == 0 {
+		t.Fatalf("runDoltCleanup exit=0; want negative MaxOrphanDBs rejected")
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s\nstderr: %s", err, stdout.String(), stderr.String())
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Kind != cleanupErrorKindInvalidMaxOrphanDBs || !strings.Contains(r.Errors[0].Error, "non-negative") {
+		t.Fatalf("Errors = %+v, want invalid max orphan validation error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_JSONOutputsResolvedPort(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Flag:     "",
+		CityPort: 0,
+		Rigs:     rigs,
+		FS:       fs,
+		JSON:     true,
+		Probe:    false, // skip TCP probe in unit tests
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("runDoltCleanup exit=%d, stderr=%q", code, stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal stdout: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Schema != "gc.dolt.cleanup.v1" {
+		t.Errorf("Schema = %q", r.Schema)
+	}
+	if r.Port.Resolved != 28231 {
+		t.Errorf("Port.Resolved = %d, want 28231", r.Port.Resolved)
+	}
+	if r.Port.Fallback {
+		t.Errorf("Port.Fallback = true, want false")
+	}
+}
+
+func TestRunDoltCleanup_HumanOutputShowsPortAndFallbackWarning(t *testing.T) {
+	fs := fsys.NewFake()
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:    fs,
+		JSON:  false,
+		Probe: false,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+
+	out := stdout.String()
+	if !strings.Contains(out, "3307") {
+		t.Errorf("stdout missing legacy port 3307: %s", out)
+	}
+	if !strings.Contains(strings.ToLower(out), "fallback") && !strings.Contains(strings.ToLower(out), "legacy default") {
+		t.Errorf("stdout missing fallback indicator: %s", out)
+	}
+}
+
+func TestRunDoltCleanup_FlagOverridesEverything(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Flag:     "9999",
+		CityPort: 4242,
+		Rigs:     []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:       fs,
+		JSON:     true,
+		Probe:    false,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d", code)
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if r.Port.Resolved != 9999 {
+		t.Errorf("Port.Resolved = %d, want 9999", r.Port.Resolved)
+	}
+	if r.Port.Source != "--port flag" {
+		t.Errorf("Port.Source = %q", r.Port.Source)
+	}
+}
+
+func TestRunDoltCleanup_ForceProtectsSelectedPortWithoutRigPortFile(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		flag     string
+		cityPort int
+		wantPort int
+	}{
+		{name: "flag", flag: "43306", cityPort: 43307, wantPort: 43306},
+		{name: "city config", cityPort: 43307, wantPort: 43307},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var killed []syscall.Signal
+
+			var stdout, stderr bytes.Buffer
+			opts := cleanupOptions{
+				Flag:     tc.flag,
+				CityPort: tc.cityPort,
+				Rigs:     []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+				FS:       fsys.NewFake(),
+				JSON:     true,
+				Force:    true,
+				HomeDir:  "/home/u",
+				DiscoverProcesses: func() ([]DoltProcInfo, error) {
+					return []DoltProcInfo{{
+						PID:            4444,
+						Ports:          []int{tc.wantPort},
+						Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestActive/config.yaml"},
+						StartTimeTicks: 10,
+					}}, nil
+				},
+				KillProcess: func(_ int, sig syscall.Signal) error {
+					killed = append(killed, sig)
+					return nil
+				},
+				ReapGracePeriod: 1,
+			}
+			code := runDoltCleanup(opts, &stdout, &stderr)
+			if code != 0 {
+				t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+			}
+			var r CleanupReport
+			if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+				t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+			}
+
+			if r.Port.Resolved != tc.wantPort {
+				t.Fatalf("Port.Resolved = %d, want %d", r.Port.Resolved, tc.wantPort)
+			}
+			if len(killed) != 0 {
+				t.Fatalf("KillProcess called for selected active port: %v", killed)
+			}
+			if r.Reaped.Count != 0 {
+				t.Errorf("Reaped.Count = %d, want 0 for process listening on selected port", r.Reaped.Count)
+			}
+			if !equalIntSlice(r.Reaped.ProtectedPIDs, []int{4444}) {
+				t.Errorf("ProtectedPIDs = %v, want [4444]", r.Reaped.ProtectedPIDs)
+			}
+		})
+	}
+}
+
+func TestRunDoltCleanup_InvalidPortFlagIsFatal(t *testing.T) {
+	for _, flag := range []string{"not-a-number", "0", "-1", "65536", "70000"} {
+		t.Run(flag, func(t *testing.T) {
+			client := &fakeCleanupDoltClient{
+				databases: []string{"testdb_abc"},
+			}
+			var killed []syscall.Signal
+
+			var stdout, stderr bytes.Buffer
+			opts := cleanupOptions{
+				Flag:       flag,
+				CityPort:   4242,
+				FS:         fsys.NewFake(),
+				JSON:       true,
+				Force:      true,
+				DoltClient: client,
+				DiscoverProcesses: func() ([]DoltProcInfo, error) {
+					return []DoltProcInfo{{PID: 4444, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"}}}, nil
+				},
+				KillProcess: func(_ int, sig syscall.Signal) error {
+					killed = append(killed, sig)
+					return nil
+				},
+				ReapGracePeriod: 1,
+			}
+			code := runDoltCleanup(opts, &stdout, &stderr)
+			if code == 0 {
+				t.Fatalf("exit=0, want invalid explicit --port to fail\nstdout=%s\nstderr=%s", stdout.String(), stderr.String())
+			}
+
+			var r CleanupReport
+			if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+				t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+			}
+			if len(client.dropped) != 0 {
+				t.Fatalf("DropDatabase called for invalid --port: %v", client.dropped)
+			}
+			if len(killed) != 0 {
+				t.Fatalf("KillProcess called for invalid --port: %v", killed)
+			}
+			foundPortError := false
+			for _, entry := range r.Errors {
+				if entry.Stage == "port" && strings.Contains(entry.Error, "invalid port") {
+					foundPortError = true
+				}
+			}
+			if !foundPortError {
+				t.Fatalf("Errors missing fatal port validation entry: %+v", r.Errors)
+			}
+		})
+	}
+}
+
+func TestRunDoltCleanup_InvalidCityConfigPortIsFatal(t *testing.T) {
+	client := &fakeCleanupDoltClient{
+		databases: []string{"testdb_abc"},
+	}
+	var killed []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		CityPort:   70000,
+		FS:         fsys.NewFake(),
+		JSON:       true,
+		Force:      true,
+		DoltClient: client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			return []DoltProcInfo{{PID: 4444, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"}}}, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			killed = append(killed, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code == 0 {
+		t.Fatalf("exit=0, want invalid city config port to fail\nstdout=%s\nstderr=%s", stdout.String(), stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("DropDatabase called for invalid city config port: %v", client.dropped)
+	}
+	if len(killed) != 0 {
+		t.Fatalf("KillProcess called for invalid city config port: %v", killed)
+	}
+	if r.Port.Resolved != 0 {
+		t.Fatalf("Port.Resolved = %d, want 0 for unresolved fatal city config port", r.Port.Resolved)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "port" || r.Errors[0].Name != "city config dolt.port" || !strings.Contains(r.Errors[0].Error, "65535") {
+		t.Fatalf("Errors = %+v, want fatal city config port validation error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_BadRigPortFileIsFatal(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		setup     func(*fsys.Fake)
+		wantError string
+	}{
+		{
+			name:      "empty",
+			setup:     func(fs *fsys.Fake) { fs.Files["/city/.beads/dolt-server.port"] = []byte("\n") },
+			wantError: "empty",
+		},
+		{
+			name:      "malformed",
+			setup:     func(fs *fsys.Fake) { fs.Files["/city/.beads/dolt-server.port"] = []byte("not-a-port\n") },
+			wantError: "invalid port",
+		},
+		{
+			name:      "out of range",
+			setup:     func(fs *fsys.Fake) { fs.Files["/city/.beads/dolt-server.port"] = []byte("70000\n") },
+			wantError: "65535",
+		},
+		{
+			name:      "unreadable",
+			setup:     func(fs *fsys.Fake) { fs.Errors["/city/.beads/dolt-server.port"] = os.ErrPermission },
+			wantError: "permission",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fs := fsys.NewFake()
+			tc.setup(fs)
+			client := &fakeCleanupDoltClient{
+				databases: []string{"testdb_abc"},
+			}
+			var killed []syscall.Signal
+
+			var stdout, stderr bytes.Buffer
+			opts := cleanupOptions{
+				Rigs:       []resolverRig{{Name: "city", Path: "/city", HQ: true}},
+				FS:         fs,
+				JSON:       true,
+				Force:      true,
+				DoltClient: client,
+				DiscoverProcesses: func() ([]DoltProcInfo, error) {
+					return []DoltProcInfo{{PID: 4444, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"}}}, nil
+				},
+				KillProcess: func(_ int, sig syscall.Signal) error {
+					killed = append(killed, sig)
+					return nil
+				},
+				ReapGracePeriod: 1,
+			}
+			code := runDoltCleanup(opts, &stdout, &stderr)
+			if code == 0 {
+				t.Fatalf("exit=0, want bad rig port file to fail closed\nstdout=%s\nstderr=%s", stdout.String(), stderr.String())
+			}
+
+			var r CleanupReport
+			if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+				t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+			}
+			if len(client.dropped) != 0 {
+				t.Fatalf("DropDatabase called after bad rig port file: %v", client.dropped)
+			}
+			if len(killed) != 0 {
+				t.Fatalf("KillProcess called after bad rig port file: %v", killed)
+			}
+			if r.Port.Resolved != 0 {
+				t.Fatalf("Port.Resolved = %d, want 0 for unresolved fatal port", r.Port.Resolved)
+			}
+			foundPortError := false
+			for _, entry := range r.Errors {
+				if entry.Stage == "port" && strings.Contains(entry.Error, tc.wantError) {
+					foundPortError = true
+				}
+			}
+			if !foundPortError {
+				t.Fatalf("Errors missing fatal rig port-file entry containing %q: %+v", tc.wantError, r.Errors)
+			}
+		})
+	}
+}
+
+func TestRunDoltCleanup_ForceDoesNotProtectLegacyFallbackPort(t *testing.T) {
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:      fsys.NewFake(),
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			return []DoltProcInfo{{
+				PID:            4444,
+				Ports:          []int{LegacyDefaultDoltPort},
+				Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestLegacyFallback/config.yaml"},
+				StartTimeTicks: 10,
+			}}, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return syscall.ESRCH
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Port.Resolved != LegacyDefaultDoltPort || !r.Port.Fallback {
+		t.Fatalf("Port = %+v, want legacy fallback", r.Port)
+	}
+	if !equalIntSlice(r.Reaped.ProtectedPIDs, nil) {
+		t.Fatalf("ProtectedPIDs = %v, want none for legacy fallback test process", r.Reaped.ProtectedPIDs)
+	}
+	if len(signals) != 1 || signals[0] != syscall.SIGTERM {
+		t.Fatalf("signals = %v, want legacy fallback process to stay eligible for SIGTERM", signals)
+	}
+}
+
+func TestRunDoltCleanup_SQLClientOpenFailureIsTypedAndFatal(t *testing.T) {
+	fs := fsys.NewFake()
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"dropped_db/data.bin": 4096,
+	})
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "city", Path: "/city", HQ: true}},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClientOpenErr: fmt.Errorf("open dolt connection: refused"),
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code == 0 {
+		t.Fatalf("exit=0, want SQL open failure to make forced cleanup fail\nstdout=%s\nstderr=%s", stdout.String(), stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Summary.ErrorsTotal != 2 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want drop and purge open errors; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	hasDrop := false
+	hasPurge := false
+	for _, entry := range r.Errors {
+		if strings.Contains(entry.Error, "open dolt connection: refused") {
+			switch entry.Stage {
+			case "drop":
+				hasDrop = true
+			case "purge":
+				hasPurge = true
+			}
+		}
+	}
+	if !hasDrop || !hasPurge {
+		t.Fatalf("Errors = %+v, want typed drop and purge SQL-open errors", r.Errors)
+	}
+	if r.Purge.OK {
+		t.Fatalf("Purge.OK = true, want false when SQL-backed purge could not run")
+	}
+	if r.Summary.BytesFreedDisk != 0 {
+		t.Fatalf("Summary.BytesFreedDisk = %d, want 0 because forced purge did not run", r.Summary.BytesFreedDisk)
+	}
+}
+
+func TestRunDoltCleanup_RigsProtectedFromRegistry(t *testing.T) {
+	// Wireframe-6 schema requires rigs_protected to enumerate registered rigs.
+	// One entry per registered rig (HQ + non-HQ); each rig's DB name equals
+	// its rig name in this codebase (`gascity`, `beads`, etc.). Order is
+	// HQ-first to match the resolver's port-resolution preference.
+	fs := fsys.NewFake()
+	rigs := []resolverRig{
+		{Name: "gascity", Path: "/city", HQ: true},
+		{Name: "beads", Path: "/beads", HQ: false},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:  rigs,
+		FS:    fs,
+		JSON:  true,
+		Probe: false,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	want := []CleanupRigProtection{
+		{Rig: "gascity", DB: "gascity"},
+		{Rig: "beads", DB: "beads"},
+	}
+	if len(r.RigsProtected) != len(want) {
+		t.Fatalf("RigsProtected len = %d, want %d (got %v)", len(r.RigsProtected), len(want), r.RigsProtected)
+	}
+	for i, w := range want {
+		if r.RigsProtected[i] != w {
+			t.Errorf("RigsProtected[%d] = %+v, want %+v", i, r.RigsProtected[i], w)
+		}
+	}
+}
+
+func TestRunDoltCleanup_DryRunReportsReapPlanWithoutKilling(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+
+	procs := []DoltProcInfo{
+		{PID: 1138290, Ports: []int{28231}, Argv: []string{"dolt", "sql-server"}},
+		{PID: 1281044, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestA/config.yaml"}},
+		{PID: 1319499, Ports: []int{33400}, Argv: []string{"dolt", "sql-server", "--config", "/tmp/be-s9d-bench-dolt/config.yaml"}},
+	}
+	killed := []int{}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:    []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:      fs,
+		JSON:    true,
+		Probe:   false,
+		HomeDir: "/home/u",
+		// Force not set → dry-run.
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+		KillProcess: func(pid int, _ syscall.Signal) error {
+			killed = append(killed, pid)
+			return nil
+		},
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Reaped.Count != 1 {
+		t.Errorf("Reaped.Count = %d, want 1 (one orphan, dry-run)", r.Reaped.Count)
+	}
+	wantProtected := []int{1138290, 1319499}
+	if !equalIntSlice(r.Reaped.ProtectedPIDs, wantProtected) {
+		t.Errorf("ProtectedPIDs = %v, want %v", r.Reaped.ProtectedPIDs, wantProtected)
+	}
+	if len(killed) != 0 {
+		t.Errorf("KillProcess called %d times in dry-run; want 0 (dry-run is non-destructive)", len(killed))
+	}
+}
+
+func TestRunDoltCleanup_DryRunAllowsProcessTempRootTestConfig(t *testing.T) {
+	procs := []DoltProcInfo{{
+		PID:  1281044,
+		Argv: []string{"dolt", "sql-server", "--config", "/var/tmp/go-test/TestA/config.yaml"},
+	}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		TempDir:           "/var/tmp/go-test",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Reaped.Count != 1 {
+		t.Errorf("Reaped.Count = %d, want 1 for os.TempDir()/Test* config", r.Reaped.Count)
+	}
+	if len(r.Reaped.ProtectedPIDs) != 0 {
+		t.Errorf("ProtectedPIDs = %v, want none for os.TempDir()/Test* config", r.Reaped.ProtectedPIDs)
+	}
+}
+
+func TestRunDoltCleanup_ForceKillsOrphans(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+
+	procs := []DoltProcInfo{
+		{PID: 1138290, Ports: []int{28231}, Argv: []string{"dolt", "sql-server"}, StartTimeTicks: 10},
+		{PID: 1281044, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestA/config.yaml"}, StartTimeTicks: 20},
+		{PID: 1281099, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestB/config.yaml"}, StartTimeTicks: 30},
+	}
+	var termed []int
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		HomeDir:           "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+		KillProcess: func(pid int, sig syscall.Signal) error {
+			if sig == syscall.SIGTERM {
+				termed = append(termed, pid)
+			}
+			return syscall.ESRCH // pretend the process is already gone after TERM
+		},
+		ReapGracePeriod: 1, // tiny so the test doesn't sleep meaningfully
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if r.Reaped.Count != 2 {
+		t.Errorf("Reaped.Count = %d, want 2", r.Reaped.Count)
+	}
+	wantTermed := []int{1281044, 1281099}
+	if !equalIntSlice(termed, wantTermed) {
+		t.Errorf("SIGTERM-ed PIDs = %v, want %v", termed, wantTermed)
+	}
+}
+
+func TestRunDoltCleanup_ForceReportsReapedRSSBytes(t *testing.T) {
+	procs := []DoltProcInfo{
+		{PID: 1281044, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestA/config.yaml"}, RSSBytes: 4096, StartTimeTicks: 20},
+		{PID: 1281099, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestB/config.yaml"}, RSSBytes: 8192, StartTimeTicks: 30},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Force:             true,
+		HomeDir:           "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+		KillProcess:       func(_ int, _ syscall.Signal) error { return syscall.ESRCH },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Reaped.Count != 2 {
+		t.Fatalf("Reaped.Count = %d, want 2", r.Reaped.Count)
+	}
+	if r.Summary.BytesFreedRSS != 12288 {
+		t.Errorf("Summary.BytesFreedRSS = %d, want 12288", r.Summary.BytesFreedRSS)
+	}
+}
+
+func TestRunDoltCleanup_ForceCountsSuccessfulKill(t *testing.T) {
+	procs := []DoltProcInfo{
+		{PID: 4444, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"}, StartTimeTicks: 10},
+	}
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Force:             true,
+		HomeDir:           "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if r.Reaped.Count != len(procs) {
+		t.Errorf("Reaped.Count = %d, want %d", r.Reaped.Count, len(procs))
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Errorf("Summary.ErrorsTotal = %d, want 0", r.Summary.ErrorsTotal)
+	}
+	if len(r.Errors) != 0 || len(r.Reaped.Errors) != 0 {
+		t.Errorf("errors = %#v, reap errors = %#v; want none", r.Errors, r.Reaped.Errors)
+	}
+	if len(signals) != 2 || signals[0] != syscall.SIGTERM || signals[1] != syscall.SIGKILL {
+		t.Errorf("signals = %v, want [SIGTERM SIGKILL]", signals)
+	}
+}
+
+func TestRunDoltCleanup_ForceCountsPostSIGTERMGoneAsReaped(t *testing.T) {
+	discoverCalls := 0
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:      fsys.NewFake(),
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			switch discoverCalls {
+			case 1, 2:
+				return []DoltProcInfo{{
+					PID:            4444,
+					Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+					RSSBytes:       4096,
+					StartTimeTicks: 10,
+				}}, nil
+			default:
+				return nil, nil
+			}
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if discoverCalls != 3 {
+		t.Fatalf("DiscoverProcesses calls = %d, want initial, pre-SIGTERM, pre-SIGKILL", discoverCalls)
+	}
+	if len(signals) != 1 || signals[0] != syscall.SIGTERM {
+		t.Fatalf("signals = %v, want [SIGTERM]", signals)
+	}
+	if r.Reaped.Count != 1 {
+		t.Errorf("Reaped.Count = %d, want 1 when process vanishes after our SIGTERM", r.Reaped.Count)
+	}
+	if r.Summary.BytesFreedRSS != 4096 {
+		t.Errorf("Summary.BytesFreedRSS = %d, want 4096", r.Summary.BytesFreedRSS)
+	}
+	if len(r.Reaped.VanishedPIDs) != 0 {
+		t.Errorf("VanishedPIDs = %v, want none for post-SIGTERM success", r.Reaped.VanishedPIDs)
+	}
+}
+
+func TestRunDoltCleanup_ForceRevalidatesPIDBeforeSIGTERM(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+
+	discoverCalls := 0
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:    []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:      fs,
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			if discoverCalls == 1 {
+				return []DoltProcInfo{{
+					PID:            4444,
+					Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+					StartTimeTicks: 10,
+				}}, nil
+			}
+			return []DoltProcInfo{{
+				PID:            4444,
+				Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+				Ports:          []int{28231},
+				StartTimeTicks: 10,
+			}}, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if discoverCalls != 2 {
+		t.Fatalf("DiscoverProcesses called %d time(s), want initial scan plus pre-SIGTERM revalidation", discoverCalls)
+	}
+	if len(signals) != 0 {
+		t.Fatalf("signals = %v, want none after PID reclassified as protected before SIGTERM", signals)
+	}
+	if r.Reaped.Count != 0 {
+		t.Errorf("Reaped.Count = %d, want 0 because SIGTERM was skipped", r.Reaped.Count)
+	}
+	if !equalIntSlice(r.Reaped.ProtectedPIDs, []int{4444}) {
+		t.Errorf("ProtectedPIDs = %v, want [4444] after revalidation", r.Reaped.ProtectedPIDs)
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsSignalWhenPIDStartTimeChanges(t *testing.T) {
+	discoverCalls := 0
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:      fsys.NewFake(),
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			if discoverCalls == 1 {
+				return []DoltProcInfo{{
+					PID:            4444,
+					Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+					StartTimeTicks: 10,
+				}}, nil
+			}
+			return []DoltProcInfo{{
+				PID:            4444,
+				Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+				StartTimeTicks: 11,
+			}}, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if discoverCalls != 2 {
+		t.Fatalf("DiscoverProcesses calls = %d, want 2", discoverCalls)
+	}
+	if len(signals) != 0 {
+		t.Fatalf("signals = %v, want none after PID start time changed", signals)
+	}
+	if r.Reaped.Count != 0 {
+		t.Errorf("Reaped.Count = %d, want 0 because PID identity changed", r.Reaped.Count)
+	}
+	if !equalIntSlice(r.Reaped.ProtectedPIDs, []int{4444}) {
+		t.Errorf("ProtectedPIDs = %v, want [4444] after PID identity changed", r.Reaped.ProtectedPIDs)
+	}
+}
+
+func TestRunDoltCleanup_ForceDoesNotCountMissingPIDAfterRevalidation(t *testing.T) {
+	discoverCalls := 0
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:      fsys.NewFake(),
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			if discoverCalls == 1 {
+				return []DoltProcInfo{{
+					PID:            4444,
+					Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+					StartTimeTicks: 10,
+				}}, nil
+			}
+			return nil, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if discoverCalls != 2 {
+		t.Fatalf("DiscoverProcesses calls = %d, want 2", discoverCalls)
+	}
+	if len(signals) != 0 {
+		t.Fatalf("signals = %v, want none when pre-SIGTERM refresh misses the PID", signals)
+	}
+	if r.Reaped.Count != 0 {
+		t.Errorf("Reaped.Count = %d, want 0 because missing-on-refresh is not a confirmed kill", r.Reaped.Count)
+	}
+	if !equalIntSlice(r.Reaped.VanishedPIDs, []int{4444}) {
+		t.Errorf("VanishedPIDs = %v, want [4444]", r.Reaped.VanishedPIDs)
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsSIGKILLWhenRevalidationDiscoverErrors(t *testing.T) {
+	discoverCalls := 0
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:      fsys.NewFake(),
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			if discoverCalls == 1 {
+				return []DoltProcInfo{{
+					PID:            4444,
+					Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+					StartTimeTicks: 10,
+				}}, nil
+			}
+			return nil, fmt.Errorf("transient /proc walk failed")
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if discoverCalls != 2 {
+		t.Fatalf("DiscoverProcesses calls = %d, want 2", discoverCalls)
+	}
+	if len(signals) != 0 {
+		t.Fatalf("signals = %v, want none when pre-SIGTERM revalidation fails", signals)
+	}
+	if r.Reaped.Count != 0 {
+		t.Errorf("Reaped.Count = %d, want 0 because SIGKILL was skipped", r.Reaped.Count)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Errorf("Summary.ErrorsTotal = %d, want 1", r.Summary.ErrorsTotal)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "reap" || !strings.Contains(r.Errors[0].Error, "revalidate before SIGTERM") {
+		t.Fatalf("Errors = %+v, want revalidation reap error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsSIGKILLWhenProcessBecomesProtected(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+
+	discoverCalls := 0
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:    []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:      fs,
+		JSON:    true,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			proc := DoltProcInfo{
+				PID:            4444,
+				Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+				StartTimeTicks: 10,
+			}
+			if discoverCalls >= 3 {
+				proc.Ports = []int{28231}
+			}
+			return []DoltProcInfo{proc}, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if discoverCalls != 3 {
+		t.Fatalf("DiscoverProcesses calls = %d, want initial, pre-SIGTERM, pre-SIGKILL", discoverCalls)
+	}
+	if len(signals) != 1 || signals[0] != syscall.SIGTERM {
+		t.Fatalf("signals = %v, want only SIGTERM before protected SIGKILL revalidation", signals)
+	}
+	if r.Reaped.Count != 0 {
+		t.Errorf("Reaped.Count = %d, want 0 because SIGKILL was skipped", r.Reaped.Count)
+	}
+	if !equalIntSlice(r.Reaped.ProtectedPIDs, []int{4444}) {
+		t.Errorf("ProtectedPIDs = %v, want [4444]", r.Reaped.ProtectedPIDs)
+	}
+}
+
+func TestRunDoltCleanup_ForceRecordsKillError(t *testing.T) {
+	procs := []DoltProcInfo{
+		{PID: 4444, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"}, StartTimeTicks: 10},
+	}
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Force:             true,
+		HomeDir:           "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			if sig == syscall.SIGTERM {
+				return nil
+			}
+			return syscall.EPERM
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if len(r.Reaped.Errors) == 0 {
+		t.Errorf("Reaped.Errors empty; want non-zero kill error")
+	}
+	if r.Reaped.Count != 0 {
+		t.Errorf("Reaped.Count = %d, want 0 because SIGKILL failed", r.Reaped.Count)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Errorf("Summary.ErrorsTotal = %d, want 1", r.Summary.ErrorsTotal)
+	}
+	if len(r.Errors) != 1 {
+		t.Fatalf("len(Errors) = %d, want 1: %#v", len(r.Errors), r.Errors)
+	}
+	if r.Errors[0].Stage != "reap" || r.Errors[0].Name != "pid 4444" || !strings.Contains(r.Errors[0].Error, "SIGKILL") {
+		t.Errorf("Errors[0] = %#v, want top-level reap SIGKILL error for pid 4444", r.Errors[0])
+	}
+}
+
+func TestRunDoltCleanup_RigsProtectedReadsDoltDatabaseFromMetadata(t *testing.T) {
+	// When a rig's metadata.json sets dolt_database, the protection entry MUST
+	// use that value as DB (not the rig name) so the drop step doesn't
+	// accidentally target a rig DB whose operator-chosen name differs from
+	// the rig's registered name. Falls back to rig.Name when metadata is
+	// missing or doesn't specify dolt_database.
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/rigs/foo/.beads/metadata.json"] = []byte(`{"dolt_database":"foo_db"}`)
+	fs.Files["/rigs/bar/.beads/metadata.json"] = []byte(`{"database":"sqlite"}`) // no dolt_database
+	// /rigs/missing has no metadata.json at all.
+
+	rigs := []resolverRig{
+		{Name: "city", Path: "/city", HQ: true},
+		{Name: "foo", Path: "/rigs/foo"},
+		{Name: "bar", Path: "/rigs/bar"},
+		{Name: "missing", Path: "/rigs/missing"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:  rigs,
+		FS:    fs,
+		JSON:  true,
+		Probe: false,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("runDoltCleanup exit=%d, stderr=%q", code, stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+
+	want := []CleanupRigProtection{
+		{Rig: "city", DB: "hq"},         // from metadata
+		{Rig: "foo", DB: "foo_db"},      // from metadata
+		{Rig: "bar", DB: "bar"},         // metadata present but no dolt_database — fall back to rig.Name
+		{Rig: "missing", DB: "missing"}, // no metadata — fall back to rig.Name
+	}
+	if len(r.RigsProtected) != len(want) {
+		t.Fatalf("RigsProtected len = %d, want %d (got %+v)", len(r.RigsProtected), len(want), r.RigsProtected)
+	}
+	for i, w := range want {
+		if r.RigsProtected[i] != w {
+			t.Errorf("RigsProtected[%d] = %+v, want %+v", i, r.RigsProtected[i], w)
+		}
+	}
+}
+
+func TestRunDoltCleanup_DryRunReportsUnsafeRigDatabaseName(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rigs/foo/.beads/metadata.json"] = []byte(`{"dolt_database":"foo db"}`)
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "foo", Path: "/rigs/foo"}},
+		FS:                fs,
+		JSON:              true,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "rig" || r.Errors[0].Name != "foo" || !strings.Contains(r.Errors[0].Error, "foo db") {
+		t.Fatalf("Errors = %+v, want typed rig error naming unsafe dolt_database", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_DryRunDoesNotCountMissingRigMetadataAsError(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rigs/silent/.beads/metadata.json"] = []byte(`{"database":"sqlite"}`)
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs: []resolverRig{
+			{Name: "missing", Path: "/rigs/missing"},
+			{Name: "silent", Path: "/rigs/silent"},
+		},
+		FS:                fs,
+		JSON:              true,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Summary.ErrorsTotal != 0 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 0 for dry-run metadata gaps; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 0 {
+		t.Fatalf("Errors = %+v, want none for dry-run metadata gaps", r.Errors)
+	}
+	out := stdout.String()
+	for _, want := range []string{
+		`"force_blockers":[`,
+		`"kind":"rig-protection"`,
+		`"name":"missing"`,
+		`"name":"silent"`,
+	} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("stdout missing dry-run force blocker %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestRunDoltCleanup_ForceDisablesDropAndPurgeWhenRigMetadataMissing(t *testing.T) {
+	fs := fsys.NewFake()
+	putFakeDirTree(fs, "/rigs/foo/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	client := &fakeCleanupDoltClient{
+		databases: []string{"foo", "testdb_foo_live"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "foo", Path: "/rigs/foo"}},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("dropped = %v, want no forced drops when rig metadata is missing", client.dropped)
+	}
+	if client.purged != 0 {
+		t.Fatalf("purged = %d, want no forced purge when rig metadata is missing", client.purged)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "rig" || r.Errors[0].Name != "foo" || !strings.Contains(r.Errors[0].Error, "missing") {
+		t.Fatalf("Errors = %+v, want missing metadata rig protection error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceDisablesDropAndPurgeWhenRigMetadataLacksDoltDatabase(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rigs/foo/.beads/metadata.json"] = []byte(`{"database":"sqlite"}`)
+	client := &fakeCleanupDoltClient{
+		databases: []string{"foo", "testdb_foo_live"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "foo", Path: "/rigs/foo"}},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("dropped = %v, want no forced drops when rig metadata lacks dolt_database", client.dropped)
+	}
+	if client.purged != 0 {
+		t.Fatalf("purged = %d, want no forced purge when rig metadata lacks dolt_database", client.purged)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "rig" || r.Errors[0].Name != "foo" || !strings.Contains(r.Errors[0].Error, "dolt_database") {
+		t.Fatalf("Errors = %+v, want missing dolt_database rig protection error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceRefusesDropWhenApplyPlanExceedsMaxOrphanDBs(t *testing.T) {
+	client := &fakeCleanupDoltClient{
+		databases: []string{"testdb_a", "testdb_b", "testdb_c"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Force:             true,
+		MaxOrphanDBs:      2,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("dropped = %v, want no forced drops when apply plan exceeds max", client.dropped)
+	}
+	if r.Dropped.Count != 3 || !equalStringSlice(r.Dropped.Names, []string{"testdb_a", "testdb_b", "testdb_c"}) {
+		t.Fatalf("Dropped = %+v, want planned drops when max-orphan guard refuses", r.Dropped)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "drop" || !strings.Contains(r.Errors[0].Error, "--max-orphan-dbs") || strings.Contains(r.Errors[0].Error, "max_orphans_for_sql") {
+		t.Fatalf("Errors = %+v, want user-facing max orphan DB refusal", r.Errors)
+	}
+	if !strings.Contains(stdout.String(), `"kind":"max-orphan-refusal"`) {
+		t.Fatalf("stdout missing structured max-orphan refusal kind:\n%s", stdout.String())
+	}
+}
+
+func TestRunDoltCleanup_MaxOrphanRefusalAbortsForcedPurgeAndReap(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rigs/foo/.beads/metadata.json"] = []byte(`{"dolt_database":"foo"}`)
+	putFakeDirTree(fs, "/rigs/foo/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"dropped/data.bin": 100,
+	})
+
+	client := &fakeCleanupDoltClient{
+		databases: []string{"foo", "testdb_a", "testdb_b", "testdb_c"},
+	}
+	procs := []DoltProcInfo{{
+		PID:            4444,
+		Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+		StartTimeTicks: 10,
+	}}
+	var signals []syscall.Signal
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:         []resolverRig{{Name: "foo", Path: "/rigs/foo"}},
+		FS:           fs,
+		JSON:         true,
+		Force:        true,
+		MaxOrphanDBs: 2,
+		DoltClient:   client,
+		HomeDir:      "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			return procs, nil
+		},
+		KillProcess: func(_ int, sig syscall.Signal) error {
+			signals = append(signals, sig)
+			return nil
+		},
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("dropped = %v, want no forced drops when apply plan exceeds max", client.dropped)
+	}
+	if client.purged != 0 {
+		t.Fatalf("purged = %d, want max-orphan refusal to skip forced purge", client.purged)
+	}
+	if len(signals) != 0 {
+		t.Fatalf("signals = %v, want max-orphan refusal to skip forced reap", signals)
+	}
+	if r.Purge.BytesReclaimed != 0 || r.Purge.OK {
+		t.Fatalf("Purge = %+v, want no forced purge result after max-orphan refusal", r.Purge)
+	}
+	if r.Reaped.Count != 0 || len(r.Reaped.Targets) != 0 {
+		t.Fatalf("Reaped = %+v, want no forced reap result after max-orphan refusal", r.Reaped)
+	}
+	if r.Summary.BytesFreedDisk != 0 || r.Summary.BytesFreedRSS != 0 {
+		t.Fatalf("Summary = %+v, want no freed resources after max-orphan refusal", r.Summary)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "drop" || !strings.Contains(r.Errors[0].Error, "--max-orphan-dbs") {
+		t.Fatalf("Errors = %+v, want max-orphan drop refusal only", r.Errors)
+	}
+	if !strings.Contains(stdout.String(), `"kind":"max-orphan-refusal"`) {
+		t.Fatalf("stdout missing structured max-orphan refusal kind:\n%s", stdout.String())
+	}
+}
+
+func equalStringSlice(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func equalIntSlice(a, b []int) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/cmd/gc/cmd_dolt_config.go b/cmd/gc/cmd_dolt_config.go
index 7449a894af..14c7973452 100644
--- a/cmd/gc/cmd_dolt_config.go
+++ b/cmd/gc/cmd_dolt_config.go
@@ -27,6 +27,7 @@ func newDoltConfigCmd(_ io.Writer, stderr io.Writer) *cobra.Command {
 		port         string
 		dataDir      string
 		logLevel     string
+		archiveLevel int
 		cityPath     string
 		scopeDir     string
 		issuePrefix  string
@@ -39,7 +40,7 @@ func newDoltConfigCmd(_ io.Writer, stderr io.Writer) *cobra.Command {
 		Hidden: true,
 		Args:   cobra.NoArgs,
 		RunE: func(_ *cobra.Command, _ []string) error {
-			if err := writeManagedDoltConfigFile(configFile, host, port, dataDir, logLevel); err != nil {
+			if err := writeManagedDoltConfigFile(configFile, host, port, dataDir, logLevel, archiveLevel); err != nil {
 				fmt.Fprintf(stderr, "gc dolt-config write-managed: %v\n", err) //nolint:errcheck
 				return errExit
 			}
@@ -51,6 +52,7 @@ func newDoltConfigCmd(_ io.Writer, stderr io.Writer) *cobra.Command {
 	writeManaged.Flags().StringVar(&port, "port", "", "listener port")
 	writeManaged.Flags().StringVar(&dataDir, "data-dir", "", "Dolt data directory")
 	writeManaged.Flags().StringVar(&logLevel, "log-level", "warning", "Dolt log level")
+	writeManaged.Flags().IntVar(&archiveLevel, "archive-level", 0, "Dolt auto_gc archive_level (0=off, 1=on)")
 	_ = writeManaged.MarkFlagRequired("file")
 	_ = writeManaged.MarkFlagRequired("host")
 	_ = writeManaged.MarkFlagRequired("port")
@@ -97,7 +99,7 @@ func newDoltConfigCmd(_ io.Writer, stderr io.Writer) *cobra.Command {
 	return cmd
 }
 
-func writeManagedDoltConfigFile(path, host, port, dataDir, logLevel string) error {
+func writeManagedDoltConfigFile(path, host, port, dataDir, logLevel string, archiveLevel int) error {
 	if path == "" {
 		return fmt.Errorf("missing --file")
 	}
@@ -137,8 +139,8 @@ data_dir: %q
 behavior:
   auto_gc_behavior:
     enable: true
-    archive_level: 1
-`, logLevel, port, host, dataDir)
+    archive_level: %d
+`, logLevel, port, host, dataDir, archiveLevel)
 	if err := fsys.WriteFileAtomic(fsys.OSFS{}, path, []byte(content), 0o644); err != nil {
 		return fmt.Errorf("write config file: %w", err)
 	}
diff --git a/cmd/gc/cmd_dolt_config_test.go b/cmd/gc/cmd_dolt_config_test.go
index b29f1de726..b7e75c9fb5 100644
--- a/cmd/gc/cmd_dolt_config_test.go
+++ b/cmd/gc/cmd_dolt_config_test.go
@@ -36,7 +36,7 @@ func TestDoltConfigWriteManagedCmd(t *testing.T) {
 		"port: 3311",
 		"host: 127.0.0.1",
 		`data_dir: "/tmp/city/.beads/dolt"`,
-		"archive_level: 1",
+		"archive_level: 0",
 		"back_log: 50",
 		"max_connections_timeout_millis: 5000",
 	} {
@@ -48,7 +48,7 @@ func TestDoltConfigWriteManagedCmd(t *testing.T) {
 
 func TestDoltConfigWriterIncludesDoctorExpectedCoreValues(t *testing.T) {
 	configPath := filepath.Join(t.TempDir(), "packs", "dolt", "dolt-config.yaml")
-	if err := writeManagedDoltConfigFile(configPath, "127.0.0.1", "3311", "/tmp/city/.beads/dolt", "warning"); err != nil {
+	if err := writeManagedDoltConfigFile(configPath, "127.0.0.1", "3311", "/tmp/city/.beads/dolt", "warning", 0); err != nil {
 		t.Fatalf("writeManagedDoltConfigFile: %v", err)
 	}
 
@@ -110,6 +110,45 @@ func testYAMLValueEqual(got, want any) bool {
 	return false
 }
 
+func TestDoltConfigWriteManagedCmd_ExplicitArchiveLevel(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "packs", "dolt", "dolt-config.yaml")
+	var stdout, stderr bytes.Buffer
+	code := run([]string{
+		"dolt-config", "write-managed",
+		"--file", configPath,
+		"--host", "127.0.0.1",
+		"--port", "3311",
+		"--data-dir", "/tmp/city/.beads/dolt",
+		"--archive-level", "1",
+	}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stderr = %s", code, stderr.String())
+	}
+
+	data, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", configPath, err)
+	}
+	if !strings.Contains(string(data), "archive_level: 1") {
+		t.Fatalf("config missing archive_level: 1:\n%s", data)
+	}
+}
+
+func TestWriteManagedDoltConfigFile_DefaultLogLevel(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "packs", "dolt", "dolt-config.yaml")
+	if err := writeManagedDoltConfigFile(configPath, "127.0.0.1", "3311", "/tmp/dolt-data", "", 0); err != nil {
+		t.Fatalf("writeManagedDoltConfigFile: %v", err)
+	}
+	data, err := os.ReadFile(configPath)
+	if err != nil {
+		t.Fatalf("ReadFile: %v", err)
+	}
+	text := string(data)
+	if !strings.Contains(text, "log_level: warning") {
+		t.Fatalf("empty logLevel should default to warning, got:\n%s", text)
+	}
+}
+
 func TestDoltConfigNormalizeScopeCmd(t *testing.T) {
 	cityPath := t.TempDir()
 	rigPath := filepath.Join(cityPath, "frontend")
diff --git a/cmd/gc/cmd_dolt_state.go b/cmd/gc/cmd_dolt_state.go
index bb398efa23..4075d2b409 100644
--- a/cmd/gc/cmd_dolt_state.go
+++ b/cmd/gc/cmd_dolt_state.go
@@ -289,12 +289,12 @@ func newDoltStateCmd(stdout, stderr io.Writer) *cobra.Command {
 
 	resetProbe := &cobra.Command{
 		Use:    "reset-probe",
-		Short:  "Drop the managed Dolt health probe database",
+		Short:  "Reset managed Dolt health probe artifacts",
 		Hidden: true,
 		Args:   cobra.NoArgs,
 		RunE: func(_ *cobra.Command, _ []string) error {
 			if !forceReset {
-				fmt.Fprintf(stderr, "gc dolt-state reset-probe: refusing to drop %s without --force; this database may contain a legacy bead store in old metadata\n", managedDoltProbeDatabase) //nolint:errcheck
+				fmt.Fprintf(stderr, "gc dolt-state reset-probe: refusing to reset health probe artifacts without --force; %s may contain a legacy bead store in old metadata\n", managedDoltProbeDatabase) //nolint:errcheck
 				return errExit
 			}
 			if err := managedDoltResetProbe(hostText, portText, userText); err != nil {
@@ -307,7 +307,7 @@ func newDoltStateCmd(stdout, stderr io.Writer) *cobra.Command {
 	resetProbe.Flags().StringVar(&hostText, "host", "", "Dolt host")
 	resetProbe.Flags().StringVar(&portText, "port", "", "Dolt port")
 	resetProbe.Flags().StringVar(&userText, "user", "", "Dolt user")
-	resetProbe.Flags().BoolVar(&forceReset, "force", false, "acknowledge dropping the managed probe database")
+	resetProbe.Flags().BoolVar(&forceReset, "force", false, "acknowledge dropping the legacy probe database and GC-owned probe table")
 	_ = resetProbe.MarkFlagRequired("port")
 	cmd.AddCommand(resetProbe)
 
diff --git a/cmd/gc/cmd_dolt_state_test.go b/cmd/gc/cmd_dolt_state_test.go
index 2b64a257d4..90c33b1fc4 100644
--- a/cmd/gc/cmd_dolt_state_test.go
+++ b/cmd/gc/cmd_dolt_state_test.go
@@ -520,6 +520,203 @@ func TestDoltStateAllocatePortCmdRepairsStoppedProviderStateFromOwnedLivePortHol
 	}
 }
 
+func TestDoltStateAllocatePortCmdRepairsMissingProviderStateFromPublishedHint(t *testing.T) {
+	cityPath := t.TempDir()
+	stateFile := filepath.Join(t.TempDir(), "dolt-provider-state.json")
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), doltRuntimeState{
+		Running:   false,
+		PID:       0,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(published): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "allocate-port", "--city", cityPath, "--state-file", stateFile}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stderr = %s", code, stderr.String())
+	}
+	if got := strings.TrimSpace(stdout.String()); got != strconv.Itoa(port) {
+		t.Fatalf("allocate-port = %q, want %d", got, port)
+	}
+
+	state, err := readDoltRuntimeStateFile(stateFile)
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(provider): %v", err)
+	}
+	if !state.Running {
+		t.Fatalf("repaired state running = false, want true")
+	}
+	if state.Port != port {
+		t.Fatalf("repaired state port = %d, want %d", state.Port, port)
+	}
+	if state.PID != listener.Process.Pid {
+		t.Fatalf("repaired state pid = %d, want %d", state.PID, listener.Process.Pid)
+	}
+
+	if _, err := os.Stat(layout.StateFile); !os.IsNotExist(err) {
+		t.Fatalf("canonical provider state was touched for non-canonical --state-file: %v", err)
+	}
+}
+
+func TestDoltStateAllocatePortCmdRepairsMissingCanonicalProviderStateFromPublishedHint(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), doltRuntimeState{
+		Running:   false,
+		PID:       0,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(published): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "allocate-port", "--city", cityPath}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stderr = %s", code, stderr.String())
+	}
+	if got := strings.TrimSpace(stdout.String()); got != strconv.Itoa(port) {
+		t.Fatalf("allocate-port = %q, want %d", got, port)
+	}
+
+	state, err := readDoltRuntimeStateFile(layout.StateFile)
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(provider): %v", err)
+	}
+	if !state.Running {
+		t.Fatalf("repaired state running = false, want true")
+	}
+	if state.Port != port {
+		t.Fatalf("repaired state port = %d, want %d", state.Port, port)
+	}
+	if state.PID != listener.Process.Pid {
+		t.Fatalf("repaired state pid = %d, want %d", state.PID, listener.Process.Pid)
+	}
+}
+
+func TestDoltStateAllocatePortCmdRepairsStaleWrongPortProviderStateFromPublishedHint(t *testing.T) {
+	cityPath := t.TempDir()
+	stateFile := filepath.Join(t.TempDir(), "dolt-provider-state.json")
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	stalePort := reserveRandomTCPPort(t)
+	if err := writeDoltRuntimeStateFile(stateFile, doltRuntimeState{
+		Running:   true,
+		PID:       999999,
+		Port:      stalePort,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(provider): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), doltRuntimeState{
+		Running:   false,
+		PID:       0,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(published): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "allocate-port", "--city", cityPath, "--state-file", stateFile}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stderr = %s", code, stderr.String())
+	}
+	if got := strings.TrimSpace(stdout.String()); got != strconv.Itoa(port) {
+		t.Fatalf("allocate-port = %q, want %d", got, port)
+	}
+
+	state, err := readDoltRuntimeStateFile(stateFile)
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(provider): %v", err)
+	}
+	if !state.Running {
+		t.Fatalf("repaired state running = false, want true")
+	}
+	if state.Port != port {
+		t.Fatalf("repaired state port = %d, want %d", state.Port, port)
+	}
+	if state.PID != listener.Process.Pid {
+		t.Fatalf("repaired state pid = %d, want %d", state.PID, listener.Process.Pid)
+	}
+	if _, err := os.Stat(layout.StateFile); !os.IsNotExist(err) {
+		t.Fatalf("canonical provider state was touched for non-canonical --state-file: %v", err)
+	}
+}
+
+func TestDoltStateAllocatePortCmdIgnoresMalformedPublishedHint(t *testing.T) {
+	cityPath := t.TempDir()
+	stateFile := filepath.Join(t.TempDir(), "dolt-provider-state.json")
+	publishedPath := managedDoltStatePath(cityPath)
+	if err := os.MkdirAll(filepath.Dir(publishedPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll(published dir): %v", err)
+	}
+	if err := os.WriteFile(publishedPath, []byte("{not-json"), 0o644); err != nil {
+		t.Fatalf("write malformed published hint: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "allocate-port", "--city", cityPath, "--state-file", stateFile}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stderr = %s", code, stderr.String())
+	}
+	if _, err := strconv.Atoi(strings.TrimSpace(stdout.String())); err != nil {
+		t.Fatalf("allocate-port output %q is not a port: %v", stdout.String(), err)
+	}
+	if _, err := os.Stat(stateFile); !os.IsNotExist(err) {
+		t.Fatalf("provider state was written from malformed hint: %v", err)
+	}
+}
+
 func TestDoltStateAllocatePortCmdSkipsOccupiedSeedPort(t *testing.T) {
 	cityPath := t.TempDir()
 
@@ -1358,27 +1555,31 @@ while True:
 
 func startUnixSocketProcess(t *testing.T, socketPath string) *exec.Cmd {
 	t.Helper()
+	readyPath := filepath.Join(t.TempDir(), "ready")
 	proc := exec.Command("python3", "-c", `
 import os
 import socket
 import sys
 import time
 path = sys.argv[1]
+ready_path = sys.argv[2]
 if os.path.exists(path):
     os.remove(path)
 sock = socket.socket(socket.AF_UNIX)
 sock.bind(path)
 sock.listen(1)
+with open(ready_path, "w") as f:
+    f.write("ready\n")
 while True:
     time.sleep(1)
-`, socketPath)
+`, socketPath, readyPath)
 	if err := proc.Start(); err != nil {
 		t.Fatalf("start unix socket process: %v", err)
 	}
 	deadline := time.Now().Add(5 * time.Second)
 	for {
 		if _, err := os.Stat(socketPath); err == nil {
-			if open, openErr := fileOpenedByAnyProcess(socketPath); openErr == nil && open {
+			if _, readyErr := os.Stat(readyPath); readyErr == nil {
 				return proc
 			}
 		}
@@ -1396,24 +1597,28 @@ func startOpenFileProcess(t *testing.T, path string) *exec.Cmd {
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		t.Fatal(err)
 	}
+	readyPath := filepath.Join(t.TempDir(), "ready")
 	proc := exec.Command("python3", "-c", `
 import os
 import sys
 import time
 path = sys.argv[1]
+ready_path = sys.argv[2]
 f = open(path, "a+")
 f.write("held")
 f.flush()
+with open(ready_path, "w") as f_ready:
+    f_ready.write("ready\n")
 while True:
     time.sleep(1)
-`, path)
+`, path, readyPath)
 	if err := proc.Start(); err != nil {
 		t.Fatalf("start open-file process: %v", err)
 	}
 	deadline := time.Now().Add(5 * time.Second)
 	for {
 		if _, err := os.Stat(path); err == nil {
-			if open, openErr := fileOpenedByAnyProcess(path); openErr == nil && open {
+			if _, readyErr := os.Stat(readyPath); readyErr == nil {
 				return proc
 			}
 		}
@@ -1431,6 +1636,7 @@ func startOpenFileAndTCPListenerProcess(t *testing.T, path string, port int, dir
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		t.Fatal(err)
 	}
+	readyPath := filepath.Join(t.TempDir(), "ready")
 	proc := exec.Command("python3", "-c", `
 import os
 import signal
@@ -1439,6 +1645,7 @@ import sys
 import time
 path = sys.argv[1]
 port = int(sys.argv[2])
+ready_path = sys.argv[3]
 f = open(path, "a+")
 f.write("held")
 f.flush()
@@ -1446,13 +1653,15 @@ sock = socket.socket()
 sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 sock.bind(("127.0.0.1", port))
 sock.listen(5)
+with open(ready_path, "w") as f_ready:
+    f_ready.write("ready\n")
 def _stop(*_args):
     raise SystemExit(0)
 signal.signal(signal.SIGTERM, _stop)
 signal.signal(signal.SIGINT, _stop)
 while True:
     time.sleep(1)
-`, path, strconv.Itoa(port))
+`, path, strconv.Itoa(port), readyPath)
 	if strings.TrimSpace(dir) != "" {
 		proc.Dir = dir
 	}
@@ -1462,7 +1671,7 @@ while True:
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
 		if _, err := os.Stat(path); err == nil {
-			if open, openErr := fileOpenedByAnyProcess(path); openErr == nil && open {
+			if _, readyErr := os.Stat(readyPath); readyErr == nil {
 				conn, err := net.DialTimeout("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)), 200*time.Millisecond)
 				if err == nil {
 					_ = conn.Close()
@@ -1569,8 +1778,20 @@ func TestDoltStateReadOnlyCheckCmdDetectsReadOnly(t *testing.T) {
 	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
 set -eu
 printf '%s\n' "$*" >> "$INVOCATION_FILE"
-echo 'database is read only' >&2
-exit 1
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\ninformation_schema\nmysql\ndolt_cluster\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
+    echo 'database is read only' >&2
+    exit 1
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
 `)
 	t.Setenv("INVOCATION_FILE", invocationFile)
 	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
@@ -1584,8 +1805,14 @@ exit 1
 	if err != nil {
 		t.Fatalf("ReadFile(invocation): %v", err)
 	}
-	assertNoManagedDoltProbeDrop(t, "read-only-check invocation", string(invocation))
-	assertManagedDoltProbeWrites(t, "read-only-check invocation", string(invocation))
+	text := string(invocation)
+	bt := "`"
+	assertNoManagedDoltProbeDrop(t, "read-only-check invocation", text)
+	assertNoManagedDoltProbeLegacyTarget(t, "read-only-check invocation", text)
+	wantWrite := "REPLACE INTO " + bt + "gascity" + bt + "." + bt + managedDoltProbeTable + bt + " VALUES (1)"
+	if !strings.Contains(text, wantWrite) {
+		t.Fatalf("read-only-check invocation = %s, want %q", text, wantWrite)
+	}
 }
 
 func TestDoltStateReadOnlyCheckCmdReturnsErrExitWhenWritable(t *testing.T) {
@@ -1594,7 +1821,15 @@ func TestDoltStateReadOnlyCheckCmdReturnsErrExitWhenWritable(t *testing.T) {
 	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
 set -eu
 printf '%s\n' "$*" >> "$INVOCATION_FILE"
-exit 0
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\n'
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
 `)
 	t.Setenv("INVOCATION_FILE", invocationFile)
 	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
@@ -1604,6 +1839,52 @@ exit 0
 	if code != 1 {
 		t.Fatalf("run() = %d, want 1; stderr = %s", code, stderr.String())
 	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	assertNoManagedDoltProbeLegacyTarget(t, "read-only-check writable invocation", string(invocation))
+}
+
+func TestDoltStateReadOnlyCheckCmdNoUserDatabaseReturnsDiagnostic(t *testing.T) {
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`)
+	t.Setenv("INVOCATION_FILE", invocationFile)
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "read-only-check", "--host", "127.0.0.1", "--port", "3311", "--user", "root"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("run() = %d, want 1; stdout = %s stderr = %s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "no user database") {
+		t.Fatalf("stderr = %q, want no-user-database diagnostic", stderr.String())
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("read-only-check ran write probe without user database:\n%s", invocation)
+	}
 }
 
 func TestDoltStateResetProbeCmdDropsManagedProbeDatabase(t *testing.T) {
@@ -1612,7 +1893,22 @@ func TestDoltStateResetProbeCmdDropsManagedProbeDatabase(t *testing.T) {
 	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
 set -eu
 printf '%s\n' "$*" >> "$INVOCATION_FILE"
-exit 0
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\ninformation_schema\nbeads\n__gc_probe\n'
+    exit 0
+    ;;
+  *"DROP DATABASE IF EXISTS __gc_probe"*)
+    exit 0
+    ;;
+  *"DROP TABLE IF EXISTS"*"__gc_read_only_probe"*)
+    exit 0
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
 `)
 	t.Setenv("INVOCATION_FILE", invocationFile)
 	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
@@ -1630,6 +1926,11 @@ exit 0
 	if !strings.Contains(text, "DROP DATABASE IF EXISTS "+managedDoltProbeDatabase) {
 		t.Fatalf("reset-probe invocation = %s, want managed probe drop", text)
 	}
+	for _, want := range []string{"DROP TABLE IF EXISTS `gascity`.`" + managedDoltProbeTable + "`", "DROP TABLE IF EXISTS `beads`.`" + managedDoltProbeTable + "`"} {
+		if !strings.Contains(text, want) {
+			t.Fatalf("reset-probe invocation = %s, want %q", text, want)
+		}
+	}
 }
 
 func TestDoltStateResetProbeCmdRequiresForce(t *testing.T) {
@@ -1638,7 +1939,8 @@ func TestDoltStateResetProbeCmdRequiresForce(t *testing.T) {
 	if code != 1 {
 		t.Fatalf("run() = %d, want 1; stderr = %s", code, stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "refusing to drop "+managedDoltProbeDatabase+" without --force") ||
+	if !strings.Contains(stderr.String(), "refusing to reset health probe artifacts without --force") ||
+		!strings.Contains(stderr.String(), managedDoltProbeDatabase) ||
 		!strings.Contains(stderr.String(), "legacy bead store") {
 		t.Fatalf("stderr = %q, want force warning with legacy bead store context", stderr.String())
 	}
@@ -1692,7 +1994,11 @@ case "$*" in
   *"sql -q SELECT active_branch()"*)
     exit 0
     ;;
-  *"sql -q CREATE DATABASE IF NOT EXISTS __gc_probe; CREATE TABLE IF NOT EXISTS __gc_probe.__probe (k INT PRIMARY KEY); REPLACE INTO __gc_probe.__probe VALUES (1);"*)
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\ninformation_schema\nmysql\ndolt_cluster\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
     echo 'database is read only' >&2
     exit 1
     ;;
@@ -1730,14 +2036,74 @@ esac
 	}
 	text := string(invocation)
 	assertNoManagedDoltProbeDrop(t, "health-check read-only probe", text)
-	assertManagedDoltProbeWrites(t, "health-check read-only probe", text)
-	for _, want := range []string{"--host 127.0.0.1", "--port 3311", "--user root", "SELECT active_branch()", "information_schema.PROCESSLIST"} {
+	assertNoManagedDoltProbeLegacyTarget(t, "health-check read-only probe", text)
+	bt := "`"
+	wantWrite := "REPLACE INTO " + bt + "gascity" + bt + "." + bt + managedDoltProbeTable + bt + " VALUES (1)"
+	if !strings.Contains(text, wantWrite) {
+		t.Fatalf("health-check probe = %s, want %q", text, wantWrite)
+	}
+	for _, want := range []string{"--host 127.0.0.1", "--port 3311", "--user root", "SELECT active_branch()", "information_schema.PROCESSLIST", "SHOW DATABASES"} {
 		if strings.Contains(text, want) == false {
 			t.Fatalf("dolt invocation missing %q: %s", want, text)
 		}
 	}
 }
 
+func TestDoltStateHealthCheckCmdNoUserDatabaseReportsUnknown(t *testing.T) {
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -q SELECT active_branch()"*)
+    exit 0
+    ;;
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"sql -r csv -q SELECT COUNT(*) AS cnt FROM information_schema.PROCESSLIST"*)
+    printf 'cnt\n0\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`)
+	t.Setenv("INVOCATION_FILE", invocationFile)
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "health-check", "--host", "0.0.0.0", "--port", "3311", "--user", "root", "--check-read-only"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stdout = %s stderr = %s", code, stdout.String(), stderr.String())
+	}
+	got := parseDoltStateOutput(t, stdout.String())
+	if got["query_ready"] != "true" {
+		t.Fatalf("query_ready = %q, want true", got["query_ready"])
+	}
+	if got["read_only"] != "unknown" {
+		t.Fatalf("read_only = %q, want unknown", got["read_only"])
+	}
+	if got["connection_count"] != "0" {
+		t.Fatalf("connection_count = %q, want 0", got["connection_count"])
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("health-check ran write probe without user database:\n%s", invocation)
+	}
+}
+
 func TestDoltStateHealthCheckCmdSkipsReadOnlyAndBestEffortCount(t *testing.T) {
 	binDir := t.TempDir()
 	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
@@ -1777,9 +2143,13 @@ esac
 		t.Fatalf("ReadFile(invocation): %v", err)
 	}
 	text := string(invocation)
-	if strings.Contains(text, "CREATE DATABASE IF NOT EXISTS __gc_probe") {
+	if strings.Contains(text, "CREATE TABLE IF NOT EXISTS") && strings.Contains(text, managedDoltProbeTable) {
 		t.Fatalf("health-check unexpectedly ran read-only probe: %s", text)
 	}
+	if strings.Contains(text, "SHOW DATABASES") {
+		t.Fatalf("health-check unexpectedly enumerated databases without --check-read-only: %s", text)
+	}
+	assertNoManagedDoltProbeLegacyTarget(t, "health-check skip-read-only probe", text)
 	for _, want := range []string{"SELECT active_branch()", "information_schema.PROCESSLIST"} {
 		if strings.Contains(text, want) == false {
 			t.Fatalf("dolt invocation missing %q: %s", want, text)
@@ -1816,7 +2186,11 @@ case "$*" in
   *"sql -q SELECT active_branch()"*)
     exit 0
     ;;
-  *"sql -q CREATE DATABASE IF NOT EXISTS __gc_probe; CREATE TABLE IF NOT EXISTS __gc_probe.__probe (k INT PRIMARY KEY); REPLACE INTO __gc_probe.__probe VALUES (1);"*)
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
     echo 'probe exploded' >&2
     exit 1
     ;;
@@ -2177,7 +2551,7 @@ set -eu
 printf '%s\n' "$*" >> "$INVOCATION_FILE"
 case "$*" in
   "sql-server --config "*)
-    config_file=${*#sql-server --config }
+    config_file=$3
     port=$(awk '/port:/ {print $2; exit}' "$config_file")
     data_dir=$(awk '/data_dir:/ {print $2; exit}' "$config_file" | tr -d '"')
     exec python3 - "$port" "$data_dir" <<'INNERPY'
@@ -2209,7 +2583,11 @@ INNERPY
   *"SELECT active_branch()"*)
     exit 0
     ;;
-  *"CREATE DATABASE IF NOT EXISTS __gc_probe;"*)
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
     if [ -f "$READ_ONLY_ONCE" ]; then
       rm -f "$READ_ONLY_ONCE"
       echo "read only" >&2
@@ -2233,7 +2611,7 @@ esac
 	})
 
 	var stdout, stderr bytes.Buffer
-	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "1000"}, &stdout, &stderr)
+	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "5000"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("run() = %d, stdout = %s stderr = %s", code, stdout.String(), stderr.String())
 	}
@@ -2278,6 +2656,127 @@ esac
 	}
 }
 
+func TestDoltStateRecoverManagedCmdNoUserDatabaseHealthSucceeds(t *testing.T) {
+	skipSlowCmdGCTest(t, "spawns managed dolt recovery processes; run make test-cmd-gc-process for full coverage")
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(layout.PIDFile), 0o755); err != nil {
+		t.Fatalf("MkdirAll(runtime dir): %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	original := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = original.Process.Kill()
+		_ = original.Wait()
+	}()
+	if err := os.WriteFile(layout.PIDFile, []byte(strconv.Itoa(original.Process.Pid)+"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(pid): %v", err)
+	}
+	if err := writeDoltRuntimeStateFile(layout.StateFile, doltRuntimeState{
+		Running:   true,
+		PID:       original.Process.Pid,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile: %v", err)
+	}
+
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  "sql-server --config "*)
+    config_file=$3
+    port=$(awk '/port:/ {print $2; exit}' "$config_file")
+    data_dir=$(awk '/data_dir:/ {print $2; exit}' "$config_file" | tr -d '"')
+    exec python3 - "$port" "$data_dir" <<'INNERPY'
+import os
+import signal
+import socket
+import sys
+import time
+
+port = int(sys.argv[1])
+data_dir = sys.argv[2]
+if data_dir:
+    os.chdir(data_dir)
+sock = socket.socket()
+sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+sock.bind(("127.0.0.1", port))
+sock.listen(5)
+def _stop(*_args):
+    raise SystemExit(0)
+signal.signal(signal.SIGTERM, _stop)
+signal.signal(signal.SIGINT, _stop)
+while True:
+    time.sleep(1)
+INNERPY
+    ;;
+  *"SELECT COUNT(*) AS cnt FROM information_schema.PROCESSLIST"*)
+    printf 'cnt\n0\n'
+    ;;
+  *"SELECT active_branch()"*)
+    exit 0
+    ;;
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`)
+	t.Setenv("INVOCATION_FILE", invocationFile)
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Cleanup(func() {
+		if state, err := readDoltRuntimeStateFile(layout.StateFile); err == nil && state.PID > 0 {
+			_ = terminateManagedDoltPID(state.PID)
+		}
+	})
+
+	var stdout, stderr bytes.Buffer
+	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "5000"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("run() = %d, stdout = %s stderr = %s", code, stdout.String(), stderr.String())
+	}
+	got := parseDoltStateOutput(t, stdout.String())
+	if got["diagnosed_read_only"] != "false" {
+		t.Fatalf("diagnosed_read_only = %q, want false", got["diagnosed_read_only"])
+	}
+	if got["had_pid"] != "true" {
+		t.Fatalf("had_pid = %q, want true", got["had_pid"])
+	}
+	if got["ready"] != "true" {
+		t.Fatalf("ready = %q, want true", got["ready"])
+	}
+	if got["healthy"] != "true" {
+		t.Fatalf("healthy = %q, want true", got["healthy"])
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("recover-managed ran write probe without user database:\n%s", invocation)
+	}
+}
+
 func TestRecoverManagedDoltProcessReturnsWhenConcurrentStarterBecomesReady(t *testing.T) {
 	cityPath := t.TempDir()
 	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
@@ -2534,7 +3033,7 @@ func TestDoltStateRecoverManagedCmdClearsPublishedStateWhenPreflightCleanupFails
 	defer func() { managedDoltPreflightCleanupFn = oldPreflight }()
 
 	var stdout, stderr bytes.Buffer
-	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "1000"}, &stdout, &stderr)
+	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "5000"}, &stdout, &stderr)
 	if code != 1 {
 		t.Fatalf("run() = %d, want 1; stdout = %s stderr = %s", code, stdout.String(), stderr.String())
 	}
@@ -2606,7 +3105,7 @@ set -eu
 printf '%s\n' "$*" >> "$INVOCATION_FILE"
 case "$*" in
   "sql-server --config "*)
-    config_file=${*#sql-server --config }
+    config_file=$3
     port=$(awk '/port:/ {print $2; exit}' "$config_file")
     data_dir=$(awk '/data_dir:/ {print $2; exit}' "$config_file" | tr -d '"')
     exec python3 - "$port" "$data_dir" <<'INNERPY'
@@ -2648,7 +3147,11 @@ INNERPY
     echo "final health probe failed" >&2
     exit 1
     ;;
-  *"CREATE DATABASE IF NOT EXISTS __gc_probe;"*)
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
     exit 0
     ;;
   *)
@@ -2667,7 +3170,7 @@ esac
 	})
 
 	var stdout, stderr bytes.Buffer
-	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "1000"}, &stdout, &stderr)
+	code := run([]string{"dolt-state", "recover-managed", "--city", cityPath, "--host", "127.0.0.1", "--port", strconv.Itoa(port), "--user", "root", "--timeout-ms", "5000"}, &stdout, &stderr)
 	if code != 1 {
 		t.Fatalf("run() = %d, want 1; stdout = %s stderr = %s", code, stdout.String(), stderr.String())
 	}
diff --git a/cmd/gc/cmd_events.go b/cmd/gc/cmd_events.go
index 8a089ffa60..bd0b06e199 100644
--- a/cmd/gc/cmd_events.go
+++ b/cmd/gc/cmd_events.go
@@ -40,6 +40,31 @@ type eventsAPITransportError struct {
 	err error
 }
 
+type cliWireEvent struct {
+	Actor   string          `json:"actor"`
+	Message string          `json:"message,omitempty"`
+	Payload json.RawMessage `json:"payload,omitempty"`
+	Seq     int64           `json:"seq"`
+	Subject string          `json:"subject,omitempty"`
+	Ts      time.Time       `json:"ts"`
+	Type    string          `json:"type"`
+}
+
+type cliWireTaggedEvent struct {
+	Actor   string          `json:"actor"`
+	City    string          `json:"city"`
+	Message string          `json:"message,omitempty"`
+	Payload json.RawMessage `json:"payload,omitempty"`
+	Seq     int64           `json:"seq"`
+	Subject string          `json:"subject,omitempty"`
+	Ts      time.Time       `json:"ts"`
+	Type    string          `json:"type"`
+}
+
+type cliEventEnvelope = cliWireEvent
+
+type cliTaggedEventEnvelope = cliWireTaggedEvent
+
 func (e *eventsAPIError) Error() string {
 	if e == nil {
 		return "request failed"
@@ -498,7 +523,7 @@ func doEventsSeq(scope eventsAPIScope, stdout, stderr io.Writer) int {
 	return 0
 }
 
-func readLocalCityEvents(scope eventsAPIScope, apiErr error, typeFilter, sinceFlag string, warningWriter io.Writer) ([]genclient.WireEvent, bool, error) {
+func readLocalCityEvents(scope eventsAPIScope, apiErr error, typeFilter, sinceFlag string, warningWriter io.Writer) ([]cliWireEvent, bool, error) {
 	if !shouldUseLocalCityEventsFallback(scope, apiErr) {
 		return nil, false, nil
 	}
@@ -512,7 +537,7 @@ func readLocalCityEvents(scope eventsAPIScope, apiErr error, typeFilter, sinceFl
 	if err != nil {
 		return nil, true, fmt.Errorf("reading local city events: %w", err)
 	}
-	items := make([]genclient.WireEvent, 0, len(all))
+	items := make([]cliWireEvent, 0, len(all))
 	for _, item := range all {
 		items = append(items, localWireEvent(item, warningWriter))
 	}
@@ -603,30 +628,49 @@ func eventsSinceCutoff(sinceFlag string) (time.Time, error) {
 	return time.Now().Add(-d), nil
 }
 
-func localWireEvent(e events.Event, warningWriter io.Writer) genclient.WireEvent {
-	item := genclient.WireEvent{
+func localWireEvent(e events.Event, _ io.Writer) cliWireEvent {
+	item := cliWireEvent{
 		Actor: e.Actor,
 		Seq:   int64(e.Seq),
 		Ts:    e.Ts,
 		Type:  e.Type,
 	}
 	if e.Subject != "" {
-		item.Subject = &e.Subject
+		item.Subject = e.Subject
 	}
 	if e.Message != "" {
-		item.Message = &e.Message
+		item.Message = e.Message
 	}
 	if len(e.Payload) > 0 && string(e.Payload) != "null" {
-		var payload genclient.EventPayload
-		if err := payload.UnmarshalJSON(e.Payload); err == nil {
-			item.Payload = &payload
-		} else if warningWriter != nil {
-			fmt.Fprintf(warningWriter, "gc events: warning: decoding local event payload for seq %d type %s: %v\n", e.Seq, e.Type, err) //nolint:errcheck // best-effort stderr
-		}
+		item.Payload = append(json.RawMessage(nil), e.Payload...)
 	}
 	return item
 }
 
+func cityWireEventFromTyped(item genclient.TypedEventStreamEnvelope) (cliWireEvent, error) {
+	data, err := json.Marshal(item)
+	if err != nil {
+		return cliWireEvent{}, err
+	}
+	var out cliWireEvent
+	if err := json.Unmarshal(data, &out); err != nil {
+		return cliWireEvent{}, err
+	}
+	return out, nil
+}
+
+func supervisorWireEventFromTyped(item genclient.TypedTaggedEventStreamEnvelope) (cliWireTaggedEvent, error) {
+	data, err := json.Marshal(item)
+	if err != nil {
+		return cliWireTaggedEvent{}, err
+	}
+	var out cliWireTaggedEvent
+	if err := json.Unmarshal(data, &out); err != nil {
+		return cliWireTaggedEvent{}, err
+	}
+	return out, nil
+}
+
 func doEventsFollow(scope eventsAPIScope, typeFilter string, payloadMatch map[string][]string, afterSeq uint64, afterCursor string, stdout, stderr io.Writer) int {
 	if scope.localOnly {
 		printStreamingCityAPIRequirement("--follow", stderr)
@@ -747,9 +791,9 @@ func probeCityEventsReachable(ctx context.Context, client *genclient.ClientWithR
 	return eventsListError(resp.StatusCode(), resp.ApplicationproblemJSONDefault)
 }
 
-func fetchCityEvents(ctx context.Context, client *genclient.ClientWithResponses, cityName, typeFilter, sinceFlag string) ([]genclient.WireEvent, error) {
+func fetchCityEvents(ctx context.Context, client *genclient.ClientWithResponses, cityName, typeFilter, sinceFlag string) ([]cliWireEvent, error) {
 	limit := int64(500)
-	var all []genclient.WireEvent
+	var all []cliWireEvent
 	var cursor *string
 
 	for {
@@ -773,7 +817,13 @@ func fetchCityEvents(ctx context.Context, client *genclient.ClientWithResponses,
 		if resp.JSON200 == nil || resp.JSON200.Items == nil {
 			return all, nil
 		}
-		all = append(all, *resp.JSON200.Items...)
+		for _, item := range *resp.JSON200.Items {
+			wire, err := cityWireEventFromTyped(item)
+			if err != nil {
+				return nil, fmt.Errorf("decoding city event list item: %w", err)
+			}
+			all = append(all, wire)
+		}
 		if resp.JSON200.NextCursor == nil || strings.TrimSpace(*resp.JSON200.NextCursor) == "" {
 			return all, nil
 		}
@@ -802,7 +852,7 @@ func fetchCityHeadIndex(ctx context.Context, client *genclient.ClientWithRespons
 	return index, nil
 }
 
-func fetchSupervisorEvents(ctx context.Context, client *genclient.ClientWithResponses, typeFilter, sinceFlag string) ([]genclient.WireTaggedEvent, error) {
+func fetchSupervisorEvents(ctx context.Context, client *genclient.ClientWithResponses, typeFilter, sinceFlag string) ([]cliWireTaggedEvent, error) {
 	return fetchSupervisorEventsWithLimit(ctx, client, typeFilter, sinceFlag, 0)
 }
 
@@ -811,7 +861,7 @@ func fetchSupervisorEvents(ctx context.Context, client *genclient.ClientWithResp
 // most recent `limit` events. Used by fetchSupervisorHeadCursor so
 // computing the head cursor is a cheap round-trip instead of downloading
 // every event in the supervisor's history.
-func fetchSupervisorEventsWithLimit(ctx context.Context, client *genclient.ClientWithResponses, typeFilter, sinceFlag string, limit int64) ([]genclient.WireTaggedEvent, error) {
+func fetchSupervisorEventsWithLimit(ctx context.Context, client *genclient.ClientWithResponses, typeFilter, sinceFlag string, limit int64) ([]cliWireTaggedEvent, error) {
 	params := &genclient.GetV0EventsParams{}
 	if strings.TrimSpace(typeFilter) != "" {
 		params.Type = &typeFilter
@@ -830,9 +880,17 @@ func fetchSupervisorEventsWithLimit(ctx context.Context, client *genclient.Clien
 		return nil, err
 	}
 	if resp.JSON200 == nil || resp.JSON200.Items == nil {
-		return []genclient.WireTaggedEvent{}, nil
+		return []cliWireTaggedEvent{}, nil
+	}
+	items := make([]cliWireTaggedEvent, 0, len(*resp.JSON200.Items))
+	for _, item := range *resp.JSON200.Items {
+		wire, err := supervisorWireEventFromTyped(item)
+		if err != nil {
+			return nil, fmt.Errorf("decoding supervisor event list item: %w", err)
+		}
+		items = append(items, wire)
 	}
-	return *resp.JSON200.Items, nil
+	return items, nil
 }
 
 // fetchSupervisorHeadCursor asks the supervisor for its current head
@@ -878,14 +936,14 @@ func eventsListError(statusCode int, problem *genclient.ErrorModel) error {
 
 func printJSONLines(items any, stdout, stderr io.Writer) int {
 	switch typed := items.(type) {
-	case []genclient.WireEvent:
+	case []cliWireEvent:
 		for _, item := range typed {
 			if err := writeJSONLValue(stdout, item); err != nil {
 				fmt.Fprintf(stderr, "gc events: marshal: %v\n", err) //nolint:errcheck
 				return 1
 			}
 		}
-	case []genclient.WireTaggedEvent:
+	case []cliWireTaggedEvent:
 		for _, item := range typed {
 			if err := writeJSONLValue(stdout, item); err != nil {
 				fmt.Fprintf(stderr, "gc events: marshal: %v\n", err) //nolint:errcheck
@@ -924,11 +982,11 @@ func writeJSONLValue(stdout io.Writer, value any) error {
 	return err
 }
 
-func filterCityEvents(items []genclient.WireEvent, afterSeq uint64, typeFilter string, payloadMatch map[string][]string) []genclient.WireEvent {
+func filterCityEvents(items []cliWireEvent, afterSeq uint64, typeFilter string, payloadMatch map[string][]string) []cliWireEvent {
 	if len(items) == 0 {
-		return []genclient.WireEvent{}
+		return []cliWireEvent{}
 	}
-	out := make([]genclient.WireEvent, 0, len(items))
+	out := make([]cliWireEvent, 0, len(items))
 	for _, item := range items {
 		if uint64(item.Seq) <= afterSeq {
 			continue
@@ -944,11 +1002,11 @@ func filterCityEvents(items []genclient.WireEvent, afterSeq uint64, typeFilter s
 	return out
 }
 
-func filterSupervisorEvents(items []genclient.WireTaggedEvent, typeFilter string, payloadMatch map[string][]string) []genclient.WireTaggedEvent {
+func filterSupervisorEvents(items []cliWireTaggedEvent, typeFilter string, payloadMatch map[string][]string) []cliWireTaggedEvent {
 	if len(items) == 0 {
-		return []genclient.WireTaggedEvent{}
+		return []cliWireTaggedEvent{}
 	}
-	out := make([]genclient.WireTaggedEvent, 0, len(items))
+	out := make([]cliWireTaggedEvent, 0, len(items))
 	for _, item := range items {
 		if typeFilter != "" && item.Type != typeFilter {
 			continue
@@ -961,9 +1019,9 @@ func filterSupervisorEvents(items []genclient.WireTaggedEvent, typeFilter string
 	return out
 }
 
-func filterSupervisorEventsAfterCursor(items []genclient.WireTaggedEvent, cursor, typeFilter string, payloadMatch map[string][]string) []genclient.WireTaggedEvent {
+func filterSupervisorEventsAfterCursor(items []cliWireTaggedEvent, cursor, typeFilter string, payloadMatch map[string][]string) []cliWireTaggedEvent {
 	cursors := events.ParseCursor(cursor)
-	out := make([]genclient.WireTaggedEvent, 0, len(items))
+	out := make([]cliWireTaggedEvent, 0, len(items))
 	for _, item := range items {
 		if uint64(item.Seq) <= cursors[item.City] {
 			continue
@@ -1302,7 +1360,7 @@ func (d *sseDecoder) Next() (sseFrame, error) {
 	return sseFrame{}, io.EOF
 }
 
-func supervisorCursorFor(items []genclient.WireTaggedEvent) string {
+func supervisorCursorFor(items []cliWireTaggedEvent) string {
 	if len(items) == 0 {
 		return ""
 	}
@@ -1320,39 +1378,16 @@ func supervisorCursorFor(items []genclient.WireTaggedEvent) string {
 // identical JSONL output. The only structural difference between the
 // two shapes is the optional Workflow projection that the stream
 // attaches to bead events; list results omit it.
-func cityEnvelopesFor(items []genclient.WireEvent) []genclient.EventStreamEnvelope {
-	out := make([]genclient.EventStreamEnvelope, 0, len(items))
-	for _, item := range items {
-		out = append(out, genclient.EventStreamEnvelope{
-			Actor:   item.Actor,
-			Message: item.Message,
-			Payload: item.Payload,
-			Seq:     item.Seq,
-			Subject: item.Subject,
-			Ts:      item.Ts,
-			Type:    item.Type,
-		})
-	}
-	return out
+func cityEnvelopesFor(items []cliWireEvent) []cliEventEnvelope {
+	out := make([]cliEventEnvelope, 0, len(items))
+	return append(out, items...)
 }
 
 // taggedEnvelopesFor is the supervisor-scope analog of cityEnvelopesFor,
 // preserving the City tag for the aggregated events stream.
-func taggedEnvelopesFor(items []genclient.WireTaggedEvent) []genclient.TaggedEventStreamEnvelope {
-	out := make([]genclient.TaggedEventStreamEnvelope, 0, len(items))
-	for _, item := range items {
-		out = append(out, genclient.TaggedEventStreamEnvelope{
-			Actor:   item.Actor,
-			City:    item.City,
-			Message: item.Message,
-			Payload: item.Payload,
-			Seq:     item.Seq,
-			Subject: item.Subject,
-			Ts:      item.Ts,
-			Type:    item.Type,
-		})
-	}
-	return out
+func taggedEnvelopesFor(items []cliWireTaggedEvent) []cliTaggedEventEnvelope {
+	out := make([]cliTaggedEventEnvelope, 0, len(items))
+	return append(out, items...)
 }
 
 func matchPayload(payload any, payloadMatch map[string][]string) bool {
diff --git a/cmd/gc/cmd_events_test.go b/cmd/gc/cmd_events_test.go
index 7d3c62eced..bddec16ff7 100644
--- a/cmd/gc/cmd_events_test.go
+++ b/cmd/gc/cmd_events_test.go
@@ -18,14 +18,14 @@ import (
 )
 
 func TestDoEventsCityDefaultUsesJSONLItems(t *testing.T) {
-	items := []genclient.WireEvent{
-		{Actor: "human", Seq: 1, Subject: stringPtr("gc-1"), Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
-		{Actor: "gc", Seq: 2, Subject: stringPtr("mayor"), Ts: time.Unix(1700000010, 0).UTC(), Type: "session.woke"},
+	items := []cliWireEvent{
+		{Actor: "human", Seq: 1, Subject: "gc-1", Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
+		{Actor: "gc", Seq: 2, Subject: "mayor", Ts: time.Unix(1700000010, 0).UTC(), Type: "session.woke"},
 	}
 	server := newEventsTestServer(t, testEventRoutes{
 		cityEvents: func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set("X-GC-Index", "2")
-			writeJSONResponse(t, w, genclient.ListBodyWireEvent{Items: &items, Total: int64(len(items))})
+			writeJSONResponse(t, w, cityEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -40,9 +40,9 @@ func TestDoEventsCityDefaultUsesJSONLItems(t *testing.T) {
 	if len(lines) != 2 {
 		t.Fatalf("got %d JSONL lines, want 2; output=%q", len(lines), stdout.String())
 	}
-	var got []genclient.WireEvent
+	var got []cliWireEvent
 	for _, line := range lines {
-		var item genclient.WireEvent
+		var item cliWireEvent
 		if err := json.Unmarshal([]byte(line), &item); err != nil {
 			t.Fatalf("unmarshal line: %v; line=%q", err, line)
 		}
@@ -54,12 +54,12 @@ func TestDoEventsCityDefaultUsesJSONLItems(t *testing.T) {
 }
 
 func TestDoEventsSupervisorDefaultUsesTaggedJSONLItems(t *testing.T) {
-	items := []genclient.WireTaggedEvent{
-		{Actor: "human", City: "alpha", Seq: 3, Subject: stringPtr("gc-1"), Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
+	items := []cliWireTaggedEvent{
+		{Actor: "human", City: "alpha", Seq: 3, Subject: "gc-1", Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
 	}
 	server := newEventsTestServer(t, testEventRoutes{
 		supervisorEvents: func(w http.ResponseWriter, _ *http.Request) {
-			writeJSONResponse(t, w, genclient.SupervisorEventListOutputBody{Items: &items, Total: int64(len(items))})
+			writeJSONResponse(t, w, supervisorEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -70,7 +70,7 @@ func TestDoEventsSupervisorDefaultUsesTaggedJSONLItems(t *testing.T) {
 		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
 	}
 
-	var got genclient.WireTaggedEvent
+	var got cliWireTaggedEvent
 	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &got); err != nil {
 		t.Fatalf("unmarshal stdout: %v; output=%s", err, stdout.String())
 	}
@@ -83,8 +83,8 @@ func TestDoEventsSeqCityUsesIndexHeader(t *testing.T) {
 	server := newEventsTestServer(t, testEventRoutes{
 		cityEvents: func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set("X-GC-Index", "7")
-			items := []genclient.WireEvent{}
-			writeJSONResponse(t, w, genclient.ListBodyWireEvent{Items: &items, Total: 0})
+			items := []cliWireEvent{}
+			writeJSONResponse(t, w, cityEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -100,13 +100,13 @@ func TestDoEventsSeqCityUsesIndexHeader(t *testing.T) {
 }
 
 func TestDoEventsSeqSupervisorPrintsCompositeCursor(t *testing.T) {
-	items := []genclient.WireTaggedEvent{
+	items := []cliWireTaggedEvent{
 		{Actor: "human", City: "beta", Seq: 9, Ts: time.Unix(1700000001, 0).UTC(), Type: "mail.sent"},
 		{Actor: "human", City: "alpha", Seq: 4, Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
 	}
 	server := newEventsTestServer(t, testEventRoutes{
 		supervisorEvents: func(w http.ResponseWriter, _ *http.Request) {
-			writeJSONResponse(t, w, genclient.SupervisorEventListOutputBody{Items: &items, Total: int64(len(items))})
+			writeJSONResponse(t, w, supervisorEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -152,7 +152,7 @@ func TestDoEventsFallsBackToLocalCityEventsWhenCityStopped(t *testing.T) {
 		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
 	}
 
-	var got genclient.WireEvent
+	var got cliWireEvent
 	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &got); err != nil {
 		t.Fatalf("unmarshal stdout: %v; output=%s", err, stdout.String())
 	}
@@ -192,7 +192,7 @@ func TestDoEventsFallsBackToLocalCityEventsOnTypedStoppedCityNotFound(t *testing
 		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
 	}
 
-	var got genclient.WireEvent
+	var got cliWireEvent
 	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &got); err != nil {
 		t.Fatalf("unmarshal stdout: %v; output=%s", err, stdout.String())
 	}
@@ -311,7 +311,7 @@ func TestDoEventsFallsBackToLocalCityEventsForExplicitLocalSupervisorAPI(t *test
 		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
 	}
 
-	var got genclient.WireEvent
+	var got cliWireEvent
 	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &got); err != nil {
 		t.Fatalf("unmarshal stdout: %v; output=%s", err, stdout.String())
 	}
@@ -346,7 +346,7 @@ func TestDoEventsFallsBackToLocalCityEventsForExplicitLocalSupervisorAPITranspor
 		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
 	}
 
-	var got genclient.WireEvent
+	var got cliWireEvent
 	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &got); err != nil {
 		t.Fatalf("unmarshal stdout: %v; output=%s", err, stdout.String())
 	}
@@ -355,6 +355,79 @@ func TestDoEventsFallsBackToLocalCityEventsForExplicitLocalSupervisorAPITranspor
 	}
 }
 
+func TestDoEventsReadsCustomCityEventTypesThroughAPI(t *testing.T) {
+	cityDir := t.TempDir()
+	items := []cliWireEvent{{
+		Actor:   "human",
+		Seq:     1,
+		Subject: "fixture",
+		Ts:      time.Unix(1700000000, 0).UTC(),
+		Type:    "app.custom",
+		Message: "custom event",
+		Payload: json.RawMessage(`{"source":"test"}`),
+	}}
+
+	server := newEventsTestServer(t, testEventRoutes{
+		cityEvents: func(w http.ResponseWriter, r *http.Request) {
+			if got := r.URL.Query().Get("type"); got != "app.custom" {
+				t.Fatalf("type query = %q, want app.custom", got)
+			}
+			w.Header().Set("X-GC-Index", "1")
+			writeJSONResponse(t, w, cityEventsListResponse(t, items))
+		},
+	})
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := doEvents(eventsAPIScope{
+		apiURL:   server.URL,
+		cityName: "mc-city",
+		cityPath: cityDir,
+	}, "app.custom", "", nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
+	}
+
+	var got cliWireEvent
+	if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &got); err != nil {
+		t.Fatalf("unmarshal stdout: %v; output=%s", err, stdout.String())
+	}
+	if got.Type != "app.custom" || got.Subject != "fixture" || got.Message != "custom event" {
+		t.Fatalf("custom event = %+v", got)
+	}
+	if string(got.Payload) != `{"source":"test"}` {
+		t.Fatalf("custom event payload = %s", got.Payload)
+	}
+}
+
+func TestDoEventsDoesNotReadLocalUntypedCityEventsForExplicitRemoteAPI(t *testing.T) {
+	cityDir := t.TempDir()
+	rec := newTestProvider(t, filepath.Join(cityDir, ".gc"))
+	rec.Record(events.Event{Type: "app.custom", Actor: "human"})
+
+	server := newEventsTestServer(t, testEventRoutes{
+		cityEvents: func(w http.ResponseWriter, _ *http.Request) {
+			w.Header().Set("X-GC-Index", "0")
+			writeJSONResponse(t, w, cityEventsListResponse(t, []cliWireEvent{}))
+		},
+	})
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	code := doEvents(eventsAPIScope{
+		apiURL:      server.URL,
+		cityName:    "mc-city",
+		cityPath:    cityDir,
+		explicitAPI: true,
+	}, "app.custom", "", nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doEvents = %d, want 0; stderr=%s", code, stderr.String())
+	}
+	if strings.TrimSpace(stdout.String()) != "" {
+		t.Fatalf("stdout = %q, want explicit remote API result", stdout.String())
+	}
+}
+
 func TestDoEventsSeqFallsBackToLocalCityEventHeadWhenCityStopped(t *testing.T) {
 	cityDir := t.TempDir()
 	rec := newTestProvider(t, filepath.Join(cityDir, ".gc"))
@@ -554,14 +627,14 @@ func TestDoEventsWatchStoppedCityAfterSeqRequiresRunningAPI(t *testing.T) {
 }
 
 func TestDoEventsWatchCityBufferedReplayUsesEnvelopeSchema(t *testing.T) {
-	items := []genclient.WireEvent{
-		{Actor: "human", Seq: 1, Subject: stringPtr("gc-1"), Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
-		{Actor: "human", Message: stringPtr("hello"), Seq: 2, Subject: stringPtr("gc-2"), Ts: time.Unix(1700000010, 0).UTC(), Type: "mail.sent"},
+	items := []cliWireEvent{
+		{Actor: "human", Seq: 1, Subject: "gc-1", Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
+		{Actor: "human", Message: "hello", Seq: 2, Subject: "gc-2", Ts: time.Unix(1700000010, 0).UTC(), Type: "mail.sent"},
 	}
 	server := newEventsTestServer(t, testEventRoutes{
 		cityEvents: func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set("X-GC-Index", "2")
-			writeJSONResponse(t, w, genclient.ListBodyWireEvent{Items: &items, Total: int64(len(items))})
+			writeJSONResponse(t, w, cityEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -586,15 +659,15 @@ func TestDoEventsWatchCityBufferedReplayUsesEnvelopeSchema(t *testing.T) {
 }
 
 func TestDoEventsWatchCityBufferedReplayAfterSeqSkipsHeadProbe(t *testing.T) {
-	items := []genclient.WireEvent{
-		{Actor: "human", Seq: 1, Subject: stringPtr("gc-1"), Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
-		{Actor: "human", Message: stringPtr("hello"), Seq: 2, Subject: stringPtr("gc-2"), Ts: time.Unix(1700000010, 0).UTC(), Type: "mail.sent"},
+	items := []cliWireEvent{
+		{Actor: "human", Seq: 1, Subject: "gc-1", Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
+		{Actor: "human", Message: "hello", Seq: 2, Subject: "gc-2", Ts: time.Unix(1700000010, 0).UTC(), Type: "mail.sent"},
 	}
 	server := newEventsTestServer(t, testEventRoutes{
 		cityEvents: func(w http.ResponseWriter, _ *http.Request) {
 			// Buffered replay for --after only needs the JSON body; a missing
 			// X-GC-Index header should not block replay.
-			writeJSONResponse(t, w, genclient.ListBodyWireEvent{Items: &items, Total: int64(len(items))})
+			writeJSONResponse(t, w, cityEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -619,13 +692,13 @@ func TestDoEventsWatchCityBufferedReplayAfterSeqSkipsHeadProbe(t *testing.T) {
 }
 
 func TestDoEventsWatchSupervisorBufferedReplayUsesTaggedEnvelopeSchema(t *testing.T) {
-	items := []genclient.WireTaggedEvent{
+	items := []cliWireTaggedEvent{
 		{Actor: "human", City: "alpha", Seq: 2, Ts: time.Unix(1700000000, 0).UTC(), Type: "bead.created"},
 		{Actor: "gc", City: "beta", Seq: 5, Ts: time.Unix(1700000010, 0).UTC(), Type: "session.woke"},
 	}
 	server := newEventsTestServer(t, testEventRoutes{
 		supervisorEvents: func(w http.ResponseWriter, _ *http.Request) {
-			writeJSONResponse(t, w, genclient.SupervisorEventListOutputBody{Items: &items, Total: int64(len(items))})
+			writeJSONResponse(t, w, supervisorEventsListResponse(t, items))
 		},
 	})
 	defer server.Close()
@@ -653,8 +726,8 @@ func TestDoEventsWatchTimesOutWithoutMatch(t *testing.T) {
 	server := newEventsTestServer(t, testEventRoutes{
 		cityEvents: func(w http.ResponseWriter, _ *http.Request) {
 			w.Header().Set("X-GC-Index", "3")
-			items := []genclient.WireEvent{}
-			writeJSONResponse(t, w, genclient.ListBodyWireEvent{Items: &items, Total: 0})
+			items := []cliWireEvent{}
+			writeJSONResponse(t, w, cityEventsListResponse(t, items))
 		},
 		cityStream: func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Content-Type", "text/event-stream")
@@ -792,6 +865,40 @@ func writeJSONResponse(t *testing.T, w http.ResponseWriter, body any) {
 	}
 }
 
+func cityEventsListResponse(t *testing.T, items []cliWireEvent) genclient.ListBodyWireEvent {
+	t.Helper()
+	typed := make([]genclient.TypedEventStreamEnvelope, 0, len(items))
+	for _, item := range items {
+		data, err := json.Marshal(item)
+		if err != nil {
+			t.Fatalf("marshal city event item: %v", err)
+		}
+		var envelope genclient.TypedEventStreamEnvelope
+		if err := envelope.UnmarshalJSON(data); err != nil {
+			t.Fatalf("unmarshal typed city event item: %v; item=%s", err, data)
+		}
+		typed = append(typed, envelope)
+	}
+	return genclient.ListBodyWireEvent{Items: &typed, Total: int64(len(typed))}
+}
+
+func supervisorEventsListResponse(t *testing.T, items []cliWireTaggedEvent) genclient.SupervisorEventListOutputBody {
+	t.Helper()
+	typed := make([]genclient.TypedTaggedEventStreamEnvelope, 0, len(items))
+	for _, item := range items {
+		data, err := json.Marshal(item)
+		if err != nil {
+			t.Fatalf("marshal supervisor event item: %v", err)
+		}
+		var envelope genclient.TypedTaggedEventStreamEnvelope
+		if err := envelope.UnmarshalJSON(data); err != nil {
+			t.Fatalf("unmarshal typed supervisor event item: %v; item=%s", err, data)
+		}
+		typed = append(typed, envelope)
+	}
+	return genclient.SupervisorEventListOutputBody{Items: &typed, Total: int64(len(typed))}
+}
+
 func writeProblemResponse(t *testing.T, w http.ResponseWriter, body any) {
 	t.Helper()
 	w.Header().Set("Content-Type", "application/problem+json")
diff --git a/cmd/gc/cmd_handoff.go b/cmd/gc/cmd_handoff.go
index 5675c6ca63..b66d73e3ec 100644
--- a/cmd/gc/cmd_handoff.go
+++ b/cmd/gc/cmd_handoff.go
@@ -17,8 +17,9 @@ import (
 
 func newHandoffCmd(stdout, stderr io.Writer) *cobra.Command {
 	var target string
+	var auto bool
 	cmd := &cobra.Command{
-		Use:   "handoff <subject> [message]",
+		Use:   "handoff [subject] [message]",
 		Short: "Send handoff mail and restart controller-managed sessions",
 		Long: `Convenience command for context handoff.
 
@@ -33,6 +34,10 @@ For controller-restartable sessions, equivalent to:
   gc mail send $GC_ALIAS <subject> [message]
   gc runtime request-restart
 
+Auto handoff (--auto): sends mail to self and returns without requesting a
+restart. This is for PreCompact hooks, where the provider is already managing
+the context compaction lifecycle.
+
 Remote handoff (--target): sends mail to a target session. If the target is
 controller-restartable, kills it so the reconciler restarts it with the handoff
 mail waiting. For on-demand configured named targets, sends mail and returns
@@ -44,21 +49,32 @@ For controller-restartable targets, equivalent to:
   gc session kill <target>
 
 Self-handoff requires session context (GC_ALIAS or GC_SESSION_ID, plus
-GC_SESSION_NAME and city context env). Remote handoff accepts a session alias or ID.`,
-		Args: cobra.RangeArgs(1, 2),
+GC_SESSION_NAME and city context env). Remote handoff accepts a session alias
+or ID. Subject is required unless --auto is set.`,
+		Args: func(cmd *cobra.Command, args []string) error {
+			if auto {
+				return cobra.MaximumNArgs(2)(cmd, args)
+			}
+			return cobra.RangeArgs(1, 2)(cmd, args)
+		},
 		RunE: func(_ *cobra.Command, args []string) error {
-			if cmdHandoff(args, target, stdout, stderr) != 0 {
+			if cmdHandoff(args, target, auto, stdout, stderr) != 0 {
 				return errExit
 			}
 			return nil
 		},
 	}
 	cmd.Flags().StringVar(&target, "target", "", "Remote session alias or ID to handoff (kills only controller-restartable sessions)")
+	cmd.Flags().BoolVar(&auto, "auto", false, "Send handoff mail without requesting restart (for PreCompact hooks)")
 	return cmd
 }
 
-func cmdHandoff(args []string, target string, stdout, stderr io.Writer) int {
+func cmdHandoff(args []string, target string, auto bool, stdout, stderr io.Writer) int {
 	if target != "" {
+		if auto {
+			fmt.Fprintln(stderr, "gc handoff: --auto cannot be used with --target") //nolint:errcheck // best-effort stderr
+			return 1
+		}
 		return cmdHandoffRemote(args, target, stdout, stderr)
 	}
 
@@ -74,9 +90,13 @@ func cmdHandoff(args []string, target string, stdout, stderr io.Writer) int {
 		fmt.Fprintln(stderr, "hint: run \"gc doctor\" for diagnostics") //nolint:errcheck // best-effort stderr
 		return 1
 	}
+	rec := openCityRecorderAt(current.cityPath, stderr)
+	if auto {
+		return doHandoffAuto(store, rec, current.display, args, stdout, stderr)
+	}
+
 	sp := newSessionProvider()
 	dops := newDrainOps(sp)
-	rec := openCityRecorderAt(current.cityPath, stderr)
 	cfg, _ := loadCityConfig(current.cityPath, stderr)
 	persistRestart := sessionRestartPersister(current.cityPath, store, sp, cfg, current.sessionName)
 
@@ -92,8 +112,8 @@ func cmdHandoff(args []string, target string, stdout, stderr io.Writer) int {
 	select {}
 }
 
-// cmdHandoffRemote sends handoff mail to a remote session and stops the target
-// only when the controller can restart it. Returns immediately.
+// cmdHandoffRemote sends handoff mail to a remote session and kills its runtime.
+// Returns immediately (non-blocking). The reconciler restarts the target.
 func cmdHandoffRemote(args []string, target string, stdout, stderr io.Writer) int {
 	targetInfo, err := resolveSessionRuntimeTarget(target, stderr)
 	if err != nil {
@@ -150,48 +170,23 @@ func doHandoff(store beads.Store, rec events.Recorder, dops drainOps, persistRes
 func doHandoffWithOutcome(store beads.Store, rec events.Recorder, dops drainOps, persistRestart func() error,
 	sessionAddress, sessionName string, args []string, stdout, stderr io.Writer,
 ) handoffOutcome {
-	subject := args[0]
-	var message string
-	if len(args) > 1 {
-		message = args[1]
-	}
-
-	b, err := store.Create(beads.Bead{
-		Title:       subject,
-		Description: message,
-		Type:        "message",
-		Assignee:    sessionAddress,
-		From:        sessionAddress,
-		Labels:      []string{"thread:" + handoffThreadID()},
-	})
-	if err != nil {
-		fmt.Fprintf(stderr, "gc handoff: creating mail: %v\n", err) //nolint:errcheck // best-effort stderr
+	b, ok := createHandoffMail(store, rec, sessionAddress, sessionAddress, args, "HANDOFF: context cycle", stderr)
+	if !ok {
 		return handoffOutcome{code: 1}
 	}
-	rec.Record(events.Event{
-		Type:    events.MailSent,
-		Actor:   sessionAddress,
-		Subject: b.ID,
-		Message: sessionAddress,
-		Payload: mailEventPayload(nil),
-	})
 
 	restartable, err := sessionRestartableByController(store, sessionName)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc handoff: checking session type: %v\n", err) //nolint:errcheck // best-effort stderr
 		return handoffOutcome{code: 1}
 	}
-	// On-demand named sessions are human-attended and the controller cannot
-	// respawn their process after a restart request. Preserve the handoff
-	// mail so context survives, but skip both restart flags. Regression
-	// guard: gastownhall/gascity#744.
 	if !restartable {
 		if err := clearRestartRequest(store, dops, sessionName); err != nil {
 			fmt.Fprintf(stderr, "gc handoff: clearing stale restart request: %v\n", err) //nolint:errcheck // best-effort stderr
-			return handoffOutcome{code: 1, restartRequested: false}
+			return handoffOutcome{code: 1}
 		}
 		fmt.Fprintf(stdout, "Handoff: sent mail %s (named session; restart skipped).\n", b.ID) //nolint:errcheck // best-effort stdout
-		return handoffOutcome{code: 0, restartRequested: false}
+		return handoffOutcome{code: 0}
 	}
 
 	if err := dops.setRestartRequested(sessionName); err != nil {
@@ -216,6 +211,55 @@ func doHandoffWithOutcome(store beads.Store, rec events.Recorder, dops drainOps,
 	return handoffOutcome{code: 0, restartRequested: true}
 }
 
+// doHandoffAuto sends handoff mail to self without requesting restart.
+func doHandoffAuto(store beads.Store, rec events.Recorder, sessionAddress string, args []string, stdout, stderr io.Writer) int {
+	b, ok := createHandoffMail(store, rec, sessionAddress, sessionAddress, args, "context cycle", stderr)
+	if !ok {
+		return 1
+	}
+	fmt.Fprintf(stdout, "Handoff: sent auto mail %s (restart skipped).\n", b.ID) //nolint:errcheck // best-effort stdout
+	return 0
+}
+
+func createHandoffMail(store beads.Store, rec events.Recorder, senderAddress, recipientAddress string, args []string, defaultSubject string, stderr io.Writer) (beads.Bead, bool) {
+	subject := defaultSubject
+	if len(args) > 0 {
+		subject = args[0]
+	}
+	var message string
+	if len(args) > 1 {
+		message = args[1]
+	}
+	metadata, err := mailSenderRouteMetadata(store, senderAddress)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc handoff: resolving sender route: %v\n", err) //nolint:errcheck // best-effort stderr
+		return beads.Bead{}, false
+	}
+	senderDisplay := mailSenderDisplayFromMetadata(senderAddress, metadata)
+
+	b, err := store.Create(beads.Bead{
+		Title:       subject,
+		Description: message,
+		Type:        "message",
+		Assignee:    recipientAddress,
+		From:        senderDisplay,
+		Labels:      []string{"thread:" + handoffThreadID()},
+		Metadata:    metadata,
+	})
+	if err != nil {
+		fmt.Fprintf(stderr, "gc handoff: creating mail: %v\n", err) //nolint:errcheck // best-effort stderr
+		return beads.Bead{}, false
+	}
+	rec.Record(events.Event{
+		Type:    events.MailSent,
+		Actor:   senderDisplay,
+		Subject: b.ID,
+		Message: recipientAddress,
+		Payload: mailEventPayload(nil),
+	})
+	return b, true
+}
+
 func sessionRestartableByController(store beads.Store, sessionName string) (bool, error) {
 	if store == nil || sessionName == "" {
 		return true, nil
@@ -267,37 +311,15 @@ func clearRestartRequest(store beads.Store, dops drainOps, sessionName string) e
 	return errors.Join(errs...)
 }
 
-// doHandoffRemote sends handoff mail to a remote session and stops the target
-// only when the controller can restart it.
+// doHandoffRemote sends handoff mail to a remote session and kills its runtime.
+// Non-blocking: returns immediately after killing the session.
 func doHandoffRemote(store beads.Store, rec events.Recorder, sp runtime.Provider,
 	sessionName, targetAddress, sender string, args []string, stdout, stderr io.Writer,
 ) int {
-	subject := args[0]
-	var message string
-	if len(args) > 1 {
-		message = args[1]
-	}
-
-	// Send mail to target.
-	b, err := store.Create(beads.Bead{
-		Title:       subject,
-		Description: message,
-		Type:        "message",
-		Assignee:    targetAddress,
-		From:        sender,
-		Labels:      []string{"thread:" + handoffThreadID()},
-	})
-	if err != nil {
-		fmt.Fprintf(stderr, "gc handoff: creating mail: %v\n", err) //nolint:errcheck // best-effort stderr
+	b, ok := createHandoffMail(store, rec, sender, targetAddress, args, "HANDOFF: context cycle", stderr)
+	if !ok {
 		return 1
 	}
-	rec.Record(events.Event{
-		Type:    events.MailSent,
-		Actor:   sender,
-		Subject: b.ID,
-		Message: targetAddress,
-		Payload: mailEventPayload(nil),
-	})
 
 	restartable, err := sessionRestartableByController(store, sessionName)
 	if err != nil {
diff --git a/cmd/gc/cmd_handoff_test.go b/cmd/gc/cmd_handoff_test.go
index 0ceba9e951..9b83daec87 100644
--- a/cmd/gc/cmd_handoff_test.go
+++ b/cmd/gc/cmd_handoff_test.go
@@ -75,22 +75,112 @@ func TestHandoffSuccess(t *testing.T) {
 	}
 }
 
+func TestCmdHandoffAutoSendsMailWithoutBlocking(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", cityDir)
+	t.Setenv("GC_ALIAS", "mayor")
+	t.Setenv("GC_SESSION_NAME", "mayor")
+
+	var stdout, stderr bytes.Buffer
+	cmd := newHandoffCmd(&stdout, &stderr)
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+	cmd.SetArgs([]string{"--auto", "context cycle"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("gc handoff --auto failed: %v; stderr=%s", err, stderr.String())
+	}
+
+	store, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	all, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("ListOpen: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("got %d open beads, want 1", len(all))
+	}
+	if got := all[0].Title; got != "context cycle" {
+		t.Fatalf("mail title = %q, want context cycle", got)
+	}
+	if got := all[0].Type; got != "message" {
+		t.Fatalf("mail type = %q, want message", got)
+	}
+	if strings.Contains(stdout.String(), "requesting restart") {
+		t.Fatalf("stdout = %q, --auto must not request restart", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), "auto") {
+		t.Fatalf("stdout = %q, want auto handoff confirmation", stdout.String())
+	}
+}
+
+func TestCmdHandoffAutoUsesDefaultSubject(t *testing.T) {
+	cityDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", cityDir)
+	t.Setenv("GC_ALIAS", "mayor")
+	t.Setenv("GC_SESSION_NAME", "mayor")
+
+	var stdout, stderr bytes.Buffer
+	cmd := newHandoffCmd(&stdout, &stderr)
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+	cmd.SetArgs([]string{"--auto"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("gc handoff --auto failed: %v; stderr=%s", err, stderr.String())
+	}
+
+	store, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	all, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("ListOpen: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("got %d open beads, want 1", len(all))
+	}
+	if got := all[0].Title; got != "context cycle" {
+		t.Fatalf("mail title = %q, want context cycle", got)
+	}
+}
+
+func TestCmdHandoffAutoRejectsTarget(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if code := cmdHandoff([]string{"context cycle"}, "mayor", true, &stdout, &stderr); code == 0 {
+		t.Fatal("cmdHandoff returned 0 for --auto with --target")
+	}
+	if !strings.Contains(stderr.String(), "--auto cannot be used with --target") {
+		t.Fatalf("stderr = %q, want --auto/--target conflict", stderr.String())
+	}
+}
+
 // Regression for gastownhall/gascity#744:
 // gc handoff on a named (human-attended) session used to call
 // setRestartRequested unconditionally. The controller cannot respawn a
-// user-started session, so the PreCompact hook crashed the mayor to the
-// user's shell on every context compaction. doHandoff must recognize the
-// named-session case, still send the handoff mail, and skip both the
-// tmux and bead restart flags.
+// user-started session, so the PreCompact hook crashed the user to their shell
+// on every context compaction. doHandoff must recognize the named-session
+// case, still send the handoff mail, and skip both the tmux and bead restart
+// flags.
 func TestDoHandoff_Regression744_NamedSessionSkipsRestart(t *testing.T) {
 	store := beads.NewMemStore()
 	rec := events.NewFake()
 	dops := newFakeDrainOps()
 	var stdout, stderr bytes.Buffer
 
-	// Seed a session bead marked as a configured named session (i.e. the
-	// mayor). IsNamedSessionBead returns true for beads whose metadata
-	// contains configured_named_session="true".
 	b, err := store.Create(beads.Bead{
 		Type:   sessionBeadType,
 		Labels: []string{"gc:session"},
@@ -119,8 +209,7 @@ func TestDoHandoff_Regression744_NamedSessionSkipsRestart(t *testing.T) {
 	outcome := doHandoffWithOutcome(store, rec, dops, func() error {
 		persistCalled = true
 		return nil
-	}, "mayor", "mayor",
-		[]string{"HANDOFF: context full"}, &stdout, &stderr)
+	}, "mayor", "mayor", []string{"HANDOFF: context full"}, &stdout, &stderr)
 	if outcome.code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", outcome.code, stderr.String())
 	}
@@ -128,7 +217,6 @@ func TestDoHandoff_Regression744_NamedSessionSkipsRestart(t *testing.T) {
 		t.Fatal("restartRequested = true, want false for on-demand named session")
 	}
 
-	// Mail must still be sent — context preservation is the whole point.
 	mailFound := false
 	all, _ := store.ListOpen()
 	for _, got := range all {
@@ -140,18 +228,12 @@ func TestDoHandoff_Regression744_NamedSessionSkipsRestart(t *testing.T) {
 	if !mailFound {
 		t.Fatalf("handoff mail not created; beads=%v", all)
 	}
-
-	// Restart must NOT be requested — the controller can't respawn a
-	// user-started named session.
 	if dops.restartRequested["mayor"] {
-		t.Errorf("restart-requested flag is still set — named sessions must skip restart (gascity#744)")
+		t.Errorf("restart-requested flag is still set; named sessions must skip restart")
 	}
 	if persistCalled {
-		t.Error("persistRestart was called — named sessions must skip persisted restart requests")
+		t.Error("persistRestart was called; named sessions must skip persisted restart requests")
 	}
-
-	// Bead-level restart flags must also be absent, including stale flags
-	// left behind by older handoff implementations.
 	refreshed, err := store.Get(b.ID)
 	if err != nil {
 		t.Fatalf("fetching seeded bead: %v", err)
@@ -162,8 +244,6 @@ func TestDoHandoff_Regression744_NamedSessionSkipsRestart(t *testing.T) {
 	if refreshed.Metadata["continuation_reset_pending"] != "" {
 		t.Errorf("continuation_reset_pending = %q, want cleared for named session", refreshed.Metadata["continuation_reset_pending"])
 	}
-
-	// Stdout should not promise a restart the controller can't deliver.
 	if strings.Contains(stdout.String(), "requesting restart") {
 		t.Errorf("stdout = %q, must not promise a restart for named sessions", stdout.String())
 	}
@@ -263,12 +343,36 @@ func TestDoHandoff_NamedAlwaysSessionRequestsRestart(t *testing.T) {
 	}
 }
 
+func TestHandoffWithMessage(t *testing.T) {
+	store := beads.NewMemStore()
+	rec := events.NewFake()
+	dops := newFakeDrainOps()
+	var stdout, stderr bytes.Buffer
+
+	code := doHandoff(store, rec, dops, nil, "polecat-1", "gc-city-polecat-1",
+		[]string{"HANDOFF: PR review needed", "PR #42 is open, tests passing, needs review from refinery"},
+		&stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	all, _ := store.ListOpen()
+	if len(all) != 1 {
+		t.Fatalf("got %d beads, want 1", len(all))
+	}
+	b := all[0]
+	if b.Description != "PR #42 is open, tests passing, needs review from refinery" {
+		t.Errorf("Description = %q, want body text", b.Description)
+	}
+}
+
 func TestCmdHandoff_Regression744_NamedSessionReturnsWithoutBlocking(t *testing.T) {
 	cityDir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte("[workspace]\nname = \"demo\"\n"), 0o644); err != nil {
 		t.Fatalf("write city.toml: %v", err)
 	}
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_CITY_PATH", cityDir)
 	t.Setenv("GC_ALIAS", "mayor")
@@ -298,7 +402,7 @@ func TestCmdHandoff_Regression744_NamedSessionReturnsWithoutBlocking(t *testing.
 	var stdout, stderr bytes.Buffer
 	done := make(chan int, 1)
 	go func() {
-		done <- cmdHandoff([]string{"HANDOFF: context full"}, "", &stdout, &stderr)
+		done <- cmdHandoff([]string{"HANDOFF: context full"}, "", false, &stdout, &stderr)
 	}()
 
 	select {
@@ -306,7 +410,7 @@ func TestCmdHandoff_Regression744_NamedSessionReturnsWithoutBlocking(t *testing.
 		if code != 0 {
 			t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
 		}
-	case <-time.After(2 * time.Second):
+	case <-time.After(10 * time.Second):
 		t.Fatal("cmdHandoff blocked for named on-demand session")
 	}
 	if !strings.Contains(stdout.String(), "restart skipped") {
@@ -314,29 +418,6 @@ func TestCmdHandoff_Regression744_NamedSessionReturnsWithoutBlocking(t *testing.
 	}
 }
 
-func TestHandoffWithMessage(t *testing.T) {
-	store := beads.NewMemStore()
-	rec := events.NewFake()
-	dops := newFakeDrainOps()
-	var stdout, stderr bytes.Buffer
-
-	code := doHandoff(store, rec, dops, nil, "polecat-1", "gc-city-polecat-1",
-		[]string{"HANDOFF: PR review needed", "PR #42 is open, tests passing, needs review from refinery"},
-		&stdout, &stderr)
-	if code != 0 {
-		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
-	}
-
-	all, _ := store.ListOpen()
-	if len(all) != 1 {
-		t.Fatalf("got %d beads, want 1", len(all))
-	}
-	b := all[0]
-	if b.Description != "PR #42 is open, tests passing, needs review from refinery" {
-		t.Errorf("Description = %q, want body text", b.Description)
-	}
-}
-
 func TestHandoffMissingSubject(t *testing.T) {
 	store := beads.NewMemStore()
 	rec := events.NewFake()
@@ -537,6 +618,7 @@ func TestHandoffRemoteNotRunning(t *testing.T) {
 
 func TestCmdHandoffRemoteDefaultSenderFallsBackToGCAliasWhenSessionIDMissing(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	t.Setenv("GC_MAIL", "")
 
 	cityPath := t.TempDir()
@@ -549,14 +631,15 @@ func TestCmdHandoffRemoteDefaultSenderFallsBackToGCAliasWhenSessionIDMissing(t *
 	if err != nil {
 		t.Fatalf("openCityStoreAt: %v", err)
 	}
-	if _, err := store.Create(beads.Bead{
+	senderBead, err := store.Create(beads.Bead{
 		Type:   session.BeadType,
 		Labels: []string{session.LabelSession},
 		Metadata: map[string]string{
 			"alias":        "sender",
 			"session_name": "sender-gc-42",
 		},
-	}); err != nil {
+	})
+	if err != nil {
 		t.Fatalf("Create sender: %v", err)
 	}
 	if _, err := store.Create(beads.Bead{
@@ -603,6 +686,12 @@ func TestCmdHandoffRemoteDefaultSenderFallsBackToGCAliasWhenSessionIDMissing(t *
 	if msg.From != "sender" {
 		t.Fatalf("message From = %q, want sender", msg.From)
 	}
+	if msg.Metadata["mail.from_session_id"] != senderBead.ID {
+		t.Fatalf("mail.from_session_id = %q, want %q", msg.Metadata["mail.from_session_id"], senderBead.ID)
+	}
+	if msg.Metadata["mail.from_display"] != "sender" {
+		t.Fatalf("mail.from_display = %q, want sender", msg.Metadata["mail.from_display"])
+	}
 	if msg.Assignee != "recipient" {
 		t.Fatalf("message Assignee = %q, want recipient", msg.Assignee)
 	}
diff --git a/cmd/gc/cmd_hook.go b/cmd/gc/cmd_hook.go
index f40525f99f..d55890fd61 100644
--- a/cmd/gc/cmd_hook.go
+++ b/cmd/gc/cmd_hook.go
@@ -20,38 +20,44 @@ func newHookCmd(stdout, stderr io.Writer) *cobra.Command {
 	var hookFormat string
 	cmd := &cobra.Command{
 		Use:   "hook [agent]",
-		Short: "Check for available work (use --inject for Stop hook output)",
+		Short: "Check for available work",
 		Long: `Checks for available work using the agent's work_query config.
 
 Without --inject: prints raw output, exits 0 if work exists, 1 if empty.
-With --inject: wraps output in <system-reminder> for hook injection, always exits 0.
+With --inject: silent legacy Stop-hook compatibility; skips the work query and always exits 0.
 
 		The agent is determined from $GC_AGENT or a positional argument.`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(_ *cobra.Command, args []string) error {
-			code := cmdHook(args, inject, stdout, stderr)
-			if hookFormat != "" {
-				code = cmdHookWithFormat(args, inject, hookFormat, stdout, stderr)
-			}
-			if code != 0 {
+			if cmdHookWithFormat(args, inject, hookFormat, stdout, stderr) != 0 {
 				return errExit
 			}
 			return nil
 		},
 	}
-	cmd.Flags().BoolVar(&inject, "inject", false, "output <system-reminder> block for hook injection")
+	cmd.Flags().BoolVar(&inject, "inject", false, "silent legacy Stop-hook compatibility; skip work query and exit 0")
 	cmd.Flags().StringVar(&hookFormat, "hook-format", "", "format hook output for a provider")
+	if flag := cmd.Flags().Lookup("hook-format"); flag != nil {
+		flag.Hidden = true
+	}
 	return cmd
 }
 
 // cmdHook is the CLI entry point for gc hook. Resolves the agent from
 // $GC_AGENT or a positional argument, loads the city config, and runs
 // the agent's work query.
-func cmdHook(args []string, inject bool, stdout, stderr io.Writer) int {
-	return cmdHookWithFormat(args, inject, "", stdout, stderr)
+func cmdHook(args []string, stdout, stderr io.Writer) int {
+	return cmdHookWithFormat(args, false, "", stdout, stderr)
 }
 
 func cmdHookWithFormat(args []string, inject bool, hookFormat string, stdout, stderr io.Writer) int {
+	if inject {
+		return 0
+	}
+	// Accepted for compatibility with installed hook commands; non-inject
+	// gc hook output is intentionally raw regardless of provider format.
+	_ = hookFormat
+
 	agentName := os.Getenv("GC_ALIAS")
 	if agentName == "" {
 		agentName = os.Getenv("GC_AGENT")
@@ -70,26 +76,17 @@ func cmdHookWithFormat(args []string, inject bool, hookFormat string, stdout, st
 		agentName = args[0]
 	}
 	if agentName == "" {
-		if inject {
-			return 0 // --inject always exits 0
-		}
 		fmt.Fprintln(stderr, "gc hook: agent not specified (set $GC_AGENT or pass as argument)") //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	cityPath, err := resolveCity()
 	if err != nil {
-		if inject {
-			return 0
-		}
 		fmt.Fprintf(stderr, "gc hook: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 	cfg, err := loadCityConfig(cityPath, stderr)
 	if err != nil {
-		if inject {
-			return 0
-		}
 		fmt.Fprintf(stderr, "gc hook: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
@@ -100,26 +97,17 @@ func cmdHookWithFormat(args []string, inject bool, hookFormat string, stdout, st
 	resolveRigPaths(cityPath, cfg.Rigs)
 
 	if citySuspended(cfg) {
-		if inject {
-			return 0
-		}
 		fmt.Fprintln(stderr, "gc hook: city is suspended") //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	a, ok := resolveAgentIdentity(cfg, agentName, currentRigContext(cfg))
 	if !ok {
-		if inject {
-			return 0
-		}
 		fmt.Fprintf(stderr, "gc hook: agent %q not found in config\n", agentName) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	if isAgentEffectivelySuspended(cfg, &a) {
-		if inject {
-			return 0
-		}
 		fmt.Fprintf(stderr, "gc hook: agent %q is suspended\n", agentName) //nolint:errcheck // best-effort stderr
 		return 1
 	}
@@ -140,9 +128,8 @@ func cmdHookWithFormat(args []string, inject bool, hookFormat string, stdout, st
 	// names; named-session context preserves the runtime-supplied owner
 	// env while selecting the backing config through GC_TEMPLATE.
 	resolvedAgentName := a.QualifiedName()
-	resolvedSessionName := cliSessionName(cityPath, cityName, resolvedAgentName, cfg.Workspace.SessionTemplate)
 	agentForQuery := resolvedAgentName
-	sessionForQuery := resolvedSessionName
+	sessionForQuery := ""
 	if sessionTemplateContext {
 		agentForQuery = os.Getenv("GC_ALIAS")
 		if agentForQuery == "" {
@@ -152,6 +139,8 @@ func cmdHookWithFormat(args []string, inject bool, hookFormat string, stdout, st
 			agentForQuery = os.Getenv("GC_AGENT")
 		}
 		sessionForQuery = os.Getenv("GC_SESSION_NAME")
+	} else {
+		sessionForQuery = cliSessionName(cityPath, cityName, resolvedAgentName, cfg.Workspace.SessionTemplate)
 	}
 	overrides := hookQueryEnv(cityPath, cfg, &a)
 	overrides["GC_AGENT"] = agentForQuery
@@ -166,7 +155,7 @@ func cmdHookWithFormat(args []string, inject bool, hookFormat string, stdout, st
 	runner := func(command, dir string) (string, error) {
 		return shellWorkQueryWithEnv(command, dir, queryEnv)
 	}
-	return doHookWithFormat(workQuery, workDir, inject, hookFormat, runner, stdout, stderr)
+	return doHook(workQuery, workDir, inject, runner, stdout, stderr)
 }
 
 // hookQueryEnv returns the full work-query environment for a hook subprocess.
@@ -198,9 +187,7 @@ func shellWorkQueryWithEnv(command, dir string, env []string) (string, error) {
 	if dir != "" {
 		cmd.Dir = dir
 	}
-	if env != nil {
-		cmd.Env = workQueryEnvForDir(env, dir)
-	}
+	cmd.Env = workQueryEnvForDir(env, dir)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("running work query %q: %w", command, err)
@@ -215,7 +202,7 @@ func shellWorkQueryWithEnv(command, dir string, env []string) (string, error) {
 // that inspect $PWD.
 func workQueryEnvForDir(env []string, dir string) []string {
 	if env == nil {
-		return nil
+		env = mergeRuntimeEnv(os.Environ(), nil)
 	}
 	if dir == "" {
 		return env
@@ -226,17 +213,14 @@ func workQueryEnvForDir(env []string, dir string) []string {
 
 // doHook is the pure logic for gc hook. Runs the work query and outputs
 // results based on mode. Without inject: prints raw output, returns 0 if
-// work, 1 if empty. With inject: wraps in <system-reminder>, always returns 0.
+// work, 1 if empty. With inject: skips the work query and returns 0.
 func doHook(workQuery, dir string, inject bool, runner WorkQueryRunner, stdout, stderr io.Writer) int {
-	return doHookWithFormat(workQuery, dir, inject, "", runner, stdout, stderr)
-}
+	if inject {
+		return 0
+	}
 
-func doHookWithFormat(workQuery, dir string, inject bool, hookFormat string, runner WorkQueryRunner, stdout, stderr io.Writer) int {
 	output, err := runner(workQuery, dir)
 	if err != nil {
-		if inject {
-			return 0 // --inject always exits 0
-		}
 		fmt.Fprintf(stderr, "gc hook: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
@@ -245,14 +229,6 @@ func doHookWithFormat(workQuery, dir string, inject bool, hookFormat string, run
 	normalized := normalizeWorkQueryOutput(trimmed)
 	hasWork := workQueryHasReadyWork(normalized)
 
-	if inject {
-		if hasWork {
-			content := formatHookInjectReminder(normalized)
-			_ = writeProviderHookContext(stdout, hookFormat, content)
-		}
-		return 0 // --inject always exits 0
-	}
-
 	// Non-inject mode: print raw output. Return 0 only when work exists.
 	if !hasWork {
 		if normalized != "" {
@@ -264,23 +240,6 @@ func doHookWithFormat(workQuery, dir string, inject bool, hookFormat string, run
 	return 0
 }
 
-func formatHookInjectReminder(normalizedWork string) string {
-	return fmt.Sprintf(`<system-reminder>
-You have pending work. Pick up the next item:
-
-<work-items>
-%s
-</work-items>
-
-Use the bead id from the work item:
-- If the item is not assigned to you yet, run `+"`bd update <id> --claim`"+`.
-- Do the requested work.
-- When done, run `+"`bd close <id>`"+`.
-Run `+"`gc hook`"+` to see the full queue.
-</system-reminder>
-`, normalizedWork)
-}
-
 func workQueryHasReadyWork(output string) bool {
 	if output == "" {
 		return false
diff --git a/cmd/gc/cmd_hook_test.go b/cmd/gc/cmd_hook_test.go
index 6f39547b8e..0f7ad12b47 100644
--- a/cmd/gc/cmd_hook_test.go
+++ b/cmd/gc/cmd_hook_test.go
@@ -85,34 +85,192 @@ func TestHookInjectSuppressesNoReadyMessage(t *testing.T) {
 	}
 }
 
-func TestHookInjectFormatsOutput(t *testing.T) {
+func TestHookInjectIsNonIntrusiveWithWork(t *testing.T) {
 	runner := func(string, string) (string, error) { return "hw-1  open  Fix the bug\n", nil }
 	var stdout, stderr bytes.Buffer
 	code := doHook("bd ready", "", true, runner, &stdout, &stderr)
 	if code != 0 {
 		t.Errorf("doHook(inject, work) = %d, want 0", code)
 	}
-	out := stdout.String()
-	if !strings.Contains(out, "<system-reminder>") {
-		t.Errorf("stdout missing <system-reminder>: %q", out)
+	if stdout.Len() != 0 {
+		t.Errorf("stdout = %q, want empty non-intrusive inject output", stdout.String())
+	}
+}
+
+func TestHookInjectDoesNotRunWorkQuery(t *testing.T) {
+	called := false
+	runner := func(string, string) (string, error) {
+		called = true
+		return "hw-1  open  Fix the bug\n", nil
+	}
+	var stdout, stderr bytes.Buffer
+	code := doHook("bd ready", "", true, runner, &stdout, &stderr)
+	if code != 0 {
+		t.Errorf("doHook(inject, work) = %d, want 0", code)
+	}
+	if called {
+		t.Fatal("inject mode ran the work query even though its output is ignored")
+	}
+	if stdout.Len() != 0 {
+		t.Errorf("stdout = %q, want empty non-intrusive inject output", stdout.String())
+	}
+	if stderr.Len() != 0 {
+		t.Errorf("stderr = %q, want empty", stderr.String())
+	}
+}
+
+func TestHookCommandCodexInjectDoesNotBlockStop(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := `[workspace]
+name = "test-city"
+
+[[agent]]
+name = "worker"
+work_query = "printf '[{\"id\":\"hw-1\",\"title\":\"Fix the bug\"}]'"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	var stdout, stderr bytes.Buffer
+	cmd := newHookCmd(&stdout, &stderr)
+	cmd.SetArgs([]string{"worker", "--inject", "--hook-format", "codex"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("gc hook command failed: %v; stderr=%s", err, stderr.String())
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty non-blocking Stop hook output", stdout.String())
+	}
+}
+
+func TestHookCommandInjectSkipsConfiguredWorkQuery(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	marker := filepath.Join(t.TempDir(), "work-query-ran")
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := fmt.Sprintf(`[workspace]
+name = "test-city"
+
+[[agent]]
+name = "worker"
+work_query = "printf ran > %q"
+`, marker)
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	var stdout, stderr bytes.Buffer
+	cmd := newHookCmd(&stdout, &stderr)
+	cmd.SetArgs([]string{"worker", "--inject", "--hook-format", "codex"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("gc hook command failed: %v; stderr=%s", err, stderr.String())
 	}
-	if !strings.Contains(out, "</system-reminder>") {
-		t.Errorf("stdout missing </system-reminder>: %q", out)
+	if _, err := os.Stat(marker); !os.IsNotExist(err) {
+		t.Fatalf("inject mode ran configured work_query; marker stat err=%v", err)
 	}
-	if !strings.Contains(out, "<work-items>") {
-		t.Errorf("stdout missing <work-items>: %q", out)
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty non-blocking Stop hook output", stdout.String())
+	}
+}
+
+func TestHookCommandHookFormatIsIgnoredForNonInjectOutput(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := `[workspace]
+name = "test-city"
+
+[[agent]]
+name = "worker"
+work_query = "printf '[{\"id\":\"hw-1\",\"title\":\"Fix the bug\"}]'"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_CITY", cityDir)
+
+	run := func(args ...string) (string, string, error) {
+		var stdout, stderr bytes.Buffer
+		cmd := newHookCmd(&stdout, &stderr)
+		cmd.SetArgs(args)
+		err := cmd.Execute()
+		return stdout.String(), stderr.String(), err
+	}
+
+	rawOut, rawErr, err := run("worker")
+	if err != nil {
+		t.Fatalf("gc hook worker failed: %v; stderr=%s", err, rawErr)
+	}
+	formattedOut, formattedErr, err := run("worker", "--hook-format", "codex")
+	if err != nil {
+		t.Fatalf("gc hook worker --hook-format codex failed: %v; stderr=%s", err, formattedErr)
+	}
+	if formattedOut != rawOut {
+		t.Fatalf("hook-format changed non-inject output:\nraw:       %q\nformatted: %q", rawOut, formattedOut)
+	}
+	if formattedErr != rawErr {
+		t.Fatalf("hook-format changed non-inject stderr:\nraw:       %q\nformatted: %q", rawErr, formattedErr)
+	}
+	if strings.Contains(formattedOut, "system-reminder") {
+		t.Fatalf("non-inject hook output was provider-formatted: %q", formattedOut)
 	}
-	if !strings.Contains(out, "hw-1") {
-		t.Errorf("stdout missing work item: %q", out)
+}
+
+func TestCmdHookSessionTemplateContextDoesNotScanSessionsForName(t *testing.T) {
+	clearGCEnv(t)
+	cityDir := t.TempDir()
+	fakeBin := t.TempDir()
+	logPath := filepath.Join(t.TempDir(), "bd.log")
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := `[workspace]
+name = "test-city"
+
+[[agent]]
+name = "worker"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	fakeBD := filepath.Join(fakeBin, "bd")
+	script := fmt.Sprintf("#!/bin/sh\nprintf '%%s\\n' \"$*\" >> %q\nprintf '[]'\n", logPath)
+	if err := os.WriteFile(fakeBD, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("PATH", fakeBin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_TEMPLATE", "worker")
+	t.Setenv("GC_ALIAS", "worker-1")
+	t.Setenv("GC_SESSION_ID", "mc-session")
+	t.Setenv("GC_SESSION_NAME", "runtime-session")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdHookWithFormat(nil, false, "", &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("cmdHookWithFormat() = %d, want 1 for empty work; stderr=%s", code, stderr.String())
 	}
-	if !strings.Contains(out, "gc hook") {
-		t.Errorf("stdout missing 'gc hook' hint: %q", out)
+	logData, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", logPath, err)
 	}
-	if !strings.Contains(out, "bd update <id> --claim") {
-		t.Errorf("stdout missing claim command: %q", out)
+	logText := string(logData)
+	if strings.Contains(logText, "--label=gc:session") {
+		t.Fatalf("gc hook scanned all session beads before running work_query:\n%s", logText)
 	}
-	if !strings.Contains(out, "bd close <id>") {
-		t.Errorf("stdout missing close command: %q", out)
+	if !strings.Contains(logText, "--assignee=runtime-session") {
+		t.Fatalf("gc hook did not pass runtime session name into work_query; bd log:\n%s", logText)
 	}
 }
 
@@ -213,7 +371,7 @@ max = 5
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook(nil, false, &stdout, &stderr)
+	code := cmdHook(nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -292,7 +450,7 @@ dir = "myrig"
 	t.Setenv("BEADS_DIR", cityBeads)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook([]string{"worker"}, false, &stdout, &stderr)
+	code := cmdHook([]string{"worker"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -359,7 +517,7 @@ dir = "myrig"
 	t.Setenv("GC_DIR", rigAbs)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook([]string{"worker"}, false, &stdout, &stderr)
+	code := cmdHook([]string{"worker"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -416,7 +574,7 @@ work_query = "bd {{.CityName}} {{.Rig}} {{.AgentBase}}"
 	t.Setenv("GC_DIR", rigDir)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook([]string{"worker"}, false, &stdout, &stderr)
+	code := cmdHook([]string{"worker"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -464,7 +622,7 @@ dir = "workdir"
 	t.Setenv("GC_CITY", cityDir)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook([]string{"worker"}, false, &stdout, &stderr)
+	code := cmdHook([]string{"worker"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -538,7 +696,7 @@ max = 5
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook(nil, false, &stdout, &stderr)
+	code := cmdHook(nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -602,7 +760,7 @@ name = "worker"
 	t.Setenv("GC_CITY", cityDir)
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook([]string{"worker"}, false, &stdout, &stderr)
+	code := cmdHook([]string{"worker"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -662,7 +820,7 @@ dir = "myrig"
 	wantSession := cliSessionName(cityDir, "test-city", wantAgent, "")
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook([]string{"worker"}, false, &stdout, &stderr)
+	code := cmdHook([]string{"worker"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
diff --git a/cmd/gc/cmd_init.go b/cmd/gc/cmd_init.go
index bb8e97f7d4..bf02993d9f 100644
--- a/cmd/gc/cmd_init.go
+++ b/cmd/gc/cmd_init.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"github.com/BurntSushi/toml"
+	"github.com/gastownhall/gascity/internal/cityinit"
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/fsys"
@@ -58,16 +59,7 @@ type initPackConfig struct {
 	Global         config.PackGlobal              `toml:"global,omitempty"`
 }
 
-var initConventionDirs = []string{
-	"agents",
-	"commands",
-	"doctor",
-	citylayout.FormulasRoot,
-	citylayout.OrdersRoot,
-	"template-fragments",
-	"overlays",
-	"assets",
-}
+var initConventionDirs = cityinit.InitConventionDirs()
 
 // wizardConfig carries the results of the interactive init wizard (or defaults
 // for non-interactive paths). doInit uses it to decide which config to write.
@@ -90,8 +82,8 @@ func canBootstrapExistingCity(wiz wizardConfig) bool {
 }
 
 const (
-	bootstrapProfileK8sCell          = "k8s-cell"
-	bootstrapProfileSingleHostCompat = "single-host-compat"
+	bootstrapProfileK8sCell          = cityinit.BootstrapProfileK8sCell
+	bootstrapProfileSingleHostCompat = cityinit.BootstrapProfileSingleHostCompat
 )
 
 // isTerminal reports whether f is connected to a terminal (not a pipe or file).
@@ -381,16 +373,7 @@ func normalizeInitProvider(provider string) (string, error) {
 }
 
 func normalizeBootstrapProfile(profile string) (string, error) {
-	switch strings.TrimSpace(profile) {
-	case "":
-		return "", nil
-	case bootstrapProfileK8sCell, "kubernetes", "kubernetes-cell":
-		return bootstrapProfileK8sCell, nil
-	case bootstrapProfileSingleHostCompat:
-		return bootstrapProfileSingleHostCompat, nil
-	default:
-		return "", fmt.Errorf("unknown bootstrap profile %q", profile)
-	}
+	return cityinit.NormalizeBootstrapProfile(profile)
 }
 
 func initPromptTemplatePath(templatePath string) (string, bool) {
@@ -1079,13 +1062,7 @@ func overrideCityName(f fsys.FS, tomlPath, name string, stderr io.Writer) int {
 // Priority: explicit --name flag > name set on the source/template config >
 // target directory basename.
 func resolveCityName(nameOverride, sourceName, cityPath string) string {
-	if n := strings.TrimSpace(nameOverride); n != "" {
-		return n
-	}
-	if n := strings.TrimSpace(sourceName); n != "" {
-		return n
-	}
-	return strings.TrimSpace(filepath.Base(cityPath))
+	return cityinit.ResolveCityName(nameOverride, sourceName, cityPath)
 }
 
 func cmdInitFromDirWithOptions(fromDir string, args []string, nameOverride string, stdout, stderr io.Writer, skipProviderReadiness bool) int {
diff --git a/cmd/gc/cmd_mail.go b/cmd/gc/cmd_mail.go
index 8188c493c7..506a099294 100644
--- a/cmd/gc/cmd_mail.go
+++ b/cmd/gc/cmd_mail.go
@@ -9,7 +9,10 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"sync"
 	"text/tabwriter"
+	"unicode"
+	"unicode/utf8"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
@@ -25,6 +28,12 @@ import (
 // Errors are non-fatal.
 type nudgeFunc func(recipient string) error
 
+const (
+	mailInjectMaxMessages     = 3
+	mailInjectBodyPreviewSize = 240
+	mailInjectPreviewScanSize = 4096
+)
+
 func newMailNudgeFunc(sender string) nudgeFunc {
 	return func(recipient string) error {
 		target, err := resolveNudgeTarget(recipient, io.Discard)
@@ -73,12 +82,13 @@ hooks to deliver mail notifications into agent prompts.`,
 
 func newMailArchiveCmd(stdout, stderr io.Writer) *cobra.Command {
 	return &cobra.Command{
-		Use:   "archive <id>",
-		Short: "Archive a message without reading it",
-		Long: `Close a message bead without displaying its contents.
+		Use:   "archive <id>...",
+		Short: "Archive one or more messages without reading them",
+		Long: `Close one or more message beads without displaying their contents.
 
-Use this to dismiss a message without reading it. The message is marked
-as closed and will no longer appear in mail check or inbox results.`,
+Use this to dismiss messages without reading them. Each message is marked
+as closed and will no longer appear in mail check or inbox results. When
+multiple IDs are passed, they are archived in a single batch round-trip.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
 			if cmdMailArchive(args, stdout, stderr) != 0 {
@@ -99,15 +109,22 @@ func cmdMailArchive(args []string, stdout, stderr io.Writer) int {
 	return doMailArchive(mp, rec, args, stdout, stderr)
 }
 
-// doMailArchive closes a message without displaying it. Accepts an
-// injected provider and recorder for testability.
+// doMailArchive closes one or more message beads. For a single ID the
+// behavior matches the pre-batch CLI byte-for-byte; for two or more IDs it
+// delegates to mp.ArchiveMany for a single-round-trip close and prints one
+// result line per id.
 func doMailArchive(mp mail.Provider, rec events.Recorder, args []string, stdout, stderr io.Writer) int {
 	if len(args) < 1 {
 		fmt.Fprintln(stderr, "gc mail archive: missing message ID") //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	id := args[0]
+	if len(args) == 1 {
+		return doMailArchiveSingle(mp, rec, args[0], stdout, stderr)
+	}
+	return doMailArchiveMany(mp, rec, args, stdout, stderr)
+}
 
+func doMailArchiveSingle(mp mail.Provider, rec events.Recorder, id string, stdout, stderr io.Writer) int {
 	if err := mp.Archive(id); err != nil {
 		if errors.Is(err, mail.ErrAlreadyArchived) {
 			fmt.Fprintf(stdout, "Already archived %s\n", id) //nolint:errcheck // best-effort stdout
@@ -128,6 +145,36 @@ func doMailArchive(mp mail.Provider, rec events.Recorder, args []string, stdout,
 	return 0
 }
 
+func doMailArchiveMany(mp mail.Provider, rec events.Recorder, ids []string, stdout, stderr io.Writer) int {
+	results, err := mp.ArchiveMany(ids)
+	if err != nil {
+		telemetry.RecordMailOp(context.Background(), "archive", err)
+		fmt.Fprintf(stderr, "gc mail archive: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	exit := 0
+	for _, r := range results {
+		switch {
+		case r.Err == nil:
+			telemetry.RecordMailOp(context.Background(), "archive", nil)
+			rec.Record(events.Event{
+				Type:    events.MailArchived,
+				Actor:   eventActor(),
+				Subject: r.ID,
+				Payload: mailEventPayload(nil),
+			})
+			fmt.Fprintf(stdout, "Archived message %s\n", r.ID) //nolint:errcheck // best-effort stdout
+		case errors.Is(r.Err, mail.ErrAlreadyArchived):
+			fmt.Fprintf(stdout, "Already archived %s\n", r.ID) //nolint:errcheck // best-effort stdout
+		default:
+			telemetry.RecordMailOp(context.Background(), "archive", r.Err)
+			fmt.Fprintf(stderr, "gc mail archive %s: %v\n", r.ID, r.Err) //nolint:errcheck // best-effort stderr
+			exit = 1
+		}
+	}
+	return exit
+}
+
 func newMailCheckCmd(stdout, stderr io.Writer) *cobra.Command {
 	var inject bool
 	var hookFormat string
@@ -213,7 +260,7 @@ func doMailCheckTargetWithFormat(mp mail.Provider, target resolvedMailTarget, in
 
 	if inject {
 		if len(messages) > 0 {
-			_ = writeProviderHookContext(stdout, hookFormat, formatInjectOutput(messages))
+			_ = writeProviderHookContextForEvent(stdout, hookFormat, "UserPromptSubmit", formatInjectOutput(messages))
 		}
 		return 0 // --inject always exits 0
 	}
@@ -232,20 +279,88 @@ func formatInjectOutput(messages []mail.Message) string {
 	var sb strings.Builder
 	sb.WriteString("<system-reminder>\n")
 	fmt.Fprintf(&sb, "You have %d unread message(s).\n\n", len(messages))
-	for _, m := range messages {
-		subject := strings.TrimSpace(m.Subject)
-		body := strings.TrimSpace(m.Body)
+	limit := len(messages)
+	if limit > mailInjectMaxMessages {
+		limit = mailInjectMaxMessages
+		fmt.Fprintf(&sb, "Showing the first %d message(s) here; run 'gc mail inbox' for the full list.\n\n", limit)
+	}
+	for _, m := range messages[:limit] {
+		subject, subjectTruncated := mailInjectSubjectPreview(m.Subject)
+		body, bodyTruncated := mailInjectBodyPreview(m.Body)
 		if subject != "" && subject != body {
-			fmt.Fprintf(&sb, "- %s from %s [%s]: %s\n", m.ID, m.From, m.Subject, m.Body)
+			fmt.Fprintf(&sb, "- %s from %s [%s", m.ID, m.From, subject)
+			if subjectTruncated {
+				sb.WriteString(" ... [subject truncated]")
+			}
+			fmt.Fprintf(&sb, "]: %s", body)
 		} else {
-			fmt.Fprintf(&sb, "- %s from %s: %s\n", m.ID, m.From, m.Body)
+			fmt.Fprintf(&sb, "- %s from %s: %s", m.ID, m.From, body)
 		}
+		if bodyTruncated {
+			sb.WriteString(" ... [preview truncated]")
+		}
+		sb.WriteByte('\n')
 	}
 	sb.WriteString("\nRun 'gc mail read <id>' for full details, or 'gc mail inbox' to see all.\n")
 	sb.WriteString("</system-reminder>\n")
 	return sb.String()
 }
 
+func mailInjectSubjectPreview(subject string) (string, bool) {
+	return mailInjectTextPreview(subject, mailInjectBodyPreviewSize)
+}
+
+func mailInjectBodyPreview(body string) (string, bool) {
+	return mailInjectTextPreview(body, mailInjectBodyPreviewSize)
+}
+
+func mailInjectTextPreview(text string, limit int) (string, bool) {
+	if limit <= 0 {
+		return "", strings.TrimSpace(text) != ""
+	}
+
+	var sb strings.Builder
+	scanned := 0
+	pendingSpace := false
+	for len(text) > 0 {
+		if scanned >= mailInjectPreviewScanSize {
+			return sb.String(), true
+		}
+
+		r, size := utf8.DecodeRuneInString(text)
+		if scanned+size > mailInjectPreviewScanSize {
+			return sb.String(), true
+		}
+		text = text[size:]
+		scanned += size
+
+		if unicode.IsSpace(r) || unicode.IsControl(r) {
+			if sb.Len() > 0 {
+				pendingSpace = true
+			}
+			continue
+		}
+
+		encodedLen := utf8.RuneLen(r)
+		if encodedLen < 0 {
+			encodedLen = len(string(r))
+		}
+		needed := encodedLen
+		if pendingSpace && sb.Len() > 0 {
+			needed++
+		}
+		if sb.Len()+needed > limit {
+			return sb.String(), true
+		}
+		if pendingSpace && sb.Len() > 0 {
+			sb.WriteByte(' ')
+			pendingSpace = false
+		}
+		sb.WriteRune(r)
+	}
+	return sb.String(), false
+}
+
 func defaultMailIdentity() string {
 	return defaultMailIdentityCandidates()[0]
 }
@@ -313,14 +428,14 @@ func sessionMailboxAddresses(b beads.Bead) []string {
 	return addresses
 }
 
-func resolveMailIdentity(store beads.Store, identifier string) (string, error) {
+func resolveMailIdentityCached(store beads.Store, identifier string, cache *mailIdentitySessionCache) (string, error) {
 	if identifier == "" || identifier == "human" {
 		return "human", nil
 	}
 	sessionID, err := resolveSessionID(store, identifier)
 	if err != nil {
 		if errors.Is(err, session.ErrSessionNotFound) {
-			if target, matched, targetErr := resolveLiveConfiguredNamedMailTarget(store, identifier); targetErr != nil {
+			if target, matched, targetErr := resolveLiveConfiguredNamedMailTargetCached(store, identifier, cache); targetErr != nil {
 				return "", targetErr
 			} else if matched {
 				return target.display, nil
@@ -343,6 +458,10 @@ func resolveMailIdentity(store beads.Store, identifier string) (string, error) {
 }
 
 func resolveMailIdentityWithConfig(cityPath string, cfg *config.City, store beads.Store, identifier string) (string, error) {
+	return resolveMailIdentityWithConfigCached(cityPath, cfg, store, identifier, nil)
+}
+
+func resolveMailIdentityWithConfigCached(cityPath string, cfg *config.City, store beads.Store, identifier string, cache *mailIdentitySessionCache) (string, error) {
 	if identifier == "" || identifier == "human" {
 		return "human", nil
 	}
@@ -363,7 +482,7 @@ func resolveMailIdentityWithConfig(cityPath string, cfg *config.City, store bead
 			return "", err
 		}
 	}
-	if target, matched, targetErr := resolveLiveConfiguredNamedMailTarget(store, identifier); targetErr != nil {
+	if target, matched, targetErr := resolveLiveConfiguredNamedMailTargetCached(store, identifier, cache); targetErr != nil {
 		return "", targetErr
 	} else if matched {
 		return target.display, nil
@@ -371,19 +490,23 @@ func resolveMailIdentityWithConfig(cityPath string, cfg *config.City, store bead
 	if address, ok := configuredMailboxAddressWithConfig(cityPath, cfg, identifier); ok {
 		return address, nil
 	}
-	return resolveMailIdentity(store, identifier)
+	return resolveMailIdentityCached(store, identifier, cache)
 }
 
 func resolveMailRecipientIdentity(cityPath string, cfg *config.City, store beads.Store, identifier string) (string, error) {
+	return resolveMailRecipientIdentityCached(cityPath, cfg, store, identifier, nil)
+}
+
+func resolveMailRecipientIdentityCached(cityPath string, cfg *config.City, store beads.Store, identifier string, cache *mailIdentitySessionCache) (string, error) {
 	if identifier == "" || identifier == "human" {
 		return "human", nil
 	}
-	if target, matched, targetErr := resolveLiveConfiguredNamedMailTarget(store, identifier); targetErr != nil {
+	if target, matched, targetErr := resolveLiveConfiguredNamedMailTargetCached(store, identifier, cache); targetErr != nil {
 		return "", targetErr
 	} else if matched {
 		return target.display, nil
 	}
-	return resolveMailIdentityWithConfig(cityPath, cfg, store, identifier)
+	return resolveMailIdentityWithConfigCached(cityPath, cfg, store, identifier, cache)
 }
 
 func configuredMailboxAddress(identifier string) (string, bool) {
@@ -415,14 +538,12 @@ func configuredMailboxAddressWithConfig(cityPath string, cfg *config.City, ident
 	return spec.Identity, true
 }
 
-func listLiveSessionMailboxes(store beads.Store) (map[string]bool, error) {
+func listLiveSessionMailboxesCached(store beads.Store, cache *mailIdentitySessionCache) (map[string]bool, error) {
 	recipients := map[string]bool{"human": true}
 	if store == nil {
 		return recipients, nil
 	}
-	all, err := store.List(beads.ListQuery{
-		Label: session.LabelSession,
-	})
+	all, err := listMailIdentitySessions(store, cache)
 	if err != nil {
 		return nil, err
 	}
@@ -442,14 +563,89 @@ type resolvedMailTarget struct {
 	recipients []string
 }
 
-func resolveLiveConfiguredNamedMailTarget(store beads.Store, identifier string) (resolvedMailTarget, bool, error) {
+func mailSenderRouteMetadata(store beads.Store, sender string) (map[string]string, error) {
+	sender = strings.TrimSpace(sender)
+	if store == nil || sender == "" || sender == "human" {
+		return nil, nil
+	}
+	sessionID, err := resolveSessionID(store, sender)
+	if err != nil {
+		if errors.Is(err, session.ErrSessionNotFound) || errors.Is(err, session.ErrAmbiguous) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("resolving sender route %q: %w", sender, err)
+	}
+	b, err := store.Get(sessionID)
+	if err != nil {
+		return nil, fmt.Errorf("loading sender session %q: %w", sessionID, err)
+	}
+	display := mailSenderDisplayAddress(b, sender)
+	return map[string]string{
+		mail.FromSessionIDMetadataKey: sessionID,
+		mail.FromDisplayMetadataKey:   display,
+	}, nil
+}
+
+func mailSenderDisplayAddress(b beads.Bead, fallback string) string {
+	if alias := strings.TrimSpace(b.Metadata["alias"]); alias != "" {
+		return alias
+	}
+	fallback = strings.TrimSpace(fallback)
+	if fallback != "" && fallback != b.ID {
+		return fallback
+	}
+	if name := strings.TrimSpace(b.Metadata["session_name"]); name != "" {
+		return name
+	}
+	if b.ID != "" {
+		return b.ID
+	}
+	return fallback
+}
+
+func mailSenderDisplayFromMetadata(fallback string, metadata map[string]string) string {
+	if metadata != nil {
+		if display := strings.TrimSpace(metadata[mail.FromDisplayMetadataKey]); display != "" {
+			return display
+		}
+	}
+	return strings.TrimSpace(fallback)
+}
+
+// mailIdentitySessionCache memoizes a single gc:session enumeration so that
+// repeated identity-resolution attempts (multi-candidate retry, sender +
+// recipient resolution in the same command, etc.) share the same broad scan.
+// A nil cache disables memoization; the zero value memoizes on first use.
+type mailIdentitySessionCache struct {
+	mu      sync.Mutex
+	list    []beads.Bead
+	fetched bool
+}
+
+func listMailIdentitySessions(store beads.Store, cache *mailIdentitySessionCache) ([]beads.Bead, error) {
+	if cache == nil {
+		return store.List(beads.ListQuery{Label: session.LabelSession})
+	}
+	cache.mu.Lock()
+	defer cache.mu.Unlock()
+	if cache.fetched {
+		return cache.list, nil
+	}
+	list, err := store.List(beads.ListQuery{Label: session.LabelSession})
+	if err != nil {
+		return nil, err
+	}
+	cache.list = list
+	cache.fetched = true
+	return list, nil
+}
+
+func resolveLiveConfiguredNamedMailTargetCached(store beads.Store, identifier string, cache *mailIdentitySessionCache) (resolvedMailTarget, bool, error) {
 	identifier = normalizeNamedSessionTarget(identifier)
 	if store == nil || identifier == "" || identifier == "human" || strings.Contains(identifier, "/") {
 		return resolvedMailTarget{}, false, nil
 	}
-	all, err := store.List(beads.ListQuery{
-		Label: session.LabelSession,
-	})
+	all, err := listMailIdentitySessions(store, cache)
 	if err != nil {
 		return resolvedMailTarget{}, false, err
 	}
@@ -494,13 +690,17 @@ func resolveLiveConfiguredNamedMailTarget(store beads.Store, identifier string)
 }
 
 func resolveMailTargets(store beads.Store, identifier string) (resolvedMailTarget, error) {
+	return resolveMailTargetsCached(store, identifier, nil)
+}
+
+func resolveMailTargetsCached(store beads.Store, identifier string, cache *mailIdentitySessionCache) (resolvedMailTarget, error) {
 	if identifier == "" || identifier == "human" {
 		return resolvedMailTarget{display: "human", recipients: []string{"human"}}, nil
 	}
 	sessionID, err := resolveSessionID(store, identifier)
 	if err != nil {
 		if errors.Is(err, session.ErrSessionNotFound) {
-			if target, matched, targetErr := resolveLiveConfiguredNamedMailTarget(store, identifier); targetErr != nil {
+			if target, matched, targetErr := resolveLiveConfiguredNamedMailTargetCached(store, identifier, cache); targetErr != nil {
 				return resolvedMailTarget{}, targetErr
 			} else if matched {
 				return target, nil
@@ -559,8 +759,11 @@ func resolveDefaultMailTargetsForCommand(stderr io.Writer, cmdName string) (reso
 		_ = code
 		return resolvedMailTarget{}, false
 	}
+	// Memoize the gc:session enumeration so multi-candidate retry shares one
+	// broad scan instead of issuing one per candidate (ga-q6ct Layer 2).
+	cache := &mailIdentitySessionCache{}
 	for _, c := range candidates {
-		target, err := resolveMailTargets(store, c)
+		target, err := resolveMailTargetsCached(store, c, cache)
 		if err == nil {
 			return target, true
 		}
@@ -574,9 +777,13 @@ func resolveDefaultMailTargetsForCommand(stderr io.Writer, cmdName string) (reso
 }
 
 func resolveDefaultMailSenderForCommand(cityPath string, cfg *config.City, store beads.Store, stderr io.Writer, cmdName string) (string, bool) {
+	return resolveDefaultMailSenderForCommandCached(cityPath, cfg, store, stderr, cmdName, nil)
+}
+
+func resolveDefaultMailSenderForCommandCached(cityPath string, cfg *config.City, store beads.Store, stderr io.Writer, cmdName string, cache *mailIdentitySessionCache) (string, bool) {
 	candidates := defaultMailIdentityCandidates()
 	for _, c := range candidates {
-		sender, err := resolveMailIdentityWithConfig(cityPath, cfg, store, c)
+		sender, err := resolveMailIdentityWithConfigCached(cityPath, cfg, store, c, cache)
 		if err == nil {
 			return sender, true
 		}
@@ -689,6 +896,10 @@ func collectMailCounts(count func(string) (int, int, error), recipients []string
 	return total, unread, nil
 }
 
+type multiRecipientMailCounter interface {
+	CountRecipients([]string) (int, int, error)
+}
+
 func newMailSendCmd(stdout, stderr io.Writer) *cobra.Command {
 	var notify bool
 	var all bool
@@ -723,6 +934,8 @@ Use --all to broadcast to all live sessions (excluding sender and "human").`,
 		},
 	}
 	cmd.Flags().BoolVar(&notify, "notify", false, "nudge the recipient after sending")
+	cmd.Flags().BoolVar(&notify, "nudge", false, "alias for --notify")
+	_ = cmd.Flags().MarkHidden("nudge")
 	cmd.Flags().BoolVar(&all, "all", false, "broadcast to all live sessions (excludes sender and human)")
 	cmd.Flags().StringVar(&from, "from", "", "sender identity (default: $GC_SESSION_ID, $GC_ALIAS, $GC_AGENT, or \"human\")")
 	cmd.Flags().StringVar(&to, "to", "", "recipient address (alternative to positional argument)")
@@ -796,6 +1009,7 @@ func newMailReplyCmd(stdout, stderr io.Writer) *cobra.Command {
 		Long: `Reply to a message. The reply is addressed to the original sender.
 
 Inherits the thread ID from the original message for conversation tracking.
+Use --notify to nudge the recipient after replying.
 Use -s/--subject for the reply subject and -m/--message for the reply body.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
@@ -808,6 +1022,8 @@ Use -s/--subject for the reply subject and -m/--message for the reply body.`,
 	cmd.Flags().StringVarP(&subject, "subject", "s", "", "reply subject line")
 	cmd.Flags().StringVarP(&message, "message", "m", "", "reply body text")
 	cmd.Flags().BoolVar(&notify, "notify", false, "nudge the recipient after replying")
+	cmd.Flags().BoolVar(&notify, "nudge", false, "alias for --notify")
+	_ = cmd.Flags().MarkHidden("nudge")
 	return cmd
 }
 
@@ -843,10 +1059,12 @@ func newMailMarkUnreadCmd(stdout, stderr io.Writer) *cobra.Command {
 
 func newMailDeleteCmd(stdout, stderr io.Writer) *cobra.Command {
 	return &cobra.Command{
-		Use:   "delete <id>",
-		Short: "Delete a message (closes the bead)",
-		Long:  `Delete a message by closing the bead. Same effect as archive but with different user intent.`,
-		Args:  cobra.ArbitraryArgs,
+		Use:   "delete <id>...",
+		Short: "Delete one or more messages (closes the beads)",
+		Long: `Delete one or more messages by closing the beads. Same effect as archive
+but with different user intent. When multiple IDs are passed, they are
+deleted in a single batch round-trip.`,
+		Args: cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
 			if cmdMailDelete(args, stdout, stderr) != 0 {
 				return errExit
@@ -858,9 +1076,9 @@ func newMailDeleteCmd(stdout, stderr io.Writer) *cobra.Command {
 
 func newMailThreadCmd(stdout, stderr io.Writer) *cobra.Command {
 	return &cobra.Command{
-		Use:   "thread <thread-id>",
+		Use:   "thread <id>",
 		Short: "List all messages in a thread",
-		Long:  `Show all messages sharing a thread ID, ordered by time.`,
+		Long:  `Show all messages sharing a thread ID or message ID, ordered by time.`,
 		Args:  cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
 			if cmdMailThread(args, stdout, stderr) != 0 {
@@ -913,8 +1131,12 @@ func cmdMailSend(args []string, notify bool, all bool, from string, to string, s
 		fmt.Fprintf(stderr, "gc mail send: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
+	// Memoize the gc:session enumeration so identity resolution (sender +
+	// recipient + listLiveSessionMailboxes) shares one broad scan instead of
+	// issuing one per call site (ga-q6ct Layer 3).
+	idCache := &mailIdentitySessionCache{}
 	if store != nil {
-		validRecipients, err = listLiveSessionMailboxes(store)
+		validRecipients, err = listLiveSessionMailboxesCached(store, idCache)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc mail send: listing live sessions: %v\n", err) //nolint:errcheck // best-effort stderr
 			return 1
@@ -925,7 +1147,7 @@ func cmdMailSend(args []string, notify bool, all bool, from string, to string, s
 	if sender == "" {
 		if store != nil {
 			var ok bool
-			sender, ok = resolveDefaultMailSenderForCommand(cityPath, cfg, store, stderr, "gc mail send")
+			sender, ok = resolveDefaultMailSenderForCommandCached(cityPath, cfg, store, stderr, "gc mail send", idCache)
 			if !ok {
 				return 1
 			}
@@ -933,7 +1155,7 @@ func cmdMailSend(args []string, notify bool, all bool, from string, to string, s
 			sender = defaultMailIdentity()
 		}
 	} else if sender != "human" && store != nil {
-		sender, err = resolveMailIdentityWithConfig(cityPath, cfg, store, sender)
+		sender, err = resolveMailIdentityWithConfigCached(cityPath, cfg, store, sender, idCache)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc mail send: invalid sender %q: %v\n", sender, err) //nolint:errcheck // best-effort stderr
 			return 1
@@ -963,7 +1185,7 @@ func cmdMailSend(args []string, notify bool, all bool, from string, to string, s
 		}
 	}
 	if !all && len(args) > 0 && store != nil {
-		canonicalTo, err := resolveMailRecipientIdentity(cityPath, cfg, store, args[0])
+		canonicalTo, err := resolveMailRecipientIdentityCached(cityPath, cfg, store, args[0], idCache)
 		if err != nil {
 			fmt.Fprintf(stderr, "gc mail send: unknown recipient %q: %v\n", args[0], err) //nolint:errcheck // best-effort stderr
 			return 1
@@ -1016,7 +1238,7 @@ func doMailSend(mp mail.Provider, rec events.Recorder, validRecipients map[strin
 	}
 	rec.Record(events.Event{
 		Type:    events.MailSent,
-		Actor:   sender,
+		Actor:   m.From,
 		Subject: m.ID,
 		Message: to,
 		Payload: mailEventPayload(&m),
@@ -1071,7 +1293,7 @@ func doMailSendAll(mp mail.Provider, rec events.Recorder, validRecipients map[st
 		}
 		rec.Record(events.Event{
 			Type:    events.MailSent,
-			Actor:   sender,
+			Actor:   m.From,
 			Subject: m.ID,
 			Message: to,
 			Payload: mailEventPayload(&m),
@@ -1206,25 +1428,46 @@ func cmdMailReply(args []string, subject, message string, notify bool, stdout, s
 	rec := openCityRecorder(stderr)
 
 	sender := defaultMailIdentity()
-	var hasStore bool
-	if sender != "human" {
-		if !isStorelessMailProvider() {
-			hasStore = true
-			store, storeCode := openCityStore(stderr, "gc mail reply")
+	providerName := mailProviderName()
+	var store beads.Store
+	var cityPath string
+	var cfg *config.City
+	var notifySetupErr error
+	if sender != "human" || notify {
+		switch {
+		case strings.HasPrefix(providerName, "exec:"):
+			var err error
+			cityPath, err = resolveCity()
+			if err == nil {
+				cfg, _ = loadCityConfig(cityPath, stderr)
+				store, err = openCityStoreAt(cityPath)
+			}
+			if err != nil {
+				notifySetupErr = err
+				store = nil
+			}
+		case !isStorelessMailProvider():
+			var storeCode int
+			store, storeCode = openCityStore(stderr, "gc mail reply")
 			if store == nil {
 				return storeCode
 			}
-			cityPath, err := resolveCity()
+			var err error
+			cityPath, err = resolveCity()
 			if err != nil {
 				fmt.Fprintf(stderr, "gc mail reply: %v\n", err) //nolint:errcheck // best-effort stderr
 				return 1
 			}
-			cfg, _ := loadCityConfig(cityPath, stderr)
-			resolved, ok := resolveDefaultMailSenderForCommand(cityPath, cfg, store, stderr, "gc mail reply")
-			if !ok {
-				return 1
+			cfg, _ = loadCityConfig(cityPath, stderr)
+		}
+		if sender != "human" {
+			if store != nil {
+				resolved, ok := resolveDefaultMailSenderForCommand(cityPath, cfg, store, stderr, "gc mail reply")
+				if !ok {
+					return 1
+				}
+				sender = resolved
 			}
-			sender = resolved
 		}
 	}
 
@@ -1235,8 +1478,10 @@ func cmdMailReply(args []string, subject, message string, notify bool, stdout, s
 	}
 
 	var nf nudgeFunc
-	if notify && hasStore {
+	if notify && store != nil {
 		nf = newMailNudgeFunc(sender)
+	} else if notify && strings.HasPrefix(providerName, "exec:") && notifySetupErr != nil {
+		fmt.Fprintf(stderr, "gc mail reply: --notify requested but no city store available; nudge skipped: %v\n", notifySetupErr) //nolint:errcheck // best-effort stderr
 	}
 
 	return doMailReply(mp, rec, args[0], sender, subject, body, nf, stdout, stderr)
@@ -1252,7 +1497,7 @@ func doMailReply(mp mail.Provider, rec events.Recorder, id, sender, subject, bod
 	}
 	rec.Record(events.Event{
 		Type:    events.MailReplied,
-		Actor:   sender,
+		Actor:   reply.From,
 		Subject: reply.ID,
 		Message: reply.To,
 		Payload: mailEventPayload(&reply),
@@ -1343,13 +1588,22 @@ func cmdMailDelete(args []string, stdout, stderr io.Writer) int {
 	return doMailDelete(mp, rec, args, stdout, stderr)
 }
 
-// doMailDelete closes a message bead (same as archive but different intent).
+// doMailDelete closes one or more message beads (same as archive but
+// different intent). Single-id behavior matches the pre-batch CLI
+// byte-for-byte; multi-id uses mp.DeleteMany to preserve provider delete
+// semantics.
 func doMailDelete(mp mail.Provider, rec events.Recorder, args []string, stdout, stderr io.Writer) int {
 	if len(args) < 1 {
 		fmt.Fprintln(stderr, "gc mail delete: missing message ID") //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	id := args[0]
+	if len(args) == 1 {
+		return doMailDeleteSingle(mp, rec, args[0], stdout, stderr)
+	}
+	return doMailDeleteMany(mp, rec, args, stdout, stderr)
+}
+
+func doMailDeleteSingle(mp mail.Provider, rec events.Recorder, id string, stdout, stderr io.Writer) int {
 	if err := mp.Delete(id); err != nil {
 		if errors.Is(err, mail.ErrAlreadyArchived) {
 			fmt.Fprintf(stdout, "Already deleted %s\n", id) //nolint:errcheck // best-effort stdout
@@ -1370,6 +1624,36 @@ func doMailDelete(mp mail.Provider, rec events.Recorder, args []string, stdout,
 	return 0
 }
 
+func doMailDeleteMany(mp mail.Provider, rec events.Recorder, ids []string, stdout, stderr io.Writer) int {
+	results, err := mp.DeleteMany(ids)
+	if err != nil {
+		telemetry.RecordMailOp(context.Background(), "delete", err)
+		fmt.Fprintf(stderr, "gc mail delete: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	exit := 0
+	for _, r := range results {
+		switch {
+		case r.Err == nil:
+			telemetry.RecordMailOp(context.Background(), "delete", nil)
+			rec.Record(events.Event{
+				Type:    events.MailDeleted,
+				Actor:   eventActor(),
+				Subject: r.ID,
+				Payload: mailEventPayload(nil),
+			})
+			fmt.Fprintf(stdout, "Deleted message %s\n", r.ID) //nolint:errcheck // best-effort stdout
+		case errors.Is(r.Err, mail.ErrAlreadyArchived):
+			fmt.Fprintf(stdout, "Already deleted %s\n", r.ID) //nolint:errcheck // best-effort stdout
+		default:
+			telemetry.RecordMailOp(context.Background(), "delete", r.Err)
+			fmt.Fprintf(stderr, "gc mail delete %s: %v\n", r.ID, r.Err) //nolint:errcheck // best-effort stderr
+			exit = 1
+		}
+	}
+	return exit
+}
+
 // cmdMailThread lists messages in a thread.
 func cmdMailThread(args []string, stdout, stderr io.Writer) int {
 	mp, code := openCityMailProvider(stderr, "gc mail thread")
@@ -1382,19 +1666,19 @@ func cmdMailThread(args []string, stdout, stderr io.Writer) int {
 // doMailThread shows all messages in a thread.
 func doMailThread(mp mail.Provider, args []string, stdout, stderr io.Writer) int {
 	if len(args) < 1 {
-		fmt.Fprintln(stderr, "gc mail thread: missing thread ID") //nolint:errcheck // best-effort stderr
+		fmt.Fprintln(stderr, "gc mail thread: missing thread or message ID") //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	threadID := args[0]
+	id := args[0]
 
-	msgs, err := mp.Thread(threadID)
+	msgs, err := mp.Thread(id)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc mail thread: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 
 	if len(msgs) == 0 {
-		fmt.Fprintf(stdout, "No messages in thread %s\n", threadID) //nolint:errcheck // best-effort stdout
+		fmt.Fprintf(stdout, "No messages in thread %s\n", id) //nolint:errcheck // best-effort stdout
 		return 0
 	}
 
@@ -1433,7 +1717,13 @@ func doMailCount(mp mail.Provider, recipient string, stdout, stderr io.Writer) i
 }
 
 func doMailCountTarget(mp mail.Provider, target resolvedMailTarget, stdout, stderr io.Writer) int {
-	total, unread, err := collectMailCounts(mp.Count, target.recipients)
+	var total, unread int
+	var err error
+	if counter, ok := mp.(multiRecipientMailCounter); ok {
+		total, unread, err = counter.CountRecipients(target.recipients)
+	} else {
+		total, unread, err = collectMailCounts(mp.Count, target.recipients)
+	}
 	if err != nil {
 		fmt.Fprintf(stderr, "gc mail count: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
diff --git a/cmd/gc/cmd_mail_test.go b/cmd/gc/cmd_mail_test.go
index 2e51d16a61..f065f7d1b1 100644
--- a/cmd/gc/cmd_mail_test.go
+++ b/cmd/gc/cmd_mail_test.go
@@ -10,12 +10,15 @@ import (
 	"syscall"
 	"testing"
 	"time"
+	"unicode/utf8"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/mail"
 	"github.com/gastownhall/gascity/internal/mail/beadmail"
+	mailexec "github.com/gastownhall/gascity/internal/mail/exec"
+	"github.com/gastownhall/gascity/internal/nudgequeue"
 	"github.com/gastownhall/gascity/internal/session"
 )
 
@@ -35,7 +38,13 @@ func (countOnlyMailProvider) Read(string) (mail.Message, error)    { panic("unex
 func (countOnlyMailProvider) MarkRead(string) error                { panic("unexpected MarkRead") }
 func (countOnlyMailProvider) MarkUnread(string) error              { panic("unexpected MarkUnread") }
 func (countOnlyMailProvider) Archive(string) error                 { panic("unexpected Archive") }
-func (countOnlyMailProvider) Delete(string) error                  { panic("unexpected Delete") }
+func (countOnlyMailProvider) ArchiveMany([]string) ([]mail.ArchiveResult, error) {
+	panic("unexpected ArchiveMany")
+}
+func (countOnlyMailProvider) Delete(string) error { panic("unexpected Delete") }
+func (countOnlyMailProvider) DeleteMany([]string) ([]mail.ArchiveResult, error) {
+	panic("unexpected DeleteMany")
+}
 func (countOnlyMailProvider) Check(string) ([]mail.Message, error) { panic("unexpected Check") }
 func (countOnlyMailProvider) Reply(string, string, string, string) (mail.Message, error) {
 	panic("unexpected Reply")
@@ -353,6 +362,86 @@ func TestResolveDefaultMailTargetsForCommand_FallsBackToGCAliasWhenSessionIDMiss
 	}
 }
 
+func TestResolveDefaultMailSenderForCommand_UsesDisplayAliasBeforeSessionName(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_MAIL", "")
+
+	cityPath := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Setenv("GC_CITY", cityPath)
+
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	b, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "gascity/workflows.codex-min-1",
+			"session_name": "workflows__codex-min-mc-abc123",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cfg, _ := loadCityConfig(cityPath)
+
+	t.Setenv("GC_SESSION_ID", b.ID)
+	t.Setenv("GC_ALIAS", "gascity/workflows.codex-min-1")
+	t.Setenv("GC_AGENT", "gascity/workflows.codex-min-1")
+
+	var stderr bytes.Buffer
+	sender, ok := resolveDefaultMailSenderForCommand(cityPath, cfg, store, &stderr, "gc mail send")
+	if !ok {
+		t.Fatalf("resolveDefaultMailSenderForCommand() = not ok; stderr=%q", stderr.String())
+	}
+	if sender != "gascity/workflows.codex-min-1" {
+		t.Fatalf("sender = %q, want display alias", sender)
+	}
+}
+
+func TestResolveMailIdentityWithConfig_ExplicitAliasUsesDisplayAlias(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_MAIL", "")
+
+	cityPath := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Setenv("GC_CITY", cityPath)
+
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "gascity/workflows.codex-min-16",
+			"session_name": "workflows__codex-min-mc-explicit",
+		},
+	}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cfg, _ := loadCityConfig(cityPath)
+
+	for _, from := range []string{"gascity/workflows.codex-min-16", "workflows.codex-min-16"} {
+		t.Run(from, func(t *testing.T) {
+			sender, err := resolveMailIdentityWithConfig(cityPath, cfg, store, from)
+			if err != nil {
+				t.Fatalf("resolveMailIdentityWithConfig(%q): %v", from, err)
+			}
+			if sender != "gascity/workflows.codex-min-16" {
+				t.Fatalf("sender = %q, want display alias", sender)
+			}
+		})
+	}
+}
+
 func TestResolveDefaultMailSenderForCommand_FallsBackToGCAliasWhenSessionIDMissing(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_MAIL", "")
@@ -407,14 +496,15 @@ func TestCmdMailSendDefaultSenderFallsBackToGCAliasWhenSessionIDMissing(t *testi
 	if err != nil {
 		t.Fatalf("openCityStoreAt: %v", err)
 	}
-	if _, err := store.Create(beads.Bead{
+	senderBead, err := store.Create(beads.Bead{
 		Type:   session.BeadType,
 		Labels: []string{session.LabelSession},
 		Metadata: map[string]string{
 			"alias":        "sender",
 			"session_name": "sender-gc-42",
 		},
-	}); err != nil {
+	})
+	if err != nil {
 		t.Fatalf("Create sender: %v", err)
 	}
 	if _, err := store.Create(beads.Bead{
@@ -460,6 +550,12 @@ func TestCmdMailSendDefaultSenderFallsBackToGCAliasWhenSessionIDMissing(t *testi
 	if msg.From != "sender" {
 		t.Fatalf("message From = %q, want sender", msg.From)
 	}
+	if msg.Metadata["mail.from_session_id"] != senderBead.ID {
+		t.Fatalf("mail.from_session_id = %q, want %q", msg.Metadata["mail.from_session_id"], senderBead.ID)
+	}
+	if msg.Metadata["mail.from_display"] != "sender" {
+		t.Fatalf("mail.from_display = %q, want sender", msg.Metadata["mail.from_display"])
+	}
 	if msg.Assignee != "recipient" {
 		t.Fatalf("message Assignee = %q, want recipient", msg.Assignee)
 	}
@@ -1404,6 +1500,246 @@ func TestCmdMailReply_FallsBackToGCSessionIDWhenAliasMissing(t *testing.T) {
 	}
 }
 
+func TestCmdMailReplyHumanNotifyQueuesNudge(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_MAIL", "")
+	t.Setenv("GC_SESSION", "fake")
+	t.Setenv("GC_ALIAS", "")
+	t.Setenv("GC_SESSION_ID", "")
+	t.Setenv("GC_AGENT", "")
+
+	cityPath := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Setenv("GC_CITY", cityPath)
+
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "alice",
+			"session_name": "alice-session",
+			"provider":     "fake",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(session): %v", err)
+	}
+
+	mp := beadmail.New(store)
+	original, err := mp.Send("alice", "human", "Hello", "first")
+	if err != nil {
+		t.Fatalf("mp.Send(): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := cmdMailReply([]string{original.ID, "reply body"}, "", "", true, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdMailReply() = %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "to alice") {
+		t.Fatalf("stdout = %q, want reply addressed to alice", stdout.String())
+	}
+
+	state, err := nudgequeue.LoadState(cityPath)
+	if err != nil {
+		t.Fatalf("LoadState(): %v", err)
+	}
+	if len(state.Pending) != 1 {
+		t.Fatalf("pending nudges = %d, want 1; state=%+v stderr=%s", len(state.Pending), state, stderr.String())
+	}
+	nudge := state.Pending[0]
+	if nudge.Agent != "alice" {
+		t.Fatalf("nudge.Agent = %q, want alice", nudge.Agent)
+	}
+	if nudge.SessionID != sessionBead.ID {
+		t.Fatalf("nudge.SessionID = %q, want %q", nudge.SessionID, sessionBead.ID)
+	}
+	if nudge.Source != "mail" {
+		t.Fatalf("nudge.Source = %q, want mail", nudge.Source)
+	}
+	if nudge.Message != "You have mail from human" {
+		t.Fatalf("nudge.Message = %q", nudge.Message)
+	}
+}
+
+func TestCmdMailReplyExecProviderNotifyQueuesNudge(t *testing.T) {
+	cityPath, sessionID, script := setupExecMailReplyNudgeTest(t)
+	t.Setenv("GC_MAIL", "exec:"+script)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdMailReply([]string{"gc-1", "reply body"}, "", "", true, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdMailReply() = %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+
+	assertQueuedMailNudge(t, cityPath, sessionID, stderr.String())
+}
+
+func TestMailReplyNudgeAliasQueuesNudge(t *testing.T) {
+	cityPath, sessionID, script := setupExecMailReplyNudgeTest(t)
+	t.Setenv("GC_MAIL", "exec:"+script)
+
+	var stdout, stderr bytes.Buffer
+	cmd := newMailReplyCmd(&stdout, &stderr)
+	if cmd.Flags().Lookup("nudge") == nil {
+		t.Fatal("reply command missing --nudge alias")
+	}
+	cmd.SetArgs([]string{"gc-1", "--nudge", "reply body"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("reply --nudge: %v; stdout=%s stderr=%s", err, stdout.String(), stderr.String())
+	}
+
+	assertQueuedMailNudge(t, cityPath, sessionID, stderr.String())
+}
+
+func TestCmdMailReplyExecProviderNotifyWithoutCityWarnsAndSendsReply(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_MAIL", "exec:"+writeExecReplyScript(t))
+	t.Setenv("GC_SESSION", "fake")
+	t.Setenv("GC_CITY", "")
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_ALIAS", "")
+	t.Setenv("GC_SESSION_ID", "")
+	t.Setenv("GC_AGENT", "")
+	t.Chdir(t.TempDir())
+
+	var stdout, stderr bytes.Buffer
+	code := cmdMailReply([]string{"gc-1", "reply body"}, "", "", true, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdMailReply() = %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "Replied to gc-1") {
+		t.Fatalf("stdout = %q, want reply confirmation", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "--notify requested but no city store available") {
+		t.Fatalf("stderr = %q, want notify warning", stderr.String())
+	}
+}
+
+func TestCmdMailReplyExecProviderNotifyResolvesNonHumanSender(t *testing.T) {
+	cityPath, sessionID, script := setupExecMailReplyNudgeTest(t)
+	t.Setenv("GC_MAIL", "exec:"+script)
+	t.Setenv("GC_SESSION_ID", "bob-session")
+
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "bob",
+			"session_name": "bob-session",
+			"provider":     "fake",
+		},
+	}); err != nil {
+		t.Fatalf("Create(sender session): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := cmdMailReply([]string{"gc-1", "reply body"}, "", "", true, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdMailReply() = %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+
+	assertQueuedMailNudgeMessage(t, cityPath, sessionID, "You have mail from bob", stderr.String())
+}
+
+func setupExecMailReplyNudgeTest(t *testing.T) (string, string, string) {
+	t.Helper()
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_SESSION", "fake")
+	t.Setenv("GC_ALIAS", "")
+	t.Setenv("GC_SESSION_ID", "")
+	t.Setenv("GC_AGENT", "")
+
+	cityPath := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname = \"test-city\"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Setenv("GC_CITY", cityPath)
+	t.Setenv("GC_CITY_PATH", cityPath)
+
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "alice",
+			"session_name": "alice-session",
+			"provider":     "fake",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(session): %v", err)
+	}
+
+	return cityPath, sessionBead.ID, writeExecReplyScript(t)
+}
+
+func writeExecReplyScript(t *testing.T) string {
+	t.Helper()
+	script := filepath.Join(t.TempDir(), "mail-exec")
+	data := `#!/bin/sh
+case "$1" in
+  ensure-running)
+    exit 0
+    ;;
+  reply)
+    cat >/dev/null
+    printf '{"id":"exec-reply-1","from":"human","to":"alice","subject":"RE: Hello","body":"reply body","created_at":"2026-04-28T00:00:00Z","read":false,"thread_id":"thread-1","reply_to":"%s"}\n' "$2"
+    exit 0
+    ;;
+  *)
+    exit 2
+    ;;
+esac
+`
+	if err := os.WriteFile(script, []byte(data), 0o755); err != nil {
+		t.Fatalf("WriteFile(exec script): %v", err)
+	}
+	return script
+}
+
+func assertQueuedMailNudge(t *testing.T, cityPath, sessionID, stderr string) {
+	t.Helper()
+	assertQueuedMailNudgeMessage(t, cityPath, sessionID, "You have mail from human", stderr)
+}
+
+func assertQueuedMailNudgeMessage(t *testing.T, cityPath, sessionID, message, stderr string) {
+	t.Helper()
+	state, err := nudgequeue.LoadState(cityPath)
+	if err != nil {
+		t.Fatalf("LoadState(): %v", err)
+	}
+	if len(state.Pending) != 1 {
+		t.Fatalf("pending nudges = %d, want 1; state=%+v stderr=%s", len(state.Pending), state, stderr)
+	}
+	nudge := state.Pending[0]
+	if nudge.Agent != "alice" {
+		t.Fatalf("nudge.Agent = %q, want alice", nudge.Agent)
+	}
+	if nudge.SessionID != sessionID {
+		t.Fatalf("nudge.SessionID = %q, want %q", nudge.SessionID, sessionID)
+	}
+	if nudge.Source != "mail" {
+		t.Fatalf("nudge.Source = %q, want mail", nudge.Source)
+	}
+	if nudge.Message != message {
+		t.Fatalf("nudge.Message = %q", nudge.Message)
+	}
+}
+
 // --- gc mail mark-read / mark-unread ---
 
 func TestMailMarkReadSuccess(t *testing.T) {
@@ -1454,6 +1790,105 @@ func TestMailDeleteSuccess(t *testing.T) {
 	}
 }
 
+func TestMailDeleteMultiSuccess(t *testing.T) {
+	store := beads.NewMemStore()
+	mp := beadmail.New(store)
+	for i := 0; i < 3; i++ {
+		if _, err := mp.Send("human", "mayor", "", "batch me"); err != nil {
+			t.Fatalf("Send %d: %v", i, err)
+		}
+	}
+
+	var stdout, stderr bytes.Buffer
+	rec := &memRecorder{}
+	code := doMailDelete(mp, rec, []string{"gc-1", "gc-2", "gc-3"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doMailDelete = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	out := stdout.String()
+	for _, want := range []string{"Deleted message gc-1", "Deleted message gc-2", "Deleted message gc-3"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("stdout missing %q:\n%s", want, out)
+		}
+	}
+	if n := len(rec.events); n != 3 {
+		t.Errorf("recorded events = %d, want 3", n)
+	}
+	for _, id := range []string{"gc-1", "gc-2", "gc-3"} {
+		b, err := store.Get(id)
+		if err != nil {
+			t.Fatalf("Get(%s): %v", id, err)
+		}
+		if b.Status != "closed" {
+			t.Errorf("bead %s Status = %q, want closed", id, b.Status)
+		}
+	}
+}
+
+func TestMailDeleteMultiPartialFailure(t *testing.T) {
+	mp := mail.NewFake()
+	m1, _ := mp.Send("human", "mayor", "", "one")
+	m2, _ := mp.Send("human", "mayor", "", "two")
+	if err := mp.Archive(m2.ID); err != nil {
+		t.Fatalf("pre-archive m2: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doMailDelete(mp, events.Discard, []string{m1.ID, m2.ID, "ghost"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("doMailDelete = %d, want 1; stderr: %s", code, stderr.String())
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "Deleted message "+m1.ID) {
+		t.Errorf("stdout missing Deleted for m1:\n%s", out)
+	}
+	if !strings.Contains(out, "Already deleted "+m2.ID) {
+		t.Errorf("stdout missing Already deleted for m2:\n%s", out)
+	}
+	if !strings.Contains(stderr.String(), "gc mail delete ghost") {
+		t.Errorf("stderr missing per-id error for ghost:\n%s", stderr.String())
+	}
+}
+
+func TestMailDeleteMultiExecProviderUsesDeleteCommand(t *testing.T) {
+	dir := t.TempDir()
+	logPath := filepath.Join(dir, "ops.log")
+	scriptPath := filepath.Join(dir, "mail-provider")
+	script := fmt.Sprintf(`#!/bin/sh
+set -eu
+op="$1"
+case "$op" in
+  ensure-running)
+    ;;
+  archive|delete)
+    printf '%%s %%s\n' "$op" "$2" >> %q
+    ;;
+  *)
+    echo "unexpected op $op" >&2
+    exit 2
+    ;;
+esac
+`, logPath)
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		t.Fatalf("WriteFile(script): %v", err)
+	}
+
+	mp := mailexec.NewProvider(scriptPath)
+	var stdout, stderr bytes.Buffer
+	code := doMailDelete(mp, events.Discard, []string{"msg-1", "msg-2"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doMailDelete = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	gotBytes, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("ReadFile(log): %v", err)
+	}
+	want := "delete msg-1\ndelete msg-2\n"
+	if got := string(gotBytes); got != want {
+		t.Fatalf("exec operations = %q, want %q", got, want)
+	}
+}
+
 // --- gc mail thread ---
 
 func TestMailThreadSuccess(t *testing.T) {
@@ -1657,6 +2092,57 @@ func TestMailArchiveAlreadyClosed(t *testing.T) {
 	}
 }
 
+func TestMailArchiveMultiSuccess(t *testing.T) {
+	store := beads.NewMemStore()
+	mp := beadmail.New(store)
+	for i := 0; i < 3; i++ {
+		if _, err := mp.Send("human", "mayor", "", "batch"); err != nil {
+			t.Fatalf("Send %d: %v", i, err)
+		}
+	}
+
+	var stdout, stderr bytes.Buffer
+	rec := &memRecorder{}
+	code := doMailArchive(mp, rec, []string{"gc-1", "gc-2", "gc-3"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doMailArchive = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	out := stdout.String()
+	for _, want := range []string{"Archived message gc-1", "Archived message gc-2", "Archived message gc-3"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("stdout missing %q:\n%s", want, out)
+		}
+	}
+	if n := len(rec.events); n != 3 {
+		t.Errorf("recorded events = %d, want 3", n)
+	}
+}
+
+func TestMailArchiveMultiPartialFailure(t *testing.T) {
+	mp := mail.NewFake()
+	m1, _ := mp.Send("human", "mayor", "", "one")
+	m2, _ := mp.Send("human", "mayor", "", "two")
+	if err := mp.Archive(m2.ID); err != nil {
+		t.Fatalf("pre-archive: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doMailArchive(mp, events.Discard, []string{m1.ID, m2.ID, "ghost"}, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("doMailArchive = %d, want 1; stderr: %s", code, stderr.String())
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "Archived message "+m1.ID) {
+		t.Errorf("stdout missing Archived for m1:\n%s", out)
+	}
+	if !strings.Contains(out, "Already archived "+m2.ID) {
+		t.Errorf("stdout missing Already archived for m2:\n%s", out)
+	}
+	if !strings.Contains(stderr.String(), "gc mail archive ghost") {
+		t.Errorf("stderr missing per-id error for ghost:\n%s", stderr.String())
+	}
+}
+
 // --- gc mail send --notify ---
 
 func TestMailSendNotifySuccess(t *testing.T) {
@@ -1838,6 +2324,17 @@ func TestMailSendToFlag(t *testing.T) {
 	}
 }
 
+func TestMailSendAcceptsNudgeAlias(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	cmd := newMailSendCmd(&stdout, &stderr)
+	if cmd.Flags().Lookup("nudge") == nil {
+		t.Fatal("send command missing --nudge alias")
+	}
+	if err := cmd.Flags().Set("nudge", "true"); err != nil {
+		t.Fatalf("set --nudge: %v", err)
+	}
+}
+
 // --- gc mail send --all ---
 
 func TestMailSendAll(t *testing.T) {
@@ -2041,6 +2538,143 @@ func TestMailCheckInjectFormatsMessages(t *testing.T) {
 	}
 }
 
+func TestMailCheckInjectLimitsMessageCount(t *testing.T) {
+	store := beads.NewMemStore()
+	mp := beadmail.New(store)
+	mp.Send("sender-a", "recipient", "", "first")  //nolint:errcheck
+	mp.Send("sender-b", "recipient", "", "second") //nolint:errcheck
+	mp.Send("sender-c", "recipient", "", "third")  //nolint:errcheck
+	mp.Send("sender-d", "recipient", "", "fourth") //nolint:errcheck
+
+	var stdout bytes.Buffer
+	code := doMailCheck(mp, "recipient", true, &stdout, &bytes.Buffer{})
+	if code != 0 {
+		t.Fatalf("doMailCheck = %d, want 0", code)
+	}
+
+	out := stdout.String()
+	for _, want := range []string{"4 unread message(s)", "gc-1 from sender-a", "gc-2 from sender-b", "gc-3 from sender-c", "Showing the first 3 message(s)"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("stdout missing %q:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, "gc-4") || strings.Contains(out, "fourth") {
+		t.Errorf("stdout should not include the fourth message:\n%s", out)
+	}
+}
+
+func TestMailCheckInjectTruncatesLongBodies(t *testing.T) {
+	store := beads.NewMemStore()
+	mp := beadmail.New(store)
+	longBody := "prefix " + strings.Repeat("x", mailInjectBodyPreviewSize+100)
+	mp.Send("sender-a", "recipient", "Long body", longBody) //nolint:errcheck
+
+	var stdout bytes.Buffer
+	code := doMailCheck(mp, "recipient", true, &stdout, &bytes.Buffer{})
+	if code != 0 {
+		t.Fatalf("doMailCheck = %d, want 0", code)
+	}
+
+	out := stdout.String()
+	if !strings.Contains(out, "Long body") {
+		t.Errorf("stdout missing subject:\n%s", out)
+	}
+	if !strings.Contains(out, "... [preview truncated]") {
+		t.Errorf("stdout missing truncation marker:\n%s", out)
+	}
+	if strings.Contains(out, strings.Repeat("x", mailInjectBodyPreviewSize+80)) {
+		t.Errorf("stdout includes too much of the long body:\n%s", out)
+	}
+}
+
+func TestMailCheckInjectCompactsAndBoundsLongSubjects(t *testing.T) {
+	store := beads.NewMemStore()
+	mp := beadmail.New(store)
+	longSubject := "subject\n\tline " + strings.Repeat("x", mailInjectBodyPreviewSize+100) + " tail"
+	mp.Send("sender-a", "recipient", longSubject, "short body") //nolint:errcheck
+
+	var stdout bytes.Buffer
+	code := doMailCheck(mp, "recipient", true, &stdout, &bytes.Buffer{})
+	if code != 0 {
+		t.Fatalf("doMailCheck = %d, want 0", code)
+	}
+
+	out := stdout.String()
+	if !strings.Contains(out, "[subject line ") {
+		t.Fatalf("stdout missing compacted subject prefix:\n%s", out)
+	}
+	if strings.Contains(out, "subject\n\tline") {
+		t.Fatalf("stdout contains raw multiline subject:\n%s", out)
+	}
+	if strings.Contains(out, strings.Repeat("x", mailInjectBodyPreviewSize+80)) {
+		t.Fatalf("stdout includes too much of the long subject:\n%s", out)
+	}
+	if !strings.Contains(out, "... [subject truncated]") {
+		t.Fatalf("stdout missing subject truncation marker:\n%s", out)
+	}
+}
+
+func TestMailCheckInjectOmitsSubjectWhenFullBodyMatches(t *testing.T) {
+	store := beads.NewMemStore()
+	mp := beadmail.New(store)
+	longBody := strings.Repeat("x", mailInjectBodyPreviewSize+100)
+	mp.Send("sender-a", "recipient", longBody, longBody) //nolint:errcheck
+
+	var stdout bytes.Buffer
+	code := doMailCheck(mp, "recipient", true, &stdout, &bytes.Buffer{})
+	if code != 0 {
+		t.Fatalf("doMailCheck = %d, want 0", code)
+	}
+
+	out := stdout.String()
+	if strings.Contains(out, "["+longBody+"]") {
+		t.Errorf("stdout should not repeat a matching subject after body truncation:\n%s", out)
+	}
+	if !strings.Contains(out, "gc-1 from sender-a: ") {
+		t.Errorf("stdout missing compact message format:\n%s", out)
+	}
+	if !strings.Contains(out, "... [preview truncated]") {
+		t.Errorf("stdout missing truncation marker:\n%s", out)
+	}
+}
+
+func TestMailInjectBodyPreviewUsesBoundedScan(t *testing.T) {
+	body := strings.Repeat(" ", mailInjectPreviewScanSize+1) + "tail"
+	preview, truncated := mailInjectBodyPreview(body)
+	if !truncated {
+		t.Fatalf("mailInjectBodyPreview did not truncate after scan budget")
+	}
+	if preview != "" {
+		t.Fatalf("mailInjectBodyPreview = %q, want empty preview after leading-space budget", preview)
+	}
+}
+
+func TestMailInjectBodyPreviewCompactsWhitespace(t *testing.T) {
+	preview, truncated := mailInjectBodyPreview(" first\n\tsecond   third ")
+	if truncated {
+		t.Fatalf("mailInjectBodyPreview truncated short body")
+	}
+	if preview != "first second third" {
+		t.Fatalf("mailInjectBodyPreview = %q, want %q", preview, "first second third")
+	}
+}
+
+func TestMailInjectBodyPreviewKeepsUTF8Boundary(t *testing.T) {
+	prefix := strings.Repeat("a", mailInjectBodyPreviewSize-1)
+	compact := prefix + "界tail"
+
+	preview, truncated := mailInjectBodyPreview(compact)
+	if !truncated {
+		t.Fatalf("mailInjectBodyPreview did not truncate long body")
+	}
+	if preview != prefix {
+		t.Fatalf("mailInjectBodyPreview = %q, want %q", preview, prefix)
+	}
+	if !utf8.ValidString(preview) {
+		t.Fatalf("mailInjectBodyPreview returned invalid UTF-8: %q", preview)
+	}
+}
+
 func TestMailCheckInjectDoesNotCloseBeads(t *testing.T) {
 	store := beads.NewMemStore()
 	mp := beadmail.New(store)
@@ -2098,3 +2732,127 @@ func TestMailCheckInjectFiltersCorrectly(t *testing.T) {
 		t.Errorf("stdout missing correct count:\n%s", out)
 	}
 }
+
+// --- ga-q6ct: identity-resolution session-list cache ---
+
+// countingMailIdentityListStore counts broad gc:session List calls (the same
+// query the cmd_mail identity-resolution path issues) so tests can assert the
+// per-command cache budget.
+type countingMailIdentityListStore struct {
+	beads.Store
+	sessionListCalls int
+}
+
+func (s *countingMailIdentityListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == session.LabelSession && len(query.Metadata) == 0 {
+		s.sessionListCalls++
+	}
+	return s.Store.List(query)
+}
+
+func TestResolveLiveConfiguredNamedMailTargetCached_SharesCacheAcrossCalls(t *testing.T) {
+	// Pin: when a single command invocation resolves multiple identity
+	// candidates (or recipient + sender both), the broad gc:session
+	// enumeration runs at most once via the shared cache.
+	base := beads.NewMemStore()
+	store := &countingMailIdentityListStore{Store: base}
+
+	if _, err := base.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata: "gascity/builder",
+			"alias":                      "builder-1",
+		},
+	}); err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+
+	cache := &mailIdentitySessionCache{}
+	for _, id := range []string{"unmatched-a", "unmatched-b", "unmatched-c"} {
+		if _, _, err := resolveLiveConfiguredNamedMailTargetCached(store, id, cache); err != nil {
+			t.Fatalf("resolve(%q): %v", id, err)
+		}
+	}
+
+	if store.sessionListCalls != 1 {
+		t.Errorf("broad gc:session List calls = %d, want 1 (cache must dedupe across resolutions)", store.sessionListCalls)
+	}
+}
+
+func TestResolveLiveConfiguredNamedMailTargetCached_NilCacheStillFetches(t *testing.T) {
+	// Backward-compat: passing nil cache should still resolve correctly,
+	// issuing a broad scan per call (the legacy behavior).
+	base := beads.NewMemStore()
+	store := &countingMailIdentityListStore{Store: base}
+
+	for _, id := range []string{"a", "b"} {
+		if _, _, err := resolveLiveConfiguredNamedMailTargetCached(store, id, nil); err != nil {
+			t.Fatalf("resolve(%q): %v", id, err)
+		}
+	}
+
+	if store.sessionListCalls != 2 {
+		t.Errorf("broad gc:session List calls = %d, want 2 (no cache → per-call scan)", store.sessionListCalls)
+	}
+}
+
+func TestListLiveSessionMailboxesCached_UsesCache(t *testing.T) {
+	// Pin: listLiveSessionMailboxesCached + a sibling resolve call sharing
+	// the same cache hit the store at most once for the broad enumeration.
+	base := beads.NewMemStore()
+	store := &countingMailIdentityListStore{Store: base}
+
+	if _, err := base.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata: "gascity/mayor",
+			"alias":                      "mayor",
+		},
+	}); err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+
+	cache := &mailIdentitySessionCache{}
+	if _, err := listLiveSessionMailboxesCached(store, cache); err != nil {
+		t.Fatalf("listLiveSessionMailboxesCached: %v", err)
+	}
+	if _, _, err := resolveLiveConfiguredNamedMailTargetCached(store, "no-match", cache); err != nil {
+		t.Fatalf("resolveLiveConfiguredNamedMailTargetCached: %v", err)
+	}
+
+	if store.sessionListCalls != 1 {
+		t.Errorf("broad gc:session List calls = %d, want 1 across listLiveSessionMailboxes + resolve sharing one cache", store.sessionListCalls)
+	}
+}
+
+func TestResolveMailIdentityWithConfigCached_SharedCacheSurvivesFallbackMiss(t *testing.T) {
+	// Pin: the shared cache must stay in effect even when identity resolution
+	// misses every shortcut and falls back to the generic resolution path.
+	base := beads.NewMemStore()
+	store := &countingMailIdentityListStore{Store: base}
+
+	if _, err := base.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata: "gascity/worker",
+			"alias":                      "worker",
+		},
+	}); err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+
+	cache := &mailIdentitySessionCache{}
+	if _, err := listLiveSessionMailboxesCached(store, cache); err != nil {
+		t.Fatalf("listLiveSessionMailboxesCached: %v", err)
+	}
+	if _, err := resolveMailIdentityWithConfigCached("", nil, store, "no-match", cache); !errors.Is(err, session.ErrSessionNotFound) {
+		t.Fatalf("resolveMailIdentityWithConfigCached(no-match) error = %v, want ErrSessionNotFound", err)
+	}
+
+	if store.sessionListCalls != 1 {
+		t.Errorf("broad gc:session List calls = %d, want 1 across listLiveSessionMailboxes + fallback miss resolution", store.sessionListCalls)
+	}
+}
diff --git a/cmd/gc/cmd_nudge.go b/cmd/gc/cmd_nudge.go
index 149b95b4f0..d38bed1e4a 100644
--- a/cmd/gc/cmd_nudge.go
+++ b/cmd/gc/cmd_nudge.go
@@ -84,6 +84,13 @@ func (t nudgeTarget) agentKey() string {
 	return t.sessionName
 }
 
+func (t nudgeTarget) pollerKey() string {
+	if t.sessionID != "" {
+		return t.sessionID
+	}
+	return t.agentKey()
+}
+
 func (t nudgeTarget) queueKeys() []string {
 	var keys []string
 	seen := map[string]bool{}
@@ -357,7 +364,7 @@ func cmdNudgeDrainWithFormat(args []string, inject bool, hookFormat string, stdo
 	}
 	var writeErr error
 	if inject {
-		writeErr = writeProviderHookContext(stdout, hookFormat, out)
+		writeErr = writeProviderHookContextForEvent(stdout, hookFormat, "UserPromptSubmit", out)
 	} else {
 		_, writeErr = io.WriteString(stdout, out)
 	}
@@ -450,7 +457,7 @@ func cmdNudgePoll(args []string, sessionName string, interval, quiescence time.D
 			return 0
 		}
 		missingSince = time.Time{}
-		delivered, pollErr := tryDeliverQueuedNudgesByPoller(target, store, sp, quiescence)
+		delivered, pollErr := tryDeliverQueuedNudgesByPoller(target, store, sp, quiescence, obs)
 		if pollErr != nil {
 			fmt.Fprintf(stderr, "gc nudge poll: %v\n", pollErr) //nolint:errcheck
 		}
@@ -719,8 +726,8 @@ func parseNudgeDeliveryMode(raw string) (nudgeDeliveryMode, error) {
 	}
 }
 
-func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp runtime.Provider, quiescence time.Duration) (bool, error) {
-	if !pollerSessionIdleEnough(target, store, sp, quiescence) {
+func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp runtime.Provider, quiescence time.Duration, obs worker.LiveObservation) (bool, error) {
+	if !pollerSessionIdleEnough(target, sp, quiescence, obs) {
 		return false, nil
 	}
 	items, err := claimDueQueuedNudgesForTarget(target.cityPath, target, time.Now())
@@ -779,12 +786,25 @@ func tryDeliverQueuedNudgesByPoller(target nudgeTarget, store beads.Store, sp ru
 	return true, ackQueuedNudges(target.cityPath, queuedNudgeIDs(items))
 }
 
-func pollerSessionIdleEnough(target nudgeTarget, store beads.Store, sp runtime.Provider, quiescence time.Duration) bool {
-	obs, err := workerObserveNudgeTarget(target, store, sp)
-	if err != nil || obs.LastActivity == nil || obs.LastActivity.IsZero() {
+func pollerSessionIdleEnough(target nudgeTarget, sp runtime.Provider, quiescence time.Duration, obs worker.LiveObservation) bool {
+	if quiescence <= 0 {
+		return true
+	}
+	if obs.LastActivity != nil && !obs.LastActivity.IsZero() {
+		return time.Since(*obs.LastActivity) >= quiescence
+	}
+	if target.sessionName == "" {
+		return false
+	}
+	waiter, ok := sp.(runtime.IdleWaitProvider)
+	if !ok {
 		return false
 	}
-	return time.Since(*obs.LastActivity) >= quiescence
+	// The poller may take up to the quiescence window to exit while this
+	// runtime idle check is in progress.
+	ctx, cancel := context.WithTimeout(context.Background(), quiescence)
+	defer cancel()
+	return waiter.WaitForIdle(ctx, target.sessionName, quiescence) == nil
 }
 
 func maybeStartNudgePoller(target nudgeTarget) {
@@ -794,7 +814,7 @@ func maybeStartNudgePoller(target nudgeTarget) {
 	if target.sessionTransport() == "acp" {
 		return
 	}
-	if err := startNudgePoller(target.cityPath, target.agentKey(), target.sessionName); err != nil {
+	if err := startNudgePoller(target.cityPath, target.pollerKey(), target.sessionName); err != nil {
 		return
 	}
 }
@@ -1393,9 +1413,9 @@ func pruneExpiredQueuedNudges(state *nudgeQueueState, store beads.Store, now tim
 				item.LastError = "expired"
 			}
 			state.Dead = append(state.Dead, item)
-			if err := markQueuedNudgeTerminal(store, item, "expired", item.LastError, "", now); err != nil {
-				return err
-			}
+			// Best-effort: remove expired item from pending even if bead update fails.
+			// A failed bead update here would trap the item in pending forever.
+			_ = markQueuedNudgeTerminal(store, item, "expired", item.LastError, "", now)
 			continue
 		}
 		filtered = append(filtered, item)
@@ -1414,9 +1434,8 @@ func recoverExpiredInFlightNudges(state *nudgeQueueState, store beads.Store, now
 				item.LastError = "expired"
 			}
 			state.Dead = append(state.Dead, item)
-			if err := markQueuedNudgeTerminal(store, item, "expired", item.LastError, "", now); err != nil {
-				return err
-			}
+			// Best-effort: remove expired item from in-flight even if bead update fails.
+			_ = markQueuedNudgeTerminal(store, item, "expired", item.LastError, "", now)
 			continue
 		}
 		if item.LeaseUntil.IsZero() || !item.LeaseUntil.After(now) {
diff --git a/cmd/gc/cmd_nudge_test.go b/cmd/gc/cmd_nudge_test.go
index 07e739b201..5a5f126001 100644
--- a/cmd/gc/cmd_nudge_test.go
+++ b/cmd/gc/cmd_nudge_test.go
@@ -15,12 +15,9 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/session"
+	"github.com/gastownhall/gascity/internal/worker"
 )
 
-type noActivityCapabilityProvider struct {
-	*runtime.Fake
-}
-
 func intPtrNudge(n int) *int { return &n }
 
 type missingNudgeBeadStore struct {
@@ -42,6 +39,25 @@ func (s *missingNudgeBeadStore) Close(id string) error {
 	return s.MemStore.Close(id)
 }
 
+type ambiguousNudgeBeadStore struct {
+	*beads.MemStore
+	ambiguousID string
+}
+
+func (s *ambiguousNudgeBeadStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if id == s.ambiguousID {
+		return fmt.Errorf("setting metadata on %q: exit status 1: Error resolving %s: ambiguous ID %q matches 86 issues: [gc-170 gc-171 gc-172 ...]\nUse more characters to disambiguate", id, id, id)
+	}
+	return s.MemStore.SetMetadataBatch(id, kvs)
+}
+
+func (s *ambiguousNudgeBeadStore) Close(id string) error {
+	if id == s.ambiguousID {
+		return fmt.Errorf("closing bead %q: exit status 1: Error resolving %s: ambiguous ID %q matches 86 issues: [gc-170 gc-171 gc-172 ...]\nUse more characters to disambiguate", id, id, id)
+	}
+	return s.MemStore.Close(id)
+}
+
 type unrelatedNotFoundNudgeBeadStore struct {
 	*beads.MemStore
 	errorID string
@@ -54,10 +70,6 @@ func (s *unrelatedNotFoundNudgeBeadStore) SetMetadataBatch(id string, kvs map[st
 	return s.MemStore.SetMetadataBatch(id, kvs)
 }
 
-func (p *noActivityCapabilityProvider) Capabilities() runtime.ProviderCapabilities {
-	return runtime.ProviderCapabilities{}
-}
-
 func TestMarkQueuedNudgeTerminalFallsBackWhenStoredBeadIDEmpty(t *testing.T) {
 	store := beads.NewMemStore()
 	item := queuedNudge{
@@ -193,6 +205,75 @@ func TestPruneExpiredQueuedNudgesIgnoresMissingTerminalBead(t *testing.T) {
 	}
 }
 
+func TestMarkQueuedNudgeTerminalHandlesAmbiguousBeadID(t *testing.T) {
+	store := &ambiguousNudgeBeadStore{MemStore: beads.NewMemStore(), ambiguousID: "gc-17"}
+	item := queuedNudge{
+		ID:        "nudge-ambiguous",
+		Agent:     "wendy.wendy",
+		SessionID: "mc-ayq6xi",
+		Source:    "session",
+		Message:   "follow up",
+		BeadID:    "gc-17",
+		CreatedAt: time.Now().Add(-time.Minute).UTC(),
+	}
+	createdID, created, err := ensureQueuedNudgeBead(store, item)
+	if err != nil {
+		t.Fatalf("ensureQueuedNudgeBead: %v", err)
+	}
+	if !created {
+		t.Fatal("expected ensureQueuedNudgeBead to create a backing nudge bead")
+	}
+
+	now := time.Now().UTC()
+	item.LastError = "expired"
+	if err := markQueuedNudgeTerminal(store, item, "expired", "expired", "", now); err != nil {
+		t.Fatalf("markQueuedNudgeTerminal with ambiguous BeadID: %v", err)
+	}
+
+	bead, err := store.Get(createdID)
+	if err != nil {
+		t.Fatalf("Get(%q): %v", createdID, err)
+	}
+	if bead.Status != "closed" {
+		t.Fatalf("bead.Status = %q, want closed", bead.Status)
+	}
+	if bead.Metadata["state"] != "expired" {
+		t.Fatalf("state = %q, want expired", bead.Metadata["state"])
+	}
+}
+
+func TestPruneExpiredQueuedNudgesWithAmbiguousBeadIDContinues(t *testing.T) {
+	// Regression: stale entries with short bead IDs (e.g. "gc-17") that match many
+	// beads in a large store used to abort the entire nudge processing loop.
+	store := &ambiguousNudgeBeadStore{MemStore: beads.NewMemStore(), ambiguousID: "gc-17"}
+	now := time.Now().UTC()
+	state := &nudgeQueueState{
+		Pending: []queuedNudge{
+			{
+				ID:           "nudge-ambiguous",
+				BeadID:       "gc-17",
+				Agent:        "gc-ub35o",
+				SessionID:    "gc-ub35o",
+				Source:       "session",
+				Message:      "Run gc hook",
+				CreatedAt:    now.Add(-8 * 24 * time.Hour),
+				DeliverAfter: now.Add(-8 * 24 * time.Hour),
+				ExpiresAt:    now.Add(-7 * 24 * time.Hour),
+			},
+		},
+	}
+
+	if err := pruneExpiredQueuedNudges(state, store, now); err != nil {
+		t.Fatalf("pruneExpiredQueuedNudges: %v", err)
+	}
+	if len(state.Pending) != 0 {
+		t.Fatalf("pending = %d, want 0 (stale entry must be pruned)", len(state.Pending))
+	}
+	if len(state.Dead) != 1 {
+		t.Fatalf("dead = %d, want 1", len(state.Dead))
+	}
+}
+
 func TestDeliverSessionNudgeWithProviderWaitIdleQueuesForCodex(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	dir := t.TempDir()
@@ -485,16 +566,49 @@ func TestDeliverSessionNudgeWithProviderWaitIdleStartsClaudePollerWhenQueued(t *
 	}
 }
 
-func TestPollerSessionIdleEnoughUsesLastActivityWithoutCapabilityFlag(t *testing.T) {
+func TestPollerSessionIdleEnoughUsesSuppliedLastActivity(t *testing.T) {
+	target := nudgeTarget{sessionName: "sess-worker"}
+	last := time.Now().Add(-5 * time.Second)
+	obs := worker.LiveObservation{LastActivity: &last}
+
+	if !pollerSessionIdleEnough(target, nil, 3*time.Second, obs) {
+		t.Fatal("pollerSessionIdleEnough = false, want true when supplied last activity is old enough")
+	}
+
+	recent := time.Now().Add(-1 * time.Second)
+	obs.LastActivity = &recent
+	if pollerSessionIdleEnough(target, nil, 3*time.Second, obs) {
+		t.Fatal("pollerSessionIdleEnough = true, want false when supplied last activity is too recent")
+	}
+}
+
+func TestPollerSessionIdleEnoughFallsBackToIdleWaitWhenActivityUnavailable(t *testing.T) {
 	fake := runtime.NewFake()
 	if err := fake.Start(context.Background(), "sess-worker", runtime.Config{}); err != nil {
 		t.Fatalf("Start: %v", err)
 	}
-	fake.SetActivity("sess-worker", time.Now().Add(-5*time.Second))
+	fake.WaitForIdleErrors["sess-worker"] = nil
 	target := nudgeTarget{sessionName: "sess-worker"}
+	obs := worker.LiveObservation{}
 
-	if !pollerSessionIdleEnough(target, nil, &noActivityCapabilityProvider{Fake: fake}, 3*time.Second) {
-		t.Fatal("pollerSessionIdleEnough = false, want true when last activity is old enough")
+	if !pollerSessionIdleEnough(target, fake, 3*time.Second, obs) {
+		t.Fatal("pollerSessionIdleEnough = false, want idle wait fallback to allow delivery")
+	}
+
+	var sawWait bool
+	for _, call := range fake.Calls {
+		if call.Method == "WaitForIdle" && call.Name == "sess-worker" {
+			sawWait = true
+			break
+		}
+	}
+	if !sawWait {
+		t.Fatalf("calls = %#v, want WaitForIdle fallback", fake.Calls)
+	}
+
+	fake.WaitForIdleErrors["sess-worker"] = errors.New("timed out waiting for idle")
+	if pollerSessionIdleEnough(target, fake, 3*time.Second, obs) {
+		t.Fatal("pollerSessionIdleEnough = true, want idle wait error to suppress delivery")
 	}
 }
 
@@ -757,6 +871,61 @@ func TestSendMailNotifyWithProviderStartsClaudePollerWhenQueueingRunningSession(
 	}
 }
 
+func TestSendMailNotifyWithWorkerStartsPollerBySessionIDForAliasedTarget(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	dir := t.TempDir()
+	store := openNudgeBeadStore(dir)
+	fake := runtime.NewFake()
+	mgr := newSessionManagerWithConfig(dir, store, fake, nil)
+	info, err := mgr.Create(context.Background(), "mayor", "Mayor", "codex", dir, "codex", nil, session.ProviderResume{}, runtime.Config{WorkDir: dir})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := mgr.Start(context.Background(), info.ID, "", runtime.Config{WorkDir: dir}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := store.SetMetadata(info.ID, "alias", "mayor"); err != nil {
+		t.Fatalf("SetMetadata(alias): %v", err)
+	}
+	target := nudgeTarget{
+		cityPath:    dir,
+		alias:       "mayor",
+		agent:       config.Agent{Name: "mayor", MaxActiveSessions: intPtrNudge(1)},
+		sessionID:   info.ID,
+		resolved:    &config.ResolvedProvider{Name: "codex"},
+		sessionName: info.SessionName,
+	}
+
+	called := false
+	prev := startNudgePoller
+	startNudgePoller = func(cityPath, agentName, sessionName string) error {
+		called = true
+		if cityPath != dir || agentName != info.ID || sessionName != info.SessionName {
+			t.Fatalf("unexpected poller args city=%q agent=%q session=%q", cityPath, agentName, sessionName)
+		}
+		return nil
+	}
+	t.Cleanup(func() { startNudgePoller = prev })
+
+	if err := sendMailNotifyWithWorker(target, store, fake, "human"); err != nil {
+		t.Fatalf("sendMailNotifyWithWorker: %v", err)
+	}
+	if !called {
+		t.Fatal("startNudgePoller was not called")
+	}
+
+	pending, inFlight, dead, err := listQueuedNudgesForTarget(dir, target, time.Now())
+	if err != nil {
+		t.Fatalf("listQueuedNudgesForTarget: %v", err)
+	}
+	if len(pending) != 1 || len(inFlight) != 0 || len(dead) != 0 {
+		t.Fatalf("pending/inFlight/dead = %d/%d/%d, want 1/0/0", len(pending), len(inFlight), len(dead))
+	}
+	if pending[0].Agent != "mayor" || pending[0].SessionID != info.ID {
+		t.Fatalf("queued nudge agent/session = %q/%q, want mayor/%s", pending[0].Agent, pending[0].SessionID, info.ID)
+	}
+}
+
 func TestSendMailNotifyWithProviderWaitIdleWrapsDirectDeliveryInSystemReminder(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	dir := t.TempDir()
@@ -981,7 +1150,8 @@ func TestTryDeliverQueuedNudgesByPollerDeliversAndAcks(t *testing.T) {
 	if err := mgr.Start(context.Background(), info.ID, "", runtime.Config{WorkDir: dir}); err != nil {
 		t.Fatalf("Start: %v", err)
 	}
-	fake.Activity = map[string]time.Time{info.SessionName: time.Now().Add(-10 * time.Second)}
+	idleSince := time.Now().Add(-10 * time.Second)
+	fake.Activity = map[string]time.Time{info.SessionName: idleSince}
 
 	target := nudgeTarget{
 		cityPath:    dir,
@@ -990,8 +1160,9 @@ func TestTryDeliverQueuedNudgesByPollerDeliversAndAcks(t *testing.T) {
 		resolved:    &config.ResolvedProvider{Name: "codex"},
 		sessionName: info.SessionName,
 	}
+	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, store, fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
@@ -1042,7 +1213,8 @@ func TestTryDeliverQueuedNudgesByPollerLeavesACPDeliveryUnwrapped(t *testing.T)
 	if err := fake.Start(context.Background(), "sess-worker", runtime.Config{}); err != nil {
 		t.Fatalf("Start: %v", err)
 	}
-	fake.Activity = map[string]time.Time{"sess-worker": time.Now().Add(-10 * time.Second)}
+	idleSince := time.Now().Add(-10 * time.Second)
+	fake.Activity = map[string]time.Time{"sess-worker": idleSince}
 
 	target := nudgeTarget{
 		cityPath:    dir,
@@ -1051,8 +1223,9 @@ func TestTryDeliverQueuedNudgesByPollerLeavesACPDeliveryUnwrapped(t *testing.T)
 		resolved:    &config.ResolvedProvider{Name: "codex"},
 		sessionName: "sess-worker",
 	}
+	obs := worker.LiveObservation{Running: true, LastActivity: &idleSince}
 
-	delivered, err := tryDeliverQueuedNudgesByPoller(target, openNudgeBeadStore(dir), fake, 3*time.Second)
+	delivered, err := tryDeliverQueuedNudgesByPoller(target, openNudgeBeadStore(dir), fake, 3*time.Second, obs)
 	if err != nil {
 		t.Fatalf("tryDeliverQueuedNudgesByPoller: %v", err)
 	}
diff --git a/cmd/gc/cmd_order.go b/cmd/gc/cmd_order.go
index 1a3c7d09aa..c103f19700 100644
--- a/cmd/gc/cmd_order.go
+++ b/cmd/gc/cmd_order.go
@@ -32,7 +32,7 @@ tick and dispatches work when a trigger opens.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(_ *cobra.Command, args []string) error {
 			if len(args) == 0 {
-				fmt.Fprintln(stderr, "gc order: missing subcommand (list, show, run, check, history)") //nolint:errcheck // best-effort stderr
+				fmt.Fprintln(stderr, "gc order: missing subcommand (list, show, run, check, history, sweep-tracking)") //nolint:errcheck // best-effort stderr
 			} else {
 				fmt.Fprintf(stderr, "gc order: unknown subcommand %q\n", args[0]) //nolint:errcheck // best-effort stderr
 			}
@@ -45,6 +45,7 @@ tick and dispatches work when a trigger opens.`,
 		newOrderRunCmd(stdout, stderr),
 		newOrderCheckCmd(stdout, stderr),
 		newOrderHistoryCmd(stdout, stderr),
+		newOrderSweepTrackingCmd(stdout, stderr),
 	)
 	return cmd
 }
@@ -84,8 +85,10 @@ Use --rig to disambiguate same-name orders in different rigs.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeOrderNames,
 	}
 	cmd.Flags().StringVar(&rig, "rig", "", "rig name to disambiguate same-name orders")
+	_ = cmd.RegisterFlagCompletionFunc("rig", completeRigFlagNames)
 	return cmd
 }
 
@@ -107,8 +110,10 @@ Use --rig to disambiguate same-name orders in different rigs.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeOrderNames,
 	}
 	cmd.Flags().StringVar(&rig, "rig", "", "rig name to disambiguate same-name orders")
+	_ = cmd.RegisterFlagCompletionFunc("rig", completeRigFlagNames)
 	return cmd
 }
 
@@ -150,8 +155,33 @@ name. Use --rig to filter by rig.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeOrderNames,
 	}
 	cmd.Flags().StringVar(&rig, "rig", "", "rig name to filter order history")
+	_ = cmd.RegisterFlagCompletionFunc("rig", completeRigFlagNames)
+	return cmd
+}
+
+func newOrderSweepTrackingCmd(stdout, stderr io.Writer) *cobra.Command {
+	staleAfter := defaultOrderTrackingSweepStaleAfter
+	quiet := false
+	cmd := &cobra.Command{
+		Use:   "sweep-tracking",
+		Short: "Close stale order-tracking beads",
+		Long: `Close stale open order-tracking beads.
+
+This is intended for maintenance exec orders. It only closes tracking beads
+older than --stale-after so a fresh in-flight order is not interrupted.`,
+		Args: cobra.NoArgs,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			if cmdOrderSweepTracking(staleAfter, quiet, stdout, stderr) != 0 {
+				return errExit
+			}
+			return nil
+		},
+	}
+	cmd.Flags().DurationVar(&staleAfter, "stale-after", defaultOrderTrackingSweepStaleAfter, "minimum age for an open tracking bead to be closed")
+	cmd.Flags().BoolVar(&quiet, "quiet", false, "suppress success output")
 	return cmd
 }
 
@@ -416,6 +446,18 @@ func cmdOrderRun(name, rig string, stdout, stderr io.Writer) int {
 		return 1
 	}
 	if a.IsExec() {
+		if a.Trigger == "event" {
+			store, storeCode := openOrderStoreForOrder(cityPath, cfg, a, stderr, "gc order run")
+			if store == nil {
+				return storeCode
+			}
+			ep, epCode := openCityEventsProvider(stderr, "gc order run")
+			if ep == nil {
+				return epCode
+			}
+			defer ep.Close() //nolint:errcheck // best-effort
+			return doOrderRunExecTracked(a, cityPath, cfg, store, ep, stdout, stderr)
+		}
 		return doOrderRunExec(a, cityPath, cfg, stdout, stderr)
 	}
 	store, storeCode := openOrderStoreForOrder(cityPath, cfg, a, stderr, "gc order run")
@@ -448,13 +490,19 @@ func doOrderRun(aa []orders.Order, name, rig, cityPath string, store beads.Store
 			fmt.Fprintf(stderr, "gc order run: %v\n", cfgErr) //nolint:errcheck // best-effort stderr
 			return 1
 		}
-		return doOrderRunExec(a, cityPath, cfg, stdout, stderr)
+		return doOrderRunExecTracked(a, cityPath, cfg, store, ep, stdout, stderr)
 	}
 
-	// Capture event head before wisp creation (race-free cursor).
+	// Capture event head before wisp creation (race-free cursor). Event runs
+	// fail closed when the cursor cannot be read.
 	var headSeq uint64
 	if a.Trigger == "event" && ep != nil {
-		headSeq, _ = ep.LatestSeq()
+		var err error
+		headSeq, err = ep.LatestSeq()
+		if err != nil {
+			fmt.Fprintf(stderr, "gc order run: reading event cursor for %s: %v\n", a.ScopedName(), err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
 	}
 
 	scoped := a.ScopedName()
@@ -486,8 +534,16 @@ func doOrderRun(aa []orders.Order, name, rig, cityPath string, store beads.Store
 		return 1
 	}
 
+	var pool string
+	if a.Pool != "" {
+		pool, err = qualifyOrderPool(a, cfg)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc order run: %v\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+	}
+
 	if a.Pool != "" && cfg != nil {
-		pool := qualifyPool(a.Pool, a.Rig)
 		if err := applyGraphRouting(recipe, nil, pool, nil, "", "", "", "", store, cityName, cityPath, cfg); err != nil {
 			fmt.Fprintf(stderr, "gc order run: routing decoration failed: %v\n", err) //nolint:errcheck // best-effort stderr
 		}
@@ -512,9 +568,7 @@ func doOrderRun(aa []orders.Order, name, rig, cityPath string, store beads.Store
 		)
 	}
 	if a.Pool != "" {
-		update.Metadata = map[string]string{
-			"gc.routed_to": qualifyPool(a.Pool, a.Rig),
-		}
+		update.Metadata = map[string]string{"gc.routed_to": pool}
 	}
 	if err := store.Update(rootID, update); err != nil {
 		fmt.Fprintf(stderr, "gc order run: labeling wisp: %v\n", err) //nolint:errcheck // best-effort stderr
@@ -523,12 +577,52 @@ func doOrderRun(aa []orders.Order, name, rig, cityPath string, store beads.Store
 
 	fmt.Fprintf(stdout, "Order %q executed: wisp %s", name, rootID) //nolint:errcheck
 	if a.Pool != "" {
-		fmt.Fprintf(stdout, " → gc.routed_to=%s", qualifyPool(a.Pool, a.Rig)) //nolint:errcheck
+		fmt.Fprintf(stdout, " → gc.routed_to=%s", pool) //nolint:errcheck
 	}
 	fmt.Fprintln(stdout) //nolint:errcheck
 	return 0
 }
 
+func doOrderRunExecTracked(a orders.Order, cityPath string, cfg *config.City, store beads.Store, ep events.Provider, stdout, stderr io.Writer) int {
+	if a.Trigger != "event" || ep == nil {
+		return doOrderRunExec(a, cityPath, cfg, stdout, stderr)
+	}
+
+	scoped := a.ScopedName()
+	headSeq, err := ep.LatestSeq()
+	if err != nil {
+		fmt.Fprintf(stderr, "gc order run: reading event cursor for %s: %v\n", scoped, err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	tracking, err := store.Create(beads.Bead{
+		Title:  "order:" + scoped,
+		Labels: []string{"order-run:" + scoped, labelOrderTracking},
+	})
+	if err != nil {
+		fmt.Fprintf(stderr, "gc order run: creating exec tracking bead for %s: %v\n", scoped, err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	defer store.Close(tracking.ID) //nolint:errcheck // best-effort close
+
+	// Persist the event cursor before running the command so manual event execs
+	// do not leave the controller cursor stale after the side effect.
+	if err := store.Update(tracking.ID, beads.UpdateOpts{Labels: eventCursorLabels(scoped, headSeq)}); err != nil {
+		fmt.Fprintf(stderr, "gc order run: labeling exec event cursor for %s: %v\n", scoped, err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+
+	code := doOrderRunExec(a, cityPath, cfg, stdout, stderr)
+	labels := []string{"exec"}
+	if code != 0 {
+		labels = []string{"exec-failed"}
+	}
+	if err := store.Update(tracking.ID, beads.UpdateOpts{Labels: labels}); err != nil {
+		fmt.Fprintf(stderr, "gc order run: labeling exec tracking bead for %s: %v\n", scoped, err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	return code
+}
+
 // doOrderRunExec runs an exec order directly via shell.
 func doOrderRunExec(a orders.Order, cityPath string, cfg *config.City, stdout, stderr io.Writer) int {
 	var maxTimeout time.Duration
@@ -574,7 +668,7 @@ func cmdOrderCheck(stdout, stderr io.Writer) int {
 		return epCode
 	}
 	defer ep.Close() //nolint:errcheck // best-effort
-	return doOrderCheckWithStoresResolver(aa, time.Now(), ep, cachedOrderStoresResolver(cityPath, cfg), stdout, stderr)
+	return doOrderCheckWithStoresResolverScoped(cityPath, cfg, aa, time.Now(), ep, cachedOrderStoresResolver(cityPath, cfg), stdout, stderr)
 }
 
 // orderLastRunFn returns a LastRunFunc that queries BdStore for the most
@@ -638,6 +732,10 @@ func doOrderCheck(aa []orders.Order, now time.Time, lastRunFn orders.LastRunFunc
 }
 
 func doOrderCheckWithStoresResolver(aa []orders.Order, now time.Time, ep events.Provider, resolveStores orderStoresResolver, stdout, stderr io.Writer) int {
+	return doOrderCheckWithStoresResolverScoped("", nil, aa, now, ep, resolveStores, stdout, stderr)
+}
+
+func doOrderCheckWithStoresResolverScoped(cityPath string, cfg *config.City, aa []orders.Order, now time.Time, ep events.Provider, resolveStores orderStoresResolver, stdout, stderr io.Writer) int {
 	if len(aa) == 0 {
 		fmt.Fprintln(stdout, "No orders found.") //nolint:errcheck // best-effort stdout
 		return 1
@@ -676,7 +774,12 @@ func doOrderCheckWithStoresResolver(aa []orders.Order, now time.Time, ep events.
 				return cursor
 			}
 		}
-		result := orders.CheckTrigger(a, now, lastRunFn, ep, cursorFn)
+		triggerOpts, err := orderTriggerOptions(cityPath, cfg, a)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc order check: %v\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+		result := orders.CheckTriggerWithOptions(a, now, lastRunFn, ep, cursorFn, triggerOpts)
 		if lastRunErr != nil {
 			fmt.Fprintf(stderr, "gc order check: reading last run for %s: %v\n", a.ScopedName(), lastRunErr) //nolint:errcheck // best-effort stderr
 			return 1
@@ -835,6 +938,34 @@ func doOrderHistoryWithStoresResolver(name, rig string, aa []orders.Order, resol
 	return 0
 }
 
+// --- gc order sweep-tracking ---
+
+func cmdOrderSweepTracking(staleAfter time.Duration, quiet bool, stdout, stderr io.Writer) int {
+	if staleAfter <= 0 {
+		fmt.Fprintln(stderr, "gc order sweep-tracking: --stale-after must be positive") //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	cityPath, err := resolveCity()
+	if err != nil {
+		fmt.Fprintf(stderr, "gc order sweep-tracking: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	store, err := openStoreAtForCity(cityPath, cityPath)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc order sweep-tracking: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	closed, err := sweepStaleOrderTracking(store, time.Now(), staleAfter, nil, orderTrackingSweepMetadataInitiator)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc order sweep-tracking: %v\n", err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	if !quiet {
+		fmt.Fprintf(stdout, "closed %d stale order-tracking bead(s)\n", closed) //nolint:errcheck // best-effort stdout
+	}
+	return 0
+}
+
 // findOrder looks up an order by name and optional rig.
 // When rig is empty, returns the first match by name (prefers city-level).
 // When rig is non-empty, matches exact rig.
diff --git a/cmd/gc/cmd_order_test.go b/cmd/gc/cmd_order_test.go
index 33861e865c..56c46ec84c 100644
--- a/cmd/gc/cmd_order_test.go
+++ b/cmd/gc/cmd_order_test.go
@@ -599,6 +599,37 @@ func TestOrderCheckWithStoresResolverUsesLegacyCityStore(t *testing.T) {
 	}
 }
 
+func TestOrderCheckConditionUsesCityScope(t *testing.T) {
+	cityDir := t.TempDir()
+	orderDir := filepath.Join(cityDir, "packs", "workflows", "orders")
+	check := fmt.Sprintf(
+		`test "$GC_CITY_PATH" = '%s' && test "$GC_STORE_ROOT" = '%s' && test "$GC_STORE_SCOPE" = city && test "$ORDER_DIR" = '%s'`,
+		cityDir,
+		cityDir,
+		orderDir,
+	)
+	aa := []orders.Order{{
+		Name:    "pr-review-router",
+		Trigger: "condition",
+		Check:   check,
+		Formula: "mol-pr-review-router",
+		Pool:    "workflows.pr-review-router",
+		Source:  filepath.Join(orderDir, "pr-review-router.toml"),
+	}}
+	resolver := func(orders.Order) ([]beads.Store, error) {
+		return []beads.Store{beads.NewMemStore()}, nil
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderCheckWithStoresResolverScoped(cityDir, &config.City{}, aa, time.Now(), nil, resolver, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doOrderCheckWithStoresResolverScoped = %d, want 0; stderr: %s; stdout: %s", code, stderr.String(), stdout.String())
+	}
+	if !strings.Contains(stdout.String(), "yes") {
+		t.Fatalf("stdout missing due row:\n%s", stdout.String())
+	}
+}
+
 func TestOrderCheckWithStoresResolverFailsWhenLegacyEventCursorReadFails(t *testing.T) {
 	rigStore := beads.NewMemStore()
 	legacyStore := labelFailListStore{
@@ -690,6 +721,312 @@ func TestOrderRun(t *testing.T) {
 	}
 }
 
+func TestOrderRunEventExecAdvancesCursor(t *testing.T) {
+	cityDir := t.TempDir()
+	writeFile(t, filepath.Join(cityDir, "city.toml"), `[workspace]
+name = "test-city"
+`)
+	store := beads.NewMemStore()
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+	aa := []orders.Order{{
+		Name:    "release-exec",
+		Trigger: "event",
+		On:      events.BeadClosed,
+		Exec:    "printf ok",
+	}}
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "release-exec", "", cityDir, store, eventLog, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doOrderRun = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	results, err := store.ListByLabel("order-run:release-exec", 0, beads.IncludeClosed)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("store.ListByLabel() len = %d, want 1 (%#v)", len(results), results)
+	}
+	for _, want := range []string{"order:release-exec", fmt.Sprintf("seq:%d", headSeq), "exec"} {
+		if !slicesContain(results[0].Labels, want) {
+			t.Fatalf("tracking bead labels = %v, want %s", results[0].Labels, want)
+		}
+	}
+}
+
+func TestCmdOrderRunEventExecAdvancesCursor(t *testing.T) {
+	cityDir := t.TempDir()
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
+	t.Setenv("GC_EVENTS", "")
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", cityDir)
+	t.Setenv("GC_CITY_ROOT", cityDir)
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	t.Chdir(cityDir)
+
+	writeFile(t, filepath.Join(cityDir, "city.toml"), `[workspace]
+name = "test-city"
+`)
+	if err := os.MkdirAll(filepath.Join(cityDir, "orders"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(cityDir, "orders", "release-exec.toml"), `[order]
+exec = "printf ok"
+trigger = "event"
+on = "bead.closed"
+`)
+	var eventStderr bytes.Buffer
+	eventLog, err := events.NewFileRecorder(filepath.Join(cityDir, ".gc", "events.jsonl"), &eventStderr)
+	if err != nil {
+		t.Fatalf("NewFileRecorder(): %v", err)
+	}
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+	if err := eventLog.Close(); err != nil {
+		t.Fatalf("Close(): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := cmdOrderRun("release-exec", "", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdOrderRun = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	store, err := openStoreAtForCity(cityDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(): %v", err)
+	}
+	results, err := store.ListByLabel("order-run:release-exec", 0, beads.IncludeClosed)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("store.ListByLabel() len = %d, want 1 (%#v)", len(results), results)
+	}
+	for _, want := range []string{"order:release-exec", fmt.Sprintf("seq:%d", headSeq), "exec"} {
+		if !slicesContain(results[0].Labels, want) {
+			t.Fatalf("tracking bead labels = %v, want %s", results[0].Labels, want)
+		}
+	}
+}
+
+func TestOrderRunEventFormulaLatestSeqErrorDoesNotInstantiate(t *testing.T) {
+	aa := []orders.Order{{
+		Name:         "release-watch",
+		Trigger:      "event",
+		On:           events.BeadClosed,
+		Formula:      "test-formula",
+		FormulaLayer: sharedTestFormulaDir,
+	}}
+	store := beads.NewMemStore()
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "release-watch", "", "/city", store, events.NewFailFake(), &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("doOrderRun = %d, want 1 when event cursor cannot be read; stdout: %s", code, stdout.String())
+	}
+	results, err := store.ListByLabel("order-run:release-watch", 0, beads.IncludeClosed)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 0 {
+		t.Fatalf("store.ListByLabel() len = %d, want 0 (%#v)", len(results), results)
+	}
+	if !strings.Contains(stderr.String(), "reading event cursor for release-watch") {
+		t.Fatalf("stderr = %q, want event cursor read failure", stderr.String())
+	}
+}
+
+func TestOrderRunResolvesPackBindingForPool(t *testing.T) {
+	aa := []orders.Order{
+		{Name: "digest", Formula: "mol-digest", Trigger: "cooldown", Interval: "24h", Pool: "dog", FormulaLayer: sharedTestFormulaDir},
+	}
+	cityDir := t.TempDir()
+	writeOrderRunImportFixture(t, cityDir, "maintenance")
+	store := beads.NewMemStore()
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "digest", "", cityDir, store, nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doOrderRun = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	results, err := store.ListByLabel("order-run:digest", 0)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("store.ListByLabel() len = %d, want 1 (%#v)", len(results), results)
+	}
+	if got := results[0].Metadata["gc.routed_to"]; got != "maintenance.dog" {
+		t.Fatalf("gc.routed_to = %q, want maintenance.dog", got)
+	}
+	if !strings.Contains(stdout.String(), "gc.routed_to=maintenance.dog") {
+		t.Fatalf("stdout = %q, want binding-qualified route", stdout.String())
+	}
+}
+
+func TestOrderRunResolvesImportedPackPoolAgainstCityShadow(t *testing.T) {
+	cityDir := t.TempDir()
+	writeImportedDogOrderFixture(t, cityDir, true)
+	_, aa := loadImportedDogOrders(t, cityDir)
+	store := beads.NewMemStore()
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "digest", "", cityDir, store, nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doOrderRun = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	results, err := store.ListByLabel("order-run:digest", 0)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("store.ListByLabel() len = %d, want 1 (%#v)", len(results), results)
+	}
+	if got := results[0].Metadata["gc.routed_to"]; got != "maintenance.dog" {
+		t.Fatalf("gc.routed_to = %q, want maintenance.dog", got)
+	}
+}
+
+func TestOrderRunResolvesImportedPackPoolAgainstSiblingImportCollision(t *testing.T) {
+	cityDir := t.TempDir()
+	writeImportedDogOrderFixture(t, cityDir, false, "gastown")
+	_, aa := loadImportedDogOrders(t, cityDir)
+	store := beads.NewMemStore()
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "digest", "", cityDir, store, nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doOrderRun = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	results, err := store.ListByLabel("order-run:digest", 0)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("store.ListByLabel() len = %d, want 1 (%#v)", len(results), results)
+	}
+	if got := results[0].Metadata["gc.routed_to"]; got != "maintenance.dog" {
+		t.Fatalf("gc.routed_to = %q, want maintenance.dog", got)
+	}
+}
+
+func TestOrderRunPrefersCityShadowForPool(t *testing.T) {
+	aa := []orders.Order{
+		{Name: "digest", Formula: "mol-digest", Trigger: "cooldown", Interval: "24h", Pool: "dog", FormulaLayer: sharedTestFormulaDir},
+	}
+	cityDir := t.TempDir()
+	writeOrderRunImportFixture(t, cityDir, "maintenance")
+	writeFile(t, filepath.Join(cityDir, "city.toml"), `[workspace]
+name = "shadow-city"
+prefix = "shd"
+
+[[agent]]
+name = "dog"
+`)
+	store := beads.NewMemStore()
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "digest", "", cityDir, store, nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doOrderRun = %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	results, err := store.ListByLabel("order-run:digest", 0)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("store.ListByLabel() len = %d, want 1 (%#v)", len(results), results)
+	}
+	if got := results[0].Metadata["gc.routed_to"]; got != "dog" {
+		t.Fatalf("gc.routed_to = %q, want dog", got)
+	}
+	if !strings.Contains(stdout.String(), "gc.routed_to=dog") {
+		t.Fatalf("stdout = %q, want city-local route", stdout.String())
+	}
+}
+
+func TestOrderRunRejectsAmbiguousPackPool(t *testing.T) {
+	aa := []orders.Order{
+		{Name: "digest", Formula: "mol-digest", Trigger: "cooldown", Interval: "24h", Pool: "dog", FormulaLayer: sharedTestFormulaDir},
+	}
+	cityDir := t.TempDir()
+	writeOrderRunImportFixture(t, cityDir, "gastown", "maintenance")
+	store := beads.NewMemStore()
+
+	var stdout, stderr bytes.Buffer
+	code := doOrderRun(aa, "digest", "", cityDir, store, nil, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("doOrderRun = %d, want 1; stdout: %s stderr: %s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), `ambiguous pool "dog"`) {
+		t.Fatalf("stderr = %q, want ambiguity error", stderr.String())
+	}
+	results, err := store.ListByLabel("order-run:digest", 0)
+	if err != nil {
+		t.Fatalf("store.ListByLabel(): %v", err)
+	}
+	if len(results) != 0 {
+		t.Fatalf("store.ListByLabel() len = %d, want 0 (%#v)", len(results), results)
+	}
+}
+
+func writeOrderRunImportFixture(t *testing.T, cityDir string, bindings ...string) {
+	t.Helper()
+
+	packRoot := filepath.Join(cityDir, "packs")
+	if err := os.MkdirAll(packRoot, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	writeFile(t, filepath.Join(cityDir, "city.toml"), `
+[workspace]
+name = "test-city"
+`)
+
+	var packToml strings.Builder
+	packToml.WriteString(`
+[pack]
+name = "test-city"
+schema = 1
+`)
+	for _, binding := range bindings {
+		packDir := filepath.Join(packRoot, binding)
+		if err := os.MkdirAll(packDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		writeFile(t, filepath.Join(packDir, "pack.toml"), `
+[pack]
+name = "`+binding+`"
+schema = 1
+
+[[agent]]
+name = "dog"
+scope = "city"
+`)
+		packToml.WriteString(`
+[imports.` + binding + `]
+source = "./packs/` + binding + `"
+`)
+	}
+	writeFile(t, filepath.Join(cityDir, "pack.toml"), packToml.String())
+}
+
 func TestOrderRunNoPool(t *testing.T) {
 	aa := []orders.Order{
 		{Name: "cleanup", Formula: "mol-cleanup", Trigger: "cron", Schedule: "0 3 * * *", FormulaLayer: sharedTestFormulaDir},
@@ -831,8 +1168,8 @@ title = "Do work"
 			if bead.Assignee != config.ControlDispatcherAgentName {
 				t.Fatalf("finalizer assignee = %q, want %q", bead.Assignee, config.ControlDispatcherAgentName)
 			}
-			if bead.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-				t.Fatalf("finalizer gc.routed_to = %q, want %q", bead.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+			if bead.Metadata["gc.routed_to"] != "" {
+				t.Fatalf("finalizer gc.routed_to = %q, want empty for concrete control dispatcher assignee", bead.Metadata["gc.routed_to"])
 			}
 			if bead.Metadata[graphExecutionRouteMetaKey] != "quinn" {
 				t.Fatalf("finalizer execution route = %q, want quinn", bead.Metadata[graphExecutionRouteMetaKey])
diff --git a/cmd/gc/cmd_prime.go b/cmd/gc/cmd_prime.go
index e13071636c..7fcb562463 100644
--- a/cmd/gc/cmd_prime.go
+++ b/cmd/gc/cmd_prime.go
@@ -175,7 +175,7 @@ func doPrimeWithHookFormat(args []string, stdout, stderr io.Writer, hookMode boo
 			fmt.Fprintf(stderr, "gc prime: no city config found: %v\n", err) //nolint:errcheck
 			return 1
 		}
-		fmt.Fprint(stdout, defaultPrimePrompt) //nolint:errcheck // best-effort stdout
+		writePrimePromptWithFormat(stdout, "", "", defaultPrimePrompt, hookMode, hookFormat, suppressHookPrompt)
 		return 0
 	}
 	cfg, err := loadCityConfig(cityPath, stderr)
@@ -184,7 +184,7 @@ func doPrimeWithHookFormat(args []string, stdout, stderr io.Writer, hookMode boo
 			fmt.Fprintf(stderr, "gc prime: loading city config: %v\n", err) //nolint:errcheck
 			return 1
 		}
-		fmt.Fprint(stdout, defaultPrimePrompt) //nolint:errcheck // best-effort stdout
+		writePrimePromptWithFormat(stdout, "", "", defaultPrimePrompt, hookMode, hookFormat, suppressHookPrompt)
 		return 0
 	}
 	resolveRigPaths(cityPath, cfg.Rigs)
@@ -317,7 +317,7 @@ func doPrimeWithHookFormat(args []string, stdout, stderr io.Writer, hookMode boo
 	// when the agent has no prompt_template and doesn't match a builtin
 	// worker prompt — a supported config shape, so the default prompt is
 	// the correct output even under --strict.
-	fmt.Fprint(stdout, defaultPrimePrompt) //nolint:errcheck // best-effort stdout
+	writePrimePromptWithFormat(stdout, "", agentName, defaultPrimePrompt, hookMode, hookFormat, suppressHookPrompt)
 	return 0
 }
 
@@ -396,7 +396,7 @@ func writePrimePromptWithFormat(stdout io.Writer, cityName, agentName, prompt st
 		prompt = prependHookBeacon(cityName, agentName, prompt)
 	}
 	if hookMode && hookFormat != "" {
-		_ = writeProviderHookContext(stdout, hookFormat, prompt)
+		_ = writeProviderHookContextForEvent(stdout, hookFormat, "SessionStart", prompt)
 		return
 	}
 	fmt.Fprint(stdout, prompt) //nolint:errcheck // best-effort stdout
@@ -561,9 +561,11 @@ func findAgentByName(cfg *config.City, name string) (config.Agent, bool) {
 // to currentRigContext when run manually.
 func buildPrimeContext(cityPath, cityName string, a *config.Agent, rigs []config.Rig, stderr io.Writer) PromptContext {
 	ctx := PromptContext{
-		CityRoot:     cityPath,
-		TemplateName: a.Name,
-		Env:          a.Env,
+		CityRoot:      cityPath,
+		TemplateName:  a.Name,
+		BindingName:   a.BindingName,
+		BindingPrefix: a.BindingPrefix(),
+		Env:           a.Env,
 	}
 
 	// Agent identity: prefer GC_ALIAS, then GC_AGENT, else config.
diff --git a/cmd/gc/cmd_prime_test.go b/cmd/gc/cmd_prime_test.go
index df4920bc55..15c1b7190b 100644
--- a/cmd/gc/cmd_prime_test.go
+++ b/cmd/gc/cmd_prime_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
 )
 
 func TestBuildPrimeContextFallsBackToConfiguredRigRoot(t *testing.T) {
@@ -68,6 +69,43 @@ func TestBuildPrimeContextLogsTemplateExpansionWarning(t *testing.T) {
 	}
 }
 
+func TestBuildPrimeContextRendersBindingQualifiedRoute(t *testing.T) {
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	t.Setenv("GC_DIR", "")
+	t.Setenv("GC_BRANCH", "")
+	t.Setenv("GC_AGENT", "")
+	t.Setenv("GC_ALIAS", "")
+
+	cityPath := t.TempDir()
+	promptDir := filepath.Join(cityPath, "prompts")
+	if err := os.MkdirAll(promptDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(promptDir): %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(promptDir, "polecat.template.md"), []byte("route={{ .RigName }}/{{ .BindingPrefix }}refinery\nbinding={{ .BindingName }}\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(prompt): %v", err)
+	}
+
+	ctx := buildPrimeContext(cityPath, "test-city", &config.Agent{
+		Name:        "polecat",
+		Dir:         "demo",
+		BindingName: "gastown",
+	}, []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}}, nil)
+
+	if ctx.BindingName != "gastown" {
+		t.Fatalf("BindingName = %q, want gastown", ctx.BindingName)
+	}
+	if ctx.BindingPrefix != "gastown." {
+		t.Fatalf("BindingPrefix = %q, want gastown.", ctx.BindingPrefix)
+	}
+	var stderr bytes.Buffer
+	got := renderPrompt(fsys.OSFS{}, cityPath, "test-city", "prompts/polecat.template.md", ctx, "", &stderr, nil, nil, nil)
+	want := "route=demo/gastown.refinery\nbinding=gastown\n"
+	if got != want {
+		t.Fatalf("rendered prompt = %q, want %q; stderr=%q", got, want, stderr.String())
+	}
+}
+
 func TestDoPrime_RendersConventionDiscoveredRootCityAgent(t *testing.T) {
 	cityDir := t.TempDir()
 	if err := os.MkdirAll(filepath.Join(cityDir, "agents", "ada"), 0o755); err != nil {
@@ -428,6 +466,34 @@ prompt_template = "prompts/worker.md"
 	}
 }
 
+func TestDoPrimeWithHookFormat_FormatsDefaultFallback(t *testing.T) {
+	t.Setenv("GC_CITY", filepath.Join(t.TempDir(), "missing-city"))
+	t.Setenv("GC_ALIAS", "")
+	t.Setenv("GC_AGENT", "")
+
+	var stdout, stderr bytes.Buffer
+	code := doPrimeWithHookFormat(nil, &stdout, &stderr, true, hookOutputFormatCodex, false)
+	if code != 0 {
+		t.Fatalf("doPrimeWithHookFormat() = %d, want 0; stderr=%q", code, stderr.String())
+	}
+
+	var payload struct {
+		HookSpecificOutput struct {
+			HookEventName     string `json:"hookEventName"`
+			AdditionalContext string `json:"additionalContext"`
+		} `json:"hookSpecificOutput"`
+	}
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("stdout is not hook JSON: %v\n%s", err, stdout.String())
+	}
+	if got, want := payload.HookSpecificOutput.HookEventName, "SessionStart"; got != want {
+		t.Fatalf("hookEventName = %q, want %q", got, want)
+	}
+	if !strings.Contains(payload.HookSpecificOutput.AdditionalContext, "# Gas City Agent") {
+		t.Fatalf("additionalContext = %q, want default prime prompt", payload.HookSpecificOutput.AdditionalContext)
+	}
+}
+
 func withPrimeHookStdin(t *testing.T, payload map[string]string) {
 	t.Helper()
 
diff --git a/cmd/gc/cmd_reload.go b/cmd/gc/cmd_reload.go
index 037657604e..698f282580 100644
--- a/cmd/gc/cmd_reload.go
+++ b/cmd/gc/cmd_reload.go
@@ -31,7 +31,15 @@ const (
 )
 
 var (
-	controllerReloadAcceptTimeout = 5 * time.Second
+	// controllerReloadAcceptTimeout is how long a reload request waits for
+	// the controller's main goroutine to drain it from reloadReqCh. The
+	// main goroutine is blocked while a reconcile tick runs, and ticks can
+	// take 30s–90s+ under bead-store churn (see issue #1560). 5s was
+	// dramatically too short and produced "controller is busy" rejections
+	// for many minutes at a time. 60s gives the controller enough headroom
+	// to finish a tick before the reload is rejected, while still bounding
+	// the wait for genuinely deadlocked controllers.
+	controllerReloadAcceptTimeout = 60 * time.Second
 	sendReloadControlRequestHook  = sendReloadControlRequest
 	reloadUnavailableMessageHook  = reloadUnavailableMessage
 	supervisorAPIBaseURLHook      = supervisorAPIBaseURL
@@ -168,13 +176,9 @@ func sendReloadControlRequest(cityPath string, req reloadControlRequest) (reload
 	if err != nil {
 		return reloadControlReply{}, fmt.Errorf("marshaling request: %w", err)
 	}
-	readTimeout := 15 * time.Second
-	if req.Wait && req.Timeout != "" {
-		timeout, err := time.ParseDuration(req.Timeout)
-		if err != nil {
-			return reloadControlReply{}, fmt.Errorf("parsing request timeout: %w", err)
-		}
-		readTimeout = controllerReloadAcceptTimeout + timeout + 10*time.Second
+	readTimeout, err := reloadControlReadTimeout(req)
+	if err != nil {
+		return reloadControlReply{}, err
 	}
 	resp, err := sendControllerCommandWithReadTimeout(cityPath, "reload:"+string(data), readTimeout)
 	if err != nil {
@@ -187,6 +191,18 @@ func sendReloadControlRequest(cityPath string, req reloadControlRequest) (reload
 	return reply, nil
 }
 
+func reloadControlReadTimeout(req reloadControlRequest) (time.Duration, error) {
+	readTimeout := 2*controllerReloadAcceptTimeout + 10*time.Second
+	if req.Wait && req.Timeout != "" {
+		timeout, err := time.ParseDuration(req.Timeout)
+		if err != nil {
+			return 0, fmt.Errorf("parsing request timeout: %w", err)
+		}
+		readTimeout += timeout
+	}
+	return readTimeout, nil
+}
+
 func reloadUnavailableMessage(cityPath string) string {
 	info, ok := supervisorCityInfo(cityPath)
 	if !ok {
diff --git a/cmd/gc/cmd_reload_test.go b/cmd/gc/cmd_reload_test.go
index f6859f40eb..ef7617dd80 100644
--- a/cmd/gc/cmd_reload_test.go
+++ b/cmd/gc/cmd_reload_test.go
@@ -375,6 +375,40 @@ func TestHandleReloadSocketCmdWaitsForAcceptedAfterHandoff(t *testing.T) {
 	}
 }
 
+func TestControllerReloadAcceptTimeoutDefault(t *testing.T) {
+	if controllerReloadAcceptTimeout != 60*time.Second {
+		t.Fatalf("controllerReloadAcceptTimeout = %s, want 60s", controllerReloadAcceptTimeout)
+	}
+}
+
+func TestReloadControlReadTimeoutAsyncOutlastsAcceptAndAckWindow(t *testing.T) {
+	readTimeout, err := reloadControlReadTimeout(reloadControlRequest{Wait: false})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if readTimeout <= 15*time.Second {
+		t.Fatalf("async read timeout = %s, want above old 15s client deadline", readTimeout)
+	}
+	if wantMin := 2*controllerReloadAcceptTimeout + 5*time.Second; readTimeout <= wantMin {
+		t.Fatalf("async read timeout = %s, want above controller window %s", readTimeout, wantMin)
+	}
+}
+
+func TestReloadControlReadTimeoutWaitIncludesRequestedTimeout(t *testing.T) {
+	oldAccept := controllerReloadAcceptTimeout
+	controllerReloadAcceptTimeout = 20 * time.Millisecond
+	t.Cleanup(func() { controllerReloadAcceptTimeout = oldAccept })
+
+	readTimeout, err := reloadControlReadTimeout(reloadControlRequest{Wait: true, Timeout: "40ms"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := 2*controllerReloadAcceptTimeout + 40*time.Millisecond + 10*time.Second
+	if readTimeout != want {
+		t.Fatalf("read timeout = %s, want %s", readTimeout, want)
+	}
+}
+
 func TestSendReloadControlRequestNoChange(t *testing.T) {
 	sp := runtime.NewFake()
 
@@ -392,14 +426,16 @@ func TestSendReloadControlRequestNoChange(t *testing.T) {
 	}
 
 	dir := shortSocketTempDir(t, "gc-reload-no-change-")
+	cleanupManagedDoltTestCity(t, dir)
 	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	tomlPath := writeCityTOML(t, dir, "test", "mayor")
-	cfg, prov, err := config.LoadWithIncludes(osFS{}, tomlPath)
+	cfg, prov, err := loadCityConfigWithBuiltinPacks(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
+	applyFeatureFlags(cfg)
 	configRev := config.Revision(osFS{}, prov, cfg, dir)
 
 	var stdout, stderr bytes.Buffer
@@ -459,17 +495,26 @@ func TestSendReloadControlRequestInvalidConfig(t *testing.T) {
 	}
 
 	dir := shortSocketTempDir(t, "gc-reload-invalid-")
+	cleanupManagedDoltTestCity(t, dir)
 	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	tomlPath := writeCityTOML(t, dir, "test", "mayor")
-	cfg, prov, err := config.LoadWithIncludes(osFS{}, tomlPath)
+	cfg, prov, err := loadCityConfigWithBuiltinPacks(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
+	applyFeatureFlags(cfg)
+	var stdout, stderr bytes.Buffer
+	allOrders, err := scanAllOrders(dir, cfg, &stderr, "gc reload test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, order := range allOrders {
+		cfg.Orders.Skip = append(cfg.Orders.Skip, order.Name)
+	}
 	configRev := config.Revision(osFS{}, prov, cfg, dir)
 
-	var stdout, stderr bytes.Buffer
 	done := make(chan struct{})
 	go func() {
 		runController(dir, tomlPath, cfg, configRev, buildFn, nil, sp, nil, nil, nil, nil, events.Discard, nil, &stdout, &stderr)
@@ -494,21 +539,48 @@ func TestSendReloadControlRequestInvalidConfig(t *testing.T) {
 		}
 	}
 
+	oldDebounce := debounceDelay
+	debounceDelay = 30 * time.Second
+	t.Cleanup(func() {
+		debounceDelay = oldDebounce
+	})
 	if err := os.WriteFile(tomlPath, []byte("[[[ bad toml"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
-	reply, err := sendReloadControlRequest(dir, reloadControlRequest{Wait: true, Timeout: "1s"})
-	if err != nil {
-		t.Fatalf("sendReloadControlRequest: %v", err)
-	}
-	if reply.Outcome != reloadOutcomeFailed {
-		t.Fatalf("reply.Outcome = %q, want %q", reply.Outcome, reloadOutcomeFailed)
+	stdoutBeforeInvalid := stdout.String()
+	var reply reloadControlReply
+	deadline = time.After(45 * time.Second)
+	for {
+		reply, err = sendReloadControlRequest(dir, reloadControlRequest{Wait: true, Timeout: "30s"})
+		if err != nil {
+			t.Fatalf("sendReloadControlRequest: %v", err)
+		}
+		if reply.Outcome != reloadOutcomeBusy {
+			break
+		}
+		if strings.Contains(stderr.String(), "config reload") {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("reload stayed busy; last reply = %+v", reply)
+		default:
+			time.Sleep(10 * time.Millisecond)
+		}
 	}
-	if !strings.Contains(reply.Error, "parsing city.toml") {
+	switch {
+	case reply.Outcome == reloadOutcomeBusy:
+		if !strings.Contains(stderr.String(), "config reload") {
+			t.Fatalf("busy reload did not produce invalid config error; stderr=%q", stderr.String())
+		}
+	case reply.Outcome != reloadOutcomeFailed:
+		t.Fatalf("reply.Outcome = %q, want %q; stdout=%q stderr=%q",
+			reply.Outcome, reloadOutcomeFailed, stdout.String(), stderr.String())
+	case !strings.Contains(reply.Error, "parsing city.toml"):
 		t.Fatalf("reply.Error = %q", reply.Error)
 	}
-	if strings.Contains(stdout.String(), "Config reloaded:") {
+	if strings.Contains(strings.TrimPrefix(stdout.String(), stdoutBeforeInvalid), "Config reloaded:") {
 		t.Fatalf("stdout unexpectedly contains reload success: %q", stdout.String())
 	}
 }
diff --git a/cmd/gc/cmd_restart.go b/cmd/gc/cmd_restart.go
index 77b006f4be..e60c4f6bc3 100644
--- a/cmd/gc/cmd_restart.go
+++ b/cmd/gc/cmd_restart.go
@@ -76,6 +76,7 @@ quick way to force-refresh all agents working on a particular project.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeRigNames,
 	}
 }
 
@@ -163,15 +164,12 @@ func doRigRestart(
 			}
 		} else {
 			// Pool agent: resolve live instances from beads first, then legacy discovery.
-			for _, ref := range resolvePoolSessionRefs(store, a.Name, a.Dir, sp0, &a, cityName, sessionTemplate, sp, stderr) {
-				running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, ref.sessionName)
-				if err != nil {
-					fmt.Fprintf(stderr, "gc rig restart: observing %s: %v\n", ref.sessionName, err) //nolint:errcheck
-					return 1
-				}
-				if !running {
-					continue
-				}
+			refs, err := selectRunningPoolSessionRefs(store, sp, cfg, resolvePoolSessionRefs(store, cfg, a.Name, a.Dir, sp0, &a, cityName, sessionTemplate, sp, stderr))
+			if err != nil {
+				fmt.Fprintf(stderr, "gc rig restart: observing %s: %v\n", a.QualifiedName(), err) //nolint:errcheck
+				return 1
+			}
+			for _, ref := range refs {
 				targets = append(targets, stopTarget{
 					name:     ref.sessionName,
 					template: a.QualifiedName(),
diff --git a/cmd/gc/cmd_restart_test.go b/cmd/gc/cmd_restart_test.go
index cffe04fa71..813c6e9953 100644
--- a/cmd/gc/cmd_restart_test.go
+++ b/cmd/gc/cmd_restart_test.go
@@ -253,6 +253,253 @@ func TestDoRigRestart_UsesUnlimitedPoolSessionBeadsForCustomSessionNames(t *test
 	}
 }
 
+func TestDoRigRestart_UsesBoundPoolSlotOnlySessionBeadForCustomSessionName(t *testing.T) {
+	sp := runtime.NewFake()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "frontend/ops.furiosa",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "frontend/ops.worker",
+			"session_name": "custom-ops-furiosa",
+			"pool_slot":    "1",
+			"state":        "awake",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.Start(context.Background(), "custom-ops-furiosa", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := events.NewFake()
+	agents := []config.Agent{{
+		Name:              "worker",
+		Dir:               "frontend",
+		BindingName:       "ops",
+		NamepoolNames:     []string{"furiosa", "nux"},
+		MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(2), ScaleCheck: "echo 1",
+	}}
+
+	var stdout, stderr bytes.Buffer
+	code := doRigRestart(sp, rec, store, nil, agents, "frontend", "city", "{{.Agent}}", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	if sp.IsRunning("custom-ops-furiosa") {
+		t.Fatal("custom bound pool session still running after rig restart")
+	}
+	if len(rec.Events) != 1 {
+		t.Fatalf("got %d events, want 1", len(rec.Events))
+	}
+	if rec.Events[0].Subject != "frontend/ops.furiosa" {
+		t.Fatalf("event subject = %q, want %q", rec.Events[0].Subject, "frontend/ops.furiosa")
+	}
+}
+
+func TestDoRigRestart_UsesTemplateIdentityPoolSlotSessionBeadForCustomSessionName(t *testing.T) {
+	sp := runtime.NewFake()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "frontend/worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "frontend/worker",
+			"agent_name":   "frontend/worker",
+			"session_name": "custom-worker-7",
+			"pool_slot":    "7",
+			"state":        "awake",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.Start(context.Background(), "custom-worker-7", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := events.NewFake()
+	agents := []config.Agent{{
+		Name:              "worker",
+		Dir:               "frontend",
+		MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(10), ScaleCheck: "echo 1",
+	}}
+
+	var stdout, stderr bytes.Buffer
+	code := doRigRestart(sp, rec, store, nil, agents, "frontend", "city", "{{.Agent}}", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	if sp.IsRunning("custom-worker-7") {
+		t.Fatal("template-identity pool session still running after rig restart")
+	}
+	if len(rec.Events) != 1 {
+		t.Fatalf("got %d events, want 1", len(rec.Events))
+	}
+	if rec.Events[0].Subject != "frontend/worker-7" {
+		t.Fatalf("event subject = %q, want %q", rec.Events[0].Subject, "frontend/worker-7")
+	}
+}
+
+func TestDoRigRestart_DoesNotTargetOutOfBoundsAliasOnlyBoundedPoolIdentity(t *testing.T) {
+	sp := runtime.NewFake()
+	store := beads.NewMemStore()
+	if _, err := store.Create(beads.Bead{
+		Title:  "stale out-of-bounds pool instance",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "frontend/worker",
+			"alias":        "frontend/worker-7",
+			"session_name": "custom-worker-7",
+			"state":        "awake",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.Start(context.Background(), "custom-worker-7", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := events.NewFake()
+	agents := []config.Agent{{
+		Name:              "worker",
+		Dir:               "frontend",
+		MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(5), ScaleCheck: "echo 1",
+	}}
+
+	var stdout, stderr bytes.Buffer
+	code := doRigRestart(sp, rec, store, nil, agents, "frontend", "city", "{{.Agent}}", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	if !sp.IsRunning("custom-worker-7") {
+		t.Fatal("out-of-bounds pool session should not have been restarted")
+	}
+	if len(rec.Events) != 0 {
+		t.Fatalf("got %d events, want 0", len(rec.Events))
+	}
+}
+
+func TestDoRigRestart_PrefersLiveFallbackCandidateOncePerLogicalInstance(t *testing.T) {
+	sp := runtime.NewFake()
+	store := beads.NewMemStore()
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "stale duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-stale-worker-7",
+				"pool_slot":    "7",
+			},
+		},
+		{
+			Title:  "live legacy",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+				"alias":        "frontend/worker-7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := sp.Start(context.Background(), "worker-7", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := events.NewFake()
+	agents := []config.Agent{{
+		Name:              "worker",
+		Dir:               "frontend",
+		MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(10), ScaleCheck: "echo 1",
+	}}
+
+	var stdout, stderr bytes.Buffer
+	code := doRigRestart(sp, rec, store, nil, agents, "frontend", "city", "{{.Agent}}", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	if sp.IsRunning("worker-7") {
+		t.Fatal("live fallback session still running after rig restart")
+	}
+	if len(rec.Events) != 1 {
+		t.Fatalf("got %d events, want 1", len(rec.Events))
+	}
+	if rec.Events[0].Subject != "frontend/worker-7" {
+		t.Fatalf("event subject = %q, want %q", rec.Events[0].Subject, "frontend/worker-7")
+	}
+}
+
+func TestDoRigRestart_StopsAllLiveCandidatesForLogicalInstance(t *testing.T) {
+	sp := runtime.NewFake()
+	store := beads.NewMemStore()
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "stale duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-stale-worker-7",
+				"pool_slot":    "7",
+			},
+		},
+		{
+			Title:  "live legacy",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+				"alias":        "frontend/worker-7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, sessionName := range []string{"s-stale-worker-7", "worker-7"} {
+		if err := sp.Start(context.Background(), sessionName, runtime.Config{Command: "echo"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	rec := events.NewFake()
+	agents := []config.Agent{{
+		Name:              "worker",
+		Dir:               "frontend",
+		MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(10), ScaleCheck: "echo 1",
+	}}
+
+	var stdout, stderr bytes.Buffer
+	code := doRigRestart(sp, rec, store, nil, agents, "frontend", "city", "{{.Agent}}", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	for _, sessionName := range []string{"s-stale-worker-7", "worker-7"} {
+		if sp.IsRunning(sessionName) {
+			t.Fatalf("%s still running after rig restart", sessionName)
+		}
+	}
+	if len(rec.Events) != 2 {
+		t.Fatalf("got %d events, want 2", len(rec.Events))
+	}
+	for _, event := range rec.Events {
+		if event.Subject != "frontend/worker-7" {
+			t.Fatalf("event subject = %q, want %q", event.Subject, "frontend/worker-7")
+		}
+	}
+}
+
 func TestDoRigRestart_UsesLegacyPoolAgentLabelForCustomSessionNames(t *testing.T) {
 	sp := runtime.NewFake()
 	store := beads.NewMemStore()
diff --git a/cmd/gc/cmd_rig.go b/cmd/gc/cmd_rig.go
index b773e4d80a..1ca9009643 100644
--- a/cmd/gc/cmd_rig.go
+++ b/cmd/gc/cmd_rig.go
@@ -229,9 +229,9 @@ func doRigAdd(fs fsys.FS, cityPath, rigPath string, includes []string, nameOverr
 		fmt.Fprintf(stderr, "gc rig add: loading config: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
-	if cityUsesBdStoreContract(cityPath) && (cfg.Dolt.Host != "" || cfg.Dolt.Port != 0) {
-		cityDoltConfigs.Store(cityPath, cfg.Dolt)
-		defer cityDoltConfigs.Delete(cityPath)
+	if cityUsesBdStoreContract(cityPath) && cityDoltConfigHasLifecycleFields(cfg.Dolt) {
+		registerCityDoltConfig(cityPath, cfg.Dolt)
+		defer clearCityDoltConfig(cityPath)
 	}
 	rootDefaultRigImports, err := config.LoadRootPackDefaultRigImports(fs, cityPath)
 	if err != nil {
@@ -763,6 +763,7 @@ database remains accessible. Use "gc rig resume" to restore.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeRigNames,
 	}
 }
 
@@ -843,6 +844,7 @@ The reconciler will start the rig's agents on its next tick.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeRigNames,
 	}
 }
 
@@ -925,6 +927,7 @@ binding from .gc/site.toml.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeRigNames,
 	}
 }
 
diff --git a/cmd/gc/cmd_rig_endpoint.go b/cmd/gc/cmd_rig_endpoint.go
index 0186c788c7..2e6a065112 100644
--- a/cmd/gc/cmd_rig_endpoint.go
+++ b/cmd/gc/cmd_rig_endpoint.go
@@ -57,6 +57,7 @@ This command owns the rig's canonical .beads/config.yaml topology state.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeRigNames,
 	}
 	cmd.Flags().BoolVar(&opts.Inherit, "inherit", false, "inherit the city endpoint")
 	cmd.Flags().BoolVar(&opts.External, "external", false, "set an explicit external endpoint for the rig")
@@ -538,7 +539,7 @@ func readCanonicalProjectID(metadataPath string) (string, error) {
 func readDatabaseProjectID(ctx context.Context, db *sql.DB) (string, bool, error) {
 	var projectID string
 	if err := db.QueryRowContext(ctx, "SELECT value FROM metadata WHERE `key` = '_project_id'").Scan(&projectID); err != nil {
-		if err == sql.ErrNoRows {
+		if err == sql.ErrNoRows || isMissingDoltMetadataTableError(err) {
 			return "", false, nil
 		}
 		return "", false, fmt.Errorf("read database _project_id: %w", err)
@@ -550,6 +551,17 @@ func readDatabaseProjectID(ctx context.Context, db *sql.DB) (string, bool, error
 	return projectID, true, nil
 }
 
+func isMissingDoltMetadataTableError(err error) bool {
+	var mysqlErr *mysql.MySQLError
+	if errors.As(err, &mysqlErr) && mysqlErr.Number == 1146 {
+		return true
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "table not found: metadata") ||
+		strings.Contains(msg, "table 'metadata' doesn't exist") ||
+		strings.Contains(msg, "no such table: metadata")
+}
+
 type fileSnapshot struct {
 	path   string
 	data   []byte
diff --git a/cmd/gc/cmd_rig_endpoint_test.go b/cmd/gc/cmd_rig_endpoint_test.go
index a41fb3d8c7..bda0678bb1 100644
--- a/cmd/gc/cmd_rig_endpoint_test.go
+++ b/cmd/gc/cmd_rig_endpoint_test.go
@@ -1172,6 +1172,7 @@ func TestVerifyExternalDoltEndpointRejectsProjectIdentityMismatch(t *testing.T)
 	if err != nil {
 		t.Skip("dolt not installed")
 	}
+	bdPath := waitTestRealBDPath(t)
 	oldResolve := resolveProviderLifecycleGCBinary
 	resolveProviderLifecycleGCBinary = func() string { return currentGCBinaryForTests(t) }
 	t.Cleanup(func() { resolveProviderLifecycleGCBinary = oldResolve })
@@ -1200,7 +1201,7 @@ func TestVerifyExternalDoltEndpointRejectsProjectIdentityMismatch(t *testing.T)
 	t.Setenv("GC_CITY_PATH", cityDir)
 	t.Setenv("GC_BEADS", "bd")
 	t.Setenv("GC_DOLT", "")
-	t.Setenv("PATH", strings.Join([]string{"/home/ubuntu/.local/bin", filepath.Dir(doltPath), os.Getenv("PATH")}, string(os.PathListSeparator)))
+	t.Setenv("PATH", strings.Join([]string{filepath.Dir(bdPath), filepath.Dir(doltPath), os.Getenv("PATH")}, string(os.PathListSeparator)))
 
 	if err := ensureBeadsProvider(cityDir); err != nil {
 		t.Fatalf("ensureBeadsProvider: %v", err)
@@ -1276,6 +1277,7 @@ func TestVerifyExternalDoltEndpointRejectsMissingLocalProjectID(t *testing.T) {
 	if err != nil {
 		t.Skip("dolt not installed")
 	}
+	bdPath := waitTestRealBDPath(t)
 	oldResolve := resolveProviderLifecycleGCBinary
 	resolveProviderLifecycleGCBinary = func() string { return currentGCBinaryForTests(t) }
 	t.Cleanup(func() { resolveProviderLifecycleGCBinary = oldResolve })
@@ -1304,7 +1306,7 @@ func TestVerifyExternalDoltEndpointRejectsMissingLocalProjectID(t *testing.T) {
 	t.Setenv("GC_CITY_PATH", cityDir)
 	t.Setenv("GC_BEADS", "bd")
 	t.Setenv("GC_DOLT", "")
-	t.Setenv("PATH", strings.Join([]string{"/home/ubuntu/.local/bin", filepath.Dir(doltPath), os.Getenv("PATH")}, string(os.PathListSeparator)))
+	t.Setenv("PATH", strings.Join([]string{filepath.Dir(bdPath), filepath.Dir(doltPath), os.Getenv("PATH")}, string(os.PathListSeparator)))
 
 	if err := ensureBeadsProvider(cityDir); err != nil {
 		t.Fatalf("ensureBeadsProvider: %v", err)
diff --git a/cmd/gc/cmd_runtime_drain.go b/cmd/gc/cmd_runtime_drain.go
index 7630faf2da..9981fa6e04 100644
--- a/cmd/gc/cmd_runtime_drain.go
+++ b/cmd/gc/cmd_runtime_drain.go
@@ -5,9 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os/signal"
 	"strconv"
+	"syscall"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/spf13/cobra"
@@ -95,6 +98,9 @@ func (o *providerDrainOps) setRestartRequested(sessionName string) error {
 func (o *providerDrainOps) isRestartRequested(sessionName string) (bool, error) {
 	val, err := o.sp.GetMeta(sessionName, "GC_RESTART_REQUESTED")
 	if err != nil {
+		if runtime.IsSessionGone(err) {
+			return false, nil
+		}
 		return false, fmt.Errorf("reading GC_RESTART_REQUESTED: %w", err)
 	}
 	return val != "", nil
@@ -366,21 +372,28 @@ func cmdRuntimeDrainAck(args []string, stdout, stderr io.Writer) int {
 func newRuntimeRequestRestartCmd(stdout, stderr io.Writer) *cobra.Command {
 	return &cobra.Command{
 		Use:   "request-restart",
-		Short: "Request controller restart this session (blocks until killed)",
+		Short: "Request controller restart this session (waits to be killed)",
 		Long: `Signal the controller to stop and restart this session.
 
-Sets GC_RESTART_REQUESTED metadata on the session, then blocks forever.
-The controller will stop the session on its next reconcile tick and
-restart it fresh. The blocking prevents the agent from consuming more
-context while waiting.
+Sets GC_RESTART_REQUESTED metadata on the session, then waits while the
+controller stops the session on its next reconcile tick and restarts it
+fresh. The wait keeps the agent idle so it does not consume more context
+in the interim.
+
+Under normal operation the controller SIGKILLs the process tree before
+this command returns. If the controller accepts the stop handoff, the
+runtime is already gone, or a SIGINT/SIGTERM is received, the command
+exits 0 cleanly. If the controller has not acted within a bounded
+timeout (max(5*PatrolInterval, 5min), capped at 30min) the command exits
+1 with a diagnostic pointing at controller health.
 
-For on-demand configured named sessions, the controller cannot restart the
-user-attended process. In that case this command reports that restart was
-skipped and returns without blocking. No session.draining event is emitted
-when restart is skipped.
+For on-demand configured named sessions, the controller cannot restart
+the user-attended process. In that case this command reports that
+restart was skipped and returns immediately. No session.draining event
+is emitted when restart is skipped.
 
 This command is designed to be called from within a session context.
-It emits a session.draining event before blocking.`,
+It emits a session.draining event before waiting.`,
 		Args: cobra.NoArgs,
 		RunE: func(_ *cobra.Command, _ []string) error {
 			if cmdRuntimeRequestRestart(stdout, stderr) != 0 {
@@ -431,13 +444,38 @@ func cmdRuntimeRequestRestart(stdout, stderr io.Writer) int {
 			return handle.Reset(context.Background())
 		}
 	}
-	return doRuntimeRequestRestart(dops, persistRestart, rec, current.display, current.sessionName, stdout, stderr)
+	sigCtx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+	return doRuntimeRequestRestart(sigCtx, dops, persistRestart, rec, current.display, current.sessionName,
+		controllerRestartPollInterval, controllerRestartTimeout(cfg), stdout, stderr)
 }
 
-// doRuntimeRequestRestart sets the restart-requested flag and blocks forever.
-// The controller will kill and restart the session on its next tick.
-func doRuntimeRequestRestart(dops drainOps, persistRestart func() error, rec events.Recorder,
-	targetName, sn string, stdout, stderr io.Writer,
+const controllerRestartPollInterval = 1 * time.Second
+
+// controllerRestartTimeout computes the bounded timeout for waiting on the
+// controller to act on a restart request: max(5*PatrolInterval, 5min), capped at 30min.
+func controllerRestartTimeout(cfg *config.City) time.Duration {
+	const floor = 5 * time.Minute
+	const ceil = 30 * time.Minute
+	patrol := 30 * time.Second
+	if cfg != nil {
+		patrol = cfg.Daemon.PatrolIntervalDuration()
+	}
+	d := 5 * patrol
+	if d < floor {
+		d = floor
+	}
+	if d > ceil {
+		d = ceil
+	}
+	return d
+}
+
+// doRuntimeRequestRestart sets the restart-requested flag then polls until the
+// controller accepts the stop handoff (exit 0), the context is canceled by a
+// signal (exit 0), or the bounded timeout expires (exit 1 with diagnostic).
+func doRuntimeRequestRestart(ctx context.Context, dops drainOps, persistRestart func() error, rec events.Recorder,
+	targetName, sn string, pollInterval, timeout time.Duration, stdout, stderr io.Writer,
 ) int {
 	if err := dops.setRestartRequested(sn); err != nil {
 		fmt.Fprintf(stderr, "gc runtime request-restart: %v\n", err) //nolint:errcheck // best-effort stderr
@@ -456,10 +494,40 @@ func doRuntimeRequestRestart(dops drainOps, persistRestart func() error, rec eve
 		Subject: targetName,
 		Message: "restart requested by session",
 	})
-	fmt.Fprintln(stdout, "Restart requested. Blocking until controller kills this session...") //nolint:errcheck // best-effort stdout
-
-	// Block forever. The controller will kill the entire process tree.
-	select {}
+	fmt.Fprintf(stdout, "Restart requested. Waiting up to %s for controller to stop this session...\n", timeout) //nolint:errcheck // best-effort stdout
+
+	deadline := time.Now().Add(timeout)
+	ticker := time.NewTicker(pollInterval)
+	defer ticker.Stop()
+	var lastPollErr error
+
+	for {
+		select {
+		case <-ctx.Done():
+			// Signal received; leave the flag set so the controller still acts on its next tick.
+			fmt.Fprintln(stderr, "gc runtime request-restart: signal received; restart request remains set; controller will stop this session on its next reconcile tick") //nolint:errcheck // best-effort stderr
+			return 0
+		case <-ticker.C:
+			requested, err := dops.isRestartRequested(sn)
+			switch {
+			case err != nil:
+				lastPollErr = err
+			case !requested:
+				// The controller accepted the stop handoff or the runtime is already gone.
+				return 0
+			default:
+				lastPollErr = nil
+			}
+			if time.Now().After(deadline) {
+				if lastPollErr != nil {
+					fmt.Fprintf(stderr, "gc runtime request-restart: controller did not act within %s; last poll error: %v; check `gc dashboard` or `gc trace`\n", timeout, lastPollErr) //nolint:errcheck // best-effort stderr
+				} else {
+					fmt.Fprintf(stderr, "gc runtime request-restart: controller did not act within %s; check `gc dashboard` or `gc trace`\n", timeout) //nolint:errcheck // best-effort stderr
+				}
+				return 1
+			}
+		}
+	}
 }
 
 // doRuntimeDrainAck sets the drain-ack flag on the session. The controller
diff --git a/cmd/gc/cmd_runtime_drain_test.go b/cmd/gc/cmd_runtime_drain_test.go
index 685840e72e..c84dce9f90 100644
--- a/cmd/gc/cmd_runtime_drain_test.go
+++ b/cmd/gc/cmd_runtime_drain_test.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -18,14 +19,45 @@ import (
 	"github.com/gastownhall/gascity/internal/runtime"
 )
 
+// drainOpsWithCountdown wraps fakeDrainOps and returns false for isRestartRequested
+// after N calls, simulating the reconciler clearing the flag without concurrent map access.
+type drainOpsWithCountdown struct {
+	*fakeDrainOps
+	remaining int
+	cleared   bool
+}
+
+func (c *drainOpsWithCountdown) isRestartRequested(sessionName string) (bool, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.err != nil {
+		return false, c.err
+	}
+	if !c.restartRequested[sessionName] {
+		if c.cleared {
+			return false, nil
+		}
+		return false, errors.New("restart flag was not set before polling")
+	}
+	if c.remaining <= 0 {
+		delete(c.restartRequested, sessionName)
+		c.cleared = true
+		return false, nil
+	}
+	c.remaining--
+	return true, nil
+}
+
 // fakeDrainOps is a test double for drainOps.
 type fakeDrainOps struct {
+	mu               sync.Mutex
 	draining         map[string]bool
 	drainTimes       map[string]time.Time // when drain was set
 	acked            map[string]bool
 	restartRequested map[string]bool
 	driftRestart     map[string]bool
 	err              error // injected error for all ops
+	restartReadErr   error
 	setDrainCalls    []string
 	clearDrainCalls  []string
 }
@@ -41,6 +73,8 @@ func newFakeDrainOps() *fakeDrainOps {
 }
 
 func (f *fakeDrainOps) setDrain(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	f.setDrainCalls = append(f.setDrainCalls, sessionName)
 	if f.err != nil {
 		return f.err
@@ -51,6 +85,8 @@ func (f *fakeDrainOps) setDrain(sessionName string) error {
 }
 
 func (f *fakeDrainOps) clearDrain(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	f.clearDrainCalls = append(f.clearDrainCalls, sessionName)
 	if f.err != nil {
 		return f.err
@@ -61,6 +97,8 @@ func (f *fakeDrainOps) clearDrain(sessionName string) error {
 }
 
 func (f *fakeDrainOps) isDraining(sessionName string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return false, f.err
 	}
@@ -68,6 +106,8 @@ func (f *fakeDrainOps) isDraining(sessionName string) (bool, error) {
 }
 
 func (f *fakeDrainOps) drainStartTime(sessionName string) (time.Time, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return time.Time{}, f.err
 	}
@@ -79,6 +119,8 @@ func (f *fakeDrainOps) drainStartTime(sessionName string) (time.Time, error) {
 }
 
 func (f *fakeDrainOps) setDrainAck(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return f.err
 	}
@@ -87,6 +129,8 @@ func (f *fakeDrainOps) setDrainAck(sessionName string) error {
 }
 
 func (f *fakeDrainOps) isDrainAcked(sessionName string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return false, f.err
 	}
@@ -94,6 +138,8 @@ func (f *fakeDrainOps) isDrainAcked(sessionName string) (bool, error) {
 }
 
 func (f *fakeDrainOps) setRestartRequested(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return f.err
 	}
@@ -102,13 +148,20 @@ func (f *fakeDrainOps) setRestartRequested(sessionName string) error {
 }
 
 func (f *fakeDrainOps) isRestartRequested(sessionName string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return false, f.err
 	}
+	if f.restartReadErr != nil {
+		return false, f.restartReadErr
+	}
 	return f.restartRequested[sessionName], nil
 }
 
 func (f *fakeDrainOps) clearRestartRequested(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return f.err
 	}
@@ -117,6 +170,8 @@ func (f *fakeDrainOps) clearRestartRequested(sessionName string) error {
 }
 
 func (f *fakeDrainOps) setDriftRestart(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return f.err
 	}
@@ -125,6 +180,8 @@ func (f *fakeDrainOps) setDriftRestart(sessionName string) error {
 }
 
 func (f *fakeDrainOps) isDriftRestart(sessionName string) (bool, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return false, f.err
 	}
@@ -132,6 +189,8 @@ func (f *fakeDrainOps) isDriftRestart(sessionName string) (bool, error) {
 }
 
 func (f *fakeDrainOps) clearDriftRestart(sessionName string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
 	if f.err != nil {
 		return f.err
 	}
@@ -479,7 +538,8 @@ func TestDoRuntimeRequestRestartError(t *testing.T) {
 	dops := newFakeDrainOps()
 	dops.err = errors.New("tmux borked")
 	var stdout, stderr bytes.Buffer
-	code := doRuntimeRequestRestart(dops, nil, events.Discard, "worker", "worker", &stdout, &stderr)
+	code := doRuntimeRequestRestart(context.Background(), dops, nil, events.Discard, "worker", "worker",
+		time.Millisecond, time.Second, &stdout, &stderr)
 	if code != 1 {
 		t.Fatalf("code = %d, want 1", code)
 	}
@@ -488,6 +548,136 @@ func TestDoRuntimeRequestRestartError(t *testing.T) {
 	}
 }
 
+func TestDoRuntimeRequestRestartFlagCleared(t *testing.T) {
+	dops := &drainOpsWithCountdown{fakeDrainOps: newFakeDrainOps(), remaining: 2}
+
+	var stdout, stderr bytes.Buffer
+	code := doRuntimeRequestRestart(context.Background(), dops, nil, events.Discard, "worker", "worker",
+		10*time.Millisecond, 5*time.Second, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("code = %d, want 0 when flag cleared; stderr: %s", code, stderr.String())
+	}
+	if stderr.Len() > 0 {
+		t.Errorf("unexpected stderr: %q", stderr.String())
+	}
+	if got := stdout.String(); !strings.Contains(got, "Waiting up to 5s") {
+		t.Errorf("stdout = %q, want bounded wait banner", got)
+	}
+	if dops.restartRequested["worker"] {
+		t.Error("restart flag should be cleared by the simulated reconciler")
+	}
+}
+
+func TestDoRuntimeRequestRestartTimeout(t *testing.T) {
+	dops := newFakeDrainOps()
+
+	var stdout, stderr bytes.Buffer
+	code := doRuntimeRequestRestart(context.Background(), dops, nil, events.Discard, "worker", "worker",
+		10*time.Millisecond, 25*time.Millisecond, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1 on timeout", code)
+	}
+	if got := stderr.String(); !strings.Contains(got, "controller did not act within") {
+		t.Errorf("stderr = %q, want timeout diagnostic", got)
+	}
+	if !strings.Contains(stderr.String(), "gc dashboard") {
+		t.Errorf("stderr = %q, want gc dashboard hint", stderr.String())
+	}
+}
+
+func TestDoRuntimeRequestRestartTimeoutReportsLastPollError(t *testing.T) {
+	dops := newFakeDrainOps()
+	dops.restartReadErr = errors.New("metadata read failed")
+
+	var stdout, stderr bytes.Buffer
+	code := doRuntimeRequestRestart(context.Background(), dops, nil, events.Discard, "worker", "worker",
+		10*time.Millisecond, 25*time.Millisecond, &stdout, &stderr)
+	if code != 1 {
+		t.Fatalf("code = %d, want 1 on timeout", code)
+	}
+	if got := stderr.String(); !strings.Contains(got, "last poll error: metadata read failed") {
+		t.Errorf("stderr = %q, want last poll error", got)
+	}
+}
+
+func TestDoRuntimeRequestRestartContextCancel(t *testing.T) {
+	dops := newFakeDrainOps()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	var stdout, stderr bytes.Buffer
+
+	done := make(chan int, 1)
+	go func() {
+		done <- doRuntimeRequestRestart(ctx, dops, nil, events.Discard, "worker", "worker",
+			10*time.Millisecond, 30*time.Second, &stdout, &stderr)
+	}()
+
+	time.Sleep(30 * time.Millisecond)
+	cancel()
+
+	select {
+	case code := <-done:
+		if code != 0 {
+			t.Fatalf("code = %d, want 0 on context cancel", code)
+		}
+		// Flag must remain set so the controller can still act on its next tick.
+		if !dops.restartRequested["worker"] {
+			t.Error("restart flag should remain set after context cancel")
+		}
+		if got := stderr.String(); !strings.Contains(got, "restart request remains set") {
+			t.Errorf("stderr = %q, want pending restart warning", got)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("doRuntimeRequestRestart did not exit on context cancel")
+	}
+}
+
+func TestControllerRestartTimeout(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  *config.City
+		want time.Duration
+	}{
+		{name: "nil config uses floor", cfg: nil, want: 5 * time.Minute},
+		{name: "empty interval uses floor", cfg: &config.City{}, want: 5 * time.Minute},
+		{name: "below floor clamps up", cfg: &config.City{Daemon: config.DaemonConfig{PatrolInterval: "15s"}}, want: 5 * time.Minute},
+		{name: "middle range uses multiplier", cfg: &config.City{Daemon: config.DaemonConfig{PatrolInterval: "2m"}}, want: 10 * time.Minute},
+		{name: "ceiling edge", cfg: &config.City{Daemon: config.DaemonConfig{PatrolInterval: "6m"}}, want: 30 * time.Minute},
+		{name: "above ceiling clamps down", cfg: &config.City{Daemon: config.DaemonConfig{PatrolInterval: "10m"}}, want: 30 * time.Minute},
+		{name: "invalid duration uses default floor", cfg: &config.City{Daemon: config.DaemonConfig{PatrolInterval: "later"}}, want: 5 * time.Minute},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := controllerRestartTimeout(tt.cfg); got != tt.want {
+				t.Fatalf("controllerRestartTimeout() = %s, want %s", got, tt.want)
+			}
+		})
+	}
+}
+
+type getMetaErrorProvider struct {
+	*runtime.Fake
+	err error
+}
+
+func (p *getMetaErrorProvider) GetMeta(_, _ string) (string, error) {
+	return "", p.err
+}
+
+func TestProviderDrainOpsIsRestartRequestedTreatsGoneSessionAsCleared(t *testing.T) {
+	dops := newDrainOps(&getMetaErrorProvider{
+		Fake: runtime.NewFake(),
+		err:  runtime.ErrSessionNotFound,
+	})
+	requested, err := dops.isRestartRequested("worker")
+	if err != nil {
+		t.Fatalf("isRestartRequested returned gone-session error: %v", err)
+	}
+	if requested {
+		t.Fatal("isRestartRequested = true, want false for gone session")
+	}
+}
+
 func TestRequestRestartAcceptsNoArgs(t *testing.T) {
 	// Verify the cobra command accepts no args.
 	var stdout, stderr bytes.Buffer
@@ -513,6 +703,7 @@ func TestRuntimeRequestRestartNamedOnDemandReturnsWithoutBlocking(t *testing.T)
 		t.Fatalf("write city.toml: %v", err)
 	}
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 	t.Setenv("GC_CITY", cityDir)
 	t.Setenv("GC_CITY_PATH", cityDir)
 	t.Setenv("GC_ALIAS", "mayor")
@@ -556,7 +747,7 @@ func TestRuntimeRequestRestartNamedOnDemandReturnsWithoutBlocking(t *testing.T)
 		if code != 0 {
 			t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
 		}
-	case <-time.After(2 * time.Second):
+	case <-time.After(10 * time.Second):
 		t.Fatal("cmdRuntimeRequestRestart blocked for named on-demand session")
 	}
 	if !strings.Contains(stdout.String(), "Restart skipped for named session") {
@@ -617,7 +808,7 @@ func (p *removeMetaErrorProvider) RemoveMeta(_, _ string) error {
 	return p.err
 }
 
-func TestProviderDrainOpsClearRestartRequestedIgnoresGoneSession(t *testing.T) {
+func TestProviderDrainOpsClearRestartRequestedTreatsSessionGoneAsBenign(t *testing.T) {
 	dops := newDrainOps(&removeMetaErrorProvider{
 		Fake: runtime.NewFake(),
 		err:  errors.New("no tmux server running"),
diff --git a/cmd/gc/cmd_session.go b/cmd/gc/cmd_session.go
index fc49ade40a..0a58fc915f 100644
--- a/cmd/gc/cmd_session.go
+++ b/cmd/gc/cmd_session.go
@@ -96,6 +96,7 @@ according to the selected semantic intent.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 	cmd.Flags().StringVar(&intent, "intent", string(session.SubmitIntentDefault), "submit intent: default, follow_up, or interrupt_now")
 	return cmd
@@ -315,7 +316,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach bool,
 			fmt.Fprintf(stdout, "Session %s created from template %q (reconciler will start it).\n", info.ID, canonicalTemplate) //nolint:errcheck // best-effort stdout
 
 			if !shouldAttachNewSession(noAttach, sessionTransport) {
-				if sessionTransport == "acp" && !noAttach {
+				if sessionTransport == config.SessionTransportACP && !noAttach {
 					fmt.Fprintln(stdout, "Session uses ACP transport; not attaching.") //nolint:errcheck // best-effort stdout
 				}
 				return 0
@@ -409,7 +410,7 @@ func cmdSessionNew(args []string, alias, title, titleHint string, noAttach bool,
 	fmt.Fprintf(stdout, "Session %s created from template %q.\n", info.ID, canonicalTemplate) //nolint:errcheck // best-effort stdout
 
 	if !shouldAttachNewSession(noAttach, sessionTransport) {
-		if sessionTransport == "acp" && !noAttach {
+		if sessionTransport == config.SessionTransportACP && !noAttach {
 			fmt.Fprintln(stdout, "Session uses ACP transport; not attaching.") //nolint:errcheck // best-effort stdout
 		}
 		return 0
@@ -429,7 +430,7 @@ func newSessionStoredMCPMetadata(
 	alias, template, provider, workDir, transport string,
 	metadata map[string]string,
 ) (map[string]string, error) {
-	if strings.TrimSpace(transport) != "acp" {
+	if strings.TrimSpace(transport) != config.SessionTransportACP {
 		return metadata, nil
 	}
 	mcpServers, err := resolvedRuntimeMCPServersWithConfig(
@@ -469,8 +470,21 @@ type acpRouteRegistrar interface {
 
 func validateResolvedSessionTransport(resolved *config.ResolvedProvider, transport string, sp runtime.Provider) error {
 	transport = strings.TrimSpace(transport)
-	if transport != "acp" {
+	switch transport {
+	case "":
 		return nil
+	case config.SessionTransportTmux:
+		if sessionProviderSupportsTmux(sp) {
+			return nil
+		}
+		providerName := transport
+		if resolved != nil && resolved.Name != "" {
+			providerName = resolved.Name
+		}
+		return fmt.Errorf("provider %q requires tmux transport but the session provider cannot route tmux sessions", providerName)
+	case config.SessionTransportACP:
+	default:
+		return fmt.Errorf("unknown session transport %q", transport)
 	}
 	providerName := ""
 	if resolved != nil {
@@ -496,7 +510,7 @@ func sessionProviderSupportsACP(sp runtime.Provider) bool {
 		return false
 	}
 	if provider, ok := sp.(runtime.TransportCapabilityProvider); ok {
-		return provider.SupportsTransport("acp")
+		return provider.SupportsTransport(config.SessionTransportACP)
 	}
 	if _, ok := sp.(acpRouteRegistrar); ok {
 		return true
@@ -504,6 +518,13 @@ func sessionProviderSupportsACP(sp runtime.Provider) bool {
 	return false
 }
 
+func sessionProviderSupportsTmux(sp runtime.Provider) bool {
+	if provider, ok := sp.(runtime.TransportCapabilityProvider); ok {
+		return provider.SupportsTransport(config.SessionTransportTmux)
+	}
+	return true
+}
+
 func resolvedSessionCommand(cityPath string, resolved *config.ResolvedProvider, optionOverrides map[string]string, transport string) (string, error) {
 	if resolved == nil {
 		return "", fmt.Errorf("resolved provider is nil")
@@ -955,6 +976,7 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -1022,7 +1044,7 @@ func cmdSessionAttach(args []string, stdout, stderr io.Writer) int {
 //
 // stderr receives projection errors (use io.Discard to ignore).
 //
-// sessionKind mirrors the mc_session_kind bead metadata: "provider" means
+// sessionKind mirrors the real_world_app_session_kind bead metadata: "provider" means
 // the session was created from a bare provider name (not an agent template),
 // so the agent-template lookup should be skipped. This matches the guard in
 // the API handler (handler_session_chat.go).
@@ -1115,6 +1137,7 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -1195,6 +1218,7 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -1253,6 +1277,7 @@ func newSessionRenameCmd(stdout, stderr io.Writer) *cobra.Command {
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -1394,6 +1419,7 @@ func newSessionPeekCmd(stdout, stderr io.Writer) *cobra.Command {
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 	cmd.Flags().IntVar(&lines, "lines", 50, "number of lines to capture")
 	return cmd
@@ -1456,6 +1482,7 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -1529,6 +1556,7 @@ joined automatically.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 	cmd.Flags().StringVar(&delivery, "delivery", string(nudgeDeliveryWaitIdle), "delivery mode: immediate, wait-idle, or queue")
 	return cmd
@@ -1652,7 +1680,7 @@ func sessionExplicitNameForNewSession(agent *config.Agent, alias string) (string
 }
 
 func shouldAttachNewSession(noAttach bool, transport string) bool {
-	return !noAttach && transport != "acp"
+	return !noAttach && transport != config.SessionTransportACP
 }
 
 // formatDuration formats a duration for human display.
diff --git a/cmd/gc/cmd_session_logs.go b/cmd/gc/cmd_session_logs.go
index 66d56fe647..24e23b5ed1 100644
--- a/cmd/gc/cmd_session_logs.go
+++ b/cmd/gc/cmd_session_logs.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"os"
 	"strings"
 	"time"
 
@@ -13,6 +14,7 @@ import (
 	sessionpkg "github.com/gastownhall/gascity/internal/session"
 	workdirutil "github.com/gastownhall/gascity/internal/workdir"
 	"github.com/gastownhall/gascity/internal/worker"
+	workertranscript "github.com/gastownhall/gascity/internal/worker/transcript"
 	"github.com/spf13/cobra"
 )
 
@@ -51,6 +53,7 @@ Use -f to follow new messages as they arrive.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 	cmd.Flags().BoolVarP(&follow, "follow", "f", false, "Follow new messages as they arrive")
 	cmd.Flags().IntVar(&tail, "tail", 10, "Number of most recent transcript entries to show (0 = all; compact dividers count as entries)")
@@ -81,7 +84,12 @@ func cmdSessionLogs(args []string, follow bool, tail int, stdout, stderr io.Writ
 		ok       bool
 	)
 	if err == nil && store != nil {
-		path, provider, ok = resolveStoredSessionLogSource(cityPath, cfg, store, identifier, searchPaths)
+		var diagnostic string
+		path, provider, ok, diagnostic = resolveStoredSessionLogSource(cityPath, cfg, store, identifier, searchPaths)
+		if ok && path == "" && diagnostic != "" {
+			fmt.Fprintf(stderr, "gc session logs: %s\n", diagnostic) //nolint:errcheck // best-effort stderr
+			return 1
+		}
 	}
 	if !ok {
 		workDir, found := resolveConfiguredSessionLogContext(cityPath, cfg, identifier)
@@ -107,27 +115,49 @@ func resolveSessionLogPath(searchPaths []string, logCtx sessionLogContext) strin
 	return factory.DiscoverTranscript(logCtx.provider, logCtx.workDir, logCtx.sessionKey)
 }
 
-func resolveStoredSessionLogSource(cityPath string, cfg *config.City, store beads.Store, identifier string, searchPaths []string) (string, string, bool) {
+func resolveStoredSessionLogSource(cityPath string, cfg *config.City, store beads.Store, identifier string, searchPaths []string) (string, string, bool, string) {
 	logCtx, ok := resolveSessionLogContext(cityPath, cfg, store, identifier)
 	if !ok {
-		return "", "", false
+		return "", "", false, ""
 	}
 	if logCtx.sessionID != "" {
 		handle, err := workerHandleForSessionWithConfig(cityPath, store, newSessionProvider(), cfg, logCtx.sessionID)
 		if err == nil {
 			if path, pathErr := handle.TranscriptPath(context.Background()); pathErr == nil && strings.TrimSpace(path) != "" {
-				return path, logCtx.provider, true
+				return path, logCtx.provider, true, ""
 			}
 		}
 	}
-	path := resolveSessionLogPath(searchPaths, logCtx)
-	if path == "" && canFallbackStoredSessionLogByWorkDir(store, logCtx) {
+	path := ""
+	fallbackAllowed := canFallbackStoredSessionLogByWorkDir(store, logCtx)
+	if strings.TrimSpace(logCtx.sessionKey) != "" {
+		path = resolveSessionKeyedLogPath(searchPaths, logCtx)
+		if path == "" && fallbackAllowed {
+			path = resolveSessionLogPath(searchPaths, logCtx)
+		}
+	} else if fallbackAllowed {
+		path = resolveSessionLogPath(searchPaths, logCtx)
+	}
+	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
+		path = ""
+	}
+	if path == "" && fallbackAllowed {
 		factory, err := worker.NewFactory(worker.FactoryConfig{SearchPaths: searchPaths})
 		if err == nil {
 			path = factory.DiscoverWorkDirTranscript(logCtx.provider, logCtx.workDir)
 		}
 	}
-	return path, logCtx.provider, true
+	if !sessionLogPathFreshEnough(path, logCtx.createdAt) {
+		path = ""
+	}
+	if path == "" && !fallbackAllowed {
+		return "", logCtx.provider, true, ambiguousSessionLogDiagnostic(logCtx)
+	}
+	return path, logCtx.provider, true, ""
+}
+
+func resolveSessionKeyedLogPath(searchPaths []string, logCtx sessionLogContext) string {
+	return workertranscript.DiscoverKeyedPath(searchPaths, logCtx.provider, logCtx.workDir, logCtx.sessionKey)
 }
 
 type sessionLogContext struct {
@@ -135,6 +165,7 @@ type sessionLogContext struct {
 	workDir    string
 	sessionKey string
 	provider   string
+	createdAt  time.Time
 }
 
 func resolveSessionLogContext(cityPath string, cfg *config.City, store beads.Store, identifier string) (sessionLogContext, bool) {
@@ -162,19 +193,44 @@ func resolveSessionLogContext(cityPath string, cfg *config.City, store beads.Sto
 		workDir:    workDir,
 		sessionKey: strings.TrimSpace(b.Metadata["session_key"]),
 		provider:   provider,
+		createdAt:  b.CreatedAt,
 	}, true
 }
 
+func sessionLogPathFreshEnough(path string, sessionCreatedAt time.Time) bool {
+	if strings.TrimSpace(path) == "" {
+		return false
+	}
+	if sessionCreatedAt.IsZero() {
+		return true
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return !info.ModTime().Before(sessionCreatedAt.Add(-2 * time.Second))
+}
+
 func canFallbackStoredSessionLogByWorkDir(store beads.Store, logCtx sessionLogContext) bool {
 	if store == nil || strings.TrimSpace(logCtx.sessionID) == "" || strings.TrimSpace(logCtx.workDir) == "" {
 		return false
 	}
-	all, err := store.ListByLabel(sessionpkg.LabelSession, 0)
+	all, err := sessionLogFallbackCandidates(store, logCtx.workDir, logCtx.provider)
 	if err != nil {
 		return false
 	}
+	targetLive := false
+	for _, b := range all {
+		if b.ID == logCtx.sessionID {
+			targetLive = sessionLogFallbackCandidateLive(b)
+			break
+		}
+	}
 	matches := 0
 	for _, b := range all {
+		if !sessionpkg.IsSessionBeadOrRepairable(b) {
+			continue
+		}
 		if strings.TrimSpace(b.Metadata["work_dir"]) != logCtx.workDir {
 			continue
 		}
@@ -185,6 +241,9 @@ func canFallbackStoredSessionLogByWorkDir(store beads.Store, logCtx sessionLogCo
 		if logCtx.provider != "" && provider != "" && provider != logCtx.provider {
 			continue
 		}
+		if targetLive && b.ID != logCtx.sessionID && !sessionLogFallbackCandidateLive(b) {
+			continue
+		}
 		matches++
 		if matches > 1 {
 			return false
@@ -193,6 +252,64 @@ func canFallbackStoredSessionLogByWorkDir(store beads.Store, logCtx sessionLogCo
 	return matches == 1
 }
 
+func sessionLogFallbackCandidates(store beads.Store, workDir, provider string) ([]beads.Bead, error) {
+	candidates := make(map[string]beads.Bead)
+	add := func(filters map[string]string) error {
+		found, err := store.ListByMetadata(filters, 0)
+		if err != nil {
+			return err
+		}
+		for _, b := range found {
+			candidates[b.ID] = b
+		}
+		return nil
+	}
+	if strings.TrimSpace(provider) == "" {
+		if err := add(map[string]string{"work_dir": workDir}); err != nil {
+			return nil, err
+		}
+	} else {
+		if err := add(map[string]string{"work_dir": workDir, "provider": provider}); err != nil {
+			return nil, err
+		}
+		if err := add(map[string]string{"work_dir": workDir, "provider_kind": provider}); err != nil {
+			return nil, err
+		}
+	}
+	out := make([]beads.Bead, 0, len(candidates))
+	for _, b := range candidates {
+		out = append(out, b)
+	}
+	return out, nil
+}
+
+func sessionLogFallbackCandidateLive(b beads.Bead) bool {
+	if b.Status == "closed" {
+		return false
+	}
+	switch sessionpkg.State(strings.TrimSpace(b.Metadata["state"])) {
+	case sessionpkg.StateActive, sessionpkg.StateAwake, sessionpkg.StateCreating, sessionpkg.StateDraining:
+		return true
+	default:
+		return false
+	}
+}
+
+func ambiguousSessionLogDiagnostic(logCtx sessionLogContext) string {
+	sessionID := strings.TrimSpace(logCtx.sessionID)
+	if sessionID == "" {
+		sessionID = "requested session"
+	}
+	provider := strings.TrimSpace(logCtx.provider)
+	if provider == "" {
+		provider = "provider"
+	}
+	if strings.TrimSpace(logCtx.sessionKey) == "" {
+		return fmt.Sprintf("session %q has no session_key and workdir fallback is ambiguous for %s work_dir %q", sessionID, provider, logCtx.workDir)
+	}
+	return fmt.Sprintf("no exact transcript found for session %q and workdir fallback is ambiguous for %s work_dir %q", sessionID, provider, logCtx.workDir)
+}
+
 func resolveConfiguredSessionLogContext(cityPath string, cfg *config.City, identifier string) (string, bool) {
 	if cfg == nil {
 		return "", false
@@ -364,7 +481,7 @@ func printLogEntry(w io.Writer, e *worker.TranscriptEntry) {
 
 	mc := resolveMessage(e.Message)
 	if mc == nil {
-		// Unparseable message — print raw truncated.
+		// Unparseable message; print raw truncated.
 		if len(e.Message) > 0 {
 			raw := string(e.Message)
 			if len(raw) > 200 {
diff --git a/cmd/gc/cmd_session_logs_test.go b/cmd/gc/cmd_session_logs_test.go
index 0a03159f69..a96eaefc4d 100644
--- a/cmd/gc/cmd_session_logs_test.go
+++ b/cmd/gc/cmd_session_logs_test.go
@@ -47,6 +47,30 @@ func writeNamedTestSession(t *testing.T, searchBase, workDir, fileName string, l
 	return path
 }
 
+type noLabelScanSessionLogStore struct {
+	*beads.MemStore
+}
+
+func (s *noLabelScanSessionLogStore) ListByLabel(label string, _ int, _ ...beads.QueryOpt) ([]beads.Bead, error) {
+	return nil, fmt.Errorf("unexpected label scan for %q", label)
+}
+
+func writeCodexTestSession(t *testing.T, searchBase, workDir, fileName string, lines ...string) string {
+	t.Helper()
+	dayDir := filepath.Join(searchBase, "2026", "05", "04")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dayDir, fileName)
+	allLines := append([]string{
+		fmt.Sprintf(`{"timestamp":"2026-05-04T00:00:00Z","type":"session_meta","payload":{"cwd":%q}}`, workDir),
+	}, lines...)
+	if err := os.WriteFile(path, []byte(strings.Join(allLines, "\n")+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
 func TestDoSessionLogsBasic(t *testing.T) {
 	searchBase := t.TempDir()
 	workDir := t.TempDir()
@@ -123,7 +147,7 @@ func TestDoSessionLogsTailReturnsLastNEntries(t *testing.T) {
 		t.Errorf("tail=2 should include the last entry 'reply-3', got: %s", out)
 	}
 	// Everything before the last 2 must be absent. In particular, the FIRST
-	// entry must not leak through — that was the bug the user reported.
+	// entry must not leak through; that was the bug the user reported.
 	forbidden := []string{"first", "reply-1", "second", "reply-2"}
 	for _, s := range forbidden {
 		if strings.Contains(out, s) {
@@ -327,10 +351,13 @@ func TestResolveStoredSessionLogSource_UniqueWorkDirFallsBackBeyondLatestAlias(t
 		},
 	})
 
-	got, provider, ok := resolveStoredSessionLogSource("", nil, store, "mayor", []string{searchBase})
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, store, "mayor", []string{searchBase})
 	if !ok {
 		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
 	}
+	if diagnostic != "" {
+		t.Fatalf("resolveStoredSessionLogSource() diagnostic = %q, want empty", diagnostic)
+	}
 	if provider != "claude" {
 		t.Fatalf("resolveStoredSessionLogSource() provider = %q, want %q", provider, "claude")
 	}
@@ -371,7 +398,7 @@ func TestResolveStoredSessionLogSource_DoesNotCrossAmbiguousWorkDir(t *testing.T
 		},
 	})
 
-	got, provider, ok := resolveStoredSessionLogSource("", nil, store, "mayor", []string{searchBase})
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, store, "mayor", []string{searchBase})
 	if !ok {
 		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
 	}
@@ -381,6 +408,110 @@ func TestResolveStoredSessionLogSource_DoesNotCrossAmbiguousWorkDir(t *testing.T
 	if got != "" {
 		t.Fatalf("resolveStoredSessionLogSource() path = %q, want empty for ambiguous same-workdir transcript", got)
 	}
+	if !strings.Contains(diagnostic, "ambiguous") {
+		t.Fatalf("resolveStoredSessionLogSource() diagnostic = %q, want ambiguous", diagnostic)
+	}
+}
+
+func TestResolveStoredSessionLogSource_CodexDoesNotUseAmbiguousWorkDirFallback(t *testing.T) {
+	store := beads.NewMemStore()
+	workDir := t.TempDir()
+	searchBase := t.TempDir()
+	writeCodexTestSession(t, searchBase, workDir, "rollout-current.jsonl",
+		`{"timestamp":"2026-05-04T00:00:01Z","type":"response_item","payload":{"type":"message","role":"user","content":[{"text":"wrong session"}]}}`,
+	)
+
+	for _, name := range []string{"workflows__codex-max-mc-one", "workflows__codex-max-mc-two"} {
+		b, _ := store.Create(beads.Bead{
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"alias":         name,
+				"provider":      "codex",
+				"provider_kind": "codex",
+				"session_key":   "019df2fd-078f-7cb2-93c8-5c649a15eabe",
+				"session_name":  name,
+				"state":         "gc_swept",
+				"work_dir":      workDir,
+			},
+		})
+		_ = store.Close(b.ID)
+	}
+
+	got, provider, ok, diagnostic := resolveStoredSessionLogSource("", nil, store, "workflows__codex-max-mc-one", []string{searchBase})
+	if !ok {
+		t.Fatal("resolveStoredSessionLogSource() = not found, want found")
+	}
+	if provider != "codex" {
+		t.Fatalf("resolveStoredSessionLogSource() provider = %q, want codex", provider)
+	}
+	if got != "" {
+		t.Fatalf("resolveStoredSessionLogSource() path = %q, want empty for ambiguous codex workdir", got)
+	}
+	if !strings.Contains(diagnostic, "ambiguous") {
+		t.Fatalf("resolveStoredSessionLogSource() diagnostic = %q, want ambiguous", diagnostic)
+	}
+}
+
+func TestCanFallbackStoredSessionLogByWorkDirUsesTargetedLookup(t *testing.T) {
+	store := &noLabelScanSessionLogStore{MemStore: beads.NewMemStore()}
+	workDir := t.TempDir()
+	b, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"provider":     "codex",
+			"session_name": "worker",
+			"state":        "awake",
+			"work_dir":     workDir,
+		},
+	})
+
+	ok := canFallbackStoredSessionLogByWorkDir(store, sessionLogContext{
+		sessionID: b.ID,
+		workDir:   workDir,
+		provider:  "codex",
+	})
+	if !ok {
+		t.Fatal("canFallbackStoredSessionLogByWorkDir() = false, want true")
+	}
+}
+
+func TestCanFallbackStoredSessionLogByWorkDirIgnoresAsleepPeersForLiveTarget(t *testing.T) {
+	store := beads.NewMemStore()
+	workDir := t.TempDir()
+	target, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"provider":     "codex",
+			"session_name": "worker",
+			"state":        "awake",
+			"work_dir":     workDir,
+		},
+	})
+	_, _ = store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "old-worker",
+			"provider":     "codex",
+			"session_name": "old-worker",
+			"state":        "asleep",
+			"work_dir":     workDir,
+		},
+	})
+
+	ok := canFallbackStoredSessionLogByWorkDir(store, sessionLogContext{
+		sessionID: target.ID,
+		workDir:   workDir,
+		provider:  "codex",
+	})
+	if !ok {
+		t.Fatal("canFallbackStoredSessionLogByWorkDir() = false, want true")
+	}
 }
 
 func TestDoSessionLogsNegativeTail(t *testing.T) {
diff --git a/cmd/gc/cmd_session_pin.go b/cmd/gc/cmd_session_pin.go
index 4d67cc47ae..5376377f8b 100644
--- a/cmd/gc/cmd_session_pin.go
+++ b/cmd/gc/cmd_session_pin.go
@@ -25,6 +25,7 @@ canonical bead so the reconciler can start it when unblocked.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -43,6 +44,7 @@ normal wake/sleep rules on its next pass.`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -79,8 +81,9 @@ func cmdSessionSetPin(args []string, pinned bool, stdout, stderr io.Writer) int
 		id, err = resolveSessionIDWithConfig(cityPath, cfg, store, args[0])
 		if err != nil {
 			id, err = resolveSessionIDMaterializingNamedWithMetadata(cityPath, cfg, store, args[0], map[string]string{
-				"pin_awake":            "true",
-				"pending_create_claim": "",
+				"pin_awake":                 "true",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
 			})
 			materializedForPin = err == nil
 		}
diff --git a/cmd/gc/cmd_session_reset.go b/cmd/gc/cmd_session_reset.go
index 18899c15c9..e0c7569a83 100644
--- a/cmd/gc/cmd_session_reset.go
+++ b/cmd/gc/cmd_session_reset.go
@@ -17,7 +17,9 @@ func newSessionResetCmd(stdout, stderr io.Writer) *cobra.Command {
 
 The controller stops the current runtime and starts the same session again with
 fresh provider conversation state. Session identity, alias, mail, and queued
-work remain attached to the existing session bead.
+work remain attached to the existing session bead. For named sessions, reset
+also clears any tripped named-session respawn circuit breaker before requesting
+the fresh restart.
 
 Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 		Args: cobra.ExactArgs(1),
@@ -27,6 +29,7 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -68,6 +71,20 @@ func cmdSessionReset(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gc session reset: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
+
+	bead, err := store.Get(sessionID)
+	if err != nil {
+		fmt.Fprintf(stderr, "gc session reset: loading session %s: %v\n", sessionID, err) //nolint:errcheck // best-effort stderr
+		return 1
+	}
+	identity := namedSessionIdentity(bead)
+	if identity != "" {
+		if err := resetSessionCircuitBreakerOnController(cityPath, sessionID, identity); err != nil {
+			fmt.Fprintf(stderr, "gc session reset: clearing session circuit breaker for %q: %v\n", identity, err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+	}
+
 	if err := handle.Reset(context.Background()); err != nil {
 		fmt.Fprintf(stderr, "gc session reset: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
diff --git a/cmd/gc/cmd_session_reset_test.go b/cmd/gc/cmd_session_reset_test.go
index 5261822c42..4744a51200 100644
--- a/cmd/gc/cmd_session_reset_test.go
+++ b/cmd/gc/cmd_session_reset_test.go
@@ -1,10 +1,12 @@
 package main
 
 import (
+	"bufio"
 	"bytes"
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -12,13 +14,104 @@ import (
 	"github.com/gastownhall/gascity/internal/session"
 )
 
+// TestCmdSessionReset_ClearsCircuitBreaker verifies that running
+// `gc session reset <identity>` clears a tripped session circuit breaker
+// for the matching named session, so the supervisor will respawn the
+// session on the next tick. This is the operator-facing remediation path
+// the breaker's ERROR log message points at.
+func TestCmdSessionReset_ClearsCircuitBreaker(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_SESSION", "fake")
+
+	cityDir := shortSocketTempDir(t, "gc-session-reset-cb-")
+	t.Setenv("GC_CITY", cityDir)
+	writeGenericNamedSessionCityTOML(t, cityDir)
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(.gc): %v", err)
+	}
+
+	store, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	const identity = "session-a"
+	bead, err := store.Create(beads.Bead{
+		Title:  "named session",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "template:worker"},
+		Metadata: map[string]string{
+			"alias":                        identity,
+			"template":                     "worker",
+			"session_name":                 "s-gc-reset-cb-test",
+			"state":                        "awake",
+			namedSessionMetadataKey:        "true",
+			namedSessionIdentityMetadata:   identity,
+			sessionCircuitStateMetadata:    circuitOpen.String(),
+			sessionCircuitRestartsMetadata: `["2026-04-10T12:00:00Z"]`,
+		},
+	})
+	if err != nil {
+		t.Fatalf("store.Create(session bead): %v", err)
+	}
+
+	// Trip the breaker by recording enough restarts inside
+	// the rolling window with no progress events.
+	cb := newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:      30 * time.Minute,
+		MaxRestarts: 3,
+	})
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+	now := time.Date(2026, 4, 10, 12, 0, 0, 0, time.UTC)
+	for i := 0; i < 4; i++ {
+		cb.RecordRestart(identity, now.Add(time.Duration(i)*time.Second))
+	}
+	if !cb.IsOpen(identity, now.Add(time.Minute)) {
+		t.Fatalf("precondition: expected breaker OPEN for %q after 4 restarts", identity)
+	}
+
+	lis, err := startControllerSocket(
+		cityDir,
+		func() {},
+		nil,
+		make(chan reloadRequest),
+		make(chan convergenceRequest, 1),
+		make(chan struct{}, 1),
+		make(chan struct{}, 1),
+	)
+	if err != nil {
+		t.Fatalf("startControllerSocket: %v", err)
+	}
+	defer lis.Close()                              //nolint:errcheck
+	defer os.Remove(controllerSocketPath(cityDir)) //nolint:errcheck
+
+	var stdout, stderr bytes.Buffer
+	if code := cmdSessionReset([]string{identity}, &stdout, &stderr); code != 0 {
+		t.Fatalf("cmdSessionReset = %d, want 0; stderr=%s", code, stderr.String())
+	}
+
+	if cb.IsOpen(identity, now.Add(time.Minute)) {
+		t.Fatalf("breaker still OPEN for %q after `gc session reset %s`", identity, identity)
+	}
+	updated, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("store.Get(session bead): %v", err)
+	}
+	if got := updated.Metadata[sessionCircuitStateMetadata]; got != "" {
+		t.Fatalf("persisted circuit state = %q, want cleared", got)
+	}
+	if got := updated.Metadata[sessionCircuitRestartsMetadata]; got != "" {
+		t.Fatalf("persisted restart history = %q, want cleared", got)
+	}
+}
+
 func TestCmdSessionReset_RequestsFreshRestartWithController(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_SESSION", "fake")
 
 	cityDir := shortSocketTempDir(t, "gc-session-reset-")
 	t.Setenv("GC_CITY", cityDir)
-	writeNamedSessionCityTOML(t, cityDir)
+	writeGenericNamedSessionCityTOML(t, cityDir)
 	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
 		t.Fatalf("MkdirAll(.gc): %v", err)
 	}
@@ -28,12 +121,12 @@ func TestCmdSessionReset_RequestsFreshRestartWithController(t *testing.T) {
 		t.Fatalf("openCityStoreAt: %v", err)
 	}
 	bead, err := store.Create(beads.Bead{
-		Title:  "manual mayor",
+		Title:  "manual session",
 		Type:   session.BeadType,
-		Labels: []string{session.LabelSession, "template:mayor"},
+		Labels: []string{session.LabelSession, "template:worker"},
 		Metadata: map[string]string{
 			"alias":                      "sky",
-			"template":                   "mayor",
+			"template":                   "worker",
 			"session_name":               "s-gc-reset-test",
 			"state":                      "awake",
 			"session_key":                "original-key",
@@ -100,7 +193,7 @@ func TestCmdSessionReset_RequestsFreshRestartWithController(t *testing.T) {
 		case cmd, ok := <-commands:
 			if !ok {
 				if len(gotCommands) != 3 {
-					t.Fatalf("controller commands = %v, want ping plus 2 pokes", gotCommands)
+					t.Fatalf("controller commands = %v, want ping, poke, poke", gotCommands)
 				}
 				break
 			}
@@ -109,8 +202,8 @@ func TestCmdSessionReset_RequestsFreshRestartWithController(t *testing.T) {
 			t.Fatalf("timed out waiting for controller pokes, got %v", gotCommands)
 		}
 	}
-	wantCommands := []string{"ping\n", "poke\n", "poke\n"}
-	for i, want := range wantCommands {
+	wantExact := []string{"ping\n", "poke\n", "poke\n"}
+	for i, want := range wantExact {
 		if gotCommands[i] != want {
 			t.Fatalf("controller command %d = %q, want %q", i, gotCommands[i], want)
 		}
@@ -137,3 +230,193 @@ func TestCmdSessionReset_RequestsFreshRestartWithController(t *testing.T) {
 		t.Fatalf("started_config_hash = %q, want original hash preserved until reconcile", got.Metadata["started_config_hash"])
 	}
 }
+
+func TestCmdSessionReset_ControllerClearFailureDoesNotQueueRestart(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_SESSION", "fake")
+
+	cityDir := shortSocketTempDir(t, "gc-session-reset-clear-fail-")
+	t.Setenv("GC_CITY", cityDir)
+	writeGenericNamedSessionCityTOML(t, cityDir)
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(.gc): %v", err)
+	}
+
+	store, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	bead, err := store.Create(beads.Bead{
+		Title:  "generic named session",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession, "template:worker"},
+		Metadata: map[string]string{
+			"alias":                      "session-a",
+			"template":                   "worker",
+			"session_name":               "s-gc-reset-clear-fail",
+			"state":                      "awake",
+			"session_key":                "original-key",
+			"started_config_hash":        "hash-before-reset",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "session-a",
+		},
+	})
+	if err != nil {
+		t.Fatalf("store.Create(session bead): %v", err)
+	}
+
+	sockPath := filepath.Join(cityDir, ".gc", "controller.sock")
+	lis, err := net.Listen("unix", sockPath)
+	if err != nil {
+		t.Fatalf("Listen(%q): %v", sockPath, err)
+	}
+	defer lis.Close() //nolint:errcheck
+
+	commands := make(chan string, 3)
+	errCh := make(chan error, 1)
+	go func() {
+		defer close(commands)
+		for i := 0; i < 3; i++ {
+			conn, err := lis.Accept()
+			if err != nil {
+				errCh <- err
+				return
+			}
+			buf := make([]byte, 256)
+			n, err := conn.Read(buf)
+			if err != nil {
+				conn.Close() //nolint:errcheck
+				errCh <- err
+				return
+			}
+			cmd := string(buf[:n])
+			commands <- cmd
+			reply := "ok\n"
+			if cmd == "ping\n" {
+				reply = "123\n"
+			} else if strings.HasPrefix(cmd, "session-circuit-reset:") {
+				reply = `{"outcome":"failed","error":"clear failed"}` + "\n"
+			}
+			if _, err := conn.Write([]byte(reply)); err != nil {
+				conn.Close() //nolint:errcheck
+				errCh <- err
+				return
+			}
+			conn.Close() //nolint:errcheck
+		}
+	}()
+
+	var stdout, stderr bytes.Buffer
+	if code := cmdSessionReset([]string{"session-a"}, &stdout, &stderr); code != 1 {
+		t.Fatalf("cmdSessionReset = %d, want 1; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), `clearing session circuit breaker for "session-a": clear failed`) {
+		t.Fatalf("stderr = %q, want controller clear failure", stderr.String())
+	}
+
+	gotCommands := make([]string, 0, 3)
+	deadline := time.After(2 * time.Second)
+	for len(gotCommands) < 3 {
+		select {
+		case err := <-errCh:
+			if err != nil {
+				t.Fatalf("controller socket: %v", err)
+			}
+		case cmd, ok := <-commands:
+			if !ok {
+				t.Fatalf("controller commands = %v, want ping, poke, reset", gotCommands)
+			}
+			gotCommands = append(gotCommands, cmd)
+		case <-deadline:
+			t.Fatalf("timed out waiting for controller commands, got %v", gotCommands)
+		}
+	}
+	if gotCommands[0] != "ping\n" || gotCommands[1] != "poke\n" || !strings.HasPrefix(gotCommands[2], "session-circuit-reset:") {
+		t.Fatalf("controller commands = %v, want ping, poke, reset", gotCommands)
+	}
+
+	reloaded, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt(reload): %v", err)
+	}
+	got, err := reloaded.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", bead.ID, err)
+	}
+	if got.Metadata["restart_requested"] == "true" {
+		t.Fatalf("restart_requested = true, want no queued reset after controller clear failure")
+	}
+	if got.Metadata["continuation_reset_pending"] == "true" {
+		t.Fatalf("continuation_reset_pending = true, want no queued reset after controller clear failure")
+	}
+}
+
+func TestResetSessionCircuitBreakerOnControllerMalformedReply(t *testing.T) {
+	cityDir := shortSocketTempDir(t, "gc-session-reset-malformed-")
+	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(.gc): %v", err)
+	}
+	sockPath := filepath.Join(cityDir, ".gc", "controller.sock")
+	lis, err := net.Listen("unix", sockPath)
+	if err != nil {
+		t.Fatalf("Listen(%q): %v", sockPath, err)
+	}
+	defer lis.Close() //nolint:errcheck
+
+	errCh := make(chan error, 1)
+	go func() {
+		conn, err := lis.Accept()
+		if err != nil {
+			errCh <- err
+			return
+		}
+		defer conn.Close() //nolint:errcheck
+		scanner := bufio.NewScanner(conn)
+		if !scanner.Scan() {
+			errCh <- scanner.Err()
+			return
+		}
+		if _, err := conn.Write([]byte("not-json\n")); err != nil {
+			errCh <- err
+		}
+	}()
+
+	err = resetSessionCircuitBreakerOnController(cityDir, "session-id", "rig-a/session-a")
+	if err == nil {
+		t.Fatal("resetSessionCircuitBreakerOnController = nil, want decode error")
+	}
+	if !strings.Contains(err.Error(), "decoding session circuit reset reply") {
+		t.Fatalf("error = %v, want decode context", err)
+	}
+	select {
+	case err := <-errCh:
+		if err != nil {
+			t.Fatalf("controller socket: %v", err)
+		}
+	default:
+	}
+}
+
+func writeGenericNamedSessionCityTOML(t *testing.T, dir string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(.gc): %v", err)
+	}
+	data := []byte(`[workspace]
+name = "test-city"
+
+[beads]
+provider = "file"
+
+[[agent]]
+name = "session-a"
+provider = "codex"
+start_command = "echo"
+
+[[named_session]]
+template = "session-a"
+`)
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), data, 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+}
diff --git a/cmd/gc/cmd_session_test.go b/cmd/gc/cmd_session_test.go
index e7be2b480f..46efcfd5ec 100644
--- a/cmd/gc/cmd_session_test.go
+++ b/cmd/gc/cmd_session_test.go
@@ -394,7 +394,7 @@ func TestCmdSessionNew_ACPTemplatePersistsStoredMCPMetadata(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_SESSION", "fake")
 
-	cityDir := t.TempDir()
+	cityDir := shortSocketTempDir(t, "gc-session-mcp-")
 	t.Setenv("GC_CITY", cityDir)
 	writePoolACPSessionCityTOML(t, cityDir)
 	writeCatalogFile(t, cityDir, "mcp/identity.template.toml", `
@@ -533,6 +533,34 @@ args = ["{{.AgentName}}", "{{.WorkDir}}", "{{.TemplateName}}"]
 	}
 }
 
+func TestCmdSessionNewRejectsExplicitTmuxAgentWhenCitySessionProviderIsACP(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+
+	oldBuild := buildSessionProviderByName
+	t.Cleanup(func() { buildSessionProviderByName = oldBuild })
+	buildSessionProviderByName = func(name string, sc config.SessionConfig, cityName, cityPath string) (runtime.Provider, error) {
+		if name == "acp" {
+			return &transportCapableSessionProvider{Fake: runtime.NewFake()}, nil
+		}
+		return oldBuild(name, sc, cityName, cityPath)
+	}
+
+	cityDir := t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	writePoolACPCityExplicitTmuxAgentTOML(t, cityDir)
+
+	var stdout, stderr bytes.Buffer
+	if code := cmdSessionNew([]string{"demo/ant"}, "", "", "", true, &stdout, &stderr); code == 0 {
+		t.Fatalf("cmdSessionNew(explicit tmux on ACP city) = %d, want failure", code)
+	}
+	if !strings.Contains(stderr.String(), "requires tmux transport") {
+		t.Fatalf("stderr = %q, want tmux transport error", stderr.String())
+	}
+	if got := sessionBeads(t, cityDir); len(got) != 0 {
+		t.Fatalf("session bead count = %d, want 0", len(got))
+	}
+}
+
 func TestCmdSessionNew_PoolTemplateRejectsAliasMatchingConcreteIdentity(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_SESSION", "fake")
@@ -841,6 +869,77 @@ func TestBuildResumeCommandUsesBuiltinAncestorForClaudeSettings(t *testing.T) {
 	}
 }
 
+func TestBuildResumeCommandIncludesWrappedCodexResumeDefaults(t *testing.T) {
+	cityDir := t.TempDir()
+	base := "builtin:codex"
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "worker", Provider: "codex-mini"},
+		},
+		Providers: map[string]config.ProviderSpec{
+			"codex-mini": {
+				Base:    &base,
+				Command: "aimux",
+				Args: []string{
+					"run", "codex", "--",
+					"--dangerously-bypass-approvals-and-sandbox",
+					"-m", "gpt-5.3-codex-spark",
+					"-c", "model_reasoning_effort=\"medium\"",
+				},
+				PathCheck:     "true",
+				ResumeCommand: "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume {{.SessionKey}}",
+			},
+		},
+	}
+	info := session.Info{
+		Template:   "worker",
+		Command:    "codex",
+		Provider:   "codex-mini",
+		WorkDir:    "/tmp/workdir",
+		SessionKey: "abc-123",
+	}
+
+	cmd, _ := buildResumeCommand(cityDir, cfg, info, "", io.Discard)
+	want := "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume -c model_reasoning_effort=medium abc-123"
+	if cmd != want {
+		t.Fatalf("resume command = %q, want %q", cmd, want)
+	}
+}
+
+func TestBuildResumeCommandProviderKindSkipsTemplateCollision(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "runner", Provider: "agent-provider"},
+		},
+		Providers: map[string]config.ProviderSpec{
+			"runner": {
+				Command:    "true",
+				Args:       []string{"provider"},
+				ResumeFlag: "--resume",
+			},
+			"agent-provider": {
+				Command:    "true",
+				Args:       []string{"agent"},
+				ResumeFlag: "--resume",
+			},
+		},
+	}
+	info := session.Info{
+		Template:   "runner",
+		Command:    "stale",
+		WorkDir:    "/tmp/workdir",
+		SessionKey: "abc-123",
+	}
+
+	cmd, _ := buildResumeCommand(t.TempDir(), cfg, info, "provider", io.Discard)
+	want := "true provider --resume abc-123"
+	if cmd != want {
+		t.Fatalf("resume command = %q, want %q", cmd, want)
+	}
+}
+
 func TestSessionReason_FallsThroughToProviderForSleepingAttachment(t *testing.T) {
 	provider := runtime.NewFake()
 	if err := provider.Start(context.Background(), "sleeping-worker", runtime.Config{Command: "echo"}); err != nil {
@@ -1361,6 +1460,42 @@ acp_args = ["acp"]
 	}
 }
 
+func writePoolACPCityExplicitTmuxAgentTOML(t *testing.T, dir string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
+		t.Fatalf("MkdirAll(.gc): %v", err)
+	}
+	rigRoot := filepath.Join(dir, "repos", "demo")
+	if err := os.MkdirAll(rigRoot, 0o755); err != nil {
+		t.Fatalf("MkdirAll(rig root): %v", err)
+	}
+	data := []byte(fmt.Sprintf(`[workspace]
+name = "test-city"
+
+[beads]
+provider = "file"
+
+[session]
+provider = "acp"
+
+[[rigs]]
+name = "demo"
+path = %q
+
+[[agent]]
+name = "ant"
+dir = "demo"
+provider = "codex"
+session = "tmux"
+work_dir = ".gc/worktrees/{{.Rig}}/ants/{{.AgentBase}}"
+min_active_sessions = 0
+max_active_sessions = 4
+`, rigRoot))
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), data, 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+}
+
 func sessionBeads(t *testing.T, cityDir string) []beads.Bead {
 	t.Helper()
 	store, err := openCityStoreAt(cityDir)
@@ -1626,6 +1761,32 @@ func TestValidateResolvedSessionTransportAcceptsRoutedACPProvider(t *testing.T)
 	}
 }
 
+func TestValidateResolvedSessionTransportAcceptsTmuxTransport(t *testing.T) {
+	if err := validateResolvedSessionTransport(&config.ResolvedProvider{
+		Name: "opencode",
+	}, config.SessionTransportTmux, runtime.NewFake()); err != nil {
+		t.Fatalf("validateResolvedSessionTransport() = %v, want nil", err)
+	}
+}
+
+func TestValidateResolvedSessionTransportRejectsTmuxWhenSessionProviderIsACPOnly(t *testing.T) {
+	err := validateResolvedSessionTransport(&config.ResolvedProvider{
+		Name: "opencode",
+	}, config.SessionTransportTmux, &transportCapableSessionProvider{Fake: runtime.NewFake()})
+	if err == nil || !strings.Contains(err.Error(), "requires tmux transport") {
+		t.Fatalf("validateResolvedSessionTransport() error = %v, want tmux routing error", err)
+	}
+}
+
+func TestValidateResolvedSessionTransportRejectsUnknownTransport(t *testing.T) {
+	err := validateResolvedSessionTransport(&config.ResolvedProvider{
+		Name: "opencode",
+	}, "stdio", runtime.NewFake())
+	if err == nil || !strings.Contains(err.Error(), "unknown session transport") {
+		t.Fatalf("validateResolvedSessionTransport() error = %v, want unknown transport error", err)
+	}
+}
+
 func TestValidateResolvedSessionTransportRejectsRoutedProviderWhenTransportCapabilityDisablesACP(t *testing.T) {
 	err := validateResolvedSessionTransport(&config.ResolvedProvider{
 		Name:        "opencode",
diff --git a/cmd/gc/cmd_session_wake.go b/cmd/gc/cmd_session_wake.go
index da32fda502..e28b50844a 100644
--- a/cmd/gc/cmd_session_wake.go
+++ b/cmd/gc/cmd_session_wake.go
@@ -3,8 +3,10 @@ package main
 import (
 	"fmt"
 	"io"
+	"strings"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/session"
 	"github.com/spf13/cobra"
@@ -31,6 +33,7 @@ Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).`,
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 }
 
@@ -61,6 +64,7 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gc session wake: %s is not a session\n", id) //nolint:errcheck
 		return 1
 	}
+	hasRunnableTemplate := sessionWakeHasRunnableTemplate(b, cfg)
 	session.RepairEmptyType(store, &b)
 	nudgeIDs, err := session.WakeSession(store, b, time.Now().UTC())
 	if err != nil {
@@ -71,6 +75,17 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gc session wake: updating metadata: %v\n", err) //nolint:errcheck
 		return 1
 	}
+	if !hasRunnableTemplate && sessionWakeRequestedCreate(b) {
+		if err := store.SetMetadataBatch(id, map[string]string{
+			"state":                     string(session.StateAsleep),
+			"state_reason":              "",
+			"pending_create_claim":      "",
+			"pending_create_started_at": "",
+		}); err != nil {
+			fmt.Fprintf(stderr, "gc session wake: updating metadata: %v\n", err) //nolint:errcheck
+			return 1
+		}
+	}
 	if cityErr == nil {
 		if err := withdrawQueuedWaitNudges(cityPath, nudgeIDs); err != nil {
 			fmt.Fprintf(stderr, "gc session wake: warning: withdrawing queued wait nudges: %v\n", err) //nolint:errcheck
@@ -85,3 +100,19 @@ func cmdSessionWake(args []string, stdout, stderr io.Writer) int {
 	fmt.Fprintf(stdout, "Session %s: wake requested.\n", id) //nolint:errcheck
 	return 0
 }
+
+func sessionWakeHasRunnableTemplate(b beads.Bead, cfg *config.City) bool {
+	if cfg == nil {
+		return true
+	}
+	template := normalizedSessionTemplate(b, cfg)
+	if template == "" {
+		template = b.Metadata["template"]
+	}
+	return findAgentByTemplate(cfg, template) != nil
+}
+
+func sessionWakeRequestedCreate(b beads.Bead) bool {
+	state := session.State(strings.TrimSpace(b.Metadata["state"]))
+	return state == session.StateSuspended || state == session.StateDrained
+}
diff --git a/cmd/gc/cmd_session_wake_test.go b/cmd/gc/cmd_session_wake_test.go
index 79db1e786a..6256352ee0 100644
--- a/cmd/gc/cmd_session_wake_test.go
+++ b/cmd/gc/cmd_session_wake_test.go
@@ -21,27 +21,30 @@ func TestSessionWake_StateTransitionsAndMetadata(t *testing.T) {
 		metadata        map[string]string
 		wantState       string
 		wantSleepReason string
+		wantPending     string
 	}{
 		{
-			name: "suspended becomes asleep",
+			name: "suspended requests start",
 			metadata: map[string]string{
 				"template":     "worker",
 				"state":        "suspended",
 				"held_until":   future,
 				"sleep_reason": "user-hold",
 			},
-			wantState:       "asleep",
+			wantState:       "creating",
 			wantSleepReason: "",
+			wantPending:     "true",
 		},
 		{
-			name: "drained becomes asleep",
+			name: "drained requests start",
 			metadata: map[string]string{
 				"template":     "worker",
 				"state":        "drained",
 				"sleep_reason": "drained",
 			},
-			wantState:       "asleep",
+			wantState:       "creating",
 			wantSleepReason: "",
+			wantPending:     "true",
 		},
 		{
 			name: "creating clears quarantine but stays creating",
@@ -54,6 +57,7 @@ func TestSessionWake_StateTransitionsAndMetadata(t *testing.T) {
 			},
 			wantState:       "creating",
 			wantSleepReason: "",
+			wantPending:     "",
 		},
 		{
 			name: "active stays active",
@@ -64,6 +68,7 @@ func TestSessionWake_StateTransitionsAndMetadata(t *testing.T) {
 			},
 			wantState:       "active",
 			wantSleepReason: "idle",
+			wantPending:     "",
 		},
 	}
 
@@ -93,6 +98,9 @@ func TestSessionWake_StateTransitionsAndMetadata(t *testing.T) {
 			if got := updated.Metadata["sleep_reason"]; got != tt.wantSleepReason {
 				t.Fatalf("sleep_reason = %q, want %q", got, tt.wantSleepReason)
 			}
+			if got := updated.Metadata["pending_create_claim"]; got != tt.wantPending {
+				t.Fatalf("pending_create_claim = %q, want %q", got, tt.wantPending)
+			}
 			if got := updated.Metadata["held_until"]; got != "" {
 				t.Fatalf("held_until = %q, want empty", got)
 			}
@@ -225,7 +233,7 @@ func TestCmdSessionWake_ManagedBdPokesControllerAndMovesSuspendedToAsleep(t *tes
 	}
 }
 
-func TestCmdSessionWake_PokesManagedControllerAndMovesSuspendedToAsleep(t *testing.T) {
+func TestCmdSessionWake_PokesManagedControllerAndRequestsSuspendedStart(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	t.Setenv("GC_SESSION", "fake")
 
@@ -329,8 +337,11 @@ func TestCmdSessionWake_PokesManagedControllerAndMovesSuspendedToAsleep(t *testi
 	if err != nil {
 		t.Fatalf("store.Get(%s): %v", sessionID, err)
 	}
-	if got := updated.Metadata["state"]; got != "asleep" {
-		t.Fatalf("state = %q, want asleep", got)
+	if got := updated.Metadata["state"]; got != "creating" {
+		t.Fatalf("state = %q, want creating", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
 	}
 	if got := updated.Metadata["held_until"]; got != "" {
 		t.Fatalf("held_until = %q, want empty", got)
diff --git a/cmd/gc/cmd_sling.go b/cmd/gc/cmd_sling.go
index e737ea0cb7..7623bfeb57 100644
--- a/cmd/gc/cmd_sling.go
+++ b/cmd/gc/cmd_sling.go
@@ -18,6 +18,7 @@ import (
 	"github.com/gastownhall/gascity/internal/formula"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/session"
+	"github.com/gastownhall/gascity/internal/shellquote"
 	"github.com/gastownhall/gascity/internal/sling"
 	"github.com/gastownhall/gascity/internal/sourceworkflow"
 	"github.com/gastownhall/gascity/internal/telemetry"
@@ -25,6 +26,21 @@ import (
 	"github.com/spf13/cobra"
 )
 
+func init() {
+	sling.SetTracer(func(format string, args ...any) {
+		path := strings.TrimSpace(os.Getenv("GC_SLING_TRACE"))
+		if path == "" {
+			return
+		}
+		f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+		if err != nil {
+			return
+		}
+		defer f.Close()                                                                                    //nolint:errcheck
+		fmt.Fprintf(f, "%s %s\n", time.Now().UTC().Format(time.RFC3339Nano), fmt.Sprintf(format, args...)) //nolint:errcheck
+	})
+}
+
 // slingStdin returns the reader for --stdin input. Extracted for testability.
 var slingStdin = func() io.Reader { return os.Stdin }
 
@@ -149,9 +165,7 @@ func shellSlingRunner(dir, command string, env map[string]string) (string, error
 	if dir != "" {
 		cmd.Dir = dir
 	}
-	if len(env) > 0 {
-		cmd.Env = mergeRuntimeEnv(os.Environ(), env)
-	}
+	cmd.Env = mergeRuntimeEnv(os.Environ(), env)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return string(out), fmt.Errorf("running %q: %w", command, err)
@@ -198,6 +212,7 @@ func cmdSling(args []string, isFormula, doNudge, force bool, title string, vars
 	cityName := loadedCityName(cfg, cityPath)
 
 	var target, beadOrFormula string
+	var sourceBead existingSlingSourceBead
 	switch {
 	case fromStdin:
 		target = args[0]
@@ -205,6 +220,13 @@ func cmdSling(args []string, isFormula, doNudge, force bool, title string, vars
 	case len(args) == 2:
 		target = args[0]
 		beadOrFormula = args[1]
+		if !isFormula {
+			sourceBead, err = probeExistingSlingSourceBead(cfg, cityPath, beadOrFormula)
+			if err != nil {
+				fmt.Fprintf(stderr, "gc sling: %v\n", err) //nolint:errcheck // best-effort stderr
+				return 1
+			}
+		}
 	default:
 		// 1-arg: bead ID only, resolve target from rig's default_sling_target.
 		beadOrFormula = args[0]
@@ -212,11 +234,19 @@ func cmdSling(args []string, isFormula, doNudge, force bool, title string, vars
 			fmt.Fprintf(stderr, "gc sling: --formula requires explicit target\n") //nolint:errcheck // best-effort stderr
 			return 1
 		}
-		if !canInferSlingDefaultTargetFromBead(cfg, beadOrFormula) {
+		sourceBead, err = probeExistingSlingSourceBead(cfg, cityPath, beadOrFormula)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc sling: %v\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+		if !canInferSlingDefaultTargetFromBead(cfg, beadOrFormula) && !sourceBead.exists {
 			fmt.Fprintf(stderr, "gc sling: inline text requires explicit target\n  usage: gc sling <target> %q\n", beadOrFormula) //nolint:errcheck // best-effort stderr
 			return 1
 		}
-		bp := sling.BeadPrefix(beadOrFormula)
+		bp := sling.BeadPrefixForCity(cfg, beadOrFormula)
+		if sourceBead.prefix != "" {
+			bp = sourceBead.prefix
+		}
 		if bp == "" {
 			fmt.Fprintf(stderr, "gc sling: cannot derive rig from bead %q (no prefix)\n", beadOrFormula) //nolint:errcheck // best-effort stderr
 			return 1
@@ -247,20 +277,42 @@ func cmdSling(args []string, isFormula, doNudge, force bool, title string, vars
 
 	sp := newSessionProvider()
 
-	storeDir, store, err := openSlingStoreForSource(cfg, cityPath, beadOrFormula, a)
-	if err != nil {
-		fmt.Fprintf(stderr, "gc sling: %v\n", err) //nolint:errcheck // best-effort stderr
-		return 1
+	var storeDir string
+	var store beads.Store
+	if sourceBead.exists {
+		storeDir = sourceBead.storeDir
+		store, err = openStoreAtForCity(storeDir, cityPath)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc sling: opening store %s: %v\n", storeDir, err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+	} else {
+		storeDir, store, err = openSlingStoreForSource(cfg, cityPath, beadOrFormula, a)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc sling: %v\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
 	}
 	storeRef := workflowStoreRefForDir(storeDir, cityPath, cityName, cfg)
 	storeEnv := slingStoreEnv(cfg, cityPath, storeDir)
+	if sourceBead.exists && looksLikeInlineText(cfg, beadOrFormula) {
+		fmt.Fprintf(stderr, "gc sling: found existing bead %q in %s; routing it instead of creating inline text\n", beadOrFormula, storeRef) //nolint:errcheck // best-effort stderr
+	}
 
 	// Inline text mode: if the argument doesn't look like a bead ID
 	// (and we're not in formula mode), create a task bead from the text.
 	// During dry-run, mark the text as preview-only instead of creating it.
 	inlineText := false
 	if !isFormula {
-		createInlineBead, previewInlineText := resolveInlineBeadAction(cfg, beadOrFormula, dryRun)
+		inlineProbeStore := store
+		if !sourceBead.exists && sourceBead.checked && looksLikeInlineText(cfg, beadOrFormula) {
+			inlineProbeStore = nil
+		}
+		createInlineBead, previewInlineText, err := resolveInlineBeadAction(cfg, beadOrFormula, dryRun, inlineProbeStore)
+		if err != nil {
+			fmt.Fprintf(stderr, "gc sling: %v\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
 		inlineText = previewInlineText
 		if createInlineBead {
 			created, err := store.Create(beads.Bead{Title: beadOrFormula, Description: stdinDescription, Type: "task"})
@@ -331,7 +383,6 @@ func cmdSling(args []string, isFormula, doNudge, force bool, title string, vars
 			}
 			return out, nil
 		},
-		Stderr: stderr,
 	}
 
 	return doSlingBatch(opts, deps, store, stdout, stderr)
@@ -363,8 +414,13 @@ func findRigByPrefix(cfg *config.City, prefix string) (config.Rig, bool) {
 	return sling.FindRigByPrefix(cfg, prefix)
 }
 
-func beadPrefix(beadID string) string {
-	return sling.BeadPrefix(beadID)
+// beadPrefix returns the rig prefix for beadID, preferring the longest
+// configured prefix when cfg is non-nil. Pass cfg whenever the caller
+// needs hyphenated rig prefixes (e.g. "agent-diagnostics-hnn") to
+// resolve correctly; otherwise the underlying sling.BeadPrefix's
+// first-dash split is used.
+func beadPrefix(cfg *config.City, beadID string) string {
+	return sling.BeadPrefixForCity(cfg, beadID)
 }
 
 func rigDirForBead(cfg *config.City, beadID string) string {
@@ -392,7 +448,7 @@ func resolveSlingStoreRoot(cfg *config.City, cityPath, beadOrFormula string, a c
 	// resolveStoreScopeRoot would silently alias them to the city
 	// scope. Skip them so sling falls back to the agent's rig_dir or
 	// the city store instead of operating on the wrong store.
-	if bp := beadPrefix(beadOrFormula); bp != "" && !looksLikeInlineText(cfg, beadOrFormula) {
+	if bp := beadPrefix(cfg, beadOrFormula); bp != "" && !looksLikeInlineText(cfg, beadOrFormula) {
 		if sling.IsHQPrefix(cfg, bp) {
 			return storeDir
 		}
@@ -415,6 +471,50 @@ func openSlingStoreForSource(cfg *config.City, cityPath, beadOrFormula string, a
 	return storeDir, store, nil
 }
 
+type existingSlingSourceBead struct {
+	exists   bool
+	checked  bool
+	storeDir string
+	prefix   string
+}
+
+func probeExistingSlingSourceBead(cfg *config.City, cityPath, beadID string) (existingSlingSourceBead, error) {
+	storeDir, prefix, ok := slingSourceStoreRootForCandidate(cfg, cityPath, beadID)
+	if !ok {
+		return existingSlingSourceBead{}, nil
+	}
+	store, err := openStoreAtForCity(storeDir, cityPath)
+	if err != nil {
+		return existingSlingSourceBead{}, fmt.Errorf("opening store %s: %w", storeDir, err)
+	}
+	exists, err := sling.ProbeBeadInStore(store, beadID)
+	if err != nil {
+		return existingSlingSourceBead{}, fmt.Errorf("checking bead candidate %q: %w", beadID, err)
+	}
+	if !exists {
+		return existingSlingSourceBead{checked: true, storeDir: storeDir, prefix: prefix}, nil
+	}
+	return existingSlingSourceBead{exists: true, checked: true, storeDir: storeDir, prefix: prefix}, nil
+}
+
+func slingSourceStoreRootForCandidate(cfg *config.City, cityPath, beadID string) (string, string, bool) {
+	if cfg == nil || !isBeadIDCandidate(beadID) {
+		return "", "", false
+	}
+	bp := sling.BeadPrefixForCity(cfg, beadID)
+	if bp == "" {
+		return "", "", false
+	}
+	if sling.IsHQPrefix(cfg, bp) {
+		return resolveStoreScopeRoot(cityPath, cityPath), bp, true
+	}
+	rig, found := findRigByPrefix(cfg, bp)
+	if !found || strings.TrimSpace(rig.Path) == "" {
+		return "", "", false
+	}
+	return resolveStoreScopeRoot(cityPath, rig.Path), bp, true
+}
+
 func canInferSlingDefaultTargetFromBead(cfg *config.City, beadOrFormula string) bool {
 	return looksLikeBeadID(beadOrFormula) || looksLikeConfiguredBeadID(cfg, beadOrFormula)
 }
@@ -488,7 +588,7 @@ func (r cliBeadRouter) Route(_ context.Context, req sling.RouteRequest) error {
 			if r.deps.Runner == nil {
 				return fmt.Errorf("custom sling_query requires a runner")
 			}
-			slingCmd := sling.BuildSlingCommandForAgent("sling_query", agentCfg.EffectiveSlingQuery(), req.BeadID, r.deps.CityPath, r.deps.CityName, agentCfg, r.deps.Cfg.Rigs, r.deps.Stderr)
+			slingCmd, _ := sling.BuildSlingCommandForAgent("sling_query", agentCfg.EffectiveSlingQuery(), req.BeadID, r.deps.CityPath, r.deps.CityName, agentCfg, r.deps.Cfg.Rigs)
 			_, err := r.deps.Runner(req.WorkDir, slingCmd, req.Env)
 			return err
 		}
@@ -782,12 +882,12 @@ func missingBeadForceApplies(opts sling.SlingOpts) bool {
 }
 
 func sourceWorkflowCleanupCommand(sourceBeadID, storeRef string) string {
-	args := []string{"gc workflow delete-source", sourceBeadID}
+	args := []string{"gc", "workflow", "delete-source", sourceBeadID}
 	if storeRef = strings.TrimSpace(storeRef); storeRef != "" {
 		args = append(args, "--store-ref", storeRef)
 	}
 	args = append(args, "--apply")
-	return strings.Join(args, " ")
+	return shellquote.Join(args)
 }
 
 func printSourceWorkflowConflict(stderr io.Writer, conflictErr *sourceworkflow.ConflictError, storeRef string) {
@@ -850,7 +950,7 @@ func collectConflictErrors(err error, visit func(*sourceworkflow.ConflictError))
 // buildSlingFormulaVars merges caller-provided vars with the runtime context
 // needed by common work formulas. Explicit --var entries always win.
 func buildSlingFormulaVars(formulaName, beadID string, userVars []string, a config.Agent, deps slingDeps) map[string]string {
-	vars := make(map[string]string, len(userVars)+3)
+	vars := make(map[string]string, len(userVars)+6)
 	for _, v := range userVars {
 		key, value, ok := strings.Cut(v, "=")
 		if ok && key != "" {
@@ -866,11 +966,20 @@ func buildSlingFormulaVars(formulaName, beadID string, userVars []string, a conf
 		}
 		vars[key] = value
 	}
+	addRoutingVar := func(key, value string) {
+		if _, explicit := vars[key]; explicit {
+			return
+		}
+		vars[key] = value
+	}
 
 	if beadID != "" {
 		// Attached work formulas conventionally expect issue=<bead-id>.
 		addVar("issue", beadID)
 	}
+	addRoutingVar("rig_name", a.Dir)
+	addRoutingVar("binding_name", a.BindingName)
+	addRoutingVar("binding_prefix", a.BindingPrefix())
 
 	autoBranch := slingFormulaTargetBranch(beadID, deps, a)
 	if slingFormulaUsesBaseBranch(formulaName) {
@@ -949,7 +1058,7 @@ func formatBeadLabel(id, title string) string {
 // printCrossRigSection prints the Cross-rig dry-run section if applicable.
 func printCrossRigSection(w func(string), beadID string, a config.Agent, cfg *config.City) {
 	if msg := checkCrossRig(beadID, a, cfg); msg != "" {
-		bp := sling.BeadPrefix(beadID)
+		bp := sling.BeadPrefixForCity(cfg, beadID)
 		rp := rigPrefixForAgent(a, cfg)
 		w("Cross-rig:")
 		w(fmt.Sprintf("  Bead %s (prefix %q) targets %s (rig prefix %q).", beadID, bp, a.QualifiedName(), rp))
@@ -1467,34 +1576,46 @@ func dryRunSingle(opts slingOpts, deps slingDeps, querier BeadQuerier, stdout, s
 		w("  This creates a wisp and returns its root bead ID.")
 		w("")
 
-		routeCmd := sling.BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), "<wisp-root>", deps.CityPath, deps.CityName, a, deps.Cfg.Rigs, stderr)
+		routeCmd, _ := sling.BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), "<wisp-root>", deps.CityPath, deps.CityName, a, deps.Cfg.Rigs)
 		w("Route command (not executed):")
 		w("  " + routeCmd)
 		w("  The wisp root bead (not the formula name) is routed to the agent.")
 		w("")
 	} else {
-		// Work section (bead info).
-		printBeadInfo(w, querier, opts.BeadOrFormula)
-
-		// Cross-rig section.
-		printCrossRigSection(w, opts.BeadOrFormula, a, deps.Cfg)
-
-		// Idempotency section -- use preflight result instead of re-querying.
-		check := sling.CheckBeadState(querier, opts.BeadOrFormula, a, deps)
-		if check.Idempotent {
-			w("Idempotency:")
-			w("  Bead " + opts.BeadOrFormula + " is already routed to " + a.QualifiedName() + ".")
-			w("  Without --force, sling would skip routing (exit 0).")
+		if opts.InlineText {
+			w("Work:")
+			w("  Would create new task bead with title=" + fmt.Sprintf("%q", opts.BeadOrFormula))
 			w("")
+		} else {
+			printBeadInfo(w, querier, opts.BeadOrFormula)
+			printCrossRigSection(w, opts.BeadOrFormula, a, deps.Cfg)
+
+			check := sling.CheckBeadState(querier, opts.BeadOrFormula, a, deps)
+			if check.Idempotent {
+				w("Idempotency:")
+				w("  Bead " + opts.BeadOrFormula + " is already routed to " + a.QualifiedName() + ".")
+				w("  Without --force, sling would skip routing (exit 0).")
+				w("")
+			}
 		}
 
-		// Attach formula section (--on or default).
-		// Dry-run does NOT auto-burn molecules (no mutations).
+		// Inline-text previews skip the molecule pre-check: the bead
+		// does not exist yet, so the "no existing children" claim
+		// would be vacuously true and misleading.
+		preCheck := !opts.InlineText
+		// In inline-text mode the live path creates a fresh bead first
+		// and operates on the new ID; reuse a placeholder in preview
+		// commands so operators don't read the inline title as the bead
+		// ID a real run would attach to or route.
+		previewBeadID := opts.BeadOrFormula
+		if opts.InlineText {
+			previewBeadID = "<new-bead-id>"
+		}
 		if opts.OnFormula != "" {
-			// Read-only check: does the bead already have an attached molecule?
-			if label, id := sling.FindBlockingMolecule(querier, opts.BeadOrFormula, deps.Store); label != "" {
-				fmt.Fprintf(stderr, "gc sling: bead %s already has attached %s %s\n", opts.BeadOrFormula, label, id) //nolint:errcheck
-				return 1
+			if preCheck {
+				if rc := dryRunReportBlockingMolecule(opts, deps, querier, stderr); rc != 0 {
+					return rc
+				}
 			}
 			w("Attach formula:")
 			w("  Formula: " + opts.OnFormula)
@@ -1502,33 +1623,38 @@ func dryRunSingle(opts slingOpts, deps slingDeps, querier BeadQuerier, stdout, s
 			w("  bead. The agent receives the original bead with the workflow")
 			w("  attached, rather than a standalone wisp.")
 			w("")
-			cookCmd := fmt.Sprintf("bd mol cook --formula=%s --on=%s", opts.OnFormula, opts.BeadOrFormula)
+			cookCmd := fmt.Sprintf("bd mol cook --formula=%s --on=%s", opts.OnFormula, previewBeadID)
 			if opts.Title != "" {
 				cookCmd += fmt.Sprintf(" --title=%s", opts.Title)
 			}
 			w("  Would run: " + cookCmd)
-			w("  Pre-check: " + opts.BeadOrFormula + " has no existing molecule/wisp children ✓")
+			if preCheck {
+				w("  Pre-check: " + opts.BeadOrFormula + " has no existing molecule/wisp children ✓")
+			}
 			w("")
 		} else if !opts.NoFormula && a.EffectiveDefaultSlingFormula() != "" {
-			if label, id := sling.FindBlockingMolecule(querier, opts.BeadOrFormula, deps.Store); label != "" {
-				fmt.Fprintf(stderr, "gc sling: bead %s already has attached %s %s\n", opts.BeadOrFormula, label, id) //nolint:errcheck
-				return 1
+			if preCheck {
+				if rc := dryRunReportBlockingMolecule(opts, deps, querier, stderr); rc != 0 {
+					return rc
+				}
 			}
 			w("Default formula:")
 			w("  Formula: " + a.EffectiveDefaultSlingFormula())
 			w("  Target " + a.QualifiedName() + " has a default_sling_formula configured.")
 			w("  A wisp will be attached automatically (use --no-formula to suppress).")
 			w("")
-			cookCmd := fmt.Sprintf("bd mol cook --formula=%s --on=%s", a.EffectiveDefaultSlingFormula(), opts.BeadOrFormula)
+			cookCmd := fmt.Sprintf("bd mol cook --formula=%s --on=%s", a.EffectiveDefaultSlingFormula(), previewBeadID)
 			if opts.Title != "" {
 				cookCmd += fmt.Sprintf(" --title=%s", opts.Title)
 			}
 			w("  Would run: " + cookCmd)
-			w("  Pre-check: " + opts.BeadOrFormula + " has no existing molecule/wisp children ✓")
+			if preCheck {
+				w("  Pre-check: " + opts.BeadOrFormula + " has no existing molecule/wisp children ✓")
+			}
 			w("")
 		}
 
-		routeCmd := sling.BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), opts.BeadOrFormula, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs, stderr)
+		routeCmd, _ := sling.BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), previewBeadID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs)
 		w("Route command (not executed):")
 		w("  " + routeCmd)
 		if !sling.IsCustomSlingQuery(a) {
@@ -1620,7 +1746,7 @@ func dryRunBatch(opts slingOpts, deps slingDeps, stdout, _ io.Writer,
 	// Route commands.
 	w("Route commands (not executed):")
 	for _, c := range open {
-		routeCmd := sling.BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), c.ID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs, io.Discard)
+		routeCmd, _ := sling.BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), c.ID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs)
 		w("  " + routeCmd)
 	}
 	w("")
@@ -1690,6 +1816,18 @@ func printBeadInfo(w func(string), q BeadQuerier, beadID string) {
 	w("")
 }
 
+// dryRunReportBlockingMolecule returns 1 (and emits a stderr diagnostic)
+// when the bead already has an attached molecule that would block
+// formula attachment, otherwise 0.
+func dryRunReportBlockingMolecule(opts slingOpts, deps slingDeps, querier BeadQuerier, stderr io.Writer) int {
+	label, id := sling.FindBlockingMolecule(querier, opts.BeadOrFormula, deps.Store)
+	if label == "" {
+		return 0
+	}
+	fmt.Fprintf(stderr, "gc sling: bead %s already has attached %s %s\n", opts.BeadOrFormula, label, id) //nolint:errcheck // best-effort stderr
+	return 1
+}
+
 // printNudgePreview prints the Nudge section for dry-run output.
 func printNudgePreview(w func(string), a config.Agent, cityName string,
 	sp runtime.Provider, store beads.Store, cfg *config.City,
@@ -1719,8 +1857,11 @@ func isCustomSlingQuery(a config.Agent) bool {
 // "gc-r5sr6bm"). Short suffixes (1-4 chars) are accepted
 // unconditionally. Longer suffixes (5-8 chars) must contain at least
 // one digit to distinguish base36 hashes from English words like
-// "hello-world". Strings with spaces or multiple dashes (like
-// "code-review") are treated as inline text for ad-hoc bead creation.
+// "hello-world". This is the cfg-free heuristic and rejects bead IDs
+// whose rig prefix contains a hyphen ("agent-diagnostics-hnn"); those
+// are accepted by looksLikeConfiguredBeadID, which consults cfg.Rigs.
+// Multi-dash strings with no matching configured rig prefix are
+// treated as inline text for ad-hoc bead creation.
 func looksLikeBeadID(s string) bool {
 	_, baseSuffix, ok := sling.BeadIDParts(s)
 	if !ok || len(baseSuffix) > 8 {
@@ -1741,15 +1882,53 @@ func looksLikeBeadIDSuffix(baseSuffix string) bool {
 	return false
 }
 
-func shouldCreateInlineBead(cfg *config.City, beadOrFormula string) bool {
-	return looksLikeInlineText(cfg, beadOrFormula)
+func resolveInlineBeadAction(cfg *config.City, beadOrFormula string, dryRun bool, store beads.Store) (createInlineBead, previewInlineText bool, err error) {
+	// Fast path: heuristics already classify this as a bead ID.
+	if !looksLikeInlineText(cfg, beadOrFormula) {
+		return false, false, nil
+	}
+	// Store probe: covers IDs that pass the shape pre-check but fail the
+	// heuristic (e.g. descriptive multi-dash IDs like "fo-spawn-storm").
+	// A store hit means the bead exists and should be routed, not created.
+	if store != nil && isBeadIDCandidate(beadOrFormula) {
+		exists, err := sling.ProbeBeadInStore(store, beadOrFormula)
+		if err != nil {
+			return false, false, fmt.Errorf("checking bead candidate %q: %w", beadOrFormula, err)
+		}
+		if exists {
+			return false, false, nil
+		}
+	}
+	if dryRun {
+		return false, true, nil
+	}
+	return true, false, nil
 }
 
-func resolveInlineBeadAction(cfg *config.City, beadOrFormula string, dryRun bool) (createInlineBead, previewInlineText bool) {
-	if dryRun && looksLikeInlineText(cfg, beadOrFormula) {
-		return false, true
+// isBeadIDCandidate reports whether s has the shape of a potential bead ID:
+// no whitespace, starts with a letter, contains only letters, digits, hyphens,
+// underscores, and dots, and has at least one hyphen. Used to gate the store
+// probe before falling back to inline-text creation.
+func isBeadIDCandidate(s string) bool {
+	if s == "" || strings.ContainsAny(s, " \t\n") {
+		return false
+	}
+	first := s[0]
+	if (first < 'a' || first > 'z') && (first < 'A' || first > 'Z') {
+		return false
+	}
+	hasDash := false
+	for _, c := range s {
+		switch {
+		case c == '-':
+			hasDash = true
+		case c == '_' || c == '.':
+		case 'a' <= c && c <= 'z', 'A' <= c && c <= 'Z', '0' <= c && c <= '9':
+		default:
+			return false
+		}
 	}
-	return shouldCreateInlineBead(cfg, beadOrFormula), false
+	return hasDash
 }
 
 func looksLikeInlineText(cfg *config.City, beadOrFormula string) bool {
@@ -1757,22 +1936,7 @@ func looksLikeInlineText(cfg *config.City, beadOrFormula string) bool {
 }
 
 func looksLikeConfiguredBeadID(cfg *config.City, s string) bool {
-	prefix, baseSuffix, ok := sling.BeadIDParts(s)
-	if !ok || len(baseSuffix) > 8 {
-		return false
-	}
-	if cfg == nil {
-		return false
-	}
-	if strings.EqualFold(prefix, config.EffectiveHQPrefix(cfg)) {
-		return true
-	}
-	for i := range cfg.Rigs {
-		if strings.EqualFold(prefix, cfg.Rigs[i].EffectivePrefix()) {
-			return true
-		}
-	}
-	return false
+	return sling.LooksLikeConfiguredBeadID(cfg, s)
 }
 
 // rigPrefixForAgent returns the effective bead prefix for the rig that an
@@ -1794,7 +1958,7 @@ func rigPrefixForAgent(a config.Agent, cfg *config.City) string {
 // doesn't match the target agent's rig prefix. Returns "" when the check
 // passes or can't be performed (missing prefix, city-wide agent, no rig).
 func checkCrossRig(beadID string, a config.Agent, cfg *config.City) string {
-	bp := sling.BeadPrefix(beadID)
+	bp := sling.BeadPrefixForCity(cfg, beadID)
 	if bp == "" {
 		return ""
 	}
diff --git a/cmd/gc/cmd_sling_test.go b/cmd/gc/cmd_sling_test.go
index 80087870b5..1c9c886a66 100644
--- a/cmd/gc/cmd_sling_test.go
+++ b/cmd/gc/cmd_sling_test.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net"
 	"os"
 	"os/exec"
@@ -114,7 +115,7 @@ func (s *slingTestStore) Get(id string) (beads.Bead, error) {
 	}
 	b, ok := s.synthetic[id]
 	if !ok {
-		if _, _, looksLikeBead := sling.BeadIDParts(id); !looksLikeBead {
+		if !slingTestLooksLikeBeadID(id) {
 			return beads.Bead{}, err
 		}
 		return s.ensureSynthetic(id), nil
@@ -122,6 +123,52 @@ func (s *slingTestStore) Get(id string) (beads.Bead, error) {
 	return b, nil
 }
 
+// slingTestLooksLikeBeadID accepts the same single-dash shapes as
+// sling.BeadIDParts plus multi-dash shapes whose trailing token has the
+// bead-suffix shape: alphanumeric, ≤8 chars, and either ≤4 chars long
+// or containing at least one digit. The digit-or-≤4 rule mirrors
+// looksLikeBeadIDSuffix and prevents prose like "code-review-please"
+// (suffix "please" — 6 chars, no digit) from being silently fabricated
+// as a synthetic bead and masking the auto-create-text-bead branch in
+// tests. Tests that rely on multi-dash bead IDs whose suffix violates
+// this shape must seed beads explicitly.
+func slingTestLooksLikeBeadID(id string) bool {
+	if _, _, ok := sling.BeadIDParts(id); ok {
+		return true
+	}
+	id = strings.TrimSpace(id)
+	if id == "" || strings.ContainsAny(id, " \t\n") {
+		return false
+	}
+	last := strings.LastIndex(id, "-")
+	if last <= 0 || last == len(id)-1 {
+		return false
+	}
+	suffix := id[last+1:]
+	base := suffix
+	if dot := strings.IndexByte(suffix, '.'); dot > 0 {
+		base = suffix[:dot]
+	}
+	if base == "" || len(base) > 8 {
+		return false
+	}
+	hasDigit := false
+	for _, c := range base {
+		switch {
+		case c >= '0' && c <= '9':
+			hasDigit = true
+		case c >= 'a' && c <= 'z':
+		case c >= 'A' && c <= 'Z':
+		default:
+			return false
+		}
+	}
+	if len(base) > 4 && !hasDigit {
+		return false
+	}
+	return true
+}
+
 func (s *slingTestStore) SetMetadata(id, key, value string) error {
 	if err := s.Store.SetMetadata(id, key, value); err == nil || !errors.Is(err, beads.ErrNotFound) {
 		return err
@@ -503,6 +550,36 @@ func TestShellSlingRunnerOverridesInheritedBDEnv(t *testing.T) {
 	}
 }
 
+func TestShellSlingRunnerStripsInheritedSecrets(t *testing.T) {
+	t.Setenv("GITHUB_TOKEN", "ghs_should_not_leak")
+	t.Setenv("OPENAI_API_KEY", "sk-should-not-leak")
+
+	out, err := shellSlingRunner("", `printf '%s|%s' "${GITHUB_TOKEN:-unset}" "${OPENAI_API_KEY:-unset}"`, nil)
+	if err != nil {
+		t.Fatalf("shellSlingRunner: %v", err)
+	}
+	if got := strings.TrimSpace(out); got != "unset|unset" {
+		t.Fatalf("shellSlingRunner inherited secrets = %q, want unset|unset", got)
+	}
+}
+
+func TestSourceWorkflowCleanupCommandQuotesUntrustedArgs(t *testing.T) {
+	got := sourceWorkflowCleanupCommand("ga-1; touch /tmp/pwn", "rig:demo; rm -rf /")
+	if got == "gc workflow delete-source ga-1; touch /tmp/pwn --store-ref rig:demo; rm -rf / --apply" {
+		t.Fatalf("cleanup command left shell metacharacters unquoted: %q", got)
+	}
+	args := shellquote.Split(got)
+	want := []string{"gc", "workflow", "delete-source", "ga-1; touch /tmp/pwn", "--store-ref", "rig:demo; rm -rf /", "--apply"}
+	if len(args) != len(want) {
+		t.Fatalf("cleanup command args = %#v, want %#v", args, want)
+	}
+	for i := range want {
+		if args[i] != want[i] {
+			t.Fatalf("cleanup command arg[%d] = %q, want %q (command %q)", i, args[i], want[i], got)
+		}
+	}
+}
+
 func TestDoSlingBeadToPool(t *testing.T) {
 	runner := newFakeRunner()
 	sp := runtime.NewFake()
@@ -1021,6 +1098,183 @@ dir = "frontend"
 	return cityDir
 }
 
+// setupRigScopedBdCity writes a city.toml with one rig ("frontend",
+// prefix "FE") and a rig-scoped .beads/config.yaml compatible with the
+// bd provider contract. Returns the city and rig paths. Used by the
+// #200 regression guards for the bd provider.
+func setupRigScopedBdCity(t *testing.T) (cityDir, rigDir string) {
+	t.Helper()
+	cityDir = t.TempDir()
+	rigDir = filepath.Join(cityDir, "frontend")
+	if err := os.MkdirAll(filepath.Join(rigDir, ".beads"), 0o700); err != nil {
+		t.Fatalf("MkdirAll(rig): %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(rigDir, ".beads", "config.yaml"), []byte(`issue_prefix: FE
+gc.endpoint_origin: inherited_city
+gc.endpoint_status: verified
+dolt.auto-start: false
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cityToml := `[workspace]
+name = "demo"
+
+[[rigs]]
+name = "frontend"
+path = "frontend"
+prefix = "FE"
+
+[[agent]]
+name = "worker"
+dir = "frontend"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	return cityDir, rigDir
+}
+
+// bdInvocation records a single bd subprocess call — env snapshot,
+// dir, and argv — so tests can assert on the scope the command ran in.
+type bdInvocation struct {
+	Env  map[string]string
+	Dir  string
+	Args []string
+}
+
+// installCaptureBdRunner swaps beadsExecCommandRunnerWithEnv with a
+// fake that records every bd invocation and returns plausible
+// responses for the subcommands cmdSling's inline-text path actually
+// runs (show, create, update). Unexpected subcommands fail the test
+// loudly so drift in sling's bd usage surfaces instead of silently
+// passing. Returns a pointer to the capture slice; auto-restores via
+// t.Cleanup.
+func installCaptureBdRunner(t *testing.T) *[]bdInvocation {
+	t.Helper()
+	orig := beadsExecCommandRunnerWithEnv
+	t.Cleanup(func() { beadsExecCommandRunnerWithEnv = orig })
+
+	calls := &[]bdInvocation{}
+	beadsExecCommandRunnerWithEnv = func(env map[string]string) beads.CommandRunner {
+		snap := maps.Clone(env)
+		return func(dir, name string, args ...string) ([]byte, error) {
+			*calls = append(*calls, bdInvocation{Env: snap, Dir: dir, Args: append([]string(nil), args...)})
+			if name != "bd" {
+				t.Errorf("unexpected command %q args=%v", name, args)
+				return nil, fmt.Errorf("unexpected command %q", name)
+			}
+			switch {
+			case len(args) >= 2 && args[0] == "create" && args[1] == "--json":
+				title := ""
+				if len(args) > 2 {
+					title = args[2]
+				}
+				return []byte(fmt.Sprintf(`{"id":"FE-abc","title":%q,"status":"open","issue_type":"task","created_at":"2026-04-22T00:00:00Z","assignee":"","from":"","parent":"","ref":"","needs":null,"description":"","labels":null}`, title)), nil
+			case len(args) >= 2 && args[0] == "update" && args[1] == "--json":
+				return []byte(`{}`), nil
+			case len(args) >= 2 && args[0] == "show" && args[1] == "--json":
+				return nil, fmt.Errorf("issue not found")
+			case len(args) >= 2 && args[0] == "list" && args[1] == "--json":
+				return []byte(`[]`), nil
+			default:
+				t.Errorf("unexpected bd subcommand args=%v — fake must be extended if sling now invokes this", args)
+				return nil, fmt.Errorf("unexpected bd subcommand args=%v", args)
+			}
+		}
+	}
+	return calls
+}
+
+// firstBdCreate returns the first `bd create --json` invocation
+// captured by installCaptureBdRunner, or fails the test if none was
+// observed.
+func firstBdCreate(t *testing.T, calls []bdInvocation) bdInvocation {
+	t.Helper()
+	for _, c := range calls {
+		if len(c.Args) >= 2 && c.Args[0] == "create" && c.Args[1] == "--json" {
+			return c
+		}
+	}
+	t.Fatalf("no bd create invocation observed. Captured %d calls: %v", len(calls), calls)
+	return bdInvocation{}
+}
+
+// Regression guard for #200: on 0.13.5 the pre-bdStoreForRig code path
+// hardcoded BEADS_DIR to <cityPath>/.beads for every bd subprocess, so
+// bd create landed the inline bead in the city store and the cross-rig
+// guard blocked routing. Commit 92c6c0d7 introduced bdStoreForRig +
+// bdRuntimeEnvForRig which silently fixed it; this test locks the
+// invariant for the default bd provider so the scoping cannot regress.
+func TestCmdSlingInlineBeadRigScopedBdProvider(t *testing.T) {
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "bd")
+
+	cityDir, rigDir := setupRigScopedBdCity(t)
+	calls := installCaptureBdRunner(t)
+
+	t.Chdir(cityDir)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling([]string{"frontend/worker", "ship feature"}, false, false, true, "", nil, "", true, false, "", false, false, false, "", "", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	create := firstBdCreate(t, *calls)
+	wantBeadsDir := filepath.Join(rigDir, ".beads")
+	if got := create.Env["BEADS_DIR"]; got != wantBeadsDir {
+		t.Fatalf("bd create BEADS_DIR = %q, want %q (rig-scoped); all calls: %v", got, wantBeadsDir, *calls)
+	}
+	if got := create.Env["GC_RIG_ROOT"]; got != rigDir {
+		t.Fatalf("bd create GC_RIG_ROOT = %q, want %q", got, rigDir)
+	}
+	if got := create.Env["GC_RIG"]; got != "frontend" {
+		t.Fatalf("bd create GC_RIG = %q, want %q", got, "frontend")
+	}
+	if got := create.Dir; got != rigDir {
+		t.Fatalf("bd create dir = %q, want %q", got, rigDir)
+	}
+}
+
+// Reporter's exact #200 repro: CWD=rig, bare target resolves to
+// rig-scoped agent via currentRigContext, and the inline bead must
+// still land in the rig store.
+func TestCmdSlingInlineBeadBareTargetFromRigCwdBdProvider(t *testing.T) {
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "bd")
+
+	_, rigDir := setupRigScopedBdCity(t)
+	calls := installCaptureBdRunner(t)
+
+	t.Chdir(rigDir)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling([]string{"worker", "ship feature"}, false, false, true, "", nil, "", true, false, "", false, false, false, "", "", &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stderr: %s", code, stderr.String())
+	}
+
+	create := firstBdCreate(t, *calls)
+	wantBeadsDir := filepath.Join(rigDir, ".beads")
+	if got := create.Env["BEADS_DIR"]; got != wantBeadsDir {
+		t.Fatalf("bd create BEADS_DIR = %q, want %q (rig-scoped). Bare target %q from rig cwd must land in the rig store; all calls: %v",
+			got, wantBeadsDir, "worker", *calls)
+	}
+	// Mirror the env-surface assertions from the qualified-target
+	// variant so a regression that sets BEADS_DIR correctly but drops
+	// GC_RIG/GC_RIG_ROOT via the currentRigContext path still fails
+	// loudly.
+	if got := create.Env["GC_RIG_ROOT"]; got != rigDir {
+		t.Fatalf("bd create GC_RIG_ROOT = %q, want %q", got, rigDir)
+	}
+	if got := create.Env["GC_RIG"]; got != "frontend" {
+		t.Fatalf("bd create GC_RIG = %q, want %q", got, "frontend")
+	}
+	if got := create.Dir; got != rigDir {
+		t.Fatalf("bd create dir = %q, want %q", got, rigDir)
+	}
+}
+
 func TestCmdSlingRefusesMissingBead(t *testing.T) {
 	// A bead-ID-shaped argument that doesn't resolve in the store must
 	// cause sling to error out — otherwise a fabricated / typo'd ID
@@ -1133,8 +1387,75 @@ func TestCmdSlingDryRunPreviewsInlineText(t *testing.T) {
 	}
 }
 
+// TestCmdSlingDryRunInlineTextHasNoFalsePositivePreCheck verifies that
+// inline-text dry-runs print a "Would create new task bead" hint and
+// suppress the Pre-check ✓ line (which would be vacuously true for a
+// bead that does not exist yet).
+func TestCmdSlingDryRunInlineTextHasNoFalsePositivePreCheck(t *testing.T) {
+	cityDir := setupCmdSlingBeadExistsFixture(t)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"frontend/worker", "write docs"},
+		false, false, false,
+		"", nil, "",
+		true, false, "",
+		false, false, true,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling dry-run returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	out := stdout.String()
+	if strings.Contains(out, "has no existing molecule/wisp children ✓") {
+		t.Fatalf("dry-run stdout still emits false-positive Pre-check ✓ for inline text:\n%s", out)
+	}
+	if !strings.Contains(out, "Would create new task bead") {
+		t.Fatalf("dry-run stdout missing inline-text creation hint:\n%s", out)
+	}
+	// Cook/route preview commands must use a placeholder rather than
+	// the inline title: the live path creates a bead first and uses
+	// the new ID, so showing "write docs" as the bead-id arg would
+	// describe a command that wouldn't actually run.
+	if strings.Contains(out, "--on=write docs") || strings.Contains(out, "--on='write docs'") {
+		t.Fatalf("dry-run stdout uses inline title as bead ID in --on=...:\n%s", out)
+	}
+	if !strings.Contains(out, "<new-bead-id>") {
+		t.Fatalf("dry-run stdout missing <new-bead-id> placeholder:\n%s", out)
+	}
+	// Pre-existing footer must still be present.
+	if !strings.Contains(out, "No side effects executed (--dry-run).") {
+		t.Fatalf("dry-run stdout missing dry-run footer:\n%s", out)
+	}
+
+	// Sanity: city/frontend stores must remain empty (no bead created).
+	for _, dir := range []string{cityDir, filepath.Join(cityDir, "frontend")} {
+		store, err := openStoreAtForCity(dir, cityDir)
+		if err != nil {
+			t.Fatalf("openStoreAtForCity(%s): %v", dir, err)
+		}
+		bs, err := store.List(beads.ListQuery{AllowScan: true})
+		if err != nil {
+			t.Fatalf("List(%s): %v", dir, err)
+		}
+		if len(bs) != 0 {
+			t.Fatalf("store %s has %d beads after dry-run, want 0: %#v", dir, len(bs), bs)
+		}
+	}
+}
+
+func mustResolveInlineBeadAction(t *testing.T, cfg *config.City, beadOrFormula string, dryRun bool, store beads.Store) (bool, bool) {
+	t.Helper()
+	create, inlineText, err := resolveInlineBeadAction(cfg, beadOrFormula, dryRun, store)
+	if err != nil {
+		t.Fatalf("resolveInlineBeadAction: %v", err)
+	}
+	return create, inlineText
+}
+
 func TestResolveInlineBeadActionDryRunInlineTextDoesNotProbeStore(t *testing.T) {
-	create, inlineText := resolveInlineBeadAction(&config.City{}, "write docs", true)
+	create, inlineText := mustResolveInlineBeadAction(t, &config.City{}, "write docs", true, nil)
 	if create {
 		t.Fatal("create = true, want false during dry-run")
 	}
@@ -1144,7 +1465,7 @@ func TestResolveInlineBeadActionDryRunInlineTextDoesNotProbeStore(t *testing.T)
 }
 
 func TestResolveInlineBeadActionWhitespaceInlineTextDoesNotProbeStore(t *testing.T) {
-	create, inlineText := resolveInlineBeadAction(&config.City{}, "write docs", false)
+	create, inlineText := mustResolveInlineBeadAction(t, &config.City{}, "write docs", false, nil)
 	if !create {
 		t.Fatal("create = false, want true for whitespace inline text")
 	}
@@ -1154,7 +1475,7 @@ func TestResolveInlineBeadActionWhitespaceInlineTextDoesNotProbeStore(t *testing
 }
 
 func TestResolveInlineBeadActionSingleTokenInlineTextDoesNotProbeStore(t *testing.T) {
-	create, inlineText := resolveInlineBeadAction(&config.City{}, "docs", false)
+	create, inlineText := mustResolveInlineBeadAction(t, &config.City{}, "docs", false, nil)
 	if !create {
 		t.Fatal("create = false, want true for single-token inline text")
 	}
@@ -1164,7 +1485,7 @@ func TestResolveInlineBeadActionSingleTokenInlineTextDoesNotProbeStore(t *testin
 }
 
 func TestResolveInlineBeadActionBeadIDDoesNotProbeStore(t *testing.T) {
-	create, inlineText := resolveInlineBeadAction(&config.City{}, "FE-123", false)
+	create, inlineText := mustResolveInlineBeadAction(t, &config.City{}, "FE-123", false, nil)
 	if create {
 		t.Fatal("create = true, want false for bead ID")
 	}
@@ -1173,13 +1494,56 @@ func TestResolveInlineBeadActionBeadIDDoesNotProbeStore(t *testing.T) {
 	}
 }
 
+func TestResolveInlineBeadActionHyphenatedRigPrefixIsBeadID(t *testing.T) {
+	// Bead IDs whose configured rig prefix contains a hyphen
+	// (agent-diagnostics-hnn from rig "agent-diagnostics") must
+	// classify as bead IDs, not inline text.
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent-diagnostics", Path: "/tmp/agent-diag", Prefix: "agent-diagnostics"},
+		},
+	}
+
+	create, inlineText := mustResolveInlineBeadAction(t, cfg, "agent-diagnostics-hnn", false, nil)
+	if create {
+		t.Fatal("create = true, want false for configured hyphenated bead ID")
+	}
+	if inlineText {
+		t.Fatal("inlineText = true, want false outside dry-run")
+	}
+
+	create, inlineText = mustResolveInlineBeadAction(t, cfg, "agent-diagnostics-hnn", true, nil)
+	if create {
+		t.Fatal("create = true, want false during dry-run")
+	}
+	if inlineText {
+		t.Fatal("inlineText = true, want false for configured bead ID even in dry-run")
+	}
+}
+
+func TestResolveInlineBeadActionUnknownHyphenatedTextStillCreates(t *testing.T) {
+	// Inline text shaped like "<unknown-prefix>-<word>" with no store must
+	// still create an inline task bead. Only inputs that match a CONFIGURED
+	// rig prefix are protected from the auto-create branch (without a store).
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fe", Path: "/fe", Prefix: "fe"}},
+	}
+	create, inlineText := mustResolveInlineBeadAction(t, cfg, "code-review-please", false, nil)
+	if !create {
+		t.Fatal("create = false, want true for non-configured hyphenated text")
+	}
+	if inlineText {
+		t.Fatal("inlineText = true, want false outside dry-run")
+	}
+}
+
 func TestResolveInlineBeadActionConfiguredAlphaSuffixIsBeadID(t *testing.T) {
 	cfg := &config.City{
 		Workspace: config.Workspace{Name: "test", Prefix: "HQ"},
 		Rigs:      []config.Rig{{Name: "frontend", Path: "/tmp/frontend", Prefix: "FE"}},
 	}
 
-	create, inlineText := resolveInlineBeadAction(cfg, "FE-hello", false)
+	create, inlineText := mustResolveInlineBeadAction(t, cfg, "FE-hello", false, nil)
 	if create {
 		t.Fatal("create = true, want false for configured bead ID with all-alpha suffix")
 	}
@@ -1187,7 +1551,7 @@ func TestResolveInlineBeadActionConfiguredAlphaSuffixIsBeadID(t *testing.T) {
 		t.Fatal("inlineText = true, want false outside dry-run")
 	}
 
-	create, inlineText = resolveInlineBeadAction(cfg, "FE-a1pha", false)
+	create, inlineText = mustResolveInlineBeadAction(t, cfg, "FE-a1pha", false, nil)
 	if create {
 		t.Fatal("create = true, want false for configured bead ID with digit")
 	}
@@ -1196,11 +1560,73 @@ func TestResolveInlineBeadActionConfiguredAlphaSuffixIsBeadID(t *testing.T) {
 	}
 }
 
+func TestResolveInlineBeadActionMultiDashStoreHitIsBeadID(t *testing.T) {
+	// A multi-dash ID that fails the suffix heuristic but exists in the store
+	// must classify as a bead ID, not inline text.
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fo", Path: "/tmp/fo", Prefix: "fo"}},
+	}
+	store := seededStore("fo-spawn-storm")
+
+	create, inlineText := mustResolveInlineBeadAction(t, cfg, "fo-spawn-storm", false, store)
+	if create {
+		t.Fatal("create = true, want false — bead exists in store")
+	}
+	if inlineText {
+		t.Fatal("inlineText = true, want false outside dry-run")
+	}
+
+	create, inlineText = mustResolveInlineBeadAction(t, cfg, "fo-spawn-storm", true, store)
+	if create {
+		t.Fatal("create = true, want false during dry-run")
+	}
+	if inlineText {
+		t.Fatal("inlineText = true, want false — bead exists in store")
+	}
+}
+
+func TestResolveInlineBeadActionMultiDashStoreMissStillCreates(t *testing.T) {
+	// A multi-dash ID absent from the store falls through to inline-text
+	// creation — the caller will auto-create a bead from the text.
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fo", Path: "/tmp/fo", Prefix: "fo"}},
+	}
+	store := seededStore() // empty
+
+	create, inlineText := mustResolveInlineBeadAction(t, cfg, "fo-typo-not-real", false, store)
+	if !create {
+		t.Fatal("create = false, want true for unknown multi-dash text")
+	}
+	if inlineText {
+		t.Fatal("inlineText = true, want false outside dry-run")
+	}
+}
+
+func TestResolveInlineBeadActionMultiDashStoreErrorSurfaces(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fo", Path: "/tmp/fo", Prefix: "fo"}},
+	}
+	store := &getErrStore{Store: beads.NewMemStore(), err: fmt.Errorf("lookup failed")}
+
+	_, _, err := resolveInlineBeadAction(cfg, "fo-spawn-storm", false, store)
+	if err == nil {
+		t.Fatal("resolveInlineBeadAction error = nil, want lookup failure")
+	}
+	if !strings.Contains(err.Error(), "lookup failed") {
+		t.Fatalf("resolveInlineBeadAction error = %q, want lookup failure", err)
+	}
+}
+
 func TestCmdSlingConfiguredPrefixAllAlphaExistingBeadUsesPrefixStore(t *testing.T) {
 	configureIsolatedRuntimeEnv(t)
 	t.Setenv("GC_BEADS", "file")
 
 	cityDir := t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
 	frontendDir := filepath.Join(cityDir, "frontend")
 	ordersDir := filepath.Join(cityDir, "orders")
 	for _, dir := range []string{frontendDir, ordersDir} {
@@ -1287,6 +1713,203 @@ dir = "orders"
 	}
 }
 
+// TestCmdSlingHyphenatedRigPrefixExistingBeadDoesNotOrphan verifies
+// that an existing bead in a rig whose configured prefix contains a
+// hyphen ("agent-diagnostics-hnn" in rig "agent-diagnostics") routes
+// to the rig store without auto-creating a city orphan.
+func TestCmdSlingHyphenatedRigPrefixExistingBeadDoesNotOrphan(t *testing.T) {
+	beadID := "agent-diagnostics-hnn"
+	cityDir, rigDir, _ := setupCmdSlingHyphenatedRigPrefixBeadFixture(t, beadID, "agent-diagnostics")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"agent-diagnostics/worker", beadID},
+		false, false, true,
+		"", nil, "",
+		true, false, "",
+		true, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	// The pre-fix bug printed a "Created gc-NNN — \"agent-diagnostics-hnn\""
+	// line because the live path took the auto-create-text-bead branch.
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("orphan auto-create regression: stdout = %q", stdout.String())
+	}
+
+	assertHyphenatedRigBeadRoutedWithoutInlineOrphan(t, cityDir, rigDir, beadID, "agent-diagnostics/worker")
+}
+
+func TestCmdSlingHyphenatedRigPrefixMultiDashExistingBeadDoesNotOrphan(t *testing.T) {
+	beadID := "agent-diagnostics-spawn-storm"
+	cityDir, rigDir, _ := setupCmdSlingHyphenatedRigPrefixBeadFixture(t, beadID, "agent-diagnostics")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"agent-diagnostics/worker", beadID},
+		false, false, true,
+		"", nil, "",
+		true, false, "",
+		true, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("orphan auto-create regression: stdout = %q", stdout.String())
+	}
+
+	assertHyphenatedRigBeadRoutedWithoutInlineOrphan(t, cityDir, rigDir, beadID, "agent-diagnostics/worker")
+}
+
+func TestCmdSlingOneArgHyphenatedPrefixMultiDashExistingBeadUsesDefaultTarget(t *testing.T) {
+	beadID := "agent-diagnostics-spawn-storm"
+	cityDir, rigDir, _ := setupCmdSlingHyphenatedRigPrefixBeadFixture(t, beadID, "agent-diagnostics")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{beadID},
+		false, false, false,
+		"", nil, "",
+		true, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("orphan auto-create regression: stdout = %q", stdout.String())
+	}
+
+	assertHyphenatedRigBeadRoutedWithoutInlineOrphan(t, cityDir, rigDir, beadID, "agent-diagnostics/worker")
+}
+
+func TestCmdSlingCrossRigHyphenatedPrefixMultiDashExistingBeadUsesPrefixStore(t *testing.T) {
+	beadID := "agent-diagnostics-spawn-storm"
+	cityDir, rigDir, otherDir := setupCmdSlingHyphenatedRigPrefixBeadFixture(t, beadID, "other")
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"other/worker", beadID},
+		false, false, true,
+		"", nil, "",
+		true, false, "",
+		true, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("stdout = %q, want existing bead route without inline creation", stdout.String())
+	}
+
+	assertHyphenatedRigBeadRoutedWithoutInlineOrphan(t, cityDir, rigDir, beadID, "other/worker")
+	assertStoreHasNoBeadTitle(t, cityDir, otherDir, beadID)
+}
+
+func setupCmdSlingHyphenatedRigPrefixBeadFixture(t *testing.T, beadID, agentDir string) (cityDir, rigDir, otherDir string) {
+	t.Helper()
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir = t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	rigDir = filepath.Join(cityDir, "agent-diagnostics")
+	otherDir = filepath.Join(cityDir, "other")
+	for _, dir := range []string{rigDir, otherDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatalf("MkdirAll(%s): %v", dir, err)
+		}
+	}
+	if err := ensureScopedFileStoreLayout(cityDir); err != nil {
+		t.Fatalf("ensureScopedFileStoreLayout: %v", err)
+	}
+	for _, dir := range []string{cityDir, rigDir, otherDir} {
+		if err := ensurePersistedScopeLocalFileStore(dir); err != nil {
+			t.Fatalf("ensurePersistedScopeLocalFileStore(%s): %v", dir, err)
+		}
+	}
+	writeTestFileStoreBeads(t, rigDir, []beads.Bead{{
+		ID:       beadID,
+		Title:    "existing diagnostics work",
+		Type:     "task",
+		Status:   "open",
+		Metadata: map[string]string{},
+	}})
+	cityToml := fmt.Sprintf(`[workspace]
+name = "demo"
+
+[[rigs]]
+name = "agent-diagnostics"
+path = "agent-diagnostics"
+prefix = "agent-diagnostics"
+default_sling_target = "agent-diagnostics/worker"
+
+[[rigs]]
+name = "other"
+path = "other"
+prefix = "OT"
+
+[[agent]]
+name = "worker"
+dir = %q
+`, agentDir)
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Chdir(cityDir)
+	return cityDir, rigDir, otherDir
+}
+
+func assertHyphenatedRigBeadRoutedWithoutInlineOrphan(t *testing.T, cityDir, rigDir, beadID, wantTarget string) {
+	t.Helper()
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	routed, err := rigStore.Get(beadID)
+	if err != nil {
+		t.Fatalf("rigStore.Get(%s): %v", beadID, err)
+	}
+	if routed.Metadata["gc.routed_to"] != wantTarget {
+		t.Fatalf("rig bead gc.routed_to = %q, want %s (routing must land on the existing bead, not an orphan)", routed.Metadata["gc.routed_to"], wantTarget)
+	}
+
+	// City store must NOT contain a stray bead from the auto-create path.
+	assertStoreHasNoBeadTitle(t, cityDir, cityDir, beadID)
+}
+
+func assertStoreHasNoBeadTitle(t *testing.T, cityDir, storeDir, beadTitle string) {
+	t.Helper()
+	store, err := openStoreAtForCity(storeDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(%s): %v", storeDir, err)
+	}
+	storeBeads, err := store.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("store.List(%s): %v", storeDir, err)
+	}
+	for _, b := range storeBeads {
+		if b.Title == beadTitle {
+			t.Fatalf("store %s has orphan bead %q (title %q): inline-text auto-create fired for a known-rig bead ID", storeDir, b.ID, b.Title)
+		}
+	}
+}
+
 func TestCmdSlingConfiguredPrefixAllAlphaExistingBeadUsesSelectedPrefixStore(t *testing.T) {
 	cityDir, frontendDir := setupCmdSlingConfiguredPrefixAllAlphaFrontendFixture(t, false, true)
 
@@ -1366,6 +1989,11 @@ func setupCmdSlingConfiguredPrefixAllAlphaFrontendFixture(t *testing.T, defaultT
 	t.Setenv("GC_BEADS", "file")
 
 	cityDir = t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
 	frontendDir = filepath.Join(cityDir, "frontend")
 	if err := os.MkdirAll(frontendDir, 0o755); err != nil {
 		t.Fatalf("MkdirAll(frontend): %v", err)
@@ -1425,34 +2053,295 @@ func writeTestFileStoreBeads(t *testing.T, scopeRoot string, stored []beads.Bead
 	}
 }
 
-func TestCmdSlingForceBypassesMissingBeadCheck(t *testing.T) {
-	// --force must bypass the bead-existence check. The call may still
-	// fail further downstream (we don't assert a success exit here), but
-	// stderr must not contain the "not found" guard message.
-	setupCmdSlingBeadExistsFixture(t)
+func TestCmdSlingForceBypassesMissingBeadCheck(t *testing.T) {
+	// --force must bypass the bead-existence check. The call may still
+	// fail further downstream (we don't assert a success exit here), but
+	// stderr must not contain the "not found" guard message.
+	setupCmdSlingBeadExistsFixture(t)
+
+	var stdout, stderr bytes.Buffer
+	_ = cmdSling(
+		[]string{"frontend/worker", "FE-ghost1"},
+		false, false, true, // force=true
+		"", nil, "",
+		true, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	got := stderr.String()
+	if strings.Contains(got, "not found in store") {
+		t.Errorf("--force did not bypass bead-existence check; stderr: %s", got)
+	}
+}
+
+func TestCmdSlingForceMissingBeadPrintsAutoConvoyWarning(t *testing.T) {
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "frontend")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(rig): %v", err)
+	}
+	if err := ensureScopedFileStoreLayout(cityDir); err != nil {
+		t.Fatalf("ensureScopedFileStoreLayout: %v", err)
+	}
+	for _, dir := range []string{cityDir, rigDir} {
+		if err := ensurePersistedScopeLocalFileStore(dir); err != nil {
+			t.Fatalf("ensurePersistedScopeLocalFileStore(%s): %v", dir, err)
+		}
+	}
+	cityToml := `[workspace]
+name = "demo"
+
+[[rigs]]
+name = "frontend"
+path = "frontend"
+prefix = "FE"
+
+[[agent]]
+name = "worker"
+dir = "frontend"
+sling_query = "true"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	t.Chdir(cityDir)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"frontend/worker", "FE-ghost1"},
+		false, false, true,
+		"", nil, "",
+		false, false, "",
+		true, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "forced dispatch skipped missing-bead validation") {
+		t.Fatalf("stderr = %q, want forced missing-bead auto-convoy warning", stderr.String())
+	}
+}
+
+func TestCmdSlingAcceptsExistingBead(t *testing.T) {
+	// When a bead-ID-shaped argument IS present in the store, the new
+	// existence check must not fire. This test only asserts the check
+	// does not trip — it doesn't assert sling completes successfully,
+	// since downstream routing has its own gates (cross-rig, etc.)
+	// that are out of scope for this change.
+	cityDir := setupCmdSlingBeadExistsFixture(t)
+	rigDir := filepath.Join(cityDir, "frontend")
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	seeded, err := rigStore.Create(beads.Bead{Title: "real work", Type: "task"})
+	if err != nil {
+		t.Fatalf("seeding bead: %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	_ = cmdSling(
+		[]string{"frontend/worker", seeded.ID},
+		false, false, false, // force=false; existence check should pass naturally
+		"", nil, "",
+		true, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if strings.Contains(stderr.String(), "not found in store") {
+		t.Errorf("existence check incorrectly tripped on a real bead; stderr: %s", stderr.String())
+	}
+}
+
+func TestCmdSlingMultiDashBeadIDRoutesExistingBead(t *testing.T) {
+	// gc sling target fo-spawn-storm must route the existing bead and must
+	// not create a new inline bead, when "fo-spawn-storm" exists in the store.
+	cityDir, rigDir := setupCmdSlingMultiDashBeadFixture(t, true)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"foundations/worker", "fo-spawn-storm"},
+		false, false, false,
+		"", nil, "",
+		true, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Errorf("created new inline bead instead of routing existing one; stdout=%s stderr=%s", stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "found existing bead") {
+		t.Errorf("stderr = %q, want existing-bead routing breadcrumb", stderr.String())
+	}
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	routed, err := rigStore.Get("fo-spawn-storm")
+	if err != nil {
+		t.Fatalf("rigStore.Get(fo-spawn-storm): %v", err)
+	}
+	if routed.Metadata["gc.routed_to"] != "foundations/worker" {
+		t.Fatalf("rig bead gc.routed_to = %q, want foundations/worker", routed.Metadata["gc.routed_to"])
+	}
+	all, err := rigStore.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("rigStore.List: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("rig store bead count = %d, want 1: %#v", len(all), all)
+	}
+}
+
+func TestCmdSlingOneArgMultiDashExistingBeadUsesDefaultTarget(t *testing.T) {
+	cityDir, rigDir := setupCmdSlingMultiDashBeadFixture(t, true)
+
+	var stdout, stderr bytes.Buffer
+	code := cmdSling(
+		[]string{"fo-spawn-storm"},
+		false, false, false,
+		"", nil, "",
+		true, false, "",
+		false, false, false,
+		"", "",
+		&stdout, &stderr,
+	)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("stdout = %q, want existing bead route without inline creation", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "found existing bead") {
+		t.Errorf("stderr = %q, want existing-bead routing breadcrumb", stderr.String())
+	}
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	routed, err := rigStore.Get("fo-spawn-storm")
+	if err != nil {
+		t.Fatalf("rigStore.Get(fo-spawn-storm): %v", err)
+	}
+	if routed.Metadata["gc.routed_to"] != "foundations/worker" {
+		t.Fatalf("rig bead gc.routed_to = %q, want foundations/worker", routed.Metadata["gc.routed_to"])
+	}
+	all, err := rigStore.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("rigStore.List: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("rig store bead count = %d, want 1: %#v", len(all), all)
+	}
+}
+
+func TestCmdSlingCrossRigMultiDashExistingBeadUsesPrefixStore(t *testing.T) {
+	cityDir, rigDir := setupCmdSlingMultiDashBeadFixture(t, false)
+	ordersDir := filepath.Join(cityDir, "orders")
+	if err := os.MkdirAll(ordersDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(orders): %v", err)
+	}
+	if err := ensurePersistedScopeLocalFileStore(ordersDir); err != nil {
+		t.Fatalf("ensurePersistedScopeLocalFileStore(orders): %v", err)
+	}
+	cityToml := `[workspace]
+name = "demo"
+
+[[rigs]]
+name = "foundations"
+path = "foundations"
+prefix = "fo"
+
+[[rigs]]
+name = "orders"
+path = "orders"
+prefix = "od"
+
+[[agent]]
+name = "worker"
+dir = "orders"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
 
 	var stdout, stderr bytes.Buffer
-	_ = cmdSling(
-		[]string{"frontend/worker", "FE-ghost1"},
-		false, false, true, // force=true
+	code := cmdSling(
+		[]string{"orders/worker", "fo-spawn-storm"},
+		false, false, true,
 		"", nil, "",
 		true, false, "",
-		false, false, false,
+		true, false, false,
 		"", "",
 		&stdout, &stderr,
 	)
-	got := stderr.String()
-	if strings.Contains(got, "not found in store") {
-		t.Errorf("--force did not bypass bead-existence check; stderr: %s", got)
+	if code != 0 {
+		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("stdout = %q, want existing bead route without inline creation", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "found existing bead") {
+		t.Errorf("stderr = %q, want existing-bead routing breadcrumb", stderr.String())
+	}
+
+	rigStore, err := openStoreAtForCity(rigDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(rig): %v", err)
+	}
+	routed, err := rigStore.Get("fo-spawn-storm")
+	if err != nil {
+		t.Fatalf("rigStore.Get(fo-spawn-storm): %v", err)
+	}
+	if routed.Metadata["gc.routed_to"] != "orders/worker" {
+		t.Fatalf("rig bead gc.routed_to = %q, want orders/worker", routed.Metadata["gc.routed_to"])
+	}
+	all, err := rigStore.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("rigStore.List: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("rig store bead count = %d, want 1: %#v", len(all), all)
+	}
+
+	ordersStore, err := openStoreAtForCity(ordersDir, cityDir)
+	if err != nil {
+		t.Fatalf("openStoreAtForCity(orders): %v", err)
+	}
+	ordersBeads, err := ordersStore.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("ordersStore.List: %v", err)
+	}
+	if len(ordersBeads) != 0 {
+		t.Fatalf("orders store bead count = %d, want 0: %#v", len(ordersBeads), ordersBeads)
 	}
 }
 
-func TestCmdSlingForceMissingBeadPrintsAutoConvoyWarning(t *testing.T) {
+func TestCmdSlingUnderscoredPrefixMultiDashExistingBeadUsesPrefixStore(t *testing.T) {
 	configureIsolatedRuntimeEnv(t)
 	t.Setenv("GC_BEADS", "file")
 
 	cityDir := t.TempDir()
-	rigDir := filepath.Join(cityDir, "frontend")
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	rigDir := filepath.Join(cityDir, "live-docs")
 	if err := os.MkdirAll(rigDir, 0o755); err != nil {
 		t.Fatalf("MkdirAll(rig): %v", err)
 	}
@@ -1464,18 +2353,25 @@ func TestCmdSlingForceMissingBeadPrintsAutoConvoyWarning(t *testing.T) {
 			t.Fatalf("ensurePersistedScopeLocalFileStore(%s): %v", dir, err)
 		}
 	}
+	const beadID = "live_docs-spawn-storm"
+	writeTestFileStoreBeads(t, rigDir, []beads.Bead{{
+		ID:       beadID,
+		Title:    "spawn storm bead",
+		Type:     "task",
+		Status:   "open",
+		Metadata: map[string]string{},
+	}})
 	cityToml := `[workspace]
 name = "demo"
 
 [[rigs]]
-name = "frontend"
-path = "frontend"
-prefix = "FE"
+name = "live_docs"
+path = "live-docs"
+prefix = "live_docs"
 
 [[agent]]
 name = "worker"
-dir = "frontend"
-sling_query = "true"
+dir = "live_docs"
 `
 	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
 		t.Fatalf("WriteFile(city.toml): %v", err)
@@ -1484,53 +2380,88 @@ sling_query = "true"
 
 	var stdout, stderr bytes.Buffer
 	code := cmdSling(
-		[]string{"frontend/worker", "FE-ghost1"},
-		false, false, true,
+		[]string{"live_docs/worker", beadID},
+		false, false, false,
 		"", nil, "",
-		false, false, "",
-		true, false, false,
+		true, false, "",
+		false, false, false,
 		"", "",
 		&stdout, &stderr,
 	)
 	if code != 0 {
 		t.Fatalf("cmdSling returned %d, want 0; stdout=%s stderr=%s", code, stdout.String(), stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "forced dispatch skipped missing-bead validation") {
-		t.Fatalf("stderr = %q, want forced missing-bead auto-convoy warning", stderr.String())
+	if strings.Contains(stdout.String(), "Created ") {
+		t.Fatalf("stdout = %q, want existing bead route without inline creation", stdout.String())
 	}
-}
-
-func TestCmdSlingAcceptsExistingBead(t *testing.T) {
-	// When a bead-ID-shaped argument IS present in the store, the new
-	// existence check must not fire. This test only asserts the check
-	// does not trip — it doesn't assert sling completes successfully,
-	// since downstream routing has its own gates (cross-rig, etc.)
-	// that are out of scope for this change.
-	cityDir := setupCmdSlingBeadExistsFixture(t)
-	rigDir := filepath.Join(cityDir, "frontend")
 
 	rigStore, err := openStoreAtForCity(rigDir, cityDir)
 	if err != nil {
 		t.Fatalf("openStoreAtForCity(rig): %v", err)
 	}
-	seeded, err := rigStore.Create(beads.Bead{Title: "real work", Type: "task"})
+	routed, err := rigStore.Get(beadID)
 	if err != nil {
-		t.Fatalf("seeding bead: %v", err)
+		t.Fatalf("rigStore.Get(%s): %v", beadID, err)
+	}
+	if routed.Metadata["gc.routed_to"] != "live_docs/worker" {
+		t.Fatalf("rig bead gc.routed_to = %q, want live_docs/worker", routed.Metadata["gc.routed_to"])
 	}
 
-	var stdout, stderr bytes.Buffer
-	_ = cmdSling(
-		[]string{"frontend/worker", seeded.ID},
-		false, false, false, // force=false; existence check should pass naturally
-		"", nil, "",
-		true, false, "",
-		false, false, false,
-		"", "",
-		&stdout, &stderr,
-	)
-	if strings.Contains(stderr.String(), "not found in store") {
-		t.Errorf("existence check incorrectly tripped on a real bead; stderr: %s", stderr.String())
+	assertStoreHasNoBeadTitle(t, cityDir, cityDir, beadID)
+}
+
+func setupCmdSlingMultiDashBeadFixture(t *testing.T, defaultTarget bool) (cityDir, rigDir string) {
+	t.Helper()
+	configureIsolatedRuntimeEnv(t)
+	t.Setenv("GC_BEADS", "file")
+
+	cityDir = t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	rigDir = filepath.Join(cityDir, "foundations")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(rig): %v", err)
+	}
+	if err := ensureScopedFileStoreLayout(cityDir); err != nil {
+		t.Fatalf("ensureScopedFileStoreLayout: %v", err)
+	}
+	for _, dir := range []string{cityDir, rigDir} {
+		if err := ensurePersistedScopeLocalFileStore(dir); err != nil {
+			t.Fatalf("ensurePersistedScopeLocalFileStore(%s): %v", dir, err)
+		}
+	}
+	writeTestFileStoreBeads(t, rigDir, []beads.Bead{{
+		ID:       "fo-spawn-storm",
+		Title:    "spawn storm bead",
+		Type:     "task",
+		Status:   "open",
+		Metadata: map[string]string{},
+	}})
+	defaultTargetLine := ""
+	if defaultTarget {
+		defaultTargetLine = "default_sling_target = \"foundations/worker\"\n"
+	}
+	cityToml := `[workspace]
+name = "demo"
+
+[[rigs]]
+name = "foundations"
+path = "foundations"
+prefix = "fo"
+` + defaultTargetLine + `
+
+[[agent]]
+name = "worker"
+dir = "foundations"
+`
+	if err := os.WriteFile(filepath.Join(cityDir, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
 	}
+	t.Chdir(cityDir)
+	return cityDir, rigDir
 }
 
 func TestCmdSlingRefusesMissingConfiguredFallbackBeadID(t *testing.T) {
@@ -1538,6 +2469,11 @@ func TestCmdSlingRefusesMissingConfiguredFallbackBeadID(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 
 	cityDir := t.TempDir()
+	t.Setenv("GC_CITY", cityDir)
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
 	rigDir := filepath.Join(cityDir, "orders")
 	if err := os.MkdirAll(rigDir, 0o755); err != nil {
 		t.Fatalf("MkdirAll(rig): %v", err)
@@ -2376,6 +3312,113 @@ func TestOnFormulaAttachesAndRoutes(t *testing.T) {
 	}
 }
 
+func TestOnRootOnlyFormulaKeepsAttachedWispPrivate(t *testing.T) {
+	runner := newFakeRunner()
+	sp := runtime.NewFake()
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "root-only.formula.toml"), []byte(`
+formula = "root-only"
+description = "Private attached root"
+version = 1
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace:     config.Workspace{Name: "test-city"},
+		FormulaLayers: config.FormulaLayers{City: []string{dir}},
+	}
+	a := config.Agent{Name: "mayor", MaxActiveSessions: intPtr(1)}
+
+	deps, stdout, stderr := testDeps(cfg, sp, runner.run)
+	deps.Store = beads.NewMemStoreFrom(1, []beads.Bead{
+		{ID: "BL-42", Title: "Work", Type: "task", Status: "open"},
+	}, nil)
+	opts := testOpts(a, "BL-42")
+	opts.OnFormula = "root-only"
+	code := doSling(opts, deps, deps.Store, stdout, stderr)
+
+	if code != 0 {
+		t.Fatalf("doSling returned %d, want 0; stderr: %s", code, stderr.String())
+	}
+	source, err := deps.Store.Get("BL-42")
+	if err != nil {
+		t.Fatalf("store.Get(BL-42): %v", err)
+	}
+	if source.Metadata["gc.routed_to"] != "mayor" {
+		t.Errorf("source gc.routed_to = %q, want mayor", source.Metadata["gc.routed_to"])
+	}
+	rootID := source.Metadata["molecule_id"]
+	if rootID == "" {
+		t.Fatal("source bead missing molecule_id")
+	}
+	root, err := deps.Store.Get(rootID)
+	if err != nil {
+		t.Fatalf("store.Get(%s): %v", rootID, err)
+	}
+	if root.Type != "molecule" {
+		t.Fatalf("attached root type = %q, want molecule", root.Type)
+	}
+	if root.Metadata["gc.kind"] == "wisp" {
+		t.Fatalf("attached root leaked gc.kind=wisp metadata: %+v", root.Metadata)
+	}
+	ready, err := deps.Store.Ready()
+	if err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	for _, bead := range ready {
+		if bead.ID == rootID {
+			t.Fatalf("attached wisp root %s appeared in Ready(): %+v", rootID, ready)
+		}
+	}
+}
+
+func TestFormulaRootOnlyRoutesRunnableWispRoot(t *testing.T) {
+	runner := newFakeRunner()
+	sp := runtime.NewFake()
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "root-only.formula.toml"), []byte(`
+formula = "root-only"
+description = "Standalone root"
+version = 1
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Workspace:     config.Workspace{Name: "test-city"},
+		FormulaLayers: config.FormulaLayers{City: []string{dir}},
+	}
+	a := config.Agent{Name: "mayor", MaxActiveSessions: intPtr(1)}
+
+	deps, stdout, stderr := testDeps(cfg, sp, runner.run)
+	opts := testOpts(a, "root-only")
+	opts.IsFormula = true
+	code := doSling(opts, deps, deps.Store, stdout, stderr)
+
+	if code != 0 {
+		t.Fatalf("doSling returned %d, want 0; stderr: %s", code, stderr.String())
+	}
+	root, err := deps.Store.Get("gc-1")
+	if err != nil {
+		t.Fatalf("store.Get(gc-1): %v", err)
+	}
+	if root.Type != "task" {
+		t.Fatalf("root type = %q, want task", root.Type)
+	}
+	if root.Metadata["gc.kind"] != "wisp" {
+		t.Fatalf("root gc.kind = %q, want wisp", root.Metadata["gc.kind"])
+	}
+	if root.Metadata["gc.routed_to"] != "mayor" {
+		t.Fatalf("root gc.routed_to = %q, want mayor", root.Metadata["gc.routed_to"])
+	}
+	ready, err := deps.Store.Ready()
+	if err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	if len(ready) != 1 || ready[0].ID != root.ID {
+		t.Fatalf("Ready() = %+v, want only routed root %s", ready, root.ID)
+	}
+}
+
 func TestOnFormulaCopiesSourcePriorityToCreatedBeads(t *testing.T) {
 	runner := newFakeRunner()
 	sp := runtime.NewFake()
@@ -2548,8 +3591,8 @@ title = "Do work"
 			if bead.Assignee != config.ControlDispatcherAgentName {
 				t.Fatalf("workflow-finalize assignee = %q, want %q", bead.Assignee, config.ControlDispatcherAgentName)
 			}
-			if bead.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-				t.Fatalf("workflow-finalize gc.routed_to = %q, want %q", bead.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+			if got := bead.Metadata["gc.routed_to"]; got != "" {
+				t.Fatalf("workflow-finalize gc.routed_to = %q, want empty direct dispatcher assignee", got)
 			}
 			if bead.Metadata[graphExecutionRouteMetaKey] != "mayor" {
 				t.Fatalf("workflow-finalize execution route = %q, want mayor", bead.Metadata[graphExecutionRouteMetaKey])
@@ -2871,6 +3914,33 @@ func TestResolveSlingStoreRootUsesPrefixRigForConfiguredAllAlphaBeadID(t *testin
 	}
 }
 
+func TestResolveSlingStoreRootHonorsHyphenatedRigPrefix(t *testing.T) {
+	// A rig whose configured prefix itself contains a hyphen must
+	// receive its own beads — the longest configured prefix wins
+	// over a shorter prefix that also matches the bead-ID head.
+	cityPath := filepath.Join(t.TempDir(), "city")
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent", Path: filepath.Join("rigs", "agent"), Prefix: "agent"},
+			{Name: "agent-diagnostics", Path: filepath.Join("rigs", "agent-diag"), Prefix: "agent-diagnostics"},
+		},
+	}
+
+	got := resolveSlingStoreRoot(cfg, cityPath, "agent-diagnostics-hnn", config.Agent{Dir: "agent"})
+	want := filepath.Join(cityPath, "rigs", "agent-diag")
+	if got != want {
+		t.Fatalf("resolveSlingStoreRoot(agent-diagnostics-hnn) = %q, want %q (longest configured prefix should win)", got, want)
+	}
+
+	// Sanity check: a bead under the shorter "agent" prefix still resolves
+	// to that rig.
+	got = resolveSlingStoreRoot(cfg, cityPath, "agent-x1", config.Agent{Dir: "agent-diagnostics"})
+	want = filepath.Join(cityPath, "rigs", "agent")
+	if got != want {
+		t.Fatalf("resolveSlingStoreRoot(agent-x1) = %q, want %q", got, want)
+	}
+}
+
 func TestResolveSlingStoreRootUsesCityRootForHQPrefix(t *testing.T) {
 	cityPath := filepath.Join(t.TempDir(), "city")
 	cfg := &config.City{
@@ -5658,6 +6728,68 @@ func TestBuildSlingFormulaVarsPreservesExplicitValues(t *testing.T) {
 	}
 }
 
+func TestBuildSlingFormulaVarsSeedsRoutingNamespace(t *testing.T) {
+	cfg := &config.City{Workspace: config.Workspace{Name: "test-city"}}
+	deps, _, _ := testDeps(cfg, runtime.NewFake(), newFakeRunner().run)
+
+	vars := buildSlingFormulaVars("mol-polecat-work", "HW-42", nil, config.Agent{
+		Name:        "polecat",
+		Dir:         "hw",
+		BindingName: "gastown",
+	}, deps)
+
+	if got, ok := findVarValue(vars, "rig_name"); !ok || got != "hw" {
+		t.Fatalf("rig_name var = %q, %v; want hw, true", got, ok)
+	}
+	if got, ok := findVarValue(vars, "binding_name"); !ok || got != "gastown" {
+		t.Fatalf("binding_name var = %q, %v; want gastown, true", got, ok)
+	}
+	if got, ok := findVarValue(vars, "binding_prefix"); !ok || got != "gastown." {
+		t.Fatalf("binding_prefix var = %q, %v; want gastown., true", got, ok)
+	}
+}
+
+func TestBuildSlingFormulaVarsPreservesExplicitRoutingNamespace(t *testing.T) {
+	cfg := &config.City{Workspace: config.Workspace{Name: "test-city"}}
+	deps, _, _ := testDeps(cfg, runtime.NewFake(), newFakeRunner().run)
+
+	vars := buildSlingFormulaVars("mol-polecat-work", "HW-42", []string{
+		"rig_name=override-rig",
+		"binding_name=override-binding",
+		"binding_prefix=override.",
+	}, config.Agent{
+		Name:        "polecat",
+		Dir:         "hw",
+		BindingName: "gastown",
+	}, deps)
+
+	if got, ok := findVarValue(vars, "rig_name"); !ok || got != "override-rig" {
+		t.Fatalf("rig_name var = %q, %v; want override-rig, true", got, ok)
+	}
+	if got, ok := findVarValue(vars, "binding_name"); !ok || got != "override-binding" {
+		t.Fatalf("binding_name var = %q, %v; want override-binding, true", got, ok)
+	}
+	if got, ok := findVarValue(vars, "binding_prefix"); !ok || got != "override." {
+		t.Fatalf("binding_prefix var = %q, %v; want override., true", got, ok)
+	}
+}
+
+func TestBuildSlingFormulaVarsSeedsEmptyRoutingNamespaceForUnboundAgent(t *testing.T) {
+	cfg := &config.City{Workspace: config.Workspace{Name: "test-city"}}
+	deps, _, _ := testDeps(cfg, runtime.NewFake(), newFakeRunner().run)
+
+	vars := buildSlingFormulaVars("mol-deacon-patrol", "CITY-42", nil, config.Agent{
+		Name: "deacon",
+	}, deps)
+
+	for _, key := range []string{"rig_name", "binding_name", "binding_prefix"} {
+		got, ok := findVarValue(vars, key)
+		if !ok || got != "" {
+			t.Fatalf("%s var = %q, %v; want empty string, true", key, got, ok)
+		}
+	}
+}
+
 func TestBeadMetadataTargetStopsOnParentCycle(t *testing.T) {
 	store := &recordingStore{
 		Store: beads.NewMemStore(),
diff --git a/cmd/gc/cmd_start.go b/cmd/gc/cmd_start.go
index 189f13fea8..40cb1f80d8 100644
--- a/cmd/gc/cmd_start.go
+++ b/cmd/gc/cmd_start.go
@@ -579,32 +579,59 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 		// Beads won't be persisted, but the reconciler still manages lifecycle.
 		oneShotStore = beads.NewMemStore()
 	}
+	rigStores := buildStandaloneRigStores(cfg, cityPath, stderr)
 
 	// One-shot bead reconciliation: same code path as the daemon.
+	sessionQueryPartial := false
 	sessionBeads, err := loadSessionBeadSnapshot(oneShotStore)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc start: loading session beads: %v\n", err) //nolint:errcheck
 		sessionBeads = nil
+		sessionQueryPartial = true
 	}
-	dsResult := buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, nil, sessionBeads, nil, stderr)
+	dsResult := buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, rigStores, sessionBeads, nil, stderr)
+	dsResult.SessionQueryPartial = dsResult.SessionQueryPartial || sessionQueryPartial
 	ds := dsResult.State
 	cfgNames := configuredSessionNamesWithSnapshot(cfg, cityName, sessionBeads)
-	_, sessionBeads = syncSessionBeadsWithSnapshot(
-		cityPath, oneShotStore, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
+	_, sessionBeads = syncSessionBeadsWithSnapshotAndRigStores(
+		cityPath, oneShotStore, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
 	)
 
 	open := sessionBeads.Open()
+	if released := releaseOrphanedPoolAssignmentsWhenSnapshotsComplete(oneShotStore, cfg, cityPath, open, dsResult, rigStores); len(released) > 0 {
+		for _, r := range released {
+			fmt.Fprintf(stderr, "released orphaned pool work: %s\n", r.ID) //nolint:errcheck
+		}
+		// Standalone start has no follow-up patrol tick, so after reopening
+		// orphaned pool work we must immediately rebuild demand and sync once
+		// more so replacement session beads can be materialized in this run.
+		dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, rigStores, sessionBeads, nil, stderr)
+		ds = dsResult.State
+		cfgNames = configuredSessionNamesWithSnapshot(cfg, cityName, sessionBeads)
+		_, sessionBeads = syncSessionBeadsWithSnapshotAndRigStores(
+			cityPath, oneShotStore, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, true, sessionBeads,
+		)
+		open = sessionBeads.Open()
+	}
+
 	dt := newDrainTracker()
-	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(
-		cfg, nil, sessionBeads.Open(), dsResult.ScaleCheckCounts))
+	poolWorkBeads := filterAssignedWorkBeadsForPoolDemand(cfg, cityPath, open, dsResult.AssignedWorkBeads, dsResult.AssignedWorkStoreRefs)
+	poolDesired := retainScaleCheckPartialPoolDesired(
+		PoolDesiredCounts(ComputePoolDesiredStates(
+			cfg, poolWorkBeads, open, dsResult.ScaleCheckCounts)),
+		sessionBeads,
+		dsResult.PoolScaleCheckPartialTemplates,
+	)
 	if poolDesired == nil {
 		poolDesired = make(map[string]int)
 	}
 	mergeNamedSessionDemand(poolDesired, dsResult.NamedSessionDemand, cfg)
-	reconcileSessionBeadsAtPath(
+	awakeAssignedWorkBeads := filterAssignedWorkBeadsForSessionWake(cfg, cityPath, open, dsResult.AssignedWorkBeads, dsResult.AssignedWorkStoreRefs)
+	reconcileSessionBeadsAtPathWithNamedDemand(
 		sigCtx, cityPath, open, ds, cfgNames, cfg, sp, oneShotStore,
-		nil, nil, nil, nil, dt, poolDesired,
-		dsResult.StoreQueryPartial,
+		nil, awakeAssignedWorkBeads, rigStores, nil, dt, poolDesired,
+		dsResult.NamedSessionDemand,
+		dsResult.snapshotQueryPartial(),
 		nil, cityName,
 		nil, clock.Real{}, recorder, cfg.Session.StartupTimeoutDuration(), 0,
 		stdout, stderr,
@@ -616,10 +643,12 @@ func doStartStandalone(args []string, controllerMode bool, stdout, stderr io.Wri
 		fmt.Fprintf(stderr, "gc start: loading session beads: %v\n", err) //nolint:errcheck
 		sessionBeads = nil
 	}
-	dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, nil, sessionBeads, nil, stderr)
+	dsResult = buildDesiredStateWithSessionBeads(cityName, cityPath, beaconTime, cfg, sp, oneShotStore, rigStores, sessionBeads, nil, stderr)
 	ds = dsResult.State
 	cfgNames = configuredSessionNamesWithSnapshot(cfg, cityName, sessionBeads)
-	syncSessionBeadsWithSnapshot(cityPath, oneShotStore, ds, sp, cfgNames, cfg, clock.Real{}, stderr, false, sessionBeads)
+	syncSessionBeadsWithSnapshotAndRigStores(
+		cityPath, oneShotStore, rigStores, ds, sp, cfgNames, cfg, clock.Real{}, stderr, false, sessionBeads,
+	)
 
 	fmt.Fprintln(stdout, "City started.") //nolint:errcheck // best-effort stdout
 	return 0
diff --git a/cmd/gc/cmd_start_test.go b/cmd/gc/cmd_start_test.go
index 10a049f53e..b66a33cb73 100644
--- a/cmd/gc/cmd_start_test.go
+++ b/cmd/gc/cmd_start_test.go
@@ -123,6 +123,95 @@ func TestStandaloneBuildAgentsFnWithSessionBeads_UsesRigStoresForAssignedWork(t
 	}
 }
 
+func TestReleaseOrphanedPoolAssignmentsWhenSnapshotsComplete_PartialSkipsCompleteReleases(t *testing.T) {
+	store := beads.NewMemStore()
+	work, err := store.Create(beads.Bead{
+		ID:       "ga-live",
+		Title:    "live assigned work from partial snapshot",
+		Type:     "task",
+		Assignee: "worker-session",
+		Metadata: map[string]string{
+			"gc.routed_to": "worker",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	inProgress := "in_progress"
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatalf("mark work in_progress: %v", err)
+	}
+	work.Status = inProgress
+
+	released := releaseOrphanedPoolAssignmentsWhenSnapshotsComplete(
+		store,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}}},
+		"",
+		nil,
+		DesiredStateResult{
+			AssignedWorkBeads:  []beads.Bead{work},
+			AssignedWorkStores: []beads.Store{store},
+			StoreQueryPartial:  true,
+		},
+		nil,
+	)
+	if len(released) != 0 {
+		t.Fatalf("released %d work bead(s) from a partial snapshot, want none", len(released))
+	}
+	got, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get work after partial one-shot release: %v", err)
+	}
+	if got.Status != "in_progress" || got.Assignee != "worker-session" {
+		t.Fatalf("partial one-shot snapshot released work: status=%q assignee=%q", got.Status, got.Assignee)
+	}
+
+	released = releaseOrphanedPoolAssignmentsWhenSnapshotsComplete(
+		store,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}}},
+		"",
+		nil,
+		DesiredStateResult{
+			AssignedWorkBeads:   []beads.Bead{work},
+			AssignedWorkStores:  []beads.Store{store},
+			SessionQueryPartial: true,
+		},
+		nil,
+	)
+	if len(released) != 0 {
+		t.Fatalf("released %d work bead(s) from a partial session snapshot, want none", len(released))
+	}
+	got, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get work after partial session snapshot release: %v", err)
+	}
+	if got.Status != "in_progress" || got.Assignee != "worker-session" {
+		t.Fatalf("partial session snapshot released work: status=%q assignee=%q", got.Status, got.Assignee)
+	}
+
+	released = releaseOrphanedPoolAssignmentsWhenSnapshotsComplete(
+		store,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(5)}}},
+		"",
+		nil,
+		DesiredStateResult{
+			AssignedWorkBeads:  []beads.Bead{work},
+			AssignedWorkStores: []beads.Store{store},
+		},
+		nil,
+	)
+	if len(released) != 1 {
+		t.Fatalf("complete one-shot snapshot released %d work bead(s), want 1", len(released))
+	}
+	got, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get work after complete one-shot release: %v", err)
+	}
+	if got.Status != "open" || got.Assignee != "" {
+		t.Fatalf("complete one-shot snapshot did not release orphaned work: status=%q assignee=%q", got.Status, got.Assignee)
+	}
+}
+
 func TestMergeEnvOverrideOrder(t *testing.T) {
 	a := map[string]string{"KEY": "first", "A": "a"}
 	b := map[string]string{"KEY": "second", "B": "b"}
diff --git a/cmd/gc/cmd_status.go b/cmd/gc/cmd_status.go
index f44a92fb59..b1b9bd9e39 100644
--- a/cmd/gc/cmd_status.go
+++ b/cmd/gc/cmd_status.go
@@ -26,6 +26,7 @@ func newRigStatusCmd(stdout, stderr io.Writer) *cobra.Command {
 			}
 			return nil
 		},
+		ValidArgsFunction: completeRigNames,
 	}
 }
 
@@ -75,27 +76,30 @@ func cmdRigStatus(args []string, stdout, stderr io.Writer) int {
 	}
 
 	cityName := loadedCityName(cfg, cityPath)
-	sp := newSessionProvider()
+	var store beads.Store
+	if cityPath != "" {
+		if opened, err := openCityStoreAt(cityPath); err == nil {
+			store = opened
+		}
+	}
+	statusSnapshot := loadStatusSessionSnapshot(store)
+	sp := newStatusSessionProviderForCityWithSnapshot(cfg, cityPath, statusSnapshot)
 	dops := newDrainOps(sp)
-	return doRigStatus(sp, dops, rig, rigAgents, cityPath, cityName, cfg.Workspace.SessionTemplate, stdout, stderr)
+	return doRigStatusWithStoreAndSnapshot(sp, dops, rig, rigAgents, cityPath, cityName, cfg.Workspace.SessionTemplate, cfg, store, statusSnapshot, stdout, stderr)
 }
 
-// doRigStatus prints rig info and per-agent running state.
-func doRigStatus(
+func doRigStatusWithStoreAndSnapshot(
 	sp runtime.Provider,
 	dops drainOps,
 	rig config.Rig,
 	agents []config.Agent,
 	cityPath, cityName, sessionTemplate string,
+	cfg *config.City,
+	store beads.Store,
+	statusSnapshot *sessionBeadSnapshot,
 	stdout, stderr io.Writer,
 ) int {
-	_ = stderr // reserved for future error reporting
-	var store beads.Store
-	if cityPath != "" {
-		if opened, err := openCityStoreAt(cityPath); err == nil {
-			store = opened
-		}
-	}
+	registerStatusProviderACPRoutes(sp, statusSnapshot, cityName, cfg)
 
 	suspStr := "no"
 	if rig.Suspended {
@@ -110,15 +114,15 @@ func doRigStatus(
 	for _, a := range agents {
 		sp0 := scaleParamsFor(&a)
 		if !a.SupportsInstanceExpansion() {
-			sn := cliSessionName(cityPath, cityName, a.QualifiedName(), sessionTemplate)
-			obs := observeSessionTargetWithWarning("gc rig status", cityPath, store, sp, nil, sn, stderr)
-			status := agentStatusLine(obs.Running, dops, sn, a.Suspended || obs.Suspended)
+			target := statusObservationTargetForIdentity(statusSnapshot, cityName, a.QualifiedName(), sessionTemplate)
+			obs := observeSessionTargetWithWarning("gc rig status", cityPath, store, sp, cfg, target, stderr)
+			status := agentStatusLine(obs.Running, dops, target.runtimeSessionName, a.Suspended || obs.Suspended)
 			fmt.Fprintf(stdout, "    %-12s%s\n", a.QualifiedName(), status) //nolint:errcheck // best-effort stdout
 		} else {
 			for _, qualifiedInstance := range discoverPoolInstances(a.Name, a.Dir, sp0, &a, cityName, sessionTemplate, sp) {
-				sn := cliSessionName(cityPath, cityName, qualifiedInstance, sessionTemplate)
-				obs := observeSessionTargetWithWarning("gc rig status", cityPath, store, sp, nil, sn, stderr)
-				status := agentStatusLine(obs.Running, dops, sn, a.Suspended || obs.Suspended)
+				target := statusObservationTargetForIdentity(statusSnapshot, cityName, qualifiedInstance, sessionTemplate)
+				obs := observeSessionTargetWithWarning("gc rig status", cityPath, store, sp, cfg, target, stderr)
+				status := agentStatusLine(obs.Running, dops, target.runtimeSessionName, a.Suspended || obs.Suspended)
 				fmt.Fprintf(stdout, "    %-12s%s\n", qualifiedInstance, status) //nolint:errcheck // best-effort stdout
 			}
 		}
diff --git a/cmd/gc/cmd_status_test.go b/cmd/gc/cmd_status_test.go
index 698bcc1570..bc95c4951b 100644
--- a/cmd/gc/cmd_status_test.go
+++ b/cmd/gc/cmd_status_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"io"
 	"strings"
 	"testing"
 
@@ -17,6 +18,24 @@ import (
 // doRigStatus tests
 // ---------------------------------------------------------------------------
 
+func runDoRigStatus(
+	sp runtime.Provider,
+	dops drainOps,
+	rig config.Rig,
+	agents []config.Agent,
+	cityPath string,
+	stdout, stderr io.Writer,
+) int {
+	var store beads.Store
+	if cityPath != "" {
+		if opened, err := openCityStoreAt(cityPath); err == nil {
+			store = opened
+		}
+	}
+	statusSnapshot := loadStatusSessionSnapshot(store)
+	return doRigStatusWithStoreAndSnapshot(sp, dops, rig, agents, cityPath, "city", "", nil, store, statusSnapshot, stdout, stderr)
+}
+
 func TestDoRigStatus(t *testing.T) {
 	sp := runtime.NewFake()
 	if err := sp.Start(context.Background(), "frontend--polecat", runtime.Config{Command: "echo"}); err != nil {
@@ -32,7 +51,7 @@ func TestDoRigStatus(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doRigStatus(sp, dops, rig, agents, "", "city", "", &stdout, &stderr)
+	code := runDoRigStatus(sp, dops, rig, agents, "", &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
 	}
@@ -67,7 +86,7 @@ func TestDoRigStatusSuspendedRig(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doRigStatus(sp, dops, rig, agents, "", "city", "", &stdout, &stderr)
+	code := runDoRigStatus(sp, dops, rig, agents, "", &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0", code)
 	}
@@ -91,7 +110,7 @@ func TestDoRigStatusWithDraining(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doRigStatus(sp, dops, rig, agents, "", "city", "", &stdout, &stderr)
+	code := runDoRigStatus(sp, dops, rig, agents, "", &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0", code)
 	}
@@ -113,7 +132,7 @@ func TestDoRigStatusSuspendedAgent(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doRigStatus(sp, dops, rig, agents, "", "city", "", &stdout, &stderr)
+	code := runDoRigStatus(sp, dops, rig, agents, "", &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0", code)
 	}
@@ -140,7 +159,7 @@ func TestDoRigStatusReportsObservationErrors(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := doRigStatus(sp, dops, rig, agents, "/tmp/city", "city", "", &stdout, &stderr)
+	code := runDoRigStatus(sp, dops, rig, agents, "/tmp/city", &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("code = %d, want 0; stderr: %s", code, stderr.String())
 	}
diff --git a/cmd/gc/cmd_stop.go b/cmd/gc/cmd_stop.go
index e4d87bd96f..982c2e3e04 100644
--- a/cmd/gc/cmd_stop.go
+++ b/cmd/gc/cmd_stop.go
@@ -98,7 +98,7 @@ func cmdStop(args []string, stdout, stderr io.Writer) int {
 			desired[sn] = true
 		} else {
 			// Pool agent: resolve runtime session names from beads first, then legacy discovery.
-			for _, ref := range resolvePoolSessionRefs(store, a.Name, a.Dir, sp0, &a, cityName, st, sp, stderr) {
+			for _, ref := range resolvePoolSessionRefs(store, cfg, a.Name, a.Dir, sp0, &a, cityName, st, sp, stderr) {
 				sessionNames = append(sessionNames, ref.sessionName)
 				desired[ref.sessionName] = true
 			}
@@ -239,10 +239,35 @@ func waitForStandaloneControllerStop(cityPath string, timeout time.Duration) err
 func doStop(sessionNames []string, sp runtime.Provider, cfg *config.City, store beads.Store, timeout time.Duration,
 	rec events.Recorder, stdout, stderr io.Writer,
 ) int {
+	visible := map[string]bool{}
+	if sp != nil {
+		names, err := sp.ListRunning("")
+		partialList := runtime.IsPartialListError(err)
+		if err != nil && !partialList {
+			fmt.Fprintf(stderr, "gc stop: listing sessions: %v\n", err) //nolint:errcheck // best-effort stderr
+			names = nil
+		}
+		if partialList {
+			fmt.Fprintf(stderr, "gc stop: listing sessions partially failed: %v\n", err) //nolint:errcheck // best-effort stderr
+		}
+		for _, name := range names {
+			if name = strings.TrimSpace(name); name != "" {
+				visible[name] = true
+			}
+		}
+	}
 	var running []string
 	for _, sn := range sessionNames {
+		sn = strings.TrimSpace(sn)
+		if sn == "" {
+			continue
+		}
 		if alive, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, sn); err == nil && alive {
 			running = append(running, sn)
+			continue
+		}
+		if visible[sn] {
+			running = append(running, sn)
 		}
 	}
 	gracefulStopAll(running, sp, timeout, rec, cfg, store, stdout, stderr)
diff --git a/cmd/gc/cmd_supervisor.go b/cmd/gc/cmd_supervisor.go
index b9d762eb4c..7fe23beb01 100644
--- a/cmd/gc/cmd_supervisor.go
+++ b/cmd/gc/cmd_supervisor.go
@@ -3,7 +3,6 @@ package main
 import (
 	"bufio"
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -183,6 +182,97 @@ type reconcileRequest struct {
 	done chan struct{}
 }
 
+type supervisorShutdownMode int32
+
+const (
+	supervisorShutdownNone supervisorShutdownMode = iota
+	supervisorShutdownPreserveSessions
+	supervisorShutdownDestructive
+)
+
+const supervisorPreserveSessionsOnSignalEnv = "GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL"
+
+var supervisorShutdownSettleDelay = 50 * time.Millisecond
+
+var supervisorSignalNotify = signal.Notify
+
+func supervisorPreserveSessionsOnSignal() bool {
+	return os.Getenv(supervisorPreserveSessionsOnSignalEnv) == "1"
+}
+
+func supervisorShutdownModeForSignal(sig os.Signal) supervisorShutdownMode {
+	if sig == syscall.SIGTERM && supervisorPreserveSessionsOnSignal() {
+		return supervisorShutdownPreserveSessions
+	}
+	return supervisorShutdownDestructive
+}
+
+type supervisorShutdownController struct {
+	mode                 atomic.Int32
+	destructiveRequested atomic.Bool
+	destructiveOnce      sync.Once
+	destructiveCh        chan struct{}
+}
+
+func newSupervisorShutdownController() *supervisorShutdownController {
+	return &supervisorShutdownController{destructiveCh: make(chan struct{})}
+}
+
+func supervisorSignalLoop(sigCh <-chan os.Signal, done <-chan struct{}, requestShutdown func(supervisorShutdownMode), requestReconcile func()) {
+	for {
+		select {
+		case sig := <-sigCh:
+			if sig == nil {
+				continue
+			}
+			if sig == syscall.SIGHUP {
+				requestReconcile()
+				continue
+			}
+			requestShutdown(supervisorShutdownModeForSignal(sig))
+		case <-done:
+			return
+		}
+	}
+}
+
+func (c *supervisorShutdownController) request(mode supervisorShutdownMode) {
+	if mode == supervisorShutdownDestructive {
+		c.destructiveRequested.Store(true)
+		c.mode.Store(int32(supervisorShutdownDestructive))
+		c.destructiveOnce.Do(func() {
+			if c.destructiveCh != nil {
+				close(c.destructiveCh)
+			}
+		})
+		return
+	}
+	if mode == supervisorShutdownPreserveSessions {
+		c.mode.CompareAndSwap(int32(supervisorShutdownNone), int32(supervisorShutdownPreserveSessions))
+	}
+}
+
+func (c *supervisorShutdownController) preservesSessions() bool {
+	if c.destructiveRequested.Load() {
+		return false
+	}
+	return supervisorShutdownMode(c.mode.Load()) == supervisorShutdownPreserveSessions
+}
+
+func (c *supervisorShutdownController) preservesSessionsAfterSettle(timeout time.Duration) bool {
+	if !c.preservesSessions() || timeout <= 0 {
+		return c.preservesSessions()
+	}
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+	select {
+	case <-c.destructiveCh:
+		return false
+	case <-timer.C:
+		return c.preservesSessions()
+	}
+}
+
 var (
 	supervisorReloadQueueTimeout = 5 * time.Second
 	supervisorReloadWaitTimeout  = 5 * time.Minute
@@ -211,7 +301,7 @@ func (s *shutdownState) finish(err error) {
 	close(s.done)
 }
 
-func startSupervisorSocket(sockPath string, cancelFn context.CancelFunc, reconcileCh chan reconcileRequest, shut *shutdownState) (net.Listener, error) {
+func startSupervisorSocket(sockPath string, requestShutdown func(supervisorShutdownMode), reconcileCh chan reconcileRequest, shut *shutdownState) (net.Listener, error) {
 	os.Remove(sockPath) //nolint:errcheck // remove stale socket from previous crash
 	lis, err := net.Listen("unix", sockPath)
 	if err != nil {
@@ -229,7 +319,7 @@ func startSupervisorSocket(sockPath string, cancelFn context.CancelFunc, reconci
 				fmt.Fprintf(os.Stderr, "gc supervisor: socket accept: %v\n", err) //nolint:errcheck
 				continue
 			}
-			go handleSupervisorConn(conn, cancelFn, reconcileCh, shut)
+			go handleSupervisorConn(conn, requestShutdown, reconcileCh, shut)
 		}
 	}()
 	return lis, nil
@@ -243,14 +333,14 @@ func startSupervisorSocket(sockPath string, cancelFn context.CancelFunc, reconci
 // then — if the client keeps the connection open — blocks until shutdown
 // completes and sends a second line "done:ok\n" or "done:err:<detail>\n"
 // so --wait clients can distinguish clean shutdown from partial failure.
-func handleSupervisorConn(conn net.Conn, cancelFn context.CancelFunc, reconcileCh chan reconcileRequest, shut *shutdownState) {
+func handleSupervisorConn(conn net.Conn, requestShutdown func(supervisorShutdownMode), reconcileCh chan reconcileRequest, shut *shutdownState) {
 	defer conn.Close()                                     //nolint:errcheck
 	conn.SetReadDeadline(time.Now().Add(60 * time.Second)) //nolint:errcheck
 	scanner := bufio.NewScanner(conn)
 	if scanner.Scan() {
 		switch scanner.Text() {
 		case "stop":
-			cancelFn()
+			requestShutdown(supervisorShutdownDestructive)
 			if _, err := conn.Write([]byte("ok\n")); err != nil {
 				return
 			}
@@ -370,13 +460,10 @@ func stopSupervisor(stdout, stderr io.Writer) int {
 // it stops answering. This is the shape tests and shell scripts want: on
 // return, the supervisor has fully shut down and any failure is visible.
 //
-// It also unloads the platform service (without removing the unit file) so
-// launchd/systemd doesn't immediately restart the supervisor.
+// It also unloads the platform service (without removing the unit file) after
+// the supervisor acknowledges the destructive socket stop, so launchd/systemd
+// will not restart it when the process exits.
 func stopSupervisorWithWait(stdout, stderr io.Writer, wait bool, waitTimeout time.Duration) int {
-	// Unload the platform service first so the service manager doesn't
-	// restart the supervisor after we send the stop command.
-	unloadSupervisorService()
-
 	sockPath, _ := runningSupervisorSocket()
 	if sockPath == "" {
 		fmt.Fprintln(stderr, "gc supervisor stop: supervisor is not running") //nolint:errcheck
@@ -397,6 +484,7 @@ func stopSupervisorWithWait(stdout, stderr io.Writer, wait bool, waitTimeout tim
 		return 1
 	}
 	fmt.Fprintln(stdout, "Supervisor stopping...") //nolint:errcheck
+	unloadSupervisorService()
 	if !wait {
 		return 0
 	}
@@ -629,6 +717,47 @@ func stopManagedCity(mc *managedCity, cityPath string, stderr io.Writer) error {
 	return stopErr
 }
 
+func stopManagedCityPreservingSessions(mc *managedCity, _ string, stderr io.Writer) error {
+	if mc == nil {
+		return nil
+	}
+	if mc.cr != nil {
+		mc.cr.preserveSessionsOnShutdown()
+	}
+	mc.cancel()
+	timeout := managedCityStopTimeout(mc)
+	var stopErr error
+	waitForRuntimeShutdown := timeout <= 0
+	if timeout > 0 {
+		select {
+		case <-mc.done:
+		case <-time.After(timeout):
+			fmt.Fprintf(stderr, "gc supervisor: city '%s' did not exit within %s after preserve-mode cancel\n", mc.name, timeout) //nolint:errcheck
+			stopErr = fmt.Errorf("city %q did not exit within %s after preserve-mode cancel", mc.name, timeout)
+			waitForRuntimeShutdown = true
+		}
+	}
+	if waitForRuntimeShutdown && mc.cr != nil {
+		func() {
+			defer func() { recover() }() //nolint:errcheck
+			mc.cr.shutdown()
+		}()
+		if timeout > 0 {
+			select {
+			case <-mc.done:
+				stopErr = nil
+			case <-time.After(timeout):
+				fmt.Fprintf(stderr, "gc supervisor: city '%s' did not exit within %s after preserve-mode shutdown wait\n", mc.name, timeout) //nolint:errcheck
+				stopErr = fmt.Errorf("city %q did not exit within %s after preserve-mode shutdown wait", mc.name, timeout)
+			}
+		}
+	}
+	if mc.closer != nil {
+		mc.closer.Close() //nolint:errcheck
+	}
+	return stopErr
+}
+
 // runSupervisor is the main supervisor loop. It acquires the lock,
 // starts a control socket, reads the registry, starts CityRuntimes,
 // and runs until canceled.
@@ -647,35 +776,29 @@ func runSupervisor(stdout, stderr io.Writer) int {
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
+	shutdownCtl := newSupervisorShutdownController()
+	requestShutdown := func(mode supervisorShutdownMode) {
+		shutdownCtl.request(mode)
+		cancel()
+	}
 
 	// Reconcile channel — triggers immediate reconciliation from SIGHUP
 	// or the "reload" socket command.
 	reconcileCh := make(chan reconcileRequest, 1)
 
 	// Signal handler: SIGINT/SIGTERM → shutdown, SIGHUP → immediate reconcile.
-	sigCh := make(chan os.Signal, 1)
-	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
+	sigCh := make(chan os.Signal, 2)
+	supervisorSignalNotify(sigCh, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
 	defer signal.Stop(sigCh)
-	go func() {
-		for {
-			select {
-			case sig := <-sigCh:
-				if sig == syscall.SIGHUP {
-					fmt.Fprintln(stderr, "SIGHUP received, triggering reconciliation...") //nolint:errcheck
-					select {
-					case reconcileCh <- reconcileRequest{}:
-					default: // reconcile already pending
-					}
-					continue
-				}
-				// SIGINT/SIGTERM → shutdown.
-				cancel()
-				return
-			case <-ctx.Done():
-				return
-			}
+	shutdownSignalsDone := make(chan struct{})
+	defer close(shutdownSignalsDone)
+	go supervisorSignalLoop(sigCh, shutdownSignalsDone, requestShutdown, func() {
+		fmt.Fprintln(stderr, "SIGHUP received, triggering reconciliation...") //nolint:errcheck
+		select {
+		case reconcileCh <- reconcileRequest{}:
+		default: // reconcile already pending
 		}
-	}()
+	})
 
 	// Load supervisor config.
 	supCfg, err := supervisor.LoadConfig(supervisor.ConfigPath())
@@ -685,10 +808,19 @@ func runSupervisor(stdout, stderr io.Writer) int {
 	}
 
 	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	if err := cleanupSupervisorWorkspaceServicesForSupervisorStart(supervisor.DefaultHome()); err != nil {
+		fmt.Fprintf(stderr, "gc supervisor: workspace-service startup cleanup: %v\n", err) //nolint:errcheck
+		return 1
+	}
 
 	// Track managed cities via atomic-snapshot registry. API reads are
 	// lock-free (atomic pointer load); mutations go through citiesMu.
 	registry := newCityRegistry()
+	supEvPath := filepath.Join(supervisor.RuntimeDir(), "events.jsonl")
+	if supFR, supErr := events.NewFileRecorder(supEvPath, stderr); supErr == nil {
+		registry.SetSupervisorRecorder(supFR)
+		defer supFR.Close() //nolint:errcheck
+	}
 
 	// Start API server with city-namespaced routing (Phase 2).
 	startedAt := time.Now()
@@ -699,7 +831,12 @@ func runSupervisor(stdout, stderr io.Writer) int {
 	if readOnly {
 		fmt.Fprintf(stderr, "gc supervisor: binding to %s — mutation endpoints disabled (non-localhost)\n", bind) //nolint:errcheck
 	}
-	apiMux := api.NewSupervisorMux(registry, NewInitializer(), readOnly, version, startedAt)
+	cityInitSvc, err := newCityInitService()
+	if err != nil {
+		fmt.Fprintf(stderr, "gc supervisor: %v\n", err) //nolint:errcheck
+		return 1
+	}
+	apiMux := api.NewSupervisorMux(registry, cityInitSvc, readOnly, version, startedAt)
 
 	pprofSrv, pprofErr := api.StartPprof("")
 	if pprofErr != nil {
@@ -738,7 +875,7 @@ func runSupervisor(stdout, stderr io.Writer) int {
 		return 1
 	}
 	shut := newShutdownState()
-	lis, err := startSupervisorSocket(sockPath, cancel, reconcileCh, shut)
+	lis, err := startSupervisorSocket(sockPath, requestShutdown, reconcileCh, shut)
 	if err != nil {
 		fmt.Fprintf(stderr, "gc supervisor: %v\n", err) //nolint:errcheck
 		return 1
@@ -823,14 +960,27 @@ func runSupervisor(stdout, stderr io.Writer) int {
 					delete(cities, k)
 				}
 			})
+			preserveSessions := shutdownCtl.preservesSessionsAfterSettle(supervisorShutdownSettleDelay)
 			var stopFailures []string
 			for name, mc := range toStop {
-				fmt.Fprintf(stdout, "Stopping city '%s'...\n", name) //nolint:errcheck
-				if err := stopManagedCity(mc, name, stderr); err != nil {
+				if preserveSessions {
+					fmt.Fprintf(stdout, "Preserving city '%s' sessions for re-adoption...\n", name) //nolint:errcheck
+				} else {
+					fmt.Fprintf(stdout, "Stopping city '%s'...\n", name) //nolint:errcheck
+				}
+				stopFn := stopManagedCity
+				if preserveSessions {
+					stopFn = stopManagedCityPreservingSessions
+				}
+				if err := stopFn(mc, name, stderr); err != nil {
 					stopFailures = append(stopFailures, fmt.Sprintf("%s: %s", name, err.Error()))
 					fmt.Fprintf(stdout, "City '%s' stop reported error (see stderr).\n", name) //nolint:errcheck
 				} else {
-					fmt.Fprintf(stdout, "City '%s' stopped.\n", name) //nolint:errcheck
+					if preserveSessions {
+						fmt.Fprintf(stdout, "City '%s' preserved.\n", name) //nolint:errcheck
+					} else {
+						fmt.Fprintf(stdout, "City '%s' stopped.\n", name) //nolint:errcheck
+					}
 				}
 			}
 			var shutErr error
@@ -860,8 +1010,11 @@ type initFailRecord struct {
 	backoff   time.Time
 	configMod time.Time // mtime of city.toml at last failure
 	lastError string    // last error message for user-facing feedback
+	dirAbsent int       // consecutive failures where the city directory is gone
 }
 
+const staleCityDirAbsentThreshold = 3
+
 // reconcileCities compares the registry against running cities and
 // starts/stops as needed. All state access goes through the cityRegistry.
 func reconcileCities(
@@ -927,25 +1080,20 @@ func reconcileCities(
 		// subscribers see the event via the running-provider path.
 		// Best-effort: a failure to open the recorder just means
 		// subscribers learn via GET /v0/cities instead.
-		evType := events.CityUnregistered
-		var payload []byte
-		if stopErr == nil {
-			fmt.Fprintf(stdout, "City '%s' stopped.\n", cityName) //nolint:errcheck
-			p, _ := json.Marshal(api.CityUnregisteredPayload{Name: cityName, Path: path})
-			payload = p
-		} else {
-			evType = events.CityUnregisterFailed
-			p, _ := json.Marshal(api.CityUnregisterFailedPayload{Name: cityName, Path: path, Error: stopErr.Error()})
-			payload = p
+		reqID, hasReqID, consumeErr := cr.ConsumePendingRequestID(path)
+		if consumeErr != nil {
+			fmt.Fprintf(stderr, "gc supervisor: city '%s': consume pending request_id for city.unregister completion event failed (path=%s): %v\n", cityName, path, consumeErr) //nolint:errcheck
 		}
-		if fr, frErr := events.NewFileRecorder(filepath.Join(path, ".gc", "events.jsonl"), stderr); frErr == nil {
-			fr.Record(events.Event{
-				Type:    evType,
-				Actor:   "gc",
-				Subject: cityName,
-				Payload: payload,
-			})
-			fr.Close() //nolint:errcheck // best-effort
+		if !hasReqID {
+			fmt.Fprintf(stderr, "gc supervisor: city '%s': no pending request_id for city.unregister completion event (path=%s)\n", cityName, path) //nolint:errcheck
+		}
+		if supRec := cr.SupervisorEventRecorder(); supRec != nil && hasReqID {
+			emitCityUnregisterTerminalEvent(supRec, reqID, cityName, path, stopErr)
+			if stopErr == nil {
+				fmt.Fprintf(stdout, "City '%s' stopped.\n", cityName) //nolint:errcheck
+			}
+		} else if stopErr == nil {
+			fmt.Fprintf(stdout, "City '%s' stopped.\n", cityName) //nolint:errcheck
 		}
 	}
 
@@ -1039,6 +1187,45 @@ func reconcileCities(
 			continue
 		}
 
+		// Auto-unregister cities whose directory no longer exists. If the
+		// directory has been absent for staleCityDirAbsentThreshold
+		// consecutive reconciliation cycles, remove the registration so
+		// the supervisor stops retrying. This catches leftover registrations
+		// from test runs or tutorials where the directory was cleaned up
+		// but the city was never unregistered.
+		if _, statErr := os.Stat(path); os.IsNotExist(statErr) {
+			var absentCount int
+			cr.BatchUpdate(func(
+				_ map[string]*managedCity,
+				_ map[string]cityInitProgress,
+				initFailures map[string]*initFailRecord,
+				_ map[string]*panicRecord,
+			) {
+				ifrec := initFailures[path]
+				if ifrec == nil {
+					ifrec = &initFailRecord{}
+					initFailures[path] = ifrec
+				}
+				ifrec.dirAbsent++
+				absentCount = ifrec.dirAbsent
+			})
+			if absentCount >= staleCityDirAbsentThreshold {
+				fmt.Fprintf(stderr, "gc supervisor: city '%s': directory %s absent for %d cycles, auto-unregistering\n", name, path, absentCount) //nolint:errcheck
+				if unregErr := reg.Unregister(path); unregErr != nil {
+					fmt.Fprintf(stderr, "gc supervisor: city '%s': auto-unregister failed: %v\n", name, unregErr) //nolint:errcheck
+				}
+				cr.BatchUpdate(func(
+					_ map[string]*managedCity,
+					_ map[string]cityInitProgress,
+					initFailures map[string]*initFailRecord,
+					_ map[string]*panicRecord,
+				) {
+					delete(initFailures, path)
+				})
+			}
+			continue
+		}
+
 		// Init failure backoff: skip cities whose init failed recently,
 		// unless the config file has been modified (user may have fixed it).
 		tomlPath := filepath.Join(path, "city.toml")
@@ -1092,6 +1279,7 @@ func reconcileCities(
 					initFailures[path] = ifrec
 				}
 				ifrec.count++
+				ifrec.dirAbsent = 0
 				exp := ifrec.count - 1
 				if exp > 5 {
 					exp = 5
@@ -1108,6 +1296,7 @@ func reconcileCities(
 		}
 
 		if err := ensureLegacyNamedPacksCached(path); err != nil {
+			emitPendingCityCreateFailure(cr, path, name, "pack_cache_failed", err, stderr)
 			recordInitFailure(name, fmt.Sprintf("fetching packs: %v", err))
 			continue
 		}
@@ -1116,6 +1305,7 @@ func reconcileCities(
 		// System packs are appended as extra includes for normal pack expansion.
 		cfg, prov, loadErr := loadSupervisorCityConfig(path)
 		if loadErr != nil {
+			emitPendingCityCreateFailure(cr, path, name, "city_config_failed", loadErr, stderr)
 			recordInitFailure(name, loadErr.Error())
 			continue
 		}
@@ -1159,28 +1349,7 @@ func reconcileCities(
 			) {
 				delete(initStatus, path)
 			})
-			// Emit city.init_failed to the city's event file so
-			// clients watching /v0/events/stream observe async
-			// failure signal without polling. Best-effort: if the
-			// file recorder can't open (e.g. .gc/ missing or
-			// permissions), fall through to recordInitFailure which
-			// surfaces the error via /v0/cities.
-			evPath := filepath.Join(path, ".gc", "events.jsonl")
-			if fr, frErr := events.NewFileRecorder(evPath, stderr); frErr == nil {
-				if payload, mErr := json.Marshal(api.CityInitFailedPayload{
-					Name:  cityName,
-					Path:  path,
-					Error: err.Error(),
-				}); mErr == nil {
-					fr.Record(events.Event{
-						Type:    events.CityInitFailed,
-						Actor:   "gc",
-						Subject: cityName,
-						Payload: payload,
-					})
-				}
-				fr.Close() //nolint:errcheck // best-effort
-			}
+			emitPendingCityCreateFailure(cr, path, cityName, "city_init_failed", err, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("init: %v", err))
 			continue
 		}
@@ -1229,6 +1398,7 @@ func reconcileCities(
 			) {
 				delete(initStatus, path)
 			})
+			emitPendingCityCreateFailure(cr, path, cityName, "session_provider_failed", spErr, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("session provider: %v", spErr))
 			continue
 		}
@@ -1245,6 +1415,7 @@ func reconcileCities(
 			) {
 				delete(initStatus, path)
 			})
+			emitPendingCityCreateFailure(cr, path, cityName, "agent_image_check_failed", err, stderr)
 			recordInitFailure(cityName, err.Error())
 			continue
 		}
@@ -1299,6 +1470,7 @@ func reconcileCities(
 					cr.UpdateCallback(path, func(m *managedCity) {
 						m.started = true
 					})
+					emitPendingCityCreateResult(cr, path, cityName, stderr)
 				},
 				OnStatus: func(status string) {
 					cr.UpdateCallback(path, func(m *managedCity) {
@@ -1311,6 +1483,7 @@ func reconcileCities(
 			})
 			return nil
 		}); err != nil {
+			emitPendingCityCreateFailure(cr, path, cityName, "city_runtime_failed", err, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("city runtime: %v", err))
 			continue
 		}
@@ -1322,6 +1495,7 @@ func reconcileCities(
 			cs = newControllerState(cityCtx, cfg, sp, eventProv, cityName, path)
 			return nil
 		}); err != nil {
+			emitPendingCityCreateFailure(cr, path, cityName, "controller_state_failed", err, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("controller state: %v", err))
 			continue
 		}
@@ -1337,6 +1511,7 @@ func reconcileCities(
 			runPoolOnBoot(cfg, path, shellRunHook, stderr)
 			return nil
 		}); err != nil {
+			emitPendingCityCreateFailure(cr, path, cityName, "pool_on_boot_failed", err, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("pool on_boot: %v", err))
 			continue
 		}
@@ -1380,6 +1555,7 @@ func reconcileCities(
 			) {
 				delete(cities, path)
 			})
+			emitPendingCityCreateFailure(cr, path, cityName, "controller_lock_failed", lockErr, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("controller lock: %v", lockErr))
 			continue
 		}
@@ -1404,6 +1580,7 @@ func reconcileCities(
 			) {
 				delete(cities, path)
 			})
+			emitPendingCityCreateFailure(cr, path, cityName, "controller_socket_failed", lisErr, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("controller socket: %v", lisErr))
 			continue
 		}
@@ -1429,6 +1606,7 @@ func reconcileCities(
 			) {
 				delete(cities, path)
 			})
+			emitPendingCityCreateFailure(cr, path, cityName, "controller_token_failed", tokenErr, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("controller token: %v", tokenErr))
 			continue
 		}
@@ -1451,6 +1629,7 @@ func reconcileCities(
 			) {
 				delete(cities, path)
 			})
+			emitPendingCityCreateFailure(cr, path, cityName, "controller_token_write_failed", err, stderr)
 			recordInitFailure(cityName, fmt.Sprintf("controller token write: %v", err))
 			continue
 		}
@@ -1476,6 +1655,20 @@ func reconcileCities(
 			defer func() {
 				if r := recover(); r != nil {
 					fmt.Fprintf(stderr, "gc supervisor: city '%s' panicked: %v\n", n, r) //nolint:errcheck
+					reqID, hasReqID, consumeErr := cr.ConsumePendingRequestID(p)
+					if consumeErr != nil {
+						fmt.Fprintf(stderr, "gc supervisor: city '%s': consume pending request_id for city.create panic event failed (path=%s): %v\n", n, p, consumeErr) //nolint:errcheck
+					}
+					if hasReqID {
+						if supRec := cr.SupervisorEventRecorder(); supRec != nil {
+							api.EmitTypedEvent(supRec, events.RequestFailed, n, api.RequestFailedPayload{
+								RequestID:    reqID,
+								Operation:    api.RequestOperationCityCreate,
+								ErrorCode:    "internal_error",
+								ErrorMessage: fmt.Sprintf("panic: %v", r),
+							})
+						}
+					}
 					// Gracefully stop agents so they aren't orphaned.
 					// Wrap in recovery to prevent nested panic from crashing
 					// the entire supervisor.
@@ -1558,24 +1751,60 @@ func reconcileCities(
 		}(cityName, path, fr, lis, sockPath, sockInfo, lock)
 
 		rec.Record(events.Event{Type: events.ControllerStarted, Actor: "gc"})
-		// Signal city.ready on the supervisor event bus so clients
-		// that POST /v0/city and subscribe to /v0/events/stream
-		// observe completion without polling. Handler returned 202
-		// synchronously; this event is the async completion signal.
-		readyPayload, readyErr := json.Marshal(api.CityReadyPayload{Name: cityName, Path: path})
-		if readyErr == nil {
-			rec.Record(events.Event{
-				Type:    events.CityReady,
-				Actor:   "gc",
-				Subject: cityName,
-				Payload: readyPayload,
-			})
-		}
 		telemetry.RecordControllerLifecycle(context.Background(), "started")
 		fmt.Fprintf(stdout, "Launching city '%s' (%s)\n", cityName, path) //nolint:errcheck
 	}
 }
 
+func emitPendingCityCreateResult(cr *cityRegistry, path, cityName string, stderr io.Writer) {
+	reqID, hasReqID, consumeErr := cr.ConsumePendingRequestID(path)
+	if consumeErr != nil {
+		fmt.Fprintf(stderr, "gc supervisor: city '%s': consume pending request_id for city.create completion event failed (path=%s): %v\n", cityName, path, consumeErr) //nolint:errcheck
+	}
+	if supRec := cr.SupervisorEventRecorder(); supRec != nil && hasReqID {
+		api.EmitTypedEvent(supRec, events.RequestResultCityCreate, cityName, api.CityCreateSucceededPayload{
+			RequestID: reqID,
+			Name:      cityName,
+			Path:      path,
+		})
+	}
+}
+
+func emitPendingCityCreateFailure(cr *cityRegistry, path, cityName, errorCode string, err error, stderr io.Writer) {
+	reqID, hasReqID, consumeErr := cr.ConsumePendingRequestID(path)
+	if consumeErr != nil {
+		fmt.Fprintf(stderr, "gc supervisor: city '%s': consume pending request_id for city.create failure event failed (path=%s): %v\n", cityName, path, consumeErr) //nolint:errcheck
+	}
+	if !hasReqID {
+		return
+	}
+	if supRec := cr.SupervisorEventRecorder(); supRec != nil {
+		api.EmitTypedEvent(supRec, events.RequestFailed, cityName, api.RequestFailedPayload{
+			RequestID:    reqID,
+			Operation:    api.RequestOperationCityCreate,
+			ErrorCode:    errorCode,
+			ErrorMessage: err.Error(),
+		})
+	}
+}
+
+func emitCityUnregisterTerminalEvent(rec events.Recorder, requestID, cityName, path string, stopErr error) {
+	if stopErr == nil {
+		api.EmitTypedEvent(rec, events.RequestResultCityUnregister, cityName, api.CityUnregisterSucceededPayload{
+			RequestID: requestID,
+			Name:      cityName,
+			Path:      path,
+		})
+		return
+	}
+	api.EmitTypedEvent(rec, events.RequestFailed, cityName, api.RequestFailedPayload{
+		RequestID:    requestID,
+		Operation:    api.RequestOperationCityUnregister,
+		ErrorCode:    "city_unregister_failed",
+		ErrorMessage: stopErr.Error(),
+	})
+}
+
 var supervisorLoadWarningSeen sync.Map
 
 func emitSupervisorLoadCityConfigWarnings(w io.Writer, cityPath string, prov *config.Provenance) {
@@ -1613,10 +1842,10 @@ func publishManagedCity(cr *cityRegistry, path string, mc *managedCity) bool {
 			alreadyRunning = true
 			return
 		}
-		// The controller state and per-city API are fully wired at this point.
-		// Mark the city started before the first reconcile so slow bead scans
-		// don't keep supervisor startup and API availability blocked.
-		mc.started = true
+		// The controller state and per-city API are wired at this point, but
+		// initial reconciliation has not yet materialized startup session
+		// beads. Keep the city in startup status until CityRuntime.OnStarted
+		// runs after that reconciliation completes.
 		mc.status = "starting_agents"
 		cities[path] = mc
 		delete(initStatus, path)
diff --git a/cmd/gc/cmd_supervisor_city.go b/cmd/gc/cmd_supervisor_city.go
index 0be16f7fbf..0ae99b77cd 100644
--- a/cmd/gc/cmd_supervisor_city.go
+++ b/cmd/gc/cmd_supervisor_city.go
@@ -275,18 +275,23 @@ func registerCityForAPI(cityPath, nameOverride string) error {
 // socket without waiting for the reply. Used by registerCityForAPI
 // so the async POST /v0/city handler doesn't block on the
 // reconciler tick.
-func reloadSupervisorNoWait() {
+func reloadSupervisorNoWait() error {
 	sockPath, _ := runningSupervisorSocket()
 	if sockPath == "" {
-		return
+		return errors.New("supervisor is not running; start it with 'gc supervisor start'")
 	}
 	conn, err := net.DialTimeout("unix", sockPath, 2*time.Second)
 	if err != nil {
-		return
+		return fmt.Errorf("connecting to supervisor reload socket: %w", err)
 	}
 	defer conn.Close() //nolint:errcheck // best-effort
-	_ = conn.SetWriteDeadline(time.Now().Add(1 * time.Second))
-	_, _ = conn.Write([]byte("reload\n"))
+	if err := conn.SetWriteDeadline(time.Now().Add(1 * time.Second)); err != nil {
+		return fmt.Errorf("setting supervisor reload deadline: %w", err)
+	}
+	if _, err := conn.Write([]byte("reload\n")); err != nil {
+		return fmt.Errorf("writing supervisor reload command: %w", err)
+	}
+	return nil
 }
 
 func retrySupervisorCityStartAfterControllerLock(cityPath string, stdout, stderr io.Writer, startErr error) (bool, error) {
diff --git a/cmd/gc/cmd_supervisor_city_test.go b/cmd/gc/cmd_supervisor_city_test.go
index a31e434a44..bd9d2cc90a 100644
--- a/cmd/gc/cmd_supervisor_city_test.go
+++ b/cmd/gc/cmd_supervisor_city_test.go
@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"io"
 	"net"
 	"os"
@@ -12,6 +13,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/api"
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
@@ -283,6 +285,7 @@ func TestRegisterCityWithSupervisorFailsFastWhenSupervisorStopsDuringWait(t *tes
 	}
 
 	aliveChecks := 0
+	var waitStarted time.Time
 	withSupervisorTestHooks(
 		t,
 		func(_, _ io.Writer) int { return 0 },
@@ -290,6 +293,7 @@ func TestRegisterCityWithSupervisorFailsFastWhenSupervisorStopsDuringWait(t *tes
 		func() int {
 			aliveChecks++
 			if aliveChecks <= 1 {
+				waitStarted = time.Now()
 				return 4242
 			}
 			return 0
@@ -300,7 +304,6 @@ func TestRegisterCityWithSupervisorFailsFastWhenSupervisorStopsDuringWait(t *tes
 	)
 
 	var stdout, stderr bytes.Buffer
-	started := time.Now()
 	code := registerCityWithSupervisor(cityPath, &stdout, &stderr, "gc register", true)
 	if code != 1 {
 		t.Fatalf("registerCityWithSupervisor code = %d, want 1", code)
@@ -308,7 +311,10 @@ func TestRegisterCityWithSupervisorFailsFastWhenSupervisorStopsDuringWait(t *tes
 	if !strings.Contains(stderr.String(), "supervisor stopped before city became ready") {
 		t.Fatalf("stderr = %q, want supervisor-stopped message", stderr.String())
 	}
-	if elapsed := time.Since(started); elapsed > 250*time.Millisecond {
+	if waitStarted.IsZero() {
+		t.Fatal("supervisor wait path was not reached")
+	}
+	if elapsed := time.Since(waitStarted); elapsed > 250*time.Millisecond {
 		t.Fatalf("registerCityWithSupervisor took %v, want fast failure when supervisor stops", elapsed)
 	}
 	if !strings.Contains(stderr.String(), "keeping registration") {
@@ -1148,7 +1154,12 @@ func TestReconcileCitiesUnregisterEventUsesManagedCityName(t *testing.T) {
 
 	done := make(chan struct{})
 	close(done)
+	supRec := events.NewFake()
 	registry := newCityRegistry()
+	registry.SetSupervisorRecorder(supRec)
+	if err := registry.StorePendingRequestID(cityPath, "req-test-unregister"); err != nil {
+		t.Fatal(err)
+	}
 	registry.Add(cityPath, &managedCity{
 		name:    "effective-city",
 		started: true,
@@ -1160,32 +1171,144 @@ func TestReconcileCitiesUnregisterEventUsesManagedCityName(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
 
-	recorded, err := events.ReadAll(filepath.Join(cityPath, ".gc", "events.jsonl"))
-	if err != nil {
-		t.Fatalf("ReadAll(events): %v", err)
-	}
+	recorded := supRec.Events
 	if len(recorded) != 1 {
-		t.Fatalf("recorded %d events, want 1", len(recorded))
+		t.Fatalf("recorded %d supervisor events, want 1", len(recorded))
 	}
 	got := recorded[0]
-	if got.Type != events.CityUnregistered {
-		t.Fatalf("event.Type = %q, want %q", got.Type, events.CityUnregistered)
+	if got.Type != events.RequestResultCityUnregister {
+		t.Fatalf("event.Type = %q, want %q", got.Type, events.RequestResultCityUnregister)
 	}
 	if got.Subject != "effective-city" {
 		t.Fatalf("event.Subject = %q, want effective-city", got.Subject)
 	}
-	var payload struct {
-		Name string `json:"name"`
-		Path string `json:"path"`
-	}
+	var payload api.CityUnregisterSucceededPayload
 	if err := json.Unmarshal(got.Payload, &payload); err != nil {
 		t.Fatalf("json.Unmarshal(payload): %v", err)
 	}
 	if payload.Name != "effective-city" {
 		t.Fatalf("payload.Name = %q, want effective-city", payload.Name)
 	}
-	if payload.Path != cityPath {
-		t.Fatalf("payload.Path = %q, want %q", payload.Path, cityPath)
+	if payload.RequestID != "req-test-unregister" {
+		t.Fatalf("payload.RequestID = %q, want req-test-unregister", payload.RequestID)
+	}
+}
+
+func TestEmitCityUnregisterFailureEventUsesManagedCityName(t *testing.T) {
+	supRec := events.NewFake()
+	emitCityUnregisterTerminalEvent(
+		supRec,
+		"req-test-unregister",
+		"effective-city",
+		"/tmp/effective-city",
+		errors.New("city did not exit"),
+	)
+
+	recorded := supRec.Events
+	if len(recorded) != 1 {
+		t.Fatalf("recorded %d supervisor events, want 1", len(recorded))
+	}
+	got := recorded[0]
+	if got.Type != events.RequestFailed {
+		t.Fatalf("event.Type = %q, want %q", got.Type, events.RequestFailed)
+	}
+	if got.Subject != "effective-city" {
+		t.Fatalf("event.Subject = %q, want effective-city", got.Subject)
+	}
+	var payload api.RequestFailedPayload
+	if err := json.Unmarshal(got.Payload, &payload); err != nil {
+		t.Fatalf("json.Unmarshal(payload): %v", err)
+	}
+	if payload.RequestID != "req-test-unregister" {
+		t.Fatalf("payload.RequestID = %q, want req-test-unregister", payload.RequestID)
+	}
+	if payload.Operation != api.RequestOperationCityUnregister {
+		t.Fatalf("payload.Operation = %q, want %q", payload.Operation, api.RequestOperationCityUnregister)
+	}
+}
+
+func TestReconcileCitiesEmitsCityCreateFailureForPendingConfigLoadError(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+
+	cityPath := filepath.Join(t.TempDir(), "bad-city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	if err := reg.Register(cityPath, "bad-city"); err != nil {
+		t.Fatal(err)
+	}
+	supRec := events.NewFake()
+	registry := newCityRegistry()
+	registry.SetSupervisorRecorder(supRec)
+	if err := registry.StorePendingRequestID(cityPath, "req-test-create"); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
+
+	recorded := supRec.Events
+	if len(recorded) != 1 {
+		t.Fatalf("recorded %d supervisor events, want 1; stderr=%s", len(recorded), stderr.String())
+	}
+	got := recorded[0]
+	if got.Type != events.RequestFailed {
+		t.Fatalf("event.Type = %q, want %q", got.Type, events.RequestFailed)
+	}
+	if got.Subject != "bad-city" {
+		t.Fatalf("event.Subject = %q, want bad-city", got.Subject)
+	}
+	var payload api.RequestFailedPayload
+	if err := json.Unmarshal(got.Payload, &payload); err != nil {
+		t.Fatalf("json.Unmarshal(payload): %v", err)
+	}
+	if payload.RequestID != "req-test-create" {
+		t.Fatalf("payload.RequestID = %q, want req-test-create", payload.RequestID)
+	}
+	if payload.Operation != api.RequestOperationCityCreate {
+		t.Fatalf("payload.Operation = %q, want %q", payload.Operation, api.RequestOperationCityCreate)
+	}
+	if payload.ErrorCode != "city_config_failed" {
+		t.Fatalf("payload.ErrorCode = %q, want city_config_failed", payload.ErrorCode)
+	}
+	if _, ok, err := registry.ConsumePendingRequestID(cityPath); err != nil {
+		t.Fatal(err)
+	} else if ok {
+		t.Fatal("pending request_id survived city create failure")
+	}
+}
+
+func TestReconcileCitiesUnregisterSkipsRequestResultWithoutPendingRequestID(t *testing.T) {
+	t.Setenv("GC_HOME", t.TempDir())
+
+	cityPath := filepath.Join(t.TempDir(), "basename-city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	done := make(chan struct{})
+	close(done)
+	supRec := events.NewFake()
+	registry := newCityRegistry()
+	registry.SetSupervisorRecorder(supRec)
+	registry.Add(cityPath, &managedCity{
+		name:    "effective-city",
+		started: true,
+		cancel:  func() {},
+		done:    done,
+	})
+
+	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	var stdout, stderr bytes.Buffer
+	reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
+
+	if len(supRec.Events) != 0 {
+		t.Fatalf("recorded %d supervisor events without pending request_id, want 0: %#v", len(supRec.Events), supRec.Events)
 	}
 }
 
@@ -1317,6 +1440,7 @@ func TestCmdStopSupervisorManagedCityReliesOnSupervisorCleanup(t *testing.T) {
 	logFile := filepath.Join(t.TempDir(), "ops.log")
 	script := writeSpyScript(t, logFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 
 	withSupervisorTestHooks(
 		t,
@@ -1396,6 +1520,7 @@ func TestReconcileCitiesNameDriftStopsBeadsProvider(t *testing.T) {
 	logFile := filepath.Join(t.TempDir(), "ops.log")
 	script := writeSpyScript(t, logFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 
 	reg := supervisor.NewRegistry(supervisor.RegistryPath())
 	if err := reg.Register(cityPath, "new-name"); err != nil {
@@ -1405,7 +1530,7 @@ func TestReconcileCitiesNameDriftStopsBeadsProvider(t *testing.T) {
 	cfg := config.DefaultCity("old-name")
 	sp := runtime.NewFake()
 	var cityOut, cityErr bytes.Buffer
-	cr := newCityRuntime(CityRuntimeParams{
+	cr := newTestCityRuntime(t, CityRuntimeParams{
 		CityPath: cityPath,
 		CityName: "old-name",
 		Cfg:      &cfg,
@@ -1441,6 +1566,7 @@ func TestSupervisorCreatesControllerSocketForManagedCity(t *testing.T) {
 	t.Setenv("GC_HOME", gcHome)
 
 	cityPath := shortSocketTempDir(t, "gc-supervisor-city-")
+	cleanupManagedDoltTestCity(t, cityPath)
 	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -1452,6 +1578,7 @@ func TestSupervisorCreatesControllerSocketForManagedCity(t *testing.T) {
 	logFile := filepath.Join(t.TempDir(), "ops.log")
 	script := writeSpyScript(t, logFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 
 	reg := supervisor.NewRegistry(supervisor.RegistryPath())
 	if err := reg.Register(cityPath, "test-city"); err != nil {
@@ -1690,7 +1817,108 @@ func TestReconcileCitiesSkipsCityAlreadyInitializing(t *testing.T) {
 	})
 }
 
-func TestPublishManagedCityMarksRunningBeforeInitialReconcile(t *testing.T) {
+func TestReconcileCitiesAutoUnregistersAbsentDirectory(t *testing.T) {
+	gcHome := t.TempDir()
+	t.Setenv("GC_HOME", gcHome)
+
+	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	missingPath := filepath.Join(t.TempDir(), "gone-city")
+	if err := reg.Register(missingPath, "gone-city"); err != nil {
+		t.Fatal(err)
+	}
+
+	registry := newCityRegistry()
+	var stdout, stderr bytes.Buffer
+
+	for i := 0; i < staleCityDirAbsentThreshold; i++ {
+		reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
+	}
+
+	entries, err := reg.List()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range entries {
+		if e.Path == missingPath {
+			t.Fatalf("city %q should have been auto-unregistered after %d cycles, but is still registered", missingPath, staleCityDirAbsentThreshold)
+		}
+	}
+	if !strings.Contains(stderr.String(), "auto-unregistering") {
+		t.Fatalf("stderr should mention auto-unregistering, got: %s", stderr.String())
+	}
+}
+
+func TestReconcileCitiesDoesNotUnregisterBeforeThreshold(t *testing.T) {
+	gcHome := t.TempDir()
+	t.Setenv("GC_HOME", gcHome)
+
+	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	missingPath := filepath.Join(t.TempDir(), "gone-city")
+	if err := reg.Register(missingPath, "gone-city"); err != nil {
+		t.Fatal(err)
+	}
+
+	registry := newCityRegistry()
+	var stdout, stderr bytes.Buffer
+
+	for i := 0; i < staleCityDirAbsentThreshold-1; i++ {
+		reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
+	}
+
+	entries, err := reg.List()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found bool
+	for _, e := range entries {
+		if e.Path == missingPath {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("city %q should still be registered after %d cycles (threshold is %d)", missingPath, staleCityDirAbsentThreshold-1, staleCityDirAbsentThreshold)
+	}
+}
+
+func TestReconcileCitiesResetsAbsentCounterWhenDirectoryReappears(t *testing.T) {
+	gcHome := t.TempDir()
+	t.Setenv("GC_HOME", gcHome)
+
+	reg := supervisor.NewRegistry(supervisor.RegistryPath())
+	cityPath := filepath.Join(t.TempDir(), "flaky-city")
+	if err := reg.Register(cityPath, "flaky-city"); err != nil {
+		t.Fatal(err)
+	}
+
+	registry := newCityRegistry()
+	var stdout, stderr bytes.Buffer
+
+	for i := 0; i < staleCityDirAbsentThreshold-1; i++ {
+		reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
+	}
+
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	reconcileCities(reg, registry, supervisor.PublicationConfig{}, &stdout, &stderr)
+
+	var dirAbsent int
+	registry.ReadCallback(func(
+		_ map[string]*managedCity,
+		_ map[string]cityInitProgress,
+		initFailures map[string]*initFailRecord,
+		_ map[string]*panicRecord,
+	) {
+		if rec := initFailures[cityPath]; rec != nil {
+			dirAbsent = rec.dirAbsent
+		}
+	})
+	if dirAbsent != 0 {
+		t.Fatalf("dirAbsent = %d after directory reappeared, want 0", dirAbsent)
+	}
+}
+
+func TestPublishManagedCityWaitsForInitialReconcileBeforeRunning(t *testing.T) {
 	registry := newCityRegistry()
 	cityPath := "/tmp/bright-lights"
 	cs := &controllerState{}
@@ -1718,14 +1946,14 @@ func TestPublishManagedCityMarksRunningBeforeInitialReconcile(t *testing.T) {
 	if len(cities) != 1 {
 		t.Fatalf("ListCities() returned %d cities, want 1", len(cities))
 	}
-	if !cities[0].Running {
-		t.Fatalf("city Running = false, want true: %+v", cities[0])
+	if cities[0].Running {
+		t.Fatalf("city Running = true before startup reconcile: %+v", cities[0])
 	}
-	if cities[0].Status != "" {
-		t.Fatalf("city Status = %q, want empty once published", cities[0].Status)
+	if cities[0].Status != "starting_agents" {
+		t.Fatalf("city Status = %q, want starting_agents while startup reconcile runs", cities[0].Status)
 	}
-	if got := registry.CityState("bright-lights"); got != cs {
-		t.Fatalf("CityState() = %#v, want controller state", got)
+	if got := registry.CityState("bright-lights"); got != nil {
+		t.Fatalf("CityState() = %#v before startup reconcile, want nil", got)
 	}
 
 	registry.ReadCallback(func(
diff --git a/cmd/gc/cmd_supervisor_lifecycle.go b/cmd/gc/cmd_supervisor_lifecycle.go
index 8ee7a962e7..5f75a8dfa1 100644
--- a/cmd/gc/cmd_supervisor_lifecycle.go
+++ b/cmd/gc/cmd_supervisor_lifecycle.go
@@ -18,33 +18,324 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"syscall"
 	"text/template"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/searchpath"
 	"github.com/gastownhall/gascity/internal/supervisor"
 	"github.com/spf13/cobra"
 )
 
 var (
-	ensureSupervisorRunningHook = ensureSupervisorRunning
-	reloadSupervisorHook        = reloadSupervisor
-	supervisorAliveHook         = supervisorAlive
-	supervisorReadyTimeout      = 15 * time.Second
-	supervisorReadyPollInterval = 100 * time.Millisecond
-	supervisorLaunchctlRun      = func(args ...string) error {
+	ensureSupervisorRunningHook              = ensureSupervisorRunning
+	reloadSupervisorHook                     = reloadSupervisor
+	supervisorAliveHook                      = supervisorAlive
+	supervisorReadyTimeout                   = 15 * time.Second
+	supervisorReadyPollInterval              = 100 * time.Millisecond
+	supervisorSystemdWarmRefreshStopTimeout  = 5 * time.Second
+	supervisorSystemdWarmRefreshPollInterval = 100 * time.Millisecond
+	supervisorLaunchctlRun                   = func(args ...string) error {
 		return exec.Command("launchctl", args...).Run()
 	}
+	supervisorLaunchdActive = func(label string) bool {
+		out, err := exec.Command("launchctl", "print", supervisorLaunchdServiceTarget(label)).Output()
+		return err == nil && launchdPrintReportsRunning(out)
+	}
 	supervisorSystemctlRun = func(args ...string) error {
 		return exec.Command("systemctl", args...).Run()
 	}
 	supervisorSystemctlActive = func(service string) bool {
 		return exec.Command("systemctl", "--user", "is-active", "--quiet", service).Run() == nil
 	}
+	supervisorRunningPreserveSignalReady                = runningSupervisorPreserveSignalReady
+	supervisorProcRoot                                  = "/proc"
+	supervisorProcReadDir                               = os.ReadDir
+	supervisorProcReadFile                              = os.ReadFile
+	supervisorGetpgid                                   = syscall.Getpgid
+	supervisorGetpgrp                                   = syscall.Getpgrp
+	supervisorKill                                      = syscall.Kill
+	supervisorProcessGroupPollPeriod                    = 20 * time.Millisecond
+	supervisorRuntimeGOOS                               = goruntime.GOOS
+	supervisorWorkspaceServiceCleanupWarnings io.Writer = os.Stderr
 )
 
 const supervisorServiceFileMode os.FileMode = 0o600
 
+type supervisorWorkspaceServiceProcess struct {
+	pid  int
+	pgid int
+	name string
+}
+
+type supervisorWorkspaceServiceCleanupScope struct {
+	gcHome    string
+	cityPaths map[string]string
+}
+
+func launchdPrintReportsRunning(out []byte) bool {
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) == 3 && fields[0] == "state" && fields[1] == "=" && fields[2] == "running" {
+			return true
+		}
+	}
+	return false
+}
+
+func cleanupSupervisorWorkspaceServicesForWarmRefresh(gcHome string) error {
+	scope, err := supervisorWorkspaceServiceCleanupScopeFromRegistry(gcHome)
+	if err != nil {
+		return err
+	}
+	return cleanupSupervisorWorkspaceServices(scope)
+}
+
+func cleanupSupervisorWorkspaceServicesForSupervisorStart(gcHome string) error {
+	scope, err := supervisorWorkspaceServiceCleanupScopeFromRegistry(gcHome)
+	if err != nil {
+		return err
+	}
+	if supervisorRuntimeGOOS != "linux" {
+		if len(scope.cityPaths) > 0 {
+			warnSupervisorWorkspaceServiceCleanup("gc supervisor: workspace-service startup cleanup is not available on %s; after a non-graceful supervisor exit, stale workspace-service processes may keep sockets bound. Registered workspace-service roots: %s. Stop stale processes whose environment includes GC_SERVICE_STATE_ROOT under those roots, then restart those cities.\n", supervisorRuntimeGOOS, strings.Join(supervisorWorkspaceServiceStateRoots(scope), ", "))
+		}
+		return nil
+	}
+	if err := cleanupSupervisorWorkspaceServices(scope); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return err
+	}
+	return nil
+}
+
+func warnSupervisorWorkspaceServiceCleanup(format string, args ...any) {
+	if supervisorWorkspaceServiceCleanupWarnings == nil {
+		return
+	}
+	fmt.Fprintf(supervisorWorkspaceServiceCleanupWarnings, format, args...) //nolint:errcheck // best-effort operator diagnostic
+}
+
+func supervisorWorkspaceServiceStateRoots(scope supervisorWorkspaceServiceCleanupScope) []string {
+	roots := make([]string, 0, len(scope.cityPaths))
+	for cityPath := range scope.cityPaths {
+		roots = append(roots, citylayout.RuntimeServicesDir(cityPath))
+	}
+	sort.Strings(roots)
+	return roots
+}
+
+func cleanupSupervisorWorkspaceServices(scope supervisorWorkspaceServiceCleanupScope) error {
+	procs, err := findSupervisorWorkspaceServiceProcesses(scope)
+	if err != nil {
+		return err
+	}
+	var errs []error
+	for _, proc := range procs {
+		if err := terminateProcessGroup(proc.pgid, 2*time.Second); err != nil {
+			errs = append(errs, fmt.Errorf("stopping workspace service %q pid %d pgid %d: %w", proc.name, proc.pid, proc.pgid, err))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+func supervisorWorkspaceServiceCleanupScopeFromRegistry(gcHome string) (supervisorWorkspaceServiceCleanupScope, error) {
+	scope := supervisorWorkspaceServiceCleanupScope{
+		gcHome:    normalizePathForCompare(strings.TrimSpace(gcHome)),
+		cityPaths: make(map[string]string),
+	}
+	if scope.gcHome == "" {
+		return scope, errors.New("missing GC_HOME for workspace-service cleanup")
+	}
+	entries, err := supervisor.NewRegistry(supervisor.RegistryPath()).List()
+	if err != nil {
+		return scope, fmt.Errorf("reading supervisor registry for workspace-service cleanup: %w", err)
+	}
+	for _, entry := range entries {
+		cityPath := normalizePathForCompare(strings.TrimSpace(entry.Path))
+		if cityPath == "" {
+			continue
+		}
+		scope.cityPaths[cityPath] = cityPath
+	}
+	return scope, nil
+}
+
+func findSupervisorWorkspaceServiceProcesses(scope supervisorWorkspaceServiceCleanupScope) ([]supervisorWorkspaceServiceProcess, error) {
+	if strings.TrimSpace(scope.gcHome) == "" {
+		return nil, errors.New("missing GC_HOME for workspace-service cleanup")
+	}
+	if len(scope.cityPaths) == 0 {
+		return nil, nil
+	}
+	entries, err := supervisorProcReadDir(supervisorProcRoot)
+	if err != nil {
+		return nil, fmt.Errorf("reading /proc: %w", err)
+	}
+	seenPGID := make(map[int]supervisorWorkspaceServiceProcess)
+	var errs []error
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			continue
+		}
+		env, err := supervisorProcReadFile(filepath.Join(supervisorProcRoot, entry.Name(), "environ"))
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) || errors.Is(err, os.ErrPermission) {
+				continue
+			}
+			continue
+		}
+		envMap := supervisorProcessEnvMap(env)
+		if !supervisorWorkspaceServiceCandidateOwnedByScope(scope, envMap) {
+			continue
+		}
+		pgid, err := supervisorGetpgid(pid)
+		if err != nil {
+			if errors.Is(err, syscall.ESRCH) {
+				continue
+			}
+			errs = append(errs, fmt.Errorf("workspace service %q pid %d pgid: %w", envMap["GC_SERVICE_NAME"], pid, err))
+			continue
+		}
+		confirmedEnv, err := supervisorProcReadFile(filepath.Join(supervisorProcRoot, entry.Name(), "environ"))
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) || errors.Is(err, os.ErrPermission) {
+				continue
+			}
+			continue
+		}
+		confirmedEnvMap := supervisorProcessEnvMap(confirmedEnv)
+		if !supervisorWorkspaceServiceCandidateOwnedByScope(scope, confirmedEnvMap) ||
+			!sameSupervisorWorkspaceServiceCandidate(envMap, confirmedEnvMap) {
+			continue
+		}
+		if pgid <= 1 || pgid == supervisorGetpgrp() {
+			warnSupervisorWorkspaceServiceCleanup("gc supervisor: skipping workspace service %q pid %d with unsafe process group %d; leaving it running\n", envMap["GC_SERVICE_NAME"], pid, pgid)
+			continue
+		}
+		if _, ok := seenPGID[pgid]; !ok {
+			seenPGID[pgid] = supervisorWorkspaceServiceProcess{
+				pid:  pid,
+				pgid: pgid,
+				name: envMap["GC_SERVICE_NAME"],
+			}
+		}
+	}
+	if len(errs) > 0 {
+		return nil, errors.Join(errs...)
+	}
+	procs := make([]supervisorWorkspaceServiceProcess, 0, len(seenPGID))
+	for _, proc := range seenPGID {
+		procs = append(procs, proc)
+	}
+	sort.Slice(procs, func(i, j int) bool {
+		return procs[i].pgid < procs[j].pgid
+	})
+	return procs, nil
+}
+
+func supervisorWorkspaceServiceCandidateOwnedByScope(scope supervisorWorkspaceServiceCleanupScope, envMap map[string]string) bool {
+	if envMap["GC_SERVICE_SOCKET"] == "" || envMap["GC_SERVICE_NAME"] == "" || envMap["GC_SERVICE_STATE_ROOT"] == "" {
+		return false
+	}
+	return supervisorWorkspaceServiceOwnedByScope(scope, envMap)
+}
+
+func sameSupervisorWorkspaceServiceCandidate(before, after map[string]string) bool {
+	for _, key := range []string{
+		"GC_HOME",
+		"GC_CITY_PATH",
+		"GC_SERVICE_NAME",
+		"GC_SERVICE_STATE_ROOT",
+		"GC_SERVICE_SOCKET",
+	} {
+		if before[key] != after[key] {
+			return false
+		}
+	}
+	return true
+}
+
+func supervisorWorkspaceServiceOwnedByScope(scope supervisorWorkspaceServiceCleanupScope, envMap map[string]string) bool {
+	envHome := normalizePathForCompare(strings.TrimSpace(envMap["GC_HOME"]))
+	if envHome == "" || envHome != scope.gcHome {
+		return false
+	}
+	cityPath := normalizePathForCompare(strings.TrimSpace(envMap["GC_CITY_PATH"]))
+	if cityPath == "" {
+		return false
+	}
+	cityPath, ok := scope.cityPaths[cityPath]
+	if !ok {
+		return false
+	}
+	stateRoot := strings.TrimSpace(envMap["GC_SERVICE_STATE_ROOT"])
+	if stateRoot == "" {
+		return false
+	}
+	return pathWithinOrSame(stateRoot, citylayout.RuntimeServicesDir(cityPath))
+}
+
+func supervisorProcessEnvMap(data []byte) map[string]string {
+	env := make(map[string]string)
+	for _, item := range bytes.Split(data, []byte{0}) {
+		if len(item) == 0 {
+			continue
+		}
+		key, value, ok := bytes.Cut(item, []byte("="))
+		if !ok {
+			continue
+		}
+		env[string(key)] = string(value)
+	}
+	return env
+}
+
+func terminateProcessGroup(pgid int, timeout time.Duration) error {
+	if pgid <= 1 || pgid == supervisorGetpgrp() {
+		return fmt.Errorf("refusing to signal unsafe process group %d", pgid)
+	}
+	if err := supervisorKill(-pgid, syscall.SIGTERM); err != nil && !errors.Is(err, syscall.ESRCH) {
+		return err
+	}
+	if err := waitForProcessGroupExit(pgid, timeout); err == nil {
+		return nil
+	}
+	if err := supervisorKill(-pgid, syscall.SIGKILL); err != nil && !errors.Is(err, syscall.ESRCH) {
+		return err
+	}
+	return waitForProcessGroupExit(pgid, timeout)
+}
+
+func waitForProcessGroupExit(pgid int, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	for {
+		if !processGroupAlive(pgid) {
+			return nil
+		}
+		if time.Now().After(deadline) {
+			return fmt.Errorf("process group %d did not exit within %s", pgid, timeout)
+		}
+		time.Sleep(supervisorProcessGroupPollPeriod)
+	}
+}
+
+func processGroupAlive(pgid int) bool {
+	if pgid <= 0 {
+		return false
+	}
+	err := supervisorKill(-pgid, 0)
+	return err == nil || errors.Is(err, syscall.EPERM)
+}
+
 func newSupervisorRunCmd(stdout, stderr io.Writer) *cobra.Command {
 	return &cobra.Command{
 		Use:   "run",
@@ -299,8 +590,12 @@ func newSupervisorUninstallCmd(stdout, stderr io.Writer) *cobra.Command {
 	return &cobra.Command{
 		Use:   "uninstall",
 		Short: "Remove the platform service",
-		Long:  `Remove the platform service and stop the machine-wide supervisor.`,
-		Args:  cobra.NoArgs,
+		Long: `Remove the platform service and stop the machine-wide supervisor.
+
+On systemd, uninstall refuses to remove an active unit when the supervisor
+control socket is unavailable. Start the supervisor first so it can re-adopt
+preserved sessions, then retry uninstall.`,
+		Args: cobra.NoArgs,
 		RunE: func(_ *cobra.Command, _ []string) error {
 			if doSupervisorUninstall(stdout, stderr) != 0 {
 				return errExit
@@ -408,9 +703,10 @@ var providerCredentialEnvPrefixes = []string{
 }
 
 var supervisorServiceFixedEnvKeys = map[string]bool{
-	"GC_HOME":         true,
-	"PATH":            true,
-	"XDG_RUNTIME_DIR": true,
+	"GC_HOME":                             true,
+	supervisorPreserveSessionsOnSignalEnv: true,
+	"PATH":                                true,
+	"XDG_RUNTIME_DIR":                     true,
 }
 
 func supervisorServiceExtraEnv() []supervisorServiceEnvVar {
@@ -543,6 +839,8 @@ const supervisorLaunchdTemplate = `<?xml version="1.0" encoding="UTF-8"?>
         {{end}}
         <key>PATH</key>
         <string>{{xmlesc .Path}}</string>
+        <key>GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL</key>
+        <string>1</string>
         {{range .ExtraEnv}}
         <key>{{xmlesc .Name}}</key>
         <string>{{xmlesc .Value}}</string>
@@ -557,6 +855,11 @@ Description=Gas City machine supervisor
 
 [Service]
 Type=simple
+# Signal only the main supervisor PID on stop. The systemd default
+# (control-group) would cascade SIGTERM to tmux servers spawned by
+# 'gc supervisor run' that live in this cgroup, killing one-per-bead
+# session conversation history. The reconciler re-adopts tmux on start.
+KillMode=process
 ExecStart={{.GCPath}} supervisor run
 Restart=always
 RestartSec=5s
@@ -565,6 +868,7 @@ StandardError=append:{{.LogPath}}
 Environment=GC_HOME="{{.GCHome}}"
 {{if .XDGRuntimeDir}}Environment=XDG_RUNTIME_DIR="{{.XDGRuntimeDir}}"
 {{end}}Environment=PATH="{{.Path}}"
+Environment=GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL="1"
 {{range .ExtraEnv}}Environment={{systemdenv .Name .Value}}
 {{end}}
 
@@ -613,6 +917,48 @@ func supervisorLaunchdPlistPath() string {
 	return filepath.Join(home, "Library", "LaunchAgents", supervisorLaunchdLabel()+".plist")
 }
 
+func supervisorLaunchdServiceTarget(label string) string {
+	if label == "" {
+		label = supervisorLaunchdLabel()
+	}
+	return "gui/" + strconv.Itoa(os.Getuid()) + "/" + label
+}
+
+func loadAndStartSupervisorLaunchd(path, label string) error {
+	if err := supervisorLaunchctlRun("load", path); err != nil {
+		return fmt.Errorf("load %s: %w", path, err)
+	}
+	target := supervisorLaunchdServiceTarget(label)
+	if err := supervisorLaunchctlRun("enable", target); err != nil {
+		return fmt.Errorf("enable %s: %w", target, err)
+	}
+	if err := supervisorLaunchctlRun("kickstart", "-p", target); err != nil {
+		return fmt.Errorf("kickstart -p %s: %w", target, err)
+	}
+	return nil
+}
+
+func loadAndStartSupervisorLaunchdForRollback(path, label string, stderr io.Writer) error {
+	if err := supervisorLaunchctlRun("load", path); err != nil {
+		return fmt.Errorf("load %s: %w", path, err)
+	}
+	target := supervisorLaunchdServiceTarget(label)
+	if err := supervisorLaunchctlRun("enable", target); err != nil {
+		warnSupervisorLaunchdRollback(stderr, "enable %s: %v", target, err)
+	}
+	if err := supervisorLaunchctlRun("kickstart", "-p", target); err != nil {
+		warnSupervisorLaunchdRollback(stderr, "kickstart -p %s: %v", target, err)
+	}
+	return nil
+}
+
+func warnSupervisorLaunchdRollback(stderr io.Writer, format string, args ...any) {
+	if stderr == nil {
+		return
+	}
+	fmt.Fprintf(stderr, "gc supervisor install: warning: restoring launchd service: "+format+"\n", args...) //nolint:errcheck // best-effort stderr
+}
+
 func legacySupervisorLaunchdPlistPath() string {
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, "Library", "LaunchAgents", defaultSupervisorLaunchdLabel+".plist")
@@ -786,6 +1132,7 @@ func unloadLegacySupervisorLaunchd(remove bool) error {
 	}
 	_ = supervisorLaunchctlRun("unload", path)
 	if remove {
+		_ = supervisorLaunchctlRun("disable", supervisorLaunchdServiceTarget(defaultSupervisorLaunchdLabel))
 		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
 			return fmt.Errorf("removing legacy plist %s: %w", path, err)
 		}
@@ -808,26 +1155,26 @@ func unloadLegacySupervisorSystemd(remove bool) error {
 	return nil
 }
 
-func rollbackNewSupervisorLaunchdInstall(path string, restoreLegacy bool) error {
+func rollbackNewSupervisorLaunchdInstall(path string, restoreLegacy bool, stderr io.Writer) error {
 	var errs []error
 	_ = supervisorLaunchctlRun("unload", path)
 	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
 		errs = append(errs, fmt.Errorf("removing failed plist %s during rollback: %w", path, err))
 	}
 	if restoreLegacy {
-		if err := supervisorLaunchctlRun("load", legacySupervisorLaunchdPlistPath()); err != nil {
+		if err := loadAndStartSupervisorLaunchdForRollback(legacySupervisorLaunchdPlistPath(), defaultSupervisorLaunchdLabel, stderr); err != nil {
 			errs = append(errs, fmt.Errorf("restoring legacy plist %s: %w", legacySupervisorLaunchdPlistPath(), err))
 		}
 	}
 	return errors.Join(errs...)
 }
 
-func restorePreviousSupervisorLaunchdInstall(path string, previousContent []byte) error {
+func restorePreviousSupervisorLaunchdInstall(path string, previousContent []byte, stderr io.Writer) error {
 	var errs []error
 	_ = supervisorLaunchctlRun("unload", path)
 	if err := writeSupervisorServiceFile(path, previousContent); err != nil {
 		errs = append(errs, fmt.Errorf("restoring previous plist %s: %w", path, err))
-	} else if err := supervisorLaunchctlRun("load", path); err != nil {
+	} else if err := loadAndStartSupervisorLaunchdForRollback(path, supervisorLaunchdLabel(), stderr); err != nil {
 		errs = append(errs, fmt.Errorf("reloading previous plist %s: %w", path, err))
 	}
 	return errors.Join(errs...)
@@ -874,6 +1221,10 @@ func restorePreviousSupervisorSystemdInstall(path, service string, previousConte
 	return errors.Join(errs...)
 }
 
+func warnSupervisorSystemdWarmRefreshPreservedUnit(stderr io.Writer, service string) {
+	fmt.Fprintf(stderr, "gc supervisor install: leaving refreshed systemd unit %s in place after warm-refresh failure; not restoring the previous unit because it may lack KillMode=process. Resolve the error, then run 'systemctl --user start %s' or rerun 'gc supervisor install'.\n", service, service) //nolint:errcheck // best-effort stderr
+}
+
 func installSupervisorLaunchd(data *supervisorServiceData, stdout, stderr io.Writer) int {
 	content, err := renderSupervisorTemplate(supervisorLaunchdTemplate, data)
 	if err != nil {
@@ -903,17 +1254,17 @@ func installSupervisorLaunchd(data *supervisorServiceData, stdout, stderr io.Wri
 	}
 
 	_ = supervisorLaunchctlRun("unload", path)
-	if err := supervisorLaunchctlRun("load", path); err != nil {
+	if err := loadAndStartSupervisorLaunchd(path, data.LaunchdLabel); err != nil {
 		var rollbackErr error
 		if hadCurrent {
-			rollbackErr = restorePreviousSupervisorLaunchdInstall(path, existing)
+			rollbackErr = restorePreviousSupervisorLaunchdInstall(path, existing, stderr)
 		} else {
-			rollbackErr = rollbackNewSupervisorLaunchdInstall(path, legacyPresent)
+			rollbackErr = rollbackNewSupervisorLaunchdInstall(path, legacyPresent, stderr)
 		}
 		if rollbackErr != nil {
-			fmt.Fprintf(stderr, "gc supervisor install: rollback after launchctl load failure: %v\n", rollbackErr) //nolint:errcheck // best-effort stderr
+			fmt.Fprintf(stderr, "gc supervisor install: rollback after launchctl failure: %v\n", rollbackErr) //nolint:errcheck // best-effort stderr
 		}
-		fmt.Fprintf(stderr, "gc supervisor install: launchctl load: %v\n", err) //nolint:errcheck // best-effort stderr
+		fmt.Fprintf(stderr, "gc supervisor install: launchctl %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
 	}
 	if err := unloadLegacySupervisorLaunchd(true); err != nil {
@@ -926,7 +1277,17 @@ func installSupervisorLaunchd(data *supervisorServiceData, stdout, stderr io.Wri
 
 func uninstallSupervisorLaunchd(_ *supervisorServiceData, stdout, stderr io.Writer) int {
 	path := supervisorLaunchdPlistPath()
+	active := supervisorLaunchdActive(supervisorLaunchdLabel())
+	if sockPath, _ := runningSupervisorSocket(); sockPath != "" {
+		if code := stopSupervisorWithWait(stdout, stderr, true, 30*time.Second); code != 0 {
+			return code
+		}
+	} else if active {
+		fmt.Fprintf(stderr, "gc supervisor uninstall: launchd service %s is active but the control socket is unavailable; run 'gc supervisor start' to re-adopt sessions, then retry uninstall\n", supervisorLaunchdLabel()) //nolint:errcheck // best-effort stderr
+		return 1
+	}
 	_ = supervisorLaunchctlRun("unload", path)
+	_ = supervisorLaunchctlRun("disable", supervisorLaunchdServiceTarget(supervisorLaunchdLabel()))
 	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
 		fmt.Fprintf(stderr, "gc supervisor uninstall: removing plist: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -939,6 +1300,54 @@ func uninstallSupervisorLaunchd(_ *supervisorServiceData, stdout, stderr io.Writ
 	return 0
 }
 
+func waitSupervisorSystemdInactive(service string, timeout time.Duration) bool {
+	if !supervisorSystemctlActive(service) {
+		return true
+	}
+	if timeout <= 0 {
+		return false
+	}
+	poll := supervisorSystemdWarmRefreshPollInterval
+	if poll <= 0 {
+		poll = time.Millisecond
+	}
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		time.Sleep(poll)
+		if !supervisorSystemctlActive(service) {
+			return true
+		}
+	}
+	return !supervisorSystemctlActive(service)
+}
+
+func runningSupervisorPreserveSignalReady() (int, bool, error) {
+	_, pid := runningSupervisorSocket()
+	if pid <= 0 {
+		return 0, false, errors.New("active supervisor control socket is unavailable")
+	}
+	env, err := supervisorProcReadFile(filepath.Join(supervisorProcRoot, strconv.Itoa(pid), "environ"))
+	if err != nil {
+		return pid, false, fmt.Errorf("reading active supervisor pid %d environment: %w", pid, err)
+	}
+	return pid, supervisorProcessEnvMap(env)[supervisorPreserveSessionsOnSignalEnv] == "1", nil
+}
+
+func stopSupervisorSystemdForWarmRefresh(service string) ([]string, error) {
+	termArgs := []string{"--user", "kill", "--kill-who=main", "--signal=SIGTERM", service}
+	if err := supervisorSystemctlRun(termArgs...); err != nil {
+		return termArgs, err
+	}
+	if waitSupervisorSystemdInactive(service, supervisorSystemdWarmRefreshStopTimeout) {
+		return termArgs, nil
+	}
+	killArgs := []string{"--user", "kill", "--kill-who=main", "--signal=SIGKILL", service}
+	if err := supervisorSystemctlRun(killArgs...); err != nil {
+		return killArgs, err
+	}
+	return killArgs, nil
+}
+
 func installSupervisorSystemd(data *supervisorServiceData, stdout, stderr io.Writer) int {
 	content, err := renderSupervisorTemplate(supervisorSystemdTemplate, data)
 	if err != nil {
@@ -960,6 +1369,18 @@ func installSupervisorSystemd(data *supervisorServiceData, stdout, stderr io.Wri
 		return 1
 	}
 	contentChanged := string(existing) != content
+	active := supervisorSystemctlActive(service)
+	if contentChanged && active {
+		pid, ready, err := supervisorRunningPreserveSignalReady()
+		if err != nil {
+			fmt.Fprintf(stderr, "gc supervisor install: cannot verify active supervisor preserve-mode readiness: %v. Refusing systemd warm refresh because signaling an older supervisor can stop managed sessions. Stop or drain agents intentionally with 'gc supervisor stop --wait', then rerun 'gc supervisor install'.\n", err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+		if !ready {
+			fmt.Fprintf(stderr, "gc supervisor install: active supervisor pid %d does not have %s=1. Refusing systemd warm refresh because this first post-upgrade install would stop managed sessions. Stop or drain agents intentionally with 'gc supervisor stop --wait', then rerun 'gc supervisor install'.\n", pid, supervisorPreserveSessionsOnSignalEnv) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+	}
 	if err := writeSupervisorServiceFile(path, []byte(content)); err != nil {
 		fmt.Fprintf(stderr, "gc supervisor install: writing unit: %v\n", err) //nolint:errcheck // best-effort stderr
 		return 1
@@ -988,9 +1409,9 @@ func installSupervisorSystemd(data *supervisorServiceData, stdout, stderr io.Wri
 		return 1
 	}
 
-	if contentChanged && supervisorSystemctlActive(service) {
-		args := []string{"--user", "restart", service}
-		if err := supervisorSystemctlRun(args...); err != nil {
+	if contentChanged && active {
+		stopArgs, err := stopSupervisorSystemdForWarmRefresh(service)
+		if err != nil {
 			var rollbackErr error
 			if hadCurrent {
 				rollbackErr = restorePreviousSupervisorSystemdInstall(path, service, existing, true)
@@ -998,12 +1419,24 @@ func installSupervisorSystemd(data *supervisorServiceData, stdout, stderr io.Wri
 				rollbackErr = rollbackNewSupervisorSystemdInstall(path, service, legacyPresent)
 			}
 			if rollbackErr != nil {
-				fmt.Fprintf(stderr, "gc supervisor install: rollback after systemctl %s failure: %v\n", strings.Join(args, " "), rollbackErr) //nolint:errcheck // best-effort stderr
+				fmt.Fprintf(stderr, "gc supervisor install: rollback after systemctl %s failure: %v\n", strings.Join(stopArgs, " "), rollbackErr) //nolint:errcheck // best-effort stderr
 			}
-			fmt.Fprintf(stderr, "gc supervisor install: systemctl %s: %v\n", strings.Join(args, " "), err) //nolint:errcheck // best-effort stderr
+			fmt.Fprintf(stderr, "gc supervisor install: systemctl %s: %v\n", strings.Join(stopArgs, " "), err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+		if err := cleanupSupervisorWorkspaceServicesForWarmRefresh(data.GCHome); err != nil {
+			warnSupervisorSystemdWarmRefreshPreservedUnit(stderr, service)
+			fmt.Fprintf(stderr, "gc supervisor install: workspace-service cleanup after systemctl %s: %v\n", strings.Join(stopArgs, " "), err) //nolint:errcheck // best-effort stderr
 			return 1
 		}
-	} else if !supervisorSystemctlActive(service) {
+		_ = supervisorSystemctlRun("--user", "reset-failed", service)
+		startArgs := []string{"--user", "start", service}
+		if err := supervisorSystemctlRun(startArgs...); err != nil {
+			warnSupervisorSystemdWarmRefreshPreservedUnit(stderr, service)
+			fmt.Fprintf(stderr, "gc supervisor install: systemctl %s: %v\n", strings.Join(startArgs, " "), err) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+	} else if !active {
 		args := []string{"--user", "start", service}
 		if err := supervisorSystemctlRun(args...); err != nil {
 			var rollbackErr error
@@ -1032,6 +1465,16 @@ func installSupervisorSystemd(data *supervisorServiceData, stdout, stderr io.Wri
 func uninstallSupervisorSystemd(_ *supervisorServiceData, stdout, stderr io.Writer) int {
 	path := supervisorSystemdServicePath()
 	service := supervisorSystemdServiceName()
+	active := supervisorSystemctlActive(service)
+	if active {
+		if sockPath, _ := runningSupervisorSocket(); sockPath == "" {
+			fmt.Fprintf(stderr, "gc supervisor uninstall: systemd service %s is active but the control socket is unavailable; run 'gc supervisor start' to re-adopt sessions, then retry uninstall\n", service) //nolint:errcheck // best-effort stderr
+			return 1
+		}
+		if code := stopSupervisorWithWait(stdout, stderr, true, 30*time.Second); code != 0 {
+			return code
+		}
+	}
 	_ = supervisorSystemctlRun("--user", "stop", service)
 	_ = supervisorSystemctlRun("--user", "disable", service)
 	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
diff --git a/cmd/gc/cmd_supervisor_test.go b/cmd/gc/cmd_supervisor_test.go
index 51e5731991..31a1a41ba8 100644
--- a/cmd/gc/cmd_supervisor_test.go
+++ b/cmd/gc/cmd_supervisor_test.go
@@ -3,10 +3,12 @@ package main
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"errors"
 	"io"
 	"net"
 	"os"
+	"os/exec"
 	"os/user"
 	"path/filepath"
 	goruntime "runtime"
@@ -14,13 +16,16 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"testing"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/supervisor"
+	"github.com/gastownhall/gascity/internal/workspacesvc"
 )
 
 type closerSpy struct {
@@ -32,6 +37,115 @@ func (c *closerSpy) Close() error {
 	return nil
 }
 
+type lockedBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (b *lockedBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.Write(p)
+}
+
+func (b *lockedBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.String()
+}
+
+type workspaceServiceSentinel struct {
+	pgid int
+}
+
+func stubSupervisorRunningPreserveSignalReady(t *testing.T, ready bool) {
+	t.Helper()
+	old := supervisorRunningPreserveSignalReady
+	supervisorRunningPreserveSignalReady = func() (int, bool, error) {
+		return 4242, ready, nil
+	}
+	t.Cleanup(func() {
+		supervisorRunningPreserveSignalReady = old
+	})
+}
+
+func startWorkspaceServiceSentinel(t *testing.T, gcHome, cityPath, serviceName string) workspaceServiceSentinel {
+	t.Helper()
+	stateRoot := filepath.Join(cityPath, ".gc", "services", serviceName)
+	socketPath := filepath.Join(t.TempDir(), serviceName+".sock")
+	cmd := exec.Command("sh", "-c", "trap 'exit 0' TERM; while :; do sleep 1; done")
+	cmd.Env = append(os.Environ(),
+		"GC_HOME="+gcHome,
+		"GC_CITY_PATH="+cityPath,
+		"GC_SERVICE_NAME="+serviceName,
+		"GC_SERVICE_STATE_ROOT="+stateRoot,
+		"GC_SERVICE_SOCKET="+socketPath,
+	)
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Start workspace-service sentinel %q: %v", serviceName, err)
+	}
+	pgid, err := syscall.Getpgid(cmd.Process.Pid)
+	if err != nil {
+		t.Fatalf("Getpgid(%d): %v", cmd.Process.Pid, err)
+	}
+	waitCh := make(chan error, 1)
+	go func() {
+		waitCh <- cmd.Wait()
+	}()
+	t.Cleanup(func() {
+		if processGroupAlive(pgid) {
+			_ = syscall.Kill(-pgid, syscall.SIGKILL)
+		}
+		select {
+		case <-waitCh:
+		case <-time.After(time.Second):
+			t.Logf("workspace-service sentinel pgid %d did not exit before cleanup timeout", pgid)
+		}
+	})
+	if !processGroupAlive(pgid) {
+		t.Fatalf("workspace-service sentinel pgid %d is not alive", pgid)
+	}
+	return workspaceServiceSentinel{pgid: pgid}
+}
+
+func writeSupervisorProcEnv(t *testing.T, procRoot string, pid int, env map[string]string) {
+	t.Helper()
+	dir := filepath.Join(procRoot, strconv.Itoa(pid))
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", dir, err)
+	}
+	var data []byte
+	for key, value := range env {
+		data = append(data, (key + "=" + value)...)
+		data = append(data, 0)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "environ"), data, 0o644); err != nil {
+		t.Fatalf("WriteFile(environ): %v", err)
+	}
+}
+
+func setSupervisorProcTestHooks(t *testing.T, procRoot string, getpgid func(int) (int, error)) {
+	t.Helper()
+	oldRoot := supervisorProcRoot
+	oldReadDir := supervisorProcReadDir
+	oldReadFile := supervisorProcReadFile
+	oldGetpgid := supervisorGetpgid
+	oldGetpgrp := supervisorGetpgrp
+	supervisorProcRoot = procRoot
+	supervisorProcReadDir = os.ReadDir
+	supervisorProcReadFile = os.ReadFile
+	supervisorGetpgid = getpgid
+	supervisorGetpgrp = func() int { return 4242 }
+	t.Cleanup(func() {
+		supervisorProcRoot = oldRoot
+		supervisorProcReadDir = oldReadDir
+		supervisorProcReadFile = oldReadFile
+		supervisorGetpgid = oldGetpgid
+		supervisorGetpgrp = oldGetpgrp
+	})
+}
+
 func startTestSupervisorSocket(t *testing.T, sockPath string, handler func(string) string) {
 	t.Helper()
 	if err := os.MkdirAll(filepath.Dir(sockPath), 0o700); err != nil {
@@ -228,6 +342,8 @@ func TestRenderSupervisorLaunchdTemplate(t *testing.T) {
 		"<string>sk-&amp;&lt;&quot;&apos;&gt;</string>",
 		"<key>OPENAI_API_KEY</key>",
 		"<string>sk-openai-123</string>",
+		"<key>GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL</key>",
+		"<string>1</string>",
 	} {
 		if !strings.Contains(content, check) {
 			t.Fatalf("launchd template missing %q", check)
@@ -235,6 +351,27 @@ func TestRenderSupervisorLaunchdTemplate(t *testing.T) {
 	}
 }
 
+func TestRenderSupervisorLaunchdTemplateUsesPreserveEnvFromData(t *testing.T) {
+	content, err := renderSupervisorTemplate(supervisorLaunchdTemplate, &supervisorServiceData{
+		GCPath:       "/usr/local/bin/gc",
+		LogPath:      "/home/user/.gc/supervisor.log",
+		GCHome:       "/home/user/.gc",
+		LaunchdLabel: defaultSupervisorLaunchdLabel,
+		Path:         "/usr/local/bin:/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{
+		"<key>GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL</key>",
+		"<string>1</string>",
+	} {
+		if !strings.Contains(content, want) {
+			t.Fatalf("launchd template missing preserve env %q:\n%s", want, content)
+		}
+	}
+}
+
 func TestRenderSupervisorSystemdTemplate(t *testing.T) {
 	data := &supervisorServiceData{
 		GCPath:        "/usr/local/bin/gc",
@@ -256,6 +393,8 @@ func TestRenderSupervisorSystemdTemplate(t *testing.T) {
 
 	for _, check := range []string{
 		"[Service]",
+		`KillMode=process`,
+		`Environment=GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL="1"`,
 		`ExecStart=/usr/local/bin/gc supervisor run`,
 		`StandardOutput=append:/home/user/.gc/supervisor.log`,
 		`Environment=GC_HOME="/home/user/.gc"`,
@@ -268,6 +407,63 @@ func TestRenderSupervisorSystemdTemplate(t *testing.T) {
 			t.Fatalf("systemd template missing %q", check)
 		}
 	}
+	wantBlock := "[Service]\nType=simple\n# Signal only the main supervisor PID on stop. The systemd default\n" +
+		"# (control-group) would cascade SIGTERM to tmux servers spawned by\n" +
+		"# 'gc supervisor run' that live in this cgroup, killing one-per-bead\n" +
+		"# session conversation history. The reconciler re-adopts tmux on start.\n" +
+		"KillMode=process\nExecStart=/usr/local/bin/gc supervisor run\n"
+	if !strings.Contains(content, wantBlock) {
+		t.Fatalf("systemd template missing ordered KillMode=process block under [Service]; got:\n%s", content)
+	}
+}
+
+func TestRenderSupervisorSystemdTemplateUsesPreserveEnvFromData(t *testing.T) {
+	content, err := renderSupervisorTemplate(supervisorSystemdTemplate, &supervisorServiceData{
+		GCPath:  "/usr/local/bin/gc",
+		LogPath: "/home/user/.gc/supervisor.log",
+		GCHome:  "/home/user/.gc",
+		Path:    "/usr/local/bin:/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := `Environment=GC_SUPERVISOR_PRESERVE_SESSIONS_ON_SIGNAL="1"`
+	if !strings.Contains(content, want) {
+		t.Fatalf("systemd template missing preserve env %q:\n%s", want, content)
+	}
+}
+
+func TestBuildSupervisorServiceDataTreatsPreserveSignalEnvAsFixed(t *testing.T) {
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", filepath.Join(homeDir, ".gc"))
+	t.Setenv("PATH", "/usr/local/bin:/usr/bin:/bin")
+	t.Setenv("GC_SUPERVISOR_ENV", supervisorPreserveSessionsOnSignalEnv)
+	t.Setenv(supervisorPreserveSessionsOnSignalEnv, "0")
+
+	data, err := buildSupervisorServiceData()
+	if err != nil {
+		t.Fatalf("buildSupervisorServiceData: %v", err)
+	}
+	if got := supervisorServiceEnvMap(data.ExtraEnv); got[supervisorPreserveSessionsOnSignalEnv] != "" {
+		t.Fatalf("ExtraEnv[%s] = %q, want omitted fixed value (all env: %#v)", supervisorPreserveSessionsOnSignalEnv, got[supervisorPreserveSessionsOnSignalEnv], got)
+	}
+
+	launchdContent, err := renderSupervisorTemplate(supervisorLaunchdTemplate, data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if count := strings.Count(launchdContent, supervisorPreserveSessionsOnSignalEnv); count != 1 {
+		t.Fatalf("launchd preserve env occurrences = %d, want 1:\n%s", count, launchdContent)
+	}
+
+	systemdContent, err := renderSupervisorTemplate(supervisorSystemdTemplate, data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if count := strings.Count(systemdContent, supervisorPreserveSessionsOnSignalEnv); count != 1 {
+		t.Fatalf("systemd preserve env occurrences = %d, want 1:\n%s", count, systemdContent)
+	}
 }
 
 func TestBuildSupervisorServiceDataIncludesProviderEnv(t *testing.T) {
@@ -569,6 +765,37 @@ func TestSupervisorServiceSuffixDoesNotFallBackWhenBasenameSanitizesEmpty(t *tes
 	}
 }
 
+func TestLaunchdPrintReportsRunningAnchorsStateLine(t *testing.T) {
+	tests := []struct {
+		name string
+		out  string
+		want bool
+	}{
+		{
+			name: "top-level running state",
+			out:  "gui/501/com.gascity.supervisor = {\n\tstate = running\n\tprogram = /usr/local/bin/gc\n}\n",
+			want: true,
+		},
+		{
+			name: "stopped state with nested running text",
+			out:  "gui/501/com.gascity.supervisor = {\n\tstate = waiting\n\tlast exit code = 0\n\tpath = /tmp/state = running.log\n}\n",
+			want: false,
+		},
+		{
+			name: "running suffix is not a state token",
+			out:  "gui/501/com.gascity.supervisor = {\n\tstate = running-old\n}\n",
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := launchdPrintReportsRunning([]byte(tt.out)); got != tt.want {
+				t.Fatalf("launchdPrintReportsRunning() = %v, want %v for output:\n%s", got, tt.want, tt.out)
+			}
+		})
+	}
+}
+
 func TestSupervisorInstallUnsupportedOS(t *testing.T) {
 	if goruntime.GOOS == "darwin" || goruntime.GOOS == "linux" {
 		t.Skip("unsupported-os test only applies outside darwin/linux")
@@ -582,7 +809,7 @@ func TestSupervisorInstallUnsupportedOS(t *testing.T) {
 	}
 }
 
-func TestInstallSupervisorSystemdRestartsWhenUnitChangesAndServiceActive(t *testing.T) {
+func TestInstallSupervisorSystemdWarmRefreshGracefullySignalsMainPIDWhenUnitChangesAndServiceActive(t *testing.T) {
 	if goruntime.GOOS != "linux" {
 		t.Skip("systemd path only applies on linux")
 	}
@@ -609,12 +836,22 @@ func TestInstallSupervisorSystemdRestartsWhenUnitChangesAndServiceActive(t *test
 	oldActive := supervisorSystemctlActive
 	var calls []string
 	supervisorSystemctlRun = func(args ...string) error {
-		calls = append(calls, strings.Join(args, " "))
+		call := strings.Join(args, " ")
+		calls = append(calls, call)
 		return nil
 	}
 	supervisorSystemctlActive = func(service string) bool {
-		return service == "gascity-supervisor.service"
+		if service != "gascity-supervisor.service" {
+			return false
+		}
+		for _, call := range calls {
+			if call == "--user kill --kill-who=main --signal=SIGTERM "+service {
+				return false
+			}
+		}
+		return true
 	}
+	stubSupervisorRunningPreserveSignalReady(t, true)
 	t.Cleanup(func() {
 		supervisorSystemctlRun = oldRun
 		supervisorSystemctlActive = oldActive
@@ -628,14 +865,19 @@ func TestInstallSupervisorSystemdRestartsWhenUnitChangesAndServiceActive(t *test
 	for _, want := range []string{
 		"--user daemon-reload",
 		"--user enable gascity-supervisor.service",
-		"--user restart gascity-supervisor.service",
+		"--user kill --kill-who=main --signal=SIGTERM gascity-supervisor.service",
+		"--user reset-failed gascity-supervisor.service",
+		"--user start gascity-supervisor.service",
 	} {
 		if !strings.Contains(joined, want) {
 			t.Fatalf("systemctl calls = %v, want %q", calls, want)
 		}
 	}
-	if strings.Contains(joined, "--user start gascity-supervisor.service") {
-		t.Fatalf("systemctl calls = %v, should restart instead of start when unit changes under an active service", calls)
+	if strings.Contains(joined, "--user restart gascity-supervisor.service") {
+		t.Fatalf("systemctl calls = %v, should signal the old main PID before starting the refreshed unit", calls)
+	}
+	if strings.Contains(joined, "--signal=SIGKILL") {
+		t.Fatalf("systemctl calls = %v, should not hard-kill after graceful warm-refresh stop succeeds", calls)
 	}
 	info, err := os.Stat(path)
 	if err != nil {
@@ -646,7 +888,7 @@ func TestInstallSupervisorSystemdRestartsWhenUnitChangesAndServiceActive(t *test
 	}
 }
 
-func TestInstallSupervisorSystemdWritesPrivateUnitFile(t *testing.T) {
+func TestInstallSupervisorSystemdWarmRefreshRefusesActivePrePreserveSupervisor(t *testing.T) {
 	if goruntime.GOOS != "linux" {
 		t.Skip("systemd path only applies on linux")
 	}
@@ -655,42 +897,59 @@ func TestInstallSupervisorSystemdWritesPrivateUnitFile(t *testing.T) {
 	t.Setenv("GC_HOME", filepath.Join(homeDir, ".gc"))
 
 	data := &supervisorServiceData{
-		GCPath:  "/tmp/gc-new",
-		LogPath: "/tmp/gc-home/supervisor.log",
-		GCHome:  "/tmp/gc-home",
-		Path:    "/usr/local/bin:/usr/bin:/bin",
-		ExtraEnv: []supervisorServiceEnvVar{
-			{Name: "OPENAI_API_KEY", Value: "sk-openai-123"},
-		},
+		GCPath:        "/tmp/gc-new",
+		LogPath:       "/tmp/gc-home/supervisor.log",
+		GCHome:        "/tmp/gc-home",
+		XDGRuntimeDir: "/tmp/gc-run",
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+	path := supervisorSystemdServicePath()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	previous := []byte("old unit\n")
+	if err := os.WriteFile(path, previous, 0o644); err != nil {
+		t.Fatal(err)
 	}
 
 	oldRun := supervisorSystemctlRun
 	oldActive := supervisorSystemctlActive
-	supervisorSystemctlRun = func(_ ...string) error {
+	var calls []string
+	supervisorSystemctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
 		return nil
 	}
-	supervisorSystemctlActive = func(_ string) bool {
-		return false
+	supervisorSystemctlActive = func(service string) bool {
+		return service == "gascity-supervisor.service"
 	}
+	stubSupervisorRunningPreserveSignalReady(t, false)
 	t.Cleanup(func() {
 		supervisorSystemctlRun = oldRun
 		supervisorSystemctlActive = oldActive
 	})
 
 	var stdout, stderr bytes.Buffer
-	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 0 {
-		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 1 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 1; stderr=%q", code, stderr.String())
 	}
-	info, err := os.Stat(supervisorSystemdServicePath())
+	if len(calls) != 0 {
+		t.Fatalf("systemctl calls = %v, want none before preserve-mode migration guard passes", calls)
+	}
+	gotContent, err := os.ReadFile(path)
 	if err != nil {
-		t.Fatalf("Stat(%q): %v", supervisorSystemdServicePath(), err)
+		t.Fatalf("ReadFile(%q): %v", path, err)
 	}
-	if got := info.Mode().Perm(); got != 0o600 {
-		t.Fatalf("systemd unit mode = %03o, want 600", got)
+	if !bytes.Equal(gotContent, previous) {
+		t.Fatalf("unit content changed despite guarded warm refresh: got %q want %q", gotContent, previous)
+	}
+	for _, want := range []string{"does not have " + supervisorPreserveSessionsOnSignalEnv, "gc supervisor stop --wait"} {
+		if !strings.Contains(stderr.String(), want) {
+			t.Fatalf("stderr = %q, want %q", stderr.String(), want)
+		}
 	}
 }
 
-func TestInstallSupervisorSystemdStartsInactiveService(t *testing.T) {
+func TestInstallSupervisorSystemdWarmRefreshFallsBackToKillWhenGracefulSignalDoesNotStop(t *testing.T) {
 	if goruntime.GOOS != "linux" {
 		t.Skip("systemd path only applies on linux")
 	}
@@ -705,20 +964,33 @@ func TestInstallSupervisorSystemdStartsInactiveService(t *testing.T) {
 		XDGRuntimeDir: "/tmp/gc-run",
 		Path:          "/usr/local/bin:/usr/bin:/bin",
 	}
+	path := supervisorSystemdServicePath()
+	service := supervisorSystemdServiceName()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("old unit\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	oldRun := supervisorSystemctlRun
 	oldActive := supervisorSystemctlActive
+	oldTimeout := supervisorSystemdWarmRefreshStopTimeout
+	oldPoll := supervisorSystemdWarmRefreshPollInterval
 	var calls []string
 	supervisorSystemctlRun = func(args ...string) error {
 		calls = append(calls, strings.Join(args, " "))
 		return nil
 	}
-	supervisorSystemctlActive = func(_ string) bool {
-		return false
-	}
+	supervisorSystemctlActive = func(string) bool { return true }
+	stubSupervisorRunningPreserveSignalReady(t, true)
+	supervisorSystemdWarmRefreshStopTimeout = time.Millisecond
+	supervisorSystemdWarmRefreshPollInterval = time.Millisecond
 	t.Cleanup(func() {
 		supervisorSystemctlRun = oldRun
 		supervisorSystemctlActive = oldActive
+		supervisorSystemdWarmRefreshStopTimeout = oldTimeout
+		supervisorSystemdWarmRefreshPollInterval = oldPoll
 	})
 
 	var stdout, stderr bytes.Buffer
@@ -726,41 +998,123 @@ func TestInstallSupervisorSystemdStartsInactiveService(t *testing.T) {
 		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	joined := strings.Join(calls, "\n")
-	if !strings.Contains(joined, "--user start gascity-supervisor.service") {
-		t.Fatalf("systemctl calls = %v, want start for inactive service", calls)
-	}
-	if strings.Contains(joined, "--user restart gascity-supervisor.service") {
-		t.Fatalf("systemctl calls = %v, should not restart inactive service", calls)
+	for _, want := range []string{
+		"--user kill --kill-who=main --signal=SIGTERM " + service,
+		"--user kill --kill-who=main --signal=SIGKILL " + service,
+		"--user reset-failed " + service,
+		"--user start " + service,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("systemctl calls = %v, want %q", calls, want)
+		}
 	}
 }
 
-func TestInstallSupervisorSystemdUsesIsolatedUnitNameForIsolatedGCHome(t *testing.T) {
+func TestInstallSupervisorSystemdWarmRefreshStopsWorkspaceServicesBeforeStart(t *testing.T) {
 	if goruntime.GOOS != "linux" {
 		t.Skip("systemd path only applies on linux")
 	}
 	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
 	t.Setenv("HOME", homeDir)
-	isolatedHome := filepath.Join(t.TempDir(), "isolated-home")
-	t.Setenv("GC_HOME", isolatedHome)
+	t.Setenv("GC_HOME", gcHome)
 
 	data := &supervisorServiceData{
 		GCPath:        "/tmp/gc-new",
-		LogPath:       filepath.Join(isolatedHome, "supervisor.log"),
-		GCHome:        isolatedHome,
-		XDGRuntimeDir: "",
+		LogPath:       "/tmp/gc-home/supervisor.log",
+		GCHome:        gcHome,
+		XDGRuntimeDir: "/tmp/gc-run",
 		Path:          "/usr/local/bin:/usr/bin:/bin",
 	}
+	path := supervisorSystemdServicePath()
+	unitName := supervisorSystemdServiceName()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("old unit\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).Register(cityPath, "bright-lights"); err != nil {
+		t.Fatalf("Register(%q): %v", cityPath, err)
+	}
+	stateRoot := filepath.Join(cityPath, ".gc", "services", "bridge")
+	socketPath := filepath.Join(t.TempDir(), "bridge.sock")
+	cmd := exec.Command("sh", "-c", "trap 'exit 0' TERM; while :; do sleep 1; done")
+	cmd.Env = append(os.Environ(),
+		"GC_HOME="+gcHome,
+		"GC_CITY_PATH="+cityPath,
+		"GC_SERVICE_NAME=bridge",
+		"GC_SERVICE_STATE_ROOT="+stateRoot,
+		"GC_SERVICE_SOCKET="+socketPath,
+	)
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Start workspace-service sentinel: %v", err)
+	}
+	pgid, err := syscall.Getpgid(cmd.Process.Pid)
+	if err != nil {
+		t.Fatalf("Getpgid(%d): %v", cmd.Process.Pid, err)
+	}
+	waitCh := make(chan error, 1)
+	go func() {
+		waitCh <- cmd.Wait()
+	}()
+	t.Cleanup(func() {
+		if processGroupAlive(pgid) {
+			_ = syscall.Kill(-pgid, syscall.SIGKILL)
+		}
+		select {
+		case <-waitCh:
+		case <-time.After(time.Second):
+			t.Logf("workspace-service sentinel pgid %d did not exit before cleanup timeout", pgid)
+		}
+	})
+	if !processGroupAlive(pgid) {
+		t.Fatalf("workspace-service sentinel pgid %d is not alive before warm refresh", pgid)
+	}
+	scope, err := supervisorWorkspaceServiceCleanupScopeFromRegistry(gcHome)
+	if err != nil {
+		t.Fatalf("supervisorWorkspaceServiceCleanupScopeFromRegistry: %v", err)
+	}
+	procs, err := findSupervisorWorkspaceServiceProcesses(scope)
+	if err != nil {
+		t.Fatalf("findSupervisorWorkspaceServiceProcesses: %v", err)
+	}
+	if !slices.ContainsFunc(procs, func(proc supervisorWorkspaceServiceProcess) bool { return proc.pgid == pgid }) {
+		t.Fatalf("workspace-service discovery procs = %#v, want pgid %d", procs, pgid)
+	}
 
 	oldRun := supervisorSystemctlRun
 	oldActive := supervisorSystemctlActive
-	var calls []string
+	var (
+		calls              []string
+		startBeforeCleanup bool
+	)
 	supervisorSystemctlRun = func(args ...string) error {
-		calls = append(calls, strings.Join(args, " "))
+		call := strings.Join(args, " ")
+		calls = append(calls, call)
+		if call == "--user start "+unitName && processGroupAlive(pgid) {
+			startBeforeCleanup = true
+		}
 		return nil
 	}
-	supervisorSystemctlActive = func(_ string) bool {
-		return false
+	supervisorSystemctlActive = func(service string) bool {
+		if service != unitName {
+			return false
+		}
+		for _, call := range calls {
+			if call == "--user kill --kill-who=main --signal=SIGTERM "+unitName {
+				return false
+			}
+		}
+		return true
 	}
+	stubSupervisorRunningPreserveSignalReady(t, true)
 	t.Cleanup(func() {
 		supervisorSystemctlRun = oldRun
 		supervisorSystemctlActive = oldActive
@@ -770,62 +1124,653 @@ func TestInstallSupervisorSystemdUsesIsolatedUnitNameForIsolatedGCHome(t *testin
 	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 0 {
 		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
 	}
-
-	wantName := supervisorSystemdServiceName()
-	if wantName == defaultSupervisorSystemdUnit {
-		t.Fatalf("supervisorSystemdServiceName() = %q, want isolated unit name", wantName)
-	}
-	if !strings.HasPrefix(wantName, "gascity-supervisor-isolated-home-") {
-		t.Fatalf("supervisorSystemdServiceName() = %q, want isolated-home-prefixed name", wantName)
-	}
-	wantPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", wantName)
-	if _, err := os.Stat(wantPath); err != nil {
-		t.Fatalf("Stat(%q): %v", wantPath, err)
-	}
-	defaultPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", "gascity-supervisor.service")
-	if _, err := os.Stat(defaultPath); !os.IsNotExist(err) {
-		t.Fatalf("default systemd unit %q should stay absent; err=%v", defaultPath, err)
-	}
-
-	joined := strings.Join(calls, "\n")
-	for _, want := range []string{
-		"--user enable " + wantName,
-		"--user start " + wantName,
-	} {
-		if !strings.Contains(joined, want) {
-			t.Fatalf("systemctl calls = %v, want %q", calls, want)
-		}
+	if startBeforeCleanup {
+		t.Fatalf("systemctl start ran before workspace-service pgid %d was stopped; calls=%v", pgid, calls)
 	}
-	if strings.Contains(joined, "gascity-supervisor.service") {
-		t.Fatalf("systemctl calls = %v, should not target the default unit when GC_HOME is isolated", calls)
+	if err := waitForProcessGroupExit(pgid, time.Second); err != nil {
+		t.Fatalf("workspace-service cleanup: %v", err)
 	}
 }
 
-func TestUnloadSupervisorServiceSkipsDefaultUnitForIsolatedGCHome(t *testing.T) {
+func TestInstallSupervisorSystemdWarmRefreshLeavesUnregisteredWorkspaceServices(t *testing.T) {
 	if goruntime.GOOS != "linux" {
 		t.Skip("systemd path only applies on linux")
 	}
 	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
 	t.Setenv("HOME", homeDir)
-	t.Setenv("GC_HOME", filepath.Join(t.TempDir(), "isolated-home"))
-	logFile := installFakeSystemctl(t)
+	t.Setenv("GC_HOME", gcHome)
 
-	defaultPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", "gascity-supervisor.service")
-	if err := os.MkdirAll(filepath.Dir(defaultPath), 0o755); err != nil {
+	registeredCity := filepath.Join(t.TempDir(), "registered-city")
+	unregisteredCity := filepath.Join(t.TempDir(), "unregistered-city")
+	if err := os.MkdirAll(registeredCity, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(defaultPath, []byte("[Unit]\nDescription=test\n"), 0o644); err != nil {
+	if err := os.MkdirAll(unregisteredCity, 0o755); err != nil {
 		t.Fatal(err)
 	}
-
-	unloadSupervisorService()
-
-	if got := strings.TrimSpace(readCommandLog(t, logFile)); got != "" {
-		t.Fatalf("unloadSupervisorService invoked systemctl for default unit under isolated GC_HOME: %q", got)
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).Register(registeredCity, "registered-city"); err != nil {
+		t.Fatalf("Register(%q): %v", registeredCity, err)
 	}
-}
 
-func TestUnloadSupervisorServiceUsesIsolatedUnitWhenPresent(t *testing.T) {
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       "/tmp/gc-home/supervisor.log",
+		GCHome:        gcHome,
+		XDGRuntimeDir: "/tmp/gc-run",
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+	path := supervisorSystemdServicePath()
+	unitName := supervisorSystemdServiceName()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("old unit\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	registered := startWorkspaceServiceSentinel(t, gcHome, registeredCity, "bridge")
+	unregistered := startWorkspaceServiceSentinel(t, gcHome, unregisteredCity, "other-bridge")
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	supervisorSystemctlRun = func(_ ...string) error { return nil }
+	supervisorSystemctlActive = func(service string) bool {
+		return service == unitName
+	}
+	stubSupervisorRunningPreserveSignalReady(t, true)
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 0 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if err := waitForProcessGroupExit(registered.pgid, time.Second); err != nil {
+		t.Fatalf("registered workspace-service cleanup: %v", err)
+	}
+	if !processGroupAlive(unregistered.pgid) {
+		t.Fatalf("unregistered workspace-service pgid %d was stopped by warm-refresh cleanup", unregistered.pgid)
+	}
+}
+
+func TestCleanupSupervisorWorkspaceServicesForSupervisorStartSkipsMissingProc(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).Register(cityPath, "bright-lights"); err != nil {
+		t.Fatalf("Register(%q): %v", cityPath, err)
+	}
+
+	oldRoot := supervisorProcRoot
+	oldReadDir := supervisorProcReadDir
+	supervisorProcRoot = filepath.Join(t.TempDir(), "missing-proc")
+	supervisorProcReadDir = os.ReadDir
+	t.Cleanup(func() {
+		supervisorProcRoot = oldRoot
+		supervisorProcReadDir = oldReadDir
+	})
+
+	if err := cleanupSupervisorWorkspaceServicesForSupervisorStart(gcHome); err != nil {
+		t.Fatalf("cleanupSupervisorWorkspaceServicesForSupervisorStart: %v", err)
+	}
+}
+
+func TestCleanupSupervisorWorkspaceServicesForSupervisorStartWarnsWhenProcCleanupUnsupported(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).Register(cityPath, "bright-lights"); err != nil {
+		t.Fatalf("Register(%q): %v", cityPath, err)
+	}
+
+	oldGOOS := supervisorRuntimeGOOS
+	oldWarnings := supervisorWorkspaceServiceCleanupWarnings
+	var warnings bytes.Buffer
+	supervisorRuntimeGOOS = "darwin"
+	supervisorWorkspaceServiceCleanupWarnings = &warnings
+	t.Cleanup(func() {
+		supervisorRuntimeGOOS = oldGOOS
+		supervisorWorkspaceServiceCleanupWarnings = oldWarnings
+	})
+
+	if err := cleanupSupervisorWorkspaceServicesForSupervisorStart(gcHome); err != nil {
+		t.Fatalf("cleanupSupervisorWorkspaceServicesForSupervisorStart: %v", err)
+	}
+	if got := warnings.String(); !strings.Contains(got, "workspace-service startup cleanup is not available on darwin") ||
+		!strings.Contains(got, citylayout.RuntimeServicesDir(cityPath)) ||
+		!strings.Contains(got, "GC_SERVICE_STATE_ROOT") {
+		t.Fatalf("cleanup warning = %q, want macOS operator guidance", got)
+	}
+}
+
+func TestFindSupervisorWorkspaceServiceProcessesFiltersOwnershipAndRequiredEnv(t *testing.T) {
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
+	otherHome := filepath.Join(t.TempDir(), "other-home")
+	cityPath := filepath.Join(t.TempDir(), "city")
+	otherCity := filepath.Join(t.TempDir(), "other-city")
+	serviceRoot := filepath.Join(cityPath, ".gc", "services", "bridge")
+	procRoot := t.TempDir()
+	baseEnv := map[string]string{
+		"GC_HOME":                   gcHome,
+		"GC_CITY_PATH":              cityPath,
+		"GC_SERVICE_NAME":           "bridge",
+		"GC_SERVICE_STATE_ROOT":     serviceRoot,
+		"GC_SERVICE_SOCKET":         filepath.Join(t.TempDir(), "bridge.sock"),
+		"GC_CITY_RUNTIME_DIR":       filepath.Join(cityPath, ".gc", "runtime"),
+		"GC_SERVICE_RUN_ROOT":       filepath.Join(serviceRoot, "run"),
+		"GC_SERVICE_URL_PREFIX":     "/svc/bridge",
+		"GC_SERVICE_VISIBILITY":     "private",
+		"GC_PUBLISHED_SERVICES":     filepath.Join(cityPath, ".gc", "services", ".published"),
+		"GC_PUBLISHED_SERVICES_DIR": filepath.Join(cityPath, ".gc", "services", ".published"),
+	}
+	writeSupervisorProcEnv(t, procRoot, 101, baseEnv)
+	missingSocket := map[string]string{}
+	for k, v := range baseEnv {
+		missingSocket[k] = v
+	}
+	delete(missingSocket, "GC_SERVICE_SOCKET")
+	writeSupervisorProcEnv(t, procRoot, 102, missingSocket)
+	otherHomeEnv := map[string]string{}
+	for k, v := range baseEnv {
+		otherHomeEnv[k] = v
+	}
+	otherHomeEnv["GC_HOME"] = otherHome
+	writeSupervisorProcEnv(t, procRoot, 103, otherHomeEnv)
+	otherCityEnv := map[string]string{}
+	for k, v := range baseEnv {
+		otherCityEnv[k] = v
+	}
+	otherCityEnv["GC_CITY_PATH"] = otherCity
+	otherCityEnv["GC_SERVICE_STATE_ROOT"] = filepath.Join(otherCity, ".gc", "services", "bridge")
+	writeSupervisorProcEnv(t, procRoot, 104, otherCityEnv)
+	outsideStateEnv := map[string]string{}
+	for k, v := range baseEnv {
+		outsideStateEnv[k] = v
+	}
+	outsideStateEnv["GC_SERVICE_STATE_ROOT"] = filepath.Join(cityPath, ".gc", "not-services", "bridge")
+	writeSupervisorProcEnv(t, procRoot, 105, outsideStateEnv)
+
+	setSupervisorProcTestHooks(t, procRoot, func(pid int) (int, error) {
+		return pid + 1000, nil
+	})
+	scope := supervisorWorkspaceServiceCleanupScope{
+		gcHome: normalizePathForCompare(gcHome),
+		cityPaths: map[string]string{
+			normalizePathForCompare(cityPath): normalizePathForCompare(cityPath),
+		},
+	}
+	procs, err := findSupervisorWorkspaceServiceProcesses(scope)
+	if err != nil {
+		t.Fatalf("findSupervisorWorkspaceServiceProcesses: %v", err)
+	}
+	if len(procs) != 1 || procs[0].pid != 101 || procs[0].pgid != 1101 {
+		t.Fatalf("procs = %#v, want only owned pid 101", procs)
+	}
+}
+
+func TestFindSupervisorWorkspaceServiceProcessesSkipsUnsafeAndVanished(t *testing.T) {
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
+	cityPath := filepath.Join(t.TempDir(), "city")
+	procRoot := t.TempDir()
+	for _, pid := range []int{201, 202, 203, 204} {
+		writeSupervisorProcEnv(t, procRoot, pid, map[string]string{
+			"GC_HOME":               gcHome,
+			"GC_CITY_PATH":          cityPath,
+			"GC_SERVICE_NAME":       "bridge",
+			"GC_SERVICE_STATE_ROOT": filepath.Join(cityPath, ".gc", "services", "bridge"),
+			"GC_SERVICE_SOCKET":     filepath.Join(t.TempDir(), "bridge.sock"),
+		})
+	}
+	setSupervisorProcTestHooks(t, procRoot, func(pid int) (int, error) {
+		switch pid {
+		case 201:
+			return 0, syscall.ESRCH
+		case 202:
+			return 1, nil
+		case 203:
+			return 4242, nil
+		case 204:
+			return 5204, nil
+		default:
+			return pid + 1000, nil
+		}
+	})
+	scope := supervisorWorkspaceServiceCleanupScope{
+		gcHome: normalizePathForCompare(gcHome),
+		cityPaths: map[string]string{
+			normalizePathForCompare(cityPath): normalizePathForCompare(cityPath),
+		},
+	}
+	oldWarnings := supervisorWorkspaceServiceCleanupWarnings
+	var warnings bytes.Buffer
+	supervisorWorkspaceServiceCleanupWarnings = &warnings
+	t.Cleanup(func() {
+		supervisorWorkspaceServiceCleanupWarnings = oldWarnings
+	})
+
+	procs, err := findSupervisorWorkspaceServiceProcesses(scope)
+	if err != nil {
+		t.Fatalf("findSupervisorWorkspaceServiceProcesses: %v", err)
+	}
+	if len(procs) != 1 || procs[0].pid != 204 || procs[0].pgid != 5204 {
+		t.Fatalf("procs = %#v, want only safe pid 204", procs)
+	}
+	if got := warnings.String(); !strings.Contains(got, "unsafe process group 1") || !strings.Contains(got, "unsafe process group 4242") {
+		t.Fatalf("warnings = %q, want unsafe process group diagnostics", got)
+	}
+}
+
+func TestTerminateProcessGroupTreatsESRCHAsAlreadyStopped(t *testing.T) {
+	oldKill := supervisorKill
+	oldPoll := supervisorProcessGroupPollPeriod
+	supervisorKill = func(_ int, _ syscall.Signal) error {
+		return syscall.ESRCH
+	}
+	supervisorProcessGroupPollPeriod = time.Millisecond
+	t.Cleanup(func() {
+		supervisorKill = oldKill
+		supervisorProcessGroupPollPeriod = oldPoll
+	})
+
+	if err := terminateProcessGroup(999999, time.Millisecond); err != nil {
+		t.Fatalf("terminateProcessGroup ESRCH = %v, want nil", err)
+	}
+}
+
+func TestTerminateProcessGroupRefusesCurrentProcessGroup(t *testing.T) {
+	if err := terminateProcessGroup(syscall.Getpgrp(), time.Millisecond); err == nil {
+		t.Fatal("terminateProcessGroup current process group error = nil, want refusal")
+	}
+}
+
+func TestInstallSupervisorSystemdWarmRefreshPreservesNewUnitWhenStartFails(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", filepath.Join(homeDir, ".gc"))
+
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       "/tmp/gc-home/supervisor.log",
+		GCHome:        "/tmp/gc-home",
+		XDGRuntimeDir: "/tmp/gc-run",
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+	path := supervisorSystemdServicePath()
+	unitName := supervisorSystemdServiceName()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	previous := []byte("old unit\n")
+	if err := os.WriteFile(path, previous, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	var (
+		calls      []string
+		startCalls int
+	)
+	supervisorSystemctlRun = func(args ...string) error {
+		call := strings.Join(args, " ")
+		calls = append(calls, call)
+		if call == "--user start "+unitName {
+			startCalls++
+			if startCalls == 1 {
+				return errors.New("start failed")
+			}
+		}
+		return nil
+	}
+	supervisorSystemctlActive = func(service string) bool {
+		if service != unitName {
+			return false
+		}
+		for _, call := range calls {
+			if call == "--user kill --kill-who=main --signal=SIGTERM "+unitName {
+				return false
+			}
+		}
+		return true
+	}
+	stubSupervisorRunningPreserveSignalReady(t, true)
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 1 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	gotContent, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%q): %v", path, err)
+	}
+	if bytes.Equal(gotContent, previous) || !bytes.Contains(gotContent, []byte("KillMode=process")) {
+		t.Fatalf("unit after failed warm refresh = %q, want refreshed unit with KillMode=process", gotContent)
+	}
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"--user kill --kill-who=main --signal=SIGTERM " + unitName,
+		"--user reset-failed " + unitName,
+		"--user start " + unitName,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("systemctl calls = %v, want %q", calls, want)
+		}
+	}
+	if strings.Contains(joined, "--user stop "+unitName) {
+		t.Fatalf("systemctl calls = %v, should not stop and restart a previous unit after failed warm refresh", calls)
+	}
+	if startCalls != 1 {
+		t.Fatalf("systemctl start calls = %d, want only failed refresh start; calls=%v", startCalls, calls)
+	}
+	if !strings.Contains(stderr.String(), "systemctl --user start "+unitName+": start failed") {
+		t.Fatalf("stderr = %q, want failed refresh start", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "leaving refreshed systemd unit") {
+		t.Fatalf("stderr = %q, want refreshed-unit rollback guidance", stderr.String())
+	}
+}
+
+func TestInstallSupervisorSystemdWarmRefreshPreservesNewUnitWhenCleanupFails(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "gc-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       "/tmp/gc-home/supervisor.log",
+		GCHome:        gcHome,
+		XDGRuntimeDir: "/tmp/gc-run",
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+	path := supervisorSystemdServicePath()
+	unitName := supervisorSystemdServiceName()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	previous := []byte("old unit\n")
+	if err := os.WriteFile(path, previous, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cityPath := filepath.Join(t.TempDir(), "city")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).Register(cityPath, "bright-lights"); err != nil {
+		t.Fatalf("Register(%q): %v", cityPath, err)
+	}
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	oldReadDir := supervisorProcReadDir
+	var (
+		calls      []string
+		startCalls int
+	)
+	supervisorSystemctlRun = func(args ...string) error {
+		call := strings.Join(args, " ")
+		calls = append(calls, call)
+		if call == "--user start "+unitName {
+			startCalls++
+		}
+		return nil
+	}
+	supervisorSystemctlActive = func(service string) bool {
+		if service != unitName {
+			return false
+		}
+		for _, call := range calls {
+			if call == "--user kill --kill-who=main --signal=SIGTERM "+unitName {
+				return false
+			}
+		}
+		return true
+	}
+	stubSupervisorRunningPreserveSignalReady(t, true)
+	supervisorProcReadDir = func(string) ([]os.DirEntry, error) {
+		return nil, errors.New("proc scan failed")
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+		supervisorProcReadDir = oldReadDir
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 1 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	gotContent, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%q): %v", path, err)
+	}
+	if bytes.Equal(gotContent, previous) || !bytes.Contains(gotContent, []byte("KillMode=process")) {
+		t.Fatalf("unit after failed cleanup = %q, want refreshed unit with KillMode=process", gotContent)
+	}
+	joined := strings.Join(calls, "\n")
+	if !strings.Contains(joined, "--user kill --kill-who=main --signal=SIGTERM "+unitName) {
+		t.Fatalf("systemctl calls = %v, want warm-refresh graceful signal", calls)
+	}
+	if strings.Contains(joined, "--user stop "+unitName) {
+		t.Fatalf("systemctl calls = %v, should not stop and restart a previous unit after failed cleanup", calls)
+	}
+	if startCalls != 0 {
+		t.Fatalf("systemctl start calls = %d, want no start after cleanup failure; calls=%v", startCalls, calls)
+	}
+	if !strings.Contains(stderr.String(), "workspace-service cleanup after systemctl --user kill") {
+		t.Fatalf("stderr = %q, want cleanup failure", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "leaving refreshed systemd unit") {
+		t.Fatalf("stderr = %q, want refreshed-unit rollback guidance", stderr.String())
+	}
+}
+
+func TestInstallSupervisorSystemdWritesPrivateUnitFile(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", filepath.Join(homeDir, ".gc"))
+
+	data := &supervisorServiceData{
+		GCPath:  "/tmp/gc-new",
+		LogPath: "/tmp/gc-home/supervisor.log",
+		GCHome:  "/tmp/gc-home",
+		Path:    "/usr/local/bin:/usr/bin:/bin",
+		ExtraEnv: []supervisorServiceEnvVar{
+			{Name: "OPENAI_API_KEY", Value: "sk-openai-123"},
+		},
+	}
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	supervisorSystemctlRun = func(_ ...string) error {
+		return nil
+	}
+	supervisorSystemctlActive = func(_ string) bool {
+		return false
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 0 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	info, err := os.Stat(supervisorSystemdServicePath())
+	if err != nil {
+		t.Fatalf("Stat(%q): %v", supervisorSystemdServicePath(), err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Fatalf("systemd unit mode = %03o, want 600", got)
+	}
+}
+
+func TestInstallSupervisorSystemdStartsInactiveService(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", filepath.Join(homeDir, ".gc"))
+
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       "/tmp/gc-home/supervisor.log",
+		GCHome:        "/tmp/gc-home",
+		XDGRuntimeDir: "/tmp/gc-run",
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	var calls []string
+	supervisorSystemctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	supervisorSystemctlActive = func(_ string) bool {
+		return false
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 0 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	joined := strings.Join(calls, "\n")
+	if !strings.Contains(joined, "--user start gascity-supervisor.service") {
+		t.Fatalf("systemctl calls = %v, want start for inactive service", calls)
+	}
+	if strings.Contains(joined, "--user restart gascity-supervisor.service") {
+		t.Fatalf("systemctl calls = %v, should not restart inactive service", calls)
+	}
+}
+
+func TestInstallSupervisorSystemdUsesIsolatedUnitNameForIsolatedGCHome(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	isolatedHome := filepath.Join(t.TempDir(), "isolated-home")
+	t.Setenv("GC_HOME", isolatedHome)
+
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       filepath.Join(isolatedHome, "supervisor.log"),
+		GCHome:        isolatedHome,
+		XDGRuntimeDir: "",
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	var calls []string
+	supervisorSystemctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	supervisorSystemctlActive = func(_ string) bool {
+		return false
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorSystemd(data, &stdout, &stderr); code != 0 {
+		t.Fatalf("installSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+
+	wantName := supervisorSystemdServiceName()
+	if wantName == defaultSupervisorSystemdUnit {
+		t.Fatalf("supervisorSystemdServiceName() = %q, want isolated unit name", wantName)
+	}
+	if !strings.HasPrefix(wantName, "gascity-supervisor-isolated-home-") {
+		t.Fatalf("supervisorSystemdServiceName() = %q, want isolated-home-prefixed name", wantName)
+	}
+	wantPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", wantName)
+	if _, err := os.Stat(wantPath); err != nil {
+		t.Fatalf("Stat(%q): %v", wantPath, err)
+	}
+	defaultPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", "gascity-supervisor.service")
+	if _, err := os.Stat(defaultPath); !os.IsNotExist(err) {
+		t.Fatalf("default systemd unit %q should stay absent; err=%v", defaultPath, err)
+	}
+
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"--user enable " + wantName,
+		"--user start " + wantName,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("systemctl calls = %v, want %q", calls, want)
+		}
+	}
+	if strings.Contains(joined, "gascity-supervisor.service") {
+		t.Fatalf("systemctl calls = %v, should not target the default unit when GC_HOME is isolated", calls)
+	}
+}
+
+func TestUnloadSupervisorServiceSkipsDefaultUnitForIsolatedGCHome(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", filepath.Join(t.TempDir(), "isolated-home"))
+	logFile := installFakeSystemctl(t)
+
+	defaultPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", "gascity-supervisor.service")
+	if err := os.MkdirAll(filepath.Dir(defaultPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(defaultPath, []byte("[Unit]\nDescription=test\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	unloadSupervisorService()
+
+	if got := strings.TrimSpace(readCommandLog(t, logFile)); got != "" {
+		t.Fatalf("unloadSupervisorService invoked systemctl for default unit under isolated GC_HOME: %q", got)
+	}
+}
+
+func TestUnloadSupervisorServiceUsesIsolatedUnitWhenPresent(t *testing.T) {
 	if goruntime.GOOS != "linux" {
 		t.Skip("systemd path only applies on linux")
 	}
@@ -1406,10 +2351,144 @@ func TestUninstallSupervisorSystemdIgnoresLegacyStopDisableFailures(t *testing.T
 	if code := uninstallSupervisorSystemd(&supervisorServiceData{}, &stdout, &stderr); code != 0 {
 		t.Fatalf("uninstallSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
 	}
-	for _, path := range []string{currentPath, legacyPath} {
-		if _, err := os.Stat(path); !os.IsNotExist(err) {
-			t.Fatalf("systemd unit %q should be removed despite legacy stop/disable failures; err=%v", path, err)
-		}
+	for _, path := range []string{currentPath, legacyPath} {
+		if _, err := os.Stat(path); !os.IsNotExist(err) {
+			t.Fatalf("systemd unit %q should be removed despite legacy stop/disable failures; err=%v", path, err)
+		}
+	}
+}
+
+func TestUninstallSupervisorSystemdRefusesActiveServiceWithoutControlSocket(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	gcHome := shortTempDir(t, "gc-home-")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
+
+	currentPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", supervisorSystemdServiceName())
+	if err := os.MkdirAll(filepath.Dir(currentPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", filepath.Dir(currentPath), err)
+	}
+	if err := os.WriteFile(currentPath, []byte("current unit\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile(%q): %v", currentPath, err)
+	}
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	var calls []string
+	supervisorSystemctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	supervisorSystemctlActive = func(service string) bool {
+		return service == supervisorSystemdServiceName()
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := uninstallSupervisorSystemd(&supervisorServiceData{}, &stdout, &stderr); code != 1 {
+		t.Fatalf("uninstallSupervisorSystemd code = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(currentPath); err != nil {
+		t.Fatalf("active systemd unit %q should remain after guarded uninstall; err=%v", currentPath, err)
+	}
+	if len(calls) != 0 {
+		t.Fatalf("systemctl calls = %v, want none when active service has no control socket", calls)
+	}
+	for _, want := range []string{"control socket is unavailable", "gc supervisor start"} {
+		if !strings.Contains(stderr.String(), want) {
+			t.Fatalf("stderr = %q, want %q", stderr.String(), want)
+		}
+	}
+}
+
+func TestUninstallSupervisorSystemdUsesControlSocketWhenServiceActive(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	homeDir := t.TempDir()
+	gcHome := shortTempDir(t, "gc-home-")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
+
+	currentPath := filepath.Join(homeDir, ".local", "share", "systemd", "user", supervisorSystemdServiceName())
+	if err := os.MkdirAll(filepath.Dir(currentPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", filepath.Dir(currentPath), err)
+	}
+	if err := os.WriteFile(currentPath, []byte("current unit\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile(%q): %v", currentPath, err)
+	}
+
+	var (
+		mu                         sync.Mutex
+		socketStopSeen             bool
+		stopped                    bool
+		systemctlStopBeforeSocket  bool
+		systemctlDisableCurrentHit bool
+	)
+	sockPath := supervisorSocketPath()
+	startTestSupervisorSocket(t, sockPath, func(cmd string) string {
+		mu.Lock()
+		defer mu.Unlock()
+		switch cmd {
+		case "ping":
+			if stopped {
+				return ""
+			}
+			return "4242\n"
+		case "stop":
+			socketStopSeen = true
+			stopped = true
+			return "ok\ndone:ok\n"
+		}
+		return ""
+	})
+
+	oldRun := supervisorSystemctlRun
+	oldActive := supervisorSystemctlActive
+	supervisorSystemctlRun = func(args ...string) error {
+		mu.Lock()
+		defer mu.Unlock()
+		if len(args) >= 3 && args[1] == "stop" && args[2] == supervisorSystemdServiceName() && !socketStopSeen {
+			systemctlStopBeforeSocket = true
+		}
+		if len(args) >= 3 && args[1] == "disable" && args[2] == supervisorSystemdServiceName() {
+			systemctlDisableCurrentHit = true
+		}
+		return nil
+	}
+	supervisorSystemctlActive = func(service string) bool {
+		return service == supervisorSystemdServiceName()
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+		supervisorSystemctlActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := uninstallSupervisorSystemd(&supervisorServiceData{}, &stdout, &stderr); code != 0 {
+		t.Fatalf("uninstallSupervisorSystemd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(currentPath); !os.IsNotExist(err) {
+		t.Fatalf("systemd unit %q should be removed; err=%v", currentPath, err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if systemctlStopBeforeSocket {
+		t.Fatal("uninstall stopped the systemd unit before requesting destructive socket shutdown")
+	}
+	if !socketStopSeen {
+		t.Fatal("uninstall did not request shutdown through the supervisor control socket")
+	}
+	if !systemctlDisableCurrentHit {
+		t.Fatal("uninstall did not disable the current systemd unit")
 	}
 }
 
@@ -1515,6 +2594,54 @@ func TestInstallSupervisorLaunchdWritesPrivatePlist(t *testing.T) {
 	}
 }
 
+func TestInstallSupervisorLaunchdEnablesAndKickstartsLoadedService(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "isolated-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+
+	label := supervisorLaunchdLabel()
+	data := &supervisorServiceData{
+		GCPath:       "/tmp/gc-new",
+		LogPath:      filepath.Join(gcHome, "supervisor.log"),
+		GCHome:       gcHome,
+		LaunchdLabel: label,
+		Path:         "/usr/local/bin:/usr/bin:/bin",
+	}
+
+	oldRun := supervisorLaunchctlRun
+	var calls []string
+	supervisorLaunchctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	t.Cleanup(func() {
+		supervisorLaunchctlRun = oldRun
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorLaunchd(data, &stdout, &stderr); code != 0 {
+		t.Fatalf("installSupervisorLaunchd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+
+	path := supervisorLaunchdPlistPath()
+	target := "gui/" + strconv.Itoa(os.Getuid()) + "/" + label
+	wantSequence := []string{
+		"unload " + path,
+		"load " + path,
+		"enable " + target,
+		"kickstart -p " + target,
+	}
+	last := -1
+	for _, want := range wantSequence {
+		idx := slices.Index(calls[last+1:], want)
+		if idx < 0 {
+			t.Fatalf("launchctl calls = %v, want %q after index %d", calls, want, last)
+		}
+		last += idx + 1
+	}
+}
+
 func TestInstallSupervisorLaunchdIgnoresLegacyUnloadFailures(t *testing.T) {
 	homeDir := t.TempDir()
 	gcHome := filepath.Join(t.TempDir(), "isolated-home")
@@ -1630,6 +2757,162 @@ func TestInstallSupervisorLaunchdKeepsLegacyPlistWhenNewServiceFails(t *testing.
 		"unload " + legacyPath,
 		"load " + currentPath,
 		"load " + legacyPath,
+		"enable gui/" + strconv.Itoa(os.Getuid()) + "/" + defaultSupervisorLaunchdLabel,
+		"kickstart -p gui/" + strconv.Itoa(os.Getuid()) + "/" + defaultSupervisorLaunchdLabel,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("launchctl calls = %v, want %q", calls, want)
+		}
+	}
+}
+
+func TestInstallSupervisorLaunchdRestoresLegacyPlistWhenEnableFails(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "isolated-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+
+	legacyPath := legacySupervisorLaunchdPlistPath()
+	if err := os.MkdirAll(filepath.Dir(legacyPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	legacyContent, err := renderSupervisorTemplate(supervisorLaunchdTemplate, &supervisorServiceData{
+		GCPath:       "/tmp/gc-legacy",
+		LogPath:      filepath.Join(gcHome, "supervisor.log"),
+		GCHome:       gcHome,
+		LaunchdLabel: defaultSupervisorLaunchdLabel,
+		Path:         "/usr/local/bin:/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(legacyPath, []byte(legacyContent), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	label := supervisorLaunchdLabel()
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       filepath.Join(gcHome, "supervisor.log"),
+		GCHome:        gcHome,
+		XDGRuntimeDir: "",
+		LaunchdLabel:  label,
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+
+	currentPath := filepath.Join(homeDir, "Library", "LaunchAgents", label+".plist")
+	currentTarget := "gui/" + strconv.Itoa(os.Getuid()) + "/" + label
+	legacyTarget := "gui/" + strconv.Itoa(os.Getuid()) + "/" + defaultSupervisorLaunchdLabel
+	oldRun := supervisorLaunchctlRun
+	var calls []string
+	supervisorLaunchctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		if len(args) == 2 && args[0] == "enable" && args[1] == currentTarget {
+			return errors.New("new plist failed to enable")
+		}
+		if len(args) == 3 && args[0] == "kickstart" && args[2] == legacyTarget {
+			return errors.New("legacy plist failed to restart")
+		}
+		return nil
+	}
+	t.Cleanup(func() {
+		supervisorLaunchctlRun = oldRun
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorLaunchd(data, &stdout, &stderr); code != 1 {
+		t.Fatalf("installSupervisorLaunchd code = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(currentPath); !os.IsNotExist(err) {
+		t.Fatalf("new launchd plist %q should be removed during rollback; err=%v", currentPath, err)
+	}
+	if _, err := os.Stat(legacyPath); err != nil {
+		t.Fatalf("legacy launchd plist %q should remain after failed install; err=%v", legacyPath, err)
+	}
+	if strings.Contains(stderr.String(), "rollback after launchctl failure") {
+		t.Fatalf("stderr = %q, want rollback restart failure to be warning-only", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "warning: restoring launchd service: kickstart -p "+legacyTarget) {
+		t.Fatalf("stderr = %q, want warning for best-effort legacy restart", stderr.String())
+	}
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"enable " + currentTarget,
+		"load " + legacyPath,
+		"enable " + legacyTarget,
+		"kickstart -p " + legacyTarget,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("launchctl calls = %v, want %q", calls, want)
+		}
+	}
+}
+
+func TestInstallSupervisorLaunchdRestoresLegacyPlistWhenKickstartFails(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := filepath.Join(t.TempDir(), "isolated-home")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+
+	legacyPath := legacySupervisorLaunchdPlistPath()
+	if err := os.MkdirAll(filepath.Dir(legacyPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	legacyContent, err := renderSupervisorTemplate(supervisorLaunchdTemplate, &supervisorServiceData{
+		GCPath:       "/tmp/gc-legacy",
+		LogPath:      filepath.Join(gcHome, "supervisor.log"),
+		GCHome:       gcHome,
+		LaunchdLabel: defaultSupervisorLaunchdLabel,
+		Path:         "/usr/local/bin:/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(legacyPath, []byte(legacyContent), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	label := supervisorLaunchdLabel()
+	data := &supervisorServiceData{
+		GCPath:        "/tmp/gc-new",
+		LogPath:       filepath.Join(gcHome, "supervisor.log"),
+		GCHome:        gcHome,
+		XDGRuntimeDir: "",
+		LaunchdLabel:  label,
+		Path:          "/usr/local/bin:/usr/bin:/bin",
+	}
+
+	currentPath := filepath.Join(homeDir, "Library", "LaunchAgents", label+".plist")
+	currentTarget := "gui/" + strconv.Itoa(os.Getuid()) + "/" + label
+	oldRun := supervisorLaunchctlRun
+	var calls []string
+	supervisorLaunchctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		if len(args) == 3 && args[0] == "kickstart" && args[2] == currentTarget {
+			return errors.New("new plist failed to start")
+		}
+		return nil
+	}
+	t.Cleanup(func() {
+		supervisorLaunchctlRun = oldRun
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := installSupervisorLaunchd(data, &stdout, &stderr); code != 1 {
+		t.Fatalf("installSupervisorLaunchd code = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(currentPath); !os.IsNotExist(err) {
+		t.Fatalf("new launchd plist %q should be removed during rollback; err=%v", currentPath, err)
+	}
+	if _, err := os.Stat(legacyPath); err != nil {
+		t.Fatalf("legacy launchd plist %q should remain after failed install; err=%v", legacyPath, err)
+	}
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"kickstart -p " + currentTarget,
+		"load " + legacyPath,
+		"enable gui/" + strconv.Itoa(os.Getuid()) + "/" + defaultSupervisorLaunchdLabel,
+		"kickstart -p gui/" + strconv.Itoa(os.Getuid()) + "/" + defaultSupervisorLaunchdLabel,
 	} {
 		if !strings.Contains(joined, want) {
 			t.Fatalf("launchctl calls = %v, want %q", calls, want)
@@ -1661,6 +2944,8 @@ func TestInstallSupervisorLaunchdRestoresPreviousCurrentPlistWhenUpdateFails(t *
 		Path:          "/usr/local/bin:/usr/bin:/bin",
 	}
 
+	label := supervisorLaunchdLabel()
+	target := "gui/" + strconv.Itoa(os.Getuid()) + "/" + label
 	oldRun := supervisorLaunchctlRun
 	var calls []string
 	loadCalls := 0
@@ -1699,6 +2984,17 @@ func TestInstallSupervisorLaunchdRestoresPreviousCurrentPlistWhenUpdateFails(t *
 	if loadCalls != 2 {
 		t.Fatalf("launchctl load call count = %d, want 2 (failed install + rollback restore); calls=%v", loadCalls, calls)
 	}
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"unload " + currentPath,
+		"load " + currentPath,
+		"enable " + target,
+		"kickstart -p " + target,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("launchctl calls = %v, want %q", calls, want)
+		}
+	}
 }
 
 func TestUninstallSupervisorLaunchdRemovesMatchingLegacyDefaultPlistForIsolatedGCHome(t *testing.T) {
@@ -1743,21 +3039,156 @@ func TestUninstallSupervisorLaunchdRemovesMatchingLegacyDefaultPlistForIsolatedG
 	})
 
 	var stdout, stderr bytes.Buffer
-	if code := uninstallSupervisorLaunchd(&supervisorServiceData{}, &stdout, &stderr); code != 0 {
-		t.Fatalf("uninstallSupervisorLaunchd code = %d, want 0; stderr=%q", code, stderr.String())
+	if code := uninstallSupervisorLaunchd(&supervisorServiceData{}, &stdout, &stderr); code != 0 {
+		t.Fatalf("uninstallSupervisorLaunchd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	for _, path := range []string{currentPath, legacyPath} {
+		if _, err := os.Stat(path); !os.IsNotExist(err) {
+			t.Fatalf("launchd plist %q should be removed; err=%v", path, err)
+		}
+	}
+	joined := strings.Join(calls, "\n")
+	for _, want := range []string{
+		"unload " + currentPath,
+		"disable gui/" + strconv.Itoa(os.Getuid()) + "/" + supervisorLaunchdLabel(),
+		"unload " + legacyPath,
+		"disable gui/" + strconv.Itoa(os.Getuid()) + "/" + defaultSupervisorLaunchdLabel,
+	} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("launchctl calls = %v, want %q", calls, want)
+		}
+	}
+}
+
+func TestUninstallSupervisorLaunchdUsesControlSocketWhenSupervisorRunning(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := shortTempDir(t, "gc-home-")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
+
+	currentPath := filepath.Join(homeDir, "Library", "LaunchAgents", supervisorLaunchdLabel()+".plist")
+	if err := os.MkdirAll(filepath.Dir(currentPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	content, err := renderSupervisorTemplate(supervisorLaunchdTemplate, &supervisorServiceData{
+		GCPath:       "/tmp/gc-current",
+		LogPath:      filepath.Join(gcHome, "supervisor.log"),
+		GCHome:       gcHome,
+		LaunchdLabel: supervisorLaunchdLabel(),
+		Path:         "/usr/local/bin:/usr/bin:/bin",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(currentPath, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	var (
+		mu                 sync.Mutex
+		socketStopSeen     bool
+		stopped            bool
+		unloadBeforeSocket bool
+		launchdDisableSeen bool
+	)
+	sockPath := supervisorSocketPath()
+	startTestSupervisorSocket(t, sockPath, func(cmd string) string {
+		mu.Lock()
+		defer mu.Unlock()
+		switch cmd {
+		case "ping":
+			if stopped {
+				return ""
+			}
+			return "4242\n"
+		case "stop":
+			socketStopSeen = true
+			stopped = true
+			return "ok\ndone:ok\n"
+		}
+		return ""
+	})
+
+	oldRun := supervisorLaunchctlRun
+	supervisorLaunchctlRun = func(args ...string) error {
+		mu.Lock()
+		defer mu.Unlock()
+		if len(args) == 2 && args[0] == "unload" && args[1] == currentPath && !socketStopSeen {
+			unloadBeforeSocket = true
+		}
+		if len(args) == 2 && args[0] == "disable" && args[1] == supervisorLaunchdServiceTarget(supervisorLaunchdLabel()) {
+			launchdDisableSeen = true
+		}
+		return nil
+	}
+	t.Cleanup(func() {
+		supervisorLaunchctlRun = oldRun
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := uninstallSupervisorLaunchd(&supervisorServiceData{}, &stdout, &stderr); code != 0 {
+		t.Fatalf("uninstallSupervisorLaunchd code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if _, err := os.Stat(currentPath); !os.IsNotExist(err) {
+		t.Fatalf("launchd plist %q should be removed; err=%v", currentPath, err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if unloadBeforeSocket {
+		t.Fatal("launchd uninstall unloaded the service before requesting destructive socket shutdown")
+	}
+	if !socketStopSeen {
+		t.Fatal("launchd uninstall did not request shutdown through the supervisor control socket")
+	}
+	if !launchdDisableSeen {
+		t.Fatal("launchd uninstall did not disable the current launchd service")
+	}
+}
+
+func TestUninstallSupervisorLaunchdRefusesActiveServiceWithoutControlSocket(t *testing.T) {
+	homeDir := t.TempDir()
+	gcHome := shortTempDir(t, "gc-home-")
+	t.Setenv("HOME", homeDir)
+	t.Setenv("GC_HOME", gcHome)
+	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
+
+	currentPath := filepath.Join(homeDir, "Library", "LaunchAgents", supervisorLaunchdLabel()+".plist")
+	if err := os.MkdirAll(filepath.Dir(currentPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(currentPath, []byte("current plist\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	oldRun := supervisorLaunchctlRun
+	oldActive := supervisorLaunchdActive
+	var calls []string
+	supervisorLaunchctlRun = func(args ...string) error {
+		calls = append(calls, strings.Join(args, " "))
+		return nil
+	}
+	supervisorLaunchdActive = func(label string) bool {
+		return label == supervisorLaunchdLabel()
+	}
+	t.Cleanup(func() {
+		supervisorLaunchctlRun = oldRun
+		supervisorLaunchdActive = oldActive
+	})
+
+	var stdout, stderr bytes.Buffer
+	if code := uninstallSupervisorLaunchd(&supervisorServiceData{}, &stdout, &stderr); code != 1 {
+		t.Fatalf("uninstallSupervisorLaunchd code = %d, want 1; stderr=%q", code, stderr.String())
 	}
-	for _, path := range []string{currentPath, legacyPath} {
-		if _, err := os.Stat(path); !os.IsNotExist(err) {
-			t.Fatalf("launchd plist %q should be removed; err=%v", path, err)
-		}
+	if _, err := os.Stat(currentPath); err != nil {
+		t.Fatalf("active launchd plist %q should remain after guarded uninstall; err=%v", currentPath, err)
 	}
-	joined := strings.Join(calls, "\n")
-	for _, want := range []string{
-		"unload " + currentPath,
-		"unload " + legacyPath,
-	} {
-		if !strings.Contains(joined, want) {
-			t.Fatalf("launchctl calls = %v, want %q", calls, want)
+	if len(calls) != 0 {
+		t.Fatalf("launchctl calls = %v, want none when active service has no control socket", calls)
+	}
+	for _, want := range []string{"launchd service", "control socket is unavailable", "gc supervisor start"} {
+		if !strings.Contains(stderr.String(), want) {
+			t.Fatalf("stderr = %q, want %q", stderr.String(), want)
 		}
 	}
 }
@@ -2000,6 +3431,83 @@ func TestRunSupervisorRejectsSupervisorOnFallbackSocket(t *testing.T) {
 	}
 }
 
+func TestRunSupervisorSIGTERMPreservesSessionsEndToEnd(t *testing.T) {
+	gcHome := shortTempDir(t, "gc-home-")
+	runtimeDir := shortTempDir(t, "gc-run-")
+	t.Setenv("HOME", filepath.Dir(gcHome))
+	t.Setenv("GC_HOME", gcHome)
+	t.Setenv("XDG_RUNTIME_DIR", runtimeDir)
+	t.Setenv("GC_BEADS", "file")
+	t.Setenv(supervisorPreserveSessionsOnSignalEnv, "1")
+
+	if err := os.WriteFile(supervisor.ConfigPath(), []byte("[supervisor]\nport = "+freeLoopbackPort(t)+"\npatrol_interval = \"10m\"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cityPath := filepath.Join(t.TempDir(), "bright-lights")
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte("[workspace]\nname = \"bright-lights\"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
+	if err := supervisor.NewRegistry(supervisor.RegistryPath()).Register(cityPath, "bright-lights"); err != nil {
+		t.Fatal(err)
+	}
+
+	sigChReady := make(chan chan<- os.Signal, 1)
+	oldSignalNotify := supervisorSignalNotify
+	supervisorSignalNotify = func(c chan<- os.Signal, _ ...os.Signal) {
+		sigChReady <- c
+	}
+	t.Cleanup(func() {
+		supervisorSignalNotify = oldSignalNotify
+	})
+
+	var stdout, stderr lockedBuffer
+	done := make(chan int, 1)
+	go func() {
+		done <- runSupervisor(&stdout, &stderr)
+	}()
+
+	var sigCh chan<- os.Signal
+	select {
+	case sigCh = <-sigChReady:
+	case <-time.After(2 * time.Second):
+		t.Fatalf("timed out waiting for supervisor signal hook; stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+	deadline := time.Now().Add(15 * time.Second)
+	for time.Now().Before(deadline) && !strings.Contains(stdout.String(), "Launching city 'bright-lights'") {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if !strings.Contains(stdout.String(), "Launching city 'bright-lights'") {
+		t.Fatalf("timed out waiting for city launch; stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+	sigCh <- syscall.SIGTERM
+
+	select {
+	case code := <-done:
+		if code != 0 {
+			t.Fatalf("runSupervisor code = %d, want 0; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatalf("runSupervisor did not exit after SIGTERM; stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+	got := stdout.String()
+	for _, want := range []string{
+		"Preserving city '" + cityPath + "' sessions for re-adoption...",
+		"Preserving agent sessions for supervisor re-adoption.",
+		"City '" + cityPath + "' preserved.",
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("stdout = %q, want %q; stderr=%q", got, want, stderr.String())
+		}
+	}
+	if strings.Contains(got, "Stopping city 'bright-lights'") {
+		t.Fatalf("stdout = %q, should use preserve-mode shutdown for SIGTERM", got)
+	}
+}
+
 func TestRunSupervisorFailsWhenAPIPortUnavailable(t *testing.T) {
 	t.Setenv("GC_HOME", t.TempDir())
 	t.Setenv("XDG_RUNTIME_DIR", t.TempDir())
@@ -2276,6 +3784,7 @@ func TestStopManagedCityForcesCleanupAfterTimeout(t *testing.T) {
 	logFile := filepath.Join(t.TempDir(), "ops.log")
 	script := writeSpyScript(t, logFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 
 	closer := &closerSpy{}
 	mc := &managedCity{
@@ -2326,6 +3835,7 @@ func TestStopManagedCityDoesNotUseStartupOrDriftTimeouts(t *testing.T) {
 	logFile := filepath.Join(t.TempDir(), "ops.log")
 	script := writeSpyScript(t, logFile)
 	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
 
 	closer := &closerSpy{}
 	mc := &managedCity{
@@ -2368,6 +3878,423 @@ func TestStopManagedCityDoesNotUseStartupOrDriftTimeouts(t *testing.T) {
 	assertSingleStopWithBenignNoise(t, ops)
 }
 
+func TestCityRuntimeShutdownPreservesSessionsWhenRequested(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "agent-one", runtime.Config{}); err != nil {
+		t.Fatalf("Start(agent-one): %v", err)
+	}
+	cr := &CityRuntime{
+		cfg: &config.City{
+			Daemon: config.DaemonConfig{ShutdownTimeout: "20ms"},
+		},
+		sp:     sp,
+		rec:    events.Discard,
+		stdout: io.Discard,
+		stderr: io.Discard,
+	}
+	cr.preserveSessionsOnShutdown()
+
+	cr.shutdown()
+
+	running, err := sp.ListRunning("")
+	if err != nil {
+		t.Fatalf("ListRunning: %v", err)
+	}
+	if !slices.Contains(running, "agent-one") {
+		t.Fatalf("running sessions = %v, want agent-one preserved", running)
+	}
+	for _, call := range sp.Calls {
+		if call.Method == "Interrupt" || call.Method == "Stop" {
+			t.Fatalf("preserve-mode shutdown called %s for %q; calls=%v", call.Method, call.Name, sp.Calls)
+		}
+	}
+}
+
+func TestCityRuntimeShutdownPreserveModeRecordsTrace(t *testing.T) {
+	cityPath := t.TempDir()
+	cr := &CityRuntime{
+		cityPath: cityPath,
+		cityName: "bright-lights",
+		cfg: &config.City{
+			Daemon: config.DaemonConfig{ShutdownTimeout: "20ms"},
+		},
+		sp:     runtime.NewFake(),
+		rec:    events.Discard,
+		stdout: io.Discard,
+		stderr: io.Discard,
+		trace:  newSessionReconcilerTraceManager(cityPath, "bright-lights", io.Discard),
+	}
+	cr.preserveSessionsOnShutdown()
+
+	cr.shutdown()
+
+	records, err := ReadTraceRecords(traceCityRuntimeDir(cityPath), TraceFilter{})
+	if err != nil {
+		t.Fatalf("ReadTraceRecords: %v", err)
+	}
+	if !slices.ContainsFunc(records, func(record SessionReconcilerTraceRecord) bool {
+		return record.RecordType == TraceRecordCycleResult &&
+			record.Fields["mode"] == "preserve_sessions" &&
+			record.Fields["city_name"] == "bright-lights" &&
+			record.Fields["reason"] == "supervisor_shutdown_preserve_mode"
+	}) {
+		t.Fatalf("trace records missing preserve shutdown cycle result: %#v", records)
+	}
+}
+
+func TestStopManagedCityPreservingSessionsSkipsBeadsProviderShutdown(t *testing.T) {
+	cityPath := t.TempDir()
+	logFile := filepath.Join(t.TempDir(), "ops.log")
+	script := writeSpyScript(t, logFile)
+	t.Setenv("GC_BEADS", "exec:"+script)
+	t.Setenv("GC_BEADS_SCOPE_ROOT", cityPath)
+
+	closer := &closerSpy{}
+	done := make(chan struct{})
+	canceled := false
+	mc := &managedCity{
+		name: "bright-lights",
+		cancel: func() {
+			canceled = true
+			close(done)
+		},
+		done:   done,
+		closer: closer,
+		cr: &CityRuntime{
+			cfg: &config.City{
+				Daemon: config.DaemonConfig{ShutdownTimeout: "20ms"},
+			},
+			sp:     runtime.NewFake(),
+			rec:    events.Discard,
+			stdout: io.Discard,
+			stderr: io.Discard,
+		},
+	}
+
+	if err := stopManagedCityPreservingSessions(mc, cityPath, io.Discard); err != nil {
+		t.Fatalf("stopManagedCityPreservingSessions: %v", err)
+	}
+	if !canceled {
+		t.Fatal("expected city context to be canceled so the CityRuntime goroutine can exit")
+	}
+	if !closer.closed {
+		t.Fatal("expected recorder closer to be closed after preserve-mode teardown")
+	}
+	if ops := readOpLog(t, logFile); len(ops) != 0 {
+		t.Fatalf("beads provider ops = %v, want none in preserve mode", ops)
+	}
+}
+
+func TestStopManagedCityPreservingSessionsWaitsForRuntimeShutdownOnTimeout(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("proxy process service shutdown uses process groups on linux")
+	}
+	if _, err := exec.LookPath("python3"); err != nil {
+		t.Skip("python3 not in PATH")
+	}
+	cityPath := t.TempDir()
+	serviceScript := filepath.Join(t.TempDir(), "service.sh")
+	if err := os.WriteFile(serviceScript, []byte(`#!/usr/bin/env python3
+import os
+import signal
+import socket
+import sys
+
+sock_path = os.environ["GC_SERVICE_SOCKET"]
+try:
+    os.unlink(sock_path)
+except FileNotFoundError:
+    pass
+
+def stop(_signum, _frame):
+    sys.exit(0)
+
+signal.signal(signal.SIGTERM, stop)
+listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+listener.bind(sock_path)
+listener.listen(1)
+while True:
+    conn, _ = listener.accept()
+    conn.close()
+`), 0o755); err != nil {
+		t.Fatalf("WriteFile(service script): %v", err)
+	}
+	var runtimeStdout bytes.Buffer
+	cr := &CityRuntime{
+		cityPath: cityPath,
+		cityName: "bright-lights",
+		cfg: &config.City{
+			Daemon: config.DaemonConfig{ShutdownTimeout: "20ms"},
+			Services: []config.Service{{
+				Name: "bridge",
+				Kind: "proxy_process",
+				Process: config.ServiceProcessConfig{
+					Command: []string{serviceScript},
+				},
+			}},
+		},
+		sp:     runtime.NewFake(),
+		rec:    events.Discard,
+		stdout: &runtimeStdout,
+		stderr: io.Discard,
+	}
+	cr.svc = workspacesvc.NewManager(&serviceRuntime{cr: cr})
+	if err := cr.svc.Reload(); err != nil {
+		t.Fatalf("service Reload: %v", err)
+	}
+	status, ok := cr.svc.Get("bridge")
+	if !ok {
+		t.Fatal("service bridge missing after Reload")
+	}
+	if status.LocalState != "ready" {
+		t.Fatalf("service bridge local_state = %q, want ready; status=%#v", status.LocalState, status)
+	}
+
+	mc := &managedCity{
+		name:   "bright-lights",
+		cancel: func() {},
+		done:   make(chan struct{}),
+		cr:     cr,
+	}
+
+	err := stopManagedCityPreservingSessions(mc, cityPath, io.Discard)
+	if err == nil {
+		t.Fatal("stopManagedCityPreservingSessions error = nil, want timeout error")
+	}
+	status, ok = cr.svc.Get("bridge")
+	if !ok {
+		t.Fatal("service bridge missing after preserve-mode shutdown wait")
+	}
+	if status.LocalState != "stopped" {
+		t.Fatalf("service bridge local_state = %q, want stopped after preserve-mode shutdown wait; status=%#v", status.LocalState, status)
+	}
+	if !strings.Contains(runtimeStdout.String(), "Preserving agent sessions for supervisor re-adoption.") {
+		t.Fatalf("runtime stdout = %q, want preserve-mode shutdown message", runtimeStdout.String())
+	}
+}
+
+func TestShutdownSupervisorCitiesPreserveSessions(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "agent-one", runtime.Config{}); err != nil {
+		t.Fatalf("Start(agent-one): %v", err)
+	}
+	done := make(chan struct{})
+	mc := &managedCity{
+		name: "bright-lights",
+		cancel: func() {
+			close(done)
+		},
+		done: done,
+		cr: &CityRuntime{
+			cfg: &config.City{Daemon: config.DaemonConfig{ShutdownTimeout: "20ms"}},
+			sp:  sp, rec: events.Discard, stdout: io.Discard, stderr: io.Discard,
+		},
+	}
+	if err := stopManagedCityPreservingSessions(mc, t.TempDir(), io.Discard); err != nil {
+		t.Fatalf("stopManagedCityPreservingSessions: %v", err)
+	}
+	mc.cr.shutdown()
+	running, err := sp.ListRunning("")
+	if err != nil {
+		t.Fatalf("ListRunning: %v", err)
+	}
+	if !slices.Contains(running, "agent-one") {
+		t.Fatalf("running sessions = %v, want agent-one preserved", running)
+	}
+}
+
+func TestSupervisorShutdownControllerDestructiveRequestIsSticky(t *testing.T) {
+	tests := []struct {
+		name     string
+		requests []supervisorShutdownMode
+		want     bool
+	}{
+		{name: "no request", want: false},
+		{name: "preserve only", requests: []supervisorShutdownMode{supervisorShutdownPreserveSessions}, want: true},
+		{name: "destructive only", requests: []supervisorShutdownMode{supervisorShutdownDestructive}, want: false},
+		{name: "destructive then preserve", requests: []supervisorShutdownMode{supervisorShutdownDestructive, supervisorShutdownPreserveSessions}, want: false},
+		{name: "preserve then destructive", requests: []supervisorShutdownMode{supervisorShutdownPreserveSessions, supervisorShutdownDestructive}, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctl := newSupervisorShutdownController()
+			for _, req := range tt.requests {
+				ctl.request(req)
+			}
+			if got := ctl.preservesSessions(); got != tt.want {
+				t.Fatalf("preservesSessions() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSupervisorShutdownControllerSettlesLateDestructiveRequest(t *testing.T) {
+	ctl := newSupervisorShutdownController()
+	ctl.request(supervisorShutdownPreserveSessions)
+
+	go func() {
+		time.Sleep(10 * time.Millisecond)
+		ctl.request(supervisorShutdownDestructive)
+	}()
+
+	if got := ctl.preservesSessionsAfterSettle(200 * time.Millisecond); got {
+		t.Fatal("preservesSessionsAfterSettle() = true, want false after late destructive request")
+	}
+}
+
+func TestSupervisorSignalLoopKeepsLateDestructiveEscalationUntilShutdownDone(t *testing.T) {
+	t.Setenv(supervisorPreserveSessionsOnSignalEnv, "1")
+	sigCh := make(chan os.Signal, 2)
+	done := make(chan struct{})
+	shutdownStarted := make(chan struct{})
+	var shutdownStartedOnce sync.Once
+	ctl := newSupervisorShutdownController()
+
+	go supervisorSignalLoop(sigCh, done, func(mode supervisorShutdownMode) {
+		ctl.request(mode)
+		shutdownStartedOnce.Do(func() { close(shutdownStarted) })
+	}, func() {})
+
+	sigCh <- syscall.SIGTERM
+	select {
+	case <-shutdownStarted:
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for preserve shutdown request")
+	}
+	sigCh <- syscall.SIGINT
+	defer close(done)
+
+	if got := ctl.preservesSessionsAfterSettle(200 * time.Millisecond); got {
+		t.Fatal("preservesSessionsAfterSettle() = true, want false after late SIGINT escalation")
+	}
+}
+
+func TestSupervisorShutdownModeForSignalPreservesOnlySIGTERMWhenConfigured(t *testing.T) {
+	t.Setenv(supervisorPreserveSessionsOnSignalEnv, "1")
+	if got := supervisorShutdownModeForSignal(syscall.SIGTERM); got != supervisorShutdownPreserveSessions {
+		t.Fatalf("SIGTERM shutdown mode = %v, want preserve", got)
+	}
+	if got := supervisorShutdownModeForSignal(syscall.SIGINT); got != supervisorShutdownDestructive {
+		t.Fatalf("SIGINT shutdown mode = %v, want destructive", got)
+	}
+}
+
+func TestStopSupervisorWithWaitStopsSystemdServiceAfterAckBeforeDone(t *testing.T) {
+	if goruntime.GOOS != "linux" {
+		t.Skip("systemd path only applies on linux")
+	}
+	gcHome := shortTempDir(t, "gc-home-")
+	runtimeDir := shortTempDir(t, "gc-run-")
+	t.Setenv("HOME", filepath.Dir(gcHome))
+	t.Setenv("GC_HOME", gcHome)
+	t.Setenv("XDG_RUNTIME_DIR", runtimeDir)
+
+	unitPath := supervisorSystemdServicePath()
+	if err := os.MkdirAll(filepath.Dir(unitPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", filepath.Dir(unitPath), err)
+	}
+	if err := os.WriteFile(unitPath, []byte("unit\n"), 0o600); err != nil {
+		t.Fatalf("WriteFile(%q): %v", unitPath, err)
+	}
+
+	var (
+		mu                    sync.Mutex
+		stopped               bool
+		serviceStopBeforeAck  bool
+		doneSentBeforeService bool
+		serviceStopSeen       bool
+		serviceStopOnce       sync.Once
+	)
+	ackSent := make(chan struct{})
+	serviceStopped := make(chan struct{})
+	oldRun := supervisorSystemctlRun
+	supervisorSystemctlRun = func(args ...string) error {
+		mu.Lock()
+		if len(args) >= 3 && args[1] == "stop" && args[2] == supervisorSystemdServiceName() {
+			select {
+			case <-ackSent:
+			default:
+				serviceStopBeforeAck = true
+			}
+			serviceStopSeen = true
+			serviceStopOnce.Do(func() { close(serviceStopped) })
+		}
+		mu.Unlock()
+		return nil
+	}
+	t.Cleanup(func() {
+		supervisorSystemctlRun = oldRun
+	})
+
+	sockPath := supervisorSocketPath()
+	if err := os.MkdirAll(filepath.Dir(sockPath), 0o700); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", filepath.Dir(sockPath), err)
+	}
+	lis, err := net.Listen("unix", sockPath)
+	if err != nil {
+		t.Fatalf("Listen(unix, %q): %v", sockPath, err)
+	}
+	t.Cleanup(func() {
+		lis.Close()         //nolint:errcheck
+		os.Remove(sockPath) //nolint:errcheck
+	})
+	go func() {
+		for {
+			conn, err := lis.Accept()
+			if err != nil {
+				return
+			}
+			go func(conn net.Conn) {
+				defer conn.Close() //nolint:errcheck
+				r := bufio.NewReader(conn)
+				line, err := r.ReadString('\n')
+				if err != nil {
+					return
+				}
+				switch strings.TrimSpace(line) {
+				case "ping":
+					mu.Lock()
+					defer mu.Unlock()
+					if stopped {
+						return
+					}
+					io.WriteString(conn, "4242\n") //nolint:errcheck
+				case "stop":
+					mu.Lock()
+					stopped = true
+					mu.Unlock()
+					io.WriteString(conn, "ok\n") //nolint:errcheck
+					close(ackSent)
+					select {
+					case <-serviceStopped:
+					case <-time.After(200 * time.Millisecond):
+						mu.Lock()
+						doneSentBeforeService = true
+						mu.Unlock()
+					}
+					io.WriteString(conn, "done:ok\n") //nolint:errcheck
+				}
+			}(conn)
+		}
+	}()
+
+	var stdout, stderr bytes.Buffer
+	if code := stopSupervisorWithWait(&stdout, &stderr, true, time.Second); code != 0 {
+		t.Fatalf("stopSupervisorWithWait code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if serviceStopBeforeAck {
+		t.Fatal("platform service was stopped before the supervisor acknowledged the destructive socket stop")
+	}
+	if doneSentBeforeService {
+		t.Fatal("supervisor reported done:ok before systemd stop was requested")
+	}
+	if !serviceStopSeen {
+		t.Fatal("systemd service was not stopped after the supervisor acknowledged the destructive socket stop")
+	}
+}
+
 // TestStopSupervisorWithWaitBlocksUntilSocketStops exercises the --wait
 // path of `gc supervisor stop`. The fake socket answers "ping" with a PID
 // (so supervisorAliveAtPath keeps returning alive) for ~200ms after the
diff --git a/cmd/gc/cmd_wait.go b/cmd/gc/cmd_wait.go
index 093b3017d9..8134365b27 100644
--- a/cmd/gc/cmd_wait.go
+++ b/cmd/gc/cmd_wait.go
@@ -62,6 +62,7 @@ func newSessionWaitCmd(stdout, stderr io.Writer) *cobra.Command {
 			}
 			return nil
 		},
+		ValidArgsFunction: completeSessionIDs,
 	}
 	cmd.Flags().StringSliceVar(&depIDs, "on-beads", nil, "bead IDs to watch")
 	cmd.Flags().BoolVar(&matchAny, "any", false, "wake when any watched bead closes (default: all)")
@@ -560,10 +561,21 @@ func prepareWaitWakeState(store beads.Store, now time.Time) (map[string]bool, er
 }
 
 func prepareWaitWakeStateForCity(cityPath string, store beads.Store, now time.Time) (map[string]bool, error) {
+	return prepareWaitWakeStateForCityWithSnapshot(cityPath, store, now, nil)
+}
+
+func prepareWaitWakeStateForCityWithSnapshot(cityPath string, store beads.Store, now time.Time, sessionBeads *sessionBeadSnapshot) (map[string]bool, error) {
 	waits, err := loadWaitBeads(store)
 	if err != nil {
 		return nil, err
 	}
+	if sessionBeads == nil {
+		var err error
+		sessionBeads, err = loadSessionBeadSnapshot(store)
+		if err != nil {
+			return nil, err
+		}
+	}
 	readyWaitSet := make(map[string]bool)
 	for _, wait := range waits {
 		state := wait.Metadata["state"]
@@ -574,9 +586,20 @@ func prepareWaitWakeStateForCity(cityPath string, store beads.Store, now time.Ti
 		if isWaitTerminal(state) {
 			continue
 		}
-		sessionBead, err := store.Get(sessionID)
-		if err != nil {
-			continue
+		sessionBead, ok := sessionBeads.FindByID(sessionID)
+		if !ok {
+			if wait.Metadata["registered_epoch"] != "" {
+				var found bool
+				sessionBead, found, err = lookupSessionBeadByID(store, sessionID)
+				if err != nil {
+					return nil, err
+				}
+				if !found {
+					continue
+				}
+			} else {
+				continue
+			}
 		}
 		if epoch := wait.Metadata["registered_epoch"]; epoch != "" && sessionBead.Metadata["continuation_epoch"] != "" && epoch != sessionBead.Metadata["continuation_epoch"] {
 			if err := setWaitTerminalState(store, wait.ID, map[string]string{
@@ -591,6 +614,9 @@ func prepareWaitWakeStateForCity(cityPath string, store beads.Store, now time.Ti
 			}
 			continue
 		}
+		if !ok {
+			continue
+		}
 		if expiresAt := wait.Metadata["expires_at"]; expiresAt != "" {
 			if ts, err := time.Parse(time.RFC3339, expiresAt); err == nil && !ts.After(now) {
 				if err := setWaitTerminalState(store, wait.ID, map[string]string{
@@ -652,11 +678,39 @@ func prepareWaitWakeStateForCity(cityPath string, store beads.Store, now time.Ti
 	return readyWaitSet, nil
 }
 
-func dispatchReadyWaitNudges(cityPath string, store beads.Store, sp runtime.Provider, now time.Time) error {
+func lookupSessionBeadByID(store beads.Store, id string) (beads.Bead, bool, error) {
+	if store == nil || strings.TrimSpace(id) == "" {
+		return beads.Bead{}, false, nil
+	}
+	bead, err := store.Get(id)
+	if err != nil {
+		if errors.Is(err, beads.ErrNotFound) {
+			return beads.Bead{}, false, nil
+		}
+		return beads.Bead{}, false, err
+	}
+	if !sessionpkg.IsSessionBeadOrRepairable(bead) {
+		return beads.Bead{}, false, nil
+	}
+	return bead, true, nil
+}
+
+func dispatchReadyWaitNudges(cityPath string, store beads.Store, _ runtime.Provider, now time.Time) error {
+	return dispatchReadyWaitNudgesWithSnapshot(cityPath, store, now, nil)
+}
+
+func dispatchReadyWaitNudgesWithSnapshot(cityPath string, store beads.Store, now time.Time, sessionBeads *sessionBeadSnapshot) error {
 	waits, err := loadWaitBeads(store)
 	if err != nil {
 		return err
 	}
+	if sessionBeads == nil {
+		var err error
+		sessionBeads, err = loadSessionBeadSnapshot(store)
+		if err != nil {
+			return err
+		}
+	}
 	for _, wait := range waits {
 		if wait.Metadata["state"] != waitStateReady {
 			continue
@@ -665,12 +719,11 @@ func dispatchReadyWaitNudges(cityPath string, store beads.Store, sp runtime.Prov
 		if sessionID == "" {
 			continue
 		}
-		sessionBead, err := store.Get(sessionID)
-		if err != nil {
+		sessionBead, ok := sessionBeads.FindByID(sessionID)
+		if !ok {
 			continue
 		}
-		running, err := workerSessionTargetRunningWithConfig(cityPath, store, sp, nil, sessionID)
-		if err != nil || !running {
+		if !cachedSessionCanReceiveWaitNudge(sessionBead) {
 			continue
 		}
 		nudgeID := waitNudgeID(wait)
@@ -711,6 +764,15 @@ func dispatchReadyWaitNudges(cityPath string, store beads.Store, sp runtime.Prov
 	return nil
 }
 
+func cachedSessionCanReceiveWaitNudge(sessionBead beads.Bead) bool {
+	switch sessionpkg.State(strings.TrimSpace(sessionBead.Metadata["state"])) {
+	case "", sessionpkg.StateActive, sessionpkg.StateAwake:
+		return true
+	default:
+		return false
+	}
+}
+
 func finalizeReadyWaitFromNudge(store beads.Store, wait beads.Bead, now time.Time) (bool, error) {
 	nudgeID := wait.Metadata["nudge_id"]
 	if nudgeID == "" {
diff --git a/cmd/gc/cmd_wait_test.go b/cmd/gc/cmd_wait_test.go
index 5a52123a6d..8e5838175a 100644
--- a/cmd/gc/cmd_wait_test.go
+++ b/cmd/gc/cmd_wait_test.go
@@ -29,6 +29,11 @@ type waitNudgeMetadataFailStore struct {
 	*beads.MemStore
 }
 
+type waitGetSpyStore struct {
+	beads.Store
+	getIDs []string
+}
+
 func (s waitNudgeMetadataFailStore) SetMetadata(id, key, value string) error {
 	if key == "nudge_id" {
 		return errors.New("set nudge id failed")
@@ -36,6 +41,11 @@ func (s waitNudgeMetadataFailStore) SetMetadata(id, key, value string) error {
 	return s.MemStore.SetMetadata(id, key, value)
 }
 
+func (s *waitGetSpyStore) Get(id string) (beads.Bead, error) {
+	s.getIDs = append(s.getIDs, id)
+	return s.Store.Get(id)
+}
+
 var (
 	waitTestRealBDPathOnce sync.Once
 	waitTestRealBDCached   string
@@ -74,21 +84,16 @@ func waitTestRealBDPath(t *testing.T) string {
 	t.Helper()
 	skipSlowCmdGCTest(t, "requires a managed bd lifecycle city; run make test-cmd-gc-process for full coverage")
 	waitTestRealBDPathOnce.Do(func() {
-		for _, dir := range filepath.SplitList(os.Getenv("PATH")) {
-			if strings.TrimSpace(dir) == "" {
-				continue
-			}
-			candidate := filepath.Join(dir, "bd")
-			info, err := os.Stat(candidate)
-			if err != nil || info.IsDir() {
-				continue
-			}
-			cmd := exec.Command(candidate, "init", "--help")
-			out, err := cmd.CombinedOutput()
-			if err == nil || !strings.Contains(string(out), `unknown subcommand "init"`) {
-				waitTestRealBDCached = candidate
-				return
-			}
+		candidate, err := findPreferredBinary("bd")
+		if err != nil {
+			waitTestRealBDErr = errors.New("bd with init not installed")
+			return
+		}
+		cmd := exec.Command(candidate, "init", "--help")
+		out, err := cmd.CombinedOutput()
+		if err == nil || !strings.Contains(string(out), `unknown subcommand "init"`) {
+			waitTestRealBDCached = candidate
+			return
 		}
 		waitTestRealBDErr = errors.New("bd with init not installed")
 	})
@@ -432,6 +437,150 @@ func TestPrepareWaitWakeState_FinalizesFromNudge(t *testing.T) {
 	}
 }
 
+func TestPrepareWaitWakeState_UsesTargetedLookupForMissingSessionEpoch(t *testing.T) {
+	base := beads.NewMemStore()
+	store := &waitGetSpyStore{Store: base}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "worker",
+			"agent_name":         "worker",
+			"continuation_epoch": "1",
+			"state":              string(sessionpkg.StateActive),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if err := store.Close(sessionBead.ID); err != nil {
+		t.Fatalf("close session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   waitBeadType,
+		Labels: []string{waitBeadLabel, "session:" + sessionBead.ID},
+		Metadata: map[string]string{
+			"session_id":       sessionBead.ID,
+			"session_name":     "worker",
+			"kind":             "deps",
+			"state":            waitStateReady,
+			"registered_epoch": "1",
+		},
+	}); err != nil {
+		t.Fatalf("create wait bead: %v", err)
+	}
+
+	readyWaitSet, err := prepareWaitWakeState(store, time.Now().UTC())
+	if err != nil {
+		t.Fatalf("prepareWaitWakeState: %v", err)
+	}
+	if len(readyWaitSet) != 0 {
+		t.Fatalf("readyWaitSet = %#v, want empty for non-open session", readyWaitSet)
+	}
+	if len(store.getIDs) != 1 || store.getIDs[0] != sessionBead.ID {
+		t.Fatalf("Get IDs = %v, want targeted lookup for %s", store.getIDs, sessionBead.ID)
+	}
+}
+
+func TestPrepareWaitWakeState_SkipsMissingOpenSessionWithoutEpochLookup(t *testing.T) {
+	base := beads.NewMemStore()
+	store := &waitGetSpyStore{Store: base}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"agent_name":   "worker",
+			"state":        string(sessionpkg.StateActive),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if err := store.Close(sessionBead.ID); err != nil {
+		t.Fatalf("close session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   waitBeadType,
+		Labels: []string{waitBeadLabel, "session:" + sessionBead.ID},
+		Metadata: map[string]string{
+			"session_id":   sessionBead.ID,
+			"session_name": "worker",
+			"kind":         "deps",
+			"state":        waitStateReady,
+		},
+	}); err != nil {
+		t.Fatalf("create wait bead: %v", err)
+	}
+
+	readyWaitSet, err := prepareWaitWakeState(store, time.Now().UTC())
+	if err != nil {
+		t.Fatalf("prepareWaitWakeState: %v", err)
+	}
+	if len(readyWaitSet) != 0 {
+		t.Fatalf("readyWaitSet = %#v, want empty for non-open session", readyWaitSet)
+	}
+	if len(store.getIDs) != 0 {
+		t.Fatalf("Get IDs = %v, want no closed-session lookup without an epoch", store.getIDs)
+	}
+}
+
+func TestPrepareWaitWakeState_CancelsStaleEpochWaitForClosedSession(t *testing.T) {
+	base := beads.NewMemStore()
+	store := &waitGetSpyStore{Store: base}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "worker",
+			"agent_name":         "worker",
+			"continuation_epoch": "2",
+			"state":              string(sessionpkg.StateActive),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if err := store.Close(sessionBead.ID); err != nil {
+		t.Fatalf("close session bead: %v", err)
+	}
+	waitBead, err := store.Create(beads.Bead{
+		Type:   waitBeadType,
+		Labels: []string{waitBeadLabel, "session:" + sessionBead.ID},
+		Metadata: map[string]string{
+			"session_id":       sessionBead.ID,
+			"session_name":     "worker",
+			"kind":             "deps",
+			"state":            waitStateReady,
+			"registered_epoch": "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create wait bead: %v", err)
+	}
+
+	readyWaitSet, err := prepareWaitWakeState(store, time.Now().UTC())
+	if err != nil {
+		t.Fatalf("prepareWaitWakeState: %v", err)
+	}
+	if len(readyWaitSet) != 0 {
+		t.Fatalf("readyWaitSet = %#v, want empty after stale wait cancellation", readyWaitSet)
+	}
+	updated, err := store.Get(waitBead.ID)
+	if err != nil {
+		t.Fatalf("store.Get(wait): %v", err)
+	}
+	if got := updated.Metadata["state"]; got != waitStateCanceled {
+		t.Fatalf("wait state = %q, want %q", got, waitStateCanceled)
+	}
+	if got := updated.Metadata["last_error"]; got != "continuation-stale" {
+		t.Fatalf("last_error = %q, want continuation-stale", got)
+	}
+	if updated.Status != "closed" {
+		t.Fatalf("wait status = %q, want closed", updated.Status)
+	}
+}
+
 func TestDepsWaitReady_IgnoresEmptyDependencyEntries(t *testing.T) {
 	store := beads.NewMemStore()
 	dep, err := store.Create(beads.Bead{Title: "dep"})
@@ -738,6 +887,111 @@ func TestDispatchReadyWaitNudges_EnqueuesDeterministicNudge(t *testing.T) {
 	}
 }
 
+func TestDispatchReadyWaitNudges_UsesOpenSessionSnapshotInsteadOfWorkerRunningCheck(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	dir := t.TempDir()
+	base := beads.NewMemStore()
+	store := &waitGetSpyStore{Store: base}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "worker",
+			"agent_name":         "worker",
+			"template":           "worker",
+			"continuation_epoch": "1",
+			"state":              string(sessionpkg.StateActive),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:        waitBeadType,
+		Labels:      []string{waitBeadLabel, "session:" + sessionBead.ID},
+		Description: "Continue after review closes.",
+		Metadata: map[string]string{
+			"session_id":       sessionBead.ID,
+			"session_name":     "worker",
+			"kind":             "deps",
+			"state":            waitStateReady,
+			"dep_ids":          "gc-1",
+			"dep_mode":         "all",
+			"registered_epoch": "1",
+			"delivery_attempt": "1",
+		},
+	}); err != nil {
+		t.Fatalf("create wait bead: %v", err)
+	}
+	sp := runtime.NewFake()
+
+	if err := dispatchReadyWaitNudges(dir, store, sp, time.Now().UTC()); err != nil {
+		t.Fatalf("dispatchReadyWaitNudges: %v", err)
+	}
+	for _, id := range store.getIDs {
+		if id == sessionBead.ID {
+			t.Fatalf("dispatch used Get for session %s instead of the open-session snapshot; getIDs=%v", sessionBead.ID, store.getIDs)
+		}
+	}
+	for _, call := range sp.Calls {
+		switch call.Method {
+		case "IsRunning", "ProcessAlive", "IsAttached", "GetLastActivity", "GetMeta":
+			t.Fatalf("dispatch should trust cached session state, saw provider call %#v", call)
+		}
+	}
+}
+
+func TestDispatchReadyWaitNudges_SkipsClosedSessionWithoutBackingGet(t *testing.T) {
+	t.Setenv("GC_BEADS", "file")
+	dir := t.TempDir()
+	base := beads.NewMemStore()
+	store := &waitGetSpyStore{Store: base}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "worker",
+			"agent_name":         "worker",
+			"template":           "worker",
+			"continuation_epoch": "1",
+			"state":              string(sessionpkg.StateActive),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if err := store.Close(sessionBead.ID); err != nil {
+		t.Fatalf("close session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   waitBeadType,
+		Labels: []string{waitBeadLabel, "session:" + sessionBead.ID},
+		Metadata: map[string]string{
+			"session_id":       sessionBead.ID,
+			"session_name":     "worker",
+			"kind":             "deps",
+			"state":            waitStateReady,
+			"registered_epoch": "1",
+			"delivery_attempt": "1",
+		},
+	}); err != nil {
+		t.Fatalf("create wait bead: %v", err)
+	}
+	sp := runtime.NewFake()
+
+	if err := dispatchReadyWaitNudges(dir, store, sp, time.Now().UTC()); err != nil {
+		t.Fatalf("dispatchReadyWaitNudges: %v", err)
+	}
+	for _, id := range store.getIDs {
+		if id == sessionBead.ID {
+			t.Fatalf("dispatch used Get for closed session %s; getIDs=%v", sessionBead.ID, store.getIDs)
+		}
+	}
+	if len(sp.Calls) != 0 {
+		t.Fatalf("dispatch should not query provider for a session absent from the open-session snapshot, calls=%#v", sp.Calls)
+	}
+}
+
 func TestDispatchReadyWaitNudges_StartsCodexPoller(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
 	dir := t.TempDir()
@@ -1106,7 +1360,7 @@ func TestCmdSessionWait_AllowsRigDependencyBeads(t *testing.T) {
 	if err := rigStore.Close(dep.ID); err != nil {
 		t.Fatalf("close rig dep bead: %v", err)
 	}
-	if got := beadPrefix(dep.ID); got != "fe" {
+	if got := beadPrefix(nil, dep.ID); got != "fe" {
 		t.Fatalf("rig dep prefix = %q, want %q", got, "fe")
 	}
 
@@ -1182,7 +1436,7 @@ func TestPrepareWaitWakeState_ResolvesRigDependencyBeads(t *testing.T) {
 	if err := rigStore.Close(dep.ID); err != nil {
 		t.Fatalf("close rig dep bead: %v", err)
 	}
-	if got := beadPrefix(dep.ID); got != "fe" {
+	if got := beadPrefix(nil, dep.ID); got != "fe" {
 		t.Fatalf("rig dep prefix = %q, want %q", got, "fe")
 	}
 	cityStore, err = openCityStoreAt(cityPath)
diff --git a/cmd/gc/completion.go b/cmd/gc/completion.go
new file mode 100644
index 0000000000..fd06865e63
--- /dev/null
+++ b/cmd/gc/completion.go
@@ -0,0 +1,275 @@
+package main
+
+import (
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/orders"
+	"github.com/gastownhall/gascity/internal/session"
+	"github.com/spf13/cobra"
+)
+
+// Tab completion is load-bearing: these functions are called on every
+// keystroke after <TAB>. They must be fast and never write to the terminal,
+// since any stderr output would appear as garbage under the user's prompt.
+// All errors are swallowed; a failed completion returns an empty candidate
+// list with ShellCompDirectiveNoFileComp so the shell doesn't fall back to
+// filename completion.
+
+// completeSessionIDs completes session IDs and aliases for commands whose
+// first positional argument is a session ID-or-alias.
+func completeSessionIDs(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	if len(args) > 0 {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	sessions := loadSessionsForCompletion()
+	candidates := make([]string, 0, len(sessions)*2)
+	for _, s := range sessions {
+		desc := sessionCompletionDescription(s)
+		if strings.HasPrefix(s.ID, toComplete) {
+			candidates = append(candidates, s.ID+"\t"+desc)
+		}
+		if s.Alias != "" && s.Alias != s.ID && strings.HasPrefix(s.Alias, toComplete) {
+			candidates = append(candidates, s.Alias+"\t"+desc)
+		}
+	}
+	return candidates, cobra.ShellCompDirectiveNoFileComp
+}
+
+// completeRigNames completes rig names for commands whose first positional
+// is a rig name.
+func completeRigNames(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	if len(args) > 0 {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	return rigNameCandidates(toComplete), cobra.ShellCompDirectiveNoFileComp
+}
+
+// completeRigFlagNames completes rig names for --rig flags. Flag completion
+// must ignore existing positional args; a user often completes --rig after
+// typing the command's required positional.
+func completeRigFlagNames(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return rigNameCandidates(toComplete), cobra.ShellCompDirectiveNoFileComp
+}
+
+// completeOrderNames completes order names for commands whose first
+// positional is an order name.
+func completeOrderNames(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	if len(args) > 0 {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	aa := loadOrdersForCompletion()
+	candidates := make([]string, 0, len(aa))
+	for _, o := range aa {
+		if !strings.HasPrefix(o.Name, toComplete) {
+			continue
+		}
+		candidates = append(candidates, o.Name+"\t"+orderCompletionDescription(o))
+	}
+	return candidates, cobra.ShellCompDirectiveNoFileComp
+}
+
+// quietDefaultLogger runs fn with the default log.Logger's output redirected
+// to io.Discard, then restores it. Needed because some internal paths (e.g.,
+// orders discovery) write migration warnings via log.Printf, which would
+// corrupt the terminal during tab completion. This helper is intended only for
+// one-shot completion paths; it is not safe against concurrent log writer
+// mutation.
+func quietDefaultLogger(fn func()) {
+	orig := log.Default().Writer()
+	log.SetOutput(io.Discard)
+	defer log.SetOutput(orig)
+	fn()
+}
+
+// rigNameCandidates returns rig names with path descriptions as cobra
+// completion entries.
+func rigNameCandidates(toComplete string) []string {
+	var candidates []string
+	quietDefaultLogger(func() {
+		cityPath, err := resolveCityForCompletionContext(false)
+		if err != nil {
+			return
+		}
+		cfg, err := loadCityConfigFS(fsys.OSFS{}, filepath.Join(cityPath, "city.toml"), io.Discard)
+		if err != nil {
+			return
+		}
+		resolveRigPaths(cityPath, cfg.Rigs)
+		candidates = make([]string, 0, len(cfg.Rigs))
+		for i := range cfg.Rigs {
+			name := cfg.Rigs[i].Name
+			if !strings.HasPrefix(name, toComplete) {
+				continue
+			}
+			desc := cfg.Rigs[i].Path
+			if cfg.Rigs[i].Suspended {
+				desc += " (suspended)"
+			}
+			candidates = append(candidates, name+"\t"+desc)
+		}
+	})
+	return candidates
+}
+
+func resolveCityForCompletion() (string, error) {
+	return resolveCityForCompletionContext(true)
+}
+
+func resolveCityForCompletionContext(honorRigFlag bool) (string, error) {
+	if city := strings.TrimSpace(cityFlag); city != "" {
+		return validateCityPath(city)
+	}
+	if honorRigFlag {
+		if rig := strings.TrimSpace(rigFlag); rig != "" {
+			ctx, err := resolveRigForCompletion(rig)
+			if err != nil {
+				return "", err
+			}
+			return ctx.CityPath, nil
+		}
+	}
+	if cityPath, ok := resolveExplicitCityPathEnv(); ok {
+		return cityPath, nil
+	}
+	if cityPath, ok := resolveCityPathFromGCDir(); ok {
+		return cityPath, nil
+	}
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	if ctx, ok := lookupRigFromCwd(cwd); ok {
+		return ctx.CityPath, nil
+	}
+	return findCity(cwd)
+}
+
+func resolveRigForCompletion(nameOrPath string) (resolvedContext, error) {
+	matches, _, err := registeredRigBindingsByName(nameOrPath, false)
+	if err != nil {
+		return resolvedContext{}, err
+	}
+	if len(matches) > 0 {
+		return resolveRigBindingMatches(nameOrPath, matches)
+	}
+
+	abs, err := filepath.Abs(nameOrPath)
+	if err != nil {
+		return resolvedContext{}, err
+	}
+	matches, _, err = registeredRigBindingsByPath(abs, false)
+	if err != nil {
+		return resolvedContext{}, err
+	}
+	if len(matches) > 0 {
+		return resolveRigBindingMatches(abs, matches)
+	}
+	return resolvedContext{}, os.ErrNotExist
+}
+
+func loadOrdersForCompletion() []orders.Order {
+	var aa []orders.Order
+	quietDefaultLogger(func() {
+		cityPath, err := resolveCityForCompletion()
+		if err != nil {
+			return
+		}
+		cfg, err := loadCityConfig(cityPath, io.Discard)
+		if err != nil {
+			return
+		}
+		var code int
+		aa, code = loadAllOrders(cityPath, cfg, io.Discard, "gc completion")
+		if code != 0 {
+			aa = nil
+		}
+	})
+	return aa
+}
+
+// loadSessionsForCompletion returns session info without triggering the
+// slow live-state and attachment checks performed by the non-JSON path of
+// `gc session list`. This mirrors the JSON-path of cmdSessionList.
+func loadSessionsForCompletion() []session.Info {
+	var sessions []session.Info
+	quietDefaultLogger(func() {
+		cityPath, err := resolveCityForCompletion()
+		if err != nil {
+			return
+		}
+		store, err := openCityStoreAt(cityPath)
+		if err != nil {
+			return
+		}
+		cfg, err := loadCityConfig(cityPath, io.Discard)
+		if err != nil {
+			return
+		}
+		providerCtx := sessionProviderContextForCity(cfg, cityPath, os.Getenv("GC_SESSION"))
+		allSessionBeads, err := store.List(beads.ListQuery{
+			Label: session.LabelSession,
+			Sort:  beads.SortCreatedDesc,
+		})
+		if err != nil {
+			return
+		}
+		sessionBeads := newSessionBeadSnapshot(allSessionBeads)
+		sp, err := newSessionProviderFromContextWithError(providerCtx, sessionBeads)
+		if err != nil {
+			return
+		}
+		catalog, err := workerSessionCatalogWithConfig("", store, sp, providerCtx.cfg)
+		if err != nil {
+			return
+		}
+		sessions = catalog.ListFullFromBeads(allSessionBeads, "", "").Sessions
+	})
+	return sessions
+}
+
+// sessionCompletionDescription formats a session as "alias (state)" or
+// "template (state)" when no alias is set. Title is omitted to keep the
+// zsh completion menu scannable.
+func sessionCompletionDescription(s session.Info) string {
+	target := s.Alias
+	if target == "" {
+		target = s.Template
+	}
+	if target == "" {
+		target = "-"
+	}
+	state := string(s.State)
+	if state == "" {
+		state = "closed"
+	}
+	return target + " (" + state + ")"
+}
+
+// orderCompletionDescription formats an order as "<type>, <timing>" where
+// type is "formula" or "exec" and timing is interval/schedule/event.
+func orderCompletionDescription(o orders.Order) string {
+	typ := "formula"
+	if o.IsExec() {
+		typ = "exec"
+	}
+	timing := o.Interval
+	if timing == "" {
+		timing = o.Schedule
+	}
+	if timing == "" {
+		timing = o.On
+	}
+	if timing == "" {
+		timing = "-"
+	}
+	if o.Rig != "" {
+		return typ + ", " + timing + " (rig: " + o.Rig + ")"
+	}
+	return typ + ", " + timing
+}
diff --git a/cmd/gc/completion_test.go b/cmd/gc/completion_test.go
new file mode 100644
index 0000000000..a59fbd796a
--- /dev/null
+++ b/cmd/gc/completion_test.go
@@ -0,0 +1,461 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/orders"
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/session"
+	"github.com/spf13/cobra"
+)
+
+func TestCompleteSessionIDs_EarlyExitOnExtraArgs(t *testing.T) {
+	// When the positional is already satisfied, the completer must return no
+	// candidates and must not attempt to open the city store — otherwise it
+	// would error out or emit noise for every keystroke after the ID is typed.
+	got, dir := completeSessionIDs(nil, []string{"gc-42"}, "anything")
+	if len(got) != 0 {
+		t.Errorf("expected no candidates with args set, got %v", got)
+	}
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("expected NoFileComp directive, got %v", dir)
+	}
+}
+
+func TestCompleteRigNames_EarlyExitOnExtraArgs(t *testing.T) {
+	got, dir := completeRigNames(nil, []string{"myrig"}, "x")
+	if len(got) != 0 {
+		t.Errorf("expected no candidates, got %v", got)
+	}
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("expected NoFileComp directive, got %v", dir)
+	}
+}
+
+func TestCompleteOrderNames_EarlyExitOnExtraArgs(t *testing.T) {
+	got, dir := completeOrderNames(nil, []string{"some-order"}, "x")
+	if len(got) != 0 {
+		t.Errorf("expected no candidates, got %v", got)
+	}
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("expected NoFileComp directive, got %v", dir)
+	}
+}
+
+func TestSessionCompletionDescription(t *testing.T) {
+	cases := []struct {
+		name string
+		in   session.Info
+		want string
+	}{
+		{"alias + state", session.Info{Alias: "mayor", State: session.State("asleep")}, "mayor (asleep)"},
+		{"template fallback", session.Info{Template: "gascity/claude", State: session.State("active")}, "gascity/claude (active)"},
+		{"empty state renders as closed", session.Info{Alias: "a"}, "a (closed)"},
+		{"no alias and no template", session.Info{State: session.State("suspended")}, "- (suspended)"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := sessionCompletionDescription(tc.in)
+			if got != tc.want {
+				t.Errorf("got %q want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestOrderCompletionDescription(t *testing.T) {
+	cases := []struct {
+		name string
+		in   orders.Order
+		want string
+	}{
+		{"formula + interval", orders.Order{Formula: "f", Interval: "5m"}, "formula, 5m"},
+		{"exec + schedule", orders.Order{Exec: "s", Schedule: "0 0 * * *"}, "exec, 0 0 * * *"},
+		{"formula + event", orders.Order{Formula: "f", On: "bead.closed"}, "formula, bead.closed"},
+		{"rig scoped", orders.Order{Formula: "f", Interval: "5m", Rig: "frontend"}, "formula, 5m (rig: frontend)"},
+		{"no timing", orders.Order{Formula: "f"}, "formula, -"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := orderCompletionDescription(tc.in)
+			if got != tc.want {
+				t.Errorf("got %q want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestQuietDefaultLogger_RestoresOutput(t *testing.T) {
+	// The default logger's writer must be restored after fn returns, even if
+	// fn panics or writes to it — otherwise a single noisy completion call
+	// would leave the logger silenced for the rest of the process.
+	origWriter := log.Default().Writer()
+	t.Cleanup(func() { log.SetOutput(origWriter) })
+
+	var before bytes.Buffer
+	log.SetOutput(&before)
+
+	quietDefaultLogger(func() {
+		log.Print("silenced")
+	})
+	if strings.Contains(before.String(), "silenced") {
+		t.Errorf("expected log output to be suppressed inside quietDefaultLogger, got %q", before.String())
+	}
+
+	log.Print("audible")
+	if !strings.Contains(before.String(), "audible") {
+		t.Errorf("expected log output restored after quietDefaultLogger, got %q", before.String())
+	}
+}
+
+func TestResolveCityForCompletion_UsesExplicitRigBindingOutsideCity(t *testing.T) {
+	gcHome := t.TempDir()
+	cityPath := t.TempDir()
+	rigDir := filepath.Join(cityPath, "rigs", "frontend")
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("GC_HOME", gcHome)
+	registerRigBindingForResolution(t, gcHome, cityPath, "completion-city", "frontend", rigDir)
+
+	isolateCompletionContext(t, "")
+	rigFlag = "frontend"
+	t.Chdir(t.TempDir())
+
+	got, err := resolveCityForCompletion()
+	if err != nil {
+		t.Fatalf("resolveCityForCompletion: %v", err)
+	}
+	if !samePath(got, cityPath) {
+		t.Fatalf("city path = %q, want %q", got, cityPath)
+	}
+}
+
+func TestRigNameCandidates_LoadsAndFilters(t *testing.T) {
+	// Integration check for the rig source-of-truth — exercises resolveCity
+	// (via t.Chdir into a temp city), loadCityConfigFS, and the prefix filter.
+	cityPath := t.TempDir()
+	cityToml := "[workspace]\nname = \"my-city\"\n\n[[rigs]]\nname = \"alpha\"\npath = \"/tmp/alpha\"\n\n[[rigs]]\nname = \"beta\"\npath = \"/tmp/beta\"\n"
+	writeCompletionCity(t, cityPath, cityToml)
+	isolateCompletionContext(t, "")
+	t.Chdir(cityPath)
+	t.Setenv("GC_RIG", "ambient-rig-from-agent-session")
+	t.Setenv("GC_RIG_ROOT", "/does/not/matter")
+
+	got := rigNameCandidates("")
+	if len(got) != 2 {
+		t.Fatalf("expected 2 rig candidates, got %d: %v", len(got), got)
+	}
+	names := make([]string, len(got))
+	for i, c := range got {
+		names[i] = strings.SplitN(c, "\t", 2)[0]
+	}
+	for _, want := range []string{"alpha", "beta"} {
+		if !slicesContains(names, want) {
+			t.Errorf("missing candidate %q in %v", want, names)
+		}
+	}
+	if slicesContains(names, "my-city") {
+		t.Errorf("synthetic HQ candidate should not be offered for rig arguments: %v", names)
+	}
+
+	// Prefix filter.
+	got = rigNameCandidates("al")
+	if len(got) != 1 || !strings.HasPrefix(got[0], "alpha\t") {
+		t.Errorf("expected only alpha candidate for prefix 'al', got %v", got)
+	}
+}
+
+func TestCompleteRigFlagNames_IgnoresPositionalArgs(t *testing.T) {
+	cityPath := t.TempDir()
+	writeCompletionCity(t, cityPath, "[workspace]\nname = \"my-city\"\n\n[[rigs]]\nname = \"alpha\"\npath = \"/tmp/alpha\"\n\n[[rigs]]\nname = \"beta\"\npath = \"/tmp/beta\"\n")
+	isolateCompletionContext(t, cityPath)
+
+	for _, cmd := range []*cobra.Command{
+		newOrderShowCmd(os.Stdout, os.Stderr),
+		newOrderRunCmd(os.Stdout, os.Stderr),
+	} {
+		complete, ok := cmd.GetFlagCompletionFunc("rig")
+		if !ok {
+			t.Fatalf("%s missing --rig completion function", cmd.Name())
+		}
+		got, dir := complete(cmd, []string{"existing-order"}, "a")
+		if dir != cobra.ShellCompDirectiveNoFileComp {
+			t.Errorf("%s --rig directive = %v, want NoFileComp", cmd.Name(), dir)
+		}
+		if len(got) != 1 || !strings.HasPrefix(got[0], "alpha\t") {
+			t.Errorf("%s --rig completion with positional args = %v, want alpha", cmd.Name(), got)
+		}
+	}
+}
+
+func TestCompleteOrderNames_LoadsOrders(t *testing.T) {
+	cityPath := t.TempDir()
+	writeCompletionCity(t, cityPath, "[workspace]\nname = \"orders-city\"\n")
+	isolateCompletionContext(t, cityPath)
+	if err := os.MkdirAll(filepath.Join(cityPath, "orders"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, "orders", "digest.toml"), []byte(`
+[order]
+formula = "mol-digest"
+trigger = "cron"
+schedule = "*/5 * * * *"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, dir := completeOrderNames(nil, nil, "di")
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("directive = %v, want NoFileComp", dir)
+	}
+	if len(got) != 1 || got[0] != "digest\tformula, */5 * * * *" {
+		t.Fatalf("order candidates = %v, want digest with cron description", got)
+	}
+}
+
+func TestCompleteOrderNames_SuppressesConfigPackWarnings(t *testing.T) {
+	cityPath := t.TempDir()
+	writeCompletionCity(t, cityPath, `[workspace]
+name = "orders-city"
+includes = ["packs/missing"]
+`)
+	isolateCompletionContext(t, cityPath)
+
+	origWriter := log.Default().Writer()
+	t.Cleanup(func() { log.SetOutput(origWriter) })
+	var logs bytes.Buffer
+	log.SetOutput(&logs)
+
+	_, dir := completeOrderNames(nil, nil, "")
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("directive = %v, want NoFileComp", dir)
+	}
+	if logs.Len() != 0 {
+		t.Fatalf("completion wrote default logger output: %q", logs.String())
+	}
+}
+
+func TestCompleteSessionIDs_LoadsBeadBackedSessions(t *testing.T) {
+	cityPath := t.TempDir()
+	writeCompletionCity(t, cityPath, `[workspace]
+name = "sessions-city"
+
+[session]
+provider = "fake"
+
+[beads]
+provider = "file"
+`)
+	isolateCompletionContext(t, cityPath)
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt(%q): %v", cityPath, err)
+	}
+	created, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "sessions-city--worker",
+			"state":        "asleep",
+			"template":     "codex",
+		},
+	})
+	if err != nil {
+		t.Fatalf("store.Create(session): %v", err)
+	}
+
+	got, dir := completeSessionIDs(nil, nil, "")
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("directive = %v, want NoFileComp", dir)
+	}
+	names := completionCandidateNames(got)
+	if !slicesContains(names, created.ID) {
+		t.Errorf("session ID candidate %q missing from %v", created.ID, got)
+	}
+	if !slicesContains(names, "worker") {
+		t.Errorf("session alias candidate missing from %v", got)
+	}
+	if !slicesContains(got, "worker\tworker (asleep)") {
+		t.Errorf("session alias description missing from %v", got)
+	}
+}
+
+func TestLoadSessionsForCompletion_SwallowsProviderConstructionError(t *testing.T) {
+	cityPath := t.TempDir()
+	writeCompletionCity(t, cityPath, `[workspace]
+name = "sessions-city"
+
+[session]
+provider = "fake"
+
+[beads]
+provider = "file"
+
+[providers.opencode]
+command = "/bin/echo"
+path_check = "true"
+supports_acp = true
+acp_command = "/bin/echo"
+
+[[agent]]
+name = "worker"
+provider = "opencode"
+session = "acp"
+`)
+	isolateCompletionContext(t, cityPath)
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		t.Fatalf("openCityStoreAt(%q): %v", cityPath, err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+	}); err != nil {
+		t.Fatalf("store.Create(session): %v", err)
+	}
+	oldBuild := buildSessionProviderByName
+	t.Cleanup(func() { buildSessionProviderByName = oldBuild })
+	buildSessionProviderByName = func(name string, sc config.SessionConfig, cityName, cityPath string) (runtime.Provider, error) {
+		if name == "acp" {
+			return nil, errors.New("provider unavailable")
+		}
+		return oldBuild(name, sc, cityName, cityPath)
+	}
+
+	got := loadSessionsForCompletion()
+	if len(got) != 0 {
+		t.Fatalf("sessions = %v, want none after provider construction failure", got)
+	}
+}
+
+func TestCompleteOrderNames_DistinguishesSameNameRigOrders(t *testing.T) {
+	cityPath := t.TempDir()
+	sidecarPackDir := filepath.Join(cityPath, "packs", "sidecar")
+	for _, dir := range []string{
+		filepath.Join(cityPath, ".gc"),
+		filepath.Join(cityPath, "rigs", "frontend"),
+		filepath.Join(cityPath, "rigs", "backend"),
+		filepath.Join(sidecarPackDir, "formulas"),
+		filepath.Join(sidecarPackDir, "orders"),
+	} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	writeFile(t, filepath.Join(cityPath, "pack.toml"), `
+[pack]
+name = "orders-city"
+schema = 2
+`)
+	writeFile(t, filepath.Join(cityPath, "city.toml"), `
+[workspace]
+name = "orders-city"
+
+[[rigs]]
+name = "frontend"
+path = "rigs/frontend"
+
+[rigs.imports.sidecar]
+source = "./packs/sidecar"
+
+[[rigs]]
+name = "backend"
+path = "rigs/backend"
+
+[rigs.imports.sidecar]
+source = "./packs/sidecar"
+`)
+	writeFile(t, filepath.Join(sidecarPackDir, "pack.toml"), `
+[pack]
+name = "sidecar"
+schema = 2
+`)
+	writeFile(t, filepath.Join(sidecarPackDir, "orders", "digest.toml"), `
+[order]
+formula = "mol-digest"
+trigger = "cooldown"
+interval = "5m"
+`)
+	isolateCompletionContext(t, cityPath)
+
+	got, dir := completeOrderNames(nil, nil, "dig")
+	if dir != cobra.ShellCompDirectiveNoFileComp {
+		t.Errorf("directive = %v, want NoFileComp", dir)
+	}
+	for _, want := range []string{
+		"digest\tformula, 5m (rig: backend)",
+		"digest\tformula, 5m (rig: frontend)",
+	} {
+		if !slicesContains(got, want) {
+			t.Errorf("missing candidate %q in %v", want, got)
+		}
+	}
+}
+
+func isolateCompletionContext(t *testing.T, cityPath string) {
+	t.Helper()
+	origCity, origRig := cityFlag, rigFlag
+	cityFlag, rigFlag = "", ""
+	t.Cleanup(func() {
+		cityFlag, rigFlag = origCity, origRig
+	})
+	for _, key := range []string{
+		"GC_BEADS",
+		"GC_BEADS_SCOPE_ROOT",
+		"GC_CITY",
+		"GC_CITY_PATH",
+		"GC_CITY_ROOT",
+		"GC_DIR",
+		"GC_RIG",
+		"GC_RIG_ROOT",
+		"GC_SESSION",
+	} {
+		t.Setenv(key, "")
+	}
+	if cityPath != "" {
+		t.Setenv("GC_CITY", cityPath)
+		t.Setenv("GC_CITY_PATH", cityPath)
+	}
+}
+
+func writeCompletionCity(t *testing.T, cityPath, cityToml string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(cityPath, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte(cityToml), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func completionCandidateNames(candidates []string) []string {
+	names := make([]string, len(candidates))
+	for i, c := range candidates {
+		names[i] = strings.SplitN(c, "\t", 2)[0]
+	}
+	return names
+}
+
+func slicesContains(xs []string, want string) bool {
+	for _, x := range xs {
+		if x == want {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cmd/gc/compute_awake_bridge.go b/cmd/gc/compute_awake_bridge.go
index c3995c6542..3e00068b2a 100644
--- a/cmd/gc/compute_awake_bridge.go
+++ b/cmd/gc/compute_awake_bridge.go
@@ -18,6 +18,7 @@ func buildAwakeInputFromReconciler(
 	cfg *config.City,
 	sessionBeads []beads.Bead,
 	poolDesired map[string]int,
+	namedSessionDemand map[string]bool,
 	workSet map[string]bool,
 	readyWaitSet map[string]bool,
 	assignedWorkBeads []beads.Bead,
@@ -26,14 +27,15 @@ func buildAwakeInputFromReconciler(
 	clk time.Time,
 ) AwakeInput {
 	input := AwakeInput{
-		ScaleCheckCounts: poolDesired,
-		WorkSet:          workSet,
-		ReadyWaitSet:     readyWaitSet,
-		RunningSessions:  make(map[string]bool),
-		AttachedSessions: make(map[string]bool),
-		PendingSessions:  make(map[string]bool),
-		ChatIdleTimeout:  cfg.ChatSessions.IdleTimeoutDuration(),
-		Now:              clk,
+		ScaleCheckCounts:   poolDesired,
+		NamedSessionDemand: cloneBoolMap(namedSessionDemand),
+		WorkSet:            workSet,
+		ReadyWaitSet:       readyWaitSet,
+		RunningSessions:    make(map[string]bool),
+		AttachedSessions:   make(map[string]bool),
+		PendingSessions:    make(map[string]bool),
+		ChatIdleTimeout:    cfg.ChatSessions.IdleTimeoutDuration(),
+		Now:                clk,
 	}
 
 	// Agents
@@ -149,7 +151,7 @@ func awakeSetToWakeEvals(decisions map[string]AwakeDecision, sessionBeads []Awak
 				reasons = []WakeReason{WakePin}
 			case "wait-ready":
 				reasons = []WakeReason{WakeWait}
-			case "assigned-work", "work-query":
+			case "assigned-work", "named-demand", "work-query":
 				reasons = []WakeReason{WakeWork}
 			default:
 				reasons = []WakeReason{WakeConfig}
@@ -157,12 +159,24 @@ func awakeSetToWakeEvals(decisions map[string]AwakeDecision, sessionBeads []Awak
 		}
 		evals[bead.ID] = wakeEvaluation{
 			Reasons:          reasons,
+			Reason:           d.Reason,
 			ConfigSuppressed: d.Reason == "idle-sleep",
 		}
 	}
 	return evals
 }
 
+func cloneBoolMap(source map[string]bool) map[string]bool {
+	if source == nil {
+		return nil
+	}
+	out := make(map[string]bool, len(source))
+	for key, value := range source {
+		out[key] = value
+	}
+	return out
+}
+
 func parseSleepDuration(s string) time.Duration {
 	if s == "" || s == "off" {
 		return 0
diff --git a/cmd/gc/compute_awake_bridge_test.go b/cmd/gc/compute_awake_bridge_test.go
index 3a13c01f11..16ab3c8b68 100644
--- a/cmd/gc/compute_awake_bridge_test.go
+++ b/cmd/gc/compute_awake_bridge_test.go
@@ -29,6 +29,7 @@ func TestBuildAwakeInputFromReconcilerUsesLifecycleProjectionForCompatibilitySta
 		nil,
 		nil,
 		nil,
+		nil,
 		now,
 	)
 
@@ -66,6 +67,7 @@ func TestBuildAwakeInputFromReconcilerPopulatesPendingInteractions(t *testing.T)
 		nil,
 		nil,
 		nil,
+		nil,
 		[]wakeTarget{{session: &session, alive: true}},
 		sp,
 		now,
@@ -80,3 +82,132 @@ func TestBuildAwakeInputFromReconcilerPopulatesPendingInteractions(t *testing.T)
 		t.Fatalf("decision = %+v, want pending wake", got)
 	}
 }
+
+func TestAwakeSetToWakeEvalsPreservesDecisionReason(t *testing.T) {
+	evals := awakeSetToWakeEvals(
+		map[string]AwakeDecision{
+			"s-worker": {ShouldWake: true, Reason: "assigned-work"},
+		},
+		[]AwakeSessionBead{{
+			ID:          "mc-session-1",
+			SessionName: "s-worker",
+		}},
+	)
+
+	got := evals["mc-session-1"]
+	if got.Reason != "assigned-work" {
+		t.Fatalf("Reason = %q, want assigned-work", got.Reason)
+	}
+	if !containsWakeReason(got.Reasons, WakeWork) {
+		t.Fatalf("Reasons = %v, want WakeWork", got.Reasons)
+	}
+}
+
+func TestBuildAwakeInputFromReconcilerCarriesNamedSessionDemand(t *testing.T) {
+	now := time.Now().UTC()
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker"}},
+		NamedSessions: []config.NamedSession{
+			{Name: "primary", Template: "worker", Mode: "on_demand"},
+		},
+	}
+	sessionBead := beads.Bead{
+		ID:     "mc-session-1",
+		Status: "open",
+		Type:   "session",
+		Metadata: map[string]string{
+			"state":                     "asleep",
+			"session_name":              "primary",
+			"template":                  "worker",
+			"configured_named_identity": "primary",
+			"configured_named_mode":     "on_demand",
+		},
+	}
+
+	input := buildAwakeInputFromReconciler(
+		cfg,
+		[]beads.Bead{sessionBead},
+		map[string]int{"worker": 1},
+		map[string]bool{"primary": true},
+		nil,
+		nil,
+		nil,
+		nil,
+		runtime.NewFake(),
+		now,
+	)
+
+	if !input.NamedSessionDemand["primary"] {
+		t.Fatalf("NamedSessionDemand[primary] = false, want true")
+	}
+	decisions := ComputeAwakeSet(input)
+	got := decisions["primary"]
+	if !got.ShouldWake || got.Reason != "named-demand" {
+		t.Fatalf("decision = %+v, want named-demand wake", got)
+	}
+}
+
+// TestBuildAwakeInputFromReconcilerNamedAlwaysPostChurnRewakes pins the
+// contract for a mode=always named session that was put to sleep after churn:
+// if named-session metadata survives, the next awake-set pass must re-wake it.
+func TestBuildAwakeInputFromReconcilerNamedAlwaysPostChurnRewakes(t *testing.T) {
+	now := time.Now().UTC()
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker"}},
+		NamedSessions: []config.NamedSession{
+			{Name: "worker", Template: "worker", Mode: "always"},
+		},
+	}
+	postChurnBead := beads.Bead{
+		ID:     "mc-session-1",
+		Status: "open",
+		Type:   "session",
+		Metadata: map[string]string{
+			"state":                      "asleep",
+			"sleep_reason":               "",
+			"state_reason":               "creation_complete",
+			"last_woke_at":               "",
+			"wake_attempts":              "0",
+			"churn_count":                "1",
+			"session_key":                "",
+			"continuation_reset_pending": "",
+			"pending_create_claim":       "",
+			"pin_awake":                  "",
+			"session_name":               "worker",
+			"template":                   "worker",
+			"configured_named_identity":  "worker",
+			"configured_named_mode":      "always",
+		},
+	}
+
+	input := buildAwakeInputFromReconciler(
+		cfg,
+		[]beads.Bead{postChurnBead},
+		nil, nil, nil, nil, nil, nil,
+		runtime.NewFake(),
+		now,
+	)
+
+	if len(input.SessionBeads) != 1 {
+		t.Fatalf("SessionBeads length = %d, want 1", len(input.SessionBeads))
+	}
+	bead := input.SessionBeads[0]
+	if bead.NamedIdentity != "worker" {
+		t.Errorf("projected NamedIdentity = %q, want worker (configured_named_identity should survive churn)", bead.NamedIdentity)
+	}
+	if bead.State != "asleep" {
+		t.Errorf("projected State = %q, want asleep", bead.State)
+	}
+
+	decisions := ComputeAwakeSet(input)
+	got, ok := decisions["worker"]
+	if !ok {
+		t.Fatal("decision for 'worker' missing from awake set")
+	}
+	if !got.ShouldWake {
+		t.Fatalf("post-churn named-always session should wake; got decision = %+v", got)
+	}
+	if got.Reason != "named-always" {
+		t.Errorf("wake reason = %q, want named-always", got.Reason)
+	}
+}
diff --git a/cmd/gc/compute_awake_set.go b/cmd/gc/compute_awake_set.go
index 8fc5234ace..7e3b4b1712 100644
--- a/cmd/gc/compute_awake_set.go
+++ b/cmd/gc/compute_awake_set.go
@@ -16,18 +16,19 @@ const defaultOnDemandIdleTimeout = 5 * time.Minute
 // should be awake. All external I/O (shell commands, tmux checks, store
 // queries) happens before this function is called.
 type AwakeInput struct {
-	Agents           []AwakeAgent
-	NamedSessions    []AwakeNamedSession
-	SessionBeads     []AwakeSessionBead
-	WorkBeads        []AwakeWorkBead
-	ScaleCheckCounts map[string]int  // agent template → desired count
-	WorkSet          map[string]bool // agent template → work_query found pending work
-	RunningSessions  map[string]bool // session name → tmux exists
-	AttachedSessions map[string]bool // session name → user attached
-	PendingSessions  map[string]bool // session name → pending interaction
-	ReadyWaitSet     map[string]bool // session bead ID → durable wait is ready
-	ChatIdleTimeout  time.Duration   // global idle timeout for manual/chat sessions (0 = disabled)
-	Now              time.Time
+	Agents             []AwakeAgent
+	NamedSessions      []AwakeNamedSession
+	SessionBeads       []AwakeSessionBead
+	WorkBeads          []AwakeWorkBead
+	ScaleCheckCounts   map[string]int  // agent template → scale_check count
+	NamedSessionDemand map[string]bool // named-session identity → routed/assigned work demand
+	WorkSet            map[string]bool // agent template → work_query found pending work
+	RunningSessions    map[string]bool // session name → tmux exists
+	AttachedSessions   map[string]bool // session name → user attached
+	PendingSessions    map[string]bool // session name → pending interaction
+	ReadyWaitSet       map[string]bool // session bead ID → durable wait is ready
+	ChatIdleTimeout    time.Duration   // global idle timeout for manual/chat sessions (0 = disabled)
+	Now                time.Time
 }
 
 // AwakeAgent represents an [[agent]] config entry.
@@ -99,6 +100,7 @@ func ComputeAwakeSet(input AwakeInput) map[string]AwakeDecision {
 	// compatible wake causes (pending create, named-always, assigned work) may
 	// still reuse the same bead.
 	desired := make(map[string]string) // sessionName → reason
+	concreteAssignedWork := make(map[string]bool)
 
 	// Newly created beads that still carry a controller create claim must be
 	// launched at least once, even if the work signal that materialized them
@@ -126,10 +128,22 @@ func ComputeAwakeSet(input AwakeInput) map[string]AwakeDecision {
 				desired[ns.Identity] = "named-always"
 			}
 		case "on_demand":
-			// On-demand named sessions materialize from direct targeting,
-			// direct concrete ownership, dependencies, binding continuity,
-			// and pinning. Generic scale_check demand belongs to ephemeral
-			// capacity, not named identity materialization.
+			// On-demand named sessions wake only from named demand that was
+			// resolved by the desired-state pass, not generic template demand.
+			if !input.NamedSessionDemand[ns.Identity] {
+				continue
+			}
+			if agent, ok := agentsByName[ns.Template]; ok && agent.Suspended {
+				continue
+			}
+			if sn := findNamedSessionName(input.SessionBeads, ns.Identity); sn != "" {
+				bead := findBeadBySessionName(input.SessionBeads, sn)
+				if bead != nil && !bead.DependencyOnly && !bead.Drained && bead.State != "closed" {
+					desired[sn] = "named-demand"
+				}
+			} else {
+				desired[ns.Identity] = "named-demand"
+			}
 		}
 	}
 
@@ -143,18 +157,25 @@ func ComputeAwakeSet(input AwakeInput) map[string]AwakeDecision {
 			continue
 		}
 		active := collectActiveBeads(input.SessionBeads, template)
-		for i, bead := range active {
-			if i >= count {
+		filled := 0
+		for _, bead := range active {
+			if filled >= count {
 				break
 			}
+			if sessionHasConcreteAssignedWork(input.WorkBeads, bead) {
+				continue
+			}
 			desired[bead.SessionName] = "scaled:demand"
+			filled++
 		}
 		creating := collectCreatingBeads(input.SessionBeads, template)
-		filled := len(active)
 		for _, bead := range creating {
 			if filled >= count {
 				break
 			}
+			if sessionHasConcreteAssignedWork(input.WorkBeads, bead) {
+				continue
+			}
 			desired[bead.SessionName] = "scaled:creating"
 			filled++
 		}
@@ -206,9 +227,6 @@ func ComputeAwakeSet(input AwakeInput) map[string]AwakeDecision {
 		if bead.State == "closed" {
 			continue
 		}
-		if _, already := desired[bead.SessionName]; already {
-			continue
-		}
 		if agent, ok := agentsByName[bead.Template]; ok && agent.Suspended {
 			continue
 		}
@@ -217,7 +235,12 @@ func ComputeAwakeSet(input AwakeInput) map[string]AwakeDecision {
 			if assignee == "" || (wb.Status != "open" && wb.Status != "in_progress") {
 				continue
 			}
-			if assignee == bead.ID || assignee == bead.SessionName || (bead.NamedIdentity != "" && assignee == bead.NamedIdentity) {
+			if assignee == bead.ID || assignee == bead.SessionName {
+				desired[bead.SessionName] = "assigned-work"
+				concreteAssignedWork[bead.SessionName] = true
+				break
+			}
+			if bead.NamedIdentity != "" && assignee == bead.NamedIdentity {
 				desired[bead.SessionName] = "assigned-work"
 				break
 			}
@@ -299,7 +322,7 @@ func ComputeAwakeSet(input AwakeInput) map[string]AwakeDecision {
 			case isOnDemandSession(input.NamedSessions, bead):
 				idleTimeout = defaultOnDemandIdleTimeout
 			}
-			if idleTimeout > 0 && input.Now.Sub(bead.IdleSince) >= idleTimeout {
+			if idleTimeout > 0 && input.Now.Sub(bead.IdleSince) >= idleTimeout && !concreteAssignedWork[name] {
 				decision.ShouldWake = false
 				decision.Reason = "idle-sleep"
 			}
@@ -367,6 +390,19 @@ func collectActiveBeads(beads []AwakeSessionBead, template string) []AwakeSessio
 	return result
 }
 
+func sessionHasConcreteAssignedWork(workBeads []AwakeWorkBead, bead AwakeSessionBead) bool {
+	for _, wb := range workBeads {
+		assignee := strings.TrimSpace(wb.Assignee)
+		if assignee == "" || (wb.Status != "open" && wb.Status != "in_progress") {
+			continue
+		}
+		if assignee == bead.ID || assignee == bead.SessionName {
+			return true
+		}
+	}
+	return false
+}
+
 func isOnDemandSession(named []AwakeNamedSession, bead AwakeSessionBead) bool {
 	if bead.NamedIdentity == "" {
 		return false
diff --git a/cmd/gc/compute_awake_set_test.go b/cmd/gc/compute_awake_set_test.go
index f312f26890..3d7959a215 100644
--- a/cmd/gc/compute_awake_set_test.go
+++ b/cmd/gc/compute_awake_set_test.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"strconv"
 	"testing"
 	"time"
 
@@ -181,6 +182,30 @@ func TestNamedOnDemand_ExactNamedIdentityAssigneeWakes(t *testing.T) {
 	assertReason(t, result, "hello-world--refinery", "assigned-work")
 }
 
+func TestNamedOnDemand_NamedSessionDemandWakesExistingIdentity(t *testing.T) {
+	result := ComputeAwakeSet(AwakeInput{
+		Agents:             []AwakeAgent{{QualifiedName: "hello-world/refinery"}},
+		NamedSessions:      []AwakeNamedSession{{Identity: "hello-world/refinery", Template: "hello-world/refinery", Mode: "on_demand"}},
+		SessionBeads:       []AwakeSessionBead{{ID: "mc-1", SessionName: "hello-world--refinery", Template: "hello-world/refinery", State: "asleep", NamedIdentity: "hello-world/refinery"}},
+		NamedSessionDemand: map[string]bool{"hello-world/refinery": true},
+		Now:                now,
+	})
+	assertAwake(t, result, "hello-world--refinery")
+	assertReason(t, result, "hello-world--refinery", "named-demand")
+}
+
+func TestNamedOnDemand_NamedSessionDemandWakesSingletonTemplateResolvedIdentity(t *testing.T) {
+	result := ComputeAwakeSet(AwakeInput{
+		Agents:             []AwakeAgent{{QualifiedName: "worker"}},
+		NamedSessions:      []AwakeNamedSession{{Identity: "primary", Template: "worker", Mode: "on_demand"}},
+		SessionBeads:       []AwakeSessionBead{{ID: "mc-1", SessionName: "primary", Template: "worker", State: "asleep", NamedIdentity: "primary"}},
+		NamedSessionDemand: map[string]bool{"primary": true},
+		Now:                now,
+	})
+	assertAwake(t, result, "primary")
+	assertReason(t, result, "primary", "named-demand")
+}
+
 func TestNamedOnDemand_PendingCreateWakesWithoutDemand(t *testing.T) {
 	result := ComputeAwakeSet(AwakeInput{
 		Agents:        []AwakeAgent{{QualifiedName: "hello-world/refinery"}},
@@ -319,6 +344,48 @@ func TestScaled_Demand2_OneActive(t *testing.T) {
 	assertAsleep(t, result, "polecat-mc-2") // asleep ephemerals not reused
 }
 
+func TestScaled_NewDemandDoesNotUseActiveAssignedSessions(t *testing.T) {
+	result := ComputeAwakeSet(AwakeInput{
+		Agents: []AwakeAgent{{QualifiedName: "hello-world/polecat"}},
+		SessionBeads: []AwakeSessionBead{
+			{ID: "mc-assigned-1", SessionName: "polecat-assigned-1", Template: "hello-world/polecat", State: "active"},
+			{ID: "mc-assigned-2", SessionName: "polecat-assigned-2", Template: "hello-world/polecat", State: "active"},
+			{ID: "mc-assigned-3", SessionName: "polecat-assigned-3", Template: "hello-world/polecat", State: "active"},
+			{ID: "mc-assigned-4", SessionName: "polecat-assigned-4", Template: "hello-world/polecat", State: "active"},
+			{ID: "mc-assigned-5", SessionName: "polecat-assigned-5", Template: "hello-world/polecat", State: "active"},
+			{ID: "mc-new-1", SessionName: "polecat-new-1", Template: "hello-world/polecat", State: "creating"},
+			{ID: "mc-new-2", SessionName: "polecat-new-2", Template: "hello-world/polecat", State: "creating"},
+			{ID: "mc-new-3", SessionName: "polecat-new-3", Template: "hello-world/polecat", State: "creating"},
+			{ID: "mc-new-4", SessionName: "polecat-new-4", Template: "hello-world/polecat", State: "creating"},
+			{ID: "mc-new-5", SessionName: "polecat-new-5", Template: "hello-world/polecat", State: "creating"},
+		},
+		WorkBeads: []AwakeWorkBead{
+			{ID: "w-assigned-1", Assignee: "mc-assigned-1", Status: "in_progress"},
+			{ID: "w-assigned-2", Assignee: "mc-assigned-2", Status: "in_progress"},
+			{ID: "w-assigned-3", Assignee: "mc-assigned-3", Status: "in_progress"},
+			{ID: "w-assigned-4", Assignee: "mc-assigned-4", Status: "in_progress"},
+			{ID: "w-assigned-5", Assignee: "mc-assigned-5", Status: "in_progress"},
+		},
+		ScaleCheckCounts: map[string]int{"hello-world/polecat": 5},
+		RunningSessions: map[string]bool{
+			"polecat-assigned-1": true,
+			"polecat-assigned-2": true,
+			"polecat-assigned-3": true,
+			"polecat-assigned-4": true,
+			"polecat-assigned-5": true,
+		},
+		Now: now,
+	})
+
+	for i := 1; i <= 5; i++ {
+		suffix := strconv.Itoa(i)
+		assertAwake(t, result, "polecat-assigned-"+suffix)
+		assertReason(t, result, "polecat-assigned-"+suffix, "assigned-work")
+		assertAwake(t, result, "polecat-new-"+suffix)
+		assertReason(t, result, "polecat-new-"+suffix, "scaled:creating")
+	}
+}
+
 func TestScaled_Demand1_TwoActive(t *testing.T) {
 	result := ComputeAwakeSet(AwakeInput{
 		Agents: []AwakeAgent{{QualifiedName: "hello-world/polecat"}},
@@ -960,6 +1027,24 @@ func TestRegression_AsleepEphemeralWithAssignedWork_WakesViaAssignedWork(t *test
 	}
 }
 
+func TestRegression_ConcreteAssignedWorkSuppressesIdleSleep(t *testing.T) {
+	result := ComputeAwakeSet(AwakeInput{
+		Agents: []AwakeAgent{{QualifiedName: "hello-world/polecat", SleepAfterIdle: 2 * time.Hour}},
+		SessionBeads: []AwakeSessionBead{
+			{
+				ID: "mc-sctve", SessionName: "polecat-mc-sctve", Template: "hello-world/polecat", State: "active",
+				IdleSince: now.Add(-3 * time.Hour),
+			},
+		},
+		WorkBeads:        []AwakeWorkBead{{ID: "hw-8lb", Assignee: "polecat-mc-sctve", Status: "in_progress"}},
+		ScaleCheckCounts: map[string]int{"hello-world/polecat": 1},
+		RunningSessions:  map[string]bool{"polecat-mc-sctve": true},
+		Now:              now,
+	})
+	assertAwake(t, result, "polecat-mc-sctve")
+	assertReason(t, result, "polecat-mc-sctve", "assigned-work")
+}
+
 // ---------------------------------------------------------------------------
 // WorkSet — work_query demand signal (defense-in-depth alongside ScaleCheck)
 // ---------------------------------------------------------------------------
diff --git a/cmd/gc/controller.go b/cmd/gc/controller.go
index d71e2afbc4..c534c9c7d3 100644
--- a/cmd/gc/controller.go
+++ b/cmd/gc/controller.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gastownhall/gascity/internal/convergence"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/pathutil"
 	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/supervisor"
 	"github.com/gastownhall/gascity/internal/telemetry"
@@ -68,7 +69,20 @@ func (e controllerCommandError) Is(target error) bool {
 		(target == errControllerUnresponsive && e.unresponsive)
 }
 
-const controllerSocketPathLimit = 100
+const (
+	controllerSocketPathLimit        = 100
+	sessionCircuitResetCommandPrefix = "session-circuit-reset:"
+)
+
+type sessionCircuitResetRequest struct {
+	Identity  string `json:"identity"`
+	SessionID string `json:"session_id,omitempty"`
+}
+
+type sessionCircuitResetReply struct {
+	Outcome string `json:"outcome"`
+	Error   string `json:"error,omitempty"`
+}
 
 // controllerSocketPath returns the Unix socket path for controller commands.
 // It preserves the legacy .gc/controller.sock location for short city paths,
@@ -187,6 +201,8 @@ func handleControllerConn(
 			default:
 			}
 			conn.Write([]byte("ok\n")) //nolint:errcheck // best-effort ack
+		case strings.HasPrefix(line, sessionCircuitResetCommandPrefix):
+			handleSessionCircuitResetSocketCmd(conn, cityPath, line[len(sessionCircuitResetCommandPrefix):])
 		case strings.HasPrefix(line, "converge:"):
 			handleConvergeSocketCmd(conn, line[len("converge:"):], convergenceReqCh)
 		case strings.HasPrefix(line, "trace-arm:"):
@@ -209,6 +225,113 @@ func handleControllerConn(
 	}
 }
 
+func handleSessionCircuitResetSocketCmd(conn net.Conn, cityPath, payload string) {
+	var req sessionCircuitResetRequest
+	if err := json.Unmarshal([]byte(payload), &req); err != nil {
+		writeJSONLine(conn, sessionCircuitResetReply{
+			Outcome: "failed",
+			Error:   fmt.Sprintf("invalid session circuit reset request: %v", err),
+		})
+		return
+	}
+	identity := strings.TrimSpace(req.Identity)
+	if identity == "" {
+		writeJSONLine(conn, sessionCircuitResetReply{
+			Outcome: "failed",
+			Error:   "identity is required",
+		})
+		return
+	}
+	sessionID := strings.TrimSpace(req.SessionID)
+	if sessionID == "" {
+		writeJSONLine(conn, sessionCircuitResetReply{
+			Outcome: "failed",
+			Error:   "session_id is required; upgrade gc to clear persisted session circuit breaker metadata",
+		})
+		return
+	}
+	store, err := openCityStoreAt(cityPath)
+	if err != nil {
+		writeJSONLine(conn, sessionCircuitResetReply{
+			Outcome: "failed",
+			Error:   fmt.Sprintf("opening city store: %v", err),
+		})
+		return
+	}
+	if err := resetSessionCircuitBreakerState(store, sessionID, identity, defaultSessionCircuitBreaker()); err != nil {
+		writeJSONLine(conn, sessionCircuitResetReply{
+			Outcome: "failed",
+			Error:   err.Error(),
+		})
+		return
+	}
+	writeJSONLine(conn, sessionCircuitResetReply{Outcome: "ok"})
+}
+
+func resetSessionCircuitBreakerState(store beads.Store, sessionID string, identity string, cb *sessionCircuitBreaker) error {
+	identity = strings.TrimSpace(identity)
+	if identity == "" {
+		return nil
+	}
+	if cb == nil {
+		cb = defaultSessionCircuitBreaker()
+	}
+	if err := loadPersistedSessionCircuitResetGeneration(store, sessionID, identity, cb); err != nil {
+		return err
+	}
+	initialSnapshot := cb.snapshotIdentity(identity)
+	if strings.TrimSpace(sessionID) == "" {
+		cb.Reset(identity)
+		return nil
+	}
+	if err := resetAndClearSessionCircuitBreakerState(store, sessionID, identity, cb, initialSnapshot); err != nil {
+		return err
+	}
+	// The second cycle invalidates an OPEN persist that may race through
+	// the first clear window. If the second clear fails, restore the pre-reset
+	// snapshot so the controller never leaves memory CLOSED while storage still
+	// says OPEN. TestResetSessionCircuitBreakerStateClearsRacingOpenPersist
+	// guards this from being collapsed into a single reset.
+	return resetAndClearSessionCircuitBreakerState(store, sessionID, identity, cb, initialSnapshot)
+}
+
+func resetAndClearSessionCircuitBreakerState(store beads.Store, sessionID string, identity string, cb *sessionCircuitBreaker, restoreSnapshot sessionCircuitBreakerIdentitySnapshot) error {
+	resetGeneration := cb.Reset(identity)
+	if err := clearPersistedSessionCircuitBreakerMetadata(store, sessionID, resetGeneration); err != nil {
+		cb.restoreIdentity(identity, restoreSnapshot)
+		// Restore the pre-reset snapshot rather than the just-reset one so a
+		// durable clear failure cannot strand the breaker CLOSED in memory.
+		return err
+	}
+	return nil
+}
+
+func resetSessionCircuitBreakerOnController(cityPath, sessionID, identity string) error {
+	identity = strings.TrimSpace(identity)
+	if identity == "" {
+		return nil
+	}
+	payload, err := json.Marshal(sessionCircuitResetRequest{Identity: identity, SessionID: sessionID})
+	if err != nil {
+		return fmt.Errorf("encoding session circuit reset request: %w", err)
+	}
+	resp, err := sendControllerCommand(cityPath, sessionCircuitResetCommandPrefix+string(payload))
+	if err != nil {
+		return err
+	}
+	var reply sessionCircuitResetReply
+	if err := json.Unmarshal(resp, &reply); err != nil {
+		return fmt.Errorf("decoding session circuit reset reply: %w", err)
+	}
+	if reply.Outcome != "ok" {
+		if reply.Error != "" {
+			return fmt.Errorf("%s", reply.Error)
+		}
+		return fmt.Errorf("session circuit reset failed")
+	}
+	return nil
+}
+
 func handleReloadSocketCmd(conn net.Conn, payload string, ch chan reloadRequest) {
 	if ch == nil {
 		writeJSONLine(conn, reloadControlReply{
@@ -572,16 +695,7 @@ func (r *configWatchRegistrar) isConventionRootCreate(path string) bool {
 }
 
 func pathIsWithin(root, path string) bool {
-	root = normalizePathForCompare(root)
-	path = normalizePathForCompare(path)
-	if samePath(root, path) {
-		return true
-	}
-	rel, err := filepath.Rel(filepath.Clean(root), filepath.Clean(path))
-	if err != nil {
-		return false
-	}
-	return rel != "." && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+	return pathutil.PathWithin(root, path)
 }
 
 func isConventionDiscoveryDirName(base string) bool {
@@ -773,7 +887,11 @@ func tryReloadConfig(tomlPath, lockedWorkspaceName, cityRoot string) (*reloadRes
 		return nil, fmt.Errorf("fetching packs: %w", err)
 	}
 
-	newCfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath, extraConfigFiles...)
+	allIncludes, err := cityConfigIncludesWithBuiltinPacks(cityRoot, extraConfigFiles...)
+	if err != nil {
+		return nil, err
+	}
+	newCfg, prov, err := config.LoadWithIncludes(fsys.OSFS{}, tomlPath, allIncludes...)
 	if err != nil {
 		return nil, fmt.Errorf("parsing city.toml: %w", err)
 	}
@@ -893,11 +1011,17 @@ func gracefulStopAll(
 			running, _ = workerSessionTargetRunningWithConfig("", nil, sp, nil, name)
 		}
 		if !running {
+			if err := sp.Stop(name); err != nil && !runtime.IsSessionGone(err) {
+				fmt.Fprintf(stderr, "cleaning exited agent '%s': %v\n", name, err) //nolint:errcheck // best-effort stderr
+			}
 			fmt.Fprintf(stdout, "Agent '%s' exited gracefully\n", name) //nolint:errcheck // best-effort stdout
 			subject := name
 			if target, ok := targetByName[name]; ok && target.subject != "" {
 				subject = target.subject
 			}
+			if target, ok := targetByName[name]; ok && cityStopSessionMarked(store, target.sessionID) {
+				markCityStopSessionAsAsleep(store, target.sessionID, stderr)
+			}
 			rec.Record(events.Event{
 				Type: events.SessionStopped, Actor: "gc", Subject: subject,
 			})
diff --git a/cmd/gc/controller_test.go b/cmd/gc/controller_test.go
index 5de9d63bfb..3b35528ad4 100644
--- a/cmd/gc/controller_test.go
+++ b/cmd/gc/controller_test.go
@@ -1,8 +1,11 @@
 package main
 
 import (
+	"bufio"
 	"bytes"
 	"context"
+	"encoding/json"
+	"errors"
 	"net"
 	"os"
 	"path/filepath"
@@ -13,6 +16,7 @@ import (
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/runtime"
@@ -378,6 +382,7 @@ func TestSendControllerCommandWithTimeoutsTimesOutOnRead(t *testing.T) {
 // writeCityTOML is a test helper that writes a city.toml with the given agents.
 func writeCityTOML(t *testing.T, dir string, cityName string, agentNames ...string) string {
 	t.Helper()
+	clearInheritedBeadsEnv(t)
 	tomlPath := filepath.Join(dir, "city.toml")
 	var buf bytes.Buffer
 	buf.WriteString("[workspace]\nname = " + `"` + cityName + `"` + "\n\n")
@@ -394,10 +399,12 @@ func writeCityTOML(t *testing.T, dir string, cityName string, agentNames ...stri
 
 func writeControllerNamedSessionCityTOML(t *testing.T, dir, cityName, mode, idleTimeout string) string {
 	t.Helper()
+	clearInheritedBeadsEnv(t)
 	tomlPath := filepath.Join(dir, "city.toml")
 	var buf bytes.Buffer
 	buf.WriteString("[workspace]\nname = " + `"` + cityName + `"` + "\n\n")
 	buf.WriteString("[beads]\nprovider = \"file\"\n\n")
+	buf.WriteString("[daemon]\nshutdown_timeout = \"100ms\"\n\n")
 	buf.WriteString("[[agent]]\nname = \"mayor\"\nstart_command = \"echo hello\"\n")
 	if idleTimeout != "" {
 		buf.WriteString("idle_timeout = " + `"` + idleTimeout + `"` + "\n")
@@ -493,12 +500,12 @@ func TestControllerReloadsConfig(t *testing.T) {
 	deadline = time.After(1500 * time.Millisecond)
 	for {
 		names, _ := lastAgentNames.Load().([]string)
-		if len(names) == 2 && names[0] == "mayor" && names[1] == "worker" {
+		if containsAgentNames(names, "mayor", "worker") {
 			break
 		}
 		select {
 		case <-deadline:
-			t.Errorf("expected [mayor worker], got %v", names)
+			t.Errorf("expected mayor and worker, got %v", names)
 			return
 		default:
 			time.Sleep(10 * time.Millisecond)
@@ -564,10 +571,13 @@ func TestControllerReloadsConfigImmediatelyOnWatchEvent(t *testing.T) {
 		time.Sleep(5 * time.Millisecond)
 	}
 
+	before := reconcileCount.Load()
 	writeCityTOML(t, dir, "test", "mayor", "worker")
 
+	// Wait for "Config reloaded" AND at least one reconcile after
+	// the reload so that buildFn has run with the new config.
 	deadline := time.After(5 * time.Second)
-	for !strings.Contains(stdout.String(), "Config reloaded") {
+	for !strings.Contains(stdout.String(), "Config reloaded") || reconcileCount.Load() <= before {
 		select {
 		case <-deadline:
 			t.Fatalf("timed out waiting for immediate config reload; reconciles=%d stdout=%q stderr=%q",
@@ -577,9 +587,19 @@ func TestControllerReloadsConfigImmediatelyOnWatchEvent(t *testing.T) {
 		}
 	}
 
-	names, _ := lastAgentNames.Load().([]string)
-	if len(names) != 2 || names[0] != "mayor" || names[1] != "worker" {
-		t.Errorf("expected [mayor worker], got %v", names)
+	deadline = time.After(5 * time.Second)
+	for {
+		names, _ := lastAgentNames.Load().([]string)
+		if containsAgentNames(names, "mayor", "worker") {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Errorf("expected mayor and worker, got %v", names)
+			return
+		default:
+			time.Sleep(10 * time.Millisecond)
+		}
 	}
 }
 
@@ -642,15 +662,21 @@ func TestControllerReloadsConventionDiscoveredAgentOnWatchEvent(t *testing.T) {
 		t.Fatalf("revision did not change after convention-discovered agent was added: %s", result.Revision)
 	}
 
-	var names []string
+	found := false
 	for _, a := range result.Cfg.Agents {
-		if a.Implicit {
-			continue
+		if !a.Implicit && a.Name == "noreen" {
+			found = true
+			break
 		}
-		names = append(names, a.Name)
 	}
-	if len(names) != 1 || names[0] != "noreen" {
-		t.Fatalf("reloaded agent names = %v, want [noreen]", names)
+	if !found {
+		var names []string
+		for _, a := range result.Cfg.Agents {
+			if !a.Implicit {
+				names = append(names, a.Name)
+			}
+		}
+		t.Fatalf("reloaded agents = %v, want noreen among them", names)
 	}
 }
 
@@ -814,6 +840,70 @@ func TestWatchConfigDirs_CityRootDoesNotWatchUnrelatedNestedSubdir(t *testing.T)
 	}
 }
 
+func TestWatchConfigDirs_CityRootIgnoresRuntimeTraceWrites(t *testing.T) {
+	old := debounceDelay
+	debounceDelay = 5 * time.Millisecond
+	t.Cleanup(func() { debounceDelay = old })
+
+	dir := t.TempDir()
+	traceDir := citylayout.RuntimeDataDir(dir)
+	if err := os.MkdirAll(traceDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll runtime dir: %v", err)
+	}
+	traceFile := filepath.Join(traceDir, "control-dispatcher-trace.log")
+	if err := os.WriteFile(traceFile, []byte("first\n"), 0o644); err != nil {
+		t.Fatalf("seed runtime trace: %v", err)
+	}
+	legacyTraceFile := filepath.Join(dir, "control-dispatcher-trace.log")
+
+	if !shouldIgnoreConfigWatchEvent(traceFile) {
+		t.Fatalf("shouldIgnoreConfigWatchEvent(%q) = false, want true", traceFile)
+	}
+	if shouldIgnoreConfigWatchEvent(legacyTraceFile) {
+		t.Fatalf("shouldIgnoreConfigWatchEvent(%q) = true, want false", legacyTraceFile)
+	}
+
+	var dirty atomic.Bool
+	pokeCh := make(chan struct{}, 1)
+	var stderr bytes.Buffer
+	cleanup := watchConfigTargets([]config.WatchTarget{{Path: dir, DiscoverConventions: true}}, &dirty, pokeCh, &stderr)
+	defer cleanup()
+
+	select {
+	case <-pokeCh:
+	default:
+	}
+	dirty.Store(false)
+
+	for i, body := range []string{"second\n", "third\n", "fourth\n"} {
+		if err := os.WriteFile(traceFile, []byte(body), 0o644); err != nil {
+			t.Fatalf("rewrite runtime trace #%d: %v", i+1, err)
+		}
+		select {
+		case <-pokeCh:
+			t.Fatalf("unexpected watcher poke after runtime trace write #%d; stderr=%q", i+1, stderr.String())
+		case <-time.After(250 * time.Millisecond):
+		}
+		if dirty.Load() {
+			t.Fatalf("dirty flag set after runtime trace write #%d; stderr=%q", i+1, stderr.String())
+		}
+	}
+
+	dirty.Store(false)
+	if err := os.WriteFile(legacyTraceFile, []byte("legacy\n"), 0o644); err != nil {
+		t.Fatalf("write legacy city-root trace: %v", err)
+	}
+
+	select {
+	case <-pokeCh:
+	case <-time.After(3 * time.Second):
+		t.Fatalf("timed out waiting for watcher poke after legacy city-root trace write; stderr=%q", stderr.String())
+	}
+	if !dirty.Load() {
+		t.Fatalf("dirty flag not set after legacy city-root trace write; stderr=%q", stderr.String())
+	}
+}
+
 func TestWatchConfigDirs_SymlinkSeedDirWatchesNestedPreExistingDir(t *testing.T) {
 	old := debounceDelay
 	debounceDelay = 5 * time.Millisecond
@@ -1061,8 +1151,11 @@ func TestControllerReloadsNamedSessionModeAndAppliesIdleTimeout(t *testing.T) {
 	}
 
 	buildFn := func(c *config.City, _ runtime.Provider, _ beads.Store) DesiredStateResult {
-		if len(c.Agents) > 0 {
-			lastIdleTimeout.Store(c.Agents[0].IdleTimeout)
+		for _, agent := range c.Agents {
+			if agent.Name == "mayor" {
+				lastIdleTimeout.Store(agent.IdleTimeout)
+				break
+			}
 		}
 		ds := make(map[string]TemplateParams)
 		for _, a := range c.Agents {
@@ -1234,6 +1327,470 @@ func TestHandleControllerConnControlDispatcher(t *testing.T) {
 	}
 }
 
+func TestHandleSessionCircuitResetSocketCmd(t *testing.T) {
+	tests := []struct {
+		name        string
+		payload     string
+		wantOutcome string
+		wantError   string
+	}{
+		{
+			name:        "invalid json",
+			payload:     `{"identity":`,
+			wantOutcome: "failed",
+			wantError:   "invalid session circuit reset request",
+		},
+		{
+			name:        "empty identity",
+			payload:     `{"identity":"   "}`,
+			wantOutcome: "failed",
+			wantError:   "identity is required",
+		},
+		{
+			name:        "missing session id",
+			payload:     `{"identity":"rig-a/session-a"}`,
+			wantOutcome: "failed",
+			wantError:   "session_id is required",
+		},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			server, client := net.Pipe()
+			defer client.Close() //nolint:errcheck
+
+			done := make(chan struct{})
+			go func() {
+				handleSessionCircuitResetSocketCmd(server, t.TempDir(), tc.payload)
+				close(done)
+			}()
+
+			reply := readSessionCircuitResetSocketReply(t, client)
+			if reply.Outcome != tc.wantOutcome {
+				t.Fatalf("reply.Outcome = %q, want %q", reply.Outcome, tc.wantOutcome)
+			}
+			if tc.wantError != "" && !strings.Contains(reply.Error, tc.wantError) {
+				t.Fatalf("reply.Error = %q, want containing %q", reply.Error, tc.wantError)
+			}
+			<-done
+		})
+	}
+}
+
+func TestResetSessionCircuitBreakerStateResetsMemoryBeforeClearingMetadata(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const identity = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(identity, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("precondition: breaker should be open")
+	}
+
+	store := &metadataCallbackStore{
+		Store: beads.NewMemStore(),
+		beforeBatch: func() {
+			if cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+				t.Error("breaker was still open while persisted metadata was being cleared")
+			}
+		},
+	}
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata:   identity,
+			sessionCircuitStateMetadata:    circuitOpen.String(),
+			sessionCircuitRestartsMetadata: `["2026-04-01T12:00:00Z"]`,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	if err := resetSessionCircuitBreakerState(store, session.ID, identity, cb); err != nil {
+		t.Fatalf("resetSessionCircuitBreakerState: %v", err)
+	}
+	if cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("breaker should be closed after reset")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	assertSessionCircuitStateMetadataCleared(t, updated.Metadata)
+	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "2" {
+		t.Fatalf("%s = %q, want 2", sessionCircuitResetGenerationMetadata, got)
+	}
+}
+
+func TestResetSessionCircuitBreakerStateClearsRacingOpenPersist(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const identity = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(identity, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("precondition: breaker should be open")
+	}
+
+	store := &blockingOpenMetadataBatchStore{
+		Store:   beads.NewMemStore(),
+		entered: make(chan struct{}),
+		release: make(chan struct{}),
+		cleared: make(chan struct{}),
+	}
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata: identity,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	persistErr := make(chan error, 1)
+	go func() {
+		persistErr <- persistSessionCircuitBreakerMetadata(store, &session, cb, identity, t0.Add(6*time.Minute))
+	}()
+
+	select {
+	case <-store.entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("persist did not reach blocked OPEN metadata write")
+	}
+
+	resetErr := make(chan error, 1)
+	go func() {
+		resetErr <- resetSessionCircuitBreakerState(store, session.ID, identity, cb)
+	}()
+
+	select {
+	case <-store.cleared:
+	case <-time.After(50 * time.Millisecond):
+	}
+
+	close(store.release)
+	if err := <-persistErr; err != nil {
+		t.Fatalf("persistSessionCircuitBreakerMetadata: %v", err)
+	}
+	if err := <-resetErr; err != nil {
+		t.Fatalf("resetSessionCircuitBreakerState: %v", err)
+	}
+	if cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("breaker should be closed after racing persist and reset")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	assertSessionCircuitStateMetadataCleared(t, updated.Metadata)
+	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "2" {
+		t.Fatalf("%s = %q, want 2 after racing persist", sessionCircuitResetGenerationMetadata, got)
+	}
+}
+
+func TestResetSessionCircuitBreakerStateRestoresOpenStateOnMetadataClearFailure(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const identity = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(identity, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("precondition: breaker should be open")
+	}
+
+	store := &failingClearMetadataStore{Store: beads.NewMemStore()}
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata:           identity,
+			sessionCircuitStateMetadata:            circuitOpen.String(),
+			sessionCircuitRestartsMetadata:         `["2026-04-01T12:00:00Z"]`,
+			sessionCircuitLastRestartMetadata:      t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenedAtMetadata:         t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenRestartCountMetadata: "6",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	err = resetSessionCircuitBreakerState(store, session.ID, identity, cb)
+	if err == nil {
+		t.Fatal("resetSessionCircuitBreakerState: expected clear failure")
+	}
+	if !strings.Contains(err.Error(), "injected clear failure") {
+		t.Fatalf("resetSessionCircuitBreakerState error = %v, want injected failure", err)
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("breaker should remain open after failed durable clear")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	if got := updated.Metadata[sessionCircuitStateMetadata]; got != circuitOpen.String() {
+		t.Fatalf("%s = %q, want %q", sessionCircuitStateMetadata, got, circuitOpen.String())
+	}
+	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "" {
+		t.Fatalf("%s = %q, want unchanged", sessionCircuitResetGenerationMetadata, got)
+	}
+}
+
+func TestResetSessionCircuitBreakerStateRestoresOpenStateOnRacingSecondClearFailure(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const identity = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(identity, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("precondition: breaker should be open")
+	}
+
+	store := &failingNthClearMetadataStore{Store: beads.NewMemStore(), failOn: 2}
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata:           identity,
+			sessionCircuitStateMetadata:            circuitOpen.String(),
+			sessionCircuitRestartsMetadata:         `["2026-04-01T12:00:00Z"]`,
+			sessionCircuitLastRestartMetadata:      t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenedAtMetadata:         t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenRestartCountMetadata: "6",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	err = resetSessionCircuitBreakerState(store, session.ID, identity, cb)
+	if err == nil {
+		t.Fatal("resetSessionCircuitBreakerState: expected racing clear failure")
+	}
+	if !strings.Contains(err.Error(), "injected clear failure") {
+		t.Fatalf("resetSessionCircuitBreakerState error = %v, want injected failure", err)
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("breaker should remain open after failed racing clear")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	if got := updated.Metadata[sessionCircuitStateMetadata]; got != "" {
+		t.Fatalf("%s = %q, want cleared durable metadata", sessionCircuitStateMetadata, got)
+	}
+	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "1" {
+		t.Fatalf("%s = %q, want first reset generation preserved", sessionCircuitResetGenerationMetadata, got)
+	}
+}
+
+func TestResetSessionCircuitBreakerStateRejectsStaleRestoreSnapshot(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const identity = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(identity, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(identity, t0.Add(6*time.Minute)) {
+		t.Fatal("precondition: breaker should be open")
+	}
+
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata:           identity,
+			sessionCircuitStateMetadata:            circuitOpen.String(),
+			sessionCircuitRestartsMetadata:         `["2026-04-01T12:00:00Z"]`,
+			sessionCircuitLastRestartMetadata:      t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenedAtMetadata:         t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenRestartCountMetadata: "6",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	staleSnapshot := make(map[string]string, len(session.Metadata))
+	for k, v := range session.Metadata {
+		staleSnapshot[k] = v
+	}
+
+	if err := resetSessionCircuitBreakerState(store, session.ID, identity, cb); err != nil {
+		t.Fatalf("resetSessionCircuitBreakerState: %v", err)
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "2" {
+		t.Fatalf("%s = %q, want 2", sessionCircuitResetGenerationMetadata, got)
+	}
+	if reset, err := cb.restoreFromMetadata(identity, staleSnapshot, t0.Add(7*time.Minute)); err != nil || reset {
+		t.Fatalf("restoreFromMetadata stale reset=%v err=%v", reset, err)
+	}
+	if cb.IsOpen(identity, t0.Add(7*time.Minute)) {
+		t.Fatal("stale pre-reset metadata should not reopen breaker after reset")
+	}
+}
+
+func TestResetSessionCircuitBreakerStateRejectsHigherGenerationStaleRestoreSnapshot(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const identity = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata:           identity,
+			sessionCircuitStateMetadata:            circuitOpen.String(),
+			sessionCircuitRestartsMetadata:         `["2026-04-01T12:00:00Z"]`,
+			sessionCircuitLastRestartMetadata:      t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenedAtMetadata:         t0.Format(time.RFC3339Nano),
+			sessionCircuitOpenRestartCountMetadata: "6",
+			sessionCircuitResetGenerationMetadata:  "3",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	staleSnapshot := make(map[string]string, len(session.Metadata))
+	for k, v := range session.Metadata {
+		staleSnapshot[k] = v
+	}
+
+	if err := resetSessionCircuitBreakerState(store, session.ID, identity, cb); err != nil {
+		t.Fatalf("resetSessionCircuitBreakerState: %v", err)
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	if got := updated.Metadata[sessionCircuitResetGenerationMetadata]; got != "5" {
+		t.Fatalf("%s = %q, want 5", sessionCircuitResetGenerationMetadata, got)
+	}
+	if reset, err := cb.restoreFromMetadata(identity, staleSnapshot, t0.Add(7*time.Minute)); err != nil || reset {
+		t.Fatalf("restoreFromMetadata stale reset=%v err=%v", reset, err)
+	}
+	if cb.IsOpen(identity, t0.Add(7*time.Minute)) {
+		t.Fatal("higher-generation stale pre-reset metadata should not reopen breaker after reset")
+	}
+}
+
+type metadataCallbackStore struct {
+	beads.Store
+	beforeBatch func()
+}
+
+func (s *metadataCallbackStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if s.beforeBatch != nil {
+		s.beforeBatch()
+	}
+	return s.Store.SetMetadataBatch(id, kvs)
+}
+
+type blockingOpenMetadataBatchStore struct {
+	beads.Store
+	entered chan struct{}
+	release chan struct{}
+	cleared chan struct{}
+	once    sync.Once
+}
+
+func (s *blockingOpenMetadataBatchStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if kvs[sessionCircuitStateMetadata] == circuitOpen.String() {
+		s.once.Do(func() { close(s.entered) })
+		<-s.release
+	}
+	if sessionCircuitStateMetadataAllCleared(kvs) {
+		select {
+		case <-s.cleared:
+		default:
+			close(s.cleared)
+		}
+	}
+	return s.Store.SetMetadataBatch(id, kvs)
+}
+
+type failingClearMetadataStore struct {
+	beads.Store
+}
+
+func (s *failingClearMetadataStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if sessionCircuitStateMetadataAllCleared(kvs) {
+		return errors.New("injected clear failure")
+	}
+	return s.Store.SetMetadataBatch(id, kvs)
+}
+
+type failingNthClearMetadataStore struct {
+	beads.Store
+	failOn int
+	calls  int
+}
+
+func (s *failingNthClearMetadataStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if sessionCircuitStateMetadataAllCleared(kvs) {
+		s.calls++
+		if s.calls == s.failOn {
+			return errors.New("injected clear failure")
+		}
+	}
+	return s.Store.SetMetadataBatch(id, kvs)
+}
+
+func assertSessionCircuitStateMetadataCleared(t *testing.T, kvs map[string]string) {
+	t.Helper()
+	for _, key := range sessionCircuitMetadataKeys {
+		if key == sessionCircuitResetGenerationMetadata {
+			continue
+		}
+		if kvs[key] != "" {
+			t.Fatalf("%s = %q, want cleared", key, kvs[key])
+		}
+	}
+}
+
+func sessionCircuitStateMetadataAllCleared(kvs map[string]string) bool {
+	for _, key := range sessionCircuitMetadataKeys {
+		if key == sessionCircuitResetGenerationMetadata {
+			continue
+		}
+		if kvs[key] != "" {
+			return false
+		}
+	}
+	return true
+}
+
+func readSessionCircuitResetSocketReply(t *testing.T, conn net.Conn) sessionCircuitResetReply {
+	t.Helper()
+	scanner := bufio.NewScanner(conn)
+	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
+	if !scanner.Scan() {
+		if err := scanner.Err(); err != nil {
+			t.Fatalf("read reply: %v", err)
+		}
+		t.Fatal("read reply: connection closed")
+	}
+	var reply sessionCircuitResetReply
+	if err := json.Unmarshal(scanner.Bytes(), &reply); err != nil {
+		t.Fatalf("decode reply: %v", err)
+	}
+	return reply
+}
+
 func TestControllerReloadInvalidConfig(t *testing.T) {
 	old := debounceDelay
 	debounceDelay = 5 * time.Millisecond
@@ -1279,13 +1836,12 @@ func TestControllerReloadInvalidConfig(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Wait for a tick to process the bad config.
-	target := reconcileCount.Load() + 2
 	deadline := time.After(3 * time.Second)
-	for reconcileCount.Load() < target {
+	for !strings.Contains(stderr.String(), "config reload") {
 		select {
 		case <-deadline:
-			t.Fatal("timed out waiting for tick after invalid config")
+			t.Fatalf("timed out waiting for invalid config reload; reconciles=%d stdout=%q stderr=%q",
+				reconcileCount.Load(), stdout.String(), stderr.String())
 		default:
 			time.Sleep(10 * time.Millisecond)
 		}
@@ -1308,6 +1864,7 @@ func TestControllerReloadCityNameChange(t *testing.T) {
 	t.Cleanup(func() { debounceDelay = old })
 
 	dir := shortSocketTempDir(t, "gc-rename-")
+	cleanupManagedDoltTestCity(t, dir)
 	tomlPath := writeCityTOML(t, dir, "test", "mayor")
 
 	cfg, err := config.Load(osFS{}, tomlPath)
@@ -1455,7 +2012,8 @@ func TestControllerReloadCommandReloadsConfigImmediately(t *testing.T) {
 		}
 	}
 
-	writeCityTOML(t, dir, "test", "mayor", "worker")
+	expectedAgentNames := []string{"mayor", "worker"}
+	writeCityTOML(t, dir, "test", expectedAgentNames...)
 
 	before := reconcileCount.Load()
 	resp, err := sendControllerCommand(dir, "reload")
@@ -1466,22 +2024,45 @@ func TestControllerReloadCommandReloadsConfigImmediately(t *testing.T) {
 		t.Fatalf("reload response = %q, want %q", string(resp), "ok")
 	}
 
+	agentNamesMatch := func(names []string) bool {
+		return containsAgentNames(names, expectedAgentNames...)
+	}
+
+	var names []string
 	deadline = time.After(1500 * time.Millisecond)
-	for reconcileCount.Load() <= before || !strings.Contains(stdout.String(), "Config reloaded") {
+	for {
+		names, _ = lastAgentNames.Load().([]string)
+		if reconcileCount.Load() > before &&
+			strings.Contains(stdout.String(), "Config reloaded") &&
+			agentNamesMatch(names) {
+			break
+		}
 		select {
 		case <-deadline:
-			t.Fatalf("timed out waiting for reload command to apply config; reconciles=%d stdout=%q stderr=%q", reconcileCount.Load(), stdout.String(), stderr.String())
+			t.Fatalf("timed out waiting for reload command to apply config; reconciles=%d agents=%v stdout=%q stderr=%q", reconcileCount.Load(), names, stdout.String(), stderr.String())
 		default:
 			time.Sleep(10 * time.Millisecond)
 		}
 	}
 
-	names, _ := lastAgentNames.Load().([]string)
-	if len(names) != 2 || names[0] != "mayor" || names[1] != "worker" {
-		t.Fatalf("expected [mayor worker], got %v", names)
+	if !agentNamesMatch(names) {
+		t.Fatalf("expected %v, got %v", expectedAgentNames, names)
 	}
 }
 
+func containsAgentNames(got []string, want ...string) bool {
+	seen := make(map[string]bool, len(got))
+	for _, name := range got {
+		seen[name] = true
+	}
+	for _, name := range want {
+		if !seen[name] {
+			return false
+		}
+	}
+	return true
+}
+
 func TestControllerPokeTriggersImmediate(t *testing.T) {
 	sp := runtime.NewFake()
 
@@ -1597,4 +2178,53 @@ func (osFS) Lstat(name string) (os.FileInfo, error)               { return os.Ls
 func (osFS) ReadDir(name string) ([]os.DirEntry, error)           { return os.ReadDir(name) }
 func (osFS) Rename(oldpath, newpath string) error                 { return os.Rename(oldpath, newpath) }
 func (osFS) Remove(name string) error                             { return os.Remove(name) }
-func (osFS) Chmod(name string, mode os.FileMode) error            { return os.Chmod(name, mode) }
+
+// TestTryReloadConfig_IncludesBuiltinPackOrders verifies that the controller's
+// config reload path includes builtin pack formula layers so the order
+// dispatcher sees orders from all embedded packs (core, maintenance, bd, dolt).
+// Regression test for gc-4624: dolt pack orders never fired because
+// tryReloadConfig did not pass builtinPackIncludes to LoadWithIncludes.
+func TestTryReloadConfig_IncludesBuiltinPackOrders(t *testing.T) {
+	configureTestDoltIdentityEnv(t)
+	t.Setenv("GC_BEADS", "")
+
+	dir := shortSocketTempDir(t, "gc-reload-orders-")
+	tomlPath := filepath.Join(dir, "city.toml")
+	if err := os.WriteFile(tomlPath, []byte("[workspace]\nname = \"test\"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(city.toml): %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "pack.toml"), []byte("[pack]\nname = \"test\"\nschema = 1\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(pack.toml): %v", err)
+	}
+
+	result, err := tryReloadConfig(tomlPath, "test", dir)
+	if err != nil {
+		t.Fatalf("tryReloadConfig() error = %v", err)
+	}
+
+	var stderr bytes.Buffer
+	aa, err := scanAllOrders(dir, result.Cfg, &stderr, "test")
+	if err != nil {
+		t.Fatalf("scanAllOrders: %v", err)
+	}
+
+	names := make(map[string]bool, len(aa))
+	for _, a := range aa {
+		names[a.Name] = true
+	}
+
+	// Maintenance pack orders (always included).
+	for _, want := range []string{"gate-sweep", "wisp-compact"} {
+		if !names[want] {
+			t.Errorf("missing maintenance order %q; got %v", want, names)
+		}
+	}
+	// Dolt pack orders (included transitively via bd pack).
+	for _, want := range []string{"dolt-health", "dolt-gc-nudge", "dolt-remotes-patrol"} {
+		if !names[want] {
+			t.Errorf("missing dolt order %q; got %v", want, names)
+		}
+	}
+}
+
+func (osFS) Chmod(name string, mode os.FileMode) error { return os.Chmod(name, mode) }
diff --git a/cmd/gc/dashboard/handler.go b/cmd/gc/dashboard/handler.go
index 08e9186e13..2f89e17629 100644
--- a/cmd/gc/dashboard/handler.go
+++ b/cmd/gc/dashboard/handler.go
@@ -107,13 +107,38 @@ func handleClientLog(w http.ResponseWriter, r *http.Request) {
 	}
 	defer r.Body.Close() //nolint:errcheck
 
-	var entry clientLogEntry
-	if err := json.NewDecoder(io.LimitReader(r.Body, maxClientLogBody)).Decode(&entry); err != nil {
-		log.Printf("dashboard: client log decode failed from %s: %v", r.RemoteAddr, err)
-		http.Error(w, "invalid client log payload", http.StatusBadRequest)
+	raw, err := io.ReadAll(io.LimitReader(r.Body, maxClientLogBody))
+	if err != nil {
+		http.Error(w, "read body failed", http.StatusBadRequest)
 		return
 	}
 
+	var entries []clientLogEntry
+	if len(raw) > 0 && raw[0] == '[' {
+		if err := json.Unmarshal(raw, &entries); err != nil {
+			log.Printf("dashboard: client log batch decode failed from %s: %v", r.RemoteAddr, err)
+			http.Error(w, "invalid client log payload", http.StatusBadRequest)
+			return
+		}
+	} else {
+		var entry clientLogEntry
+		if err := json.Unmarshal(raw, &entry); err != nil {
+			log.Printf("dashboard: client log decode failed from %s: %v", r.RemoteAddr, err)
+			http.Error(w, "invalid client log payload", http.StatusBadRequest)
+			return
+		}
+		entries = []clientLogEntry{entry}
+	}
+
+	ua := r.UserAgent()
+	for i := range entries {
+		logClientEntry(&entries[i], ua)
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func logClientEntry(entry *clientLogEntry, ua string) {
 	level := strings.TrimSpace(entry.Level)
 	if level == "" {
 		level = "info"
@@ -123,27 +148,17 @@ func handleClientLog(w http.ResponseWriter, r *http.Request) {
 		scope = "client"
 	}
 	if strings.TrimSpace(entry.Message) == "" {
-		http.Error(w, "missing client log message", http.StatusBadRequest)
 		return
 	}
 	ts := strings.TrimSpace(entry.TS)
 	if ts == "" {
 		ts = time.Now().UTC().Format(time.RFC3339Nano)
 	}
-
 	log.Printf(
 		"dashboard: client[%s] ts=%s scope=%s city=%q url=%q msg=%q details=%s ua=%q",
-		level,
-		ts,
-		scope,
-		entry.City,
-		entry.URL,
-		entry.Message,
-		rawJSONDetails(entry.Details),
-		r.UserAgent(),
+		level, ts, scope, entry.City, entry.URL, entry.Message,
+		rawJSONDetails(entry.Details), ua,
 	)
-
-	w.WriteHeader(http.StatusNoContent)
 }
 
 // injectSupervisorURL rewrites the `<meta name="supervisor-url" content="…">`
diff --git a/cmd/gc/dashboard/handler_test.go b/cmd/gc/dashboard/handler_test.go
index b1b1f46a4c..439ef6d66d 100644
--- a/cmd/gc/dashboard/handler_test.go
+++ b/cmd/gc/dashboard/handler_test.go
@@ -132,3 +132,38 @@ func TestStaticHandlerAcceptsClientLogs(t *testing.T) {
 		t.Fatalf("client log output missing details: %s", logs.String())
 	}
 }
+
+func TestStaticHandlerAcceptsClientLogBatches(t *testing.T) {
+	h, err := NewStaticHandler("http://127.0.0.1:8372")
+	if err != nil {
+		t.Fatalf("NewStaticHandler: %v", err)
+	}
+
+	var logs bytes.Buffer
+	oldWriter := log.Writer()
+	oldFlags := log.Flags()
+	log.SetOutput(&logs)
+	log.SetFlags(0)
+	t.Cleanup(func() {
+		log.SetOutput(oldWriter)
+		log.SetFlags(oldFlags)
+	})
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/__client-log", strings.NewReader(`[
+		{"level":"warn","scope":"sse","message":"refresh delayed","details":{"pending":2}},
+		{"level":"error","scope":"api","message":"request failed","details":{"status":500}}
+	]`))
+	req.Header.Set("Content-Type", "application/json")
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("POST /__client-log: %d %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(logs.String(), `client[warn]`) || !strings.Contains(logs.String(), `scope=sse`) {
+		t.Fatalf("client log batch missing warn entry: %s", logs.String())
+	}
+	if !strings.Contains(logs.String(), `client[error]`) || !strings.Contains(logs.String(), `scope=api`) {
+		t.Fatalf("client log batch missing error entry: %s", logs.String())
+	}
+}
diff --git a/cmd/gc/dashboard/web/dist/dashboard.css b/cmd/gc/dashboard/web/dist/dashboard.css
index bd14f6ba46..9eb7cd7506 100644
--- a/cmd/gc/dashboard/web/dist/dashboard.css
+++ b/cmd/gc/dashboard/web/dist/dashboard.css
@@ -1,3 +1,4 @@
+        .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
         :root {
             --bg-dark: #0f1419;
             --bg-card: #1a1f26;
@@ -2170,7 +2171,7 @@
             background: var(--green);
         }
 
-        /* Mayor status banner */
+        /* Selected scope banner */
         .scope-banner {
             display: flex;
             align-items: center;
@@ -2182,16 +2183,6 @@
             border: 1px solid var(--border);
         }
 
-        .scope-banner.attached {
-            border-color: var(--green);
-            background: rgba(166, 209, 137, 0.08);
-        }
-
-        .scope-banner.detached {
-            border-color: var(--text-muted);
-            opacity: 0.7;
-        }
-
         .scope-info {
             display: flex;
             align-items: center;
diff --git a/cmd/gc/dashboard/web/dist/dashboard.js b/cmd/gc/dashboard/web/dist/dashboard.js
index ec9931ec7b..d805b4ad1a 100644
--- a/cmd/gc/dashboard/web/dist/dashboard.js
+++ b/cmd/gc/dashboard/web/dist/dashboard.js
@@ -1,6 +1,6 @@
-(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const r of document.querySelectorAll('link[rel="modulepreload"]'))a(r);new MutationObserver(r=>{for(const i of r)if(i.type==="childList")for(const o of i.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&a(o)}).observe(document,{childList:!0,subtree:!0});function n(r){const i={};return r.integrity&&(i.integrity=r.integrity),r.referrerPolicy&&(i.referrerPolicy=r.referrerPolicy),r.crossOrigin==="use-credentials"?i.credentials="include":r.crossOrigin==="anonymous"?i.credentials="omit":i.credentials="same-origin",i}function a(r){if(r.ep)return;r.ep=!0;const i=n(r);fetch(r.href,i)}})();const kn=/\{[^{}]+\}/g,Nn=()=>{var e,t;return typeof process=="object"&&Number.parseInt((t=(e=process==null?void 0:process.versions)==null?void 0:e.node)==null?void 0:t.substring(0,2))>=18&&process.versions.undici};function $n(){return Math.random().toString(36).slice(2,11)}function Ln(e){let{baseUrl:t="",Request:n=globalThis.Request,fetch:a=globalThis.fetch,querySerializer:r,bodySerializer:i,headers:o,requestInitExt:l=void 0,...d}={...e};l=Nn()?l:void 0,t=$t(t);const p=[];async function f(u,y){const{baseUrl:m,fetch:h=a,Request:w=n,headers:E,params:b={},parseAs:C="json",querySerializer:N,bodySerializer:I=i??Tn,body:M,...$}=y||{};let O=t;m&&(O=$t(m)??t);let A=typeof r=="function"?r:kt(r);N&&(A=typeof N=="function"?N:kt({...typeof r=="object"?r:{},...N}));const fe=M===void 0?void 0:I(M,Nt(o,E,b.header)),Ze=Nt(fe===void 0||fe instanceof FormData?{}:{"Content-Type":"application/json"},o,E,b.header),et={redirect:"follow",...d,...$,body:fe,headers:Ze};let te,pe,G=new n(An(u,{baseUrl:O,params:b,querySerializer:A}),et),x;for(const R in $)R in G||(G[R]=$[R]);if(p.length){te=$n(),pe=Object.freeze({baseUrl:O,fetch:h,parseAs:C,querySerializer:A,bodySerializer:I});for(const R of p)if(R&&typeof R=="object"&&typeof R.onRequest=="function"){const q=await R.onRequest({request:G,schemaPath:u,params:b,options:pe,id:te});if(q)if(q instanceof n)G=q;else if(q instanceof Response){x=q;break}else throw new Error("onRequest: must return new Request() or Response() when modifying the request")}}if(!x){try{x=await h(G,l)}catch(R){let q=R;if(p.length)for(let _=p.length-1;_>=0;_--){const ne=p[_];if(ne&&typeof ne=="object"&&typeof ne.onError=="function"){const Ce=await ne.onError({request:G,error:q,schemaPath:u,params:b,options:pe,id:te});if(Ce){if(Ce instanceof Response){q=void 0,x=Ce;break}if(Ce instanceof Error){q=Ce;continue}throw new Error("onError: must return new Response() or instance of Error")}}}if(q)throw q}if(p.length)for(let R=p.length-1;R>=0;R--){const q=p[R];if(q&&typeof q=="object"&&typeof q.onResponse=="function"){const _=await q.onResponse({request:G,response:x,schemaPath:u,params:b,options:pe,id:te});if(_){if(!(_ instanceof Response))throw new Error("onResponse: must return new Response() when modifying the response");x=_}}}}if(x.status===204||G.method==="HEAD"||x.headers.get("Content-Length")==="0")return x.ok?{data:void 0,response:x}:{error:void 0,response:x};if(x.ok)return C==="stream"?{data:x.body,response:x}:{data:await x[C](),response:x};let ye=await x.text();try{ye=JSON.parse(ye)}catch{}return{error:ye,response:x}}return{request(u,y,m){return f(y,{...m,method:u.toUpperCase()})},GET(u,y){return f(u,{...y,method:"GET"})},PUT(u,y){return f(u,{...y,method:"PUT"})},POST(u,y){return f(u,{...y,method:"POST"})},DELETE(u,y){return f(u,{...y,method:"DELETE"})},OPTIONS(u,y){return f(u,{...y,method:"OPTIONS"})},HEAD(u,y){return f(u,{...y,method:"HEAD"})},PATCH(u,y){return f(u,{...y,method:"PATCH"})},TRACE(u,y){return f(u,{...y,method:"TRACE"})},use(...u){for(const y of u)if(y){if(typeof y!="object"||!("onRequest"in y||"onResponse"in y||"onError"in y))throw new Error("Middleware must be an object with one of `onRequest()`, `onResponse() or `onError()`");p.push(y)}},eject(...u){for(const y of u){const m=p.indexOf(y);m!==-1&&p.splice(m,1)}}}}function He(e,t,n){if(t==null)return"";if(typeof t=="object")throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");return`${e}=${(n==null?void 0:n.allowReserved)===!0?t:encodeURIComponent(t)}`}function jt(e,t,n){if(!t||typeof t!="object")return"";const a=[],r={simple:",",label:".",matrix:";"}[n.style]||"&";if(n.style!=="deepObject"&&n.explode===!1){for(const l in t)a.push(l,n.allowReserved===!0?t[l]:encodeURIComponent(t[l]));const o=a.join(",");switch(n.style){case"form":return`${e}=${o}`;case"label":return`.${o}`;case"matrix":return`;${e}=${o}`;default:return o}}for(const o in t){const l=n.style==="deepObject"?`${e}[${o}]`:o;a.push(He(l,t[o],n))}const i=a.join(r);return n.style==="label"||n.style==="matrix"?`${r}${i}`:i}function It(e,t,n){if(!Array.isArray(t))return"";if(n.explode===!1){const i={form:",",spaceDelimited:"%20",pipeDelimited:"|"}[n.style]||",",o=(n.allowReserved===!0?t:t.map(l=>encodeURIComponent(l))).join(i);switch(n.style){case"simple":return o;case"label":return`.${o}`;case"matrix":return`;${e}=${o}`;default:return`${e}=${o}`}}const a={simple:",",label:".",matrix:";"}[n.style]||"&",r=[];for(const i of t)n.style==="simple"||n.style==="label"?r.push(n.allowReserved===!0?i:encodeURIComponent(i)):r.push(He(e,i,n));return n.style==="label"||n.style==="matrix"?`${a}${r.join(a)}`:r.join(a)}function kt(e){return function(n){const a=[];if(n&&typeof n=="object")for(const r in n){const i=n[r];if(i!=null){if(Array.isArray(i)){if(i.length===0)continue;a.push(It(r,i,{style:"form",explode:!0,...e==null?void 0:e.array,allowReserved:(e==null?void 0:e.allowReserved)||!1}));continue}if(typeof i=="object"){a.push(jt(r,i,{style:"deepObject",explode:!0,...e==null?void 0:e.object,allowReserved:(e==null?void 0:e.allowReserved)||!1}));continue}a.push(He(r,i,e))}}return a.join("&")}}function xn(e,t){let n=e;for(const a of e.match(kn)??[]){let r=a.substring(1,a.length-1),i=!1,o="simple";if(r.endsWith("*")&&(i=!0,r=r.substring(0,r.length-1)),r.startsWith(".")?(o="label",r=r.substring(1)):r.startsWith(";")&&(o="matrix",r=r.substring(1)),!t||t[r]===void 0||t[r]===null)continue;const l=t[r];if(Array.isArray(l)){n=n.replace(a,It(r,l,{style:o,explode:i}));continue}if(typeof l=="object"){n=n.replace(a,jt(r,l,{style:o,explode:i}));continue}if(o==="matrix"){n=n.replace(a,`;${He(r,l)}`);continue}n=n.replace(a,o==="label"?`.${encodeURIComponent(l)}`:encodeURIComponent(l))}return n}function Tn(e,t){return e instanceof FormData?e:t&&(t.get instanceof Function?t.get("Content-Type")??t.get("content-type"):t["Content-Type"]??t["content-type"])==="application/x-www-form-urlencoded"?new URLSearchParams(e).toString():JSON.stringify(e)}function An(e,t){var r;let n=`${t.baseUrl}${e}`;(r=t.params)!=null&&r.path&&(n=xn(n,t.params.path));let a=t.querySerializer(t.params.query??{});return a.startsWith("?")&&(a=a.substring(1)),a&&(n+=`?${a}`),n}function Nt(...e){const t=new Headers;for(const n of e){if(!n||typeof n!="object")continue;const a=n instanceof Headers?n.entries():Object.entries(n);for(const[r,i]of a)if(i===null)t.delete(r);else if(Array.isArray(i))for(const o of i)t.append(r,o);else i!==void 0&&t.set(r,i)}return t}function $t(e){return e.endsWith("/")?e.substring(0,e.length-1):e}const Rn={bodySerializer:e=>JSON.stringify(e,(t,n)=>typeof n=="bigint"?n.toString():n)};function On({onRequest:e,onSseError:t,onSseEvent:n,responseTransformer:a,responseValidator:r,sseDefaultRetryDelay:i,sseMaxRetryAttempts:o,sseMaxRetryDelay:l,sseSleepFn:d,url:p,...f}){let u;const y=d??(w=>new Promise(E=>setTimeout(E,w)));return{stream:async function*(){let w=i??3e3,E=0;const b=f.signal??new AbortController().signal;for(;!b.aborted;){E++;const C=f.headers instanceof Headers?f.headers:new Headers(f.headers);u!==void 0&&C.set("Last-Event-ID",u);try{const N={redirect:"follow",...f,body:f.serializedBody,headers:C,signal:b};let I=new Request(p,N);e&&(I=await e(p,N));const $=await(f.fetch??globalThis.fetch)(I);if(!$.ok)throw new Error(`SSE failed: ${$.status} ${$.statusText}`);if(!$.body)throw new Error("No body in SSE response");const O=$.body.pipeThrough(new TextDecoderStream).getReader();let A="";const fe=()=>{try{O.cancel()}catch{}};b.addEventListener("abort",fe);try{for(;;){const{done:Ze,value:et}=await O.read();if(Ze)break;A+=et,A=A.replace(/\r\n?/g,`
-`);const te=A.split(`
+(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const s of document.querySelectorAll('link[rel="modulepreload"]'))a(s);new MutationObserver(s=>{for(const i of s)if(i.type==="childList")for(const o of i.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&a(o)}).observe(document,{childList:!0,subtree:!0});function n(s){const i={};return s.integrity&&(i.integrity=s.integrity),s.referrerPolicy&&(i.referrerPolicy=s.referrerPolicy),s.crossOrigin==="use-credentials"?i.credentials="include":s.crossOrigin==="anonymous"?i.credentials="omit":i.credentials="same-origin",i}function a(s){if(s.ep)return;s.ep=!0;const i=n(s);fetch(s.href,i)}})();const Mn=/\{[^{}]+\}/g,Un=()=>{var e,t;return typeof process=="object"&&Number.parseInt((t=(e=process==null?void 0:process.versions)==null?void 0:e.node)==null?void 0:t.substring(0,2))>=18&&process.versions.undici};function Dn(){return Math.random().toString(36).slice(2,11)}function Wn(e){let{baseUrl:t="",Request:n=globalThis.Request,fetch:a=globalThis.fetch,querySerializer:s,bodySerializer:i,headers:o,requestInitExt:l=void 0,...u}={...e};l=Un()?l:void 0,t=Ot(t);const y=[];async function f(d,p){const{baseUrl:m,fetch:h=a,Request:v=n,headers:C,params:b={},parseAs:N="json",querySerializer:k,bodySerializer:P=i??Gn,body:M,...x}=p||{};let q=t;m&&(q=Ot(m)??t);let R=typeof s=="function"?s:Rt(s);k&&(R=typeof k=="function"?k:Rt({...typeof s=="object"?s:{},...k}));const Y=M===void 0?void 0:P(M,qt(o,C,b.header)),me=qt(Y===void 0||Y instanceof FormData?{}:{"Content-Type":"application/json"},o,C,b.header),ge={redirect:"follow",...u,...x,body:Y,headers:me};let V,X,W=new n(Fn(d,{baseUrl:q,params:b,querySerializer:R}),ge),T;for(const L in x)L in W||(W[L]=x[L]);if(y.length){V=Dn(),X=Object.freeze({baseUrl:q,fetch:h,parseAs:N,querySerializer:R,bodySerializer:P});for(const L of y)if(L&&typeof L=="object"&&typeof L.onRequest=="function"){const _=await L.onRequest({request:W,schemaPath:d,params:b,options:X,id:V});if(_)if(_ instanceof n)W=_;else if(_ instanceof Response){T=_;break}else throw new Error("onRequest: must return new Request() or Response() when modifying the request")}}if(!T){try{T=await h(W,l)}catch(L){let _=L;if(y.length)for(let j=y.length-1;j>=0;j--){const re=y[j];if(re&&typeof re=="object"&&typeof re.onError=="function"){const Ne=await re.onError({request:W,error:_,schemaPath:d,params:b,options:X,id:V});if(Ne){if(Ne instanceof Response){_=void 0,T=Ne;break}if(Ne instanceof Error){_=Ne;continue}throw new Error("onError: must return new Response() or instance of Error")}}}if(_)throw _}if(y.length)for(let L=y.length-1;L>=0;L--){const _=y[L];if(_&&typeof _=="object"&&typeof _.onResponse=="function"){const j=await _.onResponse({request:W,response:T,schemaPath:d,params:b,options:X,id:V});if(j){if(!(j instanceof Response))throw new Error("onResponse: must return new Response() when modifying the response");T=j}}}}if(T.status===204||W.method==="HEAD"||T.headers.get("Content-Length")==="0")return T.ok?{data:void 0,response:T}:{error:void 0,response:T};if(T.ok)return N==="stream"?{data:T.body,response:T}:{data:await T[N](),response:T};let $=await T.text();try{$=JSON.parse($)}catch{}return{error:$,response:T}}return{request(d,p,m){return f(p,{...m,method:d.toUpperCase()})},GET(d,p){return f(d,{...p,method:"GET"})},PUT(d,p){return f(d,{...p,method:"PUT"})},POST(d,p){return f(d,{...p,method:"POST"})},DELETE(d,p){return f(d,{...p,method:"DELETE"})},OPTIONS(d,p){return f(d,{...p,method:"OPTIONS"})},HEAD(d,p){return f(d,{...p,method:"HEAD"})},PATCH(d,p){return f(d,{...p,method:"PATCH"})},TRACE(d,p){return f(d,{...p,method:"TRACE"})},use(...d){for(const p of d)if(p){if(typeof p!="object"||!("onRequest"in p||"onResponse"in p||"onError"in p))throw new Error("Middleware must be an object with one of `onRequest()`, `onResponse() or `onError()`");y.push(p)}},eject(...d){for(const p of d){const m=y.indexOf(p);m!==-1&&y.splice(m,1)}}}}function Ze(e,t,n){if(t==null)return"";if(typeof t=="object")throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");return`${e}=${(n==null?void 0:n.allowReserved)===!0?t:encodeURIComponent(t)}`}function Ft(e,t,n){if(!t||typeof t!="object")return"";const a=[],s={simple:",",label:".",matrix:";"}[n.style]||"&";if(n.style!=="deepObject"&&n.explode===!1){for(const l in t)a.push(l,n.allowReserved===!0?t[l]:encodeURIComponent(t[l]));const o=a.join(",");switch(n.style){case"form":return`${e}=${o}`;case"label":return`.${o}`;case"matrix":return`;${e}=${o}`;default:return o}}for(const o in t){const l=n.style==="deepObject"?`${e}[${o}]`:o;a.push(Ze(l,t[o],n))}const i=a.join(s);return n.style==="label"||n.style==="matrix"?`${s}${i}`:i}function Ht(e,t,n){if(!Array.isArray(t))return"";if(n.explode===!1){const i={form:",",spaceDelimited:"%20",pipeDelimited:"|"}[n.style]||",",o=(n.allowReserved===!0?t:t.map(l=>encodeURIComponent(l))).join(i);switch(n.style){case"simple":return o;case"label":return`.${o}`;case"matrix":return`;${e}=${o}`;default:return`${e}=${o}`}}const a={simple:",",label:".",matrix:";"}[n.style]||"&",s=[];for(const i of t)n.style==="simple"||n.style==="label"?s.push(n.allowReserved===!0?i:encodeURIComponent(i)):s.push(Ze(e,i,n));return n.style==="label"||n.style==="matrix"?`${a}${s.join(a)}`:s.join(a)}function Rt(e){return function(n){const a=[];if(n&&typeof n=="object")for(const s in n){const i=n[s];if(i!=null){if(Array.isArray(i)){if(i.length===0)continue;a.push(Ht(s,i,{style:"form",explode:!0,...e==null?void 0:e.array,allowReserved:(e==null?void 0:e.allowReserved)||!1}));continue}if(typeof i=="object"){a.push(Ft(s,i,{style:"deepObject",explode:!0,...e==null?void 0:e.object,allowReserved:(e==null?void 0:e.allowReserved)||!1}));continue}a.push(Ze(s,i,e))}}return a.join("&")}}function zn(e,t){let n=e;for(const a of e.match(Mn)??[]){let s=a.substring(1,a.length-1),i=!1,o="simple";if(s.endsWith("*")&&(i=!0,s=s.substring(0,s.length-1)),s.startsWith(".")?(o="label",s=s.substring(1)):s.startsWith(";")&&(o="matrix",s=s.substring(1)),!t||t[s]===void 0||t[s]===null)continue;const l=t[s];if(Array.isArray(l)){n=n.replace(a,Ht(s,l,{style:o,explode:i}));continue}if(typeof l=="object"){n=n.replace(a,Ft(s,l,{style:o,explode:i}));continue}if(o==="matrix"){n=n.replace(a,`;${Ze(s,l)}`);continue}n=n.replace(a,o==="label"?`.${encodeURIComponent(l)}`:encodeURIComponent(l))}return n}function Gn(e,t){return e instanceof FormData?e:t&&(t.get instanceof Function?t.get("Content-Type")??t.get("content-type"):t["Content-Type"]??t["content-type"])==="application/x-www-form-urlencoded"?new URLSearchParams(e).toString():JSON.stringify(e)}function Fn(e,t){var s;let n=`${t.baseUrl}${e}`;(s=t.params)!=null&&s.path&&(n=zn(n,t.params.path));let a=t.querySerializer(t.params.query??{});return a.startsWith("?")&&(a=a.substring(1)),a&&(n+=`?${a}`),n}function qt(...e){const t=new Headers;for(const n of e){if(!n||typeof n!="object")continue;const a=n instanceof Headers?n.entries():Object.entries(n);for(const[s,i]of a)if(i===null)t.delete(s);else if(Array.isArray(i))for(const o of i)t.append(s,o);else i!==void 0&&t.set(s,i)}return t}function Ot(e){return e.endsWith("/")?e.substring(0,e.length-1):e}const Hn={bodySerializer:e=>JSON.stringify(e,(t,n)=>typeof n=="bigint"?n.toString():n)};function Jn({onRequest:e,onSseError:t,onSseEvent:n,responseTransformer:a,responseValidator:s,sseDefaultRetryDelay:i,sseMaxRetryAttempts:o,sseMaxRetryDelay:l,sseSleepFn:u,url:y,...f}){let d;const p=u??(v=>new Promise(C=>setTimeout(C,v)));return{stream:async function*(){let v=i??3e3,C=0;const b=f.signal??new AbortController().signal;for(;!b.aborted;){C++;const N=f.headers instanceof Headers?f.headers:new Headers(f.headers);d!==void 0&&N.set("Last-Event-ID",d);try{const k={redirect:"follow",...f,body:f.serializedBody,headers:N,signal:b};let P=new Request(y,k);e&&(P=await e(y,k));const x=await(f.fetch??globalThis.fetch)(P);if(!x.ok)throw new Error(`SSE failed: ${x.status} ${x.statusText}`);if(!x.body)throw new Error("No body in SSE response");const q=x.body.pipeThrough(new TextDecoderStream).getReader();let R="";const Y=()=>{try{q.cancel()}catch{}};b.addEventListener("abort",Y);try{for(;;){const{done:me,value:ge}=await q.read();if(me)break;R+=ge,R=R.replace(/\r\n?/g,`
+`);const V=R.split(`
 
-`);A=te.pop()??"";for(const pe of te){const G=pe.split(`
-`),x=[];let ye;for(const _ of G)if(_.startsWith("data:"))x.push(_.replace(/^data:\s*/,""));else if(_.startsWith("event:"))ye=_.replace(/^event:\s*/,"");else if(_.startsWith("id:"))u=_.replace(/^id:\s*/,"");else if(_.startsWith("retry:")){const ne=Number.parseInt(_.replace(/^retry:\s*/,""),10);Number.isNaN(ne)||(w=ne)}let R,q=!1;if(x.length){const _=x.join(`
-`);try{R=JSON.parse(_),q=!0}catch{R=_}}q&&(r&&await r(R),a&&(R=await a(R))),n==null||n({data:R,event:ye,id:u,retry:w}),x.length&&(yield R)}}}finally{b.removeEventListener("abort",fe),O.releaseLock()}break}catch(N){if(t==null||t(N),o!==void 0&&E>=o)break;const I=Math.min(w*2**(E-1),l??3e4);await y(I)}}}()}}const qn=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},_n=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Pn=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Bt=({allowReserved:e,explode:t,name:n,style:a,value:r})=>{if(!t){const l=(e?r:r.map(d=>encodeURIComponent(d))).join(_n(a));switch(a){case"label":return`.${l}`;case"matrix":return`;${n}=${l}`;case"simple":return l;default:return`${n}=${l}`}}const i=qn(a),o=r.map(l=>a==="label"||a==="simple"?e?l:encodeURIComponent(l):Je({allowReserved:e,name:n,value:l})).join(i);return a==="label"||a==="matrix"?i+o:o},Je=({allowReserved:e,name:t,value:n})=>{if(n==null)return"";if(typeof n=="object")throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");return`${t}=${e?n:encodeURIComponent(n)}`},Mt=({allowReserved:e,explode:t,name:n,style:a,value:r,valueOnly:i})=>{if(r instanceof Date)return i?r.toISOString():`${n}=${r.toISOString()}`;if(a!=="deepObject"&&!t){let d=[];Object.entries(r).forEach(([f,u])=>{d=[...d,f,e?u:encodeURIComponent(u)]});const p=d.join(",");switch(a){case"form":return`${n}=${p}`;case"label":return`.${p}`;case"matrix":return`;${n}=${p}`;default:return p}}const o=Pn(a),l=Object.entries(r).map(([d,p])=>Je({allowReserved:e,name:a==="deepObject"?`${n}[${d}]`:d,value:p})).join(o);return a==="label"||a==="matrix"?o+l:l},jn=/\{[^{}]+\}/g,In=({path:e,url:t})=>{let n=t;const a=t.match(jn);if(a)for(const r of a){let i=!1,o=r.substring(1,r.length-1),l="simple";o.endsWith("*")&&(i=!0,o=o.substring(0,o.length-1)),o.startsWith(".")?(o=o.substring(1),l="label"):o.startsWith(";")&&(o=o.substring(1),l="matrix");const d=e[o];if(d==null)continue;if(Array.isArray(d)){n=n.replace(r,Bt({explode:i,name:o,style:l,value:d}));continue}if(typeof d=="object"){n=n.replace(r,Mt({explode:i,name:o,style:l,value:d,valueOnly:!0}));continue}if(l==="matrix"){n=n.replace(r,`;${Je({name:o,value:d})}`);continue}const p=encodeURIComponent(l==="label"?`.${d}`:d);n=n.replace(r,p)}return n},Bn=({baseUrl:e,path:t,query:n,querySerializer:a,url:r})=>{const i=r.startsWith("/")?r:`/${r}`;let o=(e??"")+i;t&&(o=In({path:t,url:o}));let l=n?a(n):"";return l.startsWith("?")&&(l=l.substring(1)),l&&(o+=`?${l}`),o};function Lt(e){const t=e.body!==void 0;if(t&&e.bodySerializer)return"serializedBody"in e?e.serializedBody!==void 0&&e.serializedBody!==""?e.serializedBody:null:e.body!==""?e.body:null;if(t)return e.body}const Mn=async(e,t)=>{const n=typeof t=="function"?await t(e):t;if(n)return e.scheme==="bearer"?`Bearer ${n}`:e.scheme==="basic"?`Basic ${btoa(n)}`:n},Ut=({parameters:e={},...t}={})=>a=>{const r=[];if(a&&typeof a=="object")for(const i in a){const o=a[i];if(o==null)continue;const l=e[i]||t;if(Array.isArray(o)){const d=Bt({allowReserved:l.allowReserved,explode:!0,name:i,style:"form",value:o,...l.array});d&&r.push(d)}else if(typeof o=="object"){const d=Mt({allowReserved:l.allowReserved,explode:!0,name:i,style:"deepObject",value:o,...l.object});d&&r.push(d)}else{const d=Je({allowReserved:l.allowReserved,name:i,value:o});d&&r.push(d)}}return r.join("&")},Un=e=>{var n;if(!e)return"stream";const t=(n=e.split(";")[0])==null?void 0:n.trim();if(t){if(t.startsWith("application/json")||t.endsWith("+json"))return"json";if(t==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(a=>t.startsWith(a)))return"blob";if(t.startsWith("text/"))return"text"}},Dn=(e,t)=>{var n,a;return t?!!(e.headers.has(t)||(n=e.query)!=null&&n[t]||(a=e.headers.get("Cookie"))!=null&&a.includes(`${t}=`)):!1},zn=async({security:e,...t})=>{for(const n of e){if(Dn(t,n.name))continue;const a=await Mn(n,t.auth);if(!a)continue;const r=n.name??"Authorization";switch(n.in){case"query":t.query||(t.query={}),t.query[r]=a;break;case"cookie":t.headers.append("Cookie",`${r}=${a}`);break;case"header":default:t.headers.set(r,a);break}}},xt=e=>Bn({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:Ut(e.querySerializer),url:e.url}),Tt=(e,t)=>{var a;const n={...e,...t};return(a=n.baseUrl)!=null&&a.endsWith("/")&&(n.baseUrl=n.baseUrl.substring(0,n.baseUrl.length-1)),n.headers=Dt(e.headers,t.headers),n},Wn=e=>{const t=[];return e.forEach((n,a)=>{t.push([a,n])}),t},Dt=(...e)=>{const t=new Headers;for(const n of e){if(!n)continue;const a=n instanceof Headers?Wn(n):Object.entries(n);for(const[r,i]of a)if(i===null)t.delete(r);else if(Array.isArray(i))for(const o of i)t.append(r,o);else i!==void 0&&t.set(r,typeof i=="object"?JSON.stringify(i):i)}return t};class tt{constructor(){this.fns=[]}clear(){this.fns=[]}eject(t){const n=this.getInterceptorIndex(t);this.fns[n]&&(this.fns[n]=null)}exists(t){const n=this.getInterceptorIndex(t);return!!this.fns[n]}getInterceptorIndex(t){return typeof t=="number"?this.fns[t]?t:-1:this.fns.indexOf(t)}update(t,n){const a=this.getInterceptorIndex(t);return this.fns[a]?(this.fns[a]=n,t):!1}use(t){return this.fns.push(t),this.fns.length-1}}const Gn=()=>({error:new tt,request:new tt,response:new tt}),Fn=Ut({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),Hn={"Content-Type":"application/json"},zt=(e={})=>({...Rn,headers:Hn,parseAs:"auto",querySerializer:Fn,...e}),Jn=(e={})=>{let t=Tt(zt(),e);const n=()=>({...t}),a=f=>(t=Tt(t,f),n()),r=Gn(),i=async f=>{const u={...t,...f,fetch:f.fetch??t.fetch??globalThis.fetch,headers:Dt(t.headers,f.headers),serializedBody:void 0};u.security&&await zn({...u,security:u.security}),u.requestValidator&&await u.requestValidator(u),u.body!==void 0&&u.bodySerializer&&(u.serializedBody=u.bodySerializer(u.body)),(u.body===void 0||u.serializedBody==="")&&u.headers.delete("Content-Type");const y=u,m=xt(y);return{opts:y,url:m}},o=async f=>{const{opts:u,url:y}=await i(f),m={redirect:"follow",...u,body:Lt(u)};let h=new Request(y,m);for(const $ of r.request.fns)$&&(h=await $(h,u));const w=u.fetch;let E;try{E=await w(h)}catch($){let O=$;for(const A of r.error.fns)A&&(O=await A($,void 0,h,u));if(O=O||{},u.throwOnError)throw O;return u.responseStyle==="data"?void 0:{error:O,request:h,response:void 0}}for(const $ of r.response.fns)$&&(E=await $(E,h,u));const b={request:h,response:E};if(E.ok){const $=(u.parseAs==="auto"?Un(E.headers.get("Content-Type")):u.parseAs)??"json";if(E.status===204||E.headers.get("Content-Length")==="0"){let A;switch($){case"arrayBuffer":case"blob":case"text":A=await E[$]();break;case"formData":A=new FormData;break;case"stream":A=E.body;break;case"json":default:A={};break}return u.responseStyle==="data"?A:{data:A,...b}}let O;switch($){case"arrayBuffer":case"blob":case"formData":case"text":O=await E[$]();break;case"json":{const A=await E.text();O=A?JSON.parse(A):{};break}case"stream":return u.responseStyle==="data"?E.body:{data:E.body,...b}}return $==="json"&&(u.responseValidator&&await u.responseValidator(O),u.responseTransformer&&(O=await u.responseTransformer(O))),u.responseStyle==="data"?O:{data:O,...b}}const C=await E.text();let N;try{N=JSON.parse(C)}catch{}const I=N??C;let M=I;for(const $ of r.error.fns)$&&(M=await $(I,E,h,u));if(M=M||{},u.throwOnError)throw M;return u.responseStyle==="data"?void 0:{error:M,...b}},l=f=>u=>o({...u,method:f}),d=f=>async u=>{const{opts:y,url:m}=await i(u);return On({...y,body:y.body,headers:y.headers,method:f,onRequest:async(h,w)=>{let E=new Request(h,w);for(const b of r.request.fns)b&&(E=await b(E,y));return E},serializedBody:Lt(y),url:m})};return{buildUrl:f=>xt({...t,...f}),connect:l("CONNECT"),delete:l("DELETE"),get:l("GET"),getConfig:n,head:l("HEAD"),interceptors:r,options:l("OPTIONS"),patch:l("PATCH"),post:l("POST"),put:l("PUT"),request:o,setConfig:a,sse:{connect:d("CONNECT"),delete:d("DELETE"),get:d("GET"),head:d("HEAD"),options:d("OPTIONS"),patch:d("PATCH"),post:d("POST"),put:d("PUT"),trace:d("TRACE")},trace:l("TRACE")}},le=Jn(zt()),Wt={debug:console.debug.bind(console),error:console.error.bind(console),info:console.info.bind(console),log:console.log.bind(console),warn:console.warn.bind(console)};let At=!1;function Vn(){At||typeof window>"u"||(At=!0,ke("debug","debug"),ke("info","info"),ke("warn","warn"),ke("error","error"),ke("log","info"),window.addEventListener("error",e=>{oe("window","Unhandled error",{colno:e.colno,error:e.error,filename:e.filename,lineno:e.lineno,message:e.message})}),window.addEventListener("unhandledrejection",e=>{oe("window","Unhandled promise rejection",{reason:e.reason})}))}function he(e,t,n){Ke("debug",e,t,n)}function J(e,t,n){Ke("info",e,t,n)}function Ve(e,t,n){Ke("warn",e,t,n)}function oe(e,t,n){Ke("error",e,t,n)}function Ke(e,t,n,a){const r=Gt(e,t,n,a);Wt[e](`[dashboard][${t}] ${n}`,We(a)),Ft(r)}function ke(e,t){const n=Wt[e];console[e]=(...a)=>{n(...a),Ft(Gt(t,"console",Qn(a),a.length>1?a.slice(1):a[0]))}}function Gt(e,t,n,a){return{city:Kn(),details:a===void 0?void 0:We(a),level:e,message:n,scope:t,ts:new Date().toISOString(),url:typeof window>"u"?"":window.location.href}}function Kn(){return typeof window>"u"?"":(new URLSearchParams(window.location.search).get("city")??"").trim()}function Qn(e){if(e.length===0)return"console event";const[t]=e;return typeof t=="string"&&t.trim()!==""?t:t instanceof Error?t.message:"console event"}function Ft(e){const t=JSON.stringify(e);if(typeof navigator<"u"&&typeof navigator.sendBeacon=="function"){const n=new Blob([t],{type:"application/json"});if(navigator.sendBeacon("/__client-log",n))return}fetch("/__client-log",{body:t,credentials:"same-origin",headers:{"Content-Type":"application/json"},keepalive:!0,method:"POST"}).catch(()=>{})}function We(e,t=0,n=new WeakSet){if(e==null)return e??null;if(typeof e=="string")return e.length>2e3?`${e.slice(0,1999)}…`:e;if(typeof e=="number"||typeof e=="boolean")return e;if(e instanceof Error)return{message:e.message,name:e.name,stack:e.stack};if(typeof e=="function")return`[function ${e.name||"anonymous"}]`;if(t>=4)return"[max-depth]";if(Array.isArray(e))return e.slice(0,20).map(a=>We(a,t+1,n));if(typeof e=="object"){if(n.has(e))return"[circular]";n.add(e);const a={};for(const[r,i]of Object.entries(e).slice(0,40))a[r]=We(i,t+1,n);return a}return String(e)}const ft=["cities","status","supervisor","crew","issues","mail","convoys","activity","admin","options"];let Ge=Vt(window.location.search),pt=[];const ze=new Set(ft);function Xn(){return Ge}function yt(){return Ge=Vt(window.location.search),Ge}function se(...e){e.forEach(t=>ze.add(t))}function mt(){se(...ft)}function Yn(e=!1){if(e)return ze.clear(),new Set(ft);const t=new Set(ze);return ze.clear(),t}function Zn(e){pt=e.map(t=>({error:t.error,name:t.name,path:t.path,phasesCompleted:[...t.phasesCompleted??[]],running:t.running,status:t.status}))}function Ht(){return pt.map(e=>({error:e.error,name:e.name,path:e.path,phasesCompleted:[...e.phasesCompleted],running:e.running,status:e.status}))}function Jt(){const e=Ge;if(e==="")return{kind:"supervisor"};const t=pt.find(n=>n.name===e);return t?t.running?{kind:"running",city:t}:{kind:"not-running",city:t}:{kind:"unknown",name:e}}function ea(e){if(e){if(e.startsWith("session.")||e.startsWith("agent.")){se("status","crew","options");return}if(e.startsWith("bead.")){se("status","issues","convoys","admin","options");return}if(e.startsWith("mail.")){se("status","mail","options");return}if(e.startsWith("convoy.")){se("status","convoys");return}if(e.startsWith("city.")){se("cities","status","supervisor");return}if(e.startsWith("service.")||e.startsWith("provider.")||e.startsWith("rig.")){se("admin");return}}}function Vt(e){return(new URLSearchParams(e).get("city")??"").trim()}function Kt(){const e=document.querySelector('meta[name="supervisor-url"]');return((e==null?void 0:e.content)??"").replace(/\/+$/,"")}function S(){return Xn()}const T={"X-GC-Request":"true"},g=Ln({baseUrl:Kt(),headers:T});le.setConfig({baseUrl:Kt(),headers:T});g.use({async onError({error:e,request:t,schemaPath:n}){return oe("api","Request failed",{error:e,method:t.method,schemaPath:n,url:t.url}),e instanceof Error?e:new Error(String(e))},async onRequest({params:e,request:t,schemaPath:n}){he("api","Request start",{method:t.method,params:e,schemaPath:n,url:t.url})},async onResponse({request:e,response:t,schemaPath:n}){const a={method:e.method,ok:t.ok,schemaPath:n,status:t.status,url:e.url};if(!t.ok||t.status>=400){Ve("api","Request response",a);return}he("api","Request response",a)}});function s(e,t={},n=[]){const a=document.createElement(e);for(const[r,i]of Object.entries(t))i===void 0||i===!1||(i===!0?a.setAttribute(r,""):a.setAttribute(r,String(i)));for(const r of n)r!=null&&a.append(typeof r=="string"?document.createTextNode(r):r);return a}function k(e){for(;e.firstChild;)e.removeChild(e.firstChild)}function c(e){return document.getElementById(e)}async function ta(){const e=c("city-tabs");if(!e)return;const{data:t,error:n}=await g.GET("/v0/cities");!n&&(t!=null&&t.items)&&Zn(t.items.map(l=>({error:l.error??void 0,name:l.name??"",path:l.path??void 0,phasesCompleted:l.phases_completed??[],running:l.running===!0,status:l.status??void 0})));const a=Ht();if(n||a.length===0)return;const r=S();k(e);const i=s("nav",{class:"city-tabs"}),o=window.location.pathname||"/";i.append(s("a",{href:o,class:`city-tab${r===""?" active":""}`},[s("span",{class:"city-dot running"})," Supervisor"]));for(const l of a){const d=l.running,p=l.name===r,f=s("a",{href:`${o}?city=${encodeURIComponent(l.name)}`,class:`city-tab${p?" active":""}${d?"":" stopped"}`},[s("span",{class:`city-dot${d?" running":""}`}),` ${l.name}`]);i.append(f)}e.append(i)}function gt(e,t=new Date){if(!e)return"";const n=new Date(e);if(isNaN(n.getTime()))return"";const a=Math.max(0,t.getTime()-n.getTime()),r=Math.floor(a/1e3);if(r<60)return`${r}s ago`;const i=Math.floor(r/60);if(i<60)return`${i}m ago`;const o=Math.floor(i/60);return o<24?`${o}h ago`:`${Math.floor(o/24)}d ago`}const Qt=300*1e3,na=600*1e3;function D(e){if(!e)return"—";const t=new Date(e);if(Number.isNaN(t.getTime()))return"—";const n=new Date,a=t.getFullYear()===n.getFullYear()?{month:"short",day:"numeric",hour:"numeric",minute:"2-digit"}:{month:"short",day:"numeric",year:"numeric",hour:"numeric",minute:"2-digit"};return t.toLocaleString(void 0,a)}function _e(e){if(!e)return{display:"unknown",colorClass:"unknown"};const t=new Date(e);if(Number.isNaN(t.getTime()))return{display:"unknown",colorClass:"unknown"};const n=Math.max(0,Date.now()-t.getTime()),a=gt(e).replace(" ago","");return n<Qt?{display:a,colorClass:"green"}:n<na?{display:a,colorClass:"yellow"}:{display:a,colorClass:"red"}}function B(e){if(!e)return"—";const t=e.split("/").filter(Boolean);return t.length===0?"—":t.length===1?t[0]:t.length>=3?`${t[t.length-1]} (${t[0]}/${t[1]})`:`${t[0]}/${t[t.length-1]}`}function aa(e){return!e||!e.includes("/")?"":e.split("/",1)[0]??""}function sa(e){return e.startsWith("agent.")||e.startsWith("session.")?"agent":e.startsWith("bead.")||e.startsWith("convoy.")||e.startsWith("order.")?"work":e.startsWith("mail.")?"comms":"system"}function ra(e){return{"session.started":"▶","session.ended":"■","session.crashed":"☠","session.suspended":"⏸","session.woke":"▶","agent.message":"💬","agent.output":"📝","agent.tool_call":"🛠","agent.tool_result":"✅","agent.error":"⚠","bead.created":"📿","bead.updated":"📝","bead.closed":"✅","convoy.created":"🚚","convoy.closed":"✅","mail.delivered":"📬","mail.read":"📨"}[e]??"📋"}function ia(e,t,n,a){const r=B(t);switch(e){case"session.started":return`${B(n)} started`;case"session.ended":return`${B(n)} ended`;case"session.crashed":return`${B(n)} crashed`;case"session.suspended":return`${B(n)} suspended`;case"session.woke":return`${B(n)} woke`;case"bead.created":return`${r} created bead ${n??""}`.trim();case"bead.updated":return`${r} updated bead ${n??""}`.trim();case"bead.closed":return`${r} closed bead ${n??""}`.trim();case"mail.delivered":return`${r} delivered mail`;case"mail.read":return`${r} read mail`;case"convoy.created":return`${r} created convoy ${n??""}`.trim();case"convoy.closed":return`${r} closed convoy ${n??""}`.trim();default:return a??n??e}}function Qe(e,t){return e?e.length<=t?e:`${e.slice(0,t-1)}…`:""}function ee(e){return typeof e!="number"||Number.isNaN(e)||e<=0?4:e}function Xt(e){switch(ee(e)){case 1:return"badge-red";case 2:return"badge-orange";case 3:return"badge-yellow";default:return"badge-muted"}}function ce(e){switch((e??"").toLowerCase()){case"open":case"running":case"ready":case"working":return"badge-green";case"in_progress":case"pending":case"stale":case"warning":return"badge-yellow";case"closed":case"stopped":return"badge-muted";case"error":case"failed":case"stuck":return"badge-red";default:return"badge-blue"}}async function oa(){var w,E,b;const e=S(),t=c("status-banner");if(!t)return;if(!e){await ca(t);return}da();const[n,a,r,i]=await Promise.all([g.GET("/v0/city/{cityName}/status",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/sessions",{params:{path:{cityName:e},query:{state:"active",peek:!0}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"open",limit:500}}}),g.GET("/v0/city/{cityName}/convoys",{params:{path:{cityName:e},query:{limit:200}}})]);if(n.error||!n.data){k(t),t.append(s("div",{class:"banner-error"},[`Status unavailable for ${e}`]));return}const o=((w=a.data)==null?void 0:w.items)??[],l=((E=r.data)==null?void 0:E.items)??[],d=((b=i.data)==null?void 0:b.items)??[];la(e,o);const p=o.filter(C=>!C.pool||!C.running||!C.last_active?!1:Date.now()-new Date(C.last_active).getTime()>=1800*1e3).length,f=l.filter(C=>C.assignee&&C.status!=="closed").length,u=l.filter(C=>ee(C.priority)<=2).length,y=o.filter(C=>!C.running).length,m=s("div",{class:"summary-stats"},[H(n.data.agents.running,"Agents"),H(n.data.work.in_progress,"Assigned"),H(n.data.work.open,"Beads"),H(d.length,"Convoys"),H(n.data.mail.unread,"Unread")]),h=s("div",{class:"summary-alerts"});Q(h,p>0,"alert-red",`${p} stuck`),Q(h,f>0,"alert-yellow",`${f} assigned`),Q(h,u>0,"alert-red",`${u} P1/P2`),Q(h,y>0,"alert-red",`${y} dead`),h.childNodes.length||h.append(s("span",{class:"alert-item alert-green"},["All clear"])),k(t),t.append(m,h)}async function ca(e){var u,y;ua();const[t,n]=await Promise.all([g.GET("/health"),g.GET("/v0/cities")]),a=t.data,r=((u=n.data)==null?void 0:u.items)??[],i=(a==null?void 0:a.cities_total)??r.length,o=(a==null?void 0:a.cities_running)??r.filter(m=>m.running===!0).length,l=Math.max(i-o,0),d=r.filter(m=>!!m.error).length;if(k(e),t.error&&n.error){e.append(s("div",{class:"banner-error"},["Supervisor status unavailable"]));return}const p=s("div",{class:"summary-stats"},[H(i,"🏙️ Cities"),H(o,"🟢 Running"),H(l,"⏸ Stopped"),H(fa(a==null?void 0:a.uptime_sec),"⏱ Uptime")]),f=s("div",{class:"summary-alerts"});Q(f,i===0,"alert-yellow","No registered cities"),Q(f,l>0,"alert-yellow",`${l} ${l===1?"city":"cities"} not running`),Q(f,d>0,"alert-red",`${d} ${d===1?"city":"cities"} reporting errors`),Q(f,!!(a!=null&&a.startup&&!a.startup.ready),"alert-yellow",`⏳ Startup: ${((y=a==null?void 0:a.startup)==null?void 0:y.phase)||"starting"}`),f.childNodes.length||f.append(s("span",{class:"alert-item alert-green"},["✓ Supervisor ready"])),e.append(p,f)}function H(e,t){return s("div",{class:"stat"},[s("span",{class:"stat-value"},[String(e??0)]),s("span",{class:"stat-label"},[t])])}function Q(e,t,n,a){t&&e.append(s("span",{class:`alert-item ${n}`},[a]))}function la(e,t){const n=c("scope-banner"),a=c("scope-badge"),r=c("scope-status");if(!n||!a||!r)return;const i=t.find(l=>!l.rig&&!l.pool);if(!i){n.classList.remove("attached"),n.classList.add("detached"),a.className="badge badge-muted",a.textContent="Detached",k(r),r.append(K("Scope",e),K("Overseer","none"));return}n.classList.remove("attached","detached"),n.classList.add(i.attached?"attached":"detached"),a.className=`badge ${i.attached?"badge-green":"badge-muted"}`,a.textContent=i.attached?"Attached":"Detached",k(r);const o=i.last_active?Date.now()-new Date(i.last_active).getTime()<Qt:!1;r.append(K("Scope",e),K("Session",i.template),K("Activity",i.last_active?D(i.last_active):"Unknown",o?"active":"idle"),K("State",i.running?"Running":"Stopped"))}function da(){const e=c("scope-banner"),t=c("scope-badge"),n=c("scope-status");!e||!t||!n||(e.classList.remove("attached"),e.classList.add("detached"),t.className="badge badge-muted",t.textContent="Idle",k(n))}function ua(){const e=c("scope-banner"),t=c("scope-badge"),n=c("scope-status");!e||!t||!n||(e.classList.remove("attached"),e.classList.add("detached"),t.className="badge badge-muted",t.textContent="Supervisor",k(n),n.append(K("Scope","Fleet"),K("City","Select one")))}function K(e,t,n=""){return s("div",{class:"scope-stat"},[s("span",{class:"scope-stat-label"},[e]),s("span",{class:`scope-stat-value${n?` ${n}`:""}`},[t])])}function fa(e){return!e||e<=0?"0m":e<3600?`${Math.max(1,Math.floor(e/60))}m`:e<86400?`${Math.floor(e/3600)}h`:`${Math.floor(e/86400)}d`}const pa=e=>(e.client??le).sse.get({url:"/v0/city/{cityName}/events/stream",...e}),ya=e=>(e.client??le).sse.get({url:"/v0/city/{cityName}/session/{id}/stream",...e}),ma=e=>((e==null?void 0:e.client)??le).sse.get({url:"/v0/events/stream",...e});let re=0,rt=null;function ga(e){rt=e}function Yt(e){re=Math.max(0,e),document.body.dataset.pauseRefresh=re>0?"true":"false"}function F(){Yt(re+1)}function j(){const e=re>0;if(Yt(re-1),e&&re===0&&rt)try{rt()}catch(t){oe("ui","popPause listener threw",{error:String(t)})}}function bt(){return re>0}function Rt(e,t){const n=c("output-panel"),a=c("output-panel-cmd"),r=c("output-panel-content");!n||!a||!r||(a.textContent=e,r.textContent=t,n.classList.add("open"))}function Zt(){var e;(e=c("output-panel"))==null||e.classList.remove("open")}function v(e,t,n){const a=c("toast-container");if(!a)return;const r=document.createElement("div");r.className=`toast toast-${e}`,r.innerHTML=`<strong>${Ot(t)}</strong><div>${Ot(n)}</div>`,a.append(r);const i=e==="error"?9e3:5e3;window.requestAnimationFrame(()=>{r.classList.add("show")}),window.setTimeout(()=>{r.classList.remove("show"),window.setTimeout(()=>{r.remove()},300)},i)}function P(e,t,n="Unexpected dashboard error"){const a=t instanceof Error?t.message:n;oe("ui",e,{error:t,fallbackMessage:n,message:a}),v("error",e,a)}function ba(){var e,t;document.addEventListener("click",n=>{const a=n.target,r=a==null?void 0:a.closest(".collapse-btn");if(r){const p=r.closest(".panel");p==null||p.classList.toggle("collapsed");return}const i=a==null?void 0:a.closest(".expand-btn");if(!i)return;const o=i.closest(".panel");if(!o)return;const l=o.classList.contains("expanded"),d=!!document.querySelector(".panel.expanded");if(document.querySelectorAll(".panel.expanded").forEach(p=>{p.classList.remove("expanded");const f=p.querySelector(".expand-btn");f&&(f.textContent="Expand")}),l){j();return}o.classList.add("expanded"),i.textContent="✕ Close",d||F()}),document.addEventListener("keydown",n=>{if(n.key!=="Escape")return;const a=document.querySelector(".panel.expanded");if(a){a.classList.remove("expanded");const r=a.querySelector(".expand-btn");r&&(r.textContent="Expand"),j()}}),(e=c("output-close-btn"))==null||e.addEventListener("click",()=>Zt()),(t=c("output-copy-btn"))==null||t.addEventListener("click",async()=>{var a;const n=((a=c("output-panel-content"))==null?void 0:a.textContent)??"";try{await navigator.clipboard.writeText(n),v("success","Copied","Output copied to clipboard")}catch{v("error","Copy failed","Clipboard write was rejected")}})}function Ot(e){const t=document.createElement("div");return t.textContent=e,t.innerHTML}function en(e){return typeof e=="object"&&e!==null}function tn(e){return en(e)&&typeof e.timestamp=="string"}function nn(e){return en(e)&&typeof e.actor=="string"&&typeof e.seq=="number"&&typeof e.ts=="string"&&typeof e.type=="string"}function ha(e){return nn(e)}function va(e){return nn(e)&&typeof e.city=="string"}const qt=[1e3,2e3,4e3,8e3,15e3],wa=15e3;function an(e){return e<qt.length?qt[e]:wa}function Sa(e,t){var a;const n=new AbortController;return(a=t==null?void 0:t.onStatus)==null||a.call(t,"connecting"),(async()=>{var o;let r=0,i=!1;for(;!n.signal.aborted;){try{const{stream:d}=await ma({client:le,signal:n.signal,onSseEvent:p=>{var u;r=0,i=!1,(u=t==null?void 0:t.onStatus)==null||u.call(t,"live");const f=p.event??"tagged_event";if(f==="heartbeat"){if(!tn(p.data)){P("Invalid supervisor heartbeat frame",p);return}e({event:"heartbeat",id:p.id,data:p.data});return}if(f==="tagged_event"){if(!va(p.data)){P("Invalid supervisor event frame",p);return}e({event:"tagged_event",id:p.id,data:p.data});return}P(`Unexpected supervisor SSE event: ${f}`,p)}});for await(const p of d);if(n.signal.aborted)break}catch(d){if(n.signal.aborted)return;i||(P("Supervisor event stream failed",d),i=!0)}(o=t==null?void 0:t.onStatus)==null||o.call(t,"reconnecting");const l=an(r);r+=1,await sn(l,n.signal)}})(),{close:()=>n.abort()}}function Ea(e,t,n){var r;const a=new AbortController;return(r=n==null?void 0:n.onStatus)==null||r.call(n,"connecting"),(async()=>{var l;let i=0,o=!1;for(;!a.signal.aborted;){try{const{stream:p}=await pa({client:le,path:{cityName:e},signal:a.signal,onSseEvent:f=>{var m;i=0,o=!1,(m=n==null?void 0:n.onStatus)==null||m.call(n,"live");const u=f.event??"event",y=f.id!==void 0?String(f.id):void 0;if(u==="heartbeat"){if(!tn(f.data)){P("Invalid city heartbeat frame",f);return}t({event:"heartbeat",id:y,data:f.data});return}if(u==="event"){if(!ha(f.data)){P("Invalid city event frame",f);return}t({event:"event",id:y,data:f.data});return}P(`Unexpected city SSE event: ${u}`,f)}});for await(const f of p);if(a.signal.aborted)break}catch(p){if(a.signal.aborted)return;o||(P("City event stream failed",p),o=!0)}(l=n==null?void 0:n.onStatus)==null||l.call(n,"reconnecting");const d=an(i);i+=1,await sn(d,a.signal)}})(),{close:()=>a.abort()}}async function sn(e,t){if(!t.aborted)return new Promise(n=>{const a=setTimeout(()=>{t.removeEventListener("abort",r),n()},e),r=()=>{clearTimeout(a),t.removeEventListener("abort",r),n()};t.addEventListener("abort",r)})}function Ca(e,t,n){const a=new AbortController;return(async()=>{try{const{stream:r}=await ya({client:le,path:{cityName:e,id:t},signal:a.signal,onSseEvent:i=>{if(i.data===void 0){P("Session frame missing data",i);return}n({id:i.id!==void 0?String(i.id):void 0,type:i.event??"message",data:i.data})}});for await(const i of r);}catch(r){a.signal.aborted||P("Session stream failed",r)}})(),{close:()=>a.abort()}}function ka(e){return e.event==="heartbeat"?"heartbeat":e.data.type}let Te=null,ge="",X="",Pe=0;async function Na(){const e=S();if(!e){$a();return}const t=c("crew-loading"),n=c("crew-table"),a=c("crew-empty"),r=c("crew-tbody"),i=c("rigged-body"),o=c("pooled-body");if(!t||!n||!a||!r||!i||!o)return;it("No crew configured"),t.style.display="block",n.style.display="none",a.style.display="none",k(r);const{data:l,error:d}=await g.GET("/v0/city/{cityName}/sessions",{params:{path:{cityName:e},query:{state:"active",peek:!0}}});if(d||!(l!=null&&l.items)){t.textContent="Failed to load crew",ve(i,"No rigged agents"),ve(o,"No pooled agents");return}const p=l.items,f=await Promise.all(p.map(async m=>{var w;return!!((w=(await g.GET("/v0/city/{cityName}/session/{id}/pending",{params:{path:{cityName:e,id:m.id}}})).data)!=null&&w.pending)})),u=new Map;await Promise.all(p.map(async m=>{var w;if(!m.active_bead||u.has(m.active_bead))return;const h=await g.GET("/v0/city/{cityName}/bead/{id}",{params:{path:{cityName:e,id:m.active_bead}}});u.set(m.active_bead,(w=h.data)!=null&&w.id?h.data.title??h.data.id:m.active_bead)}));const y=p;y.forEach((m,h)=>{const w=La(m,f[h]??!1),E=m.active_bead?Qe(u.get(m.active_bead)??m.active_bead,24):"—",b=s("tr",{},[s("td",{},[m.template]),s("td",{},[m.rig??"city"]),s("td",{},[s("span",{class:`badge ${ce(w)}`},[w])]),s("td",{},[E]),s("td",{class:_e(m.last_active).colorClass?`activity-${_e(m.last_active).colorClass}`:""},[s("span",{class:"activity-dot"}),` ${_e(m.last_active).display}`]),s("td",{},[s("span",{class:`badge ${m.attached?"badge-green":"badge-muted"}`},[m.attached?"Attached":"Detached"])]),s("td",{},[xa(m.template)," ",rn(m.id,m.template)])]);r.append(b)}),c("crew-count").textContent=String(y.length),t.style.display="none",y.length>0?n.style.display="table":(it("No crew configured"),a.style.display="block"),Ta(p,u),Aa(p)}function $a(){const e=c("crew-loading"),t=c("crew-table"),n=c("crew-empty"),a=c("crew-tbody"),r=c("rigged-body"),i=c("pooled-body");!e||!t||!n||!a||!r||!i||(je(),c("crew-count").textContent="0",c("rigged-count").textContent="0",c("pooled-count").textContent="0",e.style.display="none",t.style.display="none",n.style.display="block",it("Select a city to view crew"),k(a),ve(r,"Select a city to view rigged agents"),ve(i,"Select a city to view pooled agents"))}function it(e){var t,n;(n=(t=c("crew-empty"))==null?void 0:t.querySelector("p"))==null||n.replaceChildren(document.createTextNode(e))}function La(e,t){return t?"questions":e.active_bead?"spinning":e.running?"idle":"finished"}function xa(e){const t=s("button",{class:"attach-btn",type:"button"},["📎 Attach"]);return t.addEventListener("click",async()=>{const n=`gc agent attach ${e}`;try{await navigator.clipboard.writeText(n),v("success","Attach command copied",n)}catch{v("error","Copy failed",n)}}),t}function rn(e,t){const n=s("button",{class:"agent-log-link",type:"button","data-session-id":e},[t]);return n.addEventListener("click",()=>{Oa(e,t)}),n}function Ta(e,t){const n=c("rigged-body"),a=c("rigged-count");if(!n||!a)return;const r=e.filter(o=>o.rig&&o.pool);if(a.textContent=String(r.length),r.length===0){ve(n,"No rigged agents");return}const i=s("tbody");r.forEach(o=>{const l=_e(o.last_active),d=o.active_bead?l.colorClass==="red"?"Stuck":l.colorClass==="yellow"?"Stale":"Working":"Idle";i.append(s("tr",{class:`rigged-${d.toLowerCase()}`},[s("td",{},[rn(o.id,o.template)]),s("td",{},[s("span",{class:"badge badge-muted"},[o.pool??"pool"])]),s("td",{},[o.rig??"city"]),s("td",{class:"rigged-issue"},[o.active_bead?`${o.active_bead} ${t.get(o.active_bead)??""}`.trim():"—"]),s("td",{},[s("span",{class:`badge ${ce(d)}`},[d])]),s("td",{class:`activity-${l.colorClass}`},[s("span",{class:"activity-dot"}),` ${l.display}`])]))}),k(n),n.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Agent"]),s("th",{},["Pool"]),s("th",{},["Rig"]),s("th",{},["Working On"]),s("th",{},["Status"]),s("th",{},["Activity"])])]),i]))}function Aa(e){const t=c("pooled-body"),n=c("pooled-count");if(!t||!n)return;const a=e.filter(i=>!i.rig&&i.pool);if(n.textContent=String(a.length),a.length===0){ve(t,"No pooled agents");return}const r=s("tbody");a.forEach(i=>{r.append(s("tr",{},[s("td",{},[i.template]),s("td",{},[s("span",{class:`badge ${i.active_bead?"badge-yellow":"badge-green"}`},[i.active_bead?"Working":"Idle"])]),s("td",{class:"status-hint"},[Qe(i.last_output,80)||"—"]),s("td",{},[D(i.last_active)])]))}),k(t),t.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Agent"]),s("th",{},["State"]),s("th",{},["Work"]),s("th",{},["Activity"])])]),r]))}function ve(e,t){k(e),e.append(s("div",{class:"empty-state"},[s("p",{},[t])]))}function Ra(){var e,t;(e=c("log-drawer-close-btn"))==null||e.addEventListener("click",()=>je()),(t=c("log-drawer-older-btn"))==null||t.addEventListener("click",()=>{he("crew","Load older transcript clicked",{hasCursor:X!=="",sessionID:ge}),!(!ge||!X)&&cn(ge,!0)})}async function Oa(e,t){const n=c("agent-log-drawer"),a=c("log-drawer-agent-name"),r=c("log-drawer-messages"),i=c("log-drawer-loading");if(!n||!a||!r||!i)return;if(ge===e&&n.style.display!=="none"){je();return}je(),ge=e,X="",Pe=0,a.textContent=t,k(r),r.append(i),i.style.display="block",n.style.display="block",F(),await cn(e,!1);const o=S();o&&(Te=Ca(o,e,l=>qa(l)))}function je(){Te==null||Te.close(),Te=null,ge="",X="";const e=c("agent-log-drawer");e&&e.style.display!=="none"&&(e.style.display="none",j())}function on(){je()}async function cn(e,t){var p,f,u,y,m;const n=S(),a=c("log-drawer-messages"),r=c("log-drawer-loading"),i=c("log-drawer-older-btn"),o=c("log-drawer-count");if(!n||!a||!r||!i||!o)return;r.style.display="block";const l=await g.GET("/v0/city/{cityName}/session/{id}/transcript",{params:{path:{cityName:n,id:e},query:{tail:String(t?50:25),before:t?X:void 0}}});if(r.style.display="none",l.error||!l.data){v("error","Transcript failed",((p=l.error)==null?void 0:p.detail)??"Could not load transcript");return}const d=document.createDocumentFragment();for(const h of l.data.turns??[])d.append(ln(h.role,h.text,h.timestamp)),Pe+=1;t?a.prepend(d):(k(a),a.append(d)),a.append(r),r.style.display="none",o.textContent=String(Pe),X=((f=l.data.pagination)==null?void 0:f.truncated_before_message)??"",i.style.display=(u=l.data.pagination)!=null&&u.has_older_messages&&X?"inline-flex":"none",he("crew","Transcript loaded",{hasOlderMessages:((y=l.data.pagination)==null?void 0:y.has_older_messages)??!1,nextBeforeCursor:X,prepend:t,sessionID:e,turnCount:((m=l.data.turns)==null?void 0:m.length)??0})}function qa(e){var r;const t=c("log-drawer-messages");if(!t)return;const n=e.data;if(e.type!=="message"||!((r=n==null?void 0:n.data)!=null&&r.message))return;t.append(ln(n.data.message.role??"agent",n.data.message.text??"",n.data.message.timestamp)),Pe+=1,c("log-drawer-count").textContent=String(Pe);const a=c("log-drawer-body");a&&(a.scrollTop=a.scrollHeight)}function ln(e,t,n){return s("div",{class:"log-msg"},[s("div",{class:"log-msg-header"},[s("span",{class:`log-msg-type log-msg-type-${_a(e)}`},[e]),s("span",{class:"log-msg-time"},[D(n)])]),s("div",{class:"log-msg-body"},[t])])}function _a(e){switch((e??"").toLowerCase()){case"assistant":case"agent":return"assistant";case"system":return"system";case"result":return"result";default:return"user"}}const Pa=3e4,ot=new Map,Ae=new Map;async function Xe(e=!1){const t=S(),n=Date.now(),a=ot.get(t);if(!e&&a&&n-a.fetchedAt<Pa)return a;const r=Ae.get(t);if(r)return r;const i=ja(t).then(o=>(ot.set(t,o),Ae.delete(t),o)).catch(o=>{throw Ae.delete(t),o});return Ae.set(t,i),i}async function ja(e){var l,d,p,f,u,y,m,h,w,E,b,C;const t={agents:[],rigs:[],sessions:[],beads:[],mail:[],fetchedAt:Date.now()};if(!e)return t;const[n,a,r,i]=await Promise.all([g.GET("/v0/city/{cityName}/config",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/rigs",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"open"}}}),g.GET("/v0/city/{cityName}/mail",{params:{path:{cityName:e}}})]);n.error&&Ve("options","Config options request failed",{city:e,detail:n.error.detail??null});const o=(((l=n.data)==null?void 0:l.agents)??[]).map(N=>({id:N.name??"",label:N.name??"",recipient:N.name??""})).filter(N=>N.recipient!=="");return he("options","Fetched options",{agentOptions:o.map(N=>N.recipient),beads:((p=(d=r.data)==null?void 0:d.items)==null?void 0:p.length)??0,city:e,configAgents:((u=(f=n.data)==null?void 0:f.agents)==null?void 0:u.length)??0,mail:((m=(y=i.data)==null?void 0:y.items)==null?void 0:m.length)??0,rigs:((w=(h=a.data)==null?void 0:h.items)==null?void 0:w.length)??0}),{agents:[...new Set(o.map(N=>N.recipient))].sort(),rigs:(((E=a.data)==null?void 0:E.items)??[]).map(N=>N.name??"").filter(Boolean),sessions:o,beads:(((b=r.data)==null?void 0:b.items)??[]).map(N=>({id:N.id??"",title:N.title??""})),mail:(((C=i.data)==null?void 0:C.items)??[]).map(N=>({id:N.id??"",subject:N.subject??""})),fetchedAt:Date.now()}}function Ia(){ot.clear(),Ae.clear()}let Re=null,Oe=null;function Ba(){var e,t,n,a,r,i,o,l,d,p;(e=c("action-modal-close-btn"))==null||e.addEventListener("click",()=>Ne(null)),(t=c("action-modal-cancel-btn"))==null||t.addEventListener("click",()=>Ne(null)),(a=(n=c("action-modal"))==null?void 0:n.querySelector(".modal-backdrop"))==null||a.addEventListener("click",()=>Ne(null)),(r=c("action-form"))==null||r.addEventListener("submit",f=>{var h,w,E;f.preventDefault();const u=((h=c("action-bead-id"))==null?void 0:h.value.trim())??"",y=((w=c("action-target"))==null?void 0:w.value.trim())??"",m=((E=c("action-rig"))==null?void 0:E.value.trim())??"";!u||!y||Ne({beadID:u,rig:m,target:y})}),(i=c("confirm-modal-close-btn"))==null||i.addEventListener("click",()=>$e(!1)),(o=c("confirm-modal-cancel-btn"))==null||o.addEventListener("click",()=>$e(!1)),(l=c("confirm-modal-confirm-btn"))==null||l.addEventListener("click",()=>$e(!0)),(p=(d=c("confirm-modal"))==null?void 0:d.querySelector(".modal-backdrop"))==null||p.addEventListener("click",()=>$e(!1)),document.addEventListener("keydown",f=>{if(f.key==="Escape"){if(we("action-modal")){Ne(null);return}we("confirm-modal")&&$e(!1)}})}async function ht(e){const t=c("action-modal"),n=c("action-form"),a=c("action-modal-title"),r=c("action-modal-submit-btn"),i=c("action-bead-group"),o=c("action-bead-id"),l=c("action-bead-hint"),d=c("action-target"),p=c("action-target-label"),f=c("action-rig-group"),u=c("action-rig"),y=c("action-modal-help"),m=c("action-target-list"),h=c("action-rig-list");if(!t||!n||!a||!r||!i||!o||!l||!d||!p||!f||!u||!y||!m||!h)return P("Action modal unavailable",new Error("missing action modal DOM")),null;const w=await Xe();return _t(m,w.agents),_t(h,w.rigs),a.textContent=e.title,r.textContent=Ua(e.mode),p.textContent=e.mode==="reassign"?"Assignee":"Target agent or pool",y.textContent=Da(e.mode),o.value=e.beadID??"",o.readOnly=!!e.beadID,i.classList.toggle("readonly",o.readOnly),l.textContent=e.beadLabel??"",d.value=e.initialTarget??"",u.value=e.initialRig??"",f.hidden=e.mode==="reassign",u.disabled=e.mode==="reassign",we("action-modal")||F(),t.style.display="flex",window.setTimeout(()=>{if(e.beadID){d.focus();return}o.focus()},0),new Promise(E=>{Re=E})}async function Ma(e){const t=c("confirm-modal"),n=c("confirm-modal-title"),a=c("confirm-modal-body"),r=c("confirm-modal-confirm-btn");return!t||!n||!a||!r?(P("Confirm modal unavailable",new Error("missing confirm modal DOM")),!1):(n.textContent=e.title,a.textContent=e.body,r.textContent=e.confirmLabel,we("confirm-modal")||F(),t.style.display="flex",new Promise(i=>{Oe=i}))}function _t(e,t){k(e),t.forEach(n=>{e.append(s("option",{value:n}))})}function Ua(e){switch(e){case"assign":return"Assign";case"reassign":return"Reassign";default:return"Sling"}}function Da(e){switch(e){case"assign":return"Launch a bead directly to a target, with an optional rig override.";case"reassign":return"Pick a new assignee from the active city sessions or type one manually.";default:return"Dispatch this bead to a target, with an optional rig constraint."}}function Ne(e){const t=c("action-modal"),n=c("action-form");if(!t||!n)return;const a=we("action-modal");t.style.display="none",n.reset(),c("action-rig").disabled=!1,c("action-bead-id").readOnly=!1,a&&j(),Re==null||Re(e),Re=null}function $e(e){const t=c("confirm-modal");if(!t)return;const n=we("confirm-modal");t.style.display="none",n&&j(),Oe==null||Oe(e),Oe=null}function we(e){var t;return((t=c(e))==null?void 0:t.style.display)==="flex"}let Fe=[],ct="ready",Se="all",Ye="";async function de(){var o,l,d,p;const e=S(),t=c("issues-list");if(!t)return;if(!e){za();return}const[n,a,r]=await Promise.all([g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"open",limit:500}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"in_progress",limit:500}}}),Xe(!0)]);if(n.error&&a.error||!((o=n.data)!=null&&o.items)&&!((l=a.data)!=null&&l.items)){k(t),t.append(s("div",{class:"panel-error"},["Could not load beads."]));return}Fe=[...((d=n.data)==null?void 0:d.items)??[],...((p=a.data)==null?void 0:p.items)??[]].filter(f=>!Wa(f)).sort((f,u)=>{const y=ee(f.priority),m=ee(u.priority);return y!==m?y-m:(u.created_at??"").localeCompare(f.created_at??"")}),c("issues-count").textContent=String(Fe.length);const i=c("rig-filter-tabs");i&&(k(i),i.append(lt("all",Se==="all")),r.rigs.forEach(f=>i.append(lt(f,Se===f)))),vt()}function za(){const e=c("issues-list"),t=c("rig-filter-tabs"),n=c("issue-detail");if(!e||!t||!n)return;me();const a=n.style.display==="block";n.style.display="none",e.style.display="block",k(e),e.append(s("div",{class:"empty-state"},[s("p",{},["Select a city to view beads"])])),k(t),Se="all",Ye="",Fe=[],t.append(lt("all",!0)),c("issues-count").textContent="0",a&&j()}function vt(){const e=c("issues-list");if(!e)return;k(e);const t=Fe.filter(a=>{const r=a.assignee?"progress":"ready",i=ct==="all"||ct===r,o=Se==="all"||nt(a)===Se;return i&&o});if(t.length===0){e.append(s("div",{class:"empty-state"},[s("p",{},["No beads"])]));return}const n=s("tbody");t.forEach(a=>{const r=s("tr",{class:`issue-row priority-${ee(a.priority)}`,"data-issue-id":a.id??"","data-status":a.assignee?"progress":"ready","data-rig":nt(a)},[s("td",{},[s("span",{class:`badge ${Xt(a.priority)}`},[`P${ee(a.priority)}`])]),s("td",{},[s("span",{class:"issue-id"},[a.id??""])]),s("td",{class:"issue-title"},[Qe(a.title??a.id??"",80)]),s("td",{class:"issue-rig"},[nt(a)]),s("td",{class:"issue-status"},[a.assignee?s("span",{class:"badge badge-blue",title:a.assignee},[a.assignee]):s("span",{class:"badge badge-green"},["Ready"])]),s("td",{class:"issue-age"},[D(a.created_at)]),s("td",{},[ts(a.id??"")])]);r.addEventListener("click",i=>{i.target.closest(".sling-btn")||a.id&&ue(a.id)}),n.append(r)}),e.append(s("table",{id:"work-table"},[s("thead",{},[s("tr",{},[s("th",{},["Pri"]),s("th",{},["ID"]),s("th",{},["Title"]),s("th",{},["Rig"]),s("th",{},["Status"]),s("th",{},["Age"]),s("th",{},["Actions"])])]),n]))}function lt(e,t){const n=s("button",{class:`rig-btn${t?" active":""}`,"data-rig":e},[e==="all"?"All":e]);return n.addEventListener("click",()=>{Se=e,document.querySelectorAll(".rig-btn").forEach(a=>a.classList.remove("active")),n.classList.add("active"),vt()}),n}function nt(e){var t;return((t=e.id)==null?void 0:t.split("-")[0])??"city"}function Wa(e){return(e.issue_type??"").toLowerCase()==="convoy"?!0:(e.labels??[]).some(t=>t.startsWith("gc:queue")||t.startsWith("gc:message"))}function Ga(){var e,t,n,a,r,i,o;document.querySelectorAll(".tab-btn").forEach(l=>{l.addEventListener("click",d=>{const p=d.currentTarget;ct=p.dataset.tab??"ready",document.querySelectorAll(".tab-btn").forEach(f=>f.classList.remove("active")),p.classList.add("active"),vt()})}),(e=c("new-issue-btn"))==null||e.addEventListener("click",()=>dn()),(t=c("issue-modal-close-btn"))==null||t.addEventListener("click",()=>me()),(n=c("issue-modal-cancel-btn"))==null||n.addEventListener("click",()=>me()),(r=(a=c("issue-modal"))==null?void 0:a.querySelector(".modal-backdrop"))==null||r.addEventListener("click",()=>me()),(i=c("issue-form"))==null||i.addEventListener("submit",l=>{l.preventDefault(),Fa()}),(o=c("issue-back-btn"))==null||o.addEventListener("click",()=>Qa()),document.addEventListener("keydown",l=>{var d;l.key==="Escape"&&((d=c("issue-modal"))==null?void 0:d.style.display)==="block"&&me()})}function dn(){var t,n,a;if(!S()){v("info","No city selected","Select a city to create a bead");return}const e=c("issue-modal");e&&(e.style.display!=="block"&&F(),e.style.display="block",(n=(t=c("issues-panel"))==null?void 0:t.scrollIntoView)==null||n.call(t,{behavior:"smooth",block:"center"}),(a=c("issue-title"))==null||a.focus())}function me(){var n;const e=c("issue-modal");if(!e)return;const t=e.style.display==="block";e.style.display="none",(n=c("issue-form"))==null||n.reset(),t&&j()}async function Fa(){var r,i,o;const e=((r=c("issue-title"))==null?void 0:r.value.trim())??"",t=((i=c("issue-description"))==null?void 0:i.value.trim())??"",n=Number(((o=c("issue-priority"))==null?void 0:o.value)??"2");if(!e)return;const a=await ns({title:e,description:t,priority:n});if(!a.ok){v("error","Create failed",a.error??"Could not create issue");return}v("success","Issue created",e),me(),await de()}async function ue(e){var l,d,p;const t=S();if(!t)return;Ye=e,((l=c("issue-detail"))==null?void 0:l.style.display)!=="block"&&F(),c("issues-list").style.display="none",c("issue-detail").style.display="block";const[n,a,r]=await Promise.all([g.GET("/v0/city/{cityName}/bead/{id}",{params:{path:{cityName:t,id:e}}}),g.GET("/v0/city/{cityName}/bead/{id}/deps",{params:{path:{cityName:t,id:e}}}),Xe()]);if(n.error||!n.data){v("error","Issue failed",((d=n.error)==null?void 0:d.detail)??"Could not load bead");return}const i=n.data;c("issue-detail-id").textContent=i.id??e,c("issue-detail-title-text").textContent=i.title??e,c("issue-detail-description").textContent=i.description||"(no description)";const o=c("issue-detail-priority");o.className=`badge ${Xt(i.priority)}`,o.textContent=`P${ee(i.priority)}`,c("issue-detail-status").textContent=i.status??"open",c("issue-detail-status").className=`issue-status ${i.status??"open"}`,c("issue-detail-type").textContent=i.issue_type?`Type: ${i.issue_type}`:"",c("issue-detail-owner").textContent=i.assignee?`Owner: ${i.assignee}`:"Owner: unassigned",c("issue-detail-created").textContent=i.created_at?`Created: ${D(i.created_at)}`:"",Ja(i,r.agents),Ha(((p=a.data)==null?void 0:p.children)??[])}function Ha(e){const t=c("issue-detail-deps"),n=c("issue-detail-depends-on"),a=c("issue-detail-blocks-section"),r=c("issue-detail-blocks");if(!(!t||!n||!a||!r)){if(k(n),k(r),e.length===0){t.style.display="none",a.style.display="none";return}t.style.display="block",e.forEach(i=>{const o=s("span",{class:"issue-dep-item","data-issue-id":i.id??""},[`→ ${i.id??""}`]);o.addEventListener("click",()=>{i.id&&ue(i.id)}),n.append(o)}),a.style.display="none"}}function Ja(e,t){const n=c("issue-detail-actions");if(!n||!e.id)return;k(n);const a=s("div",{class:"issue-actions-bar"}),r=e.status==="closed"?at("↺ Reopen","reopen",()=>void Ya(e.id)):at("✓ Close","close",()=>void Xa(e.id));a.append(r),e.status!=="closed"&&a.append(at("🚚 Sling","sling",()=>void un(e.id)));const i=s("div",{class:"issue-action-group"},[s("label",{class:"issue-action-label"},["Priority"]),Va(e.id,e.priority)]),o=s("div",{class:"issue-action-group"},[s("label",{class:"issue-action-label"},["Assign"]),Ka(e.id,e.assignee,t)]);n.append(a,i,o)}function at(e,t,n){const a=s("button",{class:`issue-action-btn ${t}`,type:"button"},[e]);return a.addEventListener("click",n),a}function Va(e,t){const n=s("select",{class:"issue-action-select",id:"issue-action-priority"});return[1,2,3,4].forEach(a=>{const r=s("option",{value:a,selected:ee(t)===a},[`P${a}`]);n.append(r)}),n.addEventListener("change",()=>{Za(e,Number(n.value))}),n}function Ka(e,t,n){const a=s("select",{class:"issue-action-select",id:"issue-action-assignee"});return a.append(s("option",{value:""},["Unassigned"])),n.forEach(r=>{a.append(s("option",{value:r,selected:t===r},[r]))}),a.addEventListener("change",()=>{es(e,a.value)}),a}function Qa(){const e=c("issue-detail"),t=(e==null?void 0:e.style.display)==="block";e.style.display="none",c("issues-list").style.display="block",Ye="",t&&j()}async function Xa(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/close",{params:{path:{cityName:t,id:e},header:T}});if(n.error){v("error","Close failed",n.error.detail??"Could not close issue");return}v("success","Closed",e),await de(),await ue(e)}async function Ya(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/reopen",{params:{path:{cityName:t,id:e},header:T}});if(n.error){v("error","Reopen failed",n.error.detail??"Could not reopen issue");return}v("success","Reopened",e),await de(),await ue(e)}async function Za(e,t){const n=S();if(!n)return;const a=await g.POST("/v0/city/{cityName}/bead/{id}/update",{params:{path:{cityName:n,id:e},header:T},body:{priority:t}});if(a.error){v("error","Priority failed",a.error.detail??"Could not update priority");return}v("success","Priority updated",`${e} → P${t}`),await de(),await ue(e)}async function es(e,t){const n=S();if(!n)return;const a=await g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:n,id:e},header:T},body:{assignee:t}});if(a.error){v("error","Assign failed",a.error.detail??"Could not update assignee");return}v("success","Assignment updated",t||"Unassigned"),await de(),await ue(e)}async function un(e){const t=S();if(!t)return;const n=await ht({beadID:e,beadLabel:e,mode:"sling",title:"Sling Bead"});if(!n)return;const a=await g.POST("/v0/city/{cityName}/sling",{params:{path:{cityName:t},header:T},body:{bead:e,target:n.target,rig:n.rig||void 0}});if(a.error){v("error","Sling failed",a.error.detail??"Could not sling issue");return}v("success","Work assigned",`${e} → ${n.target}`),await de(),Ye===e&&await ue(e)}function ts(e){const t=s("button",{class:"sling-btn",type:"button","data-bead-id":e},["Sling"]);return t.addEventListener("click",n=>{n.stopPropagation(),un(e)}),t}async function ns(e){const t=S();if(!t)return{ok:!1,error:"no city selected"};const{error:n}=await g.POST("/v0/city/{cityName}/beads",{params:{path:{cityName:t},header:T},body:{title:e.title,description:e.description,rig:e.rig,priority:e.priority,assignee:e.assignee}});return n?{ok:!1,error:n.detail??n.title??"create failed"}:{ok:!0}}let U="inbox",qe=[],L=null;async function Ue(){const e=S(),t=c("mail-loading"),n=c("mail-threads"),a=c("mail-empty"),r=c("mail-all");if(!t||!n||!a||!r)return;if(!e){as();return}wt("No mail in inbox"),t.style.display="block",n.style.display="none",a.style.display="none";const{data:i,error:o}=await g.GET("/v0/city/{cityName}/mail",{params:{path:{cityName:e},query:{status:"all",limit:200}}});if(t.style.display="none",o||!(i!=null&&i.items)){k(n),n.append(s("div",{class:"panel-error"},["Could not load mail."])),n.style.display="block";return}qe=[...i.items].sort((l,d)=>(d.created_at??"").localeCompare(l.created_at??"")),c("mail-count").textContent=String(qe.length),ss(qe),rs(qe),cs()}function as(){const e=c("mail-loading"),t=c("mail-threads"),n=c("mail-empty"),a=c("mail-all");if(!e||!t||!n||!a)return;ie()?(z(U),j()):z(U),L=null,qe=[],c("mail-count").textContent="0",e.style.display="none",k(t),k(a),t.style.display="none",wt("Select a city to view mail"),n.style.display=U==="inbox"?"block":"none",a.append(s("div",{class:"empty-state"},[s("p",{},["Select a city to view mail traffic"])]))}function wt(e){var t,n;(n=(t=c("mail-empty"))==null?void 0:t.querySelector("p"))==null||n.replaceChildren(document.createTextNode(e))}function ss(e){const t=c("mail-threads"),n=c("mail-empty");if(!t||!n)return;const a=ms(e);if(k(t),a.length===0){t.style.display="none",wt("No mail in inbox"),n.style.display="block";return}n.style.display="none",a.forEach(r=>{const i=r.messages[r.messages.length-1],o=(i.body??"").trim().slice(0,60),l=s("div",{class:`mail-thread${r.unreadCount>0?" mail-thread-unread":""}`},[s("div",{class:"mail-thread-header"},[s("div",{class:"mail-thread-left"},[s("span",{class:"mail-from"},[B(i.from)])]),s("div",{class:"mail-thread-center"},[s("span",{class:"mail-subject"},[r.subject||"(no subject)"]),o?s("span",{class:"mail-thread-preview"},[` — ${o}`]):null]),s("div",{class:"mail-thread-right"},[s("span",{class:"mail-time"},[gt(i.created_at)]),r.unreadCount>0?s("span",{class:"badge badge-unread"},[`${r.unreadCount} unread`]):null])])]);l.addEventListener("click",()=>{is(r.id)}),t.append(l)}),t.style.display=U==="inbox"?"block":"none"}function rs(e){const t=c("mail-all");if(!t)return;if(k(t),e.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No mail traffic"])]));return}const n=s("tbody");e.forEach(a=>{const r=s("tr",{class:`mail-row${a.read?"":" mail-unread"}`},[s("td",{class:"mail-from"},[B(a.from)]),s("td",{class:"mail-to"},[B(a.to)]),s("td",{},[s("span",{class:"mail-subject"},[a.subject??"(no subject)"])]),s("td",{class:"mail-time"},[D(a.created_at)])]);r.addEventListener("click",()=>{a.id&&os(a.id)}),n.append(r)}),t.append(s("table",{class:"mail-all-table"},[s("thead",{},[s("tr",{},[s("th",{},["From"]),s("th",{},["To"]),s("th",{},["Subject"]),s("th",{},["Time"])])]),n])),t.style.display=U==="all"?"block":"none"}async function is(e){var i,o;const t=S();if(!t)return;const n=await g.GET("/v0/city/{cityName}/mail/thread/{id}",{params:{path:{cityName:t,id:e}}});if(n.error||!((i=n.data)!=null&&i.items)||n.data.items.length===0){v("error","Thread failed",((o=n.error)==null?void 0:o.detail)??"Could not load mail thread");return}const a=n.data.items,r=a[a.length-1]??a[0];L=r,fn(r,a)}async function os(e){var a;const t=S();if(!t)return;const n=await g.GET("/v0/city/{cityName}/mail/{id}",{params:{path:{cityName:t,id:e}}});if(n.error||!n.data){v("error","Message failed",((a=n.error)==null?void 0:a.detail)??"Could not load message");return}L=n.data,await g.POST("/v0/city/{cityName}/mail/{id}/read",{params:{path:{cityName:t,id:e},header:T}}),L.read=!0,fn(L,[L]),Ue()}function fn(e,t){const n=ie();c("mail-detail-subject").textContent=e.subject??"(no subject)",c("mail-detail-from").textContent=B(e.from),c("mail-detail-time").textContent=D(e.created_at);const a=c("mail-detail-body");a&&(k(a),t.forEach((r,i)=>{i>0&&a.append(s("hr")),a.append(s("div",{class:"mail-thread-msg-header"},[s("span",{class:"mail-from"},[B(r.from)]),s("span",{class:"mail-time"},[D(r.created_at)])]),s("div",{class:"mail-thread-msg-subject"},[r.subject??"(no subject)"]),s("pre",{},[r.body??""]))})),pn(),z("detail"),yn("mail-detail"),n||F()}function z(e){const t=c("mail-list"),n=c("mail-all"),a=c("mail-detail"),r=c("mail-compose");!t||!n||!a||!r||(t.style.display=e==="inbox"?"block":"none",n.style.display=e==="all"?"block":"none",a.style.display=e==="detail"?"block":"none",r.style.display=e==="compose"?"block":"none")}function cs(){var e,t;((e=c("mail-compose"))==null?void 0:e.style.display)==="block"||((t=c("mail-detail"))==null?void 0:t.style.display)==="block"||z(U)}function ls(){var e,t,n,a,r,i,o,l;document.querySelectorAll(".mail-tab").forEach(d=>{d.addEventListener("click",p=>{const f=p.currentTarget;U=f.dataset.tab??"inbox",document.querySelectorAll(".mail-tab").forEach(u=>u.classList.remove("active")),f.classList.add("active"),z(U)})}),(e=c("mail-back-btn"))==null||e.addEventListener("click",()=>{const d=ie();z(U),L=null,d&&j()}),(t=c("compose-mail-btn"))==null||t.addEventListener("click",()=>{dt()}),(n=c("compose-back-btn"))==null||n.addEventListener("click",()=>{const d=!!L,p=ie();z(d?"detail":U),p&&!d&&j()}),(a=c("compose-cancel-btn"))==null||a.addEventListener("click",()=>{const d=ie();z(U),d&&j()}),(r=c("mail-reply-btn"))==null||r.addEventListener("click",()=>{L!=null&&L.id&&dt(L)}),(i=c("mail-send-btn"))==null||i.addEventListener("click",()=>{ds()}),(o=c("mail-archive-btn"))==null||o.addEventListener("click",()=>{L!=null&&L.id&&us(L.id)}),(l=c("mail-toggle-unread-btn"))==null||l.addEventListener("click",()=>{L!=null&&L.id&&fs(L)})}async function dt(e){if(!S()){v("info","No city selected","Select a city to compose mail"),Ve("mail","Compose blocked without city",{replyTo:(e==null?void 0:e.id)??null});return}const t=c("compose-to");if(!t)return;const n=ie();k(t),t.append(s("option",{value:""},["Select recipient…"]));try{const a=await Xe();a.sessions.forEach(r=>{t.append(s("option",{value:r.recipient},[r.label]))}),J("mail","Compose options loaded",{city:S(),recipients:a.sessions.length,replyTo:(e==null?void 0:e.id)??null})}catch(a){oe("mail","Compose options failed",{city:S(),error:a}),P("Mail options failed",a,"Could not load recipients")}c("compose-subject").value=e?ps(e.subject??""):"",c("compose-body").value="",c("compose-reply-to").value=(e==null?void 0:e.id)??"",c("mail-compose-title").textContent=e?"Reply":"New Message",e!=null&&e.from&&(ys(t,e.from),t.value=e.from),z("compose"),yn("compose-subject"),J("mail","Compose form opened",{city:S(),replyTo:(e==null?void 0:e.id)??null,selectedRecipient:t.value||null}),n||F()}async function ds(){var l,d,p,f;const e=S();if(!e)return;const t=((l=c("compose-to"))==null?void 0:l.value)??"",n=((d=c("compose-subject"))==null?void 0:d.value.trim())??"",a=((p=c("compose-body"))==null?void 0:p.value)??"",r=((f=c("compose-reply-to"))==null?void 0:f.value)??"";if(!t||!n){v("error","Missing fields","Recipient and subject are required"),Ve("mail","Send blocked by missing fields",{bodyLength:a.length,city:e,subject:n,to:t});return}J("mail","Send requested",{bodyLength:a.length,city:e,replyTo:r||null,subject:n,to:t});const i=r?await g.POST("/v0/city/{cityName}/mail/{id}/reply",{params:{path:{cityName:e,id:r},header:T},body:{body:a,subject:n}}):await g.POST("/v0/city/{cityName}/mail",{params:{path:{cityName:e},header:T},body:{to:t,subject:n,body:a,from:"dashboard"}});if(i.error){oe("mail","Send failed",{bodyLength:a.length,city:e,error:i.error,replyTo:r||null,subject:n,to:t}),v("error","Send failed",i.error.detail??"Could not send message");return}J("mail","Send succeeded",{bodyLength:a.length,city:e,replyTo:r||null,subject:n,to:t}),v("success","Message sent",n);const o=ie();z("inbox"),L=null,o&&j(),await Ue()}async function us(e){var r;const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/mail/{id}/archive",{params:{path:{cityName:t,id:e},header:T}});if(n.error){v("error","Archive failed",n.error.detail??"Could not archive message");return}v("success","Archived",e);const a=((r=c("mail-detail"))==null?void 0:r.style.display)==="block";z(U),L=null,a&&j(),await Ue()}async function fs(e){const t=S();if(!t||!e.id)return;const n=e.read?"/v0/city/{cityName}/mail/{id}/mark-unread":"/v0/city/{cityName}/mail/{id}/read",a=await g.POST(n,{params:{path:{cityName:t,id:e.id},header:T}});if(a.error){v("error","Update failed",a.error.detail??"Could not update message");return}e.read=!e.read,L={...e},pn(),v("success","Updated",e.subject??e.id),await Ue()}function pn(){const e=c("mail-toggle-unread-btn");e&&(e.textContent=L!=null&&L.read?"Mark unread":"Mark read")}function ie(){var e,t;return((e=c("mail-detail"))==null?void 0:e.style.display)==="block"||((t=c("mail-compose"))==null?void 0:t.style.display)==="block"}function ps(e){return e?e.toLowerCase().startsWith("re:")?e:`Re: ${e}`:"Re:"}function ys(e,t){!t||[...e.options].some(n=>n.value===t)||e.append(s("option",{value:t},[t]))}function yn(e){var t,n;(n=(t=c("mail-panel"))==null?void 0:t.scrollIntoView)==null||n.call(t,{behavior:"smooth",block:"center"}),window.setTimeout(()=>{var a;(a=c(e))==null||a.focus()},0)}function ms(e){const t=new Map;e.forEach(i=>{i.id&&t.set(i.id,i)});function n(i){let o=i;const l=new Set;for(;o.reply_to&&o.id&&!l.has(o.id);){l.add(o.id);const d=t.get(o.reply_to);if(!d)break;o=d}return o.thread_id??o.id??Math.random().toString(36)}const a=new Map;e.forEach(i=>{const o=n(i),l=a.get(o)??{id:o,messages:[],subject:i.subject??"",unreadCount:0};l.messages.push(i),i.read||(l.unreadCount+=1),!l.subject&&i.subject&&(l.subject=i.subject),a.set(o,l)});const r=[...a.values()];return r.forEach(i=>{i.messages.sort((o,l)=>(o.created_at??"").localeCompare(l.created_at??""))}),r.sort((i,o)=>{var p,f;const l=((p=i.messages[i.messages.length-1])==null?void 0:p.created_at)??"";return(((f=o.messages[o.messages.length-1])==null?void 0:f.created_at)??"").localeCompare(l)}),r}let be="";async function St(){var o;const e=S(),t=c("convoy-list");if(!t)return;if(!e){gs();return}const n=await g.GET("/v0/city/{cityName}/convoys",{params:{path:{cityName:e},query:{limit:200}}});if(n.error||!((o=n.data)!=null&&o.items)){k(t),t.append(s("div",{class:"panel-error"},["Could not load convoys."]));return}const r=(await Promise.all(n.data.items.map(async l=>bs(e,l.id??"")))).filter(l=>l!==null);if(c("convoy-count").textContent=String(r.length),k(t),r.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No active convoys"])]));return}const i=s("tbody");r.forEach(l=>{const d=s("tr",{class:"convoy-row","data-convoy-id":l.id},[s("td",{},[s("span",{class:`badge ${ce(mn(l))}`},[hs(l)])]),s("td",{},[s("span",{class:"convoy-id"},[l.id]),l.title?s("div",{class:"convoy-title"},[l.title]):null,l.assignees.length?s("div",{class:"convoy-assignees"},l.assignees.map(p=>s("span",{class:"assignee-chip"},[p]))):null]),s("td",{class:"convoy-progress-cell"},[s("div",{class:"convoy-progress-header"},[s("span",{class:"convoy-progress-fraction"},[`${l.closed}/${l.total}`]),l.total>0?s("span",{class:"convoy-progress-pct"},[`${l.progressPct}%`]):null]),l.total>0?s("div",{class:"progress-bar"},[s("div",{class:"progress-fill",style:`width: ${l.progressPct}%;`})]):null]),s("td",{class:"convoy-work-cell"},[s("div",{class:"convoy-work-breakdown"},[l.ready>0?s("span",{class:"work-chip work-ready"},[`${l.ready} ready`]):null,l.inProgress>0?s("span",{class:"work-chip work-inprogress"},[`${l.inProgress} active`]):null,l.closed===l.total&&l.total>0?s("span",{class:"work-chip work-done"},["all done"]):null])]),s("td",{class:`activity-${l.lastActivity.colorClass}`},[s("span",{class:"activity-dot"}),` ${l.lastActivity.display}`])]);d.addEventListener("click",()=>{bn(l.id)}),i.append(d)}),t.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Status"]),s("th",{},["Convoy"]),s("th",{},["Progress"]),s("th",{},["Work"]),s("th",{},["Activity"])])]),i]))}function gs(){const e=c("convoy-list"),t=c("convoy-detail"),n=c("convoy-create-form");if(!e||!t||!n)return;const a=t.style.display==="block"||n.style.display==="block";be="",c("convoy-count").textContent="0",t.style.display="none",n.style.display="none",c("convoy-add-issue-form").style.display="none",e.style.display="block",k(e),e.append(s("div",{class:"empty-state"},[s("p",{},["Select a city to view convoys"])])),a&&j()}async function bs(e,t){var f,u,y,m;if(!t)return null;const n=await g.GET("/v0/city/{cityName}/convoy/{id}",{params:{path:{cityName:e,id:t}}});if(n.error||!n.data)return null;const a=n.data.children??[],r=new Set;let i=0,o=0,l="";a.forEach(h=>{(h.status??"").toLowerCase()!=="closed"&&(h.assignee?(o+=1,r.add(h.assignee)):i+=1),l=[l,h.created_at??""].sort().slice(-1)[0]??l});const d=((f=n.data.progress)==null?void 0:f.total)??a.length,p=((u=n.data.progress)==null?void 0:u.closed)??a.filter(h=>h.status==="closed").length;return{id:t,title:((y=n.data.convoy)==null?void 0:y.title)??t,status:(m=n.data.convoy)==null?void 0:m.status,progressPct:d>0?Math.round(p/d*100):0,total:d,closed:p,ready:i,inProgress:o,assignees:[...r].sort(),lastActivity:_e(l)}}function mn(e){return e.total>0&&e.closed===e.total?"done":e.inProgress>0?"active":e.ready>0?"waiting":e.status??"open"}function hs(e){switch(mn(e)){case"done":return"✓ Done";case"active":return"Active";case"waiting":return"Waiting";default:return e.status??"Open"}}function vs(){var e,t,n,a,r,i,o,l;(e=c("new-convoy-btn"))==null||e.addEventListener("click",()=>{gn()}),(t=c("convoy-back-btn"))==null||t.addEventListener("click",()=>ws()),(n=c("convoy-create-back-btn"))==null||n.addEventListener("click",()=>ut()),(a=c("convoy-create-cancel-btn"))==null||a.addEventListener("click",()=>ut()),(r=c("convoy-create-submit-btn"))==null||r.addEventListener("click",()=>{Ss()}),(i=c("convoy-add-issue-btn"))==null||i.addEventListener("click",()=>{c("convoy-add-issue-form").style.display="flex"}),(o=c("convoy-add-issue-cancel"))==null||o.addEventListener("click",()=>{c("convoy-add-issue-form").style.display="none"}),(l=c("convoy-add-issue-submit"))==null||l.addEventListener("click",()=>{Es()})}function gn(){var n;if(!S()){v("info","No city selected","Select a city to create a convoy");return}const e=c("convoy-create-form"),t=(e==null?void 0:e.style.display)==="block";be="",c("convoy-list").style.display="none",c("convoy-detail").style.display="none",e.style.display="block",c("convoy-create-name").value="",c("convoy-create-issues").value="",t||F(),hn("convoy-create-name"),(n=c("convoy-create-name"))==null||n.focus()}async function bn(e){var l,d,p,f,u,y,m,h;const t=S();if(!t)return;be=e,((l=c("convoy-detail"))==null?void 0:l.style.display)!=="block"&&F(),c("convoy-list").style.display="none",c("convoy-create-form").style.display="none",c("convoy-detail").style.display="block",hn("convoy-detail"),c("convoy-detail-id").textContent=e,c("convoy-detail-title").textContent=`Convoy: ${e}`,c("convoy-issues-loading").style.display="block",c("convoy-issues-table").style.display="none",c("convoy-issues-empty").style.display="none",c("convoy-add-issue-form").style.display="none";const n=await g.GET("/v0/city/{cityName}/convoy/{id}",{params:{path:{cityName:t,id:e}}});if(c("convoy-issues-loading").style.display="none",n.error||!n.data){c("convoy-issues-empty").style.display="block",c("convoy-issues-empty").querySelector("p").textContent=((d=n.error)==null?void 0:d.detail)??"Failed to load convoy";return}const a=((p=n.data.progress)==null?void 0:p.total)??((f=n.data.children)==null?void 0:f.length)??0,r=((u=n.data.progress)==null?void 0:u.closed)??((y=n.data.children)==null?void 0:y.filter(w=>w.status==="closed").length)??0;c("convoy-detail-status").className=`badge ${ce(((m=n.data.convoy)==null?void 0:m.status)??"open")}`,c("convoy-detail-status").textContent=((h=n.data.convoy)==null?void 0:h.status)??"open",c("convoy-detail-progress").textContent=`${r}/${a}`;const i=c("convoy-issues-tbody");if(!i)return;k(i);const o=n.data.children??[];if(o.length===0){c("convoy-issues-empty").style.display="block";return}o.forEach(w=>{const E=w.assignee?w.assignee:w.status==="closed"?"done":"ready";i.append(s("tr",{},[s("td",{class:"convoy-issue-status"},[s("span",{class:`badge ${ce(w.status)}`},[w.status??"unknown"])]),s("td",{},[s("span",{class:"issue-id"},[w.id??""])]),s("td",{class:"issue-title"},[w.title??w.id??""]),s("td",{},[w.assignee?s("span",{class:"badge badge-blue"},[w.assignee]):s("span",{class:"badge badge-muted"},["Unassigned"])]),s("td",{},[E])]))}),c("convoy-issues-table").style.display="table"}function ws(){const e=c("convoy-detail"),t=(e==null?void 0:e.style.display)==="block";e.style.display="none",c("convoy-list").style.display="block",t&&j()}function ut(){const e=c("convoy-create-form"),t=(e==null?void 0:e.style.display)==="block";e.style.display="none",c("convoy-list").style.display="block",t&&j()}async function Ss(){var r,i;const e=S();if(!e)return;const t=((r=c("convoy-create-name"))==null?void 0:r.value.trim())??"",n=(((i=c("convoy-create-issues"))==null?void 0:i.value)??"").split(/\s+/).map(o=>o.trim()).filter(Boolean);if(!t){v("error","Missing name","Convoy name is required");return}const a=await g.POST("/v0/city/{cityName}/convoys",{params:{path:{cityName:e},header:T},body:{title:t,items:n}});if(a.error){v("error","Create failed",a.error.detail??"Could not create convoy");return}v("success","Convoy created",t),ut(),await St()}async function Es(){const e=S();if(!e||!be)return;const t=c("convoy-add-issue-input"),n=(t==null?void 0:t.value.trim())??"";if(!n)return;const a=await g.POST("/v0/city/{cityName}/convoy/{id}/add",{params:{path:{cityName:e,id:be},header:T},body:{items:[n]}});if(a.error){v("error","Add failed",a.error.detail??"Could not add issue");return}t&&(t.value=""),c("convoy-add-issue-form").style.display="none",v("success","Issue added",n),await bn(be),await St()}function hn(e){var t,n;(n=(t=c("convoy-panel"))==null?void 0:t.scrollIntoView)==null||n.call(t,{behavior:"smooth",block:"center"}),window.setTimeout(()=>{var a;(a=c(e))==null||a.focus()},0)}const Cs=150,W=[];let Y=null,Ie="all",Be="all",Me="all";async function ks(e){W.splice(0,W.length,...wn(e)),Z()}async function Ns(){var a;const e=S(),n=(((a=(e?await g.GET("/v0/city/{cityName}/events",{params:{path:{cityName:e},query:{since:"1h",limit:100}}}):await g.GET("/v0/events",{params:{query:{since:"1h"}}})).data)==null?void 0:a.items)??[]).map(r=>Rs(r)).filter(r=>r!==null);await ks(n)}function $s(e,t){const n=S();Y==null||Y.close();const a=t?{onStatus:t}:void 0;Y=(n?i=>Ea(n,i,a):i=>Sa(i,a))(i=>{const o=En(i);e==null||e(i,o);const l=As(i);if(l){if(W.some(d=>d.id===l.id)){he("activity","Duplicate stream event ignored",{id:l.id,type:l.type});return}W.splice(0,W.length,...wn([l,...W])),Z()}})}function Ls(){Y==null||Y.close(),Y=null}function Z(){Ts();const e=c("activity-feed");if(!e)return;k(e);const t=W.filter(a=>!(Ie!=="all"&&a.category!==Ie||Be!=="all"&&a.rig!==Be||Me!=="all"&&a.actor!==Me));if(c("activity-count").textContent=String(W.length),t.length===0){e.append(s("div",{class:"empty-state"},[s("p",{},["No recent activity"])]));return}const n=s("div",{class:"tl-timeline",id:"activity-timeline"});t.forEach(a=>{n.append(s("div",{class:`tl-entry ${Ps(a.category)}`,"data-category":a.category,"data-rig":a.rig,"data-agent":a.actor??"","data-type":a.type,"data-ts":a.ts},[s("div",{class:"tl-rail"},[s("span",{class:"tl-time"},[gt(a.ts)]),s("span",{class:"tl-node"})]),s("div",{class:"tl-content"},[s("div",{class:"tl-header"},[s("span",{class:"tl-icon"},[ra(a.type)]),s("span",{class:"tl-summary"},[ia(a.type,a.actor,a.subject,a.message)])]),s("div",{class:"tl-meta"},[a.actor?s("span",{class:"tl-badge tl-badge-agent"},[B(a.actor)]):null,a.rig?s("span",{class:"tl-badge tl-badge-rig"},[a.rig]):null,s("span",{class:"tl-badge tl-badge-type"},[a.type])])])]))}),e.append(n)}function xs(){var e,t;document.addEventListener("click",n=>{var r;const a=(r=n.target)==null?void 0:r.closest(".tl-filter-btn");a&&(Ie=a.dataset.value??"all",document.querySelectorAll(".tl-filter-btn").forEach(i=>i.classList.remove("active")),a.classList.add("active"),Z())}),(e=c("tl-rig-filter"))==null||e.addEventListener("change",n=>{Be=n.currentTarget.value,Z()}),(t=c("tl-agent-filter"))==null||t.addEventListener("change",n=>{Me=n.currentTarget.value,Z()})}function Ts(){const e=c("activity-filters");if(!e||(k(e),W.length===0))return;const t=[...new Set(W.map(i=>i.rig).filter(Boolean))].sort(),n=[...new Set(W.map(i=>i.actor).filter(Boolean))].sort(),a=s("select",{class:"tl-filter-select",id:"tl-rig-filter"});a.append(s("option",{value:"all"},["All rigs"])),t.forEach(i=>a.append(s("option",{value:i,selected:i===Be},[i]))),a.addEventListener("change",()=>{Be=a.value,Z()});const r=s("select",{class:"tl-filter-select",id:"tl-agent-filter"});r.append(s("option",{value:"all"},["All agents"])),n.forEach(i=>r.append(s("option",{value:i,selected:i===Me},[B(i)]))),r.addEventListener("change",()=>{Me=r.value,Z()}),e.append(s("div",{class:"tl-filters"},[s("div",{class:"tl-filter-group"},[s("label",{},["Category:"]),Le("all","All"),Le("agent","Agent"),Le("work","Work"),Le("comms","Comms"),Le("system","System")]),s("div",{class:"tl-filter-group"},[s("label",{},["Rig:"]),a]),s("div",{class:"tl-filter-group"},[s("label",{},["Agent:"]),r])]))}function Le(e,t){const n=s("button",{class:`tl-filter-btn${Ie===e?" active":""}`,"data-filter":"category","data-value":e,type:"button"},[t]);return n.addEventListener("click",()=>{Ie=e,Z()}),n}function As(e){return e.event==="heartbeat"?null:vn(e.data,e.id)}function Rs(e){return vn(e)}function vn(e,t){if(!e.type)return null;const n=Sn(e)??S(),a=typeof e.seq=="number"?e.seq:0;return{id:_s(e,t),type:e.type,category:sa(e.type),actor:e.actor||void 0,subject:e.subject||void 0,message:e.message||void 0,ts:e.ts,scope:n,seq:a,rig:aa(e.actor)||"city"in e&&e.city||""}}function wn(e){const t=new Map;return e.forEach(n=>{t.has(n.id)||t.set(n.id,n)}),[...t.values()].sort(Os).slice(0,Cs)}function Os(e,t){const n=qs(e.ts,t.ts);if(n!==0)return n;const a=e.scope.localeCompare(t.scope);if(a!==0)return a;const r=t.seq-e.seq;if(r!==0)return r;const i=e.type.localeCompare(t.type);if(i!==0)return i;const o=(e.actor??"").localeCompare(t.actor??"");return o!==0?o:(e.subject??"").localeCompare(t.subject??"")}function qs(e,t){const n=Number.isNaN(Date.parse(e))?0:Date.parse(e);return(Number.isNaN(Date.parse(t))?0:Date.parse(t))-n}function Sn(e){if("city"in e&&typeof e.city=="string"&&e.city!=="")return e.city}function _s(e,t){const n=Sn(e)??S();if(typeof e.seq=="number"&&e.seq>0)return`${n}:${e.seq}`;const a=[e.type,e.ts,e.actor??"",e.subject??"",e.message??"",t??""].join(":");return`${n}:${a}`}function En(e){return ka(e)}function Ps(e){switch(e){case"agent":return"activity-agent";case"work":return"activity-work";case"comms":return"activity-comms";default:return"activity-system"}}async function V(){var o,l,d,p,f,u;const e=S();if(!e){js();return}const[t,n,a,r,i]=await Promise.all([g.GET("/v0/city/{cityName}/services",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/rigs",{params:{path:{cityName:e},query:{git:!0}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{label:"gc:escalation",status:"open",limit:200}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"in_progress",limit:500}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{label:"gc:queue",limit:200}}})]);Bs(((o=t.data)==null?void 0:o.items)??null,(l=t.error)==null?void 0:l.detail),Ms(((d=n.data)==null?void 0:d.items)??null),Us(((p=a.data)==null?void 0:p.items)??null),Ds(((f=r.data)==null?void 0:f.items)??null),zs(((u=i.data)==null?void 0:u.items)??null)}function js(){xe("services-body","services-count","Select a city to view services"),xe("rigs-body","rigs-count","Select a city to view rigs"),xe("escalations-body","escalations-count","Select a city to view escalations"),xe("assigned-body","assigned-count","Select a city to view assigned work"),xe("queues-body","queues-count","Select a city to view queues"),c("clear-assigned-btn").style.display="none"}function Is(){var e,t;(e=c("open-assign-btn"))==null||e.addEventListener("click",()=>{Cn()}),(t=c("clear-assigned-btn"))==null||t.addEventListener("click",()=>{Fs()})}function Bs(e,t){const n=c("services-body"),a=c("services-count");if(!n||!a)return;if(k(n),t){a.textContent="n/a",n.append(s("div",{class:"empty-state"},[s("p",{},[t])]));return}const r=e??[];if(a.textContent=String(r.length),r.length===0){n.append(s("div",{class:"empty-state"},[s("p",{},["No workspace services"])]));return}const i=s("tbody");r.forEach(o=>{const l=s("button",{class:"esc-btn",type:"button"},["Restart"]);l.addEventListener("click",()=>{Js(o.service_name)}),i.append(s("tr",{},[s("td",{},[s("strong",{},[o.service_name])]),s("td",{},[o.kind??"—"]),s("td",{},[s("span",{class:`badge ${ce(o.state??o.publication_state)}`},[o.state??o.publication_state??"unknown"])]),s("td",{},[o.local_state]),s("td",{},[l])]))}),n.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Name"]),s("th",{},["Kind"]),s("th",{},["Service"]),s("th",{},["Local"]),s("th",{},["Actions"])])]),i]))}function Ms(e){const t=c("rigs-body"),n=c("rigs-count");if(!t||!n)return;k(t);const a=e??[];if(n.textContent=String(a.length),a.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No rigs configured"])]));return}const r=s("tbody");a.forEach(i=>{var d;const o=s("button",{class:"esc-btn",type:"button"},[i.suspended?"Resume":"Suspend"]);o.addEventListener("click",()=>{Pt(i.name,i.suspended?"resume":"suspend")});const l=s("button",{class:"esc-btn",type:"button"},["Restart"]);l.addEventListener("click",()=>{Pt(i.name,"restart")}),r.append(s("tr",{},[s("td",{},[s("span",{class:"rig-name"},[i.name])]),s("td",{},[String(i.agent_count-i.running_count)]),s("td",{},[String(i.running_count)]),s("td",{},[(d=i.git)!=null&&d.branch?`${i.git.branch}${i.git.clean?"":"*"}`:"—"]),s("td",{},[D(i.last_activity)]),s("td",{},[o," ",l])]))}),t.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Name"]),s("th",{},["Idle"]),s("th",{},["Running"]),s("th",{},["Git"]),s("th",{},["Activity"]),s("th",{},["Actions"])])]),r]))}function Us(e){const t=c("escalations-body"),n=c("escalations-count");if(!t||!n)return;k(t);const a=(e??[]).sort((i,o)=>(i.created_at??"").localeCompare(o.created_at??""));if(n.textContent=String(a.length),a.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No escalations"])]));return}const r=s("tbody");a.forEach(i=>{const o=Ws(i.labels??[]),l=(i.labels??[]).includes("acked"),d=s("button",{class:"esc-btn esc-ack-btn",type:"button"},["👍 Ack"]);d.addEventListener("click",()=>{Vs(i)});const p=s("button",{class:"esc-btn esc-resolve-btn",type:"button"},["✓ Resolve"]);p.addEventListener("click",()=>{i.id&&Ks(i.id)});const f=s("button",{class:"esc-btn esc-reassign-btn",type:"button"},["↻ Reassign"]);f.addEventListener("click",()=>{i.id&&Qs(i.id)}),r.append(s("tr",{class:"escalation-row","data-escalation-id":i.id??""},[s("td",{},[s("span",{class:`badge ${Gs(o)}`},[o.toUpperCase()])]),s("td",{},[i.title??i.id??"",l?s("span",{class:"badge badge-cyan",style:"margin-left: 4px;"},["ACK"]):null]),s("td",{},[B(i.assignee)]),s("td",{},[D(i.created_at)]),s("td",{class:"escalation-actions"},[l?null:d,p,f])]))}),t.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Severity"]),s("th",{},["Issue"]),s("th",{},["From"]),s("th",{},["Age"]),s("th",{},["Actions"])])]),r]))}function Ds(e){const t=c("assigned-body"),n=c("assigned-count"),a=c("clear-assigned-btn");if(!t||!n||!a)return;k(t);const r=(e??[]).filter(o=>o.assignee);if(n.textContent=String(r.length),a.style.display=r.length>0?"inline-flex":"none",r.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No assigned work"])]));return}const i=s("tbody");r.forEach(o=>{const l=s("button",{class:"unassign-btn",type:"button"},["Unassign"]);l.addEventListener("click",()=>{o.id&&Hs(o.id)}),i.append(s("tr",{},[s("td",{},[s("span",{class:"assigned-id"},[o.id??""])]),s("td",{class:"assigned-title"},[Qe(o.title??"",80)]),s("td",{class:"assigned-agent"},[B(o.assignee)]),s("td",{class:"assigned-age"},[D(o.created_at)]),s("td",{},[l])]))}),t.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Bead"]),s("th",{},["Title"]),s("th",{},["Agent"]),s("th",{},["Since"]),s("th",{},[""])])]),i]))}function zs(e){const t=c("queues-body"),n=c("queues-count");if(!t||!n)return;k(t);const a=e??[];if(n.textContent=String(a.length),a.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No queues"])]));return}const r=s("tbody");a.forEach(i=>{r.append(s("tr",{},[s("td",{},[i.title??i.id??"queue"]),s("td",{},[i.id??"—"]),s("td",{},[s("span",{class:`badge ${ce(i.status)}`},[i.status??"open"])]),s("td",{},[B(i.assignee)]),s("td",{},[D(i.created_at)])]))}),t.append(s("table",{},[s("thead",{},[s("tr",{},[s("th",{},["Queue"]),s("th",{},["Bead"]),s("th",{},["Status"]),s("th",{},["Assignee"]),s("th",{},["Created"])])]),r]))}function xe(e,t,n){const a=c(e),r=c(t);!a||!r||(k(a),r.textContent="0",a.append(s("div",{class:"empty-state"},[s("p",{},[n])])))}function Ws(e){for(const t of e)if(t.startsWith("severity:"))return t.slice(9);return"medium"}function Gs(e){switch(e){case"critical":return"badge-red";case"high":return"badge-orange";case"low":return"badge-muted";default:return"badge-yellow"}}async function Cn(e=""){const t=S();if(!t)return;const n=await ht({beadID:e||void 0,beadLabel:e||void 0,mode:"assign",title:"Assign Work"});if(!n)return;const a=await g.POST("/v0/city/{cityName}/sling",{params:{path:{cityName:t},header:T},body:{bead:n.beadID,target:n.target,rig:n.rig||void 0}});if(a.error){v("error","Assign failed",a.error.detail??"Could not assign bead");return}v("success","Assigned",`${n.beadID} → ${n.target}`),await V()}async function Fs(){var r;const e=S();if(!e)return;const n=(((r=(await g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"in_progress",limit:500}}})).data)==null?void 0:r.items)??[]).filter(i=>i.assignee);if(n.length===0){v("info","Nothing to clear","No assigned work");return}await Ma({body:`Unassign ${n.length} active ${n.length===1?"bead":"beads"}?`,confirmLabel:"Unassign All",title:"Clear Assignments"})&&(await Promise.all(n.map(i=>g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:e,id:i.id??""},header:T},body:{assignee:""}}))),v("success","Cleared",`${n.length} assignments removed`),await V())}async function Hs(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:t,id:e},header:T},body:{assignee:""}});if(n.error){v("error","Unassign failed",n.error.detail??"Could not unassign bead");return}v("success","Unassigned",e),await V()}async function Js(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/service/{name}/restart",{params:{path:{cityName:t,name:e},header:T}});if(n.error){v("error","Service failed",n.error.detail??"Could not restart service");return}v("success","Service restarted",e),await V()}async function Pt(e,t){const n=S();if(!n)return;const a=await g.POST("/v0/city/{cityName}/rig/{name}/{action}",{params:{path:{cityName:n,name:e,action:t},header:T}});if(a.error){v("error","Rig action failed",a.error.detail??`Could not ${t} ${e}`);return}v("success","Rig updated",`${e}: ${t}`),await V()}async function Vs(e){const t=S();if(!t||!e.id)return;const n=Array.from(new Set([...e.labels??[],"acked"])),a=await g.POST("/v0/city/{cityName}/bead/{id}/update",{params:{path:{cityName:t,id:e.id},header:T},body:{labels:n}});if(a.error){v("error","Ack failed",a.error.detail??"Could not acknowledge escalation");return}v("success","Acknowledged",e.id),await V()}async function Ks(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/close",{params:{path:{cityName:t,id:e},header:T}});if(n.error){v("error","Resolve failed",n.error.detail??"Could not resolve escalation");return}v("success","Resolved",e),await V()}async function Qs(e){const t=S();if(!t)return;const n=await ht({beadID:e,beadLabel:e,mode:"reassign",title:"Reassign Escalation"});if(!n)return;const a=await g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:t,id:e},header:T},body:{assignee:n.target}});if(a.error){v("error","Reassign failed",a.error.detail??"Could not reassign escalation");return}v("success","Reassigned",`${e} → ${n.target||"unassigned"}`),await V()}function Xs(e){const t=c("command-palette-overlay"),n=c("command-palette-input"),a=c("command-palette-results"),r=c("open-palette-btn");if(!t||!n||!a||!r)return;const i=t,o=n,l=a,d=r;let p=[],f=[],u=0;function y(){const b=S(),C=async(N,I)=>{const M=await I;Rt(N,JSON.stringify(M,null,2))};return[{name:"refresh",desc:"Refresh all panels",category:"Dashboard",run:()=>e.refreshAll()},{name:"supervisor health",desc:"Show supervisor health JSON",category:"Supervisor",run:()=>C("health",g.GET("/health"))},{name:"city list",desc:"Show managed cities JSON",category:"Supervisor",run:()=>C("cities",g.GET("/v0/cities"))},{name:"global events",desc:"Show recent supervisor events JSON",category:"Supervisor",run:()=>C("events",g.GET("/v0/events",{params:{query:{since:"1h"}}}))},...b?[{name:"new issue",desc:"Open the issue creation modal",category:"Work",run:()=>dn()},{name:"compose mail",desc:"Open the compose mail form",category:"Mail",run:()=>dt()},{name:"new convoy",desc:"Open the convoy creation form",category:"Convoys",run:()=>gn()},{name:"assign work",desc:"Open the assignment modal",category:"Assigned",run:()=>Cn()},{name:"status",desc:"Show current city status JSON",category:"Status",run:()=>C("status",g.GET("/v0/city/{cityName}/status",{params:{path:{cityName:b}}}))},{name:"agent list",desc:"Show current sessions JSON",category:"Status",run:()=>C("sessions",g.GET("/v0/city/{cityName}/sessions",{params:{path:{cityName:b},query:{state:"active",peek:!0}}}))},{name:"convoy list",desc:"Show current convoys JSON",category:"Convoys",run:()=>C("convoys",g.GET("/v0/city/{cityName}/convoys",{params:{path:{cityName:b},query:{limit:200}}}))},{name:"mail inbox",desc:"Show current mail JSON",category:"Mail",run:()=>C("mail",g.GET("/v0/city/{cityName}/mail",{params:{path:{cityName:b},query:{status:"all",limit:200}}}))},{name:"rig list",desc:"Show rig JSON",category:"Rigs",run:()=>C("rigs",g.GET("/v0/city/{cityName}/rigs",{params:{path:{cityName:b},query:{git:!0}}}))},{name:"list",desc:"Show open and in-progress beads JSON",category:"Beads",run:async()=>{var M,$;const[N,I]=await Promise.all([g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:b},query:{status:"open",limit:500}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:b},query:{status:"in_progress",limit:500}}})]);Rt("beads",JSON.stringify({open:((M=N.data)==null?void 0:M.items)??[],in_progress:(($=I.data)==null?void 0:$.items)??[]},null,2))}}]:[],{name:"close output",desc:"Hide the output panel",category:"Dashboard",run:()=>Zt()}].filter(N=>typeof N.run=="function")}function m(){k(l);const b=o.value.trim().toLowerCase();if(p=y(),f=p.filter(C=>b===""||C.name.includes(b)||C.desc.toLowerCase().includes(b)||C.category.toLowerCase().includes(b)),u>=f.length&&(u=0),f.length===0){l.append(s("div",{class:"command-palette-empty"},["No matching commands"]));return}f.forEach((C,N)=>{const I=s("button",{class:`command-item${N===u?" selected":""}`,type:"button"},[s("span",{class:"command-name"},[`gt ${C.name}`]),s("span",{class:"command-desc"},[C.desc]),s("span",{class:"command-category"},[C.category])]);I.addEventListener("click",()=>{E(N)}),l.append(I)})}function h(){i.classList.add("open"),o.value="",u=0,m(),o.focus()}function w(){i.classList.remove("open")}async function E(b){const C=f[b];w(),C&&(J("palette","Execute command",{category:C.category,city:S(),command:C.name}),await C.run())}d.addEventListener("click",()=>h()),i.addEventListener("click",b=>{b.target===i&&w()}),o.addEventListener("input",()=>m()),o.addEventListener("keydown",b=>{if(b.key==="ArrowDown"){u=Math.min(u+1,Math.max(f.length-1,0)),m(),b.preventDefault();return}if(b.key==="ArrowUp"){u=Math.max(u-1,0),m(),b.preventDefault();return}if(b.key==="Enter"){E(u),b.preventDefault();return}b.key==="Escape"&&w()}),document.addEventListener("keydown",b=>{(b.metaKey||b.ctrlKey)&&b.key.toLowerCase()==="k"&&(b.preventDefault(),i.classList.contains("open")?w():h())})}function Ys(){const e=c("supervisor-overview-panel"),t=c("supervisor-overview-body"),n=c("supervisor-city-count");if(!e||!t||!n)return;const a=S()==="";if(e.hidden=!a,!a)return;const r=Ht().sort((o,l)=>o.name.localeCompare(l.name));if(n.textContent=String(r.length),k(t),r.length===0){t.append(s("div",{class:"empty-state"},[s("p",{},["No managed cities available"])]));return}const i=s("tbody");r.forEach(o=>{const l=o.phasesCompleted.length>0?o.phasesCompleted.join(", "):"—",d=s("a",{class:"supervisor-city-link",href:`?city=${encodeURIComponent(o.name)}`},["Open"]);i.append(s("tr",{},[s("td",{},[s("strong",{},[o.name])]),s("td",{},[s("span",{class:`badge ${o.error?"badge-red":o.running?"badge-green":"badge-muted"}`},[o.error?"Error":o.running?"Running":"Stopped"])]),s("td",{},[o.status??"—"]),s("td",{class:"supervisor-city-phases"},[l]),s("td",{class:"supervisor-city-error"},[o.error??"—"]),s("td",{class:"supervisor-city-actions"},[d])]))}),t.append(s("table",{class:"supervisor-city-table"},[s("thead",{},[s("tr",{},[s("th",{},["City"]),s("th",{},["State"]),s("th",{},["Status"]),s("th",{},["Phases"]),s("th",{},["Error"]),s("th",{},[""])])]),i]))}const Zs=["convoy-panel","crew-panel","rigged-panel","mail-panel","escalations-panel","services-panel","rigs-panel","pooled-panel","queues-panel","beads-panel","assigned-panel","agent-log-drawer"];async function er(){bt()||await Ee()}async function tr(){bt()||await Ee().catch(e=>P("Catch-up refresh failed",e))}async function nr(){mt(),await Ee(!0)}function Et(){const e=Jt();if(e.kind==="not-running"||e.kind==="unknown"){Ls(),st("connecting");return}st("connecting"),$s(t=>{const n=En(t);!n||n==="heartbeat"||(ea(n),!bt()&&Ee().catch(a=>P("Refresh failed",a)))},st)}function st(e){const t=Ct("connection-status");if(!t)return;const n={connecting:"Connecting…",live:"Live",reconnecting:"Reconnecting…"};t.replaceChildren(document.createTextNode(n[e])),t.classList.remove("connection-live","connection-connecting","connection-reconnecting"),t.classList.add(`connection-${e}`)}function ar(){ba(),Ba(),Ra(),Ga(),ls(),vs(),xs(),Is(),Xs({refreshAll:er})}async function sr(){Vn(),J("dashboard","Boot start",{city:S(),href:window.location.href}),ar(),ir(),ga(()=>{tr()}),await nr(),Et(),J("dashboard","Boot complete",{city:S(),href:window.location.href})}function Ct(e){return document.getElementById(e)}sr().catch(e=>P("Dashboard boot failed",e));function rr(){const e=S()!=="";cr(e),De("new-convoy-btn",e,"Select a city to create a convoy"),De("new-issue-btn",e,"Select a city to create a bead"),De("compose-mail-btn",e,"Select a city to compose mail"),De("open-assign-btn",e,"Select a city to assign work")}function De(e,t,n){const a=Ct(e);a&&(a.dataset.defaultTitle===void 0&&(a.dataset.defaultTitle=a.title||""),a.disabled=!t,a.title=t?a.dataset.defaultTitle:n)}function ir(){document.addEventListener("click",e=>{var a;const t=(a=e.target)==null?void 0:a.closest("a.city-tab");if(!t)return;const n=t.href;!n||n===window.location.href||(e.preventDefault(),or(n))}),window.addEventListener("popstate",()=>{J("dashboard","Popstate navigation",{href:window.location.href}),on(),yt(),mt(),Ee().catch(e=>P("Refresh failed",e)),Et()})}async function or(e){J("dashboard","Navigate city scope",{nextURL:e}),on(),window.history.pushState({},"",e),yt(),mt(),await Ee(),Et()}function cr(e){Zs.forEach(t=>{const n=Ct(t);if(!n)return;const a=!e&&n.classList.contains("expanded");if(n.hidden=!e,a){n.classList.remove("expanded");const r=n.querySelector(".expand-btn");r&&(r.textContent="Expand"),j()}})}async function Ee(e=!1){yt(),rr();const t=Yn(e);if(t.size===0)return;t.has("options")&&Ia(),t.has("cities")&&await ta().catch(l=>P("City tabs failed",l));const n=[],r=Jt().kind==="running";ae(n,t,"status",()=>oa()),ae(n,t,"activity",()=>Ns()),r&&(ae(n,t,"crew",()=>Na()),ae(n,t,"issues",()=>de()),ae(n,t,"mail",()=>Ue()),ae(n,t,"convoys",()=>St()),ae(n,t,"admin",()=>V()));const o=(await Promise.allSettled(n)).find(l=>l.status==="rejected");o&&P("Panel refresh failed",o.reason),(t.has("supervisor")||t.has("cities"))&&Ys()}function ae(e,t,n,a){t.has(n)&&e.push(a())}
+`);R=V.pop()??"";for(const X of V){const W=X.split(`
+`),T=[];let $;for(const j of W)if(j.startsWith("data:"))T.push(j.replace(/^data:\s*/,""));else if(j.startsWith("event:"))$=j.replace(/^event:\s*/,"");else if(j.startsWith("id:"))d=j.replace(/^id:\s*/,"");else if(j.startsWith("retry:")){const re=Number.parseInt(j.replace(/^retry:\s*/,""),10);Number.isNaN(re)||(v=re)}let L,_=!1;if(T.length){const j=T.join(`
+`);try{L=JSON.parse(j),_=!0}catch{L=j}}_&&(s&&await s(L),a&&(L=await a(L))),n==null||n({data:L,event:$,id:d,retry:v}),T.length&&(yield L)}}}finally{b.removeEventListener("abort",Y),q.releaseLock()}break}catch(k){if(t==null||t(k),o!==void 0&&C>=o)break;const P=Math.min(v*2**(C-1),l??3e4);await p(P)}}}()}}const Vn=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Kn=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Qn=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Jt=({allowReserved:e,explode:t,name:n,style:a,value:s})=>{if(!t){const l=(e?s:s.map(u=>encodeURIComponent(u))).join(Kn(a));switch(a){case"label":return`.${l}`;case"matrix":return`;${n}=${l}`;case"simple":return l;default:return`${n}=${l}`}}const i=Vn(a),o=s.map(l=>a==="label"||a==="simple"?e?l:encodeURIComponent(l):et({allowReserved:e,name:n,value:l})).join(i);return a==="label"||a==="matrix"?i+o:o},et=({allowReserved:e,name:t,value:n})=>{if(n==null)return"";if(typeof n=="object")throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");return`${t}=${e?n:encodeURIComponent(n)}`},Vt=({allowReserved:e,explode:t,name:n,style:a,value:s,valueOnly:i})=>{if(s instanceof Date)return i?s.toISOString():`${n}=${s.toISOString()}`;if(a!=="deepObject"&&!t){let u=[];Object.entries(s).forEach(([f,d])=>{u=[...u,f,e?d:encodeURIComponent(d)]});const y=u.join(",");switch(a){case"form":return`${n}=${y}`;case"label":return`.${y}`;case"matrix":return`;${n}=${y}`;default:return y}}const o=Qn(a),l=Object.entries(s).map(([u,y])=>et({allowReserved:e,name:a==="deepObject"?`${n}[${u}]`:u,value:y})).join(o);return a==="label"||a==="matrix"?o+l:l},Yn=/\{[^{}]+\}/g,Xn=({path:e,url:t})=>{let n=t;const a=t.match(Yn);if(a)for(const s of a){let i=!1,o=s.substring(1,s.length-1),l="simple";o.endsWith("*")&&(i=!0,o=o.substring(0,o.length-1)),o.startsWith(".")?(o=o.substring(1),l="label"):o.startsWith(";")&&(o=o.substring(1),l="matrix");const u=e[o];if(u==null)continue;if(Array.isArray(u)){n=n.replace(s,Jt({explode:i,name:o,style:l,value:u}));continue}if(typeof u=="object"){n=n.replace(s,Vt({explode:i,name:o,style:l,value:u,valueOnly:!0}));continue}if(l==="matrix"){n=n.replace(s,`;${et({name:o,value:u})}`);continue}const y=encodeURIComponent(l==="label"?`.${u}`:u);n=n.replace(s,y)}return n},Zn=({baseUrl:e,path:t,query:n,querySerializer:a,url:s})=>{const i=s.startsWith("/")?s:`/${s}`;let o=(e??"")+i;t&&(o=Xn({path:t,url:o}));let l=n?a(n):"";return l.startsWith("?")&&(l=l.substring(1)),l&&(o+=`?${l}`),o};function Pt(e){const t=e.body!==void 0;if(t&&e.bodySerializer)return"serializedBody"in e?e.serializedBody!==void 0&&e.serializedBody!==""?e.serializedBody:null:e.body!==""?e.body:null;if(t)return e.body}const ea=async(e,t)=>{const n=typeof t=="function"?await t(e):t;if(n)return e.scheme==="bearer"?`Bearer ${n}`:e.scheme==="basic"?`Basic ${btoa(n)}`:n},Kt=({parameters:e={},...t}={})=>a=>{const s=[];if(a&&typeof a=="object")for(const i in a){const o=a[i];if(o==null)continue;const l=e[i]||t;if(Array.isArray(o)){const u=Jt({allowReserved:l.allowReserved,explode:!0,name:i,style:"form",value:o,...l.array});u&&s.push(u)}else if(typeof o=="object"){const u=Vt({allowReserved:l.allowReserved,explode:!0,name:i,style:"deepObject",value:o,...l.object});u&&s.push(u)}else{const u=et({allowReserved:l.allowReserved,name:i,value:o});u&&s.push(u)}}return s.join("&")},ta=e=>{var n;if(!e)return"stream";const t=(n=e.split(";")[0])==null?void 0:n.trim();if(t){if(t.startsWith("application/json")||t.endsWith("+json"))return"json";if(t==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(a=>t.startsWith(a)))return"blob";if(t.startsWith("text/"))return"text"}},na=(e,t)=>{var n,a;return t?!!(e.headers.has(t)||(n=e.query)!=null&&n[t]||(a=e.headers.get("Cookie"))!=null&&a.includes(`${t}=`)):!1},aa=async({security:e,...t})=>{for(const n of e){if(na(t,n.name))continue;const a=await ea(n,t.auth);if(!a)continue;const s=n.name??"Authorization";switch(n.in){case"query":t.query||(t.query={}),t.query[s]=a;break;case"cookie":t.headers.append("Cookie",`${s}=${a}`);break;case"header":default:t.headers.set(s,a);break}}},_t=e=>Zn({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:Kt(e.querySerializer),url:e.url}),jt=(e,t)=>{var a;const n={...e,...t};return(a=n.baseUrl)!=null&&a.endsWith("/")&&(n.baseUrl=n.baseUrl.substring(0,n.baseUrl.length-1)),n.headers=Qt(e.headers,t.headers),n},sa=e=>{const t=[];return e.forEach((n,a)=>{t.push([a,n])}),t},Qt=(...e)=>{const t=new Headers;for(const n of e){if(!n)continue;const a=n instanceof Headers?sa(n):Object.entries(n);for(const[s,i]of a)if(i===null)t.delete(s);else if(Array.isArray(i))for(const o of i)t.append(s,o);else i!==void 0&&t.set(s,typeof i=="object"?JSON.stringify(i):i)}return t};class ot{constructor(){this.fns=[]}clear(){this.fns=[]}eject(t){const n=this.getInterceptorIndex(t);this.fns[n]&&(this.fns[n]=null)}exists(t){const n=this.getInterceptorIndex(t);return!!this.fns[n]}getInterceptorIndex(t){return typeof t=="number"?this.fns[t]?t:-1:this.fns.indexOf(t)}update(t,n){const a=this.getInterceptorIndex(t);return this.fns[a]?(this.fns[a]=n,t):!1}use(t){return this.fns.push(t),this.fns.length-1}}const ra=()=>({error:new ot,request:new ot,response:new ot}),ia=Kt({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),oa={"Content-Type":"application/json"},Yt=(e={})=>({...Hn,headers:oa,parseAs:"auto",querySerializer:ia,...e}),ca=(e={})=>{let t=jt(Yt(),e);const n=()=>({...t}),a=f=>(t=jt(t,f),n()),s=ra(),i=async f=>{const d={...t,...f,fetch:f.fetch??t.fetch??globalThis.fetch,headers:Qt(t.headers,f.headers),serializedBody:void 0};d.security&&await aa({...d,security:d.security}),d.requestValidator&&await d.requestValidator(d),d.body!==void 0&&d.bodySerializer&&(d.serializedBody=d.bodySerializer(d.body)),(d.body===void 0||d.serializedBody==="")&&d.headers.delete("Content-Type");const p=d,m=_t(p);return{opts:p,url:m}},o=async f=>{const{opts:d,url:p}=await i(f),m={redirect:"follow",...d,body:Pt(d)};let h=new Request(p,m);for(const x of s.request.fns)x&&(h=await x(h,d));const v=d.fetch;let C;try{C=await v(h)}catch(x){let q=x;for(const R of s.error.fns)R&&(q=await R(x,void 0,h,d));if(q=q||{},d.throwOnError)throw q;return d.responseStyle==="data"?void 0:{error:q,request:h,response:void 0}}for(const x of s.response.fns)x&&(C=await x(C,h,d));const b={request:h,response:C};if(C.ok){const x=(d.parseAs==="auto"?ta(C.headers.get("Content-Type")):d.parseAs)??"json";if(C.status===204||C.headers.get("Content-Length")==="0"){let R;switch(x){case"arrayBuffer":case"blob":case"text":R=await C[x]();break;case"formData":R=new FormData;break;case"stream":R=C.body;break;case"json":default:R={};break}return d.responseStyle==="data"?R:{data:R,...b}}let q;switch(x){case"arrayBuffer":case"blob":case"formData":case"text":q=await C[x]();break;case"json":{const R=await C.text();q=R?JSON.parse(R):{};break}case"stream":return d.responseStyle==="data"?C.body:{data:C.body,...b}}return x==="json"&&(d.responseValidator&&await d.responseValidator(q),d.responseTransformer&&(q=await d.responseTransformer(q))),d.responseStyle==="data"?q:{data:q,...b}}const N=await C.text();let k;try{k=JSON.parse(N)}catch{}const P=k??N;let M=P;for(const x of s.error.fns)x&&(M=await x(P,C,h,d));if(M=M||{},d.throwOnError)throw M;return d.responseStyle==="data"?void 0:{error:M,...b}},l=f=>d=>o({...d,method:f}),u=f=>async d=>{const{opts:p,url:m}=await i(d);return Jn({...p,body:p.body,headers:p.headers,method:f,onRequest:async(h,v)=>{let C=new Request(h,v);for(const b of s.request.fns)b&&(C=await b(C,p));return C},serializedBody:Pt(p),url:m})};return{buildUrl:f=>_t({...t,...f}),connect:l("CONNECT"),delete:l("DELETE"),get:l("GET"),getConfig:n,head:l("HEAD"),interceptors:s,options:l("OPTIONS"),patch:l("PATCH"),post:l("POST"),put:l("PUT"),request:o,setConfig:a,sse:{connect:u("CONNECT"),delete:u("DELETE"),get:u("GET"),head:u("HEAD"),options:u("OPTIONS"),patch:u("PATCH"),post:u("POST"),put:u("PUT"),trace:u("TRACE")},trace:l("TRACE")}},fe=ca(Yt()),Xt={debug:console.debug.bind(console),error:console.error.bind(console),info:console.info.bind(console),log:console.log.bind(console),warn:console.warn.bind(console)};let It=!1;function la(){It||typeof window>"u"||(It=!0,nt()&&($e("debug","debug"),$e("info","info"),$e("log","info")),$e("warn","warn"),$e("error","error"),window.addEventListener("error",e=>{de("window","Unhandled error",{colno:e.colno,error:e.error,filename:e.filename,lineno:e.lineno,message:e.message})}),window.addEventListener("unhandledrejection",e=>{de("window","Unhandled promise rejection",{reason:e.reason})}))}function Ie(e,t,n){nt()&&tt("debug",e,t,n)}function ee(e,t,n){nt()&&tt("info",e,t,n)}function we(e,t,n){tt("warn",e,t,n)}function de(e,t,n){tt("error",e,t,n)}function tt(e,t,n,a){if((e==="debug"||e==="info")&&!nt())return;const s=Zt(e,t,n,a);Xt[e](`[dashboard][${t}] ${n}`,Qe(a)),en(s)}function nt(){if(typeof window>"u")return!1;const t=(new URLSearchParams(window.location.search).get("debug")??"").toLowerCase();if(t==="1"||t==="true")return!0;try{return window.localStorage.getItem("gc.dashboard.debug")==="true"}catch{return!1}}function $e(e,t){const n=Xt[e];console[e]=(...a)=>{n(...a),en(Zt(t,"console",ua(a),a.length>1?a.slice(1):a[0]))}}function Zt(e,t,n,a){return{city:da(),details:a===void 0?void 0:Qe(a),level:e,message:n,scope:t,ts:new Date().toISOString(),url:typeof window>"u"?"":window.location.href}}function da(){return typeof window>"u"?"":(new URLSearchParams(window.location.search).get("city")??"").trim()}function ua(e){if(e.length===0)return"console event";const[t]=e;return typeof t=="string"&&t.trim()!==""?t:t instanceof Error?t.message:"console event"}function en(e){const t=JSON.stringify(e);if(typeof navigator<"u"&&typeof navigator.sendBeacon=="function"){const n=new Blob([t],{type:"application/json"});if(navigator.sendBeacon("/__client-log",n))return}fetch("/__client-log",{body:t,credentials:"same-origin",headers:{"Content-Type":"application/json"},keepalive:!0,method:"POST"}).catch(()=>{})}function Qe(e,t=0,n=new WeakSet){if(e==null)return e??null;if(typeof e=="string")return e.length>2e3?`${e.slice(0,1999)}…`:e;if(typeof e=="number"||typeof e=="boolean")return e;if(e instanceof Error)return{message:e.message,name:e.name,stack:e.stack};if(typeof e=="function")return`[function ${e.name||"anonymous"}]`;if(t>=4)return"[max-depth]";if(Array.isArray(e))return e.slice(0,20).map(a=>Qe(a,t+1,n));if(typeof e=="object"){if(n.has(e))return"[circular]";n.add(e);const a={};for(const[s,i]of Object.entries(e).slice(0,40))a[s]=Qe(i,t+1,n);return a}return String(e)}const bt=["cities","status","supervisor","crew","issues","mail","convoys","activity","admin","options"];let Be=an(window.location.search),vt=[],Ge=!1;const Ke=new Set(bt);function fa(){return Be}function wt(){return Be=an(window.location.search),Be}function oe(...e){e.forEach(t=>Ke.add(t))}function St(){oe(...bt)}function ya(e=!1){if(e)return Ke.clear(),new Set(bt);const t=new Set(Ke);return Ke.clear(),t}function pa(e){Ge=!0,vt=e.map(t=>({error:t.error,name:t.name,path:t.path,phasesCompleted:[...t.phasesCompleted??[]],running:t.running,status:t.status}))}function tn(){Ge=!1}function nn(){return vt.map(e=>({error:e.error,name:e.name,path:e.path,phasesCompleted:[...e.phasesCompleted],running:e.running,status:e.status}))}function Fe(){const e=Be;if(e==="")return{kind:"supervisor"};if(!Ge)return{kind:"unknown",name:e};const t=vt.find(n=>n.name===e);return t?t.running?{kind:"running",city:t}:{kind:"not-running",city:t}:{kind:"unknown",name:e}}function ma(e=Fe()){return e.kind==="running"?!0:e.kind==="unknown"?!Ge:!1}function Ct(e=Fe()){return e.kind==="not-running"||e.kind==="unknown"&&Ge}function ga(e){if(!e)return!1;const t=Be!=="";return e.startsWith("session.")||e.startsWith("agent.")?t?(oe("status","crew","options"),!0):!1:e.startsWith("bead.")?t?(oe("status","issues"),!0):!1:e.startsWith("mail.")?t?(oe("status","mail"),!0):!1:e.startsWith("convoy.")?t?(oe("status","convoys"),!0):!1:e.startsWith("city.")||e.startsWith("request.result.")||e==="request.failed"?(oe("cities","status","supervisor"),!0):(e.startsWith("service.")||e.startsWith("provider.")||e.startsWith("rig."))&&t?(oe("admin"),!0):!1}function an(e){return(new URLSearchParams(e).get("city")??"").trim()}function sn(){const e=document.querySelector('meta[name="supervisor-url"]');return((e==null?void 0:e.content)??"").replace(/\/+$/,"")}function S(){return fa()}const O={"X-GC-Request":"true"},g=Wn({baseUrl:sn(),headers:O});fe.setConfig({baseUrl:sn(),headers:O});g.use({async onError({error:e,request:t,schemaPath:n}){return de("api","Request failed",{error:e,method:t.method,schemaPath:n,url:t.url}),e instanceof Error?e:new Error(String(e))},async onRequest({params:e,request:t,schemaPath:n}){Ie("api","Request start",{method:t.method,params:e,schemaPath:n,url:t.url})},async onResponse({request:e,response:t,schemaPath:n}){const a={method:e.method,ok:t.ok,schemaPath:n,status:t.status,url:e.url};if(!t.ok||t.status>=400){we("api","Request response",a);return}Ie("api","Request response",a)}});function r(e,t={},n=[]){const a=document.createElement(e);for(const[s,i]of Object.entries(t))i===void 0||i===!1||(i===!0?a.setAttribute(s,""):a.setAttribute(s,String(i)));for(const s of n)s!=null&&a.append(typeof s=="string"?document.createTextNode(s):s);return a}function E(e){for(;e.firstChild;)e.removeChild(e.firstChild)}function c(e){return document.getElementById(e)}async function ha(){const e=c("city-tabs");if(!e)return;const{data:t,error:n}=await g.GET("/v0/cities");!n&&(t!=null&&t.items)?pa(t.items.map(l=>({error:l.error??void 0,name:l.name??"",path:l.path??void 0,phasesCompleted:l.phases_completed??[],running:l.running===!0,status:l.status??void 0}))):tn();const a=nn();if(n||a.length===0)return;const s=S();E(e);const i=r("nav",{class:"city-tabs"}),o=window.location.pathname||"/";i.append(r("a",{href:o,class:`city-tab${s===""?" active":""}`},[r("span",{class:"city-dot running"})," Supervisor"]));for(const l of a){const u=l.running,y=l.name===s,f=r("a",{href:`${o}?city=${encodeURIComponent(l.name)}`,class:`city-tab${y?" active":""}${u?"":" stopped"}`},[r("span",{class:`city-dot${u?" running":""}`}),` ${l.name}`]);i.append(f)}e.append(i)}function Et(e,t=new Date){if(!e)return"";const n=new Date(e);if(isNaN(n.getTime()))return"";const a=Math.max(0,t.getTime()-n.getTime()),s=Math.floor(a/1e3);if(s<60)return`${s}s ago`;const i=Math.floor(s/60);if(i<60)return`${i}m ago`;const o=Math.floor(i/60);return o<24?`${o}h ago`:`${Math.floor(o/24)}d ago`}const rn=300*1e3,ba=600*1e3;function F(e){if(!e)return"—";const t=new Date(e);if(Number.isNaN(t.getTime()))return"—";const n=new Date,a=t.getFullYear()===n.getFullYear()?{month:"short",day:"numeric",hour:"numeric",minute:"2-digit"}:{month:"short",day:"numeric",year:"numeric",hour:"numeric",minute:"2-digit"};return t.toLocaleString(void 0,a)}function je(e){if(!e)return{display:"unknown",colorClass:"unknown"};const t=new Date(e);if(Number.isNaN(t.getTime()))return{display:"unknown",colorClass:"unknown"};const n=Math.max(0,Date.now()-t.getTime()),a=Et(e).replace(" ago","");return n<rn?{display:a,colorClass:"green"}:n<ba?{display:a,colorClass:"yellow"}:{display:a,colorClass:"red"}}function U(e){if(!e)return"—";const t=e.split("/").filter(Boolean);return t.length===0?"—":t.length===1?t[0]:t.length>=3?`${t[t.length-1]} (${t[0]}/${t[1]})`:`${t[0]}/${t[t.length-1]}`}function va(e){return!e||!e.includes("/")?"":e.split("/",1)[0]??""}function wa(e){return e.startsWith("agent.")||e.startsWith("session.")?"agent":e.startsWith("bead.")||e.startsWith("convoy.")||e.startsWith("order.")?"work":e.startsWith("mail.")?"comms":(e.startsWith("request.result.")||e==="request.failed","system")}function Sa(e){const t={"session.started":"▶","session.ended":"■","session.crashed":"☠","session.suspended":"⏸","session.woke":"▶","agent.message":"💬","agent.output":"📝","agent.tool_call":"🛠","agent.tool_result":"✅","agent.error":"⚠","bead.created":"📿","bead.updated":"📝","bead.closed":"✅","convoy.created":"🚚","convoy.closed":"✅","mail.delivered":"📬","mail.read":"📨","request.failed":"❌"};return e.startsWith("request.result.")?"🔔":t[e]??"📋"}function Ca(e,t,n,a){const s=U(t);switch(e){case"session.started":return`${U(n)} started`;case"session.ended":return`${U(n)} ended`;case"session.crashed":return`${U(n)} crashed`;case"session.suspended":return`${U(n)} suspended`;case"session.woke":return`${U(n)} woke`;case"bead.created":return`${s} created bead ${n??""}`.trim();case"bead.updated":return`${s} updated bead ${n??""}`.trim();case"bead.closed":return`${s} closed bead ${n??""}`.trim();case"mail.delivered":return`${s} delivered mail`;case"mail.read":return`${s} read mail`;case"convoy.created":return`${s} created convoy ${n??""}`.trim();case"convoy.closed":return`${s} closed convoy ${n??""}`.trim();case"request.failed":return a??`${n??"request"} failed`;default:return e.startsWith("request.result.")?a??`${n??"request"} succeeded`:a??n??e}}function at(e,t){return e?e.length<=t?e:`${e.slice(0,t-1)}…`:""}function se(e){return typeof e!="number"||Number.isNaN(e)||e<=0?4:e}function on(e){switch(se(e)){case 1:return"badge-red";case 2:return"badge-orange";case 3:return"badge-yellow";default:return"badge-muted"}}function ue(e){switch((e??"").toLowerCase()){case"open":case"running":case"ready":case"working":return"badge-green";case"in_progress":case"pending":case"stale":case"warning":return"badge-yellow";case"closed":case"stopped":return"badge-muted";case"error":case"failed":case"stuck":return"badge-red";default:return"badge-blue"}}const Bt=1e3;async function Ea(){var Y,me,ge,V,X,W,T;const e=S(),t=c("status-banner");if(!t)return;if(!e){await Na(t);return}const n=Fe();if(Ct(n)){const $=n.kind==="not-running"?n.city.error??n.city.status??"City not running":"City unavailable";cn(e,"Sessions unavailable"),ka(t,$);return}const a=Je("status",e,$=>g.GET("/v0/city/{cityName}/status",{params:{path:{cityName:e}},signal:$})),s=Je("sessions",e,$=>g.GET("/v0/city/{cityName}/sessions",{params:{path:{cityName:e},query:{state:"active",peek:!0}},signal:$})),i=Je("beads",e,$=>g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"open",limit:500}},signal:$})),o=Je("convoys",e,$=>g.GET("/v0/city/{cityName}/convoys",{params:{path:{cityName:e},query:{limit:200}},signal:$}));s.then($=>Mt(e,$));const[l,u,y,f]=await Promise.all([a,s,i,o]);if(S()!==e)return;const d=((Y=u.data)==null?void 0:Y.items)??[],p=((me=y.data)==null?void 0:me.items)??[],m=((ge=f.data)==null?void 0:ge.items)??[];Mt(e,u);const h=d.filter($=>!$.pool||!$.running||!$.last_active?!1:Date.now()-new Date($.last_active).getTime()>=1800*1e3).length,v=p.filter($=>$.assignee&&$.status!=="closed").length,C=p.filter($=>se($.priority)<=2).length,b=d.filter($=>!$.running).length,N=!!(l.error||!l.data),k=N||!!(u.error||y.error||f.error),P=((V=l.data)==null?void 0:V.agents.running)??d.filter($=>$.running).length,M=((X=l.data)==null?void 0:X.work.in_progress)??v,x=((W=l.data)==null?void 0:W.work.open)??p.length,q=((T=l.data)==null?void 0:T.mail.unread)??"n/a",R=`${e}|${P}|${M}|${x}|${m.length}|${q}|${h}|${v}|${C}|${b}|${k}|${N}`;if(R!==Ye){Ye=R;const $=r("div",{class:"summary-stats"},[D(P,"Agents"),D(M,"Assigned"),D(x,"Beads"),D(m.length,"Convoys"),D(q,"Unread")]),L=r("div",{class:"summary-alerts"});K(L,N,"alert-yellow","Status API slow"),K(L,k&&!N,"alert-yellow","Partial data"),K(L,h>0,"alert-red",`${h} stuck`),K(L,v>0,"alert-yellow",`${v} assigned`),K(L,C>0,"alert-red",`${C} P1/P2`),K(L,b>0,"alert-red",`${b} dead`),L.childNodes.length||L.append(r("span",{class:"alert-item alert-green"},["All clear"])),E(t),t.append($,L)}}function ka(e,t){Ye="",E(e);const n=r("div",{class:"summary-stats"},[D(0,"Agents"),D(0,"Assigned"),D(0,"Beads"),D(0,"Convoys"),D("n/a","Unread")]),a=r("div",{class:"summary-alerts"},[r("span",{class:"alert-item alert-yellow"},[t])]);e.append(n,a)}async function Je(e,t,n){const a=new AbortController;let s=!1,i;return new Promise(o=>{i=setTimeout(()=>{if(s)return;s=!0;const l=new Error(`${e} request timed out after ${Bt}ms`);a.abort(),we("status","City status dependency timed out",{city:t,label:e}),o({error:l})},Bt),n(a.signal).then(l=>{s||(s=!0,clearTimeout(i),o(l))},l=>{s||(s=!0,clearTimeout(i),we("status","City status dependency failed",{city:t,error:l,label:e}),o({error:l}))})})}async function Na(e){var d,p;xa(),Ye="";const[t,n]=await Promise.all([g.GET("/health"),g.GET("/v0/cities")]);if(S()!=="")return;const a=t.data,s=((d=n.data)==null?void 0:d.items)??[],i=(a==null?void 0:a.cities_total)??s.length,o=(a==null?void 0:a.cities_running)??s.filter(m=>m.running===!0).length,l=Math.max(i-o,0),u=s.filter(m=>!!m.error).length;if(E(e),t.error&&n.error){e.append(r("div",{class:"banner-error"},["Supervisor status unavailable"]));return}const y=r("div",{class:"summary-stats"},[D(i,"🏙️ Cities"),D(o,"🟢 Running"),D(l,"⏸ Stopped"),D(La(a==null?void 0:a.uptime_sec),"⏱ Uptime")]),f=r("div",{class:"summary-alerts"});K(f,i===0,"alert-yellow","No registered cities"),K(f,l>0,"alert-yellow",`${l} ${l===1?"city":"cities"} not running`),K(f,u>0,"alert-red",`${u} ${u===1?"city":"cities"} reporting errors`),K(f,!!(a!=null&&a.startup&&!a.startup.ready),"alert-yellow",`⏳ Startup: ${((p=a==null?void 0:a.startup)==null?void 0:p.phase)||"starting"}`),f.childNodes.length||f.append(r("span",{class:"alert-item alert-green"},["✓ Supervisor ready"])),e.append(y,f)}function D(e,t){return r("div",{class:"stat"},[r("span",{class:"stat-value"},[String(e??0)]),r("span",{class:"stat-label"},[t])])}function K(e,t,n,a){t&&e.append(r("span",{class:`alert-item ${n}`},[a]))}let Ye="";function Mt(e,t){if(S()===e){if(t.error||!t.data){cn(e,"Sessions unavailable");return}$a(e,t.data.items??[])}}function $a(e,t){const n=c("scope-banner"),a=c("scope-badge"),s=c("scope-status");if(!n||!a||!s)return;const i=t.find(l=>l.configured_named_session&&!l.rig)??t.find(l=>!l.rig&&!l.pool);if(!i){n.classList.remove("attached","detached"),a.className="badge badge-cyan",a.textContent="City",E(s),s.append(H("City",e),H("Session","none"));return}n.classList.remove("attached","detached"),a.className="badge badge-cyan",a.textContent="City",E(s);const o=i.last_active?Date.now()-new Date(i.last_active).getTime()<rn:!1;s.append(H("City",e),H("Session",i.template),H("Activity",i.last_active?F(i.last_active):"Unknown",o?"active":"idle"),H("Terminal",i.attached?"Attached":"Detached"),H("State",i.running?"Running":"Stopped"))}function cn(e,t){const n=c("scope-banner"),a=c("scope-badge"),s=c("scope-status");!n||!a||!s||(n.classList.remove("attached","detached"),a.className="badge badge-muted",a.textContent="Unknown",E(s),s.append(H("Scope",e),H("Sessions",t)))}function xa(){const e=c("scope-banner"),t=c("scope-badge"),n=c("scope-status");!e||!t||!n||(e.classList.remove("attached","detached"),t.className="badge badge-muted",t.textContent="Supervisor",E(n),n.append(H("Scope","Fleet"),H("City","Select one")))}function H(e,t,n=""){return r("div",{class:"scope-stat"},[r("span",{class:"scope-stat-label"},[e]),r("span",{class:`scope-stat-value${n?` ${n}`:""}`},[t])])}function La(e){return!e||e<=0?"0m":e<3600?`${Math.max(1,Math.floor(e/60))}m`:e<86400?`${Math.floor(e/3600)}h`:`${Math.floor(e/86400)}d`}const Ta=e=>(e.client??fe).sse.get({url:"/v0/city/{cityName}/events/stream",...e}),Aa=e=>(e.client??fe).sse.get({url:"/v0/city/{cityName}/session/{id}/stream",...e}),Ra=e=>((e==null?void 0:e.client)??fe).sse.get({url:"/v0/events/stream",...e});let ce=0,ut=null;function qa(e){ut=e}function ln(e){ce=Math.max(0,e),document.body.dataset.pauseRefresh=ce>0?"true":"false"}function Q(){ln(ce+1)}function B(){const e=ce>0;if(ln(ce-1),e&&ce===0&&ut)try{ut()}catch(t){de("ui","popPause listener threw",{error:String(t)})}}function st(){return ce>0}function Ut(e,t){const n=c("output-panel"),a=c("output-panel-cmd"),s=c("output-panel-content");!n||!a||!s||(a.textContent=e,s.textContent=t,n.classList.add("open"))}function dn(){var e;(e=c("output-panel"))==null||e.classList.remove("open")}function w(e,t,n){const a=c("toast-container");if(!a)return;const s=document.createElement("div");s.className=`toast toast-${e}`,s.innerHTML=`<strong>${Dt(t)}</strong><div>${Dt(n)}</div>`,a.append(s);const i=e==="error"?9e3:5e3;window.requestAnimationFrame(()=>{s.classList.add("show")}),window.setTimeout(()=>{s.classList.remove("show"),window.setTimeout(()=>{s.remove()},300)},i)}function I(e,t,n="Unexpected dashboard error"){const a=t instanceof Error?t.message:n;de("ui",e,{error:t,fallbackMessage:n,message:a}),w("error",e,a)}function Oa(){var e,t;document.addEventListener("click",n=>{const a=n.target,s=a==null?void 0:a.closest(".collapse-btn");if(s){const y=s.closest(".panel");y==null||y.classList.toggle("collapsed");return}const i=a==null?void 0:a.closest(".expand-btn");if(!i)return;const o=i.closest(".panel");if(!o)return;const l=o.classList.contains("expanded"),u=!!document.querySelector(".panel.expanded");if(document.querySelectorAll(".panel.expanded").forEach(y=>{y.classList.remove("expanded");const f=y.querySelector(".expand-btn");f&&(f.textContent="Expand")}),l){B();return}o.classList.add("expanded"),i.textContent="✕ Close",u||Q()}),document.addEventListener("keydown",n=>{if(n.key!=="Escape")return;const a=document.querySelector(".panel.expanded");if(a){a.classList.remove("expanded");const s=a.querySelector(".expand-btn");s&&(s.textContent="Expand"),B()}}),(e=c("output-close-btn"))==null||e.addEventListener("click",()=>dn()),(t=c("output-copy-btn"))==null||t.addEventListener("click",async()=>{var a;const n=((a=c("output-panel-content"))==null?void 0:a.textContent)??"";try{await navigator.clipboard.writeText(n),w("success","Copied","Output copied to clipboard")}catch{w("error","Copy failed","Clipboard write was rejected")}})}function Dt(e){const t=document.createElement("div");return t.textContent=e,t.innerHTML}function un(e){return typeof e=="object"&&e!==null}function fn(e){return un(e)&&typeof e.timestamp=="string"}function yn(e){return un(e)&&typeof e.actor=="string"&&typeof e.seq=="number"&&typeof e.ts=="string"&&typeof e.type=="string"}function Pa(e){return yn(e)}function _a(e){return yn(e)&&typeof e.city=="string"}const Wt=[1e3,2e3,4e3,8e3,15e3],ja=15e3;function pn(e){return e<Wt.length?Wt[e]:ja}function Ia(e,t){var s;const n=new AbortController;let a=t==null?void 0:t.afterCursor;return(s=t==null?void 0:t.onStatus)==null||s.call(t,"connecting"),(async()=>{var l,u;let i=0,o=!1;for(;!n.signal.aborted;){try{const{stream:f}=await Ra({client:fe,query:a?{after_cursor:a}:void 0,signal:n.signal,onSseEvent:d=>{var h;i=0,o=!1,(h=t==null?void 0:t.onStatus)==null||h.call(t,"live");const p=d.event??"tagged_event",m=d.id!==void 0?String(d.id):void 0;if(m&&(a=m),p==="heartbeat"){if(!fn(d.data)){I("Invalid supervisor heartbeat frame",d);return}e({event:"heartbeat",id:m,data:d.data});return}if(p==="tagged_event"){if(!_a(d.data)){I("Invalid supervisor event frame",d);return}e({event:"tagged_event",id:m,data:d.data});return}I(`Unexpected supervisor SSE event: ${p}`,d)}});(l=t==null?void 0:t.onStatus)==null||l.call(t,"live");for await(const d of f);if(n.signal.aborted)break}catch(f){if(n.signal.aborted)return;o||(I("Supervisor event stream failed",f),o=!0)}(u=t==null?void 0:t.onStatus)==null||u.call(t,"reconnecting");const y=pn(i);i+=1,await mn(y,n.signal)}})(),{close:()=>n.abort()}}function Ba(e,t,n){var i;const a=new AbortController;let s=n==null?void 0:n.afterSeq;return(i=n==null?void 0:n.onStatus)==null||i.call(n,"connecting"),(async()=>{var u,y;let o=0,l=!1;for(;!a.signal.aborted;){try{const{stream:d}=await Ta({client:fe,path:{cityName:e},query:s?{after_seq:s}:void 0,signal:a.signal,onSseEvent:p=>{var v;o=0,l=!1,(v=n==null?void 0:n.onStatus)==null||v.call(n,"live");const m=p.event??"event",h=p.id!==void 0?String(p.id):void 0;if(h&&(s=h),m==="heartbeat"){if(!fn(p.data)){I("Invalid city heartbeat frame",p);return}t({event:"heartbeat",id:h,data:p.data});return}if(m==="event"){if(!Pa(p.data)){I("Invalid city event frame",p);return}t({event:"event",id:h,data:p.data});return}I(`Unexpected city SSE event: ${m}`,p)}});(u=n==null?void 0:n.onStatus)==null||u.call(n,"live");for await(const p of d);if(a.signal.aborted)break}catch(d){if(a.signal.aborted)return;l||(I("City event stream failed",d),l=!0)}(y=n==null?void 0:n.onStatus)==null||y.call(n,"reconnecting");const f=pn(o);o+=1,await mn(f,a.signal)}})(),{close:()=>a.abort()}}async function mn(e,t){if(!t.aborted)return new Promise(n=>{const a=setTimeout(()=>{t.removeEventListener("abort",s),n()},e),s=()=>{clearTimeout(a),t.removeEventListener("abort",s),n()};t.addEventListener("abort",s)})}function Ma(e,t,n){const a=new AbortController;return(async()=>{try{const{stream:s}=await Aa({client:fe,path:{cityName:e,id:t},signal:a.signal,onSseEvent:i=>{if(i.data===void 0){I("Session frame missing data",i);return}n({id:i.id!==void 0?String(i.id):void 0,type:i.event??"message",data:i.data})}});for await(const i of s);}catch(s){a.signal.aborted||I("Session stream failed",s)}})(),{close:()=>a.abort()}}function Ua(e){return e.event==="heartbeat"?"heartbeat":e.data.type}let Re=null,be="",ne="",Me=0;async function Da(){const e=S();if(!e){gn();return}const t=c("crew-loading"),n=c("crew-table"),a=c("crew-empty"),s=c("crew-tbody"),i=c("rigged-body"),o=c("pooled-body");if(!t||!n||!a||!s||!i||!o)return;ft("No crew configured"),t.style.display="block",n.style.display="none",a.style.display="none",E(s);const{data:l,error:u}=await g.GET("/v0/city/{cityName}/sessions",{params:{path:{cityName:e},query:{state:"active",peek:!0}}});if(u||!(l!=null&&l.items)){t.textContent="Failed to load crew",Se(i,"No rigged agents"),Se(o,"No pooled agents");return}const y=l.items,f=await Promise.all(y.map(async m=>{var v;return!!((v=(await g.GET("/v0/city/{cityName}/session/{id}/pending",{params:{path:{cityName:e,id:m.id}}})).data)!=null&&v.pending)})),d=new Map;await Promise.all(y.map(async m=>{var v;if(!m.active_bead||d.has(m.active_bead))return;const h=await g.GET("/v0/city/{cityName}/bead/{id}",{params:{path:{cityName:e,id:m.active_bead}}});d.set(m.active_bead,(v=h.data)!=null&&v.id?h.data.title??h.data.id:m.active_bead)}));const p=y;p.forEach((m,h)=>{const v=Wa(m,f[h]??!1),C=m.active_bead?at(d.get(m.active_bead)??m.active_bead,24):"—",b=r("tr",{},[r("td",{},[m.template]),r("td",{},[m.rig??"city"]),r("td",{},[r("span",{class:`badge ${ue(v)}`},[v])]),r("td",{},[C]),r("td",{class:je(m.last_active).colorClass?`activity-${je(m.last_active).colorClass}`:""},[r("span",{class:"activity-dot"}),` ${je(m.last_active).display}`]),r("td",{},[r("span",{class:`badge ${m.attached?"badge-green":"badge-muted"}`},[m.attached?"Attached":"Detached"])]),r("td",{},[za(m.template)," ",hn(m.id,m.template)])]);s.append(b)}),c("crew-count").textContent=String(p.length),t.style.display="none",p.length>0?n.style.display="table":(ft("No crew configured"),a.style.display="block"),Ga(y,d),Fa(y)}function gn(){const e=c("crew-loading"),t=c("crew-table"),n=c("crew-empty"),a=c("crew-tbody"),s=c("rigged-body"),i=c("pooled-body");!e||!t||!n||!a||!s||!i||(Ue(),c("crew-count").textContent="0",c("rigged-count").textContent="0",c("pooled-count").textContent="0",e.style.display="none",t.style.display="none",n.style.display="block",ft("Select a city to view crew"),E(a),Se(s,"Select a city to view rigged agents"),Se(i,"Select a city to view pooled agents"))}function ft(e){var t,n;(n=(t=c("crew-empty"))==null?void 0:t.querySelector("p"))==null||n.replaceChildren(document.createTextNode(e))}function Wa(e,t){return t?"questions":e.active_bead?"spinning":e.running?"idle":"finished"}function za(e){const t=r("button",{class:"attach-btn",type:"button"},["📎 Attach"]);return t.addEventListener("click",async()=>{const n=`gc agent attach ${e}`;try{await navigator.clipboard.writeText(n),w("success","Attach command copied",n)}catch{w("error","Copy failed",n)}}),t}function hn(e,t){const n=r("button",{class:"agent-log-link",type:"button","data-session-id":e},[t]);return n.addEventListener("click",()=>{Ja(e,t)}),n}function Ga(e,t){const n=c("rigged-body"),a=c("rigged-count");if(!n||!a)return;const s=e.filter(o=>o.rig&&o.pool);if(a.textContent=String(s.length),s.length===0){Se(n,"No rigged agents");return}const i=r("tbody");s.forEach(o=>{const l=je(o.last_active),u=o.active_bead?l.colorClass==="red"?"Stuck":l.colorClass==="yellow"?"Stale":"Working":"Idle";i.append(r("tr",{class:`rigged-${u.toLowerCase()}`},[r("td",{},[hn(o.id,o.template)]),r("td",{},[r("span",{class:"badge badge-muted"},[o.pool??"pool"])]),r("td",{},[o.rig??"city"]),r("td",{class:"rigged-issue"},[o.active_bead?`${o.active_bead} ${t.get(o.active_bead)??""}`.trim():"—"]),r("td",{},[r("span",{class:`badge ${ue(u)}`},[u])]),r("td",{class:`activity-${l.colorClass}`},[r("span",{class:"activity-dot"}),` ${l.display}`])]))}),E(n),n.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Agent"]),r("th",{},["Pool"]),r("th",{},["Rig"]),r("th",{},["Working On"]),r("th",{},["Status"]),r("th",{},["Activity"])])]),i]))}function Fa(e){const t=c("pooled-body"),n=c("pooled-count");if(!t||!n)return;const a=e.filter(i=>!i.rig&&i.pool);if(n.textContent=String(a.length),a.length===0){Se(t,"No pooled agents");return}const s=r("tbody");a.forEach(i=>{s.append(r("tr",{},[r("td",{},[i.template]),r("td",{},[r("span",{class:`badge ${i.active_bead?"badge-yellow":"badge-green"}`},[i.active_bead?"Working":"Idle"])]),r("td",{class:"status-hint"},[at(i.last_output,80)||"—"]),r("td",{},[F(i.last_active)])]))}),E(t),t.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Agent"]),r("th",{},["State"]),r("th",{},["Work"]),r("th",{},["Activity"])])]),s]))}function Se(e,t){E(e),e.append(r("div",{class:"empty-state"},[r("p",{},[t])]))}function Ha(){var e,t;(e=c("log-drawer-close-btn"))==null||e.addEventListener("click",()=>Ue()),(t=c("log-drawer-older-btn"))==null||t.addEventListener("click",()=>{Ie("crew","Load older transcript clicked",{hasCursor:ne!=="",sessionID:be}),!(!be||!ne)&&vn(be,!0)})}async function Ja(e,t){const n=c("agent-log-drawer"),a=c("log-drawer-agent-name"),s=c("log-drawer-messages"),i=c("log-drawer-loading");if(!n||!a||!s||!i)return;if(be===e&&n.style.display!=="none"){Ue();return}Ue(),be=e,ne="",Me=0,a.textContent=t,E(s),s.append(i),i.style.display="block",n.style.display="block",Q(),await vn(e,!1);const o=S();o&&(Re=Ma(o,e,l=>Va(l)))}function Ue(){Re==null||Re.close(),Re=null,be="",ne="";const e=c("agent-log-drawer");e&&e.style.display!=="none"&&(e.style.display="none",B())}function bn(){Ue()}async function vn(e,t){var y,f,d,p,m;const n=S(),a=c("log-drawer-messages"),s=c("log-drawer-loading"),i=c("log-drawer-older-btn"),o=c("log-drawer-count");if(!n||!a||!s||!i||!o)return;s.style.display="block";const l=await g.GET("/v0/city/{cityName}/session/{id}/transcript",{params:{path:{cityName:n,id:e},query:{tail:String(t?50:25),before:t?ne:void 0}}});if(s.style.display="none",l.error||!l.data){w("error","Transcript failed",((y=l.error)==null?void 0:y.detail)??"Could not load transcript");return}const u=document.createDocumentFragment();for(const h of l.data.turns??[])u.append(wn(h.role,h.text,h.timestamp)),Me+=1;t?a.prepend(u):(E(a),a.append(u)),a.append(s),s.style.display="none",o.textContent=String(Me),ne=((f=l.data.pagination)==null?void 0:f.truncated_before_message)??"",i.style.display=(d=l.data.pagination)!=null&&d.has_older_messages&&ne?"inline-flex":"none",Ie("crew","Transcript loaded",{hasOlderMessages:((p=l.data.pagination)==null?void 0:p.has_older_messages)??!1,nextBeforeCursor:ne,prepend:t,sessionID:e,turnCount:((m=l.data.turns)==null?void 0:m.length)??0})}function Va(e){var s;const t=c("log-drawer-messages");if(!t)return;const n=e.data;if(e.type!=="message"||!((s=n==null?void 0:n.data)!=null&&s.message))return;t.append(wn(n.data.message.role??"agent",n.data.message.text??"",n.data.message.timestamp)),Me+=1,c("log-drawer-count").textContent=String(Me);const a=c("log-drawer-body");a&&(a.scrollTop=a.scrollHeight)}function wn(e,t,n){return r("div",{class:"log-msg"},[r("div",{class:"log-msg-header"},[r("span",{class:`log-msg-type log-msg-type-${Ka(e)}`},[e]),r("span",{class:"log-msg-time"},[F(n)])]),r("div",{class:"log-msg-body"},[t])])}function Ka(e){switch((e??"").toLowerCase()){case"assistant":case"agent":return"assistant";case"system":return"system";case"result":return"result";default:return"user"}}const Qa=3e4,yt=new Map,qe=new Map;async function rt(e=!1){const t=S(),n=Date.now(),a=yt.get(t);if(!e&&a&&n-a.fetchedAt<Qa)return a;const s=qe.get(t);if(s)return s;const i=Ya(t).then(o=>(yt.set(t,o),qe.delete(t),o)).catch(o=>{throw qe.delete(t),o});return qe.set(t,i),i}async function Ya(e){var l,u,y,f,d,p,m,h,v,C,b,N;const t={agents:[],rigs:[],sessions:[],beads:[],mail:[],fetchedAt:Date.now()};if(!e)return t;const[n,a,s,i]=await Promise.all([g.GET("/v0/city/{cityName}/config",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/rigs",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"open"}}}),g.GET("/v0/city/{cityName}/mail",{params:{path:{cityName:e}}})]);n.error&&we("options","Config options request failed",{city:e,detail:n.error.detail??null});const o=(((l=n.data)==null?void 0:l.agents)??[]).map(k=>({id:k.name??"",label:k.name??"",recipient:k.name??""})).filter(k=>k.recipient!=="");return Ie("options","Fetched options",{agentOptions:o.map(k=>k.recipient),beads:((y=(u=s.data)==null?void 0:u.items)==null?void 0:y.length)??0,city:e,configAgents:((d=(f=n.data)==null?void 0:f.agents)==null?void 0:d.length)??0,mail:((m=(p=i.data)==null?void 0:p.items)==null?void 0:m.length)??0,rigs:((v=(h=a.data)==null?void 0:h.items)==null?void 0:v.length)??0}),{agents:[...new Set(o.map(k=>k.recipient))].sort(),rigs:(((C=a.data)==null?void 0:C.items)??[]).map(k=>k.name??"").filter(Boolean),sessions:o,beads:(((b=s.data)==null?void 0:b.items)??[]).map(k=>({id:k.id??"",title:k.title??""})),mail:(((N=i.data)==null?void 0:N.items)??[]).map(k=>({id:k.id??"",subject:k.subject??""})),fetchedAt:Date.now()}}function Xa(){yt.clear(),qe.clear()}let Oe=null,Pe=null;function Za(){var e,t,n,a,s,i,o,l,u,y;(e=c("action-modal-close-btn"))==null||e.addEventListener("click",()=>xe(null)),(t=c("action-modal-cancel-btn"))==null||t.addEventListener("click",()=>xe(null)),(a=(n=c("action-modal"))==null?void 0:n.querySelector(".modal-backdrop"))==null||a.addEventListener("click",()=>xe(null)),(s=c("action-form"))==null||s.addEventListener("submit",f=>{var h,v,C;f.preventDefault();const d=((h=c("action-bead-id"))==null?void 0:h.value.trim())??"",p=((v=c("action-target"))==null?void 0:v.value.trim())??"",m=((C=c("action-rig"))==null?void 0:C.value.trim())??"";!d||!p||xe({beadID:d,rig:m,target:p})}),(i=c("confirm-modal-close-btn"))==null||i.addEventListener("click",()=>Le(!1)),(o=c("confirm-modal-cancel-btn"))==null||o.addEventListener("click",()=>Le(!1)),(l=c("confirm-modal-confirm-btn"))==null||l.addEventListener("click",()=>Le(!0)),(y=(u=c("confirm-modal"))==null?void 0:u.querySelector(".modal-backdrop"))==null||y.addEventListener("click",()=>Le(!1)),document.addEventListener("keydown",f=>{if(f.key==="Escape"){if(Ce("action-modal")){xe(null);return}Ce("confirm-modal")&&Le(!1)}})}async function kt(e){const t=c("action-modal"),n=c("action-form"),a=c("action-modal-title"),s=c("action-modal-submit-btn"),i=c("action-bead-group"),o=c("action-bead-id"),l=c("action-bead-hint"),u=c("action-target"),y=c("action-target-label"),f=c("action-rig-group"),d=c("action-rig"),p=c("action-modal-help"),m=c("action-target-list"),h=c("action-rig-list");if(!t||!n||!a||!s||!i||!o||!l||!u||!y||!f||!d||!p||!m||!h)return I("Action modal unavailable",new Error("missing action modal DOM")),null;const v=await rt();return zt(m,v.agents),zt(h,v.rigs),a.textContent=e.title,s.textContent=ts(e.mode),y.textContent=e.mode==="reassign"?"Assignee":"Target agent or pool",p.textContent=ns(e.mode),o.value=e.beadID??"",o.readOnly=!!e.beadID,i.classList.toggle("readonly",o.readOnly),l.textContent=e.beadLabel??"",u.value=e.initialTarget??"",d.value=e.initialRig??"",f.hidden=e.mode==="reassign",d.disabled=e.mode==="reassign",Ce("action-modal")||Q(),t.style.display="flex",window.setTimeout(()=>{if(e.beadID){u.focus();return}o.focus()},0),new Promise(C=>{Oe=C})}async function es(e){const t=c("confirm-modal"),n=c("confirm-modal-title"),a=c("confirm-modal-body"),s=c("confirm-modal-confirm-btn");return!t||!n||!a||!s?(I("Confirm modal unavailable",new Error("missing confirm modal DOM")),!1):(n.textContent=e.title,a.textContent=e.body,s.textContent=e.confirmLabel,Ce("confirm-modal")||Q(),t.style.display="flex",new Promise(i=>{Pe=i}))}function zt(e,t){E(e),t.forEach(n=>{e.append(r("option",{value:n}))})}function ts(e){switch(e){case"assign":return"Assign";case"reassign":return"Reassign";default:return"Sling"}}function ns(e){switch(e){case"assign":return"Launch a bead directly to a target, with an optional rig override.";case"reassign":return"Pick a new assignee from the active city sessions or type one manually.";default:return"Dispatch this bead to a target, with an optional rig constraint."}}function xe(e){const t=c("action-modal"),n=c("action-form");if(!t||!n)return;const a=Ce("action-modal");t.style.display="none",n.reset(),c("action-rig").disabled=!1,c("action-bead-id").readOnly=!1,a&&B(),Oe==null||Oe(e),Oe=null}function Le(e){const t=c("confirm-modal");if(!t)return;const n=Ce("confirm-modal");t.style.display="none",n&&B(),Pe==null||Pe(e),Pe=null}function Ce(e){var t;return((t=c(e))==null?void 0:t.style.display)==="flex"}let Xe=[],pt="ready",Ee="all",it="";async function ye(){var o,l,u,y;const e=S(),t=c("issues-list");if(!t)return;if(!e){Sn();return}const[n,a,s]=await Promise.all([g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"open",limit:500}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"in_progress",limit:500}}}),rt()]);if(n.error&&a.error||!((o=n.data)!=null&&o.items)&&!((l=a.data)!=null&&l.items)){E(t),t.append(r("div",{class:"panel-error"},["Could not load beads."]));return}Xe=rs([...((u=n.data)==null?void 0:u.items)??[],...((y=a.data)==null?void 0:y.items)??[]].filter(f=>!ss(f))),c("issues-count").textContent=String(Xe.length);const i=c("rig-filter-tabs");i&&(E(i),i.append(mt("all",Ee==="all")),s.rigs.forEach(f=>i.append(mt(f,Ee===f)))),Nt()}function Sn(){const e=c("issues-list"),t=c("rig-filter-tabs"),n=c("issue-detail");if(!e||!t||!n)return;he();const a=n.style.display==="block";n.style.display="none",e.style.display="block",as(),E(e),e.append(r("div",{class:"empty-state"},[r("p",{},["Select a city to view beads"])])),E(t),Ee="all",it="",Xe=[],t.append(mt("all",!0)),c("issues-count").textContent="0",a&&B()}function as(){var t,n;["issue-detail-id","issue-detail-title-text","issue-detail-description","issue-detail-status","issue-detail-type","issue-detail-owner","issue-detail-created"].forEach(a=>{const s=c(a);s&&(s.textContent="")});const e=c("issue-detail-priority");e&&(e.className="badge",e.textContent=""),["issue-detail-actions","issue-detail-depends-on","issue-detail-blocks"].forEach(a=>{const s=c(a);s&&E(s)}),(t=c("issue-detail-deps"))==null||t.style.setProperty("display","none"),(n=c("issue-detail-blocks-section"))==null||n.style.setProperty("display","none")}function Nt(){const e=c("issues-list");if(!e)return;E(e);const t=Xe.filter(a=>{const s=a.assignee?"progress":"ready",i=pt==="all"||pt===s,o=Ee==="all"||ct(a)===Ee;return i&&o});if(t.length===0){e.append(r("div",{class:"empty-state"},[r("p",{},["No beads"])]));return}const n=r("tbody");t.forEach(a=>{const s=r("tr",{class:`issue-row priority-${se(a.priority)}`,"data-issue-id":a.id??"","data-status":a.assignee?"progress":"ready","data-rig":ct(a)},[r("td",{},[r("span",{class:`badge ${on(a.priority)}`},[`P${se(a.priority)}`])]),r("td",{},[r("span",{class:"issue-id"},[a.id??""])]),r("td",{class:"issue-title"},[at(a.title??a.id??"",80)]),r("td",{class:"issue-rig"},[ct(a)]),r("td",{class:"issue-status"},[a.assignee?r("span",{class:"badge badge-blue",title:a.assignee},[a.assignee]):r("span",{class:"badge badge-green"},["Ready"])]),r("td",{class:"issue-age"},[F(a.created_at)]),r("td",{},[hs(a.id??"")])]);s.addEventListener("click",i=>{i.target.closest(".sling-btn")||a.id&&pe(a.id)}),n.append(s)}),e.append(r("table",{id:"work-table"},[r("thead",{},[r("tr",{},[r("th",{},["Pri"]),r("th",{},["ID"]),r("th",{},["Title"]),r("th",{},["Rig"]),r("th",{},["Status"]),r("th",{},["Age"]),r("th",{},["Actions"])])]),n]))}function mt(e,t){const n=r("button",{class:`rig-btn${t?" active":""}`,"data-rig":e},[e==="all"?"All":e]);return n.addEventListener("click",()=>{Ee=e,document.querySelectorAll(".rig-btn").forEach(a=>a.classList.remove("active")),n.classList.add("active"),Nt()}),n}function ct(e){var t;return((t=e.id)==null?void 0:t.split("-")[0])??"city"}function ss(e){return(e.issue_type??"").toLowerCase()==="convoy"?!0:(e.labels??[]).some(t=>t.startsWith("gc:queue")||t.startsWith("gc:message"))}function rs(e){return[...e].sort((t,n)=>{const a=se(t.priority),s=se(n.priority);return a!==s?a-s:(n.created_at??"").localeCompare(t.created_at??"")})}function is(){var e,t,n,a,s,i,o;document.querySelectorAll(".tab-btn").forEach(l=>{l.addEventListener("click",u=>{const y=u.currentTarget;pt=y.dataset.tab??"ready",document.querySelectorAll(".tab-btn").forEach(f=>f.classList.remove("active")),y.classList.add("active"),Nt()})}),(e=c("new-issue-btn"))==null||e.addEventListener("click",()=>Cn()),(t=c("issue-modal-close-btn"))==null||t.addEventListener("click",()=>he()),(n=c("issue-modal-cancel-btn"))==null||n.addEventListener("click",()=>he()),(s=(a=c("issue-modal"))==null?void 0:a.querySelector(".modal-backdrop"))==null||s.addEventListener("click",()=>he()),(i=c("issue-form"))==null||i.addEventListener("submit",l=>{l.preventDefault(),os()}),(o=c("issue-back-btn"))==null||o.addEventListener("click",()=>fs()),document.addEventListener("keydown",l=>{var u;l.key==="Escape"&&((u=c("issue-modal"))==null?void 0:u.style.display)==="block"&&he()})}function Cn(){var t,n,a;if(!S()){w("info","No city selected","Select a city to create a bead");return}const e=c("issue-modal");e&&(e.style.display!=="block"&&Q(),e.style.display="block",(n=(t=c("issues-panel"))==null?void 0:t.scrollIntoView)==null||n.call(t,{behavior:"smooth",block:"center"}),(a=c("issue-title"))==null||a.focus())}function he(){var n;const e=c("issue-modal");if(!e)return;const t=e.style.display==="block";e.style.display="none",(n=c("issue-form"))==null||n.reset(),t&&B()}async function os(){var s,i,o;const e=((s=c("issue-title"))==null?void 0:s.value.trim())??"",t=((i=c("issue-description"))==null?void 0:i.value.trim())??"",n=Number(((o=c("issue-priority"))==null?void 0:o.value)??"2");if(!e)return;const a=await bs({title:e,description:t,priority:n});if(!a.ok){w("error","Create failed",a.error??"Could not create issue");return}w("success","Issue created",e),he(),await ye()}async function pe(e){var l,u,y;const t=S();if(!t)return;it=e,((l=c("issue-detail"))==null?void 0:l.style.display)!=="block"&&Q(),c("issues-list").style.display="none",c("issue-detail").style.display="block";const[n,a,s]=await Promise.all([g.GET("/v0/city/{cityName}/bead/{id}",{params:{path:{cityName:t,id:e}}}),g.GET("/v0/city/{cityName}/bead/{id}/deps",{params:{path:{cityName:t,id:e}}}),rt()]);if(n.error||!n.data){w("error","Issue failed",((u=n.error)==null?void 0:u.detail)??"Could not load bead");return}const i=n.data;c("issue-detail-id").textContent=i.id??e,c("issue-detail-title-text").textContent=i.title??e,c("issue-detail-description").textContent=i.description||"(no description)";const o=c("issue-detail-priority");o.className=`badge ${on(i.priority)}`,o.textContent=`P${se(i.priority)}`,c("issue-detail-status").textContent=i.status??"open",c("issue-detail-status").className=`issue-status ${i.status??"open"}`,c("issue-detail-type").textContent=i.issue_type?`Type: ${i.issue_type}`:"",c("issue-detail-owner").textContent=i.assignee?`Owner: ${i.assignee}`:"Owner: unassigned",c("issue-detail-created").textContent=i.created_at?`Created: ${F(i.created_at)}`:"",ls(i,s.agents),cs(((y=a.data)==null?void 0:y.children)??[])}function cs(e){const t=c("issue-detail-deps"),n=c("issue-detail-depends-on"),a=c("issue-detail-blocks-section"),s=c("issue-detail-blocks");if(!(!t||!n||!a||!s)){if(E(n),E(s),e.length===0){t.style.display="none",a.style.display="none";return}t.style.display="block",e.forEach(i=>{const o=r("span",{class:"issue-dep-item","data-issue-id":i.id??""},[`→ ${i.id??""}`]);o.addEventListener("click",()=>{i.id&&pe(i.id)}),n.append(o)}),a.style.display="none"}}function ls(e,t){const n=c("issue-detail-actions");if(!n||!e.id)return;E(n);const a=r("div",{class:"issue-actions-bar"}),s=e.status==="closed"?lt("↺ Reopen","reopen",()=>void ps(e.id)):lt("✓ Close","close",()=>void ys(e.id));a.append(s),e.status!=="closed"&&a.append(lt("🚚 Sling","sling",()=>void En(e.id)));const i=r("div",{class:"issue-action-group"},[r("label",{class:"issue-action-label"},["Priority"]),ds(e.id,e.priority)]),o=r("div",{class:"issue-action-group"},[r("label",{class:"issue-action-label"},["Assign"]),us(e.id,e.assignee,t)]);n.append(a,i,o)}function lt(e,t,n){const a=r("button",{class:`issue-action-btn ${t}`,type:"button"},[e]);return a.addEventListener("click",n),a}function ds(e,t){const n=r("select",{class:"issue-action-select",id:"issue-action-priority","aria-label":"Priority"});return[1,2,3,4].forEach(a=>{const s=r("option",{value:a,selected:se(t)===a},[`P${a}`]);n.append(s)}),n.addEventListener("change",()=>{ms(e,Number(n.value))}),n}function us(e,t,n){const a=r("select",{class:"issue-action-select",id:"issue-action-assignee","aria-label":"Assignee"});return a.append(r("option",{value:""},["Unassigned"])),n.forEach(s=>{a.append(r("option",{value:s,selected:t===s},[s]))}),a.addEventListener("change",()=>{gs(e,a.value)}),a}function fs(){const e=c("issue-detail"),t=(e==null?void 0:e.style.display)==="block";e.style.display="none",c("issues-list").style.display="block",it="",t&&B()}async function ys(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/close",{params:{path:{cityName:t,id:e},header:O}});if(n.error){w("error","Close failed",n.error.detail??"Could not close issue");return}w("success","Closed",e),await ye(),await pe(e)}async function ps(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/reopen",{params:{path:{cityName:t,id:e},header:O}});if(n.error){w("error","Reopen failed",n.error.detail??"Could not reopen issue");return}w("success","Reopened",e),await ye(),await pe(e)}async function ms(e,t){const n=S();if(!n)return;const a=await g.POST("/v0/city/{cityName}/bead/{id}/update",{params:{path:{cityName:n,id:e},header:O},body:{priority:t}});if(a.error){w("error","Priority failed",a.error.detail??"Could not update priority");return}w("success","Priority updated",`${e} → P${t}`),await ye(),await pe(e)}async function gs(e,t){const n=S();if(!n)return;const a=await g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:n,id:e},header:O},body:{assignee:t}});if(a.error){w("error","Assign failed",a.error.detail??"Could not update assignee");return}w("success","Assignment updated",t||"Unassigned"),await ye(),await pe(e)}async function En(e){const t=S();if(!t)return;const n=await kt({beadID:e,beadLabel:e,mode:"sling",title:"Sling Bead"});if(!n)return;const a=await g.POST("/v0/city/{cityName}/sling",{params:{path:{cityName:t},header:O},body:{bead:e,target:n.target,rig:n.rig||void 0}});if(a.error){w("error","Sling failed",a.error.detail??"Could not sling issue");return}w("success","Work assigned",`${e} → ${n.target}`),await ye(),it===e&&await pe(e)}function hs(e){const t=r("button",{class:"sling-btn",type:"button","data-bead-id":e},["Sling"]);return t.addEventListener("click",n=>{n.stopPropagation(),En(e)}),t}async function bs(e){const t=S();if(!t)return{ok:!1,error:"no city selected"};const{error:n}=await g.POST("/v0/city/{cityName}/beads",{params:{path:{cityName:t},header:O},body:{title:e.title,description:e.description,rig:e.rig,priority:e.priority,assignee:e.assignee}});return n?{ok:!1,error:n.detail??n.title??"create failed"}:{ok:!0}}let G="inbox",_e=[],A=null;async function He(){const e=S(),t=c("mail-loading"),n=c("mail-threads"),a=c("mail-empty"),s=c("mail-all");if(!t||!n||!a||!s)return;if(!e){kn();return}$t("No mail in inbox"),t.style.display="block",n.style.display="none",a.style.display="none";const{data:i,error:o}=await g.GET("/v0/city/{cityName}/mail",{params:{path:{cityName:e},query:{status:"all",limit:200}}});if(t.style.display="none",o||!(i!=null&&i.items)){E(n),n.append(r("div",{class:"panel-error"},["Could not load mail."])),n.style.display="block";return}_e=[...i.items].sort((l,u)=>(u.created_at??"").localeCompare(l.created_at??"")),c("mail-count").textContent=String(_e.length),vs(_e),ws(_e),Es()}function kn(){const e=c("mail-loading"),t=c("mail-threads"),n=c("mail-empty"),a=c("mail-all");if(!e||!t||!n||!a)return;le()?(J(G),B()):J(G),A=null,_e=[],c("mail-count").textContent="0",e.style.display="none",E(t),E(a),t.style.display="none",$t("Select a city to view mail"),n.style.display=G==="inbox"?"block":"none",a.append(r("div",{class:"empty-state"},[r("p",{},["Select a city to view mail traffic"])]))}function $t(e){var t,n;(n=(t=c("mail-empty"))==null?void 0:t.querySelector("p"))==null||n.replaceChildren(document.createTextNode(e))}function vs(e){const t=c("mail-threads"),n=c("mail-empty");if(!t||!n)return;const a=As(e);if(E(t),a.length===0){t.style.display="none",$t("No mail in inbox"),n.style.display="block";return}n.style.display="none",a.forEach(s=>{const i=s.messages[s.messages.length-1],o=(i.body??"").trim().slice(0,60),l=r("div",{class:`mail-thread${s.unreadCount>0?" mail-thread-unread":""}`},[r("div",{class:"mail-thread-header"},[r("div",{class:"mail-thread-left"},[r("span",{class:"mail-from"},[U(i.from)])]),r("div",{class:"mail-thread-center"},[r("span",{class:"mail-subject"},[s.subject||"(no subject)"]),o?r("span",{class:"mail-thread-preview"},[` — ${o}`]):null]),r("div",{class:"mail-thread-right"},[r("span",{class:"mail-time"},[Et(i.created_at)]),s.unreadCount>0?r("span",{class:"badge badge-unread"},[`${s.unreadCount} unread`]):null])])]);l.addEventListener("click",()=>{Ss(s.id)}),t.append(l)}),t.style.display=G==="inbox"?"block":"none"}function ws(e){const t=c("mail-all");if(!t)return;if(E(t),e.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No mail traffic"])]));return}const n=r("tbody");e.forEach(a=>{const s=r("tr",{class:`mail-row${a.read?"":" mail-unread"}`},[r("td",{class:"mail-from"},[U(a.from)]),r("td",{class:"mail-to"},[U(a.to)]),r("td",{},[r("span",{class:"mail-subject"},[a.subject??"(no subject)"])]),r("td",{class:"mail-time"},[F(a.created_at)])]);s.addEventListener("click",()=>{a.id&&Cs(a.id)}),n.append(s)}),t.append(r("table",{class:"mail-all-table"},[r("thead",{},[r("tr",{},[r("th",{},["From"]),r("th",{},["To"]),r("th",{},["Subject"]),r("th",{},["Time"])])]),n])),t.style.display=G==="all"?"block":"none"}async function Ss(e){var i,o;const t=S();if(!t)return;const n=await g.GET("/v0/city/{cityName}/mail/thread/{id}",{params:{path:{cityName:t,id:e}}});if(n.error||!((i=n.data)!=null&&i.items)||n.data.items.length===0){w("error","Thread failed",((o=n.error)==null?void 0:o.detail)??"Could not load mail thread");return}const a=n.data.items,s=a[a.length-1]??a[0];A=s,Nn(s,a)}async function Cs(e){var a;const t=S();if(!t)return;const n=await g.GET("/v0/city/{cityName}/mail/{id}",{params:{path:{cityName:t,id:e}}});if(n.error||!n.data){w("error","Message failed",((a=n.error)==null?void 0:a.detail)??"Could not load message");return}A=n.data,await g.POST("/v0/city/{cityName}/mail/{id}/read",{params:{path:{cityName:t,id:e},header:O}}),A.read=!0,Nn(A,[A]),He()}function Nn(e,t){const n=le();c("mail-detail-subject").textContent=e.subject??"(no subject)",c("mail-detail-from").textContent=U(e.from),c("mail-detail-time").textContent=F(e.created_at);const a=c("mail-detail-body");a&&(E(a),t.forEach((s,i)=>{i>0&&a.append(r("hr")),a.append(r("div",{class:"mail-thread-msg-header"},[r("span",{class:"mail-from"},[U(s.from)]),r("span",{class:"mail-time"},[F(s.created_at)])]),r("div",{class:"mail-thread-msg-subject"},[s.subject??"(no subject)"]),r("pre",{},[s.body??""]))})),$n(),J("detail"),xn("mail-detail"),n||Q()}function J(e){const t=c("mail-list"),n=c("mail-all"),a=c("mail-detail"),s=c("mail-compose");!t||!n||!a||!s||(t.style.display=e==="inbox"?"block":"none",n.style.display=e==="all"?"block":"none",a.style.display=e==="detail"?"block":"none",s.style.display=e==="compose"?"block":"none")}function Es(){var e,t;((e=c("mail-compose"))==null?void 0:e.style.display)==="block"||((t=c("mail-detail"))==null?void 0:t.style.display)==="block"||J(G)}function ks(){var e,t,n,a,s,i,o,l;document.querySelectorAll(".mail-tab").forEach(u=>{u.addEventListener("click",y=>{const f=y.currentTarget;G=f.dataset.tab??"inbox",document.querySelectorAll(".mail-tab").forEach(d=>d.classList.remove("active")),f.classList.add("active"),J(G)})}),(e=c("mail-back-btn"))==null||e.addEventListener("click",()=>{const u=le();J(G),A=null,u&&B()}),(t=c("compose-mail-btn"))==null||t.addEventListener("click",()=>{gt()}),(n=c("compose-back-btn"))==null||n.addEventListener("click",()=>{const u=!!A,y=le();J(u?"detail":G),y&&!u&&B()}),(a=c("compose-cancel-btn"))==null||a.addEventListener("click",()=>{const u=le();J(G),u&&B()}),(s=c("mail-reply-btn"))==null||s.addEventListener("click",()=>{A!=null&&A.id&&gt(A)}),(i=c("mail-send-btn"))==null||i.addEventListener("click",()=>{Ns()}),(o=c("mail-archive-btn"))==null||o.addEventListener("click",()=>{A!=null&&A.id&&$s(A.id)}),(l=c("mail-toggle-unread-btn"))==null||l.addEventListener("click",()=>{A!=null&&A.id&&xs(A)})}async function gt(e){if(!S()){w("info","No city selected","Select a city to compose mail"),we("mail","Compose blocked without city",{replyTo:(e==null?void 0:e.id)??null});return}const t=c("compose-to");if(!t)return;const n=le();E(t),t.append(r("option",{value:""},["Select recipient…"]));try{const a=await rt();a.sessions.forEach(s=>{t.append(r("option",{value:s.recipient},[s.label]))}),ee("mail","Compose options loaded",{city:S(),recipients:a.sessions.length,replyTo:(e==null?void 0:e.id)??null})}catch(a){de("mail","Compose options failed",{city:S(),error:a}),I("Mail options failed",a,"Could not load recipients")}c("compose-subject").value=e?Ls(e.subject??""):"",c("compose-body").value="",c("compose-reply-to").value=(e==null?void 0:e.id)??"",c("mail-compose-title").textContent=e?"Reply":"New Message",e!=null&&e.from&&(Ts(t,e.from),t.value=e.from),J("compose"),xn("compose-subject"),ee("mail","Compose form opened",{city:S(),replyTo:(e==null?void 0:e.id)??null,selectedRecipient:t.value||null}),n||Q()}async function Ns(){var l,u,y,f;const e=S();if(!e)return;const t=((l=c("compose-to"))==null?void 0:l.value)??"",n=((u=c("compose-subject"))==null?void 0:u.value.trim())??"",a=((y=c("compose-body"))==null?void 0:y.value)??"",s=((f=c("compose-reply-to"))==null?void 0:f.value)??"";if(!t||!n){w("error","Missing fields","Recipient and subject are required"),we("mail","Send blocked by missing fields",{bodyLength:a.length,city:e,subject:n,to:t});return}ee("mail","Send requested",{bodyLength:a.length,city:e,replyTo:s||null,subject:n,to:t});const i=s?await g.POST("/v0/city/{cityName}/mail/{id}/reply",{params:{path:{cityName:e,id:s},header:O},body:{body:a,subject:n}}):await g.POST("/v0/city/{cityName}/mail",{params:{path:{cityName:e},header:O},body:{to:t,subject:n,body:a,from:"dashboard"}});if(i.error){de("mail","Send failed",{bodyLength:a.length,city:e,error:i.error,replyTo:s||null,subject:n,to:t}),w("error","Send failed",i.error.detail??"Could not send message");return}ee("mail","Send succeeded",{bodyLength:a.length,city:e,replyTo:s||null,subject:n,to:t}),w("success","Message sent",n);const o=le();J("inbox"),A=null,o&&B(),await He()}async function $s(e){var s;const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/mail/{id}/archive",{params:{path:{cityName:t,id:e},header:O}});if(n.error){w("error","Archive failed",n.error.detail??"Could not archive message");return}w("success","Archived",e);const a=((s=c("mail-detail"))==null?void 0:s.style.display)==="block";J(G),A=null,a&&B(),await He()}async function xs(e){const t=S();if(!t||!e.id)return;const n=e.read?"/v0/city/{cityName}/mail/{id}/mark-unread":"/v0/city/{cityName}/mail/{id}/read",a=await g.POST(n,{params:{path:{cityName:t,id:e.id},header:O}});if(a.error){w("error","Update failed",a.error.detail??"Could not update message");return}e.read=!e.read,A={...e},$n(),w("success","Updated",e.subject??e.id),await He()}function $n(){const e=c("mail-toggle-unread-btn");e&&(e.textContent=A!=null&&A.read?"Mark unread":"Mark read")}function le(){var e,t;return((e=c("mail-detail"))==null?void 0:e.style.display)==="block"||((t=c("mail-compose"))==null?void 0:t.style.display)==="block"}function Ls(e){return e?e.toLowerCase().startsWith("re:")?e:`Re: ${e}`:"Re:"}function Ts(e,t){!t||[...e.options].some(n=>n.value===t)||e.append(r("option",{value:t},[t]))}function xn(e){var t,n;(n=(t=c("mail-panel"))==null?void 0:t.scrollIntoView)==null||n.call(t,{behavior:"smooth",block:"center"}),window.setTimeout(()=>{var a;(a=c(e))==null||a.focus()},0)}function As(e){const t=new Map;e.forEach(i=>{i.id&&t.set(i.id,i)});function n(i){let o=i;const l=new Set;for(;o.reply_to&&o.id&&!l.has(o.id);){l.add(o.id);const u=t.get(o.reply_to);if(!u)break;o=u}return o.thread_id??o.id??Math.random().toString(36)}const a=new Map;e.forEach(i=>{const o=n(i),l=a.get(o)??{id:o,messages:[],subject:i.subject??"",unreadCount:0};l.messages.push(i),i.read||(l.unreadCount+=1),!l.subject&&i.subject&&(l.subject=i.subject),a.set(o,l)});const s=[...a.values()];return s.forEach(i=>{i.messages.sort((o,l)=>(o.created_at??"").localeCompare(l.created_at??""))}),s.sort((i,o)=>{var y,f;const l=((y=i.messages[i.messages.length-1])==null?void 0:y.created_at)??"";return(((f=o.messages[o.messages.length-1])==null?void 0:f.created_at)??"").localeCompare(l)}),s}let ve="";async function xt(){var o;const e=S(),t=c("convoy-list");if(!t)return;if(!e){Ln();return}const n=await g.GET("/v0/city/{cityName}/convoys",{params:{path:{cityName:e},query:{limit:200}}});if(n.error||!((o=n.data)!=null&&o.items)){E(t),t.append(r("div",{class:"panel-error"},["Could not load convoys."]));return}const s=(await Promise.all(n.data.items.map(async l=>Rs(e,l.id??"")))).filter(l=>l!==null);if(c("convoy-count").textContent=String(s.length),E(t),s.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No active convoys"])]));return}const i=r("tbody");s.forEach(l=>{const u=r("tr",{class:"convoy-row","data-convoy-id":l.id},[r("td",{},[r("span",{class:`badge ${ue(Tn(l))}`},[qs(l)])]),r("td",{},[r("span",{class:"convoy-id"},[l.id]),l.title?r("div",{class:"convoy-title"},[l.title]):null,l.assignees.length?r("div",{class:"convoy-assignees"},l.assignees.map(y=>r("span",{class:"assignee-chip"},[y]))):null]),r("td",{class:"convoy-progress-cell"},[r("div",{class:"convoy-progress-header"},[r("span",{class:"convoy-progress-fraction"},[`${l.closed}/${l.total}`]),l.total>0?r("span",{class:"convoy-progress-pct"},[`${l.progressPct}%`]):null]),l.total>0?r("div",{class:"progress-bar"},[r("div",{class:"progress-fill",style:`width: ${l.progressPct}%;`})]):null]),r("td",{class:"convoy-work-cell"},[r("div",{class:"convoy-work-breakdown"},[l.ready>0?r("span",{class:"work-chip work-ready"},[`${l.ready} ready`]):null,l.inProgress>0?r("span",{class:"work-chip work-inprogress"},[`${l.inProgress} active`]):null,l.closed===l.total&&l.total>0?r("span",{class:"work-chip work-done"},["all done"]):null])]),r("td",{class:`activity-${l.lastActivity.colorClass}`},[r("span",{class:"activity-dot"}),` ${l.lastActivity.display}`])]);u.addEventListener("click",()=>{Rn(l.id)}),i.append(u)}),t.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Status"]),r("th",{},["Convoy"]),r("th",{},["Progress"]),r("th",{},["Work"]),r("th",{},["Activity"])])]),i]))}function Ln(){const e=c("convoy-list"),t=c("convoy-detail"),n=c("convoy-create-form");if(!e||!t||!n)return;const a=t.style.display==="block"||n.style.display==="block";ve="",c("convoy-count").textContent="0",t.style.display="none",n.style.display="none",c("convoy-add-issue-form").style.display="none",e.style.display="block",E(e),e.append(r("div",{class:"empty-state"},[r("p",{},["Select a city to view convoys"])])),a&&B()}async function Rs(e,t){var f,d,p,m;if(!t)return null;const n=await g.GET("/v0/city/{cityName}/convoy/{id}",{params:{path:{cityName:e,id:t}}});if(n.error||!n.data)return null;const a=n.data.children??[],s=new Set;let i=0,o=0,l="";a.forEach(h=>{(h.status??"").toLowerCase()!=="closed"&&(h.assignee?(o+=1,s.add(h.assignee)):i+=1),l=[l,h.created_at??""].sort().slice(-1)[0]??l});const u=((f=n.data.progress)==null?void 0:f.total)??a.length,y=((d=n.data.progress)==null?void 0:d.closed)??a.filter(h=>h.status==="closed").length;return{id:t,title:((p=n.data.convoy)==null?void 0:p.title)??t,status:(m=n.data.convoy)==null?void 0:m.status,progressPct:u>0?Math.round(y/u*100):0,total:u,closed:y,ready:i,inProgress:o,assignees:[...s].sort(),lastActivity:je(l)}}function Tn(e){return e.total>0&&e.closed===e.total?"done":e.inProgress>0?"active":e.ready>0?"waiting":e.status??"open"}function qs(e){switch(Tn(e)){case"done":return"✓ Done";case"active":return"Active";case"waiting":return"Waiting";default:return e.status??"Open"}}function Os(){var e,t,n,a,s,i,o,l;(e=c("new-convoy-btn"))==null||e.addEventListener("click",()=>{An()}),(t=c("convoy-back-btn"))==null||t.addEventListener("click",()=>Ps()),(n=c("convoy-create-back-btn"))==null||n.addEventListener("click",()=>ht()),(a=c("convoy-create-cancel-btn"))==null||a.addEventListener("click",()=>ht()),(s=c("convoy-create-submit-btn"))==null||s.addEventListener("click",()=>{_s()}),(i=c("convoy-add-issue-btn"))==null||i.addEventListener("click",()=>{c("convoy-add-issue-form").style.display="flex"}),(o=c("convoy-add-issue-cancel"))==null||o.addEventListener("click",()=>{c("convoy-add-issue-form").style.display="none"}),(l=c("convoy-add-issue-submit"))==null||l.addEventListener("click",()=>{js()})}function An(){var n;if(!S()){w("info","No city selected","Select a city to create a convoy");return}const e=c("convoy-create-form"),t=(e==null?void 0:e.style.display)==="block";ve="",c("convoy-list").style.display="none",c("convoy-detail").style.display="none",e.style.display="block",c("convoy-create-name").value="",c("convoy-create-issues").value="",t||Q(),qn("convoy-create-name"),(n=c("convoy-create-name"))==null||n.focus()}async function Rn(e){var l,u,y,f,d,p,m,h;const t=S();if(!t)return;ve=e,((l=c("convoy-detail"))==null?void 0:l.style.display)!=="block"&&Q(),c("convoy-list").style.display="none",c("convoy-create-form").style.display="none",c("convoy-detail").style.display="block",qn("convoy-detail"),c("convoy-detail-id").textContent=e,c("convoy-detail-title").textContent=`Convoy: ${e}`,c("convoy-issues-loading").style.display="block",c("convoy-issues-table").style.display="none",c("convoy-issues-empty").style.display="none",c("convoy-add-issue-form").style.display="none";const n=await g.GET("/v0/city/{cityName}/convoy/{id}",{params:{path:{cityName:t,id:e}}});if(c("convoy-issues-loading").style.display="none",n.error||!n.data){c("convoy-issues-empty").style.display="block",c("convoy-issues-empty").querySelector("p").textContent=((u=n.error)==null?void 0:u.detail)??"Failed to load convoy";return}const a=((y=n.data.progress)==null?void 0:y.total)??((f=n.data.children)==null?void 0:f.length)??0,s=((d=n.data.progress)==null?void 0:d.closed)??((p=n.data.children)==null?void 0:p.filter(v=>v.status==="closed").length)??0;c("convoy-detail-status").className=`badge ${ue(((m=n.data.convoy)==null?void 0:m.status)??"open")}`,c("convoy-detail-status").textContent=((h=n.data.convoy)==null?void 0:h.status)??"open",c("convoy-detail-progress").textContent=`${s}/${a}`;const i=c("convoy-issues-tbody");if(!i)return;E(i);const o=n.data.children??[];if(o.length===0){c("convoy-issues-empty").style.display="block";return}o.forEach(v=>{const C=v.assignee?v.assignee:v.status==="closed"?"done":"ready";i.append(r("tr",{},[r("td",{class:"convoy-issue-status"},[r("span",{class:`badge ${ue(v.status)}`},[v.status??"unknown"])]),r("td",{},[r("span",{class:"issue-id"},[v.id??""])]),r("td",{class:"issue-title"},[v.title??v.id??""]),r("td",{},[v.assignee?r("span",{class:"badge badge-blue"},[v.assignee]):r("span",{class:"badge badge-muted"},["Unassigned"])]),r("td",{},[C])]))}),c("convoy-issues-table").style.display="table"}function Ps(){const e=c("convoy-detail"),t=(e==null?void 0:e.style.display)==="block";e.style.display="none",c("convoy-list").style.display="block",t&&B()}function ht(){const e=c("convoy-create-form"),t=(e==null?void 0:e.style.display)==="block";e.style.display="none",c("convoy-list").style.display="block",t&&B()}async function _s(){var s,i;const e=S();if(!e)return;const t=((s=c("convoy-create-name"))==null?void 0:s.value.trim())??"",n=(((i=c("convoy-create-issues"))==null?void 0:i.value)??"").split(/\s+/).map(o=>o.trim()).filter(Boolean);if(!t){w("error","Missing name","Convoy name is required");return}const a=await g.POST("/v0/city/{cityName}/convoys",{params:{path:{cityName:e},header:O},body:{title:t,items:n}});if(a.error){w("error","Create failed",a.error.detail??"Could not create convoy");return}w("success","Convoy created",t),ht(),await xt()}async function js(){const e=S();if(!e||!ve)return;const t=c("convoy-add-issue-input"),n=(t==null?void 0:t.value.trim())??"";if(!n)return;const a=await g.POST("/v0/city/{cityName}/convoy/{id}/add",{params:{path:{cityName:e,id:ve},header:O},body:{items:[n]}});if(a.error){w("error","Add failed",a.error.detail??"Could not add issue");return}t&&(t.value=""),c("convoy-add-issue-form").style.display="none",w("success","Issue added",n),await Rn(ve),await xt()}function qn(e){var t,n;(n=(t=c("convoy-panel"))==null?void 0:t.scrollIntoView)==null||n.call(t,{behavior:"smooth",block:"center"}),window.setTimeout(()=>{var a;(a=c(e))==null||a.focus()},0)}const Is=150,z=[];let ae=null,De="all",We="all",ze="all",Lt={};async function Bs(e){z.splice(0,z.length,...Pn(e)),Z()}async function Ms(){var s,i,o;const e=S();let t=[],n="";if(e)t=((s=(await g.GET("/v0/city/{cityName}/events",{params:{path:{cityName:e},query:{since:"1h",limit:100}}})).data)==null?void 0:s.items)??[];else{const l=await g.GET("/v0/events",{params:{query:{since:"1h"}}});t=((i=l.data)==null?void 0:i.items)??[],n=((o=l.data)==null?void 0:o.event_cursor)??""}const a=t.map(l=>Hs(l)).filter(l=>l!==null);Lt=Ks(t,e,n),await Bs(a)}function Us(){z.splice(0,z.length),Lt={},Z()}function Ds(e,t){const n=S();ae==null||ae.close();const a={...Lt,...t?{onStatus:t}:{}};ae=(n?i=>Ba(n,i,a):i=>Ia(i,a))(i=>{const o=jn(i);e==null||e(i,o);const l=Fs(i);l&&(z.some(u=>u.id===l.id)||(z.splice(0,z.length,...Pn([l,...z])),Z()))})}function Ws(){ae==null||ae.close(),ae=null}function Z(){Gs();const e=c("activity-feed");if(!e)return;E(e);const t=z.filter(a=>!(De!=="all"&&a.category!==De||We!=="all"&&a.rig!==We||ze!=="all"&&a.actor!==ze));if(c("activity-count").textContent=String(z.length),t.length===0){e.append(r("div",{class:"empty-state"},[r("p",{},["No recent activity"])]));return}const n=r("div",{class:"tl-timeline",id:"activity-timeline"});t.forEach(a=>{n.append(r("div",{class:`tl-entry ${Ys(a.category)}`,"data-category":a.category,"data-rig":a.rig,"data-agent":a.actor??"","data-type":a.type,"data-ts":a.ts},[r("div",{class:"tl-rail"},[r("span",{class:"tl-time"},[Et(a.ts)]),r("span",{class:"tl-node"})]),r("div",{class:"tl-content"},[r("div",{class:"tl-header"},[r("span",{class:"tl-icon"},[Sa(a.type)]),r("span",{class:"tl-summary"},[Ca(a.type,a.actor,a.subject,a.message)])]),r("div",{class:"tl-meta"},[a.actor?r("span",{class:"tl-badge tl-badge-agent"},[U(a.actor)]):null,a.rig?r("span",{class:"tl-badge tl-badge-rig"},[a.rig]):null,r("span",{class:"tl-badge tl-badge-type"},[a.type])])])]))}),e.append(n)}function zs(){var e,t;document.addEventListener("click",n=>{var s;const a=(s=n.target)==null?void 0:s.closest(".tl-filter-btn");a&&(De=a.dataset.value??"all",document.querySelectorAll(".tl-filter-btn").forEach(i=>i.classList.remove("active")),a.classList.add("active"),Z())}),(e=c("tl-rig-filter"))==null||e.addEventListener("change",n=>{We=n.currentTarget.value,Z()}),(t=c("tl-agent-filter"))==null||t.addEventListener("change",n=>{ze=n.currentTarget.value,Z()})}function Gs(){const e=c("activity-filters");if(!e||(E(e),z.length===0))return;const t=[...new Set(z.map(i=>i.rig).filter(Boolean))].sort(),n=[...new Set(z.map(i=>i.actor).filter(Boolean))].sort(),a=r("select",{class:"tl-filter-select",id:"tl-rig-filter"});a.append(r("option",{value:"all"},["All rigs"])),t.forEach(i=>a.append(r("option",{value:i,selected:i===We},[i]))),a.addEventListener("change",()=>{We=a.value,Z()});const s=r("select",{class:"tl-filter-select",id:"tl-agent-filter"});s.append(r("option",{value:"all"},["All agents"])),n.forEach(i=>s.append(r("option",{value:i,selected:i===ze},[U(i)]))),s.addEventListener("change",()=>{ze=s.value,Z()}),e.append(r("div",{class:"tl-filters"},[r("div",{class:"tl-filter-group"},[r("label",{},["Category:"]),Te("all","All"),Te("agent","Agent"),Te("work","Work"),Te("comms","Comms"),Te("system","System")]),r("div",{class:"tl-filter-group"},[r("label",{for:"tl-rig-filter"},["Rig:"]),a]),r("div",{class:"tl-filter-group"},[r("label",{for:"tl-agent-filter"},["Agent:"]),s])]))}function Te(e,t){const n=r("button",{class:`tl-filter-btn${De===e?" active":""}`,"data-filter":"category","data-value":e,type:"button"},[t]);return n.addEventListener("click",()=>{De=e,Z()}),n}function Fs(e){return e.event==="heartbeat"?null:On(e.data,e.id)}function Hs(e){return On(e)}function On(e,t){if(!e.type)return null;const n=_n(e)??S(),a=typeof e.seq=="number"?e.seq:0;return{id:Qs(e,t),type:e.type,category:wa(e.type),actor:e.actor||void 0,subject:e.subject||void 0,message:e.message||void 0,ts:e.ts,scope:n,seq:a,rig:va(e.actor)||"city"in e&&e.city||""}}function Pn(e){const t=new Map;return e.forEach(n=>{t.has(n.id)||t.set(n.id,n)}),[...t.values()].sort(Js).slice(0,Is)}function Js(e,t){const n=Vs(e.ts,t.ts);if(n!==0)return n;const a=e.scope.localeCompare(t.scope);if(a!==0)return a;const s=t.seq-e.seq;if(s!==0)return s;const i=e.type.localeCompare(t.type);if(i!==0)return i;const o=(e.actor??"").localeCompare(t.actor??"");return o!==0?o:(e.subject??"").localeCompare(t.subject??"")}function Vs(e,t){const n=Number.isNaN(Date.parse(e))?0:Date.parse(e);return(Number.isNaN(Date.parse(t))?0:Date.parse(t))-n}function _n(e){if("city"in e&&typeof e.city=="string"&&e.city!=="")return e.city}function Ks(e,t,n=""){if(t){const s=e.reduce((i,o)=>Math.max(i,o.seq??0),0);return s>0?{afterSeq:String(s)}:{}}const a=n.trim();return a?{afterCursor:a}:{}}function Qs(e,t){const n=_n(e)??S();if(typeof e.seq=="number"&&e.seq>0)return`${n}:${e.seq}`;const a=[e.type,e.ts,e.actor??"",e.subject??"",e.message??"",t??""].join(":");return`${n}:${a}`}function jn(e){return Ua(e)}function Ys(e){switch(e){case"agent":return"activity-agent";case"work":return"activity-work";case"comms":return"activity-comms";default:return"activity-system"}}async function te(){var o,l,u,y,f,d;const e=S();if(!e){In();return}const[t,n,a,s,i]=await Promise.all([g.GET("/v0/city/{cityName}/services",{params:{path:{cityName:e}}}),g.GET("/v0/city/{cityName}/rigs",{params:{path:{cityName:e},query:{git:!0}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{label:"gc:escalation",status:"open",limit:200}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"in_progress",limit:500}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{label:"gc:queue",limit:200}}})]);Zs(((o=t.data)==null?void 0:o.items)??null,(l=t.error)==null?void 0:l.detail),er(((u=n.data)==null?void 0:u.items)??null),tr(((y=a.data)==null?void 0:y.items)??null),nr(((f=s.data)==null?void 0:f.items)??null),ar(((d=i.data)==null?void 0:d.items)??null)}function In(){Ae("services-body","services-count","Select a city to view services"),Ae("rigs-body","rigs-count","Select a city to view rigs"),Ae("escalations-body","escalations-count","Select a city to view escalations"),Ae("assigned-body","assigned-count","Select a city to view assigned work"),Ae("queues-body","queues-count","Select a city to view queues"),c("clear-assigned-btn").style.display="none"}function Xs(){var e,t;(e=c("open-assign-btn"))==null||e.addEventListener("click",()=>{Bn()}),(t=c("clear-assigned-btn"))==null||t.addEventListener("click",()=>{ir()})}function Zs(e,t){const n=c("services-body"),a=c("services-count");if(!n||!a)return;if(E(n),t){a.textContent="n/a",n.append(r("div",{class:"empty-state"},[r("p",{},[t])]));return}const s=e??[];if(a.textContent=String(s.length),s.length===0){n.append(r("div",{class:"empty-state"},[r("p",{},["No workspace services"])]));return}const i=r("tbody");s.forEach(o=>{const l=r("button",{class:"esc-btn",type:"button"},["Restart"]);l.addEventListener("click",()=>{cr(o.service_name)}),i.append(r("tr",{},[r("td",{},[r("strong",{},[o.service_name])]),r("td",{},[o.kind??"—"]),r("td",{},[r("span",{class:`badge ${ue(o.state??o.publication_state)}`},[o.state??o.publication_state??"unknown"])]),r("td",{},[o.local_state]),r("td",{},[l])]))}),n.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Name"]),r("th",{},["Kind"]),r("th",{},["Service"]),r("th",{},["Local"]),r("th",{},["Actions"])])]),i]))}function er(e){const t=c("rigs-body"),n=c("rigs-count");if(!t||!n)return;E(t);const a=e??[];if(n.textContent=String(a.length),a.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No rigs configured"])]));return}const s=r("tbody");a.forEach(i=>{var u;const o=r("button",{class:"esc-btn",type:"button"},[i.suspended?"Resume":"Suspend"]);o.addEventListener("click",()=>{Gt(i.name,i.suspended?"resume":"suspend")});const l=r("button",{class:"esc-btn",type:"button"},["Restart"]);l.addEventListener("click",()=>{Gt(i.name,"restart")}),s.append(r("tr",{},[r("td",{},[r("span",{class:"rig-name"},[i.name])]),r("td",{},[String(i.agent_count-i.running_count)]),r("td",{},[String(i.running_count)]),r("td",{},[(u=i.git)!=null&&u.branch?`${i.git.branch}${i.git.clean?"":"*"}`:"—"]),r("td",{},[F(i.last_activity)]),r("td",{},[o," ",l])]))}),t.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Name"]),r("th",{},["Idle"]),r("th",{},["Running"]),r("th",{},["Git"]),r("th",{},["Activity"]),r("th",{},["Actions"])])]),s]))}function tr(e){const t=c("escalations-body"),n=c("escalations-count");if(!t||!n)return;E(t);const a=(e??[]).sort((i,o)=>(i.created_at??"").localeCompare(o.created_at??""));if(n.textContent=String(a.length),a.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No escalations"])]));return}const s=r("tbody");a.forEach(i=>{const o=sr(i.labels??[]),l=(i.labels??[]).includes("acked"),u=r("button",{class:"esc-btn esc-ack-btn",type:"button"},["👍 Ack"]);u.addEventListener("click",()=>{lr(i)});const y=r("button",{class:"esc-btn esc-resolve-btn",type:"button"},["✓ Resolve"]);y.addEventListener("click",()=>{i.id&&dr(i.id)});const f=r("button",{class:"esc-btn esc-reassign-btn",type:"button"},["↻ Reassign"]);f.addEventListener("click",()=>{i.id&&ur(i.id)}),s.append(r("tr",{class:"escalation-row","data-escalation-id":i.id??""},[r("td",{},[r("span",{class:`badge ${rr(o)}`},[o.toUpperCase()])]),r("td",{},[i.title??i.id??"",l?r("span",{class:"badge badge-cyan",style:"margin-left: 4px;"},["ACK"]):null]),r("td",{},[U(i.assignee)]),r("td",{},[F(i.created_at)]),r("td",{class:"escalation-actions"},[l?null:u,y,f])]))}),t.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Severity"]),r("th",{},["Issue"]),r("th",{},["From"]),r("th",{},["Age"]),r("th",{},["Actions"])])]),s]))}function nr(e){const t=c("assigned-body"),n=c("assigned-count"),a=c("clear-assigned-btn");if(!t||!n||!a)return;E(t);const s=(e??[]).filter(o=>o.assignee);if(n.textContent=String(s.length),a.style.display=s.length>0?"inline-flex":"none",s.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No assigned work"])]));return}const i=r("tbody");s.forEach(o=>{const l=r("button",{class:"unassign-btn",type:"button"},["Unassign"]);l.addEventListener("click",()=>{o.id&&or(o.id)}),i.append(r("tr",{},[r("td",{},[r("span",{class:"assigned-id"},[o.id??""])]),r("td",{class:"assigned-title"},[at(o.title??"",80)]),r("td",{class:"assigned-agent"},[U(o.assignee)]),r("td",{class:"assigned-age"},[F(o.created_at)]),r("td",{},[l])]))}),t.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Bead"]),r("th",{},["Title"]),r("th",{},["Agent"]),r("th",{},["Since"]),r("th",{},[""])])]),i]))}function ar(e){const t=c("queues-body"),n=c("queues-count");if(!t||!n)return;E(t);const a=e??[];if(n.textContent=String(a.length),a.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No queues"])]));return}const s=r("tbody");a.forEach(i=>{s.append(r("tr",{},[r("td",{},[i.title??i.id??"queue"]),r("td",{},[i.id??"—"]),r("td",{},[r("span",{class:`badge ${ue(i.status)}`},[i.status??"open"])]),r("td",{},[U(i.assignee)]),r("td",{},[F(i.created_at)])]))}),t.append(r("table",{},[r("thead",{},[r("tr",{},[r("th",{},["Queue"]),r("th",{},["Bead"]),r("th",{},["Status"]),r("th",{},["Assignee"]),r("th",{},["Created"])])]),s]))}function Ae(e,t,n){const a=c(e),s=c(t);!a||!s||(E(a),s.textContent="0",a.append(r("div",{class:"empty-state"},[r("p",{},[n])])))}function sr(e){for(const t of e)if(t.startsWith("severity:"))return t.slice(9);return"medium"}function rr(e){switch(e){case"critical":return"badge-red";case"high":return"badge-orange";case"low":return"badge-muted";default:return"badge-yellow"}}async function Bn(e=""){const t=S();if(!t)return;const n=await kt({beadID:e||void 0,beadLabel:e||void 0,mode:"assign",title:"Assign Work"});if(!n)return;const a=await g.POST("/v0/city/{cityName}/sling",{params:{path:{cityName:t},header:O},body:{bead:n.beadID,target:n.target,rig:n.rig||void 0}});if(a.error){w("error","Assign failed",a.error.detail??"Could not assign bead");return}w("success","Assigned",`${n.beadID} → ${n.target}`),await te()}async function ir(){var s;const e=S();if(!e)return;const n=(((s=(await g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:e},query:{status:"in_progress",limit:500}}})).data)==null?void 0:s.items)??[]).filter(i=>i.assignee);if(n.length===0){w("info","Nothing to clear","No assigned work");return}await es({body:`Unassign ${n.length} active ${n.length===1?"bead":"beads"}?`,confirmLabel:"Unassign All",title:"Clear Assignments"})&&(await Promise.all(n.map(i=>g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:e,id:i.id??""},header:O},body:{assignee:""}}))),w("success","Cleared",`${n.length} assignments removed`),await te())}async function or(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:t,id:e},header:O},body:{assignee:""}});if(n.error){w("error","Unassign failed",n.error.detail??"Could not unassign bead");return}w("success","Unassigned",e),await te()}async function cr(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/service/{name}/restart",{params:{path:{cityName:t,name:e},header:O}});if(n.error){w("error","Service failed",n.error.detail??"Could not restart service");return}w("success","Service restarted",e),await te()}async function Gt(e,t){const n=S();if(!n)return;const a=await g.POST("/v0/city/{cityName}/rig/{name}/{action}",{params:{path:{cityName:n,name:e,action:t},header:O}});if(a.error){w("error","Rig action failed",a.error.detail??`Could not ${t} ${e}`);return}w("success","Rig updated",`${e}: ${t}`),await te()}async function lr(e){const t=S();if(!t||!e.id)return;const n=Array.from(new Set([...e.labels??[],"acked"])),a=await g.POST("/v0/city/{cityName}/bead/{id}/update",{params:{path:{cityName:t,id:e.id},header:O},body:{labels:n}});if(a.error){w("error","Ack failed",a.error.detail??"Could not acknowledge escalation");return}w("success","Acknowledged",e.id),await te()}async function dr(e){const t=S();if(!t)return;const n=await g.POST("/v0/city/{cityName}/bead/{id}/close",{params:{path:{cityName:t,id:e},header:O}});if(n.error){w("error","Resolve failed",n.error.detail??"Could not resolve escalation");return}w("success","Resolved",e),await te()}async function ur(e){const t=S();if(!t)return;const n=await kt({beadID:e,beadLabel:e,mode:"reassign",title:"Reassign Escalation"});if(!n)return;const a=await g.POST("/v0/city/{cityName}/bead/{id}/assign",{params:{path:{cityName:t,id:e},header:O},body:{assignee:n.target}});if(a.error){w("error","Reassign failed",a.error.detail??"Could not reassign escalation");return}w("success","Reassigned",`${e} → ${n.target||"unassigned"}`),await te()}function fr(e){const t=c("command-palette-overlay"),n=c("command-palette-input"),a=c("command-palette-results"),s=c("open-palette-btn");if(!t||!n||!a||!s)return;const i=t,o=n,l=a,u=s;let y=[],f=[],d=0;function p(){const b=S(),N=async(k,P)=>{const M=await P;Ut(k,JSON.stringify(M,null,2))};return[{name:"refresh",desc:"Refresh all panels",category:"Dashboard",run:()=>e.refreshAll()},{name:"supervisor health",desc:"Show supervisor health JSON",category:"Supervisor",run:()=>N("health",g.GET("/health"))},{name:"city list",desc:"Show managed cities JSON",category:"Supervisor",run:()=>N("cities",g.GET("/v0/cities"))},{name:"global events",desc:"Show recent supervisor events JSON",category:"Supervisor",run:()=>N("events",g.GET("/v0/events",{params:{query:{since:"1h"}}}))},...b?[{name:"new issue",desc:"Open the issue creation modal",category:"Work",run:()=>Cn()},{name:"compose mail",desc:"Open the compose mail form",category:"Mail",run:()=>gt()},{name:"new convoy",desc:"Open the convoy creation form",category:"Convoys",run:()=>An()},{name:"assign work",desc:"Open the assignment modal",category:"Assigned",run:()=>Bn()},{name:"status",desc:"Show current city status JSON",category:"Status",run:()=>N("status",g.GET("/v0/city/{cityName}/status",{params:{path:{cityName:b}}}))},{name:"agent list",desc:"Show current sessions JSON",category:"Status",run:()=>N("sessions",g.GET("/v0/city/{cityName}/sessions",{params:{path:{cityName:b},query:{state:"active",peek:!0}}}))},{name:"convoy list",desc:"Show current convoys JSON",category:"Convoys",run:()=>N("convoys",g.GET("/v0/city/{cityName}/convoys",{params:{path:{cityName:b},query:{limit:200}}}))},{name:"mail inbox",desc:"Show current mail JSON",category:"Mail",run:()=>N("mail",g.GET("/v0/city/{cityName}/mail",{params:{path:{cityName:b},query:{status:"all",limit:200}}}))},{name:"rig list",desc:"Show rig JSON",category:"Rigs",run:()=>N("rigs",g.GET("/v0/city/{cityName}/rigs",{params:{path:{cityName:b},query:{git:!0}}}))},{name:"list",desc:"Show open and in-progress beads JSON",category:"Beads",run:async()=>{var M,x;const[k,P]=await Promise.all([g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:b},query:{status:"open",limit:500}}}),g.GET("/v0/city/{cityName}/beads",{params:{path:{cityName:b},query:{status:"in_progress",limit:500}}})]);Ut("beads",JSON.stringify({open:((M=k.data)==null?void 0:M.items)??[],in_progress:((x=P.data)==null?void 0:x.items)??[]},null,2))}}]:[],{name:"close output",desc:"Hide the output panel",category:"Dashboard",run:()=>dn()}].filter(k=>typeof k.run=="function")}function m(){E(l);const b=o.value.trim().toLowerCase();if(y=p(),f=y.filter(N=>b===""||N.name.includes(b)||N.desc.toLowerCase().includes(b)||N.category.toLowerCase().includes(b)),d>=f.length&&(d=0),f.length===0){l.append(r("div",{class:"command-palette-empty"},["No matching commands"]));return}f.forEach((N,k)=>{const P=r("button",{class:`command-item${k===d?" selected":""}`,type:"button"},[r("span",{class:"command-name"},[`gt ${N.name}`]),r("span",{class:"command-desc"},[N.desc]),r("span",{class:"command-category"},[N.category])]);P.addEventListener("click",()=>{C(k)}),l.append(P)})}function h(){i.classList.add("open"),o.value="",d=0,m(),o.focus()}function v(){i.classList.remove("open")}async function C(b){const N=f[b];v(),N&&(ee("palette","Execute command",{category:N.category,city:S(),command:N.name}),await N.run())}u.addEventListener("click",()=>h()),i.addEventListener("click",b=>{b.target===i&&v()}),o.addEventListener("input",()=>m()),o.addEventListener("keydown",b=>{if(b.key==="ArrowDown"){d=Math.min(d+1,Math.max(f.length-1,0)),m(),b.preventDefault();return}if(b.key==="ArrowUp"){d=Math.max(d-1,0),m(),b.preventDefault();return}if(b.key==="Enter"){C(d),b.preventDefault();return}b.key==="Escape"&&v()}),document.addEventListener("keydown",b=>{(b.metaKey||b.ctrlKey)&&b.key.toLowerCase()==="k"&&(b.preventDefault(),i.classList.contains("open")?v():h())})}function yr(){const e=c("supervisor-overview-panel"),t=c("supervisor-overview-body"),n=c("supervisor-city-count");if(!e||!t||!n)return;const a=S()==="";if(e.hidden=!a,!a)return;const s=nn().sort((o,l)=>o.name.localeCompare(l.name));if(n.textContent=String(s.length),E(t),s.length===0){t.append(r("div",{class:"empty-state"},[r("p",{},["No managed cities available"])]));return}const i=r("tbody");s.forEach(o=>{const l=o.phasesCompleted.length>0?o.phasesCompleted.join(", "):"—",u=r("a",{class:"supervisor-city-link",href:`?city=${encodeURIComponent(o.name)}`},["Open"]);i.append(r("tr",{},[r("td",{},[r("strong",{},[o.name])]),r("td",{},[r("span",{class:`badge ${o.error?"badge-red":o.running?"badge-green":"badge-muted"}`},[o.error?"Error":o.running?"Running":"Stopped"])]),r("td",{},[o.status??"—"]),r("td",{class:"supervisor-city-phases"},[l]),r("td",{class:"supervisor-city-error"},[o.error??"—"]),r("td",{class:"supervisor-city-actions"},[u])]))}),t.append(r("table",{class:"supervisor-city-table"},[r("thead",{},[r("tr",{},[r("th",{},["City"]),r("th",{},["State"]),r("th",{},["Status"]),r("th",{},["Phases"]),r("th",{},["Error"]),r("th",{},[""])])]),i]))}function pr(e){let t=null,n=!1,a=0,s=!1;async function i(){if(t=null,!e.isPaused()){n=!0,a=Date.now();try{await e.run()}catch(l){e.onError(l)}finally{n=!1}if(!s||e.isPaused()){s=!1;return}s=!1,o()}}function o(){if(t!==null)return;if(n){s=!0;return}const l=e.minIntervalMs??0,u=a>0?Date.now()-a:Number.POSITIVE_INFINITY,y=l>0?Math.max(0,l-u):0;t=setTimeout(()=>{i()},Math.max(e.delayMs,y))}return{schedule:o}}const mr=["convoy-panel","crew-panel","rigged-panel","mail-panel","escalations-panel","services-panel","rigs-panel","pooled-panel","queues-panel","beads-panel","assigned-panel","agent-log-drawer"];async function gr(){st()||await ke()}async function hr(){st()||await ke().catch(e=>I("Catch-up refresh failed",e))}async function br(){St(),await ke(!0)}function Tt(){const e=Fe();if(Ct(e)){Ws(),dt("connecting");return}dt("connecting"),Ds(t=>{const n=jn(t);!n||n==="heartbeat"||!ga(n)||st()||Lr()},dt)}function dt(e){const t=At("connection-status");if(!t)return;const n={connecting:"Connecting…",live:"Live",reconnecting:"Reconnecting…"};t.replaceChildren(document.createTextNode(n[e])),t.classList.remove("connection-live","connection-connecting","connection-reconnecting"),t.classList.add(`connection-${e}`)}function vr(){Oa(),Za(),Ha(),is(),ks(),Os(),zs(),Xs(),fr({refreshAll:gr})}async function wr(){la(),ee("dashboard","Boot start",{city:S(),href:window.location.href}),vr(),Cr(),qa(()=>{hr()}),await br(),Tt(),ee("dashboard","Boot complete",{city:S(),href:window.location.href})}function At(e){return document.getElementById(e)}wr().catch(e=>I("Dashboard boot failed",e));function Sr(e){kr(e),Ve("new-convoy-btn",e,"Select a running city to create a convoy"),Ve("new-issue-btn",e,"Select a running city to create a bead"),Ve("compose-mail-btn",e,"Select a running city to compose mail"),Ve("open-assign-btn",e,"Select a running city to assign work")}function Ve(e,t,n){const a=At(e);a&&(a.dataset.defaultTitle===void 0&&(a.dataset.defaultTitle=a.title||""),a.disabled=!t,a.title=t?a.dataset.defaultTitle:n)}function Cr(){document.addEventListener("click",e=>{var a;const t=(a=e.target)==null?void 0:a.closest("a.city-tab");if(!t)return;const n=t.href;!n||n===window.location.href||(e.preventDefault(),Er(n))}),window.addEventListener("popstate",()=>{ee("dashboard","Popstate navigation",{href:window.location.href}),bn(),wt(),St(),ke().catch(e=>I("Refresh failed",e)),Tt()})}async function Er(e){ee("dashboard","Navigate city scope",{nextURL:e}),bn(),window.history.pushState({},"",e),wt(),St(),await ke(),Tt()}function kr(e){mr.forEach(t=>{const n=At(t);if(!n)return;const a=!e&&n.classList.contains("expanded");if(n.hidden=!e,a){n.classList.remove("expanded");const s=n.querySelector(".expand-btn");s&&(s.textContent="Expand"),B()}})}const Nr=1e3,$r=1e4,xr=pr({delayMs:Nr,isPaused:st,minIntervalMs:$r,onError:e=>I("Refresh failed",e),run:()=>ke()});function Lr(){xr.schedule()}async function ke(e=!1){wt();const t=ya(e);if(t.size===0)return;t.has("options")&&Xa(),t.has("cities")&&await ha().catch(l=>{tn(),I("City tabs failed",l)});const n=[],a=Fe(),s=ma(a);Sr(s),Ct(a)&&Tr(),ie(n,t,"status",()=>Ea()),a.kind==="supervisor"||s?ie(n,t,"activity",()=>Ms()):Us(),s&&(ie(n,t,"crew",()=>Da()),ie(n,t,"issues",()=>ye()),ie(n,t,"mail",()=>He()),ie(n,t,"convoys",()=>xt()),ie(n,t,"admin",()=>te()));const o=(await Promise.allSettled(n)).find(l=>l.status==="rejected");o&&I("Panel refresh failed",o.reason),(t.has("supervisor")||t.has("cities"))&&yr()}function Tr(){Ln(),gn(),Sn(),kn(),In()}function ie(e,t,n,a){t.has(n)&&e.push(a())}
diff --git a/cmd/gc/dashboard/web/dist/index.html b/cmd/gc/dashboard/web/dist/index.html
index c98a34b726..94ef1d21fd 100644
--- a/cmd/gc/dashboard/web/dist/index.html
+++ b/cmd/gc/dashboard/web/dist/index.html
@@ -27,10 +27,10 @@
 
       <div id="city-tabs"></div>
 
-      <div class="scope-banner detached" id="scope-banner">
+      <div class="scope-banner" id="scope-banner">
         <div class="scope-info">
-          <span class="scope-title">City Scope</span>
-          <span class="badge badge-muted" id="scope-badge">Idle</span>
+          <span class="scope-title">Selected Scope</span>
+          <span class="badge badge-muted" id="scope-badge">Loading</span>
         </div>
         <div class="scope-status" id="scope-status"></div>
       </div>
@@ -75,6 +75,7 @@ <h4>Tracked Issues</h4>
                     <button class="convoy-add-issue-btn" id="convoy-add-issue-btn">+ Add Issue</button>
                   </div>
                   <div id="convoy-add-issue-form" class="convoy-add-issue-form" style="display: none;">
+                    <label for="convoy-add-issue-input" class="sr-only">Issue ID</label>
                     <input type="text" id="convoy-add-issue-input" class="convoy-add-issue-input" placeholder="Enter issue ID..." />
                     <button class="btn-primary convoy-add-issue-submit" id="convoy-add-issue-submit">Add</button>
                     <button class="btn-secondary convoy-add-issue-cancel" id="convoy-add-issue-cancel">Cancel</button>
@@ -369,6 +370,7 @@ <h2>👤 Assigned</h2>
 
     <div id="command-palette-overlay" class="command-palette-overlay">
       <div class="command-palette">
+        <label for="command-palette-input" class="sr-only">Search commands</label>
         <input type="text" id="command-palette-input" class="command-palette-input" placeholder="Type to search commands..." autocomplete="off" />
         <div id="command-palette-results" class="command-palette-results"></div>
         <div class="command-palette-footer">
diff --git a/cmd/gc/dashboard/web/index.html b/cmd/gc/dashboard/web/index.html
index 39efe9ee36..33a854c822 100644
--- a/cmd/gc/dashboard/web/index.html
+++ b/cmd/gc/dashboard/web/index.html
@@ -26,10 +26,10 @@
 
       <div id="city-tabs"></div>
 
-      <div class="scope-banner detached" id="scope-banner">
+      <div class="scope-banner" id="scope-banner">
         <div class="scope-info">
-          <span class="scope-title">City Scope</span>
-          <span class="badge badge-muted" id="scope-badge">Idle</span>
+          <span class="scope-title">Selected Scope</span>
+          <span class="badge badge-muted" id="scope-badge">Loading</span>
         </div>
         <div class="scope-status" id="scope-status"></div>
       </div>
@@ -74,6 +74,7 @@ <h4>Tracked Issues</h4>
                     <button class="convoy-add-issue-btn" id="convoy-add-issue-btn">+ Add Issue</button>
                   </div>
                   <div id="convoy-add-issue-form" class="convoy-add-issue-form" style="display: none;">
+                    <label for="convoy-add-issue-input" class="sr-only">Issue ID</label>
                     <input type="text" id="convoy-add-issue-input" class="convoy-add-issue-input" placeholder="Enter issue ID..." />
                     <button class="btn-primary convoy-add-issue-submit" id="convoy-add-issue-submit">Add</button>
                     <button class="btn-secondary convoy-add-issue-cancel" id="convoy-add-issue-cancel">Cancel</button>
@@ -368,6 +369,7 @@ <h2>👤 Assigned</h2>
 
     <div id="command-palette-overlay" class="command-palette-overlay">
       <div class="command-palette">
+        <label for="command-palette-input" class="sr-only">Search commands</label>
         <input type="text" id="command-palette-input" class="command-palette-input" placeholder="Type to search commands..." autocomplete="off" />
         <div id="command-palette-results" class="command-palette-results"></div>
         <div class="command-palette-footer">
diff --git a/cmd/gc/dashboard/web/public/dashboard.css b/cmd/gc/dashboard/web/public/dashboard.css
index bd14f6ba46..9eb7cd7506 100644
--- a/cmd/gc/dashboard/web/public/dashboard.css
+++ b/cmd/gc/dashboard/web/public/dashboard.css
@@ -1,3 +1,4 @@
+        .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
         :root {
             --bg-dark: #0f1419;
             --bg-card: #1a1f26;
@@ -2170,7 +2171,7 @@
             background: var(--green);
         }
 
-        /* Mayor status banner */
+        /* Selected scope banner */
         .scope-banner {
             display: flex;
             align-items: center;
@@ -2182,16 +2183,6 @@
             border: 1px solid var(--border);
         }
 
-        .scope-banner.attached {
-            border-color: var(--green);
-            background: rgba(166, 209, 137, 0.08);
-        }
-
-        .scope-banner.detached {
-            border-color: var(--text-muted);
-            opacity: 0.7;
-        }
-
         .scope-info {
             display: flex;
             align-items: center;
diff --git a/cmd/gc/dashboard/web/src/api.ts b/cmd/gc/dashboard/web/src/api.ts
index 87d6eb57c0..8508dfc2a0 100644
--- a/cmd/gc/dashboard/web/src/api.ts
+++ b/cmd/gc/dashboard/web/src/api.ts
@@ -39,13 +39,12 @@ export function hasCityScope(): boolean {
 }
 
 export type DashboardSchema = components["schemas"];
-// `WireEvent` / `WireTaggedEvent` are the list-endpoint shapes with
-// typed payload fields. `EventStreamEnvelope` /
-// `TaggedEventStreamEnvelope` are the SSE-stream shapes with the
-// same typed payload union.
-export type CityEventRecord = DashboardSchema["WireEvent"];
+// Event list items and SSE frames both use envelope `type` as the
+// discriminator for the typed payload union.
+export type CityEventRecord = DashboardSchema["TypedEventStreamEnvelope"];
 export type CityEventStreamEnvelope = DashboardSchema["EventStreamEnvelope"];
-export type SupervisorEventRecord = DashboardSchema["WireTaggedEvent"];
+export type SupervisorEventRecord =
+  DashboardSchema["TypedTaggedEventStreamEnvelope"];
 export type SupervisorEventStreamEnvelope = DashboardSchema["TaggedEventStreamEnvelope"];
 export type HeartbeatEvent = DashboardSchema["HeartbeatEvent"];
 export type SessionRecord = DashboardSchema["SessionResponse"];
diff --git a/cmd/gc/dashboard/web/src/generated/index.ts b/cmd/gc/dashboard/web/src/generated/index.ts
index 47eed4b632..c1342d0202 100644
--- a/cmd/gc/dashboard/web/src/generated/index.ts
+++ b/cmd/gc/dashboard/web/src/generated/index.ts
@@ -1,4 +1,4 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 export { createAgent, createBead, createConvoy, createProvider, createRig, createSession, deleteV0CityByCityNameAgentByBase, deleteV0CityByCityNameAgentByDirByBase, deleteV0CityByCityNameBeadById, deleteV0CityByCityNameConvoyById, deleteV0CityByCityNameExtmsgAdapters, deleteV0CityByCityNameExtmsgParticipants, deleteV0CityByCityNameMailById, deleteV0CityByCityNamePatchesAgentByBase, deleteV0CityByCityNamePatchesAgentByDirByBase, deleteV0CityByCityNamePatchesProviderByName, deleteV0CityByCityNamePatchesRigByName, deleteV0CityByCityNameProviderByName, deleteV0CityByCityNameRigByName, deleteV0CityByCityNameWorkflowByWorkflowId, emitEvent, ensureExtmsgGroup, getHealth, getV0Cities, getV0CityByCityName, getV0CityByCityNameAgentByBase, getV0CityByCityNameAgentByBaseOutput, getV0CityByCityNameAgentByDirByBase, getV0CityByCityNameAgentByDirByBaseOutput, getV0CityByCityNameAgents, getV0CityByCityNameBeadById, getV0CityByCityNameBeadByIdDeps, getV0CityByCityNameBeads, getV0CityByCityNameBeadsGraphByRootId, getV0CityByCityNameBeadsReady, getV0CityByCityNameConfig, getV0CityByCityNameConfigExplain, getV0CityByCityNameConfigValidate, getV0CityByCityNameConvoyById, getV0CityByCityNameConvoyByIdCheck, getV0CityByCityNameConvoys, getV0CityByCityNameEvents, getV0CityByCityNameExtmsgAdapters, getV0CityByCityNameExtmsgBindings, getV0CityByCityNameExtmsgGroups, getV0CityByCityNameExtmsgTranscript, getV0CityByCityNameFormulaByName, getV0CityByCityNameFormulas, getV0CityByCityNameFormulasByName, getV0CityByCityNameFormulasByNameRuns, getV0CityByCityNameFormulasFeed, getV0CityByCityNameHealth, getV0CityByCityNameMail, getV0CityByCityNameMailById, getV0CityByCityNameMailCount, getV0CityByCityNameMailThreadById, getV0CityByCityNameOrderByName, getV0CityByCityNameOrderHistoryByBeadId, getV0CityByCityNameOrders, getV0CityByCityNameOrdersCheck, getV0CityByCityNameOrdersFeed, getV0CityByCityNameOrdersHistory, getV0CityByCityNamePacks, getV0CityByCityNamePatchesAgentByBase, getV0CityByCityNamePatchesAgentByDirByBase, getV0CityByCityNamePatchesAgents, getV0CityByCityNamePatchesProviderByName, getV0CityByCityNamePatchesProviders, getV0CityByCityNamePatchesRigByName, getV0CityByCityNamePatchesRigs, getV0CityByCityNameProviderByName, getV0CityByCityNameProviderReadiness, getV0CityByCityNameProviders, getV0CityByCityNameProvidersPublic, getV0CityByCityNameReadiness, getV0CityByCityNameRigByName, getV0CityByCityNameRigs, getV0CityByCityNameServiceByName, getV0CityByCityNameServices, getV0CityByCityNameSessionById, getV0CityByCityNameSessionByIdAgents, getV0CityByCityNameSessionByIdAgentsByAgentId, getV0CityByCityNameSessionByIdPending, getV0CityByCityNameSessionByIdTranscript, getV0CityByCityNameSessions, getV0CityByCityNameStatus, getV0CityByCityNameWorkflowByWorkflowId, getV0Events, getV0ProviderReadiness, getV0Readiness, type Options, patchV0CityByCityName, patchV0CityByCityNameAgentByBase, patchV0CityByCityNameAgentByDirByBase, patchV0CityByCityNameBeadById, patchV0CityByCityNameProviderByName, patchV0CityByCityNameRigByName, patchV0CityByCityNameSessionById, postV0City, postV0CityByCityNameAgentByBaseByAction, postV0CityByCityNameAgentByDirByBaseByAction, postV0CityByCityNameBeadByIdAssign, postV0CityByCityNameBeadByIdClose, postV0CityByCityNameBeadByIdReopen, postV0CityByCityNameBeadByIdUpdate, postV0CityByCityNameConvoyByIdAdd, postV0CityByCityNameConvoyByIdClose, postV0CityByCityNameConvoyByIdRemove, postV0CityByCityNameExtmsgBind, postV0CityByCityNameExtmsgInbound, postV0CityByCityNameExtmsgOutbound, postV0CityByCityNameExtmsgParticipants, postV0CityByCityNameExtmsgTranscriptAck, postV0CityByCityNameExtmsgUnbind, postV0CityByCityNameFormulasByNamePreview, postV0CityByCityNameMailByIdArchive, postV0CityByCityNameMailByIdMarkUnread, postV0CityByCityNameMailByIdRead, postV0CityByCityNameOrderByNameDisable, postV0CityByCityNameOrderByNameEnable, postV0CityByCityNameRigByNameByAction, postV0CityByCityNameServiceByNameRestart, postV0CityByCityNameSessionByIdClose, postV0CityByCityNameSessionByIdKill, postV0CityByCityNameSessionByIdRename, postV0CityByCityNameSessionByIdStop, postV0CityByCityNameSessionByIdSuspend, postV0CityByCityNameSessionByIdWake, postV0CityByCityNameSling, postV0CityByCityNameUnregister, putV0CityByCityNamePatchesAgents, putV0CityByCityNamePatchesProviders, putV0CityByCityNamePatchesRigs, registerExtmsgAdapter, replyMail, respondSession, sendMail, sendSessionMessage, streamAgentOutput, streamAgentOutputQualified, streamEvents, streamSession, streamSupervisorEvents, submitSession } from './sdk.gen';
-export type { AdapterCapabilities, AdapterEventPayload, AgentCreatedOutputBody, AgentCreateInputBody, AgentMapping, AgentOutputResponse, AgentPatch, AgentPatchSetInputBody, AgentResponse, AgentUpdateInputBody, AgentUpdateQualifiedInputBody, AnnotatedAgentResponse, AnnotatedProviderResponse, Bead, BeadAssignInputBody, BeadCreateInputBody, BeadDepsResponse, BeadEventPayload, BeadGraphResponse, BeadUpdateBody, BindingStatus, BoundEventPayload, CityCreateRequest, CityCreateResponse, CityGetResponse, CityInfo, CityLifecyclePayload, CityPatchInputBody, CityUnregisterResponse, ClientOptions, ConfigAgentResponse, ConfigExplainPatches, ConfigExplainResponse, ConfigPatchesResponse, ConfigResponse, ConfigRigResponse, ConfigValidateOutputBody, ConversationGroupParticipant, ConversationGroupRecord, ConversationKind, ConversationRef, ConversationTranscriptRecord, ConvoyAddInputBody, ConvoyCheckResponse, ConvoyCreateInputBody, ConvoyGetResponse, ConvoyProgress, ConvoyRemoveInputBody, CreateAgentData, CreateAgentError, CreateAgentErrors, CreateAgentResponse, CreateAgentResponses, CreateBeadData, CreateBeadError, CreateBeadErrors, CreateBeadResponse, CreateBeadResponses, CreateConvoyData, CreateConvoyError, CreateConvoyErrors, CreateConvoyResponse, CreateConvoyResponses, CreateProviderData, CreateProviderError, CreateProviderErrors, CreateProviderResponse, CreateProviderResponses, CreateRigData, CreateRigError, CreateRigErrors, CreateRigResponse, CreateRigResponses, CreateSessionData, CreateSessionError, CreateSessionErrors, CreateSessionResponse, CreateSessionResponses, DeleteV0CityByCityNameAgentByBaseData, DeleteV0CityByCityNameAgentByBaseError, DeleteV0CityByCityNameAgentByBaseErrors, DeleteV0CityByCityNameAgentByBaseResponse, DeleteV0CityByCityNameAgentByBaseResponses, DeleteV0CityByCityNameAgentByDirByBaseData, DeleteV0CityByCityNameAgentByDirByBaseError, DeleteV0CityByCityNameAgentByDirByBaseErrors, DeleteV0CityByCityNameAgentByDirByBaseResponse, DeleteV0CityByCityNameAgentByDirByBaseResponses, DeleteV0CityByCityNameBeadByIdData, DeleteV0CityByCityNameBeadByIdError, DeleteV0CityByCityNameBeadByIdErrors, DeleteV0CityByCityNameBeadByIdResponse, DeleteV0CityByCityNameBeadByIdResponses, DeleteV0CityByCityNameConvoyByIdData, DeleteV0CityByCityNameConvoyByIdError, DeleteV0CityByCityNameConvoyByIdErrors, DeleteV0CityByCityNameConvoyByIdResponse, DeleteV0CityByCityNameConvoyByIdResponses, DeleteV0CityByCityNameExtmsgAdaptersData, DeleteV0CityByCityNameExtmsgAdaptersError, DeleteV0CityByCityNameExtmsgAdaptersErrors, DeleteV0CityByCityNameExtmsgAdaptersResponse, DeleteV0CityByCityNameExtmsgAdaptersResponses, DeleteV0CityByCityNameExtmsgParticipantsData, DeleteV0CityByCityNameExtmsgParticipantsError, DeleteV0CityByCityNameExtmsgParticipantsErrors, DeleteV0CityByCityNameExtmsgParticipantsResponse, DeleteV0CityByCityNameExtmsgParticipantsResponses, DeleteV0CityByCityNameMailByIdData, DeleteV0CityByCityNameMailByIdError, DeleteV0CityByCityNameMailByIdErrors, DeleteV0CityByCityNameMailByIdResponse, DeleteV0CityByCityNameMailByIdResponses, DeleteV0CityByCityNamePatchesAgentByBaseData, DeleteV0CityByCityNamePatchesAgentByBaseError, DeleteV0CityByCityNamePatchesAgentByBaseErrors, DeleteV0CityByCityNamePatchesAgentByBaseResponse, DeleteV0CityByCityNamePatchesAgentByBaseResponses, DeleteV0CityByCityNamePatchesAgentByDirByBaseData, DeleteV0CityByCityNamePatchesAgentByDirByBaseError, DeleteV0CityByCityNamePatchesAgentByDirByBaseErrors, DeleteV0CityByCityNamePatchesAgentByDirByBaseResponse, DeleteV0CityByCityNamePatchesAgentByDirByBaseResponses, DeleteV0CityByCityNamePatchesProviderByNameData, DeleteV0CityByCityNamePatchesProviderByNameError, DeleteV0CityByCityNamePatchesProviderByNameErrors, DeleteV0CityByCityNamePatchesProviderByNameResponse, DeleteV0CityByCityNamePatchesProviderByNameResponses, DeleteV0CityByCityNamePatchesRigByNameData, DeleteV0CityByCityNamePatchesRigByNameError, DeleteV0CityByCityNamePatchesRigByNameErrors, DeleteV0CityByCityNamePatchesRigByNameResponse, DeleteV0CityByCityNamePatchesRigByNameResponses, DeleteV0CityByCityNameProviderByNameData, DeleteV0CityByCityNameProviderByNameError, DeleteV0CityByCityNameProviderByNameErrors, DeleteV0CityByCityNameProviderByNameResponse, DeleteV0CityByCityNameProviderByNameResponses, DeleteV0CityByCityNameRigByNameData, DeleteV0CityByCityNameRigByNameError, DeleteV0CityByCityNameRigByNameErrors, DeleteV0CityByCityNameRigByNameResponse, DeleteV0CityByCityNameRigByNameResponses, DeleteV0CityByCityNameWorkflowByWorkflowIdData, DeleteV0CityByCityNameWorkflowByWorkflowIdError, DeleteV0CityByCityNameWorkflowByWorkflowIdErrors, DeleteV0CityByCityNameWorkflowByWorkflowIdResponse, DeleteV0CityByCityNameWorkflowByWorkflowIdResponses, DeliveryContextRecord, Dep, EmitEventData, EmitEventError, EmitEventErrors, EmitEventResponse, EmitEventResponses, EnsureExtmsgGroupData, EnsureExtmsgGroupError, EnsureExtmsgGroupErrors, EnsureExtmsgGroupResponse, EnsureExtmsgGroupResponses, ErrorDetail, ErrorModel, EventEmitOutputBody, EventEmitRequest, EventPayload, EventStreamEnvelope, ExternalActor, ExternalAttachment, ExternalInboundMessage, ExtmsgAdapterInfo, ExtMsgAdapterRegisterInputBody, ExtMsgAdapterRegisterOutputBody, ExtMsgAdapterUnregisterInputBody, ExtMsgBindInputBody, ExtMsgGroupEnsureInputBody, ExtMsgInboundInputBody, ExtMsgOutboundInputBody, ExtMsgParticipantRemoveInputBody, ExtMsgParticipantUpsertInputBody, ExtMsgTranscriptAckInputBody, ExtMsgUnbindBody, ExtMsgUnbindInputBody, FanoutPolicy, FormulaDetailResponse, FormulaFeedBody, FormulaListBody, FormulaPreviewBody, FormulaPreviewEdgeResponse, FormulaPreviewNodeResponse, FormulaPreviewResponse, FormulaRecentRunResponse, FormulaRunsResponse, FormulaStepResponse, FormulaSummaryResponse, FormulaVarDefResponse, GetHealthData, GetHealthError, GetHealthErrors, GetHealthResponse, GetHealthResponses, GetV0CitiesData, GetV0CitiesError, GetV0CitiesErrors, GetV0CitiesResponse, GetV0CitiesResponses, GetV0CityByCityNameAgentByBaseData, GetV0CityByCityNameAgentByBaseError, GetV0CityByCityNameAgentByBaseErrors, GetV0CityByCityNameAgentByBaseOutputData, GetV0CityByCityNameAgentByBaseOutputError, GetV0CityByCityNameAgentByBaseOutputErrors, GetV0CityByCityNameAgentByBaseOutputResponse, GetV0CityByCityNameAgentByBaseOutputResponses, GetV0CityByCityNameAgentByBaseResponse, GetV0CityByCityNameAgentByBaseResponses, GetV0CityByCityNameAgentByDirByBaseData, GetV0CityByCityNameAgentByDirByBaseError, GetV0CityByCityNameAgentByDirByBaseErrors, GetV0CityByCityNameAgentByDirByBaseOutputData, GetV0CityByCityNameAgentByDirByBaseOutputError, GetV0CityByCityNameAgentByDirByBaseOutputErrors, GetV0CityByCityNameAgentByDirByBaseOutputResponse, GetV0CityByCityNameAgentByDirByBaseOutputResponses, GetV0CityByCityNameAgentByDirByBaseResponse, GetV0CityByCityNameAgentByDirByBaseResponses, GetV0CityByCityNameAgentsData, GetV0CityByCityNameAgentsError, GetV0CityByCityNameAgentsErrors, GetV0CityByCityNameAgentsResponse, GetV0CityByCityNameAgentsResponses, GetV0CityByCityNameBeadByIdData, GetV0CityByCityNameBeadByIdDepsData, GetV0CityByCityNameBeadByIdDepsError, GetV0CityByCityNameBeadByIdDepsErrors, GetV0CityByCityNameBeadByIdDepsResponse, GetV0CityByCityNameBeadByIdDepsResponses, GetV0CityByCityNameBeadByIdError, GetV0CityByCityNameBeadByIdErrors, GetV0CityByCityNameBeadByIdResponse, GetV0CityByCityNameBeadByIdResponses, GetV0CityByCityNameBeadsData, GetV0CityByCityNameBeadsError, GetV0CityByCityNameBeadsErrors, GetV0CityByCityNameBeadsGraphByRootIdData, GetV0CityByCityNameBeadsGraphByRootIdError, GetV0CityByCityNameBeadsGraphByRootIdErrors, GetV0CityByCityNameBeadsGraphByRootIdResponse, GetV0CityByCityNameBeadsGraphByRootIdResponses, GetV0CityByCityNameBeadsReadyData, GetV0CityByCityNameBeadsReadyError, GetV0CityByCityNameBeadsReadyErrors, GetV0CityByCityNameBeadsReadyResponse, GetV0CityByCityNameBeadsReadyResponses, GetV0CityByCityNameBeadsResponse, GetV0CityByCityNameBeadsResponses, GetV0CityByCityNameConfigData, GetV0CityByCityNameConfigError, GetV0CityByCityNameConfigErrors, GetV0CityByCityNameConfigExplainData, GetV0CityByCityNameConfigExplainError, GetV0CityByCityNameConfigExplainErrors, GetV0CityByCityNameConfigExplainResponse, GetV0CityByCityNameConfigExplainResponses, GetV0CityByCityNameConfigResponse, GetV0CityByCityNameConfigResponses, GetV0CityByCityNameConfigValidateData, GetV0CityByCityNameConfigValidateError, GetV0CityByCityNameConfigValidateErrors, GetV0CityByCityNameConfigValidateResponse, GetV0CityByCityNameConfigValidateResponses, GetV0CityByCityNameConvoyByIdCheckData, GetV0CityByCityNameConvoyByIdCheckError, GetV0CityByCityNameConvoyByIdCheckErrors, GetV0CityByCityNameConvoyByIdCheckResponse, GetV0CityByCityNameConvoyByIdCheckResponses, GetV0CityByCityNameConvoyByIdData, GetV0CityByCityNameConvoyByIdError, GetV0CityByCityNameConvoyByIdErrors, GetV0CityByCityNameConvoyByIdResponse, GetV0CityByCityNameConvoyByIdResponses, GetV0CityByCityNameConvoysData, GetV0CityByCityNameConvoysError, GetV0CityByCityNameConvoysErrors, GetV0CityByCityNameConvoysResponse, GetV0CityByCityNameConvoysResponses, GetV0CityByCityNameData, GetV0CityByCityNameError, GetV0CityByCityNameErrors, GetV0CityByCityNameEventsData, GetV0CityByCityNameEventsError, GetV0CityByCityNameEventsErrors, GetV0CityByCityNameEventsResponse, GetV0CityByCityNameEventsResponses, GetV0CityByCityNameExtmsgAdaptersData, GetV0CityByCityNameExtmsgAdaptersError, GetV0CityByCityNameExtmsgAdaptersErrors, GetV0CityByCityNameExtmsgAdaptersResponse, GetV0CityByCityNameExtmsgAdaptersResponses, GetV0CityByCityNameExtmsgBindingsData, GetV0CityByCityNameExtmsgBindingsError, GetV0CityByCityNameExtmsgBindingsErrors, GetV0CityByCityNameExtmsgBindingsResponse, GetV0CityByCityNameExtmsgBindingsResponses, GetV0CityByCityNameExtmsgGroupsData, GetV0CityByCityNameExtmsgGroupsError, GetV0CityByCityNameExtmsgGroupsErrors, GetV0CityByCityNameExtmsgGroupsResponse, GetV0CityByCityNameExtmsgGroupsResponses, GetV0CityByCityNameExtmsgTranscriptData, GetV0CityByCityNameExtmsgTranscriptError, GetV0CityByCityNameExtmsgTranscriptErrors, GetV0CityByCityNameExtmsgTranscriptResponse, GetV0CityByCityNameExtmsgTranscriptResponses, GetV0CityByCityNameFormulaByNameData, GetV0CityByCityNameFormulaByNameError, GetV0CityByCityNameFormulaByNameErrors, GetV0CityByCityNameFormulaByNameResponse, GetV0CityByCityNameFormulaByNameResponses, GetV0CityByCityNameFormulasByNameData, GetV0CityByCityNameFormulasByNameError, GetV0CityByCityNameFormulasByNameErrors, GetV0CityByCityNameFormulasByNameResponse, GetV0CityByCityNameFormulasByNameResponses, GetV0CityByCityNameFormulasByNameRunsData, GetV0CityByCityNameFormulasByNameRunsError, GetV0CityByCityNameFormulasByNameRunsErrors, GetV0CityByCityNameFormulasByNameRunsResponse, GetV0CityByCityNameFormulasByNameRunsResponses, GetV0CityByCityNameFormulasData, GetV0CityByCityNameFormulasError, GetV0CityByCityNameFormulasErrors, GetV0CityByCityNameFormulasFeedData, GetV0CityByCityNameFormulasFeedError, GetV0CityByCityNameFormulasFeedErrors, GetV0CityByCityNameFormulasFeedResponse, GetV0CityByCityNameFormulasFeedResponses, GetV0CityByCityNameFormulasResponse, GetV0CityByCityNameFormulasResponses, GetV0CityByCityNameHealthData, GetV0CityByCityNameHealthError, GetV0CityByCityNameHealthErrors, GetV0CityByCityNameHealthResponse, GetV0CityByCityNameHealthResponses, GetV0CityByCityNameMailByIdData, GetV0CityByCityNameMailByIdError, GetV0CityByCityNameMailByIdErrors, GetV0CityByCityNameMailByIdResponse, GetV0CityByCityNameMailByIdResponses, GetV0CityByCityNameMailCountData, GetV0CityByCityNameMailCountError, GetV0CityByCityNameMailCountErrors, GetV0CityByCityNameMailCountResponse, GetV0CityByCityNameMailCountResponses, GetV0CityByCityNameMailData, GetV0CityByCityNameMailError, GetV0CityByCityNameMailErrors, GetV0CityByCityNameMailResponse, GetV0CityByCityNameMailResponses, GetV0CityByCityNameMailThreadByIdData, GetV0CityByCityNameMailThreadByIdError, GetV0CityByCityNameMailThreadByIdErrors, GetV0CityByCityNameMailThreadByIdResponse, GetV0CityByCityNameMailThreadByIdResponses, GetV0CityByCityNameOrderByNameData, GetV0CityByCityNameOrderByNameError, GetV0CityByCityNameOrderByNameErrors, GetV0CityByCityNameOrderByNameResponse, GetV0CityByCityNameOrderByNameResponses, GetV0CityByCityNameOrderHistoryByBeadIdData, GetV0CityByCityNameOrderHistoryByBeadIdError, GetV0CityByCityNameOrderHistoryByBeadIdErrors, GetV0CityByCityNameOrderHistoryByBeadIdResponse, GetV0CityByCityNameOrderHistoryByBeadIdResponses, GetV0CityByCityNameOrdersCheckData, GetV0CityByCityNameOrdersCheckError, GetV0CityByCityNameOrdersCheckErrors, GetV0CityByCityNameOrdersCheckResponse, GetV0CityByCityNameOrdersCheckResponses, GetV0CityByCityNameOrdersData, GetV0CityByCityNameOrdersError, GetV0CityByCityNameOrdersErrors, GetV0CityByCityNameOrdersFeedData, GetV0CityByCityNameOrdersFeedError, GetV0CityByCityNameOrdersFeedErrors, GetV0CityByCityNameOrdersFeedResponse, GetV0CityByCityNameOrdersFeedResponses, GetV0CityByCityNameOrdersHistoryData, GetV0CityByCityNameOrdersHistoryError, GetV0CityByCityNameOrdersHistoryErrors, GetV0CityByCityNameOrdersHistoryResponse, GetV0CityByCityNameOrdersHistoryResponses, GetV0CityByCityNameOrdersResponse, GetV0CityByCityNameOrdersResponses, GetV0CityByCityNamePacksData, GetV0CityByCityNamePacksError, GetV0CityByCityNamePacksErrors, GetV0CityByCityNamePacksResponse, GetV0CityByCityNamePacksResponses, GetV0CityByCityNamePatchesAgentByBaseData, GetV0CityByCityNamePatchesAgentByBaseError, GetV0CityByCityNamePatchesAgentByBaseErrors, GetV0CityByCityNamePatchesAgentByBaseResponse, GetV0CityByCityNamePatchesAgentByBaseResponses, GetV0CityByCityNamePatchesAgentByDirByBaseData, GetV0CityByCityNamePatchesAgentByDirByBaseError, GetV0CityByCityNamePatchesAgentByDirByBaseErrors, GetV0CityByCityNamePatchesAgentByDirByBaseResponse, GetV0CityByCityNamePatchesAgentByDirByBaseResponses, GetV0CityByCityNamePatchesAgentsData, GetV0CityByCityNamePatchesAgentsError, GetV0CityByCityNamePatchesAgentsErrors, GetV0CityByCityNamePatchesAgentsResponse, GetV0CityByCityNamePatchesAgentsResponses, GetV0CityByCityNamePatchesProviderByNameData, GetV0CityByCityNamePatchesProviderByNameError, GetV0CityByCityNamePatchesProviderByNameErrors, GetV0CityByCityNamePatchesProviderByNameResponse, GetV0CityByCityNamePatchesProviderByNameResponses, GetV0CityByCityNamePatchesProvidersData, GetV0CityByCityNamePatchesProvidersError, GetV0CityByCityNamePatchesProvidersErrors, GetV0CityByCityNamePatchesProvidersResponse, GetV0CityByCityNamePatchesProvidersResponses, GetV0CityByCityNamePatchesRigByNameData, GetV0CityByCityNamePatchesRigByNameError, GetV0CityByCityNamePatchesRigByNameErrors, GetV0CityByCityNamePatchesRigByNameResponse, GetV0CityByCityNamePatchesRigByNameResponses, GetV0CityByCityNamePatchesRigsData, GetV0CityByCityNamePatchesRigsError, GetV0CityByCityNamePatchesRigsErrors, GetV0CityByCityNamePatchesRigsResponse, GetV0CityByCityNamePatchesRigsResponses, GetV0CityByCityNameProviderByNameData, GetV0CityByCityNameProviderByNameError, GetV0CityByCityNameProviderByNameErrors, GetV0CityByCityNameProviderByNameResponse, GetV0CityByCityNameProviderByNameResponses, GetV0CityByCityNameProviderReadinessData, GetV0CityByCityNameProviderReadinessError, GetV0CityByCityNameProviderReadinessErrors, GetV0CityByCityNameProviderReadinessResponse, GetV0CityByCityNameProviderReadinessResponses, GetV0CityByCityNameProvidersData, GetV0CityByCityNameProvidersError, GetV0CityByCityNameProvidersErrors, GetV0CityByCityNameProvidersPublicData, GetV0CityByCityNameProvidersPublicError, GetV0CityByCityNameProvidersPublicErrors, GetV0CityByCityNameProvidersPublicResponse, GetV0CityByCityNameProvidersPublicResponses, GetV0CityByCityNameProvidersResponse, GetV0CityByCityNameProvidersResponses, GetV0CityByCityNameReadinessData, GetV0CityByCityNameReadinessError, GetV0CityByCityNameReadinessErrors, GetV0CityByCityNameReadinessResponse, GetV0CityByCityNameReadinessResponses, GetV0CityByCityNameResponse, GetV0CityByCityNameResponses, GetV0CityByCityNameRigByNameData, GetV0CityByCityNameRigByNameError, GetV0CityByCityNameRigByNameErrors, GetV0CityByCityNameRigByNameResponse, GetV0CityByCityNameRigByNameResponses, GetV0CityByCityNameRigsData, GetV0CityByCityNameRigsError, GetV0CityByCityNameRigsErrors, GetV0CityByCityNameRigsResponse, GetV0CityByCityNameRigsResponses, GetV0CityByCityNameServiceByNameData, GetV0CityByCityNameServiceByNameError, GetV0CityByCityNameServiceByNameErrors, GetV0CityByCityNameServiceByNameResponse, GetV0CityByCityNameServiceByNameResponses, GetV0CityByCityNameServicesData, GetV0CityByCityNameServicesError, GetV0CityByCityNameServicesErrors, GetV0CityByCityNameServicesResponse, GetV0CityByCityNameServicesResponses, GetV0CityByCityNameSessionByIdAgentsByAgentIdData, GetV0CityByCityNameSessionByIdAgentsByAgentIdError, GetV0CityByCityNameSessionByIdAgentsByAgentIdErrors, GetV0CityByCityNameSessionByIdAgentsByAgentIdResponse, GetV0CityByCityNameSessionByIdAgentsByAgentIdResponses, GetV0CityByCityNameSessionByIdAgentsData, GetV0CityByCityNameSessionByIdAgentsError, GetV0CityByCityNameSessionByIdAgentsErrors, GetV0CityByCityNameSessionByIdAgentsResponse, GetV0CityByCityNameSessionByIdAgentsResponses, GetV0CityByCityNameSessionByIdData, GetV0CityByCityNameSessionByIdError, GetV0CityByCityNameSessionByIdErrors, GetV0CityByCityNameSessionByIdPendingData, GetV0CityByCityNameSessionByIdPendingError, GetV0CityByCityNameSessionByIdPendingErrors, GetV0CityByCityNameSessionByIdPendingResponse, GetV0CityByCityNameSessionByIdPendingResponses, GetV0CityByCityNameSessionByIdResponse, GetV0CityByCityNameSessionByIdResponses, GetV0CityByCityNameSessionByIdTranscriptData, GetV0CityByCityNameSessionByIdTranscriptError, GetV0CityByCityNameSessionByIdTranscriptErrors, GetV0CityByCityNameSessionByIdTranscriptResponse, GetV0CityByCityNameSessionByIdTranscriptResponses, GetV0CityByCityNameSessionsData, GetV0CityByCityNameSessionsError, GetV0CityByCityNameSessionsErrors, GetV0CityByCityNameSessionsResponse, GetV0CityByCityNameSessionsResponses, GetV0CityByCityNameStatusData, GetV0CityByCityNameStatusError, GetV0CityByCityNameStatusErrors, GetV0CityByCityNameStatusResponse, GetV0CityByCityNameStatusResponses, GetV0CityByCityNameWorkflowByWorkflowIdData, GetV0CityByCityNameWorkflowByWorkflowIdError, GetV0CityByCityNameWorkflowByWorkflowIdErrors, GetV0CityByCityNameWorkflowByWorkflowIdResponse, GetV0CityByCityNameWorkflowByWorkflowIdResponses, GetV0EventsData, GetV0EventsError, GetV0EventsErrors, GetV0EventsResponse, GetV0EventsResponses, GetV0ProviderReadinessData, GetV0ProviderReadinessError, GetV0ProviderReadinessErrors, GetV0ProviderReadinessResponse, GetV0ProviderReadinessResponses, GetV0ReadinessData, GetV0ReadinessError, GetV0ReadinessErrors, GetV0ReadinessResponse, GetV0ReadinessResponses, GitStatus, GroupCreatedEventPayload, GroupRouteDecision, HealthOutputBody, HeartbeatEvent, InboundEventPayload, InboundResult, ListBodyAgentPatch, ListBodyAgentResponse, ListBodyBead, ListBodyConversationTranscriptRecord, ListBodyExtmsgAdapterInfo, ListBodyProviderPatch, ListBodyProviderResponse, ListBodyRigPatch, ListBodyRigResponse, ListBodySessionBindingRecord, ListBodySessionResponse, ListBodyStatus, ListBodyWireEvent, LogicalNode, MailCountOutputBody, MailEventPayload, MailListBody, MailReplyInputBody, MailSendInputBody, Message, MonitorFeedItemResponse, NoPayload, OkResponseBody, OkWithIdResponseBody, OptionChoiceDto, OrderCheckListBody, OrderCheckResponse, OrderHistoryDetailResponse, OrderHistoryEntry, OrderHistoryListBody, OrderListBody, OrderResponse, OrdersFeedBody, OutboundEventPayload, OutboundResult, OutputTurn, PackListBody, PackResponse, PaginationInfo, PatchDeletedResponseBody, PatchOkResponseBody, PatchV0CityByCityNameAgentByBaseData, PatchV0CityByCityNameAgentByBaseError, PatchV0CityByCityNameAgentByBaseErrors, PatchV0CityByCityNameAgentByBaseResponse, PatchV0CityByCityNameAgentByBaseResponses, PatchV0CityByCityNameAgentByDirByBaseData, PatchV0CityByCityNameAgentByDirByBaseError, PatchV0CityByCityNameAgentByDirByBaseErrors, PatchV0CityByCityNameAgentByDirByBaseResponse, PatchV0CityByCityNameAgentByDirByBaseResponses, PatchV0CityByCityNameBeadByIdData, PatchV0CityByCityNameBeadByIdError, PatchV0CityByCityNameBeadByIdErrors, PatchV0CityByCityNameBeadByIdResponse, PatchV0CityByCityNameBeadByIdResponses, PatchV0CityByCityNameData, PatchV0CityByCityNameError, PatchV0CityByCityNameErrors, PatchV0CityByCityNameProviderByNameData, PatchV0CityByCityNameProviderByNameError, PatchV0CityByCityNameProviderByNameErrors, PatchV0CityByCityNameProviderByNameResponse, PatchV0CityByCityNameProviderByNameResponses, PatchV0CityByCityNameResponse, PatchV0CityByCityNameResponses, PatchV0CityByCityNameRigByNameData, PatchV0CityByCityNameRigByNameError, PatchV0CityByCityNameRigByNameErrors, PatchV0CityByCityNameRigByNameResponse, PatchV0CityByCityNameRigByNameResponses, PatchV0CityByCityNameSessionByIdData, PatchV0CityByCityNameSessionByIdError, PatchV0CityByCityNameSessionByIdErrors, PatchV0CityByCityNameSessionByIdResponse, PatchV0CityByCityNameSessionByIdResponses, PendingInteraction, PoolOverride, PostV0CityByCityNameAgentByBaseByActionData, PostV0CityByCityNameAgentByBaseByActionError, PostV0CityByCityNameAgentByBaseByActionErrors, PostV0CityByCityNameAgentByBaseByActionResponse, PostV0CityByCityNameAgentByBaseByActionResponses, PostV0CityByCityNameAgentByDirByBaseByActionData, PostV0CityByCityNameAgentByDirByBaseByActionError, PostV0CityByCityNameAgentByDirByBaseByActionErrors, PostV0CityByCityNameAgentByDirByBaseByActionResponse, PostV0CityByCityNameAgentByDirByBaseByActionResponses, PostV0CityByCityNameBeadByIdAssignData, PostV0CityByCityNameBeadByIdAssignError, PostV0CityByCityNameBeadByIdAssignErrors, PostV0CityByCityNameBeadByIdAssignResponse, PostV0CityByCityNameBeadByIdAssignResponses, PostV0CityByCityNameBeadByIdCloseData, PostV0CityByCityNameBeadByIdCloseError, PostV0CityByCityNameBeadByIdCloseErrors, PostV0CityByCityNameBeadByIdCloseResponse, PostV0CityByCityNameBeadByIdCloseResponses, PostV0CityByCityNameBeadByIdReopenData, PostV0CityByCityNameBeadByIdReopenError, PostV0CityByCityNameBeadByIdReopenErrors, PostV0CityByCityNameBeadByIdReopenResponse, PostV0CityByCityNameBeadByIdReopenResponses, PostV0CityByCityNameBeadByIdUpdateData, PostV0CityByCityNameBeadByIdUpdateError, PostV0CityByCityNameBeadByIdUpdateErrors, PostV0CityByCityNameBeadByIdUpdateResponse, PostV0CityByCityNameBeadByIdUpdateResponses, PostV0CityByCityNameConvoyByIdAddData, PostV0CityByCityNameConvoyByIdAddError, PostV0CityByCityNameConvoyByIdAddErrors, PostV0CityByCityNameConvoyByIdAddResponse, PostV0CityByCityNameConvoyByIdAddResponses, PostV0CityByCityNameConvoyByIdCloseData, PostV0CityByCityNameConvoyByIdCloseError, PostV0CityByCityNameConvoyByIdCloseErrors, PostV0CityByCityNameConvoyByIdCloseResponse, PostV0CityByCityNameConvoyByIdCloseResponses, PostV0CityByCityNameConvoyByIdRemoveData, PostV0CityByCityNameConvoyByIdRemoveError, PostV0CityByCityNameConvoyByIdRemoveErrors, PostV0CityByCityNameConvoyByIdRemoveResponse, PostV0CityByCityNameConvoyByIdRemoveResponses, PostV0CityByCityNameExtmsgBindData, PostV0CityByCityNameExtmsgBindError, PostV0CityByCityNameExtmsgBindErrors, PostV0CityByCityNameExtmsgBindResponse, PostV0CityByCityNameExtmsgBindResponses, PostV0CityByCityNameExtmsgInboundData, PostV0CityByCityNameExtmsgInboundError, PostV0CityByCityNameExtmsgInboundErrors, PostV0CityByCityNameExtmsgInboundResponse, PostV0CityByCityNameExtmsgInboundResponses, PostV0CityByCityNameExtmsgOutboundData, PostV0CityByCityNameExtmsgOutboundError, PostV0CityByCityNameExtmsgOutboundErrors, PostV0CityByCityNameExtmsgOutboundResponse, PostV0CityByCityNameExtmsgOutboundResponses, PostV0CityByCityNameExtmsgParticipantsData, PostV0CityByCityNameExtmsgParticipantsError, PostV0CityByCityNameExtmsgParticipantsErrors, PostV0CityByCityNameExtmsgParticipantsResponse, PostV0CityByCityNameExtmsgParticipantsResponses, PostV0CityByCityNameExtmsgTranscriptAckData, PostV0CityByCityNameExtmsgTranscriptAckError, PostV0CityByCityNameExtmsgTranscriptAckErrors, PostV0CityByCityNameExtmsgTranscriptAckResponse, PostV0CityByCityNameExtmsgTranscriptAckResponses, PostV0CityByCityNameExtmsgUnbindData, PostV0CityByCityNameExtmsgUnbindError, PostV0CityByCityNameExtmsgUnbindErrors, PostV0CityByCityNameExtmsgUnbindResponse, PostV0CityByCityNameExtmsgUnbindResponses, PostV0CityByCityNameFormulasByNamePreviewData, PostV0CityByCityNameFormulasByNamePreviewError, PostV0CityByCityNameFormulasByNamePreviewErrors, PostV0CityByCityNameFormulasByNamePreviewResponse, PostV0CityByCityNameFormulasByNamePreviewResponses, PostV0CityByCityNameMailByIdArchiveData, PostV0CityByCityNameMailByIdArchiveError, PostV0CityByCityNameMailByIdArchiveErrors, PostV0CityByCityNameMailByIdArchiveResponse, PostV0CityByCityNameMailByIdArchiveResponses, PostV0CityByCityNameMailByIdMarkUnreadData, PostV0CityByCityNameMailByIdMarkUnreadError, PostV0CityByCityNameMailByIdMarkUnreadErrors, PostV0CityByCityNameMailByIdMarkUnreadResponse, PostV0CityByCityNameMailByIdMarkUnreadResponses, PostV0CityByCityNameMailByIdReadData, PostV0CityByCityNameMailByIdReadError, PostV0CityByCityNameMailByIdReadErrors, PostV0CityByCityNameMailByIdReadResponse, PostV0CityByCityNameMailByIdReadResponses, PostV0CityByCityNameOrderByNameDisableData, PostV0CityByCityNameOrderByNameDisableError, PostV0CityByCityNameOrderByNameDisableErrors, PostV0CityByCityNameOrderByNameDisableResponse, PostV0CityByCityNameOrderByNameDisableResponses, PostV0CityByCityNameOrderByNameEnableData, PostV0CityByCityNameOrderByNameEnableError, PostV0CityByCityNameOrderByNameEnableErrors, PostV0CityByCityNameOrderByNameEnableResponse, PostV0CityByCityNameOrderByNameEnableResponses, PostV0CityByCityNameRigByNameByActionData, PostV0CityByCityNameRigByNameByActionError, PostV0CityByCityNameRigByNameByActionErrors, PostV0CityByCityNameRigByNameByActionResponse, PostV0CityByCityNameRigByNameByActionResponses, PostV0CityByCityNameServiceByNameRestartData, PostV0CityByCityNameServiceByNameRestartError, PostV0CityByCityNameServiceByNameRestartErrors, PostV0CityByCityNameServiceByNameRestartResponse, PostV0CityByCityNameServiceByNameRestartResponses, PostV0CityByCityNameSessionByIdCloseData, PostV0CityByCityNameSessionByIdCloseError, PostV0CityByCityNameSessionByIdCloseErrors, PostV0CityByCityNameSessionByIdCloseResponse, PostV0CityByCityNameSessionByIdCloseResponses, PostV0CityByCityNameSessionByIdKillData, PostV0CityByCityNameSessionByIdKillError, PostV0CityByCityNameSessionByIdKillErrors, PostV0CityByCityNameSessionByIdKillResponse, PostV0CityByCityNameSessionByIdKillResponses, PostV0CityByCityNameSessionByIdRenameData, PostV0CityByCityNameSessionByIdRenameError, PostV0CityByCityNameSessionByIdRenameErrors, PostV0CityByCityNameSessionByIdRenameResponse, PostV0CityByCityNameSessionByIdRenameResponses, PostV0CityByCityNameSessionByIdStopData, PostV0CityByCityNameSessionByIdStopError, PostV0CityByCityNameSessionByIdStopErrors, PostV0CityByCityNameSessionByIdStopResponse, PostV0CityByCityNameSessionByIdStopResponses, PostV0CityByCityNameSessionByIdSuspendData, PostV0CityByCityNameSessionByIdSuspendError, PostV0CityByCityNameSessionByIdSuspendErrors, PostV0CityByCityNameSessionByIdSuspendResponse, PostV0CityByCityNameSessionByIdSuspendResponses, PostV0CityByCityNameSessionByIdWakeData, PostV0CityByCityNameSessionByIdWakeError, PostV0CityByCityNameSessionByIdWakeErrors, PostV0CityByCityNameSessionByIdWakeResponse, PostV0CityByCityNameSessionByIdWakeResponses, PostV0CityByCityNameSlingData, PostV0CityByCityNameSlingError, PostV0CityByCityNameSlingErrors, PostV0CityByCityNameSlingResponse, PostV0CityByCityNameSlingResponses, PostV0CityByCityNameUnregisterData, PostV0CityByCityNameUnregisterError, PostV0CityByCityNameUnregisterErrors, PostV0CityByCityNameUnregisterResponse, PostV0CityByCityNameUnregisterResponses, PostV0CityData, PostV0CityError, PostV0CityErrors, PostV0CityResponse, PostV0CityResponses, ProviderCreatedOutputBody, ProviderCreateInputBody, ProviderOptionDto, ProviderPatch, ProviderPatchSetInputBody, ProviderPublicListBody, ProviderPublicResponse, ProviderReadiness, ProviderReadinessResponse, ProviderResponse, ProviderSpecJson, ProviderUpdateInputBody, PublishReceipt, PutV0CityByCityNamePatchesAgentsData, PutV0CityByCityNamePatchesAgentsError, PutV0CityByCityNamePatchesAgentsErrors, PutV0CityByCityNamePatchesAgentsResponse, PutV0CityByCityNamePatchesAgentsResponses, PutV0CityByCityNamePatchesProvidersData, PutV0CityByCityNamePatchesProvidersError, PutV0CityByCityNamePatchesProvidersErrors, PutV0CityByCityNamePatchesProvidersResponse, PutV0CityByCityNamePatchesProvidersResponses, PutV0CityByCityNamePatchesRigsData, PutV0CityByCityNamePatchesRigsError, PutV0CityByCityNamePatchesRigsErrors, PutV0CityByCityNamePatchesRigsResponse, PutV0CityByCityNamePatchesRigsResponses, ReadinessItem, ReadinessResponse, RegisterExtmsgAdapterData, RegisterExtmsgAdapterError, RegisterExtmsgAdapterErrors, RegisterExtmsgAdapterResponse, RegisterExtmsgAdapterResponses, ReplyMailData, ReplyMailError, ReplyMailErrors, ReplyMailResponse, ReplyMailResponses, RespondSessionData, RespondSessionError, RespondSessionErrors, RespondSessionResponse, RespondSessionResponses, RigActionBody, RigCreatedOutputBody, RigCreateInputBody, RigPatch, RigPatchSetInputBody, RigResponse, RigUpdateInputBody, ScopeGroup, SendMailData, SendMailError, SendMailErrors, SendMailResponse, SendMailResponses, SendSessionMessageData, SendSessionMessageError, SendSessionMessageErrors, SendSessionMessageResponse, SendSessionMessageResponses, ServiceRestartOutputBody, SessionActivityEvent, SessionAgentGetResponse, SessionAgentListResponse, SessionBindingRecord, SessionCreateBody, SessionInfo, SessionMessageInputBody, SessionMessageOutputBody, SessionPatchBody, SessionPendingResponse, SessionRawMessageFrame, SessionRenameInputBody, SessionRespondInputBody, SessionRespondOutputBody, SessionResponse, SessionStreamCommonEvent, SessionStreamMessageEvent, SessionStreamRawMessageEvent, SessionSubmitInputBody, SessionSubmitOutputBody, SessionTranscriptGetResponse, SlingInputBody, SlingResponse, Status, StatusAgentCounts, StatusBody, StatusMailCounts, StatusRigCounts, StatusWorkCounts, StreamAgentOutputData, StreamAgentOutputError, StreamAgentOutputErrors, StreamAgentOutputQualifiedData, StreamAgentOutputQualifiedError, StreamAgentOutputQualifiedErrors, StreamAgentOutputQualifiedResponse, StreamAgentOutputQualifiedResponses, StreamAgentOutputResponse, StreamAgentOutputResponses, StreamEventsData, StreamEventsError, StreamEventsErrors, StreamEventsResponse, StreamEventsResponses, StreamSessionData, StreamSessionError, StreamSessionErrors, StreamSessionResponse, StreamSessionResponses, StreamSupervisorEventsData, StreamSupervisorEventsError, StreamSupervisorEventsErrors, StreamSupervisorEventsResponse, StreamSupervisorEventsResponses, SubmissionCapabilities, SubmitIntent, SubmitSessionData, SubmitSessionError, SubmitSessionErrors, SubmitSessionResponse, SubmitSessionResponses, SupervisorCitiesOutputBody, SupervisorEventListOutputBody, SupervisorHealthOutputBody, SupervisorStartup, TaggedEventStreamEnvelope, TranscriptMessageKind, TranscriptProvenance, TypedEventStreamEnvelope, TypedEventStreamEnvelopeBeadClosed, TypedEventStreamEnvelopeBeadCreated, TypedEventStreamEnvelopeBeadUpdated, TypedEventStreamEnvelopeCityCreated, TypedEventStreamEnvelopeCityInitFailed, TypedEventStreamEnvelopeCityReady, TypedEventStreamEnvelopeCityResumed, TypedEventStreamEnvelopeCitySuspended, TypedEventStreamEnvelopeCityUnregistered, TypedEventStreamEnvelopeCityUnregisterFailed, TypedEventStreamEnvelopeCityUnregisterRequested, TypedEventStreamEnvelopeControllerStarted, TypedEventStreamEnvelopeControllerStopped, TypedEventStreamEnvelopeConvoyClosed, TypedEventStreamEnvelopeConvoyCreated, TypedEventStreamEnvelopeExtmsgAdapterAdded, TypedEventStreamEnvelopeExtmsgAdapterRemoved, TypedEventStreamEnvelopeExtmsgBound, TypedEventStreamEnvelopeExtmsgGroupCreated, TypedEventStreamEnvelopeExtmsgInbound, TypedEventStreamEnvelopeExtmsgOutbound, TypedEventStreamEnvelopeExtmsgUnbound, TypedEventStreamEnvelopeMailArchived, TypedEventStreamEnvelopeMailDeleted, TypedEventStreamEnvelopeMailMarkedRead, TypedEventStreamEnvelopeMailMarkedUnread, TypedEventStreamEnvelopeMailRead, TypedEventStreamEnvelopeMailReplied, TypedEventStreamEnvelopeMailSent, TypedEventStreamEnvelopeOrderCompleted, TypedEventStreamEnvelopeOrderFailed, TypedEventStreamEnvelopeOrderFired, TypedEventStreamEnvelopeProviderSwapped, TypedEventStreamEnvelopeSessionCrashed, TypedEventStreamEnvelopeSessionDraining, TypedEventStreamEnvelopeSessionIdleKilled, TypedEventStreamEnvelopeSessionQuarantined, TypedEventStreamEnvelopeSessionStopped, TypedEventStreamEnvelopeSessionSuspended, TypedEventStreamEnvelopeSessionUndrained, TypedEventStreamEnvelopeSessionUpdated, TypedEventStreamEnvelopeSessionWoke, TypedEventStreamEnvelopeWorkerOperation, TypedTaggedEventStreamEnvelope, TypedTaggedEventStreamEnvelopeBeadClosed, TypedTaggedEventStreamEnvelopeBeadCreated, TypedTaggedEventStreamEnvelopeBeadUpdated, TypedTaggedEventStreamEnvelopeCityCreated, TypedTaggedEventStreamEnvelopeCityInitFailed, TypedTaggedEventStreamEnvelopeCityReady, TypedTaggedEventStreamEnvelopeCityResumed, TypedTaggedEventStreamEnvelopeCitySuspended, TypedTaggedEventStreamEnvelopeCityUnregistered, TypedTaggedEventStreamEnvelopeCityUnregisterFailed, TypedTaggedEventStreamEnvelopeCityUnregisterRequested, TypedTaggedEventStreamEnvelopeControllerStarted, TypedTaggedEventStreamEnvelopeControllerStopped, TypedTaggedEventStreamEnvelopeConvoyClosed, TypedTaggedEventStreamEnvelopeConvoyCreated, TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded, TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved, TypedTaggedEventStreamEnvelopeExtmsgBound, TypedTaggedEventStreamEnvelopeExtmsgGroupCreated, TypedTaggedEventStreamEnvelopeExtmsgInbound, TypedTaggedEventStreamEnvelopeExtmsgOutbound, TypedTaggedEventStreamEnvelopeExtmsgUnbound, TypedTaggedEventStreamEnvelopeMailArchived, TypedTaggedEventStreamEnvelopeMailDeleted, TypedTaggedEventStreamEnvelopeMailMarkedRead, TypedTaggedEventStreamEnvelopeMailMarkedUnread, TypedTaggedEventStreamEnvelopeMailRead, TypedTaggedEventStreamEnvelopeMailReplied, TypedTaggedEventStreamEnvelopeMailSent, TypedTaggedEventStreamEnvelopeOrderCompleted, TypedTaggedEventStreamEnvelopeOrderFailed, TypedTaggedEventStreamEnvelopeOrderFired, TypedTaggedEventStreamEnvelopeProviderSwapped, TypedTaggedEventStreamEnvelopeSessionCrashed, TypedTaggedEventStreamEnvelopeSessionDraining, TypedTaggedEventStreamEnvelopeSessionIdleKilled, TypedTaggedEventStreamEnvelopeSessionQuarantined, TypedTaggedEventStreamEnvelopeSessionStopped, TypedTaggedEventStreamEnvelopeSessionSuspended, TypedTaggedEventStreamEnvelopeSessionUndrained, TypedTaggedEventStreamEnvelopeSessionUpdated, TypedTaggedEventStreamEnvelopeSessionWoke, TypedTaggedEventStreamEnvelopeWorkerOperation, UnboundEventPayload, WireEvent, WireTaggedEvent, WorkerOperationEventPayload, WorkflowAttemptSummary, WorkflowBeadResponse, WorkflowDeleteResponse, WorkflowDepResponse, WorkflowEventProjection, WorkflowSnapshotResponse, WorkspaceResponse } from './types.gen';
+export type { AdapterCapabilities, AdapterEventPayload, AgentCreatedOutputBody, AgentCreateInputBody, AgentMapping, AgentOutputResponse, AgentPatch, AgentPatchSetInputBody, AgentResponse, AgentUpdateInputBody, AgentUpdateQualifiedInputBody, AnnotatedAgentResponse, AnnotatedProviderResponse, AsyncAcceptedBody, AsyncAcceptedResponse, Bead, BeadAssignInputBody, BeadCreateInputBody, BeadDepsResponse, BeadEventPayload, BeadGraphResponse, BeadUpdateBody, BindingStatus, BoundEventPayload, CityCreateRequest, CityCreateSucceededPayload, CityGetResponse, CityInfo, CityLifecyclePayload, CityPatchInputBody, CityUnregisterSucceededPayload, ClientOptions, ConfigAgentResponse, ConfigExplainPatches, ConfigExplainResponse, ConfigPatchesResponse, ConfigResponse, ConfigRigResponse, ConfigValidateOutputBody, ConversationGroupParticipant, ConversationGroupRecord, ConversationKind, ConversationRef, ConversationTranscriptRecord, ConvoyAddInputBody, ConvoyCheckResponse, ConvoyCreateInputBody, ConvoyGetResponse, ConvoyProgress, ConvoyRemoveInputBody, CreateAgentData, CreateAgentError, CreateAgentErrors, CreateAgentResponse, CreateAgentResponses, CreateBeadData, CreateBeadError, CreateBeadErrors, CreateBeadResponse, CreateBeadResponses, CreateConvoyData, CreateConvoyError, CreateConvoyErrors, CreateConvoyResponse, CreateConvoyResponses, CreateProviderData, CreateProviderError, CreateProviderErrors, CreateProviderResponse, CreateProviderResponses, CreateRigData, CreateRigError, CreateRigErrors, CreateRigResponse, CreateRigResponses, CreateSessionData, CreateSessionError, CreateSessionErrors, CreateSessionResponse, CreateSessionResponses, DeleteV0CityByCityNameAgentByBaseData, DeleteV0CityByCityNameAgentByBaseError, DeleteV0CityByCityNameAgentByBaseErrors, DeleteV0CityByCityNameAgentByBaseResponse, DeleteV0CityByCityNameAgentByBaseResponses, DeleteV0CityByCityNameAgentByDirByBaseData, DeleteV0CityByCityNameAgentByDirByBaseError, DeleteV0CityByCityNameAgentByDirByBaseErrors, DeleteV0CityByCityNameAgentByDirByBaseResponse, DeleteV0CityByCityNameAgentByDirByBaseResponses, DeleteV0CityByCityNameBeadByIdData, DeleteV0CityByCityNameBeadByIdError, DeleteV0CityByCityNameBeadByIdErrors, DeleteV0CityByCityNameBeadByIdResponse, DeleteV0CityByCityNameBeadByIdResponses, DeleteV0CityByCityNameConvoyByIdData, DeleteV0CityByCityNameConvoyByIdError, DeleteV0CityByCityNameConvoyByIdErrors, DeleteV0CityByCityNameConvoyByIdResponse, DeleteV0CityByCityNameConvoyByIdResponses, DeleteV0CityByCityNameExtmsgAdaptersData, DeleteV0CityByCityNameExtmsgAdaptersError, DeleteV0CityByCityNameExtmsgAdaptersErrors, DeleteV0CityByCityNameExtmsgAdaptersResponse, DeleteV0CityByCityNameExtmsgAdaptersResponses, DeleteV0CityByCityNameExtmsgParticipantsData, DeleteV0CityByCityNameExtmsgParticipantsError, DeleteV0CityByCityNameExtmsgParticipantsErrors, DeleteV0CityByCityNameExtmsgParticipantsResponse, DeleteV0CityByCityNameExtmsgParticipantsResponses, DeleteV0CityByCityNameMailByIdData, DeleteV0CityByCityNameMailByIdError, DeleteV0CityByCityNameMailByIdErrors, DeleteV0CityByCityNameMailByIdResponse, DeleteV0CityByCityNameMailByIdResponses, DeleteV0CityByCityNamePatchesAgentByBaseData, DeleteV0CityByCityNamePatchesAgentByBaseError, DeleteV0CityByCityNamePatchesAgentByBaseErrors, DeleteV0CityByCityNamePatchesAgentByBaseResponse, DeleteV0CityByCityNamePatchesAgentByBaseResponses, DeleteV0CityByCityNamePatchesAgentByDirByBaseData, DeleteV0CityByCityNamePatchesAgentByDirByBaseError, DeleteV0CityByCityNamePatchesAgentByDirByBaseErrors, DeleteV0CityByCityNamePatchesAgentByDirByBaseResponse, DeleteV0CityByCityNamePatchesAgentByDirByBaseResponses, DeleteV0CityByCityNamePatchesProviderByNameData, DeleteV0CityByCityNamePatchesProviderByNameError, DeleteV0CityByCityNamePatchesProviderByNameErrors, DeleteV0CityByCityNamePatchesProviderByNameResponse, DeleteV0CityByCityNamePatchesProviderByNameResponses, DeleteV0CityByCityNamePatchesRigByNameData, DeleteV0CityByCityNamePatchesRigByNameError, DeleteV0CityByCityNamePatchesRigByNameErrors, DeleteV0CityByCityNamePatchesRigByNameResponse, DeleteV0CityByCityNamePatchesRigByNameResponses, DeleteV0CityByCityNameProviderByNameData, DeleteV0CityByCityNameProviderByNameError, DeleteV0CityByCityNameProviderByNameErrors, DeleteV0CityByCityNameProviderByNameResponse, DeleteV0CityByCityNameProviderByNameResponses, DeleteV0CityByCityNameRigByNameData, DeleteV0CityByCityNameRigByNameError, DeleteV0CityByCityNameRigByNameErrors, DeleteV0CityByCityNameRigByNameResponse, DeleteV0CityByCityNameRigByNameResponses, DeleteV0CityByCityNameWorkflowByWorkflowIdData, DeleteV0CityByCityNameWorkflowByWorkflowIdError, DeleteV0CityByCityNameWorkflowByWorkflowIdErrors, DeleteV0CityByCityNameWorkflowByWorkflowIdResponse, DeleteV0CityByCityNameWorkflowByWorkflowIdResponses, DeliveryContextRecord, Dep, EmitEventData, EmitEventError, EmitEventErrors, EmitEventResponse, EmitEventResponses, EnsureExtmsgGroupData, EnsureExtmsgGroupError, EnsureExtmsgGroupErrors, EnsureExtmsgGroupResponse, EnsureExtmsgGroupResponses, ErrorDetail, ErrorModel, EventEmitOutputBody, EventEmitRequest, EventPayload, EventStreamEnvelope, ExternalActor, ExternalAttachment, ExternalInboundMessage, ExtmsgAdapterInfo, ExtMsgAdapterRegisterInputBody, ExtMsgAdapterRegisterOutputBody, ExtMsgAdapterUnregisterInputBody, ExtMsgBindInputBody, ExtMsgGroupEnsureInputBody, ExtMsgInboundInputBody, ExtMsgOutboundInputBody, ExtMsgParticipantRemoveInputBody, ExtMsgParticipantUpsertInputBody, ExtMsgTranscriptAckInputBody, ExtMsgUnbindBody, ExtMsgUnbindInputBody, FanoutPolicy, FormulaDetailResponse, FormulaFeedBody, FormulaListBody, FormulaPreviewBody, FormulaPreviewEdgeResponse, FormulaPreviewNodeResponse, FormulaPreviewResponse, FormulaRecentRunResponse, FormulaRunsResponse, FormulaStepResponse, FormulaSummaryResponse, FormulaVarDefResponse, GetHealthData, GetHealthError, GetHealthErrors, GetHealthResponse, GetHealthResponses, GetV0CitiesData, GetV0CitiesError, GetV0CitiesErrors, GetV0CitiesResponse, GetV0CitiesResponses, GetV0CityByCityNameAgentByBaseData, GetV0CityByCityNameAgentByBaseError, GetV0CityByCityNameAgentByBaseErrors, GetV0CityByCityNameAgentByBaseOutputData, GetV0CityByCityNameAgentByBaseOutputError, GetV0CityByCityNameAgentByBaseOutputErrors, GetV0CityByCityNameAgentByBaseOutputResponse, GetV0CityByCityNameAgentByBaseOutputResponses, GetV0CityByCityNameAgentByBaseResponse, GetV0CityByCityNameAgentByBaseResponses, GetV0CityByCityNameAgentByDirByBaseData, GetV0CityByCityNameAgentByDirByBaseError, GetV0CityByCityNameAgentByDirByBaseErrors, GetV0CityByCityNameAgentByDirByBaseOutputData, GetV0CityByCityNameAgentByDirByBaseOutputError, GetV0CityByCityNameAgentByDirByBaseOutputErrors, GetV0CityByCityNameAgentByDirByBaseOutputResponse, GetV0CityByCityNameAgentByDirByBaseOutputResponses, GetV0CityByCityNameAgentByDirByBaseResponse, GetV0CityByCityNameAgentByDirByBaseResponses, GetV0CityByCityNameAgentsData, GetV0CityByCityNameAgentsError, GetV0CityByCityNameAgentsErrors, GetV0CityByCityNameAgentsResponse, GetV0CityByCityNameAgentsResponses, GetV0CityByCityNameBeadByIdData, GetV0CityByCityNameBeadByIdDepsData, GetV0CityByCityNameBeadByIdDepsError, GetV0CityByCityNameBeadByIdDepsErrors, GetV0CityByCityNameBeadByIdDepsResponse, GetV0CityByCityNameBeadByIdDepsResponses, GetV0CityByCityNameBeadByIdError, GetV0CityByCityNameBeadByIdErrors, GetV0CityByCityNameBeadByIdResponse, GetV0CityByCityNameBeadByIdResponses, GetV0CityByCityNameBeadsData, GetV0CityByCityNameBeadsError, GetV0CityByCityNameBeadsErrors, GetV0CityByCityNameBeadsGraphByRootIdData, GetV0CityByCityNameBeadsGraphByRootIdError, GetV0CityByCityNameBeadsGraphByRootIdErrors, GetV0CityByCityNameBeadsGraphByRootIdResponse, GetV0CityByCityNameBeadsGraphByRootIdResponses, GetV0CityByCityNameBeadsReadyData, GetV0CityByCityNameBeadsReadyError, GetV0CityByCityNameBeadsReadyErrors, GetV0CityByCityNameBeadsReadyResponse, GetV0CityByCityNameBeadsReadyResponses, GetV0CityByCityNameBeadsResponse, GetV0CityByCityNameBeadsResponses, GetV0CityByCityNameConfigData, GetV0CityByCityNameConfigError, GetV0CityByCityNameConfigErrors, GetV0CityByCityNameConfigExplainData, GetV0CityByCityNameConfigExplainError, GetV0CityByCityNameConfigExplainErrors, GetV0CityByCityNameConfigExplainResponse, GetV0CityByCityNameConfigExplainResponses, GetV0CityByCityNameConfigResponse, GetV0CityByCityNameConfigResponses, GetV0CityByCityNameConfigValidateData, GetV0CityByCityNameConfigValidateError, GetV0CityByCityNameConfigValidateErrors, GetV0CityByCityNameConfigValidateResponse, GetV0CityByCityNameConfigValidateResponses, GetV0CityByCityNameConvoyByIdCheckData, GetV0CityByCityNameConvoyByIdCheckError, GetV0CityByCityNameConvoyByIdCheckErrors, GetV0CityByCityNameConvoyByIdCheckResponse, GetV0CityByCityNameConvoyByIdCheckResponses, GetV0CityByCityNameConvoyByIdData, GetV0CityByCityNameConvoyByIdError, GetV0CityByCityNameConvoyByIdErrors, GetV0CityByCityNameConvoyByIdResponse, GetV0CityByCityNameConvoyByIdResponses, GetV0CityByCityNameConvoysData, GetV0CityByCityNameConvoysError, GetV0CityByCityNameConvoysErrors, GetV0CityByCityNameConvoysResponse, GetV0CityByCityNameConvoysResponses, GetV0CityByCityNameData, GetV0CityByCityNameError, GetV0CityByCityNameErrors, GetV0CityByCityNameEventsData, GetV0CityByCityNameEventsError, GetV0CityByCityNameEventsErrors, GetV0CityByCityNameEventsResponse, GetV0CityByCityNameEventsResponses, GetV0CityByCityNameExtmsgAdaptersData, GetV0CityByCityNameExtmsgAdaptersError, GetV0CityByCityNameExtmsgAdaptersErrors, GetV0CityByCityNameExtmsgAdaptersResponse, GetV0CityByCityNameExtmsgAdaptersResponses, GetV0CityByCityNameExtmsgBindingsData, GetV0CityByCityNameExtmsgBindingsError, GetV0CityByCityNameExtmsgBindingsErrors, GetV0CityByCityNameExtmsgBindingsResponse, GetV0CityByCityNameExtmsgBindingsResponses, GetV0CityByCityNameExtmsgGroupsData, GetV0CityByCityNameExtmsgGroupsError, GetV0CityByCityNameExtmsgGroupsErrors, GetV0CityByCityNameExtmsgGroupsResponse, GetV0CityByCityNameExtmsgGroupsResponses, GetV0CityByCityNameExtmsgTranscriptData, GetV0CityByCityNameExtmsgTranscriptError, GetV0CityByCityNameExtmsgTranscriptErrors, GetV0CityByCityNameExtmsgTranscriptResponse, GetV0CityByCityNameExtmsgTranscriptResponses, GetV0CityByCityNameFormulaByNameData, GetV0CityByCityNameFormulaByNameError, GetV0CityByCityNameFormulaByNameErrors, GetV0CityByCityNameFormulaByNameResponse, GetV0CityByCityNameFormulaByNameResponses, GetV0CityByCityNameFormulasByNameData, GetV0CityByCityNameFormulasByNameError, GetV0CityByCityNameFormulasByNameErrors, GetV0CityByCityNameFormulasByNameResponse, GetV0CityByCityNameFormulasByNameResponses, GetV0CityByCityNameFormulasByNameRunsData, GetV0CityByCityNameFormulasByNameRunsError, GetV0CityByCityNameFormulasByNameRunsErrors, GetV0CityByCityNameFormulasByNameRunsResponse, GetV0CityByCityNameFormulasByNameRunsResponses, GetV0CityByCityNameFormulasData, GetV0CityByCityNameFormulasError, GetV0CityByCityNameFormulasErrors, GetV0CityByCityNameFormulasFeedData, GetV0CityByCityNameFormulasFeedError, GetV0CityByCityNameFormulasFeedErrors, GetV0CityByCityNameFormulasFeedResponse, GetV0CityByCityNameFormulasFeedResponses, GetV0CityByCityNameFormulasResponse, GetV0CityByCityNameFormulasResponses, GetV0CityByCityNameHealthData, GetV0CityByCityNameHealthError, GetV0CityByCityNameHealthErrors, GetV0CityByCityNameHealthResponse, GetV0CityByCityNameHealthResponses, GetV0CityByCityNameMailByIdData, GetV0CityByCityNameMailByIdError, GetV0CityByCityNameMailByIdErrors, GetV0CityByCityNameMailByIdResponse, GetV0CityByCityNameMailByIdResponses, GetV0CityByCityNameMailCountData, GetV0CityByCityNameMailCountError, GetV0CityByCityNameMailCountErrors, GetV0CityByCityNameMailCountResponse, GetV0CityByCityNameMailCountResponses, GetV0CityByCityNameMailData, GetV0CityByCityNameMailError, GetV0CityByCityNameMailErrors, GetV0CityByCityNameMailResponse, GetV0CityByCityNameMailResponses, GetV0CityByCityNameMailThreadByIdData, GetV0CityByCityNameMailThreadByIdError, GetV0CityByCityNameMailThreadByIdErrors, GetV0CityByCityNameMailThreadByIdResponse, GetV0CityByCityNameMailThreadByIdResponses, GetV0CityByCityNameOrderByNameData, GetV0CityByCityNameOrderByNameError, GetV0CityByCityNameOrderByNameErrors, GetV0CityByCityNameOrderByNameResponse, GetV0CityByCityNameOrderByNameResponses, GetV0CityByCityNameOrderHistoryByBeadIdData, GetV0CityByCityNameOrderHistoryByBeadIdError, GetV0CityByCityNameOrderHistoryByBeadIdErrors, GetV0CityByCityNameOrderHistoryByBeadIdResponse, GetV0CityByCityNameOrderHistoryByBeadIdResponses, GetV0CityByCityNameOrdersCheckData, GetV0CityByCityNameOrdersCheckError, GetV0CityByCityNameOrdersCheckErrors, GetV0CityByCityNameOrdersCheckResponse, GetV0CityByCityNameOrdersCheckResponses, GetV0CityByCityNameOrdersData, GetV0CityByCityNameOrdersError, GetV0CityByCityNameOrdersErrors, GetV0CityByCityNameOrdersFeedData, GetV0CityByCityNameOrdersFeedError, GetV0CityByCityNameOrdersFeedErrors, GetV0CityByCityNameOrdersFeedResponse, GetV0CityByCityNameOrdersFeedResponses, GetV0CityByCityNameOrdersHistoryData, GetV0CityByCityNameOrdersHistoryError, GetV0CityByCityNameOrdersHistoryErrors, GetV0CityByCityNameOrdersHistoryResponse, GetV0CityByCityNameOrdersHistoryResponses, GetV0CityByCityNameOrdersResponse, GetV0CityByCityNameOrdersResponses, GetV0CityByCityNamePacksData, GetV0CityByCityNamePacksError, GetV0CityByCityNamePacksErrors, GetV0CityByCityNamePacksResponse, GetV0CityByCityNamePacksResponses, GetV0CityByCityNamePatchesAgentByBaseData, GetV0CityByCityNamePatchesAgentByBaseError, GetV0CityByCityNamePatchesAgentByBaseErrors, GetV0CityByCityNamePatchesAgentByBaseResponse, GetV0CityByCityNamePatchesAgentByBaseResponses, GetV0CityByCityNamePatchesAgentByDirByBaseData, GetV0CityByCityNamePatchesAgentByDirByBaseError, GetV0CityByCityNamePatchesAgentByDirByBaseErrors, GetV0CityByCityNamePatchesAgentByDirByBaseResponse, GetV0CityByCityNamePatchesAgentByDirByBaseResponses, GetV0CityByCityNamePatchesAgentsData, GetV0CityByCityNamePatchesAgentsError, GetV0CityByCityNamePatchesAgentsErrors, GetV0CityByCityNamePatchesAgentsResponse, GetV0CityByCityNamePatchesAgentsResponses, GetV0CityByCityNamePatchesProviderByNameData, GetV0CityByCityNamePatchesProviderByNameError, GetV0CityByCityNamePatchesProviderByNameErrors, GetV0CityByCityNamePatchesProviderByNameResponse, GetV0CityByCityNamePatchesProviderByNameResponses, GetV0CityByCityNamePatchesProvidersData, GetV0CityByCityNamePatchesProvidersError, GetV0CityByCityNamePatchesProvidersErrors, GetV0CityByCityNamePatchesProvidersResponse, GetV0CityByCityNamePatchesProvidersResponses, GetV0CityByCityNamePatchesRigByNameData, GetV0CityByCityNamePatchesRigByNameError, GetV0CityByCityNamePatchesRigByNameErrors, GetV0CityByCityNamePatchesRigByNameResponse, GetV0CityByCityNamePatchesRigByNameResponses, GetV0CityByCityNamePatchesRigsData, GetV0CityByCityNamePatchesRigsError, GetV0CityByCityNamePatchesRigsErrors, GetV0CityByCityNamePatchesRigsResponse, GetV0CityByCityNamePatchesRigsResponses, GetV0CityByCityNameProviderByNameData, GetV0CityByCityNameProviderByNameError, GetV0CityByCityNameProviderByNameErrors, GetV0CityByCityNameProviderByNameResponse, GetV0CityByCityNameProviderByNameResponses, GetV0CityByCityNameProviderReadinessData, GetV0CityByCityNameProviderReadinessError, GetV0CityByCityNameProviderReadinessErrors, GetV0CityByCityNameProviderReadinessResponse, GetV0CityByCityNameProviderReadinessResponses, GetV0CityByCityNameProvidersData, GetV0CityByCityNameProvidersError, GetV0CityByCityNameProvidersErrors, GetV0CityByCityNameProvidersPublicData, GetV0CityByCityNameProvidersPublicError, GetV0CityByCityNameProvidersPublicErrors, GetV0CityByCityNameProvidersPublicResponse, GetV0CityByCityNameProvidersPublicResponses, GetV0CityByCityNameProvidersResponse, GetV0CityByCityNameProvidersResponses, GetV0CityByCityNameReadinessData, GetV0CityByCityNameReadinessError, GetV0CityByCityNameReadinessErrors, GetV0CityByCityNameReadinessResponse, GetV0CityByCityNameReadinessResponses, GetV0CityByCityNameResponse, GetV0CityByCityNameResponses, GetV0CityByCityNameRigByNameData, GetV0CityByCityNameRigByNameError, GetV0CityByCityNameRigByNameErrors, GetV0CityByCityNameRigByNameResponse, GetV0CityByCityNameRigByNameResponses, GetV0CityByCityNameRigsData, GetV0CityByCityNameRigsError, GetV0CityByCityNameRigsErrors, GetV0CityByCityNameRigsResponse, GetV0CityByCityNameRigsResponses, GetV0CityByCityNameServiceByNameData, GetV0CityByCityNameServiceByNameError, GetV0CityByCityNameServiceByNameErrors, GetV0CityByCityNameServiceByNameResponse, GetV0CityByCityNameServiceByNameResponses, GetV0CityByCityNameServicesData, GetV0CityByCityNameServicesError, GetV0CityByCityNameServicesErrors, GetV0CityByCityNameServicesResponse, GetV0CityByCityNameServicesResponses, GetV0CityByCityNameSessionByIdAgentsByAgentIdData, GetV0CityByCityNameSessionByIdAgentsByAgentIdError, GetV0CityByCityNameSessionByIdAgentsByAgentIdErrors, GetV0CityByCityNameSessionByIdAgentsByAgentIdResponse, GetV0CityByCityNameSessionByIdAgentsByAgentIdResponses, GetV0CityByCityNameSessionByIdAgentsData, GetV0CityByCityNameSessionByIdAgentsError, GetV0CityByCityNameSessionByIdAgentsErrors, GetV0CityByCityNameSessionByIdAgentsResponse, GetV0CityByCityNameSessionByIdAgentsResponses, GetV0CityByCityNameSessionByIdData, GetV0CityByCityNameSessionByIdError, GetV0CityByCityNameSessionByIdErrors, GetV0CityByCityNameSessionByIdPendingData, GetV0CityByCityNameSessionByIdPendingError, GetV0CityByCityNameSessionByIdPendingErrors, GetV0CityByCityNameSessionByIdPendingResponse, GetV0CityByCityNameSessionByIdPendingResponses, GetV0CityByCityNameSessionByIdResponse, GetV0CityByCityNameSessionByIdResponses, GetV0CityByCityNameSessionByIdTranscriptData, GetV0CityByCityNameSessionByIdTranscriptError, GetV0CityByCityNameSessionByIdTranscriptErrors, GetV0CityByCityNameSessionByIdTranscriptResponse, GetV0CityByCityNameSessionByIdTranscriptResponses, GetV0CityByCityNameSessionsData, GetV0CityByCityNameSessionsError, GetV0CityByCityNameSessionsErrors, GetV0CityByCityNameSessionsResponse, GetV0CityByCityNameSessionsResponses, GetV0CityByCityNameStatusData, GetV0CityByCityNameStatusError, GetV0CityByCityNameStatusErrors, GetV0CityByCityNameStatusResponse, GetV0CityByCityNameStatusResponses, GetV0CityByCityNameWorkflowByWorkflowIdData, GetV0CityByCityNameWorkflowByWorkflowIdError, GetV0CityByCityNameWorkflowByWorkflowIdErrors, GetV0CityByCityNameWorkflowByWorkflowIdResponse, GetV0CityByCityNameWorkflowByWorkflowIdResponses, GetV0EventsData, GetV0EventsError, GetV0EventsErrors, GetV0EventsResponse, GetV0EventsResponses, GetV0ProviderReadinessData, GetV0ProviderReadinessError, GetV0ProviderReadinessErrors, GetV0ProviderReadinessResponse, GetV0ProviderReadinessResponses, GetV0ReadinessData, GetV0ReadinessError, GetV0ReadinessErrors, GetV0ReadinessResponse, GetV0ReadinessResponses, GitStatus, GroupCreatedEventPayload, GroupRouteDecision, HealthOutputBody, HeartbeatEvent, InboundEventPayload, InboundResult, ListBodyAgentPatch, ListBodyAgentResponse, ListBodyBead, ListBodyConversationTranscriptRecord, ListBodyExtmsgAdapterInfo, ListBodyProviderPatch, ListBodyProviderResponse, ListBodyRigPatch, ListBodyRigResponse, ListBodySessionBindingRecord, ListBodySessionResponse, ListBodyStatus, ListBodyWireEvent, LogicalNode, MailCountOutputBody, MailEventPayload, MailListBody, MailReplyInputBody, MailSendInputBody, Message, MonitorFeedItemResponse, NoPayload, OkResponseBody, OkWithIdResponseBody, OptionChoiceDto, OrderCheckListBody, OrderCheckResponse, OrderHistoryDetailResponse, OrderHistoryEntry, OrderHistoryListBody, OrderListBody, OrderResponse, OrdersFeedBody, OutboundEventPayload, OutboundResult, OutputTurn, PackListBody, PackResponse, PaginationInfo, PatchDeletedResponseBody, PatchOkResponseBody, PatchV0CityByCityNameAgentByBaseData, PatchV0CityByCityNameAgentByBaseError, PatchV0CityByCityNameAgentByBaseErrors, PatchV0CityByCityNameAgentByBaseResponse, PatchV0CityByCityNameAgentByBaseResponses, PatchV0CityByCityNameAgentByDirByBaseData, PatchV0CityByCityNameAgentByDirByBaseError, PatchV0CityByCityNameAgentByDirByBaseErrors, PatchV0CityByCityNameAgentByDirByBaseResponse, PatchV0CityByCityNameAgentByDirByBaseResponses, PatchV0CityByCityNameBeadByIdData, PatchV0CityByCityNameBeadByIdError, PatchV0CityByCityNameBeadByIdErrors, PatchV0CityByCityNameBeadByIdResponse, PatchV0CityByCityNameBeadByIdResponses, PatchV0CityByCityNameData, PatchV0CityByCityNameError, PatchV0CityByCityNameErrors, PatchV0CityByCityNameProviderByNameData, PatchV0CityByCityNameProviderByNameError, PatchV0CityByCityNameProviderByNameErrors, PatchV0CityByCityNameProviderByNameResponse, PatchV0CityByCityNameProviderByNameResponses, PatchV0CityByCityNameResponse, PatchV0CityByCityNameResponses, PatchV0CityByCityNameRigByNameData, PatchV0CityByCityNameRigByNameError, PatchV0CityByCityNameRigByNameErrors, PatchV0CityByCityNameRigByNameResponse, PatchV0CityByCityNameRigByNameResponses, PatchV0CityByCityNameSessionByIdData, PatchV0CityByCityNameSessionByIdError, PatchV0CityByCityNameSessionByIdErrors, PatchV0CityByCityNameSessionByIdResponse, PatchV0CityByCityNameSessionByIdResponses, PendingInteraction, PoolOverride, PostV0CityByCityNameAgentByBaseByActionData, PostV0CityByCityNameAgentByBaseByActionError, PostV0CityByCityNameAgentByBaseByActionErrors, PostV0CityByCityNameAgentByBaseByActionResponse, PostV0CityByCityNameAgentByBaseByActionResponses, PostV0CityByCityNameAgentByDirByBaseByActionData, PostV0CityByCityNameAgentByDirByBaseByActionError, PostV0CityByCityNameAgentByDirByBaseByActionErrors, PostV0CityByCityNameAgentByDirByBaseByActionResponse, PostV0CityByCityNameAgentByDirByBaseByActionResponses, PostV0CityByCityNameBeadByIdAssignData, PostV0CityByCityNameBeadByIdAssignError, PostV0CityByCityNameBeadByIdAssignErrors, PostV0CityByCityNameBeadByIdAssignResponse, PostV0CityByCityNameBeadByIdAssignResponses, PostV0CityByCityNameBeadByIdCloseData, PostV0CityByCityNameBeadByIdCloseError, PostV0CityByCityNameBeadByIdCloseErrors, PostV0CityByCityNameBeadByIdCloseResponse, PostV0CityByCityNameBeadByIdCloseResponses, PostV0CityByCityNameBeadByIdReopenData, PostV0CityByCityNameBeadByIdReopenError, PostV0CityByCityNameBeadByIdReopenErrors, PostV0CityByCityNameBeadByIdReopenResponse, PostV0CityByCityNameBeadByIdReopenResponses, PostV0CityByCityNameBeadByIdUpdateData, PostV0CityByCityNameBeadByIdUpdateError, PostV0CityByCityNameBeadByIdUpdateErrors, PostV0CityByCityNameBeadByIdUpdateResponse, PostV0CityByCityNameBeadByIdUpdateResponses, PostV0CityByCityNameConvoyByIdAddData, PostV0CityByCityNameConvoyByIdAddError, PostV0CityByCityNameConvoyByIdAddErrors, PostV0CityByCityNameConvoyByIdAddResponse, PostV0CityByCityNameConvoyByIdAddResponses, PostV0CityByCityNameConvoyByIdCloseData, PostV0CityByCityNameConvoyByIdCloseError, PostV0CityByCityNameConvoyByIdCloseErrors, PostV0CityByCityNameConvoyByIdCloseResponse, PostV0CityByCityNameConvoyByIdCloseResponses, PostV0CityByCityNameConvoyByIdRemoveData, PostV0CityByCityNameConvoyByIdRemoveError, PostV0CityByCityNameConvoyByIdRemoveErrors, PostV0CityByCityNameConvoyByIdRemoveResponse, PostV0CityByCityNameConvoyByIdRemoveResponses, PostV0CityByCityNameExtmsgBindData, PostV0CityByCityNameExtmsgBindError, PostV0CityByCityNameExtmsgBindErrors, PostV0CityByCityNameExtmsgBindResponse, PostV0CityByCityNameExtmsgBindResponses, PostV0CityByCityNameExtmsgInboundData, PostV0CityByCityNameExtmsgInboundError, PostV0CityByCityNameExtmsgInboundErrors, PostV0CityByCityNameExtmsgInboundResponse, PostV0CityByCityNameExtmsgInboundResponses, PostV0CityByCityNameExtmsgOutboundData, PostV0CityByCityNameExtmsgOutboundError, PostV0CityByCityNameExtmsgOutboundErrors, PostV0CityByCityNameExtmsgOutboundResponse, PostV0CityByCityNameExtmsgOutboundResponses, PostV0CityByCityNameExtmsgParticipantsData, PostV0CityByCityNameExtmsgParticipantsError, PostV0CityByCityNameExtmsgParticipantsErrors, PostV0CityByCityNameExtmsgParticipantsResponse, PostV0CityByCityNameExtmsgParticipantsResponses, PostV0CityByCityNameExtmsgTranscriptAckData, PostV0CityByCityNameExtmsgTranscriptAckError, PostV0CityByCityNameExtmsgTranscriptAckErrors, PostV0CityByCityNameExtmsgTranscriptAckResponse, PostV0CityByCityNameExtmsgTranscriptAckResponses, PostV0CityByCityNameExtmsgUnbindData, PostV0CityByCityNameExtmsgUnbindError, PostV0CityByCityNameExtmsgUnbindErrors, PostV0CityByCityNameExtmsgUnbindResponse, PostV0CityByCityNameExtmsgUnbindResponses, PostV0CityByCityNameFormulasByNamePreviewData, PostV0CityByCityNameFormulasByNamePreviewError, PostV0CityByCityNameFormulasByNamePreviewErrors, PostV0CityByCityNameFormulasByNamePreviewResponse, PostV0CityByCityNameFormulasByNamePreviewResponses, PostV0CityByCityNameMailByIdArchiveData, PostV0CityByCityNameMailByIdArchiveError, PostV0CityByCityNameMailByIdArchiveErrors, PostV0CityByCityNameMailByIdArchiveResponse, PostV0CityByCityNameMailByIdArchiveResponses, PostV0CityByCityNameMailByIdMarkUnreadData, PostV0CityByCityNameMailByIdMarkUnreadError, PostV0CityByCityNameMailByIdMarkUnreadErrors, PostV0CityByCityNameMailByIdMarkUnreadResponse, PostV0CityByCityNameMailByIdMarkUnreadResponses, PostV0CityByCityNameMailByIdReadData, PostV0CityByCityNameMailByIdReadError, PostV0CityByCityNameMailByIdReadErrors, PostV0CityByCityNameMailByIdReadResponse, PostV0CityByCityNameMailByIdReadResponses, PostV0CityByCityNameOrderByNameDisableData, PostV0CityByCityNameOrderByNameDisableError, PostV0CityByCityNameOrderByNameDisableErrors, PostV0CityByCityNameOrderByNameDisableResponse, PostV0CityByCityNameOrderByNameDisableResponses, PostV0CityByCityNameOrderByNameEnableData, PostV0CityByCityNameOrderByNameEnableError, PostV0CityByCityNameOrderByNameEnableErrors, PostV0CityByCityNameOrderByNameEnableResponse, PostV0CityByCityNameOrderByNameEnableResponses, PostV0CityByCityNameRigByNameByActionData, PostV0CityByCityNameRigByNameByActionError, PostV0CityByCityNameRigByNameByActionErrors, PostV0CityByCityNameRigByNameByActionResponse, PostV0CityByCityNameRigByNameByActionResponses, PostV0CityByCityNameServiceByNameRestartData, PostV0CityByCityNameServiceByNameRestartError, PostV0CityByCityNameServiceByNameRestartErrors, PostV0CityByCityNameServiceByNameRestartResponse, PostV0CityByCityNameServiceByNameRestartResponses, PostV0CityByCityNameSessionByIdCloseData, PostV0CityByCityNameSessionByIdCloseError, PostV0CityByCityNameSessionByIdCloseErrors, PostV0CityByCityNameSessionByIdCloseResponse, PostV0CityByCityNameSessionByIdCloseResponses, PostV0CityByCityNameSessionByIdKillData, PostV0CityByCityNameSessionByIdKillError, PostV0CityByCityNameSessionByIdKillErrors, PostV0CityByCityNameSessionByIdKillResponse, PostV0CityByCityNameSessionByIdKillResponses, PostV0CityByCityNameSessionByIdRenameData, PostV0CityByCityNameSessionByIdRenameError, PostV0CityByCityNameSessionByIdRenameErrors, PostV0CityByCityNameSessionByIdRenameResponse, PostV0CityByCityNameSessionByIdRenameResponses, PostV0CityByCityNameSessionByIdStopData, PostV0CityByCityNameSessionByIdStopError, PostV0CityByCityNameSessionByIdStopErrors, PostV0CityByCityNameSessionByIdStopResponse, PostV0CityByCityNameSessionByIdStopResponses, PostV0CityByCityNameSessionByIdSuspendData, PostV0CityByCityNameSessionByIdSuspendError, PostV0CityByCityNameSessionByIdSuspendErrors, PostV0CityByCityNameSessionByIdSuspendResponse, PostV0CityByCityNameSessionByIdSuspendResponses, PostV0CityByCityNameSessionByIdWakeData, PostV0CityByCityNameSessionByIdWakeError, PostV0CityByCityNameSessionByIdWakeErrors, PostV0CityByCityNameSessionByIdWakeResponse, PostV0CityByCityNameSessionByIdWakeResponses, PostV0CityByCityNameSlingData, PostV0CityByCityNameSlingError, PostV0CityByCityNameSlingErrors, PostV0CityByCityNameSlingResponse, PostV0CityByCityNameSlingResponses, PostV0CityByCityNameUnregisterData, PostV0CityByCityNameUnregisterError, PostV0CityByCityNameUnregisterErrors, PostV0CityByCityNameUnregisterResponse, PostV0CityByCityNameUnregisterResponses, PostV0CityData, PostV0CityError, PostV0CityErrors, PostV0CityResponse, PostV0CityResponses, ProviderCreatedOutputBody, ProviderCreateInputBody, ProviderOptionDto, ProviderPatch, ProviderPatchSetInputBody, ProviderPublicListBody, ProviderPublicResponse, ProviderReadiness, ProviderReadinessResponse, ProviderResponse, ProviderSpecJson, ProviderUpdateInputBody, PublishReceipt, PutV0CityByCityNamePatchesAgentsData, PutV0CityByCityNamePatchesAgentsError, PutV0CityByCityNamePatchesAgentsErrors, PutV0CityByCityNamePatchesAgentsResponse, PutV0CityByCityNamePatchesAgentsResponses, PutV0CityByCityNamePatchesProvidersData, PutV0CityByCityNamePatchesProvidersError, PutV0CityByCityNamePatchesProvidersErrors, PutV0CityByCityNamePatchesProvidersResponse, PutV0CityByCityNamePatchesProvidersResponses, PutV0CityByCityNamePatchesRigsData, PutV0CityByCityNamePatchesRigsError, PutV0CityByCityNamePatchesRigsErrors, PutV0CityByCityNamePatchesRigsResponse, PutV0CityByCityNamePatchesRigsResponses, ReadinessItem, ReadinessResponse, RegisterExtmsgAdapterData, RegisterExtmsgAdapterError, RegisterExtmsgAdapterErrors, RegisterExtmsgAdapterResponse, RegisterExtmsgAdapterResponses, ReplyMailData, ReplyMailError, ReplyMailErrors, ReplyMailResponse, ReplyMailResponses, RequestFailedPayload, RespondSessionData, RespondSessionError, RespondSessionErrors, RespondSessionResponse, RespondSessionResponses, RigActionBody, RigCreatedOutputBody, RigCreateInputBody, RigPatch, RigPatchSetInputBody, RigResponse, RigUpdateInputBody, ScopeGroup, SendMailData, SendMailError, SendMailErrors, SendMailResponse, SendMailResponses, SendSessionMessageData, SendSessionMessageError, SendSessionMessageErrors, SendSessionMessageResponse, SendSessionMessageResponses, ServiceRestartOutputBody, SessionActivityEvent, SessionAgentGetResponse, SessionAgentListResponse, SessionBindingRecord, SessionCreateBody, SessionCreateSucceededPayload, SessionInfo, SessionMessageInputBody, SessionMessageSucceededPayload, SessionPatchBody, SessionPendingResponse, SessionRawMessageFrame, SessionRenameInputBody, SessionRespondInputBody, SessionRespondOutputBody, SessionResponse, SessionStreamCommonEvent, SessionStreamMessageEvent, SessionStreamRawMessageEvent, SessionSubmitInputBody, SessionSubmitSucceededPayload, SessionTranscriptGetResponse, SlingInputBody, SlingResponse, Status, StatusAgentCounts, StatusBody, StatusMailCounts, StatusRigCounts, StatusWorkCounts, StreamAgentOutputData, StreamAgentOutputError, StreamAgentOutputErrors, StreamAgentOutputQualifiedData, StreamAgentOutputQualifiedError, StreamAgentOutputQualifiedErrors, StreamAgentOutputQualifiedResponse, StreamAgentOutputQualifiedResponses, StreamAgentOutputResponse, StreamAgentOutputResponses, StreamEventsData, StreamEventsError, StreamEventsErrors, StreamEventsResponse, StreamEventsResponses, StreamSessionData, StreamSessionError, StreamSessionErrors, StreamSessionResponse, StreamSessionResponses, StreamSupervisorEventsData, StreamSupervisorEventsError, StreamSupervisorEventsErrors, StreamSupervisorEventsResponse, StreamSupervisorEventsResponses, SubmissionCapabilities, SubmitIntent, SubmitSessionData, SubmitSessionError, SubmitSessionErrors, SubmitSessionResponse, SubmitSessionResponses, SupervisorCitiesOutputBody, SupervisorEventListOutputBody, SupervisorHealthOutputBody, SupervisorStartup, TaggedEventStreamEnvelope, TranscriptMessageKind, TranscriptProvenance, TypedEventStreamEnvelope, TypedEventStreamEnvelopeBeadClosed, TypedEventStreamEnvelopeBeadCreated, TypedEventStreamEnvelopeBeadUpdated, TypedEventStreamEnvelopeCityCreated, TypedEventStreamEnvelopeCityResumed, TypedEventStreamEnvelopeCitySuspended, TypedEventStreamEnvelopeCityUnregisterRequested, TypedEventStreamEnvelopeControllerStarted, TypedEventStreamEnvelopeControllerStopped, TypedEventStreamEnvelopeConvoyClosed, TypedEventStreamEnvelopeConvoyCreated, TypedEventStreamEnvelopeCustom, TypedEventStreamEnvelopeExtmsgAdapterAdded, TypedEventStreamEnvelopeExtmsgAdapterRemoved, TypedEventStreamEnvelopeExtmsgBound, TypedEventStreamEnvelopeExtmsgGroupCreated, TypedEventStreamEnvelopeExtmsgInbound, TypedEventStreamEnvelopeExtmsgOutbound, TypedEventStreamEnvelopeExtmsgUnbound, TypedEventStreamEnvelopeMailArchived, TypedEventStreamEnvelopeMailDeleted, TypedEventStreamEnvelopeMailMarkedRead, TypedEventStreamEnvelopeMailMarkedUnread, TypedEventStreamEnvelopeMailRead, TypedEventStreamEnvelopeMailReplied, TypedEventStreamEnvelopeMailSent, TypedEventStreamEnvelopeOrderCompleted, TypedEventStreamEnvelopeOrderFailed, TypedEventStreamEnvelopeOrderFired, TypedEventStreamEnvelopeProviderSwapped, TypedEventStreamEnvelopeRequestFailed, TypedEventStreamEnvelopeRequestResultCityCreate, TypedEventStreamEnvelopeRequestResultCityUnregister, TypedEventStreamEnvelopeRequestResultSessionCreate, TypedEventStreamEnvelopeRequestResultSessionMessage, TypedEventStreamEnvelopeRequestResultSessionSubmit, TypedEventStreamEnvelopeSessionCrashed, TypedEventStreamEnvelopeSessionDraining, TypedEventStreamEnvelopeSessionIdleKilled, TypedEventStreamEnvelopeSessionQuarantined, TypedEventStreamEnvelopeSessionStopped, TypedEventStreamEnvelopeSessionSuspended, TypedEventStreamEnvelopeSessionUndrained, TypedEventStreamEnvelopeSessionUpdated, TypedEventStreamEnvelopeSessionWoke, TypedEventStreamEnvelopeWorkerOperation, TypedTaggedEventStreamEnvelope, TypedTaggedEventStreamEnvelopeBeadClosed, TypedTaggedEventStreamEnvelopeBeadCreated, TypedTaggedEventStreamEnvelopeBeadUpdated, TypedTaggedEventStreamEnvelopeCityCreated, TypedTaggedEventStreamEnvelopeCityResumed, TypedTaggedEventStreamEnvelopeCitySuspended, TypedTaggedEventStreamEnvelopeCityUnregisterRequested, TypedTaggedEventStreamEnvelopeControllerStarted, TypedTaggedEventStreamEnvelopeControllerStopped, TypedTaggedEventStreamEnvelopeConvoyClosed, TypedTaggedEventStreamEnvelopeConvoyCreated, TypedTaggedEventStreamEnvelopeCustom, TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded, TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved, TypedTaggedEventStreamEnvelopeExtmsgBound, TypedTaggedEventStreamEnvelopeExtmsgGroupCreated, TypedTaggedEventStreamEnvelopeExtmsgInbound, TypedTaggedEventStreamEnvelopeExtmsgOutbound, TypedTaggedEventStreamEnvelopeExtmsgUnbound, TypedTaggedEventStreamEnvelopeMailArchived, TypedTaggedEventStreamEnvelopeMailDeleted, TypedTaggedEventStreamEnvelopeMailMarkedRead, TypedTaggedEventStreamEnvelopeMailMarkedUnread, TypedTaggedEventStreamEnvelopeMailRead, TypedTaggedEventStreamEnvelopeMailReplied, TypedTaggedEventStreamEnvelopeMailSent, TypedTaggedEventStreamEnvelopeOrderCompleted, TypedTaggedEventStreamEnvelopeOrderFailed, TypedTaggedEventStreamEnvelopeOrderFired, TypedTaggedEventStreamEnvelopeProviderSwapped, TypedTaggedEventStreamEnvelopeRequestFailed, TypedTaggedEventStreamEnvelopeRequestResultCityCreate, TypedTaggedEventStreamEnvelopeRequestResultCityUnregister, TypedTaggedEventStreamEnvelopeRequestResultSessionCreate, TypedTaggedEventStreamEnvelopeRequestResultSessionMessage, TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit, TypedTaggedEventStreamEnvelopeSessionCrashed, TypedTaggedEventStreamEnvelopeSessionDraining, TypedTaggedEventStreamEnvelopeSessionIdleKilled, TypedTaggedEventStreamEnvelopeSessionQuarantined, TypedTaggedEventStreamEnvelopeSessionStopped, TypedTaggedEventStreamEnvelopeSessionSuspended, TypedTaggedEventStreamEnvelopeSessionUndrained, TypedTaggedEventStreamEnvelopeSessionUpdated, TypedTaggedEventStreamEnvelopeSessionWoke, TypedTaggedEventStreamEnvelopeWorkerOperation, UnboundEventPayload, WorkerOperationEventPayload, WorkflowAttemptSummary, WorkflowBeadResponse, WorkflowDeleteResponse, WorkflowDepResponse, WorkflowEventProjection, WorkflowSnapshotResponse, WorkspaceResponse } from './types.gen';
diff --git a/cmd/gc/dashboard/web/src/generated/schema.d.ts b/cmd/gc/dashboard/web/src/generated/schema.d.ts
index 9adf65ac86..20b0331ba2 100644
--- a/cmd/gc/dashboard/web/src/generated/schema.d.ts
+++ b/cmd/gc/dashboard/web/src/generated/schema.d.ts
@@ -229,7 +229,10 @@ export interface paths {
         /** Get v0 city by city name agents */
         get: operations["get-v0-city-by-city-name-agents"];
         put?: never;
-        /** Create an agent */
+        /**
+         * Create an agent
+         * @description Creates an agent and waits until it is visible to immediate follow-up operations. If the agent is durably created but visibility confirmation is canceled or times out, the retryable 503/504 response includes a Retry-After header.
+         */
         post: operations["create-agent"];
         delete?: never;
         options?: never;
@@ -575,7 +578,7 @@ export interface paths {
         };
         /**
          * Stream city events in real time
-         * @description Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param.
+         * @description Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param; omitting both starts at the current city event head.
          */
         get: operations["stream-events"];
         put?: never;
@@ -1859,7 +1862,10 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Stream tagged events from all running cities. */
+        /**
+         * Stream tagged events from all running cities.
+         * @description Server-Sent Events stream of supervisor-tagged events. Supports reconnection via Last-Event-ID header or after_cursor query param; omitting both starts at the current supervisor event head.
+         */
         get: operations["stream-supervisor-events"];
         put?: never;
         post?: never;
@@ -2083,6 +2089,23 @@ export interface components {
             /** Format: int64 */
             ready_delay_ms?: number;
         };
+        AsyncAcceptedBody: {
+            /** @description City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty. */
+            event_cursor: string;
+            /** @description Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id. */
+            request_id: string;
+            /**
+             * @description Async request status.
+             * @example accepted
+             */
+            status: string;
+        };
+        AsyncAcceptedResponse: {
+            /** @description Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty. */
+            event_cursor: string;
+            /** @description Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id. */
+            request_id: string;
+        };
         Bead: {
             assignee?: string;
             /** Format: date-time */
@@ -2189,16 +2212,18 @@ export interface components {
             bootstrap_profile?: "k8s-cell" | "kubernetes" | "kubernetes-cell" | "single-host-compat";
             /** @description Directory to create the city in. Absolute or relative to $HOME. */
             dir: string;
-            /** @description Provider name for the city's default session template. */
-            provider: string;
+            /** @description Provider name for the city's default session template. Mutually exclusive with start_command. */
+            provider?: string;
+            /** @description Custom workspace start command for the city's default session template. Mutually exclusive with provider. */
+            start_command?: string;
         };
-        CityCreateResponse: {
-            /** @description Resolved city name as persisted in city.toml. Use this to filter the event stream for completion. */
+        CityCreateSucceededPayload: {
+            /** @description Resolved city name. */
             name: string;
-            /** @description True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready. */
-            ok: boolean;
-            /** @description Resolved absolute path of the created city directory. */
+            /** @description Resolved absolute city directory path. */
             path: string;
+            /** @description Correlation ID from the 202 response. */
+            request_id: string;
         };
         CityGetResponse: {
             /** Format: int64 */
@@ -2223,22 +2248,20 @@ export interface components {
             status?: string;
         };
         CityLifecyclePayload: {
-            error?: string;
             name: string;
             path: string;
-            phases_completed?: string[] | null;
         };
         CityPatchInputBody: {
             /** @description Whether the city is suspended. */
             suspended?: boolean;
         };
-        CityUnregisterResponse: {
-            /** @description Resolved registry name. Filter the event stream by this to observe completion. */
+        CityUnregisterSucceededPayload: {
+            /** @description City name that was unregistered. */
             name: string;
-            /** @description True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered. */
-            ok: boolean;
-            /** @description Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry. */
+            /** @description Absolute city directory path. */
             path: string;
+            /** @description Correlation ID from the 202 response. */
+            request_id: string;
         };
         ConfigAgentResponse: {
             dir?: string;
@@ -2485,7 +2508,7 @@ export interface components {
             /** @description Event type. */
             type: string;
         };
-        EventPayload: components["schemas"]["AdapterEventPayload"] | components["schemas"]["BeadEventPayload"] | components["schemas"]["BoundEventPayload"] | components["schemas"]["CityLifecyclePayload"] | components["schemas"]["GroupCreatedEventPayload"] | components["schemas"]["InboundEventPayload"] | components["schemas"]["MailEventPayload"] | components["schemas"]["NoPayload"] | components["schemas"]["OutboundEventPayload"] | components["schemas"]["UnboundEventPayload"] | components["schemas"]["WorkerOperationEventPayload"];
+        EventPayload: components["schemas"]["AdapterEventPayload"] | components["schemas"]["BeadEventPayload"] | components["schemas"]["BoundEventPayload"] | components["schemas"]["CityCreateSucceededPayload"] | components["schemas"]["CityLifecyclePayload"] | components["schemas"]["CityUnregisterSucceededPayload"] | components["schemas"]["GroupCreatedEventPayload"] | components["schemas"]["InboundEventPayload"] | components["schemas"]["MailEventPayload"] | components["schemas"]["NoPayload"] | components["schemas"]["OutboundEventPayload"] | components["schemas"]["RequestFailedPayload"] | components["schemas"]["SessionCreateSucceededPayload"] | components["schemas"]["SessionMessageSucceededPayload"] | components["schemas"]["SessionSubmitSucceededPayload"] | components["schemas"]["UnboundEventPayload"] | components["schemas"]["WorkerOperationEventPayload"];
         EventStreamEnvelope: {
             actor: string;
             message?: string;
@@ -2671,6 +2694,11 @@ export interface components {
             items: components["schemas"]["FormulaSummaryResponse"][] | null;
             /** @description Whether the list is partial. */
             partial: boolean;
+            /**
+             * Format: int64
+             * @description Total number of formulas in the list.
+             */
+            total: number;
         };
         FormulaPreviewBody: {
             /** @description Scope kind (city or rig). */
@@ -2978,7 +3006,7 @@ export interface components {
         };
         ListBodyWireEvent: {
             /** @description The list of items. */
-            items: components["schemas"]["WireEvent"][] | null;
+            items: components["schemas"]["TypedEventStreamEnvelope"][] | null;
             /** @description Cursor for the next page of results. */
             next_cursor?: string;
             /** @description True when one or more backends failed and the list is incomplete. */
@@ -3465,6 +3493,19 @@ export interface components {
                 [key: string]: components["schemas"]["ReadinessItem"];
             };
         };
+        RequestFailedPayload: {
+            /** @description Machine-readable error code. */
+            error_code: string;
+            /** @description Human-readable error description. */
+            error_message: string;
+            /**
+             * @description Which operation failed.
+             * @enum {string}
+             */
+            operation: "city.create" | "city.unregister" | "session.create" | "session.message" | "session.submit";
+            /** @description Correlation ID from the 202 response. */
+            request_id: string;
+        };
         RigActionBody: {
             /** @description Action that was performed. */
             action: string;
@@ -3602,6 +3643,12 @@ export interface components {
             /** @description Session title. */
             title?: string;
         };
+        SessionCreateSucceededPayload: {
+            /** @description Correlation ID from the 202 response. */
+            request_id: string;
+            /** @description Full session state as returned by GET /session/{id}. For session.create, this result is emitted only after the session has left creating and can accept normal metadata and lifecycle commands. */
+            session: components["schemas"]["SessionResponse"];
+        };
         SessionInfo: {
             attached: boolean;
             /** Format: date-time */
@@ -3612,14 +3659,11 @@ export interface components {
             /** @description Message text to send. */
             message: string;
         };
-        SessionMessageOutputBody: {
-            /** @description Session ID. */
-            id: string;
-            /**
-             * @description Operation result.
-             * @example accepted
-             */
-            status: string;
+        SessionMessageSucceededPayload: {
+            /** @description Correlation ID from the 202 response. */
+            request_id: string;
+            /** @description Session ID that received the message. */
+            session_id: string;
         };
         SessionPatchBody: {
             /** @description Session alias. Empty string clears the alias. */
@@ -3728,18 +3772,15 @@ export interface components {
             /** @description Message text to submit. */
             message: string;
         };
-        SessionSubmitOutputBody: {
-            /** @description Session ID. */
-            id: string;
-            /** @description Resolved submit intent. */
+        SessionSubmitSucceededPayload: {
+            /** @description Resolved submit intent (default, follow_up, interrupt_now). */
             intent: string;
-            /** @description Whether the message was queued. */
+            /** @description Whether the message was queued for later delivery. */
             queued: boolean;
-            /**
-             * @description Operation result.
-             * @example accepted
-             */
-            status: string;
+            /** @description Correlation ID from the 202 response. */
+            request_id: string;
+            /** @description Session ID that received the submission. */
+            session_id: string;
         };
         SessionTranscriptGetResponse: {
             /** @description conversation, text, or raw. */
@@ -3841,6 +3882,10 @@ export interface components {
             mail: components["schemas"]["StatusMailCounts"];
             /** @description City name. */
             name: string;
+            /** @description True when one or more status backing reads returned incomplete data. */
+            partial?: boolean;
+            /** @description Human-readable errors from incomplete status backing reads. */
+            partial_errors?: string[] | null;
             /** @description City directory path. */
             path: string;
             /**
@@ -3927,7 +3972,9 @@ export interface components {
             total: number;
         };
         SupervisorEventListOutputBody: {
-            items: components["schemas"]["WireTaggedEvent"][] | null;
+            /** @description Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog. */
+            event_cursor: string;
+            items: components["schemas"]["TypedTaggedEventStreamEnvelope"][] | null;
             /** Format: int64 */
             total: number;
         };
@@ -3989,7 +4036,7 @@ export interface components {
          * Typed city event stream envelope
          * @description Discriminated union of city event stream envelopes. Each variant constrains the envelope type and payload schema together.
          */
-        TypedEventStreamEnvelope: components["schemas"]["TypedEventStreamEnvelopeBeadClosed"] | components["schemas"]["TypedEventStreamEnvelopeBeadCreated"] | components["schemas"]["TypedEventStreamEnvelopeBeadUpdated"] | components["schemas"]["TypedEventStreamEnvelopeCityCreated"] | components["schemas"]["TypedEventStreamEnvelopeCityInitFailed"] | components["schemas"]["TypedEventStreamEnvelopeCityReady"] | components["schemas"]["TypedEventStreamEnvelopeCityResumed"] | components["schemas"]["TypedEventStreamEnvelopeCitySuspended"] | components["schemas"]["TypedEventStreamEnvelopeCityUnregisterFailed"] | components["schemas"]["TypedEventStreamEnvelopeCityUnregisterRequested"] | components["schemas"]["TypedEventStreamEnvelopeCityUnregistered"] | components["schemas"]["TypedEventStreamEnvelopeControllerStarted"] | components["schemas"]["TypedEventStreamEnvelopeControllerStopped"] | components["schemas"]["TypedEventStreamEnvelopeConvoyClosed"] | components["schemas"]["TypedEventStreamEnvelopeConvoyCreated"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgAdapterAdded"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgAdapterRemoved"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgBound"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgGroupCreated"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgInbound"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgOutbound"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgUnbound"] | components["schemas"]["TypedEventStreamEnvelopeMailArchived"] | components["schemas"]["TypedEventStreamEnvelopeMailDeleted"] | components["schemas"]["TypedEventStreamEnvelopeMailMarkedRead"] | components["schemas"]["TypedEventStreamEnvelopeMailMarkedUnread"] | components["schemas"]["TypedEventStreamEnvelopeMailRead"] | components["schemas"]["TypedEventStreamEnvelopeMailReplied"] | components["schemas"]["TypedEventStreamEnvelopeMailSent"] | components["schemas"]["TypedEventStreamEnvelopeOrderCompleted"] | components["schemas"]["TypedEventStreamEnvelopeOrderFailed"] | components["schemas"]["TypedEventStreamEnvelopeOrderFired"] | components["schemas"]["TypedEventStreamEnvelopeProviderSwapped"] | components["schemas"]["TypedEventStreamEnvelopeSessionCrashed"] | components["schemas"]["TypedEventStreamEnvelopeSessionDraining"] | components["schemas"]["TypedEventStreamEnvelopeSessionIdleKilled"] | components["schemas"]["TypedEventStreamEnvelopeSessionQuarantined"] | components["schemas"]["TypedEventStreamEnvelopeSessionStopped"] | components["schemas"]["TypedEventStreamEnvelopeSessionSuspended"] | components["schemas"]["TypedEventStreamEnvelopeSessionUndrained"] | components["schemas"]["TypedEventStreamEnvelopeSessionUpdated"] | components["schemas"]["TypedEventStreamEnvelopeSessionWoke"] | components["schemas"]["TypedEventStreamEnvelopeWorkerOperation"];
+        TypedEventStreamEnvelope: components["schemas"]["TypedEventStreamEnvelopeBeadClosed"] | components["schemas"]["TypedEventStreamEnvelopeBeadCreated"] | components["schemas"]["TypedEventStreamEnvelopeBeadUpdated"] | components["schemas"]["TypedEventStreamEnvelopeCityCreated"] | components["schemas"]["TypedEventStreamEnvelopeCityResumed"] | components["schemas"]["TypedEventStreamEnvelopeCitySuspended"] | components["schemas"]["TypedEventStreamEnvelopeCityUnregisterRequested"] | components["schemas"]["TypedEventStreamEnvelopeControllerStarted"] | components["schemas"]["TypedEventStreamEnvelopeControllerStopped"] | components["schemas"]["TypedEventStreamEnvelopeConvoyClosed"] | components["schemas"]["TypedEventStreamEnvelopeConvoyCreated"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgAdapterAdded"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgAdapterRemoved"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgBound"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgGroupCreated"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgInbound"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgOutbound"] | components["schemas"]["TypedEventStreamEnvelopeExtmsgUnbound"] | components["schemas"]["TypedEventStreamEnvelopeMailArchived"] | components["schemas"]["TypedEventStreamEnvelopeMailDeleted"] | components["schemas"]["TypedEventStreamEnvelopeMailMarkedRead"] | components["schemas"]["TypedEventStreamEnvelopeMailMarkedUnread"] | components["schemas"]["TypedEventStreamEnvelopeMailRead"] | components["schemas"]["TypedEventStreamEnvelopeMailReplied"] | components["schemas"]["TypedEventStreamEnvelopeMailSent"] | components["schemas"]["TypedEventStreamEnvelopeOrderCompleted"] | components["schemas"]["TypedEventStreamEnvelopeOrderFailed"] | components["schemas"]["TypedEventStreamEnvelopeOrderFired"] | components["schemas"]["TypedEventStreamEnvelopeProviderSwapped"] | components["schemas"]["TypedEventStreamEnvelopeRequestFailed"] | components["schemas"]["TypedEventStreamEnvelopeRequestResultCityCreate"] | components["schemas"]["TypedEventStreamEnvelopeRequestResultCityUnregister"] | components["schemas"]["TypedEventStreamEnvelopeRequestResultSessionCreate"] | components["schemas"]["TypedEventStreamEnvelopeRequestResultSessionMessage"] | components["schemas"]["TypedEventStreamEnvelopeRequestResultSessionSubmit"] | components["schemas"]["TypedEventStreamEnvelopeSessionCrashed"] | components["schemas"]["TypedEventStreamEnvelopeSessionDraining"] | components["schemas"]["TypedEventStreamEnvelopeSessionIdleKilled"] | components["schemas"]["TypedEventStreamEnvelopeSessionQuarantined"] | components["schemas"]["TypedEventStreamEnvelopeSessionStopped"] | components["schemas"]["TypedEventStreamEnvelopeSessionSuspended"] | components["schemas"]["TypedEventStreamEnvelopeSessionUndrained"] | components["schemas"]["TypedEventStreamEnvelopeSessionUpdated"] | components["schemas"]["TypedEventStreamEnvelopeSessionWoke"] | components["schemas"]["TypedEventStreamEnvelopeWorkerOperation"] | components["schemas"]["TypedEventStreamEnvelopeCustom"];
         /** TypedEventStreamEnvelope bead.closed */
         TypedEventStreamEnvelopeBeadClosed: {
             actor: string;
@@ -4058,40 +4105,6 @@ export interface components {
             type: "city.created";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedEventStreamEnvelope city.init_failed */
-        TypedEventStreamEnvelopeCityInitFailed: {
-            actor: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.init_failed";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
-        /** TypedEventStreamEnvelope city.ready */
-        TypedEventStreamEnvelopeCityReady: {
-            actor: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.ready";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
         /** TypedEventStreamEnvelope city.resumed */
         TypedEventStreamEnvelopeCityResumed: {
             actor: string;
@@ -4126,23 +4139,6 @@ export interface components {
             type: "city.suspended";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedEventStreamEnvelope city.unregister_failed */
-        TypedEventStreamEnvelopeCityUnregisterFailed: {
-            actor: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.unregister_failed";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
         /** TypedEventStreamEnvelope city.unregister_requested */
         TypedEventStreamEnvelopeCityUnregisterRequested: {
             actor: string;
@@ -4160,23 +4156,6 @@ export interface components {
             type: "city.unregister_requested";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedEventStreamEnvelope city.unregistered */
-        TypedEventStreamEnvelopeCityUnregistered: {
-            actor: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.unregistered";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
         /** TypedEventStreamEnvelope controller.started */
         TypedEventStreamEnvelopeControllerStarted: {
             actor: string;
@@ -4245,6 +4224,23 @@ export interface components {
             type: "convoy.created";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
+        /** TypedEventStreamEnvelope custom */
+        TypedEventStreamEnvelopeCustom: {
+            actor: string;
+            message?: string;
+            payload: unknown;
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "TypedEventStreamEnvelopeCustom";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
         /** TypedEventStreamEnvelope extmsg.adapter_added */
         TypedEventStreamEnvelopeExtmsgAdapterAdded: {
             actor: string;
@@ -4551,6 +4547,108 @@ export interface components {
             type: "provider.swapped";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
+        /** TypedEventStreamEnvelope request.failed */
+        TypedEventStreamEnvelopeRequestFailed: {
+            actor: string;
+            message?: string;
+            payload: components["schemas"]["RequestFailedPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.failed";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedEventStreamEnvelope request.result.city.create */
+        TypedEventStreamEnvelopeRequestResultCityCreate: {
+            actor: string;
+            message?: string;
+            payload: components["schemas"]["CityCreateSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.city.create";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedEventStreamEnvelope request.result.city.unregister */
+        TypedEventStreamEnvelopeRequestResultCityUnregister: {
+            actor: string;
+            message?: string;
+            payload: components["schemas"]["CityUnregisterSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.city.unregister";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedEventStreamEnvelope request.result.session.create */
+        TypedEventStreamEnvelopeRequestResultSessionCreate: {
+            actor: string;
+            message?: string;
+            payload: components["schemas"]["SessionCreateSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.session.create";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedEventStreamEnvelope request.result.session.message */
+        TypedEventStreamEnvelopeRequestResultSessionMessage: {
+            actor: string;
+            message?: string;
+            payload: components["schemas"]["SessionMessageSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.session.message";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedEventStreamEnvelope request.result.session.submit */
+        TypedEventStreamEnvelopeRequestResultSessionSubmit: {
+            actor: string;
+            message?: string;
+            payload: components["schemas"]["SessionSubmitSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.session.submit";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
         /** TypedEventStreamEnvelope session.crashed */
         TypedEventStreamEnvelopeSessionCrashed: {
             actor: string;
@@ -4725,7 +4823,7 @@ export interface components {
          * Typed supervisor event stream envelope
          * @description Discriminated union of supervisor event stream envelopes. Each variant constrains the envelope type and payload schema together and includes the source city.
          */
-        TypedTaggedEventStreamEnvelope: components["schemas"]["TypedTaggedEventStreamEnvelopeBeadClosed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeBeadCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeBeadUpdated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityInitFailed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityReady"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityResumed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCitySuspended"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityUnregisterFailed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityUnregisterRequested"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityUnregistered"] | components["schemas"]["TypedTaggedEventStreamEnvelopeControllerStarted"] | components["schemas"]["TypedTaggedEventStreamEnvelopeControllerStopped"] | components["schemas"]["TypedTaggedEventStreamEnvelopeConvoyClosed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeConvoyCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgBound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgGroupCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgInbound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgOutbound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgUnbound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailArchived"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailDeleted"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailMarkedRead"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailMarkedUnread"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailRead"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailReplied"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailSent"] | components["schemas"]["TypedTaggedEventStreamEnvelopeOrderCompleted"] | components["schemas"]["TypedTaggedEventStreamEnvelopeOrderFailed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeOrderFired"] | components["schemas"]["TypedTaggedEventStreamEnvelopeProviderSwapped"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionCrashed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionDraining"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionIdleKilled"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionQuarantined"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionStopped"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionSuspended"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionUndrained"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionUpdated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionWoke"] | components["schemas"]["TypedTaggedEventStreamEnvelopeWorkerOperation"];
+        TypedTaggedEventStreamEnvelope: components["schemas"]["TypedTaggedEventStreamEnvelopeBeadClosed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeBeadCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeBeadUpdated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityResumed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCitySuspended"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCityUnregisterRequested"] | components["schemas"]["TypedTaggedEventStreamEnvelopeControllerStarted"] | components["schemas"]["TypedTaggedEventStreamEnvelopeControllerStopped"] | components["schemas"]["TypedTaggedEventStreamEnvelopeConvoyClosed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeConvoyCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgBound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgGroupCreated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgInbound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgOutbound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeExtmsgUnbound"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailArchived"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailDeleted"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailMarkedRead"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailMarkedUnread"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailRead"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailReplied"] | components["schemas"]["TypedTaggedEventStreamEnvelopeMailSent"] | components["schemas"]["TypedTaggedEventStreamEnvelopeOrderCompleted"] | components["schemas"]["TypedTaggedEventStreamEnvelopeOrderFailed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeOrderFired"] | components["schemas"]["TypedTaggedEventStreamEnvelopeProviderSwapped"] | components["schemas"]["TypedTaggedEventStreamEnvelopeRequestFailed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeRequestResultCityCreate"] | components["schemas"]["TypedTaggedEventStreamEnvelopeRequestResultCityUnregister"] | components["schemas"]["TypedTaggedEventStreamEnvelopeRequestResultSessionCreate"] | components["schemas"]["TypedTaggedEventStreamEnvelopeRequestResultSessionMessage"] | components["schemas"]["TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionCrashed"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionDraining"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionIdleKilled"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionQuarantined"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionStopped"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionSuspended"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionUndrained"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionUpdated"] | components["schemas"]["TypedTaggedEventStreamEnvelopeSessionWoke"] | components["schemas"]["TypedTaggedEventStreamEnvelopeWorkerOperation"] | components["schemas"]["TypedTaggedEventStreamEnvelopeCustom"];
         /** TypedTaggedEventStreamEnvelope bead.closed */
         TypedTaggedEventStreamEnvelopeBeadClosed: {
             actor: string;
@@ -4798,42 +4896,6 @@ export interface components {
             type: "city.created";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope city.init_failed */
-        TypedTaggedEventStreamEnvelopeCityInitFailed: {
-            actor: string;
-            city: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.init_failed";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
-        /** TypedTaggedEventStreamEnvelope city.ready */
-        TypedTaggedEventStreamEnvelopeCityReady: {
-            actor: string;
-            city: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.ready";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
         /** TypedTaggedEventStreamEnvelope city.resumed */
         TypedTaggedEventStreamEnvelopeCityResumed: {
             actor: string;
@@ -4870,24 +4932,6 @@ export interface components {
             type: "city.suspended";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope city.unregister_failed */
-        TypedTaggedEventStreamEnvelopeCityUnregisterFailed: {
-            actor: string;
-            city: string;
-            message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            /**
-             * @description discriminator enum property added by openapi-typescript
-             * @enum {string}
-             */
-            type: "city.unregister_failed";
-            workflow?: components["schemas"]["WorkflowEventProjection"];
-        };
         /** TypedTaggedEventStreamEnvelope city.unregister_requested */
         TypedTaggedEventStreamEnvelopeCityUnregisterRequested: {
             actor: string;
@@ -4906,12 +4950,12 @@ export interface components {
             type: "city.unregister_requested";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope city.unregistered */
-        TypedTaggedEventStreamEnvelopeCityUnregistered: {
+        /** TypedTaggedEventStreamEnvelope controller.started */
+        TypedTaggedEventStreamEnvelopeControllerStarted: {
             actor: string;
             city: string;
             message?: string;
-            payload: components["schemas"]["CityLifecyclePayload"];
+            payload: components["schemas"]["NoPayload"];
             /** Format: int64 */
             seq: number;
             subject?: string;
@@ -4921,11 +4965,11 @@ export interface components {
              * @description discriminator enum property added by openapi-typescript
              * @enum {string}
              */
-            type: "city.unregistered";
+            type: "controller.started";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope controller.started */
-        TypedTaggedEventStreamEnvelopeControllerStarted: {
+        /** TypedTaggedEventStreamEnvelope controller.stopped */
+        TypedTaggedEventStreamEnvelopeControllerStopped: {
             actor: string;
             city: string;
             message?: string;
@@ -4939,11 +4983,11 @@ export interface components {
              * @description discriminator enum property added by openapi-typescript
              * @enum {string}
              */
-            type: "controller.started";
+            type: "controller.stopped";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope controller.stopped */
-        TypedTaggedEventStreamEnvelopeControllerStopped: {
+        /** TypedTaggedEventStreamEnvelope convoy.closed */
+        TypedTaggedEventStreamEnvelopeConvoyClosed: {
             actor: string;
             city: string;
             message?: string;
@@ -4957,11 +5001,11 @@ export interface components {
              * @description discriminator enum property added by openapi-typescript
              * @enum {string}
              */
-            type: "controller.stopped";
+            type: "convoy.closed";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope convoy.closed */
-        TypedTaggedEventStreamEnvelopeConvoyClosed: {
+        /** TypedTaggedEventStreamEnvelope convoy.created */
+        TypedTaggedEventStreamEnvelopeConvoyCreated: {
             actor: string;
             city: string;
             message?: string;
@@ -4975,15 +5019,15 @@ export interface components {
              * @description discriminator enum property added by openapi-typescript
              * @enum {string}
              */
-            type: "convoy.closed";
+            type: "convoy.created";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
-        /** TypedTaggedEventStreamEnvelope convoy.created */
-        TypedTaggedEventStreamEnvelopeConvoyCreated: {
+        /** TypedTaggedEventStreamEnvelope custom */
+        TypedTaggedEventStreamEnvelopeCustom: {
             actor: string;
             city: string;
             message?: string;
-            payload: components["schemas"]["NoPayload"];
+            payload: unknown;
             /** Format: int64 */
             seq: number;
             subject?: string;
@@ -4993,7 +5037,7 @@ export interface components {
              * @description discriminator enum property added by openapi-typescript
              * @enum {string}
              */
-            type: "convoy.created";
+            type: "TypedTaggedEventStreamEnvelopeCustom";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
         /** TypedTaggedEventStreamEnvelope extmsg.adapter_added */
@@ -5320,6 +5364,114 @@ export interface components {
             type: "provider.swapped";
             workflow?: components["schemas"]["WorkflowEventProjection"];
         };
+        /** TypedTaggedEventStreamEnvelope request.failed */
+        TypedTaggedEventStreamEnvelopeRequestFailed: {
+            actor: string;
+            city: string;
+            message?: string;
+            payload: components["schemas"]["RequestFailedPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.failed";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedTaggedEventStreamEnvelope request.result.city.create */
+        TypedTaggedEventStreamEnvelopeRequestResultCityCreate: {
+            actor: string;
+            city: string;
+            message?: string;
+            payload: components["schemas"]["CityCreateSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.city.create";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedTaggedEventStreamEnvelope request.result.city.unregister */
+        TypedTaggedEventStreamEnvelopeRequestResultCityUnregister: {
+            actor: string;
+            city: string;
+            message?: string;
+            payload: components["schemas"]["CityUnregisterSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.city.unregister";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedTaggedEventStreamEnvelope request.result.session.create */
+        TypedTaggedEventStreamEnvelopeRequestResultSessionCreate: {
+            actor: string;
+            city: string;
+            message?: string;
+            payload: components["schemas"]["SessionCreateSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.session.create";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedTaggedEventStreamEnvelope request.result.session.message */
+        TypedTaggedEventStreamEnvelopeRequestResultSessionMessage: {
+            actor: string;
+            city: string;
+            message?: string;
+            payload: components["schemas"]["SessionMessageSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.session.message";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
+        /** TypedTaggedEventStreamEnvelope request.result.session.submit */
+        TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit: {
+            actor: string;
+            city: string;
+            message?: string;
+            payload: components["schemas"]["SessionSubmitSucceededPayload"];
+            /** Format: int64 */
+            seq: number;
+            subject?: string;
+            /** Format: date-time */
+            ts: string;
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "request.result.session.submit";
+            workflow?: components["schemas"]["WorkflowEventProjection"];
+        };
         /** TypedTaggedEventStreamEnvelope session.crashed */
         TypedTaggedEventStreamEnvelopeSessionCrashed: {
             actor: string;
@@ -5505,29 +5657,6 @@ export interface components {
             count: number;
             session_id: string;
         };
-        WireEvent: {
-            actor: string;
-            message?: string;
-            payload?: components["schemas"]["EventPayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            type: string;
-        };
-        WireTaggedEvent: {
-            actor: string;
-            city: string;
-            message?: string;
-            payload?: components["schemas"]["EventPayload"];
-            /** Format: int64 */
-            seq: number;
-            subject?: string;
-            /** Format: date-time */
-            ts: string;
-            type: string;
-        };
         WorkerOperationEventPayload: {
             delivered?: boolean;
             /** Format: int64 */
@@ -5738,7 +5867,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["CityCreateResponse"];
+                    "application/json": components["schemas"]["AsyncAcceptedResponse"];
                 };
             };
             /** @description Error */
@@ -7471,11 +7600,11 @@ export interface operations {
     "stream-events": {
         parameters: {
             query?: {
-                /** @description Reconnect position: only deliver events after this sequence number. */
+                /** @description Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head. */
                 after_seq?: string;
             };
             header?: {
-                /** @description SSE reconnect position from the last received event ID. */
+                /** @description SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head. */
                 "Last-Event-ID"?: string;
             };
             path: {
@@ -8535,7 +8664,7 @@ export interface operations {
             path: {
                 /** @description City name. */
                 cityName: string;
-                /** @description Thread ID. */
+                /** @description Thread ID, or any message ID in the thread. */
                 id: string;
             };
             cookie?: never;
@@ -9009,7 +9138,10 @@ export interface operations {
     };
     "get-v0-city-by-city-name-orders-check": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Bypass cached order-check responses and cached order history. */
+                fresh?: boolean;
+            };
             header?: never;
             path: {
                 /** @description City name. */
@@ -10627,7 +10759,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SessionMessageOutputBody"];
+                    "application/json": components["schemas"]["AsyncAcceptedBody"];
                 };
             };
             /** @description Error */
@@ -10931,7 +11063,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SessionSubmitOutputBody"];
+                    "application/json": components["schemas"]["AsyncAcceptedBody"];
                 };
             };
             /** @description Error */
@@ -10994,6 +11126,8 @@ export interface operations {
                 format?: string;
                 /** @description Pagination cursor: return entries before this UUID. */
                 before?: string;
+                /** @description Pagination cursor: return entries after this UUID. */
+                after?: string;
             };
             header?: never;
             path: {
@@ -11140,7 +11274,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SessionResponse"];
+                    "application/json": components["schemas"]["AsyncAcceptedBody"];
                 };
             };
             /** @description Error */
@@ -11258,7 +11392,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["CityUnregisterResponse"];
+                    "application/json": components["schemas"]["AsyncAcceptedResponse"];
                 };
             };
             /** @description Error */
@@ -11404,11 +11538,11 @@ export interface operations {
     "stream-supervisor-events": {
         parameters: {
             query?: {
-                /** @description Alternative to Last-Event-ID for browsers that can't set custom headers. */
+                /** @description Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head. */
                 after_cursor?: string;
             };
             header?: {
-                /** @description Reconnect cursor (composite per-city cursor). */
+                /** @description Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head. */
                 "Last-Event-ID"?: string;
             };
             path?: never;
diff --git a/cmd/gc/dashboard/web/src/generated/sdk.gen.ts b/cmd/gc/dashboard/web/src/generated/sdk.gen.ts
index be654f696f..17d682f994 100644
--- a/cmd/gc/dashboard/web/src/generated/sdk.gen.ts
+++ b/cmd/gc/dashboard/web/src/generated/sdk.gen.ts
@@ -142,6 +142,8 @@ export const getV0CityByCityNameAgents = <ThrowOnError extends boolean = false>(
 
 /**
  * Create an agent
+ *
+ * Creates an agent and waits until it is visible to immediate follow-up operations. If the agent is durably created but visibility confirmation is canceled or times out, the retryable 503/504 response includes a Retry-After header.
  */
 export const createAgent = <ThrowOnError extends boolean = false>(options: Options<CreateAgentData, ThrowOnError>) => (options.client ?? client).post<CreateAgentResponses, CreateAgentErrors, ThrowOnError>({
     url: '/v0/city/{cityName}/agents',
@@ -336,7 +338,7 @@ export const emitEvent = <ThrowOnError extends boolean = false>(options: Options
 /**
  * Stream city events in real time
  *
- * Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param.
+ * Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param; omitting both starts at the current city event head.
  */
 export const streamEvents = <ThrowOnError extends boolean = false>(options: Options<StreamEventsData, ThrowOnError, StreamEventsResponse>) => (options.client ?? client).sse.get<StreamEventsResponses, StreamEventsErrors, ThrowOnError>({ url: '/v0/city/{cityName}/events/stream', ...options });
 
@@ -1008,6 +1010,8 @@ export const getV0Events = <ThrowOnError extends boolean = false>(options?: Opti
 
 /**
  * Stream tagged events from all running cities.
+ *
+ * Server-Sent Events stream of supervisor-tagged events. Supports reconnection via Last-Event-ID header or after_cursor query param; omitting both starts at the current supervisor event head.
  */
 export const streamSupervisorEvents = <ThrowOnError extends boolean = false>(options?: Options<StreamSupervisorEventsData, ThrowOnError, StreamSupervisorEventsResponse>) => (options?.client ?? client).sse.get<StreamSupervisorEventsResponses, StreamSupervisorEventsErrors, ThrowOnError>({ url: '/v0/events/stream', ...options });
 
diff --git a/cmd/gc/dashboard/web/src/generated/types.gen.ts b/cmd/gc/dashboard/web/src/generated/types.gen.ts
index f516c7dcf0..c72590cd84 100644
--- a/cmd/gc/dashboard/web/src/generated/types.gen.ts
+++ b/cmd/gc/dashboard/web/src/generated/types.gen.ts
@@ -218,6 +218,32 @@ export type AnnotatedProviderResponse = {
     ready_delay_ms?: number;
 };
 
+export type AsyncAcceptedBody = {
+    /**
+     * City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty.
+     */
+    event_cursor: string;
+    /**
+     * Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id.
+     */
+    request_id: string;
+    /**
+     * Async request status.
+     */
+    status: string;
+};
+
+export type AsyncAcceptedResponse = {
+    /**
+     * Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty.
+     */
+    event_cursor: string;
+    /**
+     * Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id.
+     */
+    request_id: string;
+};
+
 export type Bead = {
     assignee?: string;
     created_at: string;
@@ -366,24 +392,28 @@ export type CityCreateRequest = {
      */
     dir: string;
     /**
-     * Provider name for the city's default session template.
+     * Provider name for the city's default session template. Mutually exclusive with start_command.
      */
-    provider: string;
+    provider?: string;
+    /**
+     * Custom workspace start command for the city's default session template. Mutually exclusive with provider.
+     */
+    start_command?: string;
 };
 
-export type CityCreateResponse = {
+export type CityCreateSucceededPayload = {
     /**
-     * Resolved city name as persisted in city.toml. Use this to filter the event stream for completion.
+     * Resolved city name.
      */
     name: string;
     /**
-     * True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready.
+     * Resolved absolute city directory path.
      */
-    ok: boolean;
+    path: string;
     /**
-     * Resolved absolute path of the created city directory.
+     * Correlation ID from the 202 response.
      */
-    path: string;
+    request_id: string;
 };
 
 export type CityGetResponse = {
@@ -408,10 +438,8 @@ export type CityInfo = {
 };
 
 export type CityLifecyclePayload = {
-    error?: string;
     name: string;
     path: string;
-    phases_completed?: Array<string> | null;
 };
 
 export type CityPatchInputBody = {
@@ -421,19 +449,19 @@ export type CityPatchInputBody = {
     suspended?: boolean;
 };
 
-export type CityUnregisterResponse = {
+export type CityUnregisterSucceededPayload = {
     /**
-     * Resolved registry name. Filter the event stream by this to observe completion.
+     * City name that was unregistered.
      */
     name: string;
     /**
-     * True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered.
+     * Absolute city directory path.
      */
-    ok: boolean;
+    path: string;
     /**
-     * Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry.
+     * Correlation ID from the 202 response.
      */
-    path: string;
+    request_id: string;
 };
 
 export type ConfigAgentResponse = {
@@ -717,7 +745,7 @@ export type EventEmitRequest = {
     type: string;
 };
 
-export type EventPayload = AdapterEventPayload | BeadEventPayload | BoundEventPayload | CityLifecyclePayload | GroupCreatedEventPayload | InboundEventPayload | MailEventPayload | NoPayload | OutboundEventPayload | UnboundEventPayload | WorkerOperationEventPayload;
+export type EventPayload = AdapterEventPayload | BeadEventPayload | BoundEventPayload | CityCreateSucceededPayload | CityLifecyclePayload | CityUnregisterSucceededPayload | GroupCreatedEventPayload | InboundEventPayload | MailEventPayload | NoPayload | OutboundEventPayload | RequestFailedPayload | SessionCreateSucceededPayload | SessionMessageSucceededPayload | SessionSubmitSucceededPayload | UnboundEventPayload | WorkerOperationEventPayload;
 
 export type EventStreamEnvelope = {
     actor: string;
@@ -1003,6 +1031,10 @@ export type FormulaListBody = {
      * Whether the list is partial.
      */
     partial: boolean;
+    /**
+     * Total number of formulas in the list.
+     */
+    total: number;
 };
 
 export type FormulaPreviewBody = {
@@ -1432,7 +1464,7 @@ export type ListBodyWireEvent = {
     /**
      * The list of items.
      */
-    items: Array<WireEvent> | null;
+    items: Array<TypedEventStreamEnvelope> | null;
     /**
      * Cursor for the next page of results.
      */
@@ -2070,6 +2102,25 @@ export type ReadinessResponse = {
     };
 };
 
+export type RequestFailedPayload = {
+    /**
+     * Machine-readable error code.
+     */
+    error_code: string;
+    /**
+     * Human-readable error description.
+     */
+    error_message: string;
+    /**
+     * Which operation failed.
+     */
+    operation: 'city.create' | 'city.unregister' | 'session.create' | 'session.message' | 'session.submit';
+    /**
+     * Correlation ID from the 202 response.
+     */
+    request_id: string;
+};
+
 export type RigActionBody = {
     /**
      * Action that was performed.
@@ -2261,6 +2312,17 @@ export type SessionCreateBody = {
     title?: string;
 };
 
+export type SessionCreateSucceededPayload = {
+    /**
+     * Correlation ID from the 202 response.
+     */
+    request_id: string;
+    /**
+     * Full session state as returned by GET /session/{id}. For session.create, this result is emitted only after the session has left creating and can accept normal metadata and lifecycle commands.
+     */
+    session: SessionResponse;
+};
+
 export type SessionInfo = {
     attached: boolean;
     last_activity?: string;
@@ -2274,15 +2336,15 @@ export type SessionMessageInputBody = {
     message: string;
 };
 
-export type SessionMessageOutputBody = {
+export type SessionMessageSucceededPayload = {
     /**
-     * Session ID.
+     * Correlation ID from the 202 response.
      */
-    id: string;
+    request_id: string;
     /**
-     * Operation result.
+     * Session ID that received the message.
      */
-    status: string;
+    session_id: string;
 };
 
 export type SessionPatchBody = {
@@ -2425,23 +2487,23 @@ export type SessionSubmitInputBody = {
     message: string;
 };
 
-export type SessionSubmitOutputBody = {
-    /**
-     * Session ID.
-     */
-    id: string;
+export type SessionSubmitSucceededPayload = {
     /**
-     * Resolved submit intent.
+     * Resolved submit intent (default, follow_up, interrupt_now).
      */
     intent: string;
     /**
-     * Whether the message was queued.
+     * Whether the message was queued for later delivery.
      */
     queued: boolean;
     /**
-     * Operation result.
+     * Correlation ID from the 202 response.
      */
-    status: string;
+    request_id: string;
+    /**
+     * Session ID that received the submission.
+     */
+    session_id: string;
 };
 
 export type SessionTranscriptGetResponse = {
@@ -2577,6 +2639,14 @@ export type StatusBody = {
      * City name.
      */
     name: string;
+    /**
+     * True when one or more status backing reads returned incomplete data.
+     */
+    partial?: boolean;
+    /**
+     * Human-readable errors from incomplete status backing reads.
+     */
+    partial_errors?: Array<string> | null;
     /**
      * City directory path.
      */
@@ -2670,7 +2740,11 @@ export type SupervisorCitiesOutputBody = {
 };
 
 export type SupervisorEventListOutputBody = {
-    items: Array<WireTaggedEvent> | null;
+    /**
+     * Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog.
+     */
+    event_cursor: string;
+    items: Array<TypedTaggedEventStreamEnvelope> | null;
     total: number;
 };
 
@@ -2752,20 +2826,12 @@ export type TypedEventStreamEnvelope = ({
 } & TypedEventStreamEnvelopeBeadUpdated) | ({
     type: 'city.created';
 } & TypedEventStreamEnvelopeCityCreated) | ({
-    type: 'city.init_failed';
-} & TypedEventStreamEnvelopeCityInitFailed) | ({
-    type: 'city.ready';
-} & TypedEventStreamEnvelopeCityReady) | ({
     type: 'city.resumed';
 } & TypedEventStreamEnvelopeCityResumed) | ({
     type: 'city.suspended';
 } & TypedEventStreamEnvelopeCitySuspended) | ({
-    type: 'city.unregister_failed';
-} & TypedEventStreamEnvelopeCityUnregisterFailed) | ({
     type: 'city.unregister_requested';
 } & TypedEventStreamEnvelopeCityUnregisterRequested) | ({
-    type: 'city.unregistered';
-} & TypedEventStreamEnvelopeCityUnregistered) | ({
     type: 'controller.started';
 } & TypedEventStreamEnvelopeControllerStarted) | ({
     type: 'controller.stopped';
@@ -2810,6 +2876,18 @@ export type TypedEventStreamEnvelope = ({
 } & TypedEventStreamEnvelopeOrderFired) | ({
     type: 'provider.swapped';
 } & TypedEventStreamEnvelopeProviderSwapped) | ({
+    type: 'request.failed';
+} & TypedEventStreamEnvelopeRequestFailed) | ({
+    type: 'request.result.city.create';
+} & TypedEventStreamEnvelopeRequestResultCityCreate) | ({
+    type: 'request.result.city.unregister';
+} & TypedEventStreamEnvelopeRequestResultCityUnregister) | ({
+    type: 'request.result.session.create';
+} & TypedEventStreamEnvelopeRequestResultSessionCreate) | ({
+    type: 'request.result.session.message';
+} & TypedEventStreamEnvelopeRequestResultSessionMessage) | ({
+    type: 'request.result.session.submit';
+} & TypedEventStreamEnvelopeRequestResultSessionSubmit) | ({
     type: 'session.crashed';
 } & TypedEventStreamEnvelopeSessionCrashed) | ({
     type: 'session.draining';
@@ -2829,7 +2907,9 @@ export type TypedEventStreamEnvelope = ({
     type: 'session.woke';
 } & TypedEventStreamEnvelopeSessionWoke) | ({
     type: 'worker.operation';
-} & TypedEventStreamEnvelopeWorkerOperation);
+} & TypedEventStreamEnvelopeWorkerOperation) | ({
+    type: 'TypedEventStreamEnvelopeCustom';
+} & TypedEventStreamEnvelopeCustom);
 
 /**
  * TypedEventStreamEnvelope bead.closed
@@ -2887,34 +2967,6 @@ export type TypedEventStreamEnvelopeCityCreated = {
     workflow?: WorkflowEventProjection;
 };
 
-/**
- * TypedEventStreamEnvelope city.init_failed
- */
-export type TypedEventStreamEnvelopeCityInitFailed = {
-    actor: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.init_failed';
-    workflow?: WorkflowEventProjection;
-};
-
-/**
- * TypedEventStreamEnvelope city.ready
- */
-export type TypedEventStreamEnvelopeCityReady = {
-    actor: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.ready';
-    workflow?: WorkflowEventProjection;
-};
-
 /**
  * TypedEventStreamEnvelope city.resumed
  */
@@ -2943,20 +2995,6 @@ export type TypedEventStreamEnvelopeCitySuspended = {
     workflow?: WorkflowEventProjection;
 };
 
-/**
- * TypedEventStreamEnvelope city.unregister_failed
- */
-export type TypedEventStreamEnvelopeCityUnregisterFailed = {
-    actor: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.unregister_failed';
-    workflow?: WorkflowEventProjection;
-};
-
 /**
  * TypedEventStreamEnvelope city.unregister_requested
  */
@@ -2971,20 +3009,6 @@ export type TypedEventStreamEnvelopeCityUnregisterRequested = {
     workflow?: WorkflowEventProjection;
 };
 
-/**
- * TypedEventStreamEnvelope city.unregistered
- */
-export type TypedEventStreamEnvelopeCityUnregistered = {
-    actor: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.unregistered';
-    workflow?: WorkflowEventProjection;
-};
-
 /**
  * TypedEventStreamEnvelope controller.started
  */
@@ -3041,6 +3065,20 @@ export type TypedEventStreamEnvelopeConvoyCreated = {
     workflow?: WorkflowEventProjection;
 };
 
+/**
+ * TypedEventStreamEnvelope custom
+ */
+export type TypedEventStreamEnvelopeCustom = {
+    actor: string;
+    message?: string;
+    payload: unknown;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: string;
+    workflow?: WorkflowEventProjection;
+};
+
 /**
  * TypedEventStreamEnvelope extmsg.adapter_added
  */
@@ -3293,6 +3331,90 @@ export type TypedEventStreamEnvelopeProviderSwapped = {
     workflow?: WorkflowEventProjection;
 };
 
+/**
+ * TypedEventStreamEnvelope request.failed
+ */
+export type TypedEventStreamEnvelopeRequestFailed = {
+    actor: string;
+    message?: string;
+    payload: RequestFailedPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.failed';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedEventStreamEnvelope request.result.city.create
+ */
+export type TypedEventStreamEnvelopeRequestResultCityCreate = {
+    actor: string;
+    message?: string;
+    payload: CityCreateSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.city.create';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedEventStreamEnvelope request.result.city.unregister
+ */
+export type TypedEventStreamEnvelopeRequestResultCityUnregister = {
+    actor: string;
+    message?: string;
+    payload: CityUnregisterSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.city.unregister';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedEventStreamEnvelope request.result.session.create
+ */
+export type TypedEventStreamEnvelopeRequestResultSessionCreate = {
+    actor: string;
+    message?: string;
+    payload: SessionCreateSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.session.create';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedEventStreamEnvelope request.result.session.message
+ */
+export type TypedEventStreamEnvelopeRequestResultSessionMessage = {
+    actor: string;
+    message?: string;
+    payload: SessionMessageSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.session.message';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedEventStreamEnvelope request.result.session.submit
+ */
+export type TypedEventStreamEnvelopeRequestResultSessionSubmit = {
+    actor: string;
+    message?: string;
+    payload: SessionSubmitSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.session.submit';
+    workflow?: WorkflowEventProjection;
+};
+
 /**
  * TypedEventStreamEnvelope session.crashed
  */
@@ -3447,20 +3569,12 @@ export type TypedTaggedEventStreamEnvelope = ({
 } & TypedTaggedEventStreamEnvelopeBeadUpdated) | ({
     type: 'city.created';
 } & TypedTaggedEventStreamEnvelopeCityCreated) | ({
-    type: 'city.init_failed';
-} & TypedTaggedEventStreamEnvelopeCityInitFailed) | ({
-    type: 'city.ready';
-} & TypedTaggedEventStreamEnvelopeCityReady) | ({
     type: 'city.resumed';
 } & TypedTaggedEventStreamEnvelopeCityResumed) | ({
     type: 'city.suspended';
 } & TypedTaggedEventStreamEnvelopeCitySuspended) | ({
-    type: 'city.unregister_failed';
-} & TypedTaggedEventStreamEnvelopeCityUnregisterFailed) | ({
     type: 'city.unregister_requested';
 } & TypedTaggedEventStreamEnvelopeCityUnregisterRequested) | ({
-    type: 'city.unregistered';
-} & TypedTaggedEventStreamEnvelopeCityUnregistered) | ({
     type: 'controller.started';
 } & TypedTaggedEventStreamEnvelopeControllerStarted) | ({
     type: 'controller.stopped';
@@ -3505,6 +3619,18 @@ export type TypedTaggedEventStreamEnvelope = ({
 } & TypedTaggedEventStreamEnvelopeOrderFired) | ({
     type: 'provider.swapped';
 } & TypedTaggedEventStreamEnvelopeProviderSwapped) | ({
+    type: 'request.failed';
+} & TypedTaggedEventStreamEnvelopeRequestFailed) | ({
+    type: 'request.result.city.create';
+} & TypedTaggedEventStreamEnvelopeRequestResultCityCreate) | ({
+    type: 'request.result.city.unregister';
+} & TypedTaggedEventStreamEnvelopeRequestResultCityUnregister) | ({
+    type: 'request.result.session.create';
+} & TypedTaggedEventStreamEnvelopeRequestResultSessionCreate) | ({
+    type: 'request.result.session.message';
+} & TypedTaggedEventStreamEnvelopeRequestResultSessionMessage) | ({
+    type: 'request.result.session.submit';
+} & TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit) | ({
     type: 'session.crashed';
 } & TypedTaggedEventStreamEnvelopeSessionCrashed) | ({
     type: 'session.draining';
@@ -3524,7 +3650,9 @@ export type TypedTaggedEventStreamEnvelope = ({
     type: 'session.woke';
 } & TypedTaggedEventStreamEnvelopeSessionWoke) | ({
     type: 'worker.operation';
-} & TypedTaggedEventStreamEnvelopeWorkerOperation);
+} & TypedTaggedEventStreamEnvelopeWorkerOperation) | ({
+    type: 'TypedTaggedEventStreamEnvelopeCustom';
+} & TypedTaggedEventStreamEnvelopeCustom);
 
 /**
  * TypedTaggedEventStreamEnvelope bead.closed
@@ -3586,36 +3714,6 @@ export type TypedTaggedEventStreamEnvelopeCityCreated = {
     workflow?: WorkflowEventProjection;
 };
 
-/**
- * TypedTaggedEventStreamEnvelope city.init_failed
- */
-export type TypedTaggedEventStreamEnvelopeCityInitFailed = {
-    actor: string;
-    city: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.init_failed';
-    workflow?: WorkflowEventProjection;
-};
-
-/**
- * TypedTaggedEventStreamEnvelope city.ready
- */
-export type TypedTaggedEventStreamEnvelopeCityReady = {
-    actor: string;
-    city: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.ready';
-    workflow?: WorkflowEventProjection;
-};
-
 /**
  * TypedTaggedEventStreamEnvelope city.resumed
  */
@@ -3646,21 +3744,6 @@ export type TypedTaggedEventStreamEnvelopeCitySuspended = {
     workflow?: WorkflowEventProjection;
 };
 
-/**
- * TypedTaggedEventStreamEnvelope city.unregister_failed
- */
-export type TypedTaggedEventStreamEnvelopeCityUnregisterFailed = {
-    actor: string;
-    city: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.unregister_failed';
-    workflow?: WorkflowEventProjection;
-};
-
 /**
  * TypedTaggedEventStreamEnvelope city.unregister_requested
  */
@@ -3676,21 +3759,6 @@ export type TypedTaggedEventStreamEnvelopeCityUnregisterRequested = {
     workflow?: WorkflowEventProjection;
 };
 
-/**
- * TypedTaggedEventStreamEnvelope city.unregistered
- */
-export type TypedTaggedEventStreamEnvelopeCityUnregistered = {
-    actor: string;
-    city: string;
-    message?: string;
-    payload: CityLifecyclePayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: 'city.unregistered';
-    workflow?: WorkflowEventProjection;
-};
-
 /**
  * TypedTaggedEventStreamEnvelope controller.started
  */
@@ -3751,6 +3819,21 @@ export type TypedTaggedEventStreamEnvelopeConvoyCreated = {
     workflow?: WorkflowEventProjection;
 };
 
+/**
+ * TypedTaggedEventStreamEnvelope custom
+ */
+export type TypedTaggedEventStreamEnvelopeCustom = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: unknown;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: string;
+    workflow?: WorkflowEventProjection;
+};
+
 /**
  * TypedTaggedEventStreamEnvelope extmsg.adapter_added
  */
@@ -4021,6 +4104,96 @@ export type TypedTaggedEventStreamEnvelopeProviderSwapped = {
     workflow?: WorkflowEventProjection;
 };
 
+/**
+ * TypedTaggedEventStreamEnvelope request.failed
+ */
+export type TypedTaggedEventStreamEnvelopeRequestFailed = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: RequestFailedPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.failed';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedTaggedEventStreamEnvelope request.result.city.create
+ */
+export type TypedTaggedEventStreamEnvelopeRequestResultCityCreate = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: CityCreateSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.city.create';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedTaggedEventStreamEnvelope request.result.city.unregister
+ */
+export type TypedTaggedEventStreamEnvelopeRequestResultCityUnregister = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: CityUnregisterSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.city.unregister';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedTaggedEventStreamEnvelope request.result.session.create
+ */
+export type TypedTaggedEventStreamEnvelopeRequestResultSessionCreate = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: SessionCreateSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.session.create';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedTaggedEventStreamEnvelope request.result.session.message
+ */
+export type TypedTaggedEventStreamEnvelopeRequestResultSessionMessage = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: SessionMessageSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.session.message';
+    workflow?: WorkflowEventProjection;
+};
+
+/**
+ * TypedTaggedEventStreamEnvelope request.result.session.submit
+ */
+export type TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit = {
+    actor: string;
+    city: string;
+    message?: string;
+    payload: SessionSubmitSucceededPayload;
+    seq: number;
+    subject?: string;
+    ts: string;
+    type: 'request.result.session.submit';
+    workflow?: WorkflowEventProjection;
+};
+
 /**
  * TypedTaggedEventStreamEnvelope session.crashed
  */
@@ -4176,27 +4349,6 @@ export type UnboundEventPayload = {
     session_id: string;
 };
 
-export type WireEvent = {
-    actor: string;
-    message?: string;
-    payload?: EventPayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: string;
-};
-
-export type WireTaggedEvent = {
-    actor: string;
-    city: string;
-    message?: string;
-    payload?: EventPayload;
-    seq: number;
-    subject?: string;
-    ts: string;
-    type: string;
-};
-
 export type WorkerOperationEventPayload = {
     delivered?: boolean;
     duration_ms: number;
@@ -4387,7 +4539,7 @@ export type PostV0CityResponses = {
     /**
      * Accepted
      */
-    202: CityCreateResponse;
+    202: AsyncAcceptedResponse;
 };
 
 export type PostV0CityResponse = PostV0CityResponses[keyof PostV0CityResponses];
@@ -6093,7 +6245,7 @@ export type StreamEventsData = {
     body?: never;
     headers?: {
         /**
-         * SSE reconnect position from the last received event ID.
+         * SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.
          */
         'Last-Event-ID'?: string;
     };
@@ -6105,7 +6257,7 @@ export type StreamEventsData = {
     };
     query?: {
         /**
-         * Reconnect position: only deliver events after this sequence number.
+         * Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.
          */
         after_seq?: string;
     };
@@ -7130,7 +7282,7 @@ export type GetV0CityByCityNameMailThreadByIdData = {
          */
         cityName: string;
         /**
-         * Thread ID.
+         * Thread ID, or any message ID in the thread.
          */
         id: string;
     };
@@ -7616,7 +7768,12 @@ export type GetV0CityByCityNameOrdersCheckData = {
          */
         cityName: string;
     };
-    query?: never;
+    query?: {
+        /**
+         * Bypass cached order-check responses and cached order history.
+         */
+        fresh?: boolean;
+    };
     url: '/v0/city/{cityName}/orders/check';
 };
 
@@ -9161,7 +9318,7 @@ export type SendSessionMessageResponses = {
     /**
      * Accepted
      */
-    202: SessionMessageOutputBody;
+    202: AsyncAcceptedBody;
 };
 
 export type SendSessionMessageResponse = SendSessionMessageResponses[keyof SendSessionMessageResponses];
@@ -9466,7 +9623,7 @@ export type SubmitSessionResponses = {
     /**
      * Accepted
      */
-    202: SessionSubmitOutputBody;
+    202: AsyncAcceptedBody;
 };
 
 export type SubmitSessionResponse = SubmitSessionResponses[keyof SubmitSessionResponses];
@@ -9536,6 +9693,10 @@ export type GetV0CityByCityNameSessionByIdTranscriptData = {
          * Pagination cursor: return entries before this UUID.
          */
         before?: string;
+        /**
+         * Pagination cursor: return entries after this UUID.
+         */
+        after?: string;
     };
     url: '/v0/city/{cityName}/session/{id}/transcript';
 };
@@ -9680,7 +9841,7 @@ export type CreateSessionResponses = {
     /**
      * Accepted
      */
-    202: SessionResponse;
+    202: AsyncAcceptedBody;
 };
 
 export type CreateSessionResponse = CreateSessionResponses[keyof CreateSessionResponses];
@@ -9791,7 +9952,7 @@ export type PostV0CityByCityNameUnregisterResponses = {
     /**
      * Accepted
      */
-    202: CityUnregisterResponse;
+    202: AsyncAcceptedResponse;
 };
 
 export type PostV0CityByCityNameUnregisterResponse = PostV0CityByCityNameUnregisterResponses[keyof PostV0CityByCityNameUnregisterResponses];
@@ -9938,14 +10099,14 @@ export type StreamSupervisorEventsData = {
     body?: never;
     headers?: {
         /**
-         * Reconnect cursor (composite per-city cursor).
+         * Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.
          */
         'Last-Event-ID'?: string;
     };
     path?: never;
     query?: {
         /**
-         * Alternative to Last-Event-ID for browsers that can't set custom headers.
+         * Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.
          */
         after_cursor?: string;
     };
diff --git a/cmd/gc/dashboard/web/src/logger.test.ts b/cmd/gc/dashboard/web/src/logger.test.ts
index edae900cac..dc69975835 100644
--- a/cmd/gc/dashboard/web/src/logger.test.ts
+++ b/cmd/gc/dashboard/web/src/logger.test.ts
@@ -33,4 +33,66 @@ describe("dashboard logger", () => {
     expect(parsed.city).toBe("mc-city");
     expect(parsed.details.reason).toBe("missing recipient");
   });
+
+  it("does not emit debug logs by default", async () => {
+    const { installDashboardLogging, logDebug } = await import("./logger");
+
+    installDashboardLogging();
+    logDebug("api", "Request start", { url: "http://127.0.0.1:8372/v0/cities" });
+
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("does not emit info logs by default", async () => {
+    const info = vi.spyOn(console, "info").mockImplementation(() => undefined);
+    const { installDashboardLogging, logInfo } = await import("./logger");
+
+    installDashboardLogging();
+    logInfo("dashboard", "Boot complete", { city: "mc-city" });
+
+    expect(info).not.toHaveBeenCalled();
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("emits debug logs when explicitly enabled", async () => {
+    window.history.pushState({}, "", "/dashboard?city=mc-city&debug=1");
+    const { installDashboardLogging, logDebug } = await import("./logger");
+
+    installDashboardLogging();
+    logDebug("api", "Request start", { url: "http://127.0.0.1:8372/v0/cities" });
+
+    expect(fetch).toHaveBeenCalledWith("/__client-log", expect.objectContaining({
+      keepalive: true,
+      method: "POST",
+    }));
+  });
+
+  it("emits info logs when explicitly enabled", async () => {
+    window.history.pushState({}, "", "/dashboard?city=mc-city&debug=1");
+    const info = vi.spyOn(console, "info").mockImplementation(() => undefined);
+    const { installDashboardLogging, logInfo } = await import("./logger");
+
+    installDashboardLogging();
+    logInfo("dashboard", "Boot complete", { city: "mc-city" });
+
+    expect(info).toHaveBeenCalledWith("[dashboard][dashboard] Boot complete", { city: "mc-city" });
+    expect(fetch).toHaveBeenCalledWith("/__client-log", expect.objectContaining({
+      keepalive: true,
+      method: "POST",
+    }));
+  });
+
+  it("still emits warnings by default", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => undefined);
+    const { installDashboardLogging, logWarn } = await import("./logger");
+
+    installDashboardLogging();
+    logWarn("status", "City status dependency timed out", { city: "mc-city" });
+
+    expect(warn).toHaveBeenCalledWith("[dashboard][status] City status dependency timed out", { city: "mc-city" });
+    expect(fetch).toHaveBeenCalledWith("/__client-log", expect.objectContaining({
+      keepalive: true,
+      method: "POST",
+    }));
+  });
 });
diff --git a/cmd/gc/dashboard/web/src/logger.ts b/cmd/gc/dashboard/web/src/logger.ts
index b3d0b08347..ecd86bb018 100644
--- a/cmd/gc/dashboard/web/src/logger.ts
+++ b/cmd/gc/dashboard/web/src/logger.ts
@@ -26,11 +26,13 @@ export function installDashboardLogging(): void {
   if (installed || typeof window === "undefined") return;
   installed = true;
 
-  mirrorConsole("debug", "debug");
-  mirrorConsole("info", "info");
+  if (verboseLoggingEnabled()) {
+    mirrorConsole("debug", "debug");
+    mirrorConsole("info", "info");
+    mirrorConsole("log", "info");
+  }
   mirrorConsole("warn", "warn");
   mirrorConsole("error", "error");
-  mirrorConsole("log", "info");
 
   window.addEventListener("error", (event) => {
     logError("window", "Unhandled error", {
@@ -48,10 +50,12 @@ export function installDashboardLogging(): void {
 }
 
 export function logDebug(scope: string, message: string, details?: unknown): void {
+  if (!verboseLoggingEnabled()) return;
   emit("debug", scope, message, details);
 }
 
 export function logInfo(scope: string, message: string, details?: unknown): void {
+  if (!verboseLoggingEnabled()) return;
   emit("info", scope, message, details);
 }
 
@@ -64,11 +68,24 @@ export function logError(scope: string, message: string, details?: unknown): voi
 }
 
 function emit(level: DashboardLogLevel, scope: string, message: string, details?: unknown): void {
+  if ((level === "debug" || level === "info") && !verboseLoggingEnabled()) return;
   const entry = makeEntry(level, scope, message, details);
   originalConsole[level](`[dashboard][${scope}] ${message}`, safeSerialize(details));
   sendToServer(entry);
 }
 
+function verboseLoggingEnabled(): boolean {
+  if (typeof window === "undefined") return false;
+  const params = new URLSearchParams(window.location.search);
+  const query = (params.get("debug") ?? "").toLowerCase();
+  if (query === "1" || query === "true") return true;
+  try {
+    return window.localStorage.getItem("gc.dashboard.debug") === "true";
+  } catch {
+    return false;
+  }
+}
+
 function mirrorConsole(method: keyof typeof originalConsole, level: DashboardLogLevel): void {
   const original = originalConsole[method];
   console[method] = (...args: unknown[]) => {
diff --git a/cmd/gc/dashboard/web/src/main.test.ts b/cmd/gc/dashboard/web/src/main.test.ts
new file mode 100644
index 0000000000..377e836636
--- /dev/null
+++ b/cmd/gc/dashboard/web/src/main.test.ts
@@ -0,0 +1,236 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+async function waitFor(assertion: () => void | Promise<void>): Promise<void> {
+  const deadline = Date.now() + 2_000;
+  let lastError: unknown;
+  while (Date.now() < deadline) {
+    try {
+      await assertion();
+      return;
+    } catch (error) {
+      lastError = error;
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+  }
+  throw lastError;
+}
+
+function installDOM(): void {
+  document.body.innerHTML = `
+    <div id="city-tabs"></div>
+    <div id="connection-status"></div>
+    <div id="convoy-panel"></div>
+    <div id="crew-panel"></div>
+    <div id="rigged-panel"></div>
+    <div id="mail-panel"></div>
+    <div id="escalations-panel"></div>
+    <div id="services-panel"></div>
+    <div id="rigs-panel"></div>
+    <div id="pooled-panel"></div>
+    <div id="queues-panel"></div>
+    <div id="beads-panel"></div>
+    <div id="assigned-panel"></div>
+    <div id="agent-log-drawer"></div>
+    <button id="new-convoy-btn"></button>
+    <button id="new-issue-btn"></button>
+    <button id="compose-mail-btn"></button>
+    <button id="open-assign-btn"></button>
+  `;
+}
+
+describe("dashboard city scope navigation", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.restoreAllMocks();
+    window.history.pushState({}, "", "/dashboard?city=running-city");
+    installDOM();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    window.history.pushState({}, "", "/dashboard");
+  });
+
+  it("clears city-scoped panels when navigating to a stopped city", async () => {
+    vi.doMock("./logger", () => ({
+      installDashboardLogging: vi.fn(),
+      logInfo: vi.fn(),
+    }));
+    vi.doMock("./ui", () => ({
+      installPanelAffordances: vi.fn(),
+      popPause: vi.fn(),
+      refreshPaused: vi.fn(() => false),
+      reportUIError: vi.fn(),
+      setPopPauseListener: vi.fn(),
+    }));
+    vi.doMock("./refresh_scheduler", () => ({
+      createRefreshScheduler: vi.fn(() => ({ schedule: vi.fn() })),
+    }));
+    vi.doMock("./modals", () => ({
+      installSharedModals: vi.fn(),
+    }));
+    vi.doMock("./palette", () => ({
+      installCommandPalette: vi.fn(),
+    }));
+    vi.doMock("./panels/cities", () => ({
+      renderCityTabs: vi.fn(async () => {
+        const { setCachedCities } = await import("./state");
+        setCachedCities([
+          { name: "running-city", phasesCompleted: [], running: true },
+          { name: "stopped-city", phasesCompleted: [], running: false, status: "init_failed" },
+        ]);
+        document.getElementById("city-tabs")!.innerHTML = `
+          <a class="city-tab" href="/dashboard?city=running-city">running-city</a>
+          <a class="city-tab" href="/dashboard?city=stopped-city">stopped-city</a>
+        `;
+      }),
+    }));
+    vi.doMock("./panels/status", () => ({
+      renderStatus: vi.fn(async () => {}),
+    }));
+    vi.doMock("./panels/crew", () => ({
+      closeLogDrawerExternal: vi.fn(),
+      installCrewInteractions: vi.fn(),
+      renderCrew: vi.fn(async () => {}),
+      resetCrewNoCity: vi.fn(),
+    }));
+    vi.doMock("./panels/issues", () => ({
+      installIssueInteractions: vi.fn(),
+      renderIssues: vi.fn(async () => {
+        document.getElementById("beads-panel")!.textContent = "stale bead mlc1-627";
+      }),
+      resetIssuesNoCity: vi.fn(() => {
+        document.getElementById("beads-panel")!.textContent = "cleared beads";
+      }),
+    }));
+    vi.doMock("./panels/mail", () => ({
+      installMailInteractions: vi.fn(),
+      renderMail: vi.fn(async () => {}),
+      resetMailNoCity: vi.fn(),
+    }));
+    vi.doMock("./panels/convoys", () => ({
+      installConvoyInteractions: vi.fn(),
+      renderConvoys: vi.fn(async () => {}),
+      resetConvoysNoCity: vi.fn(),
+    }));
+    vi.doMock("./panels/activity", () => ({
+      eventTypeFromMessage: vi.fn(() => ""),
+      installActivityInteractions: vi.fn(),
+      loadActivityHistory: vi.fn(async () => {}),
+      resetActivity: vi.fn(),
+      startActivityStream: vi.fn(),
+      stopActivityStream: vi.fn(),
+    }));
+    vi.doMock("./panels/admin", () => ({
+      installAdminInteractions: vi.fn(),
+      renderAdminEmptyStates: vi.fn(),
+      renderAdminPanels: vi.fn(async () => {}),
+    }));
+    vi.doMock("./panels/options", () => ({
+      invalidateOptions: vi.fn(),
+    }));
+    vi.doMock("./panels/supervisor", () => ({
+      renderSupervisorOverview: vi.fn(),
+    }));
+
+    await import("./main");
+    await waitFor(() => {
+      expect(document.getElementById("beads-panel")?.textContent).toContain("mlc1-627");
+    });
+
+    document.querySelector<HTMLAnchorElement>('a[href="/dashboard?city=stopped-city"]')!.click();
+
+    await waitFor(() => {
+      expect(window.location.search).toBe("?city=stopped-city");
+      expect(document.getElementById("beads-panel")?.hidden).toBe(true);
+      expect(document.getElementById("beads-panel")?.textContent).not.toContain("mlc1-627");
+    });
+  });
+
+  it("keeps city-scoped panels enabled before the city list is known-good", async () => {
+    const renderIssues = vi.fn(async () => {
+      document.getElementById("beads-panel")!.textContent = "loaded selected city";
+    });
+    const resetIssuesNoCity = vi.fn(() => {
+      document.getElementById("beads-panel")!.textContent = "cleared beads";
+    });
+
+    vi.doMock("./logger", () => ({
+      installDashboardLogging: vi.fn(),
+      logInfo: vi.fn(),
+    }));
+    vi.doMock("./ui", () => ({
+      installPanelAffordances: vi.fn(),
+      popPause: vi.fn(),
+      refreshPaused: vi.fn(() => false),
+      reportUIError: vi.fn(),
+      setPopPauseListener: vi.fn(),
+    }));
+    vi.doMock("./refresh_scheduler", () => ({
+      createRefreshScheduler: vi.fn(() => ({ schedule: vi.fn() })),
+    }));
+    vi.doMock("./modals", () => ({
+      installSharedModals: vi.fn(),
+    }));
+    vi.doMock("./palette", () => ({
+      installCommandPalette: vi.fn(),
+    }));
+    vi.doMock("./panels/cities", () => ({
+      renderCityTabs: vi.fn(async () => {
+        throw new Error("temporary city list failure");
+      }),
+    }));
+    vi.doMock("./panels/status", () => ({
+      renderStatus: vi.fn(async () => {}),
+    }));
+    vi.doMock("./panels/crew", () => ({
+      closeLogDrawerExternal: vi.fn(),
+      installCrewInteractions: vi.fn(),
+      renderCrew: vi.fn(async () => {}),
+      resetCrewNoCity: vi.fn(),
+    }));
+    vi.doMock("./panels/issues", () => ({
+      installIssueInteractions: vi.fn(),
+      renderIssues,
+      resetIssuesNoCity,
+    }));
+    vi.doMock("./panels/mail", () => ({
+      installMailInteractions: vi.fn(),
+      renderMail: vi.fn(async () => {}),
+      resetMailNoCity: vi.fn(),
+    }));
+    vi.doMock("./panels/convoys", () => ({
+      installConvoyInteractions: vi.fn(),
+      renderConvoys: vi.fn(async () => {}),
+      resetConvoysNoCity: vi.fn(),
+    }));
+    vi.doMock("./panels/activity", () => ({
+      eventTypeFromMessage: vi.fn(() => ""),
+      installActivityInteractions: vi.fn(),
+      loadActivityHistory: vi.fn(async () => {}),
+      resetActivity: vi.fn(),
+      startActivityStream: vi.fn(),
+      stopActivityStream: vi.fn(),
+    }));
+    vi.doMock("./panels/admin", () => ({
+      installAdminInteractions: vi.fn(),
+      renderAdminEmptyStates: vi.fn(),
+      renderAdminPanels: vi.fn(async () => {}),
+    }));
+    vi.doMock("./panels/options", () => ({
+      invalidateOptions: vi.fn(),
+    }));
+    vi.doMock("./panels/supervisor", () => ({
+      renderSupervisorOverview: vi.fn(),
+    }));
+
+    await import("./main");
+
+    await waitFor(() => {
+      expect(renderIssues).toHaveBeenCalled();
+      expect(document.getElementById("beads-panel")?.hidden).toBe(false);
+      expect(document.getElementById("beads-panel")?.textContent).toBe("loaded selected city");
+    });
+    expect(resetIssuesNoCity).not.toHaveBeenCalled();
+  });
+});
diff --git a/cmd/gc/dashboard/web/src/main.ts b/cmd/gc/dashboard/web/src/main.ts
index 8ecb85faf8..558d13f540 100644
--- a/cmd/gc/dashboard/web/src/main.ts
+++ b/cmd/gc/dashboard/web/src/main.ts
@@ -1,26 +1,30 @@
 import { cityScope } from "./api";
 import { renderCityTabs } from "./panels/cities";
 import { renderStatus } from "./panels/status";
-import { renderCrew, installCrewInteractions, closeLogDrawerExternal } from "./panels/crew";
-import { renderIssues, installIssueInteractions } from "./panels/issues";
-import { renderMail, installMailInteractions } from "./panels/mail";
-import { renderConvoys, installConvoyInteractions } from "./panels/convoys";
-import { eventTypeFromMessage, loadActivityHistory, startActivityStream, stopActivityStream, installActivityInteractions } from "./panels/activity";
-import { renderAdminPanels, installAdminInteractions } from "./panels/admin";
+import { renderCrew, installCrewInteractions, closeLogDrawerExternal, resetCrewNoCity } from "./panels/crew";
+import { renderIssues, installIssueInteractions, resetIssuesNoCity } from "./panels/issues";
+import { renderMail, installMailInteractions, resetMailNoCity } from "./panels/mail";
+import { renderConvoys, installConvoyInteractions, resetConvoysNoCity } from "./panels/convoys";
+import { eventTypeFromMessage, loadActivityHistory, resetActivity, startActivityStream, stopActivityStream, installActivityInteractions } from "./panels/activity";
+import { renderAdminPanels, installAdminInteractions, renderAdminEmptyStates } from "./panels/admin";
 import { invalidateOptions } from "./panels/options";
 import { installPanelAffordances, popPause, refreshPaused, reportUIError, setPopPauseListener } from "./ui";
 import { installCommandPalette } from "./palette";
 import { installDashboardLogging, logInfo } from "./logger";
 import {
   consumeInvalidated,
+  canFetchCityScopedResources,
   currentCityStatus,
   invalidateAll,
   invalidateForEventType,
+  isKnownUnavailableCity,
+  markCachedCitiesUnknown,
   syncCityScopeFromLocation,
   type DashboardResource,
 } from "./state";
 import { renderSupervisorOverview } from "./panels/supervisor";
 import { installSharedModals } from "./modals";
+import { createRefreshScheduler } from "./refresh_scheduler";
 
 const CITY_SCOPED_PANEL_IDS = [
   "convoy-panel",
@@ -63,7 +67,7 @@ function wireSSE(): void {
   // the supervisor with every backoff tick. Supervisor-scope streams
   // (kind === "supervisor") always open.
   const status = currentCityStatus();
-  if (status.kind === "not-running" || status.kind === "unknown") {
+  if (isKnownUnavailableCity(status)) {
     stopActivityStream();
     setConnectionBadge("connecting"); // visible "not wired" state; re-wires on next city switch
     return;
@@ -76,9 +80,10 @@ function wireSSE(): void {
       // Always mark the dirty set — the pause guard only defers the
       // render. Without this, events that arrive while a modal is open
       // get dropped and panels stay stale after the modal closes.
-      invalidateForEventType(eventType);
+      const needsRefresh = invalidateForEventType(eventType);
+      if (!needsRefresh) return;
       if (refreshPaused()) return;
-      void refreshVisibleResources().catch((error) => reportUIError("Refresh failed", error));
+      scheduleRefresh();
     },
     setConnectionBadge,
   );
@@ -130,13 +135,12 @@ function byId(id: string): HTMLElement | null {
 
 void boot().catch((error) => reportUIError("Dashboard boot failed", error));
 
-function syncCityScopedControls(): void {
-  const hasCity = cityScope() !== "";
-  syncCityScopedPanels(hasCity);
-  setControlState("new-convoy-btn", hasCity, "Select a city to create a convoy");
-  setControlState("new-issue-btn", hasCity, "Select a city to create a bead");
-  setControlState("compose-mail-btn", hasCity, "Select a city to compose mail");
-  setControlState("open-assign-btn", hasCity, "Select a city to assign work");
+function syncCityScopedControls(enabled: boolean): void {
+  syncCityScopedPanels(enabled);
+  setControlState("new-convoy-btn", enabled, "Select a running city to create a convoy");
+  setControlState("new-issue-btn", enabled, "Select a running city to create a bead");
+  setControlState("compose-mail-btn", enabled, "Select a running city to compose mail");
+  setControlState("open-assign-btn", enabled, "Select a running city to assign work");
 }
 
 function setControlState(id: string, enabled: boolean, disabledTitle: string): void {
@@ -205,9 +209,23 @@ function syncCityScopedPanels(hasCity: boolean): void {
   });
 }
 
+const REFRESH_DEBOUNCE_MS = 1_000;
+const REFRESH_MIN_INTERVAL_MS = 10_000;
+
+const refreshScheduler = createRefreshScheduler({
+  delayMs: REFRESH_DEBOUNCE_MS,
+  isPaused: refreshPaused,
+  minIntervalMs: REFRESH_MIN_INTERVAL_MS,
+  onError: (error) => reportUIError("Refresh failed", error),
+  run: () => refreshVisibleResources(),
+});
+
+function scheduleRefresh(): void {
+  refreshScheduler.schedule();
+}
+
 async function refreshVisibleResources(force = false): Promise<void> {
   syncCityScopeFromLocation();
-  syncCityScopedControls();
 
   const dirty = consumeInvalidated(force);
   if (dirty.size === 0) return;
@@ -216,20 +234,30 @@ async function refreshVisibleResources(force = false): Promise<void> {
   }
 
   if (dirty.has("cities")) {
-    await renderCityTabs().catch((error) => reportUIError("City tabs failed", error));
+    await renderCityTabs().catch((error) => {
+      markCachedCitiesUnknown();
+      reportUIError("City tabs failed", error);
+    });
   }
 
   const tasks: Array<Promise<void>> = [];
   const status = currentCityStatus();
-  const hasRunningCity = status.kind === "running";
+  const canFetchCity = canFetchCityScopedResources(status);
+  syncCityScopedControls(canFetchCity);
+  if (isKnownUnavailableCity(status)) {
+    resetCityScopedResourceViews();
+  }
 
   queueRefresh(tasks, dirty, "status", () => renderStatus());
-  queueRefresh(tasks, dirty, "activity", () => loadActivityHistory());
-  // Only fan out per-city fetches when the selected city is actually
-  // running. Stopped/unknown cities return 404 for every endpoint,
-  // which cascades into a console full of errors for the user. Let
-  // renderStatus surface the "city not running" banner instead.
-  if (hasRunningCity) {
+  if (status.kind === "supervisor" || canFetchCity) {
+    queueRefresh(tasks, dirty, "activity", () => loadActivityHistory());
+  } else {
+    resetActivity();
+  }
+  // Fan out city-scoped fetches for running cities and for selected
+  // cities whose availability is not known yet. Reset/hide only once
+  // the city list is known-good and proves the city is stopped or absent.
+  if (canFetchCity) {
     queueRefresh(tasks, dirty, "crew", () => renderCrew());
     queueRefresh(tasks, dirty, "issues", () => renderIssues());
     queueRefresh(tasks, dirty, "mail", () => renderMail());
@@ -248,6 +276,14 @@ async function refreshVisibleResources(force = false): Promise<void> {
   }
 }
 
+function resetCityScopedResourceViews(): void {
+  resetConvoysNoCity();
+  resetCrewNoCity();
+  resetIssuesNoCity();
+  resetMailNoCity();
+  renderAdminEmptyStates();
+}
+
 function queueRefresh(
   tasks: Array<Promise<void>>,
   dirty: Set<DashboardResource>,
diff --git a/cmd/gc/dashboard/web/src/panels/activity.test.ts b/cmd/gc/dashboard/web/src/panels/activity.test.ts
index 10fc5b8257..1dad8834b7 100644
--- a/cmd/gc/dashboard/web/src/panels/activity.test.ts
+++ b/cmd/gc/dashboard/web/src/panels/activity.test.ts
@@ -1,6 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
-import { renderActivity, seedActivity, type ActivityEntry } from "./activity";
+import {
+  activityStreamCursorFromRecordsForTest,
+  renderActivity,
+  seedActivity,
+  type ActivityEntry,
+} from "./activity";
 
 describe("activity feed ordering", () => {
   beforeEach(() => {
@@ -56,4 +61,24 @@ describe("activity feed ordering", () => {
     expect(document.querySelectorAll(".tl-entry")).toHaveLength(3);
     expect(document.getElementById("activity-count")?.textContent).toBe("3");
   });
+
+  it("computes a city stream cursor from loaded history", () => {
+    const cursor = activityStreamCursorFromRecordsForTest([
+      { seq: 12, type: "bead.created", actor: "human", ts: "2026-04-01T10:00:00Z" },
+      { seq: 19, type: "bead.updated", actor: "human", ts: "2026-04-01T10:01:00Z" },
+      { seq: 15, type: "bead.closed", actor: "human", ts: "2026-04-01T10:02:00Z" },
+    ] as any, "mc-city");
+
+    expect(cursor).toEqual({ afterSeq: "19" });
+  });
+
+  it("resumes the supervisor stream from the history response cursor", () => {
+    const cursor = activityStreamCursorFromRecordsForTest([
+      { city: "beta", seq: 3, type: "bead.created", actor: "human", ts: "2026-04-01T10:00:00Z" },
+      { city: "alpha", seq: 9, type: "bead.updated", actor: "human", ts: "2026-04-01T10:01:00Z" },
+      { city: "beta", seq: 7, type: "bead.closed", actor: "human", ts: "2026-04-01T10:02:00Z" },
+    ] as any, "", "alpha:12,beta:8");
+
+    expect(cursor).toEqual({ afterCursor: "alpha:12,beta:8" });
+  });
 });
diff --git a/cmd/gc/dashboard/web/src/panels/activity.ts b/cmd/gc/dashboard/web/src/panels/activity.ts
index 6564c68469..0078a385a6 100644
--- a/cmd/gc/dashboard/web/src/panels/activity.ts
+++ b/cmd/gc/dashboard/web/src/panels/activity.ts
@@ -5,7 +5,6 @@ import type {
   SupervisorEventStreamEnvelope,
 } from "../api";
 import { api, cityScope } from "../api";
-import { logDebug } from "../logger";
 import { byId, clear, el } from "../util/dom";
 import {
   connectCityEvents,
@@ -30,7 +29,8 @@ export interface ActivityEntry {
   type: string;
 }
 
-type DashboardEventRecord = CityEventRecord | SupervisorEventRecord | CityEventStreamEnvelope | SupervisorEventStreamEnvelope;
+type DashboardHistoryRecord = CityEventRecord | SupervisorEventRecord;
+type DashboardEventRecord = DashboardHistoryRecord | CityEventStreamEnvelope | SupervisorEventStreamEnvelope;
 
 const MAX_ENTRIES = 150;
 const entries: ActivityEntry[] = [];
@@ -38,6 +38,7 @@ let handle: SSEHandle | null = null;
 let categoryFilter = "all";
 let rigFilter = "all";
 let agentFilter = "all";
+let streamCursor: { afterCursor?: string; afterSeq?: string } = {};
 
 export async function seedActivity(entriesFromAPI: ActivityEntry[]): Promise<void> {
   entries.splice(0, entries.length, ...normalizeEntries(entriesFromAPI));
@@ -46,26 +47,43 @@ export async function seedActivity(entriesFromAPI: ActivityEntry[]): Promise<voi
 
 export async function loadActivityHistory(): Promise<void> {
   const city = cityScope();
-  const res = city
-    ? await api.GET("/v0/city/{cityName}/events", {
-        params: { path: { cityName: city }, query: { since: "1h", limit: 100 } },
-      })
-    : await api.GET("/v0/events", {
-        params: { query: { since: "1h" } },
-      });
-  const normalized = (res.data?.items ?? [])
+  let records: DashboardHistoryRecord[] = [];
+  let supervisorEventCursor = "";
+  if (city) {
+    const res = await api.GET("/v0/city/{cityName}/events", {
+      params: { path: { cityName: city }, query: { since: "1h", limit: 100 } },
+    });
+    records = res.data?.items ?? [];
+  } else {
+    const res = await api.GET("/v0/events", {
+      params: { query: { since: "1h" } },
+    });
+    records = res.data?.items ?? [];
+    supervisorEventCursor = res.data?.event_cursor ?? "";
+  }
+  const normalized = records
     .map((item) => toEntryFromRecord(item))
     .filter((item): item is ActivityEntry => item !== null);
+  streamCursor = cursorFromRecords(records, city, supervisorEventCursor);
   await seedActivity(normalized);
 }
 
+export function resetActivity(): void {
+  entries.splice(0, entries.length);
+  streamCursor = {};
+  renderActivity();
+}
+
 export function startActivityStream(
   onEvent?: (msg: DashboardEventMessage, eventType: string) => void,
   onStatus?: (status: import("../sse").SSEStatus) => void,
 ): void {
   const city = cityScope();
   handle?.close();
-  const opts = onStatus ? { onStatus } : undefined;
+  const opts = {
+    ...streamCursor,
+    ...(onStatus ? { onStatus } : {}),
+  };
   const connect = city
     ? (listener: (msg: DashboardEventMessage) => void) => connectCityEvents(city, listener, opts)
     : (listener: (msg: DashboardEventMessage) => void) => connectEvents(listener, opts);
@@ -75,7 +93,6 @@ export function startActivityStream(
     const entry = toEntryFromMessage(msg);
     if (!entry) return;
     if (entries.some((current) => current.id === entry.id)) {
-      logDebug("activity", "Duplicate stream event ignored", { id: entry.id, type: entry.type });
       return;
     }
     entries.splice(0, entries.length, ...normalizeEntries([entry, ...entries]));
@@ -83,6 +100,18 @@ export function startActivityStream(
   });
 }
 
+export function activityStreamCursorForTest(): { afterCursor?: string; afterSeq?: string } {
+  return { ...streamCursor };
+}
+
+export function activityStreamCursorFromRecordsForTest(
+  records: DashboardEventRecord[],
+  city: string,
+  supervisorEventCursor = "",
+): { afterCursor?: string; afterSeq?: string } {
+  return cursorFromRecords(records, city, supervisorEventCursor);
+}
+
 export function stopActivityStream(): void {
   handle?.close();
   handle = null;
@@ -190,8 +219,8 @@ function renderFilters(): void {
       filterButton("comms", "Comms"),
       filterButton("system", "System"),
     ]),
-    el("div", { class: "tl-filter-group" }, [el("label", {}, ["Rig:"]), rigSelect]),
-    el("div", { class: "tl-filter-group" }, [el("label", {}, ["Agent:"]), agentSelect]),
+    el("div", { class: "tl-filter-group" }, [el("label", { for: "tl-rig-filter" }, ["Rig:"]), rigSelect]),
+    el("div", { class: "tl-filter-group" }, [el("label", { for: "tl-agent-filter" }, ["Agent:"]), agentSelect]),
   ]));
 }
 
@@ -214,7 +243,7 @@ function toEntryFromMessage(msg: DashboardEventMessage): ActivityEntry | null {
   return toActivityEntry(msg.data, msg.id);
 }
 
-function toEntryFromRecord(record: CityEventRecord | SupervisorEventRecord): ActivityEntry | null {
+function toEntryFromRecord(record: DashboardHistoryRecord): ActivityEntry | null {
   return toActivityEntry(record);
 }
 
@@ -275,6 +304,20 @@ function recordCity(record: DashboardEventRecord): string | undefined {
   return undefined;
 }
 
+function cursorFromRecords(
+  records: DashboardEventRecord[],
+  city: string,
+  supervisorEventCursor = "",
+): { afterCursor?: string; afterSeq?: string } {
+  if (city) {
+    const maxSeq = records.reduce((max, record) => Math.max(max, record.seq ?? 0), 0);
+    return maxSeq > 0 ? { afterSeq: String(maxSeq) } : {};
+  }
+
+  const cursor = supervisorEventCursor.trim();
+  return cursor ? { afterCursor: cursor } : {};
+}
+
 function stableEventID(record: DashboardEventRecord, eventID?: string): string {
   const scope = recordCity(record) ?? cityScope();
   if (typeof record.seq === "number" && record.seq > 0) {
diff --git a/cmd/gc/dashboard/web/src/panels/admin.ts b/cmd/gc/dashboard/web/src/panels/admin.ts
index 4fb76943c1..b8984dd842 100644
--- a/cmd/gc/dashboard/web/src/panels/admin.ts
+++ b/cmd/gc/dashboard/web/src/panels/admin.ts
@@ -33,7 +33,7 @@ export async function renderAdminPanels(): Promise<void> {
   renderQueues(queuesR.data?.items ?? null);
 }
 
-function renderAdminEmptyStates(): void {
+export function renderAdminEmptyStates(): void {
   renderEmptyBody("services-body", "services-count", "Select a city to view services");
   renderEmptyBody("rigs-body", "rigs-count", "Select a city to view rigs");
   renderEmptyBody("escalations-body", "escalations-count", "Select a city to view escalations");
diff --git a/cmd/gc/dashboard/web/src/panels/cities.test.ts b/cmd/gc/dashboard/web/src/panels/cities.test.ts
index 07e9ee6498..b6d3d9b7d6 100644
--- a/cmd/gc/dashboard/web/src/panels/cities.test.ts
+++ b/cmd/gc/dashboard/web/src/panels/cities.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { api } from "../api";
-import { syncCityScopeFromLocation } from "../state";
+import { canFetchCityScopedResources, currentCityStatus, syncCityScopeFromLocation } from "../state";
 import { renderCityTabs } from "./cities";
 
 describe("city tabs", () => {
@@ -33,4 +33,40 @@ describe("city tabs", () => {
     expect(document.getElementById("city-tabs")?.textContent).toContain("mc-city");
     expect(document.getElementById("city-tabs")?.textContent).toContain("Supervisor");
   });
+
+  it("treats unknown selected cities as fetchable after a failed city-list refresh", async () => {
+    const get = vi.spyOn(api, "GET");
+    get.mockResolvedValueOnce({
+      data: {
+        items: [{ error: "", name: "mc-city", path: "/tmp/mc-city", phases_completed: [], running: true, status: "ok" }],
+      },
+    } as never);
+    await renderCityTabs();
+
+    get.mockResolvedValueOnce({ error: { detail: "boom" } } as never);
+    await renderCityTabs();
+    window.history.pushState({}, "", "/dashboard?city=not-yet-listed");
+    syncCityScopeFromLocation();
+
+    expect(currentCityStatus()).toEqual({ kind: "unknown", name: "not-yet-listed" });
+    expect(canFetchCityScopedResources()).toBe(true);
+  });
+
+  it("does not trust stale stopped-city status after a failed city-list refresh", async () => {
+    const get = vi.spyOn(api, "GET");
+    get.mockResolvedValueOnce({
+      data: {
+        items: [{ error: "", name: "mc-city", path: "/tmp/mc-city", phases_completed: [], running: false, status: "stopped" }],
+      },
+    } as never);
+    await renderCityTabs();
+    expect(currentCityStatus().kind).toBe("not-running");
+    expect(canFetchCityScopedResources()).toBe(false);
+
+    get.mockResolvedValueOnce({ error: { detail: "boom" } } as never);
+    await renderCityTabs();
+
+    expect(currentCityStatus()).toEqual({ kind: "unknown", name: "mc-city" });
+    expect(canFetchCityScopedResources()).toBe(true);
+  });
 });
diff --git a/cmd/gc/dashboard/web/src/panels/cities.ts b/cmd/gc/dashboard/web/src/panels/cities.ts
index bb3888fad2..e162ab6df5 100644
--- a/cmd/gc/dashboard/web/src/panels/cities.ts
+++ b/cmd/gc/dashboard/web/src/panels/cities.ts
@@ -4,7 +4,7 @@
 // every panel re-fetches against the new scope.
 
 import { api, cityScope } from "../api";
-import { getCachedCities, setCachedCities } from "../state";
+import { getCachedCities, markCachedCitiesUnknown, setCachedCities } from "../state";
 import { byId, clear, el } from "../util/dom";
 
 export async function renderCityTabs(): Promise<void> {
@@ -21,6 +21,8 @@ export async function renderCityTabs(): Promise<void> {
       running: city.running === true,
       status: city.status ?? undefined,
     })));
+  } else {
+    markCachedCitiesUnknown();
   }
   const cachedCityItems = getCachedCities();
   if (error || cachedCityItems.length === 0) {
diff --git a/cmd/gc/dashboard/web/src/panels/convoys.ts b/cmd/gc/dashboard/web/src/panels/convoys.ts
index 63478c919f..58bd0e0255 100644
--- a/cmd/gc/dashboard/web/src/panels/convoys.ts
+++ b/cmd/gc/dashboard/web/src/panels/convoys.ts
@@ -100,7 +100,7 @@ export async function renderConvoys(): Promise<void> {
   ]));
 }
 
-function resetConvoysNoCity(): void {
+export function resetConvoysNoCity(): void {
   const container = byId("convoy-list");
   const detail = byId("convoy-detail");
   const create = byId("convoy-create-form");
diff --git a/cmd/gc/dashboard/web/src/panels/crew.test.ts b/cmd/gc/dashboard/web/src/panels/crew.test.ts
index fe758b862d..e572fa2f67 100644
--- a/cmd/gc/dashboard/web/src/panels/crew.test.ts
+++ b/cmd/gc/dashboard/web/src/panels/crew.test.ts
@@ -140,10 +140,17 @@ describe("crew empty states", () => {
   });
 });
 
+// Slow Blacksmith CI runs have shown the openLogDrawer + loadTranscript
+// chain take ~1.3s while passing runs finish in ~100ms — same VM class,
+// same code. The 1s budget here was missing those slow runs by a few
+// hundred ms even though the chain ultimately completed (the
+// `[crew] Transcript loaded` debug log fires *after* the assertion times
+// out). Five seconds keeps the local cost negligible and absorbs the
+// observed CI variance.
 async function waitFor(assertion: () => void): Promise<void> {
   const started = Date.now();
   let lastError: unknown;
-  while (Date.now() - started < 1000) {
+  while (Date.now() - started < 5000) {
     try {
       assertion();
       return;
diff --git a/cmd/gc/dashboard/web/src/panels/crew.ts b/cmd/gc/dashboard/web/src/panels/crew.ts
index 706432cd3c..609d7eb212 100644
--- a/cmd/gc/dashboard/web/src/panels/crew.ts
+++ b/cmd/gc/dashboard/web/src/panels/crew.ts
@@ -104,7 +104,7 @@ export async function renderCrew(): Promise<void> {
   renderPooledAgents(sessions);
 }
 
-function resetCrewNoCity(): void {
+export function resetCrewNoCity(): void {
   const crewLoading = byId("crew-loading");
   const crewTable = byId<HTMLTableElement>("crew-table");
   const crewEmpty = byId("crew-empty");
diff --git a/cmd/gc/dashboard/web/src/panels/issues.ts b/cmd/gc/dashboard/web/src/panels/issues.ts
index 2997f0ecb2..b53b03b1aa 100644
--- a/cmd/gc/dashboard/web/src/panels/issues.ts
+++ b/cmd/gc/dashboard/web/src/panels/issues.ts
@@ -27,7 +27,7 @@ export async function renderIssues(): Promise<void> {
     api.GET("/v0/city/{cityName}/beads", {
       params: { path: { cityName: city }, query: { status: "in_progress", limit: 500 } },
     }),
-    getOptions(true),
+    getOptions(),
   ]);
   if ((openR.error && progressR.error) || (!openR.data?.items && !progressR.data?.items)) {
     clear(issuesList);
@@ -35,14 +35,10 @@ export async function renderIssues(): Promise<void> {
     return;
   }
 
-  allIssues = [...(openR.data?.items ?? []), ...(progressR.data?.items ?? [])]
-    .filter((bead) => !isInternalBead(bead))
-    .sort((a, b) => {
-      const pa = beadPriority(a.priority);
-      const pb = beadPriority(b.priority);
-      if (pa !== pb) return pa - pb;
-      return (b.created_at ?? "").localeCompare(a.created_at ?? "");
-    });
+  allIssues = sortIssues(
+    [...(openR.data?.items ?? []), ...(progressR.data?.items ?? [])]
+      .filter((bead) => !isInternalBead(bead)),
+  );
   byId("issues-count")!.textContent = String(allIssues.length);
 
   const rigTabs = byId("rig-filter-tabs");
@@ -55,7 +51,7 @@ export async function renderIssues(): Promise<void> {
   renderIssueTable();
 }
 
-function resetIssuesNoCity(): void {
+export function resetIssuesNoCity(): void {
   const issuesList = byId("issues-list");
   const rigTabs = byId("rig-filter-tabs");
   const detail = byId("issue-detail");
@@ -65,6 +61,7 @@ function resetIssuesNoCity(): void {
   const detailOpen = detail.style.display === "block";
   detail.style.display = "none";
   issuesList.style.display = "block";
+  clearIssueDetailContent();
   clear(issuesList);
   issuesList.append(el("div", { class: "empty-state" }, [el("p", {}, ["Select a city to view beads"])]));
   clear(rigTabs);
@@ -76,6 +73,32 @@ function resetIssuesNoCity(): void {
   if (detailOpen) popPause();
 }
 
+function clearIssueDetailContent(): void {
+  [
+    "issue-detail-id",
+    "issue-detail-title-text",
+    "issue-detail-description",
+    "issue-detail-status",
+    "issue-detail-type",
+    "issue-detail-owner",
+    "issue-detail-created",
+  ].forEach((id) => {
+    const node = byId(id);
+    if (node) node.textContent = "";
+  });
+  const priority = byId("issue-detail-priority");
+  if (priority) {
+    priority.className = "badge";
+    priority.textContent = "";
+  }
+  ["issue-detail-actions", "issue-detail-depends-on", "issue-detail-blocks"].forEach((id) => {
+    const node = byId(id);
+    if (node) clear(node);
+  });
+  byId("issue-detail-deps")?.style.setProperty("display", "none");
+  byId("issue-detail-blocks-section")?.style.setProperty("display", "none");
+}
+
 function renderIssueTable(): void {
   const container = byId("issues-list");
   if (!container) return;
@@ -155,6 +178,15 @@ function isInternalBead(issue: BeadRecord): boolean {
   return (issue.labels ?? []).some((label) => label.startsWith("gc:queue") || label.startsWith("gc:message"));
 }
 
+function sortIssues(issues: BeadRecord[]): BeadRecord[] {
+  return [...issues].sort((a, b) => {
+    const pa = beadPriority(a.priority);
+    const pb = beadPriority(b.priority);
+    if (pa !== pb) return pa - pb;
+    return (b.created_at ?? "").localeCompare(a.created_at ?? "");
+  });
+}
+
 export function installIssueInteractions(): void {
   document.querySelectorAll(".tab-btn").forEach((node) => {
     node.addEventListener("click", (event) => {
@@ -311,7 +343,7 @@ function actionButton(label: string, klass: string, onClick: () => void): HTMLEl
 }
 
 function prioritySelect(issueID: string, current: number | undefined): HTMLElement {
-  const select = el("select", { class: "issue-action-select", id: "issue-action-priority" }) as HTMLSelectElement;
+  const select = el("select", { class: "issue-action-select", id: "issue-action-priority", "aria-label": "Priority" }) as HTMLSelectElement;
   [1, 2, 3, 4].forEach((priority) => {
     const option = el("option", { value: priority, selected: beadPriority(current) === priority }, [`P${priority}`]) as HTMLOptionElement;
     select.append(option);
@@ -323,7 +355,7 @@ function prioritySelect(issueID: string, current: number | undefined): HTMLEleme
 }
 
 function assigneeSelect(issueID: string, current: string | undefined, agents: string[]): HTMLElement {
-  const select = el("select", { class: "issue-action-select", id: "issue-action-assignee" }) as HTMLSelectElement;
+  const select = el("select", { class: "issue-action-select", id: "issue-action-assignee", "aria-label": "Assignee" }) as HTMLSelectElement;
   select.append(el("option", { value: "" }, ["Unassigned"]));
   agents.forEach((agent) => {
     select.append(el("option", { value: agent, selected: current === agent }, [agent]));
diff --git a/cmd/gc/dashboard/web/src/panels/mail.ts b/cmd/gc/dashboard/web/src/panels/mail.ts
index 69c77a3a6e..4eb510316b 100644
--- a/cmd/gc/dashboard/web/src/panels/mail.ts
+++ b/cmd/gc/dashboard/web/src/panels/mail.ts
@@ -56,7 +56,7 @@ export async function renderMail(): Promise<void> {
   restoreMailView();
 }
 
-function resetMailNoCity(): void {
+export function resetMailNoCity(): void {
   const loading = byId("mail-loading");
   const threadsEl = byId("mail-threads");
   const empty = byId("mail-empty");
diff --git a/cmd/gc/dashboard/web/src/panels/status.test.ts b/cmd/gc/dashboard/web/src/panels/status.test.ts
new file mode 100644
index 0000000000..3d72673d91
--- /dev/null
+++ b/cmd/gc/dashboard/web/src/panels/status.test.ts
@@ -0,0 +1,293 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const apiGet = vi.fn();
+
+vi.mock("../api", () => ({
+  api: { GET: apiGet },
+  cityScope: () => (new URLSearchParams(window.location.search).get("city") ?? "").trim(),
+}));
+
+function installStatusDOM(): void {
+  document.body.innerHTML = `
+    <div class="scope-banner" id="scope-banner">
+      <div class="scope-info">
+        <span class="scope-title">Selected Scope</span>
+        <span id="scope-badge" class="badge badge-muted">Loading</span>
+      </div>
+      <div id="scope-status"></div>
+    </div>
+    <div id="status-banner"></div>
+  `;
+}
+
+function deferred<T>(): {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+} {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
+function ok(data: unknown): { data: unknown } {
+  return { data };
+}
+
+function flushPromises(): Promise<void> {
+  return new Promise((resolve) => {
+    setTimeout(resolve, 0);
+  });
+}
+
+function scopeStats(): Record<string, string> {
+  const stats: Record<string, string> = {};
+  document.querySelectorAll(".scope-stat").forEach((stat) => {
+    const label = stat.querySelector(".scope-stat-label")?.textContent ?? "";
+    const value = stat.querySelector(".scope-stat-value")?.textContent ?? "";
+    stats[label] = value;
+  });
+  return stats;
+}
+
+describe("status panel scope rendering", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    apiGet.mockReset();
+    installStatusDOM();
+    window.history.pushState({}, "", "/dashboard");
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("does not let a stale city status response overwrite supervisor scope", async () => {
+    window.history.pushState({}, "", "/dashboard?city=alpha");
+    document.getElementById("scope-badge")!.textContent = "Supervisor";
+    document.getElementById("scope-status")!.textContent = "Scope Fleet City Select one";
+
+    const cityStatus = deferred<{ data: unknown }>();
+    apiGet.mockImplementation((path: string) => {
+      if (path.includes("/status")) return cityStatus.promise;
+      if (path.includes("/sessions")) return Promise.resolve(ok({ items: [] }));
+      if (path.includes("/beads")) return Promise.resolve(ok({ items: [] }));
+      if (path.includes("/convoys")) return Promise.resolve(ok({ items: [] }));
+      return Promise.resolve(ok({}));
+    });
+
+    const { renderStatus } = await import("./status");
+    const render = renderStatus();
+    window.history.pushState({}, "", "/dashboard");
+    cityStatus.resolve(ok({
+      agents: { running: 2 },
+      mail: { unread: 0 },
+      work: { in_progress: 1, open: 28 },
+    }));
+    await render;
+
+    expect(document.getElementById("scope-badge")?.textContent).toBe("Supervisor");
+    expect(document.getElementById("scope-status")?.textContent).toContain("Fleet");
+  });
+
+  it("does not let a stale city session response overwrite supervisor scope", async () => {
+    window.history.pushState({}, "", "/dashboard?city=alpha");
+    document.getElementById("scope-badge")!.textContent = "Supervisor";
+    document.getElementById("scope-status")!.textContent = "Scope Fleet City Select one";
+
+    const sessions = deferred<{ data: unknown }>();
+    apiGet.mockImplementation((path: string) => {
+      if (path.includes("/status")) {
+        return Promise.resolve(ok({
+          agents: { running: 2 },
+          mail: { unread: 0 },
+          work: { in_progress: 1, open: 28 },
+        }));
+      }
+      if (path.includes("/sessions")) return sessions.promise;
+      if (path.includes("/beads")) return Promise.resolve(ok({ items: [] }));
+      if (path.includes("/convoys")) return Promise.resolve(ok({ items: [] }));
+      return Promise.resolve(ok({}));
+    });
+
+    const { renderStatus } = await import("./status");
+    const render = renderStatus();
+    window.history.pushState({}, "", "/dashboard");
+    sessions.resolve(ok({
+      items: [{
+        attached: false,
+        configured_named_session: true,
+        last_active: new Date().toISOString(),
+        running: true,
+        template: "control-dispatcher",
+      }],
+    }));
+    await render;
+
+    expect(document.getElementById("scope-badge")?.textContent).toBe("Supervisor");
+    expect(document.getElementById("scope-status")?.textContent).toContain("Fleet");
+  });
+
+  it("renders city scope as soon as sessions arrive even when status is still pending", async () => {
+    window.history.pushState({}, "", "/dashboard?city=alpha");
+    const now = new Date().toISOString();
+    const cityStatus = deferred<{ data: unknown }>();
+    apiGet.mockImplementation((path: string) => {
+      if (path.includes("/status")) return cityStatus.promise;
+      if (path.includes("/sessions")) {
+        return Promise.resolve(ok({
+          items: [{
+            attached: false,
+            configured_named_session: true,
+            last_active: now,
+            running: true,
+            template: "control-dispatcher",
+          }],
+        }));
+      }
+      if (path.includes("/beads")) return Promise.resolve(ok({ items: [] }));
+      if (path.includes("/convoys")) return Promise.resolve(ok({ items: [] }));
+      return Promise.resolve(ok({}));
+    });
+
+    const { renderStatus } = await import("./status");
+    const render = renderStatus();
+    await flushPromises();
+
+    expect(document.getElementById("scope-badge")?.textContent).toBe("City");
+    expect(scopeStats()).toMatchObject({
+      City: "alpha",
+      Session: "control-dispatcher",
+      Terminal: "Detached",
+      State: "Running",
+    });
+
+    cityStatus.resolve(ok({
+      agents: { running: 2 },
+      mail: { unread: 0 },
+      work: { in_progress: 1, open: 28 },
+    }));
+    await render;
+  });
+
+  it("finishes city status render with partial data when the aggregate status request times out", async () => {
+    vi.useFakeTimers();
+    window.history.pushState({}, "", "/dashboard?city=alpha");
+    const now = new Date().toISOString();
+    apiGet.mockImplementation((path: string) => {
+      if (path.includes("/status")) return new Promise(() => {});
+      if (path.includes("/sessions")) {
+        return Promise.resolve(ok({
+          items: [{
+            attached: false,
+            configured_named_session: true,
+            last_active: now,
+            running: true,
+            template: "control-dispatcher",
+          }],
+        }));
+      }
+      if (path.includes("/beads")) {
+        return Promise.resolve(ok({
+          items: [{
+            assignee: "agent-one",
+            id: "bd-1",
+            priority: 1,
+            status: "open",
+          }],
+        }));
+      }
+      if (path.includes("/convoys")) return Promise.resolve(ok({ items: [] }));
+      return Promise.resolve(ok({}));
+    });
+
+    const { renderStatus } = await import("./status");
+    const render = renderStatus();
+    await vi.advanceTimersByTimeAsync(1_000);
+    await render;
+
+    expect(document.getElementById("scope-badge")?.textContent).toBe("City");
+    expect(scopeStats().Terminal).toBe("Detached");
+    expect(document.getElementById("status-banner")?.textContent).toContain("Status API slow");
+    expect(document.getElementById("status-banner")?.textContent).toContain("1");
+  });
+
+  it("renders city scope from session data instead of leaving the placeholder idle", async () => {
+    window.history.pushState({}, "", "/dashboard?city=alpha");
+    const now = new Date().toISOString();
+    apiGet.mockImplementation((path: string) => {
+      if (path.includes("/status")) {
+        return Promise.resolve(ok({
+          agents: { running: 2 },
+          mail: { unread: 0 },
+          work: { in_progress: 1, open: 28 },
+        }));
+      }
+      if (path.includes("/sessions")) {
+        return Promise.resolve(ok({
+          items: [{
+            attached: false,
+            configured_named_session: true,
+            last_active: now,
+            running: true,
+            template: "control-dispatcher",
+          }],
+        }));
+      }
+      if (path.includes("/beads")) return Promise.resolve(ok({ items: [] }));
+      if (path.includes("/convoys")) return Promise.resolve(ok({ items: [] }));
+      return Promise.resolve(ok({}));
+    });
+
+    const { renderStatus } = await import("./status");
+    await renderStatus();
+
+    expect(document.getElementById("scope-badge")?.textContent).toBe("City");
+    expect(scopeStats()).toMatchObject({
+      City: "alpha",
+      Session: "control-dispatcher",
+      Terminal: "Detached",
+      State: "Running",
+    });
+  });
+
+  it("keeps terminal attachment separate from the city scope badge", async () => {
+    window.history.pushState({}, "", "/dashboard?city=alpha");
+    const now = new Date().toISOString();
+    apiGet.mockImplementation((path: string) => {
+      if (path.includes("/status")) {
+        return Promise.resolve(ok({
+          agents: { running: 1 },
+          mail: { unread: 0 },
+          work: { in_progress: 0, open: 0 },
+        }));
+      }
+      if (path.includes("/sessions")) {
+        return Promise.resolve(ok({
+          items: [{
+            attached: true,
+            configured_named_session: true,
+            last_active: now,
+            running: true,
+            template: "control-dispatcher",
+          }],
+        }));
+      }
+      if (path.includes("/beads")) return Promise.resolve(ok({ items: [] }));
+      if (path.includes("/convoys")) return Promise.resolve(ok({ items: [] }));
+      return Promise.resolve(ok({}));
+    });
+
+    const { renderStatus } = await import("./status");
+    await renderStatus();
+
+    expect(document.getElementById("scope-badge")?.textContent).toBe("City");
+    expect(scopeStats()).toMatchObject({
+      City: "alpha",
+      Session: "control-dispatcher",
+      Terminal: "Attached",
+      State: "Running",
+    });
+  });
+});
diff --git a/cmd/gc/dashboard/web/src/panels/status.ts b/cmd/gc/dashboard/web/src/panels/status.ts
index 07721f5387..1b746c58b3 100644
--- a/cmd/gc/dashboard/web/src/panels/status.ts
+++ b/cmd/gc/dashboard/web/src/panels/status.ts
@@ -1,15 +1,20 @@
-import { api, cityScope } from "../api";
+import { api, cityScope, type DashboardSchema } from "../api";
+import { logWarn } from "../logger";
+import { currentCityStatus, isKnownUnavailableCity } from "../state";
 import { byId, clear, el } from "../util/dom";
 import { ACTIVE_WINDOW_MS, beadPriority, formatTimestamp } from "../util/legacy";
 
-interface SessionSummary {
-  attached: boolean;
-  last_active?: string;
-  pool?: string;
-  rig?: string;
-  running: boolean;
-  template: string;
-}
+type APIResult<T> = {
+  data?: T;
+  error?: unknown;
+};
+
+type StatusBody = DashboardSchema["StatusBody"];
+type SessionList = DashboardSchema["ListBodySessionResponse"];
+type BeadList = DashboardSchema["ListBodyBead"];
+type SessionSummary = DashboardSchema["SessionResponse"];
+
+const STATUS_REQUEST_TIMEOUT_MS = 1_000;
 
 export async function renderStatus(): Promise<void> {
   const city = cityScope();
@@ -19,29 +24,57 @@ export async function renderStatus(): Promise<void> {
     await renderSupervisorStatus(banner);
     return;
   }
-  renderCityScopeBannerIdle();
 
-  const [statusR, sessionsR, beadsR, convoysR] = await Promise.all([
-    api.GET("/v0/city/{cityName}/status", { params: { path: { cityName: city } } }),
-    api.GET("/v0/city/{cityName}/sessions", {
+  const status = currentCityStatus();
+  if (isKnownUnavailableCity(status)) {
+    const reason = status.kind === "not-running"
+      ? (status.city.error ?? status.city.status ?? "City not running")
+      : "City unavailable";
+    renderCityScopeBannerUnavailable(city, "Sessions unavailable");
+    renderUnavailableCitySummary(banner, reason);
+    return;
+  }
+
+  const statusP = requestWithTimeout<StatusBody>(
+    "status",
+    city,
+    (signal) => api.GET("/v0/city/{cityName}/status", { params: { path: { cityName: city } }, signal }) as Promise<APIResult<StatusBody>>,
+  );
+  const sessionsP = requestWithTimeout<SessionList>(
+    "sessions",
+    city,
+    (signal) => api.GET("/v0/city/{cityName}/sessions", {
       params: { path: { cityName: city }, query: { state: "active", peek: true } },
-    }),
-    api.GET("/v0/city/{cityName}/beads", {
+      signal,
+    }) as Promise<APIResult<SessionList>>,
+  );
+  const beadsP = requestWithTimeout<BeadList>(
+    "beads",
+    city,
+    (signal) => api.GET("/v0/city/{cityName}/beads", {
       params: { path: { cityName: city }, query: { status: "open", limit: 500 } },
-    }),
-    api.GET("/v0/city/{cityName}/convoys", { params: { path: { cityName: city }, query: { limit: 200 } } }),
-  ]);
+      signal,
+    }) as Promise<APIResult<BeadList>>,
+  );
+  const convoysP = requestWithTimeout<BeadList>(
+    "convoys",
+    city,
+    (signal) => api.GET("/v0/city/{cityName}/convoys", {
+      params: { path: { cityName: city }, query: { limit: 200 } },
+      signal,
+    }) as Promise<APIResult<BeadList>>,
+  );
 
-  if (statusR.error || !statusR.data) {
-    clear(banner);
-    banner.append(el("div", { class: "banner-error" }, [`Status unavailable for ${city}`]));
-    return;
-  }
+  sessionsP.then((sessionsR) => renderCityScopeFromSessions(city, sessionsR));
+
+  const [statusR, sessionsR, beadsR, convoysR] = await Promise.all([statusP, sessionsP, beadsP, convoysP]);
+
+  if (cityScope() !== city) return;
 
   const sessions = (sessionsR.data?.items ?? []) as SessionSummary[];
   const beads = beadsR.data?.items ?? [];
   const convoys = convoysR.data?.items ?? [];
-  renderCityScopeBanner(city, sessions);
+  renderCityScopeFromSessions(city, sessionsR);
 
   // Generic "stuck" detection: any running, pooled agent whose last
   // activity is >30 min old. No role name required.
@@ -52,35 +85,101 @@ export async function renderStatus(): Promise<void> {
   const staleAssigned = beads.filter((bead) => bead.assignee && bead.status !== "closed").length;
   const highPriorityIssues = beads.filter((bead) => beadPriority(bead.priority) <= 2).length;
   const deadSessions = sessions.filter((session) => !session.running).length;
+  const statusUnavailable = Boolean(statusR.error || !statusR.data);
+  const partialUnavailable = statusUnavailable || Boolean(sessionsR.error || beadsR.error || convoysR.error);
+  const runningAgents = statusR.data?.agents.running ?? sessions.filter((session) => session.running).length;
+  const assignedWork = statusR.data?.work.in_progress ?? staleAssigned;
+  const openWork = statusR.data?.work.open ?? beads.length;
+  const unreadMail = statusR.data?.mail.unread ?? "n/a";
 
-  const stats = el("div", { class: "summary-stats" }, [
-    statChip(statusR.data.agents.running, "Agents"),
-    statChip(statusR.data.work.in_progress, "Assigned"),
-    statChip(statusR.data.work.open, "Beads"),
-    statChip(convoys.length, "Convoys"),
-    statChip(statusR.data.mail.unread, "Unread"),
-  ]);
+  const statsKey = `${city}|${runningAgents}|${assignedWork}|${openWork}|${convoys.length}|${unreadMail}|${stuckAgents}|${staleAssigned}|${highPriorityIssues}|${deadSessions}|${partialUnavailable}|${statusUnavailable}`;
+  if (statsKey !== lastStatusBannerKey) {
+    lastStatusBannerKey = statsKey;
+    const stats = el("div", { class: "summary-stats" }, [
+      statChip(runningAgents, "Agents"),
+      statChip(assignedWork, "Assigned"),
+      statChip(openWork, "Beads"),
+      statChip(convoys.length, "Convoys"),
+      statChip(unreadMail, "Unread"),
+    ]);
 
-  const alerts = el("div", { class: "summary-alerts" });
-  appendAlert(alerts, stuckAgents > 0, "alert-red", `${stuckAgents} stuck`);
-  appendAlert(alerts, staleAssigned > 0, "alert-yellow", `${staleAssigned} assigned`);
-  appendAlert(alerts, highPriorityIssues > 0, "alert-red", `${highPriorityIssues} P1/P2`);
-  appendAlert(alerts, deadSessions > 0, "alert-red", `${deadSessions} dead`);
-  if (!alerts.childNodes.length) {
-    alerts.append(el("span", { class: "alert-item alert-green" }, ["All clear"]));
+    const alerts = el("div", { class: "summary-alerts" });
+    appendAlert(alerts, statusUnavailable, "alert-yellow", "Status API slow");
+    appendAlert(alerts, partialUnavailable && !statusUnavailable, "alert-yellow", "Partial data");
+    appendAlert(alerts, stuckAgents > 0, "alert-red", `${stuckAgents} stuck`);
+    appendAlert(alerts, staleAssigned > 0, "alert-yellow", `${staleAssigned} assigned`);
+    appendAlert(alerts, highPriorityIssues > 0, "alert-red", `${highPriorityIssues} P1/P2`);
+    appendAlert(alerts, deadSessions > 0, "alert-red", `${deadSessions} dead`);
+    if (!alerts.childNodes.length) {
+      alerts.append(el("span", { class: "alert-item alert-green" }, ["All clear"]));
+    }
+
+    clear(banner);
+    banner.append(stats, alerts);
   }
+}
 
+function renderUnavailableCitySummary(banner: HTMLElement, reason: string): void {
+  lastStatusBannerKey = "";
   clear(banner);
+  const stats = el("div", { class: "summary-stats" }, [
+    statChip(0, "Agents"),
+    statChip(0, "Assigned"),
+    statChip(0, "Beads"),
+    statChip(0, "Convoys"),
+    statChip("n/a", "Unread"),
+  ]);
+  const alerts = el("div", { class: "summary-alerts" }, [
+    el("span", { class: "alert-item alert-yellow" }, [reason]),
+  ]);
   banner.append(stats, alerts);
 }
 
+async function requestWithTimeout<T>(
+  label: string,
+  city: string,
+  start: (signal: AbortSignal) => Promise<APIResult<T>>,
+): Promise<APIResult<T>> {
+  const controller = new AbortController();
+  let completed = false;
+  let timer: ReturnType<typeof setTimeout>;
+  return new Promise((resolve) => {
+    timer = setTimeout(() => {
+      if (completed) return;
+      completed = true;
+      const error = new Error(`${label} request timed out after ${STATUS_REQUEST_TIMEOUT_MS}ms`);
+      controller.abort();
+      logWarn("status", "City status dependency timed out", { city, label });
+      resolve({ error });
+    }, STATUS_REQUEST_TIMEOUT_MS);
+    start(controller.signal).then(
+      (value) => {
+        if (completed) return;
+        completed = true;
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error: unknown) => {
+        if (completed) return;
+        completed = true;
+        clearTimeout(timer);
+        logWarn("status", "City status dependency failed", { city, error, label });
+        resolve({ error });
+      },
+    );
+  });
+}
+
 async function renderSupervisorStatus(banner: HTMLElement): Promise<void> {
   renderCityScopeBannerFleet();
+  lastStatusBannerKey = "";
 
   const [healthR, citiesR] = await Promise.all([
     api.GET("/health"),
     api.GET("/v0/cities"),
   ]);
+  if (cityScope() !== "") return;
+
   const health = healthR.data;
   const cities = citiesR.data?.items ?? [];
   const total = health?.cities_total ?? cities.length;
@@ -130,59 +229,69 @@ function appendAlert(container: HTMLElement, show: boolean, klass: string, text:
   container.append(el("span", { class: `alert-item ${klass}` }, [text]));
 }
 
-// renderCityScopeBanner renders a generic "scope" banner that reports
-// whether any un-rigged, un-pooled session (the city-scope overseer, if
-// the pack defines one) is currently attached. The dashboard makes no
-// assumption about what that session is called — it just surfaces the
-// attached/detached state the API provides. Packs that don't define a
-// city-scope session show "Detached" and that's fine.
+let lastStatusBannerKey = "";
+
+function renderCityScopeFromSessions(city: string, sessionsR: APIResult<SessionList>): void {
+  if (cityScope() !== city) return;
+  if (sessionsR.error || !sessionsR.data) {
+    renderCityScopeBannerUnavailable(city, "Sessions unavailable");
+    return;
+  }
+  renderCityScopeBanner(city, (sessionsR.data.items ?? []) as SessionSummary[]);
+}
+
 function renderCityScopeBanner(city: string, sessions: SessionSummary[]): void {
   const banner = byId("scope-banner");
   const badge = byId("scope-badge");
   const status = byId("scope-status");
   if (!banner || !badge || !status) return;
 
-  const overseer = sessions.find((session) => !session.rig && !session.pool);
+  const overseer =
+    sessions.find((s) => s.configured_named_session && !s.rig) ??
+    sessions.find((s) => !s.rig && !s.pool);
+
   if (!overseer) {
-    banner.classList.remove("attached");
-    banner.classList.add("detached");
-    badge.className = "badge badge-muted";
-    badge.textContent = "Detached";
+    banner.classList.remove("attached", "detached");
+    badge.className = "badge badge-cyan";
+    badge.textContent = "City";
     clear(status);
     status.append(
-      scopeStat("Scope", city),
-      scopeStat("Overseer", "none"),
+      scopeStat("City", city),
+      scopeStat("Session", "none"),
     );
     return;
   }
 
   banner.classList.remove("attached", "detached");
-  banner.classList.add(overseer.attached ? "attached" : "detached");
-  badge.className = `badge ${overseer.attached ? "badge-green" : "badge-muted"}`;
-  badge.textContent = overseer.attached ? "Attached" : "Detached";
+  badge.className = "badge badge-cyan";
+  badge.textContent = "City";
   clear(status);
 
   const active = overseer.last_active
     ? Date.now() - new Date(overseer.last_active).getTime() < ACTIVE_WINDOW_MS
     : false;
   status.append(
-    scopeStat("Scope", city),
+    scopeStat("City", city),
     scopeStat("Session", overseer.template),
     scopeStat("Activity", overseer.last_active ? formatTimestamp(overseer.last_active) : "Unknown", active ? "active" : "idle"),
+    scopeStat("Terminal", overseer.attached ? "Attached" : "Detached"),
     scopeStat("State", overseer.running ? "Running" : "Stopped"),
   );
 }
 
-function renderCityScopeBannerIdle(): void {
+function renderCityScopeBannerUnavailable(city: string, reason: string): void {
   const banner = byId("scope-banner");
   const badge = byId("scope-badge");
   const status = byId("scope-status");
   if (!banner || !badge || !status) return;
-  banner.classList.remove("attached");
-  banner.classList.add("detached");
+  banner.classList.remove("attached", "detached");
   badge.className = "badge badge-muted";
-  badge.textContent = "Idle";
+  badge.textContent = "Unknown";
   clear(status);
+  status.append(
+    scopeStat("Scope", city),
+    scopeStat("Sessions", reason),
+  );
 }
 
 function renderCityScopeBannerFleet(): void {
@@ -190,8 +299,7 @@ function renderCityScopeBannerFleet(): void {
   const badge = byId("scope-badge");
   const status = byId("scope-status");
   if (!banner || !badge || !status) return;
-  banner.classList.remove("attached");
-  banner.classList.add("detached");
+  banner.classList.remove("attached", "detached");
   badge.className = "badge badge-muted";
   badge.textContent = "Supervisor";
   clear(status);
diff --git a/cmd/gc/dashboard/web/src/refresh_scheduler.test.ts b/cmd/gc/dashboard/web/src/refresh_scheduler.test.ts
new file mode 100644
index 0000000000..0440903ccf
--- /dev/null
+++ b/cmd/gc/dashboard/web/src/refresh_scheduler.test.ts
@@ -0,0 +1,97 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { createRefreshScheduler } from "./refresh_scheduler";
+
+describe("refresh scheduler", () => {
+  it("coalesces bursts into one refresh per debounce interval", async () => {
+    vi.useFakeTimers();
+    const run = vi.fn(() => Promise.resolve());
+    const scheduler = createRefreshScheduler({
+      delayMs: 1_000,
+      isPaused: () => false,
+      onError: () => undefined,
+      run,
+    });
+
+    scheduler.schedule();
+    scheduler.schedule();
+    scheduler.schedule();
+    await vi.advanceTimersByTimeAsync(999);
+    expect(run).not.toHaveBeenCalled();
+
+    await vi.advanceTimersByTimeAsync(1);
+    expect(run).toHaveBeenCalledTimes(1);
+
+    vi.useRealTimers();
+  });
+
+  it("runs one follow-up refresh when events arrive during an active refresh", async () => {
+    vi.useFakeTimers();
+    let finishFirst!: () => void;
+    const run = vi
+      .fn()
+      .mockImplementationOnce(() => new Promise<void>((resolve) => {
+        finishFirst = resolve;
+      }))
+      .mockResolvedValue(undefined);
+    const scheduler = createRefreshScheduler({
+      delayMs: 1_000,
+      isPaused: () => false,
+      onError: () => undefined,
+      run,
+    });
+
+    scheduler.schedule();
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(run).toHaveBeenCalledTimes(1);
+
+    scheduler.schedule();
+    scheduler.schedule();
+    finishFirst();
+    await Promise.resolve();
+    await vi.advanceTimersByTimeAsync(999);
+    expect(run).toHaveBeenCalledTimes(1);
+
+    await vi.advanceTimersByTimeAsync(1);
+    expect(run).toHaveBeenCalledTimes(2);
+
+    vi.useRealTimers();
+  });
+
+  it("respects a minimum interval between refresh starts during event storms", async () => {
+    vi.useFakeTimers();
+    let finishFirst!: () => void;
+    const run = vi
+      .fn()
+      .mockImplementationOnce(() => new Promise<void>((resolve) => {
+        finishFirst = resolve;
+      }))
+      .mockResolvedValue(undefined);
+    const scheduler = createRefreshScheduler({
+      delayMs: 1_000,
+      isPaused: () => false,
+      minIntervalMs: 10_000,
+      onError: () => undefined,
+      run,
+    });
+
+    scheduler.schedule();
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(run).toHaveBeenCalledTimes(1);
+
+    scheduler.schedule();
+    finishFirst();
+    await Promise.resolve();
+
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(run).toHaveBeenCalledTimes(1);
+
+    await vi.advanceTimersByTimeAsync(8_999);
+    expect(run).toHaveBeenCalledTimes(1);
+
+    await vi.advanceTimersByTimeAsync(1);
+    expect(run).toHaveBeenCalledTimes(2);
+
+    vi.useRealTimers();
+  });
+});
diff --git a/cmd/gc/dashboard/web/src/refresh_scheduler.ts b/cmd/gc/dashboard/web/src/refresh_scheduler.ts
new file mode 100644
index 0000000000..ca74f17f92
--- /dev/null
+++ b/cmd/gc/dashboard/web/src/refresh_scheduler.ts
@@ -0,0 +1,54 @@
+export interface RefreshScheduler {
+  schedule(): void;
+}
+
+interface RefreshSchedulerOptions {
+  delayMs: number;
+  isPaused: () => boolean;
+  minIntervalMs?: number;
+  onError: (error: unknown) => void;
+  run: () => Promise<void>;
+}
+
+export function createRefreshScheduler(options: RefreshSchedulerOptions): RefreshScheduler {
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let inFlight = false;
+  let lastStartedAt = 0;
+  let requestedDuringFlight = false;
+
+  async function flush(): Promise<void> {
+    timer = null;
+    if (options.isPaused()) return;
+    inFlight = true;
+    lastStartedAt = Date.now();
+    try {
+      await options.run();
+    } catch (error) {
+      options.onError(error);
+    } finally {
+      inFlight = false;
+    }
+    if (!requestedDuringFlight || options.isPaused()) {
+      requestedDuringFlight = false;
+      return;
+    }
+    requestedDuringFlight = false;
+    schedule();
+  }
+
+  function schedule(): void {
+    if (timer !== null) return;
+    if (inFlight) {
+      requestedDuringFlight = true;
+      return;
+    }
+    const minIntervalMs = options.minIntervalMs ?? 0;
+    const elapsedSinceStart = lastStartedAt > 0 ? Date.now() - lastStartedAt : Number.POSITIVE_INFINITY;
+    const intervalDelayMs = minIntervalMs > 0 ? Math.max(0, minIntervalMs - elapsedSinceStart) : 0;
+    timer = setTimeout(() => {
+      void flush();
+    }, Math.max(options.delayMs, intervalDelayMs));
+  }
+
+  return { schedule };
+}
diff --git a/cmd/gc/dashboard/web/src/sse.test.ts b/cmd/gc/dashboard/web/src/sse.test.ts
new file mode 100644
index 0000000000..07b9a411aa
--- /dev/null
+++ b/cmd/gc/dashboard/web/src/sse.test.ts
@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const streamEvents = vi.fn();
+const streamSupervisorEvents = vi.fn();
+
+vi.mock("./generated/client.gen", () => ({
+  client: {},
+}));
+
+vi.mock("./generated/sdk.gen", () => ({
+  streamEvents,
+  streamSession: vi.fn(),
+  streamSupervisorEvents,
+}));
+
+vi.mock("./ui", () => ({
+  reportUIError: vi.fn(),
+}));
+
+async function* quietStream(): AsyncGenerator<never> {
+  await new Promise(() => undefined);
+}
+
+describe("dashboard SSE status", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    streamEvents.mockReset();
+    streamSupervisorEvents.mockReset();
+  });
+
+  it("marks a quiet city event stream live after the connection opens", async () => {
+    streamEvents.mockResolvedValue({ stream: quietStream() });
+    const statuses: string[] = [];
+
+    const { connectCityEvents } = await import("./sse");
+    const handle = connectCityEvents("mc-city", () => undefined, {
+      onStatus: (status) => statuses.push(status),
+    });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    handle.close();
+    expect(statuses).toContain("connecting");
+    expect(statuses).toContain("live");
+  });
+
+  it("marks a quiet supervisor event stream live after the connection opens", async () => {
+    streamSupervisorEvents.mockResolvedValue({ stream: quietStream() });
+    const statuses: string[] = [];
+
+    const { connectEvents } = await import("./sse");
+    const handle = connectEvents(() => undefined, {
+      onStatus: (status) => statuses.push(status),
+    });
+    await Promise.resolve();
+    await Promise.resolve();
+
+    handle.close();
+    expect(statuses).toContain("connecting");
+    expect(statuses).toContain("live");
+  });
+});
diff --git a/cmd/gc/dashboard/web/src/sse.ts b/cmd/gc/dashboard/web/src/sse.ts
index 98995e3eae..c047d7b5f4 100644
--- a/cmd/gc/dashboard/web/src/sse.ts
+++ b/cmd/gc/dashboard/web/src/sse.ts
@@ -39,6 +39,8 @@ export interface SSEHandle {
 export type SSEStatus = "connecting" | "live" | "reconnecting";
 
 export interface SSEOptions {
+  afterCursor?: string;
+  afterSeq?: string;
   onStatus?: (status: SSEStatus) => void;
 }
 
@@ -136,6 +138,7 @@ export function connectEvents(
   opts?: SSEOptions,
 ): SSEHandle {
   const controller = new AbortController();
+  let afterCursor = opts?.afterCursor;
   opts?.onStatus?.("connecting");
   (async () => {
     let attempt = 0;
@@ -148,6 +151,7 @@ export function connectEvents(
       try {
         const { stream } = await streamSupervisorEvents({
           client,
+          query: afterCursor ? { after_cursor: afterCursor } : undefined,
           signal: controller.signal,
           onSseEvent: (frame) => {
             // Any frame = live connection; reset backoff and the
@@ -157,12 +161,16 @@ export function connectEvents(
             errorReported = false;
             opts?.onStatus?.("live");
             const eventName = frame.event ?? "tagged_event";
+            const id = frame.id !== undefined ? String(frame.id) : undefined;
+            if (id) {
+              afterCursor = id;
+            }
             if (eventName === "heartbeat") {
               if (!isHeartbeat(frame.data)) {
                 reportUIError("Invalid supervisor heartbeat frame", frame);
                 return;
               }
-              onEvent({ event: "heartbeat", id: frame.id, data: frame.data });
+              onEvent({ event: "heartbeat", id, data: frame.data });
               return;
             }
             if (eventName === "tagged_event") {
@@ -170,12 +178,13 @@ export function connectEvents(
                 reportUIError("Invalid supervisor event frame", frame);
                 return;
               }
-              onEvent({ event: "tagged_event", id: frame.id, data: frame.data });
+              onEvent({ event: "tagged_event", id, data: frame.data });
               return;
             }
             reportUIError(`Unexpected supervisor SSE event: ${eventName}`, frame);
           },
         });
+        opts?.onStatus?.("live");
         // Drain the underlying async generator so the reader keeps
         // pumping frames into onSseEvent. The values it yields are not
         // used — per-frame dispatch happens in the callback above.
@@ -215,6 +224,7 @@ export function connectCityEvents(
   opts?: SSEOptions,
 ): SSEHandle {
   const controller = new AbortController();
+  let afterSeq = opts?.afterSeq;
   opts?.onStatus?.("connecting");
   (async () => {
     let attempt = 0;
@@ -223,34 +233,39 @@ export function connectCityEvents(
     while (!controller.signal.aborted) {
       try {
         const { stream } = await streamEvents({
-        client,
-        path: { cityName: city },
-        signal: controller.signal,
-        onSseEvent: (frame) => {
-          attempt = 0;
-          errorReported = false;
-          opts?.onStatus?.("live");
-          const eventName = frame.event ?? "event";
-          const id = frame.id !== undefined ? String(frame.id) : undefined;
-          if (eventName === "heartbeat") {
-            if (!isHeartbeat(frame.data)) {
-              reportUIError("Invalid city heartbeat frame", frame);
+          client,
+          path: { cityName: city },
+          query: afterSeq ? { after_seq: afterSeq } : undefined,
+          signal: controller.signal,
+          onSseEvent: (frame) => {
+            attempt = 0;
+            errorReported = false;
+            opts?.onStatus?.("live");
+            const eventName = frame.event ?? "event";
+            const id = frame.id !== undefined ? String(frame.id) : undefined;
+            if (id) {
+              afterSeq = id;
+            }
+            if (eventName === "heartbeat") {
+              if (!isHeartbeat(frame.data)) {
+                reportUIError("Invalid city heartbeat frame", frame);
+                return;
+              }
+              onEvent({ event: "heartbeat", id, data: frame.data });
               return;
             }
-            onEvent({ event: "heartbeat", id, data: frame.data });
-            return;
-          }
-          if (eventName === "event") {
-            if (!isCityEventEnvelope(frame.data)) {
-              reportUIError("Invalid city event frame", frame);
+            if (eventName === "event") {
+              if (!isCityEventEnvelope(frame.data)) {
+                reportUIError("Invalid city event frame", frame);
+                return;
+              }
+              onEvent({ event: "event", id, data: frame.data });
               return;
             }
-            onEvent({ event: "event", id, data: frame.data });
-            return;
-          }
-          reportUIError(`Unexpected city SSE event: ${eventName}`, frame);
-        },
-      });
+            reportUIError(`Unexpected city SSE event: ${eventName}`, frame);
+          },
+        });
+        opts?.onStatus?.("live");
         for await (const _ of stream) {
           void _;
         }
diff --git a/cmd/gc/dashboard/web/src/state.test.ts b/cmd/gc/dashboard/web/src/state.test.ts
new file mode 100644
index 0000000000..e01dbbf41a
--- /dev/null
+++ b/cmd/gc/dashboard/web/src/state.test.ts
@@ -0,0 +1,37 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("dashboard state invalidation", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    window.history.pushState({}, "", "/dashboard?city=mc-city");
+  });
+
+  it("keeps city bead refresh scoped to status and issues", async () => {
+    const { consumeInvalidated, invalidateForEventType } = await import("./state");
+    consumeInvalidated();
+
+    invalidateForEventType("bead.updated");
+
+    expect([...consumeInvalidated()].sort()).toEqual(["issues", "status"]);
+  });
+
+  it("does not refresh supervisor resources for city-scoped bead events", async () => {
+    window.history.pushState({}, "", "/dashboard");
+    const { consumeInvalidated, invalidateForEventType, syncCityScopeFromLocation } = await import("./state");
+    syncCityScopeFromLocation();
+    consumeInvalidated();
+
+    expect(invalidateForEventType("bead.updated")).toBe(false);
+
+    expect([...consumeInvalidated()]).toEqual([]);
+  });
+
+  it("keeps session refresh scoped to status, crew, and options", async () => {
+    const { consumeInvalidated, invalidateForEventType } = await import("./state");
+    consumeInvalidated();
+
+    invalidateForEventType("session.updated");
+
+    expect([...consumeInvalidated()].sort()).toEqual(["crew", "options", "status"]);
+  });
+});
diff --git a/cmd/gc/dashboard/web/src/state.ts b/cmd/gc/dashboard/web/src/state.ts
index 420ed298ed..c6ebe0dc8c 100644
--- a/cmd/gc/dashboard/web/src/state.ts
+++ b/cmd/gc/dashboard/web/src/state.ts
@@ -45,6 +45,7 @@ const CITY_SCOPED_RESOURCES: DashboardResource[] = [
 
 let currentCity = readCityScope(window.location.search);
 let cachedCities: CityInfoSummary[] = [];
+let cachedCitiesKnown = false;
 const invalidated = new Set<DashboardResource>(ALL_RESOURCES);
 
 export function cityScope(): string {
@@ -85,6 +86,7 @@ export function consumeInvalidated(force = false): Set<DashboardResource> {
 }
 
 export function setCachedCities(cities: CityInfoSummary[]): void {
+  cachedCitiesKnown = true;
   cachedCities = cities.map((city) => ({
     error: city.error,
     name: city.name,
@@ -95,6 +97,10 @@ export function setCachedCities(cities: CityInfoSummary[]): void {
   }));
 }
 
+export function markCachedCitiesUnknown(): void {
+  cachedCitiesKnown = false;
+}
+
 export function getCachedCities(): CityInfoSummary[] {
   return cachedCities.map((city) => ({
     error: city.error,
@@ -120,37 +126,55 @@ export type CurrentCityStatus =
 export function currentCityStatus(): CurrentCityStatus {
   const name = currentCity;
   if (name === "") return { kind: "supervisor" };
+  if (!cachedCitiesKnown) return { kind: "unknown", name };
   const city = cachedCities.find((c) => c.name === name);
   if (!city) return { kind: "unknown", name };
   return city.running ? { kind: "running", city } : { kind: "not-running", city };
 }
 
-export function invalidateForEventType(type: string): void {
-  if (!type) return;
+export function canFetchCityScopedResources(status: CurrentCityStatus = currentCityStatus()): boolean {
+  if (status.kind === "running") return true;
+  if (status.kind === "unknown") return !cachedCitiesKnown;
+  return false;
+}
+
+export function isKnownUnavailableCity(status: CurrentCityStatus = currentCityStatus()): boolean {
+  return status.kind === "not-running" || (status.kind === "unknown" && cachedCitiesKnown);
+}
+
+export function invalidateForEventType(type: string): boolean {
+  if (!type) return false;
+  const hasCityScope = currentCity !== "";
   if (type.startsWith("session.") || type.startsWith("agent.")) {
+    if (!hasCityScope) return false;
     invalidate("status", "crew", "options");
-    return;
+    return true;
   }
   if (type.startsWith("bead.")) {
-    invalidate("status", "issues", "convoys", "admin", "options");
-    return;
+    if (!hasCityScope) return false;
+    invalidate("status", "issues");
+    return true;
   }
   if (type.startsWith("mail.")) {
-    invalidate("status", "mail", "options");
-    return;
+    if (!hasCityScope) return false;
+    invalidate("status", "mail");
+    return true;
   }
   if (type.startsWith("convoy.")) {
+    if (!hasCityScope) return false;
     invalidate("status", "convoys");
-    return;
+    return true;
   }
-  if (type.startsWith("city.")) {
+  if (type.startsWith("city.") || type.startsWith("request.result.") || type === "request.failed") {
     invalidate("cities", "status", "supervisor");
-    return;
+    return true;
   }
   if (type.startsWith("service.") || type.startsWith("provider.") || type.startsWith("rig.")) {
+    if (!hasCityScope) return false;
     invalidate("admin");
-    return;
+    return true;
   }
+  return false;
 }
 
 function readCityScope(search: string): string {
diff --git a/cmd/gc/dashboard/web/src/util/legacy.ts b/cmd/gc/dashboard/web/src/util/legacy.ts
index ad2140e074..fc284b2eb1 100644
--- a/cmd/gc/dashboard/web/src/util/legacy.ts
+++ b/cmd/gc/dashboard/web/src/util/legacy.ts
@@ -60,6 +60,7 @@ export function eventCategory(eventType: string): string {
     return "work";
   }
   if (eventType.startsWith("mail.")) return "comms";
+  if (eventType.startsWith("request.result.") || eventType === "request.failed") return "system";
   return "system";
 }
 
@@ -82,7 +83,9 @@ export function eventIcon(eventType: string): string {
     "convoy.closed": "✅",
     "mail.delivered": "📬",
     "mail.read": "📨",
+    "request.failed": "❌",
   };
+  if (eventType.startsWith("request.result.")) return "🔔";
   return icons[eventType] ?? "📋";
 }
 
@@ -118,7 +121,11 @@ export function eventSummary(
       return `${shortActor} created convoy ${subject ?? ""}`.trim();
     case "convoy.closed":
       return `${shortActor} closed convoy ${subject ?? ""}`.trim();
+    case "request.failed":
+      return message ?? `${subject ?? "request"} failed`;
     default:
+      if (eventType.startsWith("request.result."))
+        return message ?? `${subject ?? "request"} succeeded`;
       return message ?? subject ?? eventType;
   }
 }
diff --git a/cmd/gc/dispatch_runtime.go b/cmd/gc/dispatch_runtime.go
index 0d32e31af4..491b04ed22 100644
--- a/cmd/gc/dispatch_runtime.go
+++ b/cmd/gc/dispatch_runtime.go
@@ -7,14 +7,18 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/dispatch"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/formula"
+	"github.com/gastownhall/gascity/internal/shellquote"
 	"github.com/gastownhall/gascity/internal/sling"
 )
 
@@ -38,7 +42,6 @@ func controlDispatcherBinding(store beads.Store, cityName string, cfg *config.Ci
 		Store:    store,
 		Cfg:      cfg,
 		Resolver: cliAgentResolver{},
-		Stderr:   os.Stderr,
 	}
 	return sling.ControlDispatcherBinding(store, cityName, cfg, rigContext, deps)
 }
@@ -58,14 +61,13 @@ func applyGraphRouting(recipe *formula.Recipe, a *config.Agent, routedTo string,
 		Cfg:                   cfg,
 		Resolver:              cliAgentResolver{},
 		DirectSessionResolver: cliDirectSessionResolver,
-		Stderr:                os.Stderr,
 	}
 	return sling.ApplyGraphRouting(recipe, a, routedTo, vars, sourceBeadID, scopeKind, scopeRef, storeRef, store, cityName, cfg, deps)
 }
 
 var (
 	workflowServeList               = nextWorkflowServeBeads
-	controlDispatcherServe          = runControlDispatcher
+	controlDispatcherServe          = runControlDispatcherInStore
 	workflowServeOpenEventsProvider = func(stderr io.Writer) (events.Provider, error) {
 		ep, code := openCityEventsProvider(stderr, "gc convoy control --serve")
 		if ep == nil {
@@ -78,6 +80,26 @@ var (
 	workflowServeWakeSweepInterval = 1 * time.Second
 	workflowServeMaxIdleSleep      = 30 * time.Second
 	workflowServeWaitForWake       = waitForRelevantWorkflowWakeWithTrace
+	workflowTraceNow               = time.Now
+	// The trace helper is intentionally process-global because workflowTracef
+	// does not carry per-invocation context. Nested installs (serve ->
+	// runControlDispatcherWithStore) reuse the active dedup map so one bad trace
+	// path warns once per command invocation instead of once per control bead.
+	// The newest installed scope owns the active writer; the most recent scope
+	// for a given writer reuses that writer's dedupe map, and out-of-order
+	// restores reactivate the newest remaining scope instead of panicking.
+	// This assumes top-level callers are nested, not concurrently active from
+	// separate goroutines in the same process.
+	workflowTraceWarnings = struct {
+		mu     sync.Mutex
+		writer io.Writer
+		warned map[string]struct{}
+		scopes []workflowTraceWarningScope
+		nextID uint64
+	}{
+		writer: os.Stderr,
+		warned: map[string]struct{}{},
+	}
 )
 
 // followSleepDuration returns the sleep interval the --follow loop should use
@@ -120,6 +142,12 @@ type hookBead struct {
 	Metadata hookBeadMetadata `json:"metadata"`
 }
 
+type workflowTraceWarningScope struct {
+	id     uint64
+	writer io.Writer
+	warned map[string]struct{}
+}
+
 // hookBeadMetadata handles metadata where values may be JSON strings,
 // numbers, or booleans (bd writes numbers for numeric-looking values).
 // Normalizes everything to strings on unmarshal.
@@ -145,18 +173,109 @@ func (m *hookBeadMetadata) UnmarshalJSON(data []byte) error {
 
 func workflowTracef(format string, args ...any) {
 	path := strings.TrimSpace(os.Getenv("GC_WORKFLOW_TRACE"))
+	if path == "" {
+		path = strings.TrimSpace(os.Getenv("GC_SLING_TRACE"))
+	}
 	if path == "" {
 		return
 	}
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
 	if err != nil {
+		workflowTraceWarnOpenFailure(path, err)
 		return
 	}
-	defer f.Close()                                                                                //nolint:errcheck // best-effort trace log
-	fmt.Fprintf(f, "%s %s\n", time.Now().UTC().Format(time.RFC3339), fmt.Sprintf(format, args...)) //nolint:errcheck
+	defer f.Close()                                                                                            //nolint:errcheck // best-effort trace log
+	fmt.Fprintf(f, "%s %s\n", workflowTraceNow().UTC().Format(time.RFC3339Nano), fmt.Sprintf(format, args...)) //nolint:errcheck
+}
+
+func workflowTraceWarnOpenFailure(path string, err error) {
+	if strings.TrimSpace(path) == "" || err == nil {
+		return
+	}
+	workflowTraceWarnings.mu.Lock()
+	writer := workflowTraceWarnings.writer
+	workflowTraceWarnings.mu.Unlock()
+	workflowTraceWarnf(writer, "trace-open:"+normalizePathForCompare(path), "gc convoy control --serve: warning: opening workflow trace %q: %v\n", path, err)
+}
+
+func workflowTraceWarnf(writer io.Writer, dedupeKey, format string, args ...any) {
+	if writer == nil {
+		return
+	}
+	workflowTraceWarnings.mu.Lock()
+	warned := workflowTraceWarnings.warned
+	if workflowTraceWarnings.writer != writer || warned == nil {
+		warned = nil
+		for i := len(workflowTraceWarnings.scopes) - 1; i >= 0; i-- {
+			if workflowTraceWarnings.scopes[i].writer == writer {
+				warned = workflowTraceWarnings.scopes[i].warned
+				break
+			}
+		}
+	}
+	if warned != nil {
+		if _, alreadyWarned := warned[dedupeKey]; alreadyWarned {
+			workflowTraceWarnings.mu.Unlock()
+			return
+		}
+		warned[dedupeKey] = struct{}{}
+	}
+	workflowTraceWarnings.mu.Unlock()
+	fmt.Fprintf(writer, format, args...) //nolint:errcheck // best-effort stderr
+}
+
+// useWorkflowTraceWarnings installs a per-command warning sink. Nested callers
+// that share a writer reuse the same dedupe map so a single command invocation
+// warns once per path. Restores may arrive out of order; the newest remaining
+// scope stays active so helper reuse cannot panic the process.
+func useWorkflowTraceWarnings(writer io.Writer) func() {
+	workflowTraceWarnings.mu.Lock()
+	workflowTraceWarnings.nextID++
+	restoreID := workflowTraceWarnings.nextID
+	warned := map[string]struct{}{}
+	for i := len(workflowTraceWarnings.scopes) - 1; i >= 0; i-- {
+		if workflowTraceWarnings.scopes[i].writer == writer {
+			warned = workflowTraceWarnings.scopes[i].warned
+			break
+		}
+	}
+	workflowTraceWarnings.scopes = append(workflowTraceWarnings.scopes, workflowTraceWarningScope{
+		id:     restoreID,
+		writer: writer,
+		warned: warned,
+	})
+	workflowTraceWarnings.writer = writer
+	workflowTraceWarnings.warned = warned
+	workflowTraceWarnings.mu.Unlock()
+	return func() {
+		workflowTraceWarnings.mu.Lock()
+		defer workflowTraceWarnings.mu.Unlock()
+		restoreIdx := -1
+		for i := len(workflowTraceWarnings.scopes) - 1; i >= 0; i-- {
+			if workflowTraceWarnings.scopes[i].id == restoreID {
+				restoreIdx = i
+				break
+			}
+		}
+		if restoreIdx < 0 {
+			return
+		}
+		workflowTraceWarnings.scopes = append(workflowTraceWarnings.scopes[:restoreIdx], workflowTraceWarnings.scopes[restoreIdx+1:]...)
+		if n := len(workflowTraceWarnings.scopes); n > 0 {
+			top := workflowTraceWarnings.scopes[n-1]
+			workflowTraceWarnings.writer = top.writer
+			workflowTraceWarnings.warned = top.warned
+			return
+		}
+		workflowTraceWarnings.writer = os.Stderr
+		workflowTraceWarnings.warned = map[string]struct{}{}
+	}
 }
 
 func runWorkflowServe(agentName string, follow bool, _ io.Writer, stderr io.Writer) error {
+	restoreTraceWarnings := useWorkflowTraceWarnings(stderr)
+	defer restoreTraceWarnings()
+
 	cityPath, err := resolveCity()
 	if err != nil {
 		return err
@@ -165,6 +284,8 @@ func runWorkflowServe(agentName string, follow bool, _ io.Writer, stderr io.Writ
 	if err != nil {
 		return err
 	}
+	resolveRigPaths(cityPath, cfg.Rigs)
+	warnLegacyWorkflowTracePath(cityPath, cfg.Rigs, stderr)
 	if agentName == "" {
 		agentName = os.Getenv("GC_ALIAS")
 	}
@@ -188,16 +309,94 @@ func runWorkflowServe(agentName string, follow bool, _ io.Writer, stderr io.Writ
 	}
 	workDir := agentCommandDir(cityPath, &agentCfg, cfg.Rigs)
 	workEnv := controllerWorkQueryEnv(cityPath, cfg, &agentCfg)
+	cityName := loadedCityName(cfg, cityPath)
 	// Expand {{.Rig}}/{{.AgentBase}} once so the long-poll drain reuses the
 	// rig-scoped command instead of passing the literal template to the shell
 	// on every iteration. #793.
-	workQuery := expandAgentCommandTemplate(cityPath, loadedCityName(cfg, cityPath), &agentCfg, cfg.Rigs, "work_query", agentCfg.EffectiveWorkQuery(), stderr)
+	workQuery := expandAgentCommandTemplate(cityPath, cityName, &agentCfg, cfg.Rigs, "work_query", agentCfg.EffectiveWorkQuery(), stderr)
+	if agentCfg.WorkQuery == "" && isWorkflowServeControlDispatcherAgent(agentCfg) {
+		workQuery = workflowServeControlReadyQuery(agentCfg, config.NamedSessionRuntimeName(cityName, cfg.Workspace, agentCfg.QualifiedName()))
+	}
 	workflowTracef("serve start agent=%s city=%s dir=%s", agentCfg.QualifiedName(), cityPath, workDir)
 	if !follow {
-		_, err := drainWorkflowServeWork(agentCfg, workQuery, workDir, workEnv, stderr)
+		_, err := drainWorkflowServeWork(agentCfg, cityPath, workDir, workQuery, workEnv, stderr)
 		return err
 	}
-	return runWorkflowServeFollow(agentCfg, workQuery, workDir, workEnv, stderr)
+	return runWorkflowServeFollow(agentCfg, cityPath, workDir, workQuery, workEnv, stderr)
+}
+
+func legacyWorkflowTracePaths(cityPath string, rigs []config.Rig) []string {
+	paths := make([]string, 0, len(rigs)+1)
+	seen := make(map[string]struct{}, len(rigs)+1)
+	appendTracePath := func(root string) {
+		root = strings.TrimSpace(root)
+		if root == "" || !pathIsWithin(cityPath, root) {
+			return
+		}
+		tracePath := filepath.Join(root, "control-dispatcher-trace.log")
+		normalized := normalizePathForCompare(tracePath)
+		if normalized == "" {
+			return
+		}
+		if _, exists := seen[normalized]; exists {
+			return
+		}
+		seen[normalized] = struct{}{}
+		paths = append(paths, tracePath)
+	}
+
+	appendTracePath(cityPath)
+	for _, rig := range rigs {
+		appendTracePath(rig.Path)
+	}
+	appendTracePath(os.Getenv("GC_RIG_ROOT"))
+	return paths
+}
+
+func warnLegacyWorkflowTracePath(cityPath string, rigs []config.Rig, stderr io.Writer) {
+	if stderr == nil {
+		return
+	}
+	legacyTracePaths := legacyWorkflowTracePaths(cityPath, rigs)
+	nextTracePath := strings.TrimSpace(os.Getenv("GC_CONTROL_DISPATCHER_TRACE_DEFAULT"))
+	if nextTracePath == "" {
+		nextTracePath = citylayout.ControlDispatcherTraceDefaultPath(cityPath)
+	}
+	current := strings.TrimSpace(os.Getenv("GC_WORKFLOW_TRACE"))
+	if current != "" {
+		for _, legacyTracePath := range legacyTracePaths {
+			if samePath(current, legacyTracePath) {
+				workflowTraceWarnf(
+					stderr,
+					"legacy-trace-path:"+normalizePathForCompare(current),
+					"gc convoy control --serve: warning: legacy control-dispatcher trace path %q matches a watcher-visible legacy location; change or unset GC_WORKFLOW_TRACE so this session adopts %q, or restart/recycle the session if this value was inherited before the upgrade\n",
+					current,
+					nextTracePath,
+				)
+				return
+			}
+		}
+	}
+	activeTracePath := current
+	if activeTracePath == "" {
+		activeTracePath = nextTracePath
+	}
+	for _, legacyTracePath := range legacyTracePaths {
+		if samePath(activeTracePath, legacyTracePath) {
+			continue
+		}
+		info, err := os.Stat(legacyTracePath)
+		if err != nil || info.IsDir() {
+			continue
+		}
+		workflowTraceWarnf(
+			stderr,
+			"legacy-trace-file:"+normalizePathForCompare(legacyTracePath),
+			"gc convoy control --serve: warning: legacy control-dispatcher trace file %q still exists; writes to it can wake the city watcher. If it is still growing, restart or recycle the control-dispatcher session so it adopts %q.\n",
+			legacyTracePath,
+			nextTracePath,
+		)
+	}
 }
 
 type workflowServeDrainResult struct {
@@ -209,11 +408,11 @@ type workflowServeDrainResult struct {
 // for a single invocation. Returns whether it advanced a control bead and
 // whether the queue still contains only pending work so the --follow caller
 // can distinguish blocked work from genuine idle.
-func drainWorkflowServeWork(agentCfg config.Agent, workQuery string, workDir string, workEnv map[string]string, stderr io.Writer) (workflowServeDrainResult, error) {
+func drainWorkflowServeWork(agentCfg config.Agent, cityPath, storePath, workQuery string, workEnv map[string]string, stderr io.Writer) (workflowServeDrainResult, error) {
 	result := workflowServeDrainResult{}
 	idlePolls := 0
 	for {
-		queue, err := workflowServeList(workflowServeQuery(workQuery), workDir, workEnv)
+		queue, err := workflowServeList(workflowServeWorkQuery(agentCfg, workQuery), storePath, workEnv)
 		if err != nil {
 			workflowTracef("serve query-error agent=%s err=%v", agentCfg.QualifiedName(), err)
 			return result, fmt.Errorf("querying control work for %s: %w", agentCfg.QualifiedName(), err)
@@ -231,6 +430,7 @@ func drainWorkflowServeWork(agentCfg config.Agent, workQuery string, workDir str
 		idlePolls = 0
 		processedThisCycle := false
 		pendingCount := 0
+		legacyOversizedCount := 0
 		for _, candidate := range queue {
 			beadID := candidate.ID
 			kind := strings.TrimSpace(candidate.Metadata["gc.kind"])
@@ -238,7 +438,7 @@ func drainWorkflowServeWork(agentCfg config.Agent, workQuery string, workDir str
 				workflowTracef("serve unexpected-kind bead=%s kind=%s", beadID, kind)
 				return result, fmt.Errorf("bead %s has unexpected non-control kind %q", beadID, kind)
 			}
-			workflowTracef("serve process bead=%s kind=%s", beadID, kind)
+			workflowTracef("serve process bead=%s kind=%s store=%s", beadID, kind, storePath)
 			// controlDispatcherServe currently returns nil both when it
 			// successfully advanced a control bead AND when ProcessControl
 			// chose to no-op (e.g., status != "open"). The caller cannot
@@ -248,7 +448,7 @@ func drainWorkflowServeWork(agentCfg config.Agent, workQuery string, workDir str
 			// control ga-fw2fm. The silent no-op now emits a separate
 			// `process-control ... skip reason=bead_not_open` line inside
 			// ProcessControl itself; see runtime.go.
-			if err := controlDispatcherServe(beadID, io.Discard, stderr); err != nil {
+			if err := controlDispatcherServe(cityPath, storePath, beadID, io.Discard, stderr); err != nil {
 				if errors.Is(err, dispatch.ErrControlPending) {
 					pendingCount++
 					result.pendingAny = true
@@ -256,12 +456,15 @@ func drainWorkflowServeWork(agentCfg config.Agent, workQuery string, workDir str
 					continue
 				}
 				workflowTracef("serve process-error bead=%s kind=%s err=%v", beadID, kind, err)
+				if isLegacyOversizedControlEventError(err) {
+					legacyOversizedCount++
+					continue
+				}
 				return result, fmt.Errorf("processing control bead %s: %w", beadID, err)
 			}
 			workflowTracef("serve processed bead=%s kind=%s", beadID, kind)
 			result.processedAny = true
 			processedThisCycle = true
-			break
 		}
 		if processedThisCycle {
 			continue
@@ -270,10 +473,24 @@ func drainWorkflowServeWork(agentCfg config.Agent, workQuery string, workDir str
 			workflowTracef("serve pending-queue agent=%s count=%d", agentCfg.QualifiedName(), pendingCount)
 			return result, nil
 		}
+		if legacyOversizedCount > 0 {
+			workflowTracef("serve legacy-oversized-queue agent=%s count=%d", agentCfg.QualifiedName(), legacyOversizedCount)
+			return result, nil
+		}
+	}
+}
+
+func isLegacyOversizedControlEventError(err error) bool {
+	if err == nil {
+		return false
 	}
+	msg := err.Error()
+	return strings.Contains(msg, "recording attempt log") &&
+		strings.Contains(msg, "old_value") &&
+		strings.Contains(msg, "too large")
 }
 
-func runWorkflowServeFollow(agentCfg config.Agent, workQuery string, workDir string, workEnv map[string]string, stderr io.Writer) error {
+func runWorkflowServeFollow(agentCfg config.Agent, cityPath, storePath, workQuery string, workEnv map[string]string, stderr io.Writer) error {
 	ep, err := workflowServeOpenEventsProvider(stderr)
 	if err != nil {
 		return err
@@ -297,7 +514,7 @@ func runWorkflowServeFollow(agentCfg config.Agent, workQuery string, workDir str
 
 	idleSweeps := 0
 	for {
-		drainResult, err := drainWorkflowServeWork(agentCfg, workQuery, workDir, workEnv, stderr)
+		drainResult, err := drainWorkflowServeWork(agentCfg, cityPath, storePath, workQuery, workEnv, stderr)
 		if err != nil {
 			return err
 		}
@@ -401,6 +618,74 @@ func workflowServeQuery(workQuery string) string {
 	return workQuery
 }
 
+func workflowServeWorkQuery(agentCfg config.Agent, expandedWorkQuery ...string) string {
+	if len(expandedWorkQuery) > 0 {
+		return workflowServeQuery(expandedWorkQuery[0])
+	}
+	if agentCfg.WorkQuery == "" && isWorkflowServeControlDispatcherAgent(agentCfg) {
+		return workflowServeControlReadyQuery(agentCfg)
+	}
+	workQuery := agentCfg.EffectiveWorkQuery()
+	return workflowServeQuery(workQuery)
+}
+
+func isWorkflowServeControlDispatcherAgent(agentCfg config.Agent) bool {
+	qualified := strings.TrimSpace(agentCfg.QualifiedName())
+	return qualified == config.ControlDispatcherAgentName ||
+		strings.HasSuffix(qualified, "/"+config.ControlDispatcherAgentName)
+}
+
+func workflowServeControlReadyQuery(agentCfg config.Agent, controlSessionNames ...string) string {
+	target := strings.TrimSpace(agentCfg.QualifiedName())
+	if target == "" {
+		target = config.ControlDispatcherAgentName
+	}
+	limit := fmt.Sprintf("%d", workflowServeScanLimit)
+	queryPrefix := `BD_EXPORT_AUTO=false GC_CONTROL_TARGET=` + shellquote.Quote(target)
+	for _, name := range controlSessionNames {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		queryPrefix += ` GC_CONTROL_SESSION_NAME=` + shellquote.Quote(name)
+		break
+	}
+	if legacy := workflowServeLegacyControlRoute(target); legacy != "" {
+		queryPrefix += ` GC_CONTROL_LEGACY_TARGET=` + shellquote.Quote(legacy)
+	}
+	query := queryPrefix + ` sh -c '` +
+		`tmp=$(mktemp); trap "rm -f \"$tmp\"" EXIT; ` +
+		`emit_ready() { r=$("$@" 2>/dev/null || true); [ -n "$r" ] && [ "$r" != "[]" ] && printf "%s\n" "$r" >> "$tmp"; }; ` +
+		`for id in "$GC_CONTROL_SESSION_NAME" "$GC_SESSION_NAME" "$GC_ALIAS" "$GC_CONTROL_TARGET" "$GC_SESSION_ID"; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`legacy=""; case "$id" in *control-dispatcher) legacy="${id%control-dispatcher}workflow-control";; esac; ` +
+		`for cand in "$id" "$legacy"; do ` +
+		`[ -z "$cand" ] && continue; ` +
+		`emit_ready bd --readonly --sandbox ready --assignee="$cand" --json --limit=` + limit + `; ` +
+		`done; ` +
+		`done; ` +
+		`emit_ready bd --readonly --sandbox ready --metadata-field "gc.routed_to=$GC_CONTROL_TARGET" --unassigned --json --limit=` + limit + `; `
+	if legacy := workflowServeLegacyControlRoute(target); legacy != "" {
+		query += `emit_ready bd --readonly --sandbox ready --metadata-field "gc.routed_to=$GC_CONTROL_LEGACY_TARGET" --unassigned --json --limit=` + limit + `; `
+	} else {
+		query += `:; `
+	}
+	query += `[ -s "$tmp" ] && jq -s "reduce add[] as \$item ([]; if any(.[]; .id == \$item.id) then . else . + [\$item] end)" "$tmp" || printf "[]"` + `'`
+	return query
+}
+
+func workflowServeLegacyControlRoute(target string) string {
+	target = strings.TrimSpace(target)
+	if target == config.ControlDispatcherAgentName {
+		return "workflow-control"
+	}
+	const suffix = "/" + config.ControlDispatcherAgentName
+	if strings.HasSuffix(target, suffix) {
+		return strings.TrimSuffix(target, suffix) + "/workflow-control"
+	}
+	return ""
+}
+
 func nextWorkflowServeBeads(workQuery, dir string, env map[string]string) ([]hookBead, error) {
 	if workQuery == "" {
 		return nil, nil
diff --git a/cmd/gc/doctor_routed_to_checks.go b/cmd/gc/doctor_routed_to_checks.go
new file mode 100644
index 0000000000..46e308862a
--- /dev/null
+++ b/cmd/gc/doctor_routed_to_checks.go
@@ -0,0 +1,194 @@
+package main
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/doctor"
+)
+
+type v2RoutedToNamespaceCheck struct {
+	cfg      *config.City
+	cityPath string
+	newStore func(string) (beads.Store, error)
+}
+
+func newV2RoutedToNamespaceCheck(cfg *config.City, cityPath string, newStore func(string) (beads.Store, error)) *v2RoutedToNamespaceCheck {
+	return &v2RoutedToNamespaceCheck{cfg: cfg, cityPath: cityPath, newStore: newStore}
+}
+
+func (c *v2RoutedToNamespaceCheck) Name() string { return "v2-routed-to-namespace" }
+
+func (c *v2RoutedToNamespaceCheck) CanFix() bool { return false }
+
+func (c *v2RoutedToNamespaceCheck) Fix(_ *doctor.CheckContext) error { return nil }
+
+func (c *v2RoutedToNamespaceCheck) Run(_ *doctor.CheckContext) *doctor.CheckResult {
+	aliases := boundRoutedToAliases(c.cfg)
+	if len(aliases) == 0 {
+		return okCheck(c.Name(), "no binding-qualified route targets configured")
+	}
+
+	var findings []string
+	var skipped []string
+	c.scanScope(&findings, &skipped, aliases, "city", c.cityPath)
+	if c.cfg != nil {
+		for _, rig := range c.cfg.Rigs {
+			if rig.Suspended || strings.TrimSpace(rig.Path) == "" {
+				continue
+			}
+			c.scanScope(&findings, &skipped, aliases, "rig "+rig.Name, rig.Path)
+		}
+	}
+
+	if len(findings) == 0 && len(skipped) == 0 {
+		return okCheck(c.Name(), "no short-form gc.routed_to values targeting bound agents found")
+	}
+	details := append([]string{}, findings...)
+	details = append(details, skipped...)
+	sort.Strings(details)
+	if len(findings) == 0 {
+		return warnCheck(c.Name(),
+			fmt.Sprintf("v2 routed_to namespace check skipped %d scope(s)", len(skipped)),
+			"fix bead store access, then rerun gc doctor",
+			details)
+	}
+	if len(skipped) > 0 {
+		return warnCheck(c.Name(),
+			fmt.Sprintf("%d short-form gc.routed_to value(s) target bound PackV2 agents; %d scope(s) skipped", len(findings), len(skipped)),
+			"rewrite gc.routed_to to the binding-qualified agent name, fix skipped store access, then rerun gc doctor",
+			details)
+	}
+	return warnCheck(c.Name(),
+		fmt.Sprintf("%d short-form gc.routed_to value(s) target bound PackV2 agents", len(findings)),
+		"rewrite gc.routed_to to the binding-qualified agent name, then rerun gc doctor",
+		details)
+}
+
+func (c *v2RoutedToNamespaceCheck) scanScope(findings, skipped *[]string, aliases map[string][]string, label, path string) {
+	if c.newStore == nil || strings.TrimSpace(path) == "" {
+		return
+	}
+	store, err := c.newStore(path)
+	if err != nil {
+		*skipped = append(*skipped, fmt.Sprintf("%s skipped: opening bead store: %v", label, err))
+		return
+	}
+	items, err := store.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		*skipped = append(*skipped, fmt.Sprintf("%s skipped: listing beads: %v", label, err))
+		return
+	}
+	for _, bead := range items {
+		route := strings.TrimSpace(bead.Metadata["gc.routed_to"])
+		if route == "" {
+			continue
+		}
+		canonicals, ok := aliases[route]
+		if !ok {
+			continue
+		}
+		switch len(canonicals) {
+		case 1:
+			*findings = append(*findings, fmt.Sprintf("%s bead %s has gc.routed_to=%q; use %q", label, bead.ID, route, canonicals[0]))
+		default:
+			*findings = append(*findings, fmt.Sprintf("%s bead %s has gc.routed_to=%q; use one of %s", label, bead.ID, route, strings.Join(canonicals, ", ")))
+		}
+	}
+}
+
+func boundRoutedToAliases(cfg *config.City) map[string][]string {
+	aliases := map[string][]string{}
+	if cfg == nil {
+		return aliases
+	}
+	unbound := unboundRoutedToIdentities(cfg)
+	addAlias := func(short, canonical string) {
+		short = strings.TrimSpace(short)
+		canonical = strings.TrimSpace(canonical)
+		if short == "" || canonical == "" || short == canonical || unbound[short] {
+			return
+		}
+		aliases[short] = appendUniqueString(aliases[short], canonical)
+	}
+	for i := range cfg.Agents {
+		agent := cfg.Agents[i]
+		if strings.TrimSpace(agent.BindingName) == "" {
+			continue
+		}
+		addAlias(unboundRouteIdentity(agent), agent.QualifiedName())
+	}
+	for i := range cfg.NamedSessions {
+		session := cfg.NamedSessions[i]
+		if strings.TrimSpace(session.BindingName) == "" {
+			continue
+		}
+		addAlias(unboundNamedSessionRouteIdentity(session), session.QualifiedName())
+	}
+	for key := range aliases {
+		sort.Strings(aliases[key])
+	}
+	return aliases
+}
+
+func unboundRouteIdentity(agent config.Agent) string {
+	name := strings.TrimSpace(agent.Name)
+	if name == "" {
+		return ""
+	}
+	dir := strings.TrimSpace(agent.Dir)
+	if dir == "" {
+		return name
+	}
+	return dir + "/" + name
+}
+
+func unboundRoutedToIdentities(cfg *config.City) map[string]bool {
+	identities := map[string]bool{}
+	for i := range cfg.Agents {
+		agent := cfg.Agents[i]
+		if strings.TrimSpace(agent.BindingName) != "" {
+			continue
+		}
+		if identity := unboundRouteIdentity(agent); identity != "" {
+			identities[identity] = true
+		}
+	}
+	for i := range cfg.NamedSessions {
+		session := cfg.NamedSessions[i]
+		if strings.TrimSpace(session.BindingName) != "" {
+			continue
+		}
+		if identity := unboundNamedSessionRouteIdentity(session); identity != "" {
+			identities[identity] = true
+		}
+	}
+	return identities
+}
+
+func unboundNamedSessionRouteIdentity(session config.NamedSession) string {
+	name := strings.TrimSpace(session.Name)
+	if name == "" {
+		name = strings.TrimSpace(session.Template)
+	}
+	if name == "" {
+		return ""
+	}
+	dir := strings.TrimSpace(session.Dir)
+	if dir == "" {
+		return name
+	}
+	return dir + "/" + name
+}
+
+func appendUniqueString(values []string, value string) []string {
+	for _, existing := range values {
+		if existing == value {
+			return values
+		}
+	}
+	return append(values, value)
+}
diff --git a/cmd/gc/doctor_routed_to_checks_test.go b/cmd/gc/doctor_routed_to_checks_test.go
new file mode 100644
index 0000000000..248749871f
--- /dev/null
+++ b/cmd/gc/doctor_routed_to_checks_test.go
@@ -0,0 +1,180 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/doctor"
+)
+
+func TestV2RoutedToNamespaceCheckWarnsOnShortBoundRoutes(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := t.TempDir()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog", BindingName: "gastown"},
+			{Name: "polecat", Dir: "repo", BindingName: "gastown"},
+		},
+		Rigs: []config.Rig{
+			{Name: "repo", Path: rigDir},
+		},
+	}
+	cityStore := beads.NewMemStoreFrom(0, []beads.Bead{
+		{ID: "CITY-1", Title: "warrant", Type: "task", Status: "open", Metadata: map[string]string{"gc.routed_to": "dog"}},
+	}, nil)
+	rigStore := beads.NewMemStoreFrom(0, []beads.Bead{
+		{ID: "RIG-1", Title: "work", Type: "task", Status: "open", Metadata: map[string]string{"gc.routed_to": "repo/polecat"}},
+	}, nil)
+	stores := map[string]beads.Store{
+		cityDir: cityStore,
+		rigDir:  rigStore,
+	}
+
+	result := newV2RoutedToNamespaceCheck(cfg, cityDir, func(path string) (beads.Store, error) {
+		store, ok := stores[path]
+		if !ok {
+			return nil, fmt.Errorf("unexpected store path %q", path)
+		}
+		return store, nil
+	}).Run(&doctor.CheckContext{})
+
+	if result.Status != doctor.StatusWarning {
+		t.Fatalf("status = %v, want warning: %#v", result.Status, result)
+	}
+	details := strings.Join(result.Details, "\n")
+	for _, want := range []string{
+		`city bead CITY-1 has gc.routed_to="dog"; use "gastown.dog"`,
+		`rig repo bead RIG-1 has gc.routed_to="repo/polecat"; use "repo/gastown.polecat"`,
+	} {
+		if !strings.Contains(details, want) {
+			t.Fatalf("details missing %q:\n%s", want, details)
+		}
+	}
+}
+
+func TestV2RoutedToNamespaceCheckAllowsCanonicalRoutes(t *testing.T) {
+	cityDir := t.TempDir()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog", BindingName: "gastown"},
+			{Name: "human"},
+		},
+	}
+	cityStore := beads.NewMemStoreFrom(0, []beads.Bead{
+		{ID: "CITY-1", Title: "warrant", Type: "task", Status: "open", Metadata: map[string]string{"gc.routed_to": "gastown.dog"}},
+		{ID: "CITY-2", Title: "human", Type: "task", Status: "open", Metadata: map[string]string{"gc.routed_to": "human"}},
+	}, nil)
+
+	result := newV2RoutedToNamespaceCheck(cfg, cityDir, func(path string) (beads.Store, error) {
+		if path != cityDir {
+			return nil, fmt.Errorf("unexpected store path %q", path)
+		}
+		return cityStore, nil
+	}).Run(&doctor.CheckContext{})
+
+	if result.Status != doctor.StatusOK {
+		t.Fatalf("status = %v, want ok: %#v", result.Status, result)
+	}
+}
+
+func TestV2RoutedToNamespaceCheckWarnsOnBoundNamedSessionShortRoutes(t *testing.T) {
+	cityDir := t.TempDir()
+	cfg := &config.City{
+		NamedSessions: []config.NamedSession{
+			{Name: "mayor", BindingName: "gastown"},
+		},
+	}
+	cityStore := beads.NewMemStoreFrom(0, []beads.Bead{
+		{ID: "CITY-1", Title: "mail", Type: "task", Status: "open", Metadata: map[string]string{"gc.routed_to": "mayor"}},
+	}, nil)
+
+	result := newV2RoutedToNamespaceCheck(cfg, cityDir, func(path string) (beads.Store, error) {
+		if path != cityDir {
+			return nil, fmt.Errorf("unexpected store path %q", path)
+		}
+		return cityStore, nil
+	}).Run(&doctor.CheckContext{})
+
+	if result.Status != doctor.StatusWarning {
+		t.Fatalf("status = %v, want warning: %#v", result.Status, result)
+	}
+	details := strings.Join(result.Details, "\n")
+	want := `city bead CITY-1 has gc.routed_to="mayor"; use "gastown.mayor"`
+	if !strings.Contains(details, want) {
+		t.Fatalf("details missing %q:\n%s", want, details)
+	}
+}
+
+func TestV2RoutedToNamespaceCheckAllowsAmbiguousShortRouteForUnboundAgent(t *testing.T) {
+	cityDir := t.TempDir()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog"},
+			{Name: "dog", BindingName: "gastown"},
+		},
+	}
+	cityStore := beads.NewMemStoreFrom(0, []beads.Bead{
+		{ID: "CITY-1", Title: "warrant", Type: "task", Status: "open", Metadata: map[string]string{"gc.routed_to": "dog"}},
+	}, nil)
+
+	result := newV2RoutedToNamespaceCheck(cfg, cityDir, func(path string) (beads.Store, error) {
+		if path != cityDir {
+			return nil, fmt.Errorf("unexpected store path %q", path)
+		}
+		return cityStore, nil
+	}).Run(&doctor.CheckContext{})
+
+	if result.Status != doctor.StatusOK {
+		t.Fatalf("status = %v, want ok: %#v", result.Status, result)
+	}
+}
+
+func TestV2RoutedToNamespaceCheckWarnsOnSkippedStoreScopes(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := t.TempDir()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog", BindingName: "gastown"},
+		},
+		Rigs: []config.Rig{
+			{Name: "repo", Path: rigDir},
+		},
+	}
+
+	result := newV2RoutedToNamespaceCheck(cfg, cityDir, func(path string) (beads.Store, error) {
+		switch path {
+		case cityDir:
+			return nil, errors.New("city offline")
+		case rigDir:
+			return routeListErrorStore{err: errors.New("rig offline")}, nil
+		default:
+			return nil, fmt.Errorf("unexpected store path %q", path)
+		}
+	}).Run(&doctor.CheckContext{})
+
+	if result.Status != doctor.StatusWarning {
+		t.Fatalf("status = %v, want warning: %#v", result.Status, result)
+	}
+	details := strings.Join(result.Details, "\n")
+	for _, want := range []string{
+		"city skipped: opening bead store: city offline",
+		"rig repo skipped: listing beads: rig offline",
+	} {
+		if !strings.Contains(details, want) {
+			t.Fatalf("details missing %q:\n%s", want, details)
+		}
+	}
+}
+
+type routeListErrorStore struct {
+	beads.Store
+	err error
+}
+
+func (s routeListErrorStore) List(beads.ListQuery) ([]beads.Bead, error) {
+	return nil, s.err
+}
diff --git a/cmd/gc/doctor_session_model.go b/cmd/gc/doctor_session_model.go
index b60d4adebd..addc70b089 100644
--- a/cmd/gc/doctor_session_model.go
+++ b/cmd/gc/doctor_session_model.go
@@ -33,7 +33,7 @@ func (c *sessionModelDoctorCheck) Run(_ *doctor.CheckContext) *doctor.CheckResul
 		r.Message = fmt.Sprintf("session model diagnostics skipped: %v", err)
 		return r
 	}
-	all, err := store.List(beads.ListQuery{AllowScan: true, IncludeClosed: true, Sort: beads.SortCreatedAsc})
+	all, err := loadSessionModelDoctorBeads(store)
 	if err != nil {
 		r.Status = doctor.StatusWarning
 		r.Message = fmt.Sprintf("session model diagnostics skipped: %v", err)
@@ -122,6 +122,44 @@ func (c *sessionModelDoctorCheck) Run(_ *doctor.CheckContext) *doctor.CheckResul
 	return r
 }
 
+func loadSessionModelDoctorBeads(store beads.Store) ([]beads.Bead, error) {
+	type listStep struct {
+		name  string
+		query beads.ListQuery
+	}
+	steps := []listStep{
+		{
+			name:  "session label",
+			query: beads.ListQuery{Label: session.LabelSession, IncludeClosed: true, Sort: beads.SortCreatedAsc},
+		},
+		{
+			name:  "session type",
+			query: beads.ListQuery{Type: session.BeadType, IncludeClosed: true, Sort: beads.SortCreatedAsc},
+		},
+		{
+			name:  "open work",
+			query: beads.ListQuery{AllowScan: true, Sort: beads.SortCreatedAsc},
+		},
+	}
+
+	seen := make(map[string]bool)
+	var all []beads.Bead
+	for _, step := range steps {
+		items, err := store.List(step.query)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", step.name, err)
+		}
+		for _, item := range items {
+			if seen[item.ID] {
+				continue
+			}
+			seen[item.ID] = true
+			all = append(all, item)
+		}
+	}
+	return all, nil
+}
+
 func isRetiredSessionModelOwner(b beads.Bead) bool {
 	return session.LifecycleIdentityReleased(b.Status, b.Metadata)
 }
diff --git a/cmd/gc/dolt_cleanup_discovery.go b/cmd/gc/dolt_cleanup_discovery.go
new file mode 100644
index 0000000000..0db0db0218
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_discovery.go
@@ -0,0 +1,361 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// loadRigDoltPorts reads each rig's <rigRoot>/.beads/dolt-server.port file and
+// returns a port→rig-name map for the reaper's protection check. Missing or
+// malformed files are silently skipped — they just won't contribute to the
+// protected set, and the reaper will fall back to its config-path filter.
+//
+// If two rigs claim the same port (pathological — operator misconfiguration),
+// the later-listed rig wins. The function is still safe: any port match
+// protects, regardless of which rig name is attributed.
+func loadRigDoltPorts(rigs []resolverRig, fs fsys.FS) map[int]string {
+	out := map[int]string{}
+	for _, rig := range rigs {
+		path := filepath.Join(rig.Path, ".beads", "dolt-server.port")
+		data, err := fs.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		text := strings.TrimSpace(string(data))
+		if text == "" {
+			continue
+		}
+		port, err := strconv.Atoi(text)
+		if err != nil || !validDoltPort(port) {
+			continue
+		}
+		out[port] = rig.Name
+	}
+	return out
+}
+
+// procEnumerationTimeout caps the per-PID I/O during /proc walks so a stuck
+// kernel thread or hung process can't make the reaper hang.
+const procEnumerationTimeout = 2 * time.Second
+
+// discoverDoltProcesses walks /proc to find live `dolt sql-server` processes
+// and reports their argv and listening ports. Returns nil + nil on hosts
+// without /proc (the reaper degrades to "no candidates found", which is
+// indistinguishable from a healthy host with no orphans).
+//
+// The function is intentionally Linux-specific. macOS/BSD hosts would need
+// `ps -ax -o pid,command` and `lsof -i -P -nFn` — left as future work since
+// the architect's spec scopes this to Linux test infrastructure.
+func discoverDoltProcesses() ([]DoltProcInfo, error) {
+	entries, err := os.ReadDir("/proc")
+	if err != nil {
+		return nil, nil
+	}
+
+	pidPorts := portsByPID()
+
+	var out []DoltProcInfo
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			continue
+		}
+		argv, ok := readDoltSQLServerArgv(pid)
+		if !ok {
+			continue
+		}
+		out = append(out, DoltProcInfo{
+			PID:            pid,
+			Argv:           argv,
+			Ports:          pidPorts[pid],
+			RSSBytes:       readProcRSSBytes(pid),
+			StartTimeTicks: readProcStartTimeTicks(pid),
+		})
+	}
+	return out, nil
+}
+
+func discoverActiveTestRoots(homeDir, tempDir string) []string {
+	entries, err := os.ReadDir("/proc")
+	if err != nil {
+		return nil
+	}
+	seen := map[string]struct{}{}
+	var roots []string
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			continue
+		}
+		data, err := readWithTimeout(filepath.Join("/proc", strconv.Itoa(pid), "cmdline"))
+		if err != nil || len(data) == 0 {
+			continue
+		}
+		argv := splitCmdline(data)
+		if looksLikeDoltSQLServer(argv) {
+			continue
+		}
+		for _, arg := range argv {
+			root, ok := activeTestRootFromPath(arg, homeDir, tempDir)
+			if !ok {
+				continue
+			}
+			if _, exists := seen[root]; exists {
+				continue
+			}
+			seen[root] = struct{}{}
+			roots = append(roots, root)
+		}
+	}
+	return roots
+}
+
+func activeTestRootFromPath(path, homeDir, tempDir string) (string, bool) {
+	clean := filepath.Clean(path)
+	for _, root := range []string{"/tmp", tempDir} {
+		if testRoot, ok := activeTestRootUnder(clean, root, testConfigPathPrefixes()); ok {
+			return testRoot, true
+		}
+	}
+	if homeDir == "" {
+		return "", false
+	}
+	return activeTestRootUnder(clean, filepath.Join(homeDir, ".gotmp"), []string{"Test"})
+}
+
+func activeTestRootUnder(cleanPath, root string, prefixes []string) (string, bool) {
+	if root == "" {
+		return "", false
+	}
+	cleanRoot := filepath.Clean(root)
+	if cleanRoot == "." || cleanRoot == string(filepath.Separator) {
+		return "", false
+	}
+	rootPrefix := cleanRoot + string(filepath.Separator)
+	if !strings.HasPrefix(cleanPath, rootPrefix) {
+		return "", false
+	}
+	child := strings.TrimPrefix(cleanPath, rootPrefix)
+	for _, prefix := range prefixes {
+		if !strings.HasPrefix(child, prefix) {
+			continue
+		}
+		nextSep := strings.IndexRune(child, filepath.Separator)
+		if nextSep < 0 {
+			return filepath.Join(cleanRoot, child), true
+		}
+		return filepath.Join(cleanRoot, child[:nextSep]), true
+	}
+	return "", false
+}
+
+func readProcStartTimeTicks(pid int) uint64 {
+	data, err := readWithTimeout(filepath.Join("/proc", strconv.Itoa(pid), "stat"))
+	if err != nil {
+		return 0
+	}
+	return parseProcStartTimeTicks(data)
+}
+
+func parseProcStartTimeTicks(data []byte) uint64 {
+	text := string(data)
+	closeParen := strings.LastIndex(text, ")")
+	if closeParen < 0 {
+		return 0
+	}
+	fields := strings.Fields(text[closeParen+1:])
+	if len(fields) <= 19 {
+		return 0
+	}
+	startTime, err := strconv.ParseUint(fields[19], 10, 64)
+	if err != nil {
+		return 0
+	}
+	return startTime
+}
+
+func readProcRSSBytes(pid int) int64 {
+	data, err := readWithTimeout(filepath.Join("/proc", strconv.Itoa(pid), "statm"))
+	if err != nil {
+		return 0
+	}
+	fields := strings.Fields(string(data))
+	if len(fields) < 2 {
+		return 0
+	}
+	pages, err := strconv.ParseInt(fields[1], 10, 64)
+	if err != nil || pages <= 0 {
+		return 0
+	}
+	return pages * int64(os.Getpagesize())
+}
+
+// readDoltSQLServerArgv reads /proc/<pid>/cmdline and returns the NUL-split
+// argv if and only if the process looks like `dolt sql-server`. The boolean
+// is false for any non-dolt process so callers can skip cheaply.
+func readDoltSQLServerArgv(pid int) ([]string, bool) {
+	data, err := readWithTimeout(filepath.Join("/proc", strconv.Itoa(pid), "cmdline"))
+	if err != nil || len(data) == 0 {
+		return nil, false
+	}
+	argv := splitCmdline(data)
+	if !looksLikeDoltSQLServer(argv) {
+		return nil, false
+	}
+	return argv, true
+}
+
+// splitCmdline parses a /proc/<pid>/cmdline blob (NUL-separated argv with
+// trailing NUL) into a string slice. Empty trailing element is dropped.
+func splitCmdline(data []byte) []string {
+	parts := strings.Split(string(data), "\x00")
+	for len(parts) > 0 && parts[len(parts)-1] == "" {
+		parts = parts[:len(parts)-1]
+	}
+	return parts
+}
+
+// looksLikeDoltSQLServer reports whether argv invokes `dolt sql-server`. The
+// match is intentionally permissive: argv[0] basename must be "dolt" (allowing
+// /usr/local/bin/dolt or just "dolt") and argv[1] must be "sql-server".
+func looksLikeDoltSQLServer(argv []string) bool {
+	if len(argv) < 2 {
+		return false
+	}
+	if filepath.Base(argv[0]) != "dolt" {
+		return false
+	}
+	return argv[1] == "sql-server"
+}
+
+// portsByPID returns a map from PID to its listening TCP ports by reading
+// /proc/net/tcp{,6} and cross-referencing /proc/<pid>/fd/ socket inodes. On
+// hosts without /proc/net the map is empty (the reaper falls back to argv-
+// only protection).
+func portsByPID() map[int][]int {
+	out := map[int][]int{}
+	listenInodes := listenInodesByPort()
+	if len(listenInodes) == 0 {
+		return out
+	}
+	inodeToPort := map[string]int{}
+	for port, inodes := range listenInodes {
+		for _, inode := range inodes {
+			inodeToPort[inode] = port
+		}
+	}
+
+	entries, err := os.ReadDir("/proc")
+	if err != nil {
+		return out
+	}
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			continue
+		}
+		fdDir := filepath.Join("/proc", strconv.Itoa(pid), "fd")
+		fds, err := os.ReadDir(fdDir)
+		if err != nil {
+			continue
+		}
+		for _, fd := range fds {
+			target, err := os.Readlink(filepath.Join(fdDir, fd.Name()))
+			if err != nil {
+				continue
+			}
+			if !strings.HasPrefix(target, "socket:[") {
+				continue
+			}
+			inode := strings.TrimSuffix(strings.TrimPrefix(target, "socket:["), "]")
+			if port, ok := inodeToPort[inode]; ok {
+				out[pid] = appendUniqueInt(out[pid], port)
+			}
+		}
+	}
+	return out
+}
+
+// listenInodesByPort reads /proc/net/tcp{,6} and returns a port → []inode map
+// for sockets in LISTEN state (TCP state 0A). Each inode is a unique kernel
+// socket identifier that appears as the target of a /proc/<pid>/fd/<n>
+// symlink ("socket:[<inode>]"); cross-referencing those gives port→pid.
+func listenInodesByPort() map[int][]string {
+	out := map[int][]string{}
+	for _, path := range []string{"/proc/net/tcp", "/proc/net/tcp6"} {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		for _, line := range strings.Split(string(data), "\n") {
+			fields := strings.Fields(line)
+			if len(fields) < 10 || fields[3] != "0A" {
+				continue
+			}
+			_, portHex, ok := strings.Cut(fields[1], ":")
+			if !ok {
+				continue
+			}
+			port, err := strconv.ParseUint(portHex, 16, 16)
+			if err != nil {
+				continue
+			}
+			out[int(port)] = appendUniqueString(out[int(port)], fields[9])
+		}
+	}
+	return out
+}
+
+func appendUniqueInt(s []int, v int) []int {
+	for _, x := range s {
+		if x == v {
+			return s
+		}
+	}
+	return append(s, v)
+}
+
+// readWithTimeout reads a file with a deadline so a stuck /proc entry (a
+// kernel thread that's blocked) can't hang the discovery walk.
+func readWithTimeout(path string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), procEnumerationTimeout)
+	defer cancel()
+	type result struct {
+		data []byte
+		err  error
+	}
+	ch := make(chan result, 1)
+	go func() {
+		data, err := os.ReadFile(path)
+		ch <- result{data, err}
+	}()
+	select {
+	case r := <-ch:
+		return r.data, r.err
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+// killProcess sends a signal to a PID. Wraps syscall.Kill so the reaper can
+// inject a no-op for tests. Errors are returned verbatim; ESRCH (no such
+// process) is the caller's responsibility to interpret as "already gone".
+func killProcess(pid int, sig syscall.Signal) error {
+	return syscall.Kill(pid, sig)
+}
diff --git a/cmd/gc/dolt_cleanup_discovery_test.go b/cmd/gc/dolt_cleanup_discovery_test.go
new file mode 100644
index 0000000000..120864ca43
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_discovery_test.go
@@ -0,0 +1,132 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestLoadRigDoltPorts_ReadsAllRigs(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+	fs.Files["/rig-a/.beads/dolt-server.port"] = []byte("28232\n")
+	fs.Files["/rig-b/.beads/dolt-server.port"] = []byte("28233\n")
+
+	rigs := []resolverRig{
+		{Name: "hq", Path: "/city", HQ: true},
+		{Name: "alpha", Path: "/rig-a"},
+		{Name: "beta", Path: "/rig-b"},
+	}
+
+	got := loadRigDoltPorts(rigs, fs)
+	want := map[int]string{
+		28231: "hq",
+		28232: "alpha",
+		28233: "beta",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("loadRigDoltPorts = %v, want %v", got, want)
+	}
+}
+
+func TestLoadRigDoltPorts_SkipsMissingAndMalformed(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rig-a/.beads/dolt-server.port"] = []byte("28232\n")
+	fs.Files["/rig-b/.beads/dolt-server.port"] = []byte("not-a-port\n")
+	fs.Files["/rig-c/.beads/dolt-server.port"] = []byte("\n")
+	// /rig-d has no port file at all.
+
+	rigs := []resolverRig{
+		{Name: "alpha", Path: "/rig-a"},
+		{Name: "beta", Path: "/rig-b"},
+		{Name: "gamma", Path: "/rig-c"},
+		{Name: "delta", Path: "/rig-d"},
+	}
+
+	got := loadRigDoltPorts(rigs, fs)
+	want := map[int]string{
+		28232: "alpha",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("loadRigDoltPorts = %v, want %v", got, want)
+	}
+}
+
+func TestLoadRigDoltPorts_DuplicatePortsLastWins(t *testing.T) {
+	// Pathological: two rigs claim the same port. Last write wins so the
+	// reaper still protects on port match (it just attributes to the
+	// later-listed rig). Acceptable behavior; documented in the function.
+	fs := fsys.NewFake()
+	fs.Files["/rig-a/.beads/dolt-server.port"] = []byte("28232\n")
+	fs.Files["/rig-b/.beads/dolt-server.port"] = []byte("28232\n")
+
+	rigs := []resolverRig{
+		{Name: "alpha", Path: "/rig-a"},
+		{Name: "beta", Path: "/rig-b"},
+	}
+
+	got := loadRigDoltPorts(rigs, fs)
+	if got[28232] == "" {
+		t.Errorf("expected port 28232 to be in map, got %v", got)
+	}
+}
+
+func TestSplitCmdline_NULSeparatedWithTrailingNUL(t *testing.T) {
+	// /proc/<pid>/cmdline format: NUL-separated argv, trailing NUL.
+	in := []byte("dolt\x00sql-server\x00--config\x00/tmp/TestFoo/config.yaml\x00")
+	got := splitCmdline(in)
+	want := []string{"dolt", "sql-server", "--config", "/tmp/TestFoo/config.yaml"}
+	if len(got) != len(want) {
+		t.Fatalf("len = %d, want %d, got=%v", len(got), len(want), got)
+	}
+	for i := range got {
+		if got[i] != want[i] {
+			t.Errorf("got[%d] = %q, want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestSplitCmdline_Empty(t *testing.T) {
+	if got := splitCmdline(nil); len(got) != 0 {
+		t.Errorf("splitCmdline(nil) = %v, want empty", got)
+	}
+	if got := splitCmdline([]byte{}); len(got) != 0 {
+		t.Errorf("splitCmdline([]) = %v, want empty", got)
+	}
+}
+
+func TestParseProcStartTimeTicks(t *testing.T) {
+	fieldsAfterComm := []string{
+		"S", "1", "2", "3", "4", "5", "6", "7", "8", "9",
+		"10", "11", "12", "13", "14", "15", "16", "17", "18", "98765",
+	}
+	line := "123 (dolt sql server) " + strings.Join(fieldsAfterComm, " ")
+
+	if got := parseProcStartTimeTicks([]byte(line)); got != 98765 {
+		t.Fatalf("parseProcStartTimeTicks = %d, want 98765", got)
+	}
+}
+
+func TestLooksLikeDoltSQLServer(t *testing.T) {
+	cases := []struct {
+		name string
+		argv []string
+		want bool
+	}{
+		{"absolute dolt path", []string{"/usr/local/bin/dolt", "sql-server"}, true},
+		{"bare dolt", []string{"dolt", "sql-server", "--config", "x"}, true},
+		{"non-dolt", []string{"mysqld", "sql-server"}, false},
+		{"dolt without sql-server", []string{"dolt", "version"}, false},
+		{"too short", []string{"dolt"}, false},
+		{"empty", []string{}, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := looksLikeDoltSQLServer(tc.argv); got != tc.want {
+				t.Errorf("looksLikeDoltSQLServer(%v) = %v, want %v", tc.argv, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/cmd/gc/dolt_cleanup_drop.go b/cmd/gc/dolt_cleanup_drop.go
new file mode 100644
index 0000000000..d6d902bf70
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_drop.go
@@ -0,0 +1,191 @@
+package main
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// CleanupDoltClient is the SQL surface the cleanup engine needs. The
+// production implementation wraps a *sql.DB; tests inject a fake.
+//
+// Methods are scoped to the operations the engine actually performs:
+// ListDatabases for the scan/plan phase, DropDatabase per stale name,
+// PurgeDroppedDatabases per rig DB after drops complete. Close is for
+// resource hygiene.
+type CleanupDoltClient interface {
+	ListDatabases(ctx context.Context) ([]string, error)
+	DropDatabase(ctx context.Context, name string) error
+	// PurgeDroppedDatabases issues CALL DOLT_PURGE_DROPPED_DATABASES()
+	// against the given rig database. The dolt server's purge routine is
+	// per-database — caller iterates over each rig DB it wants reclaimed.
+	PurgeDroppedDatabases(ctx context.Context, rigDB string) error
+	Close() error
+}
+
+// cleanupDropTimeout caps each individual DROP DATABASE call. Dolt drops
+// can be slow (the server walks the database directory), so a generous
+// timeout avoids spurious failures while still bounding hangs.
+const cleanupDropTimeout = 30 * time.Second
+
+// cleanupListTimeout caps SHOW DATABASES.
+const cleanupListTimeout = 30 * time.Second
+
+// runDropStage discovers all databases on the resolved Dolt server,
+// classifies them with planDoltDrops against the protection list, and (when
+// --force is set) drops each stale name. Errors are recorded into the
+// report. It returns false only when a force-mode safety guard refuses cleanup
+// and the caller must skip the remaining destructive stages.
+func runDropStage(report *CleanupReport, opts cleanupOptions) bool {
+	if opts.DoltClient == nil {
+		if opts.DoltClientOpenErr != nil {
+			recordCleanupError(report, "drop", "", opts.DoltClientOpenErr)
+		}
+		return true
+	}
+	if opts.Force && hasRigProtectionError(report) {
+		return true
+	}
+
+	listCtx, listCancel := context.WithTimeout(context.Background(), cleanupListTimeout)
+	defer listCancel()
+
+	all, err := opts.DoltClient.ListDatabases(listCtx)
+	if err != nil {
+		report.Errors = append(report.Errors, CleanupError{Stage: "drop", Error: err.Error()})
+		report.Summary.ErrorsTotal++
+		return true
+	}
+
+	stalePrefixes := opts.StalePrefixes
+	if len(stalePrefixes) == 0 {
+		stalePrefixes = defaultStaleDatabasePrefixes
+	}
+	protected := make([]string, 0, len(report.RigsProtected))
+	for _, rp := range report.RigsProtected {
+		protected = append(protected, rp.DB)
+	}
+
+	plan := planDoltDrops(all, stalePrefixes, protected)
+	report.Dropped.Skipped = append([]DoltDropSkip{}, plan.Skipped...)
+	for _, skipped := range plan.Skipped {
+		if skipped.Reason == DropSkipReasonInvalidIdentifier {
+			recordCleanupError(report, "drop", skipped.Name, fmt.Errorf("invalid database identifier %q", skipped.Name))
+		}
+	}
+
+	if !opts.Force {
+		report.Dropped.Count = len(plan.ToDrop)
+		report.Dropped.Names = append([]string{}, plan.ToDrop...)
+		return true
+	}
+	if opts.MaxOrphanDBs > 0 && len(plan.ToDrop) > opts.MaxOrphanDBs {
+		report.Dropped.Count = len(plan.ToDrop)
+		report.Dropped.Names = append([]string{}, plan.ToDrop...)
+		recordCleanupErrorKind(
+			report,
+			"drop",
+			cleanupErrorKindMaxOrphanRefusal,
+			"",
+			fmt.Errorf("apply-time stale database count %d exceeds --max-orphan-dbs=%d; refusing forced cleanup", len(plan.ToDrop), opts.MaxOrphanDBs),
+		)
+		return false
+	}
+
+	droppedNames := make([]string, 0, len(plan.ToDrop))
+	for _, name := range plan.ToDrop {
+		dropCtx, dropCancel := context.WithTimeout(context.Background(), cleanupDropTimeout)
+		err := opts.DoltClient.DropDatabase(dropCtx, name)
+		dropCancel()
+		if err != nil {
+			report.Dropped.Failed = append(report.Dropped.Failed, CleanupDropFailure{
+				Name:  name,
+				Error: err.Error(),
+			})
+			report.Errors = append(report.Errors, CleanupError{
+				Stage: "drop",
+				Name:  name,
+				Error: err.Error(),
+			})
+			report.Summary.ErrorsTotal++
+			continue
+		}
+		droppedNames = append(droppedNames, name)
+	}
+	// Update the count to the actually-dropped tally so the summary
+	// matches the live world rather than the planned set.
+	report.Dropped.Names = droppedNames
+	report.Dropped.Count = len(droppedNames)
+	return true
+}
+
+// sqlCleanupDoltClient wraps a *sql.DB to satisfy CleanupDoltClient.
+type sqlCleanupDoltClient struct {
+	db *sql.DB
+}
+
+// newSQLCleanupDoltClient opens a connection to the resolved Dolt server.
+// Caller must Close() when done.
+func newSQLCleanupDoltClient(host, port string) (CleanupDoltClient, error) {
+	db, err := managedDoltOpenDB(host, port, "root")
+	if err != nil {
+		return nil, fmt.Errorf("open dolt connection: %w", err)
+	}
+	return &sqlCleanupDoltClient{db: db}, nil
+}
+
+func (c *sqlCleanupDoltClient) ListDatabases(ctx context.Context) ([]string, error) {
+	rows, err := c.db.QueryContext(ctx, "SHOW DATABASES")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close() //nolint:errcheck
+	var out []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, err
+		}
+		out = append(out, name)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sqlCleanupDoltClient) DropDatabase(ctx context.Context, name string) error {
+	if !validDoltDatabaseIdentifier(name) {
+		return fmt.Errorf("invalid database identifier %q", name)
+	}
+	// Escape backticks in identifiers to prevent injection (` → ``).
+	safe := strings.ReplaceAll(name, "`", "``")
+	_, err := c.db.ExecContext(ctx, fmt.Sprintf("DROP DATABASE `%s`", safe)) //nolint:gosec // G201: identifier-escaped
+	return err
+}
+
+func (c *sqlCleanupDoltClient) PurgeDroppedDatabases(ctx context.Context, rigDB string) error {
+	if !validDoltDatabaseIdentifier(rigDB) {
+		return fmt.Errorf("invalid database identifier %q", rigDB)
+	}
+	conn, err := c.db.Conn(ctx)
+	if err != nil {
+		return err
+	}
+	defer conn.Close() //nolint:errcheck
+
+	safe := strings.ReplaceAll(rigDB, "`", "``")
+	if _, err := conn.ExecContext(ctx, fmt.Sprintf("USE `%s`", safe)); err != nil { //nolint:gosec // G201: identifier-escaped
+		return fmt.Errorf("USE %q: %w", rigDB, err)
+	}
+	if _, err := conn.ExecContext(ctx, "CALL DOLT_PURGE_DROPPED_DATABASES()"); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (c *sqlCleanupDoltClient) Close() error {
+	return c.db.Close()
+}
diff --git a/cmd/gc/dolt_cleanup_drop_planner.go b/cmd/gc/dolt_cleanup_drop_planner.go
new file mode 100644
index 0000000000..09f06f1f57
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_drop_planner.go
@@ -0,0 +1,149 @@
+package main
+
+import "strings"
+
+// defaultStaleDatabasePrefixes mirrors beads/cmd/bd/dolt.go
+// staleDatabasePrefixes: the list of name prefixes that identify test/agent
+// databases left behind by interrupted runs. The lists must converge
+// (be-hjj-3 syncs the beads side).
+//
+// Convention:
+//   - testdb_*: BEADS_TEST_MODE=1 FNV hash of temp paths
+//   - doctest_*: doctor test helpers
+//   - doctortest_*: doctor test helpers
+//   - beads_pt*: orchestrator patrol_helpers_test.go random prefixes
+//   - beads_vr*: orchestrator mail/router_test.go random prefixes
+//   - beads_t[0-9a-f]*: protocol test random prefixes (t + 8 hex chars)
+var defaultStaleDatabasePrefixes = []string{
+	"testdb_", "doctest_", "doctortest_", "beads_pt", "beads_vr", "beads_t",
+}
+
+// systemDatabaseNames are the Dolt/MySQL system databases that SHOW
+// DATABASES surfaces. The planner never targets these even if a stale
+// prefix accidentally matches.
+var systemDatabaseNames = map[string]bool{
+	"information_schema": true,
+	"mysql":              true,
+	"performance_schema": true,
+	"sys":                true,
+	"dolt_cluster":       true,
+	"__gc_probe":         true,
+}
+
+// DoltDropPlan classifies a SHOW DATABASES result into to-drop, protected,
+// and stale-but-spared sets. Pure logic; no I/O.
+type DoltDropPlan struct {
+	// ToDrop is the set of DB names whose prefix matches a stale entry and
+	// which are not protected by the rig registry.
+	ToDrop []string
+	// Protected is the set of registered rig DB names that were observed in
+	// the input list, in input order. The set is independent of whether a
+	// name matches a stale prefix — it surfaces every registered rig that
+	// currently exists on the server so callers can render a complete
+	// PROTECTED section per designer Wireframe 1.
+	Protected []string
+	// Skipped records each stale-prefix-matched name that the planner
+	// declined to drop, with the reason.
+	Skipped []DoltDropSkip
+}
+
+// DoltDropSkip is a single stale-but-spared database with the reason.
+type DoltDropSkip struct {
+	Name   string `json:"name"`
+	Reason string `json:"reason"`
+}
+
+// DropSkipReasonRigProtected marks a stale-matched DB held back because its
+// name appears in the rig-protection list (architect 4.2 safety contract).
+const DropSkipReasonRigProtected = "rig-protected"
+
+// DropSkipReasonInvalidIdentifier marks a stale-matched DB held back because
+// its name does not fit the conservative identifier shape allowed for
+// destructive DROP DATABASE targets.
+const DropSkipReasonInvalidIdentifier = "invalid-identifier"
+
+// planDoltDrops classifies the names returned by SHOW DATABASES against the
+// stale-prefix list and the rig-protection list. The protection check wins
+// over the stale-prefix match: a registered rig DB is never a drop target,
+// even if its name happens to start with a known stale prefix.
+//
+// Order of `allDBs` is preserved across ToDrop, Protected, and Skipped so
+// human-readable rendering stays predictable.
+func planDoltDrops(allDBs, stalePrefixes, protectedNames []string) DoltDropPlan {
+	protected := map[string]bool{}
+	for _, p := range protectedNames {
+		protected[p] = true
+	}
+
+	plan := DoltDropPlan{}
+	for _, name := range allDBs {
+		if systemDatabaseNames[name] {
+			continue
+		}
+		isProtected := protected[name]
+		if isProtected {
+			plan.Protected = append(plan.Protected, name)
+		}
+		if !hasAnyPrefix(name, stalePrefixes) {
+			continue
+		}
+		if isProtected {
+			plan.Skipped = append(plan.Skipped, DoltDropSkip{Name: name, Reason: DropSkipReasonRigProtected})
+			continue
+		}
+		if !validDoltDatabaseIdentifier(name) {
+			plan.Skipped = append(plan.Skipped, DoltDropSkip{Name: name, Reason: DropSkipReasonInvalidIdentifier})
+			continue
+		}
+		plan.ToDrop = append(plan.ToDrop, name)
+	}
+	return plan
+}
+
+func hasAnyPrefix(name string, prefixes []string) bool {
+	for _, p := range prefixes {
+		if p == "beads_t" {
+			if hasBeadsTHexSuffix(name) {
+				return true
+			}
+			continue
+		}
+		if strings.HasPrefix(name, p) {
+			return true
+		}
+	}
+	return false
+}
+
+func hasBeadsTHexSuffix(name string) bool {
+	const prefix = "beads_t"
+	if !strings.HasPrefix(name, prefix) {
+		return false
+	}
+	suffix := strings.TrimPrefix(name, prefix)
+	if len(suffix) < 8 {
+		return false
+	}
+	for _, r := range suffix {
+		if (r < '0' || r > '9') && (r < 'a' || r > 'f') {
+			return false
+		}
+	}
+	return true
+}
+
+func validDoltDatabaseIdentifier(name string) bool {
+	if name == "" {
+		return false
+	}
+	for i, r := range name {
+		if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_' {
+			continue
+		}
+		if i > 0 && r == '-' {
+			continue
+		}
+		return false
+	}
+	return true
+}
diff --git a/cmd/gc/dolt_cleanup_drop_planner_test.go b/cmd/gc/dolt_cleanup_drop_planner_test.go
new file mode 100644
index 0000000000..43cbdf9533
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_drop_planner_test.go
@@ -0,0 +1,170 @@
+package main
+
+import (
+	"testing"
+)
+
+func TestPlanDoltDrops_FiltersByStalePrefixes(t *testing.T) {
+	all := []string{"hq", "beads", "testdb_abc", "doctest_x", "user_data"}
+	stale := []string{"testdb_", "doctest_"}
+	protected := []string{"hq", "beads"}
+
+	plan := planDoltDrops(all, stale, protected)
+
+	wantDrop := []string{"testdb_abc", "doctest_x"}
+	if !equalStringSlice(plan.ToDrop, wantDrop) {
+		t.Errorf("ToDrop = %v, want %v", plan.ToDrop, wantDrop)
+	}
+	// Protected enumerates every registered rig DB present in the input,
+	// regardless of stale-prefix match. This drives the human PROTECTED
+	// section ("these rigs exist on the server; we won't touch them").
+	wantProtected := []string{"hq", "beads"}
+	if !equalStringSlice(plan.Protected, wantProtected) {
+		t.Errorf("Protected = %v, want %v", plan.Protected, wantProtected)
+	}
+}
+
+func TestPlanDoltDrops_RefusesProtectedEvenWhenStalePrefixMatches(t *testing.T) {
+	// Critical safety contract: a registered rig DB whose name happens to
+	// match a stale prefix must NOT be dropped. Protection wins.
+	all := []string{"testdb_unsafe", "testdb_safe"}
+	stale := []string{"testdb_"}
+	protected := []string{"testdb_unsafe"} // some operator chose this name
+
+	plan := planDoltDrops(all, stale, protected)
+
+	wantDrop := []string{"testdb_safe"}
+	if !equalStringSlice(plan.ToDrop, wantDrop) {
+		t.Errorf("ToDrop = %v, want %v", plan.ToDrop, wantDrop)
+	}
+
+	// The protected-but-stale-matching name must show up in Skipped with a
+	// reason that documents why we refused.
+	foundSkip := false
+	for _, s := range plan.Skipped {
+		if s.Name == "testdb_unsafe" && s.Reason == "rig-protected" {
+			foundSkip = true
+		}
+	}
+	if !foundSkip {
+		t.Errorf("expected Skipped entry for testdb_unsafe with reason=rig-protected; got %+v", plan.Skipped)
+	}
+}
+
+func TestPlanDoltDrops_IgnoresSystemDatabases(t *testing.T) {
+	// Dolt's SHOW DATABASES includes information_schema, mysql,
+	// performance_schema, sys, dolt_cluster — none of these are stale DBs
+	// and the planner must never attempt to drop them.
+	all := []string{
+		"information_schema", "mysql", "performance_schema", "sys", "dolt_cluster", "__gc_probe",
+		"testdb_real",
+	}
+	stale := []string{"testdb_"}
+	protected := []string{}
+
+	plan := planDoltDrops(all, stale, protected)
+
+	wantDrop := []string{"testdb_real"}
+	if !equalStringSlice(plan.ToDrop, wantDrop) {
+		t.Errorf("ToDrop = %v, want %v", plan.ToDrop, wantDrop)
+	}
+}
+
+func TestPlanDoltDrops_BeadsTRequiresHexSuffix(t *testing.T) {
+	all := []string{
+		"beads_t1234abcd",
+		"beads_team",
+		"beads_tenant",
+		"beads_tmp_prod",
+		"beads_t123",
+		"beads_tABCDEF12",
+		"beads_t1234abcg",
+	}
+
+	plan := planDoltDrops(all, defaultStaleDatabasePrefixes, nil)
+
+	wantDrop := []string{"beads_t1234abcd"}
+	if !equalStringSlice(plan.ToDrop, wantDrop) {
+		t.Errorf("ToDrop = %v, want %v", plan.ToDrop, wantDrop)
+	}
+	if len(plan.Skipped) != 0 {
+		t.Errorf("Skipped = %v, want empty because non-hex beads_t names are not stale matches", plan.Skipped)
+	}
+}
+
+func TestPlanDoltDrops_SkipsInvalidDropIdentifiers(t *testing.T) {
+	all := []string{
+		"testdb_valid_1",
+		"testdb_bad;drop",
+		"doctest_bad`tick",
+	}
+
+	plan := planDoltDrops(all, defaultStaleDatabasePrefixes, nil)
+
+	wantDrop := []string{"testdb_valid_1"}
+	if !equalStringSlice(plan.ToDrop, wantDrop) {
+		t.Errorf("ToDrop = %v, want %v", plan.ToDrop, wantDrop)
+	}
+	wantSkipped := map[string]bool{
+		"testdb_bad;drop":  false,
+		"doctest_bad`tick": false,
+	}
+	for _, skipped := range plan.Skipped {
+		if _, ok := wantSkipped[skipped.Name]; ok && skipped.Reason == DropSkipReasonInvalidIdentifier {
+			wantSkipped[skipped.Name] = true
+		}
+	}
+	for name, found := range wantSkipped {
+		if !found {
+			t.Errorf("missing invalid-identifier skip for %q in %+v", name, plan.Skipped)
+		}
+	}
+}
+
+func TestValidDoltDatabaseIdentifierBoundaries(t *testing.T) {
+	tests := []struct {
+		name string
+		want bool
+	}{
+		{name: "", want: false},
+		{name: "a", want: true},
+		{name: "-foo", want: false},
+		{name: "_foo", want: true},
+		{name: "foo-bar", want: true},
+		{name: "foo--bar", want: true},
+		{name: "123", want: true},
+		{name: "foo.bar", want: false},
+		{name: "foo bar", want: false},
+		{name: "foo`bar", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := validDoltDatabaseIdentifier(tt.name); got != tt.want {
+				t.Fatalf("validDoltDatabaseIdentifier(%q) = %v, want %v", tt.name, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPlanDoltDrops_EmptyInputsProduceEmptyPlan(t *testing.T) {
+	plan := planDoltDrops(nil, nil, nil)
+	if len(plan.ToDrop) != 0 {
+		t.Errorf("ToDrop = %v, want empty", plan.ToDrop)
+	}
+	if len(plan.Skipped) != 0 {
+		t.Errorf("Skipped = %v, want empty", plan.Skipped)
+	}
+	if len(plan.Protected) != 0 {
+		t.Errorf("Protected = %v, want empty", plan.Protected)
+	}
+}
+
+func TestDefaultStaleDatabasePrefixes_MirrorsBeadsCleanDatabases(t *testing.T) {
+	// be-hjj-3 is the beads-side bead that converges these prefixes; until
+	// then we mirror beads/cmd/bd/dolt.go:staleDatabasePrefixes.
+	want := []string{"testdb_", "doctest_", "doctortest_", "beads_pt", "beads_vr", "beads_t"}
+	if !equalStringSlice(defaultStaleDatabasePrefixes, want) {
+		t.Errorf("defaultStaleDatabasePrefixes = %v, want %v", defaultStaleDatabasePrefixes, want)
+	}
+}
diff --git a/cmd/gc/dolt_cleanup_drop_test.go b/cmd/gc/dolt_cleanup_drop_test.go
new file mode 100644
index 0000000000..5a6b0b394a
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_drop_test.go
@@ -0,0 +1,298 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// fakeCleanupDoltClient is an injectable implementation of
+// CleanupDoltClient that records calls so tests can assert on the order
+// and arguments of operations the cleanup engine performs.
+type fakeCleanupDoltClient struct {
+	databases []string
+	dropped   []string
+	purged    int
+	dropErr   map[string]error
+}
+
+func (f *fakeCleanupDoltClient) ListDatabases(_ context.Context) ([]string, error) {
+	out := make([]string, len(f.databases))
+	copy(out, f.databases)
+	return out, nil
+}
+
+func (f *fakeCleanupDoltClient) DropDatabase(_ context.Context, name string) error {
+	if err, ok := f.dropErr[name]; ok {
+		return err
+	}
+	f.dropped = append(f.dropped, name)
+	// Reflect the drop in the live database listing so subsequent ListDatabases
+	// calls see a converged view.
+	for i, d := range f.databases {
+		if d == name {
+			f.databases = append(f.databases[:i], f.databases[i+1:]...)
+			break
+		}
+	}
+	return nil
+}
+
+func (f *fakeCleanupDoltClient) PurgeDroppedDatabases(_ context.Context, _ string) error {
+	f.purged++
+	return nil
+}
+
+func (f *fakeCleanupDoltClient) Close() error { return nil }
+
+func TestRunDoltCleanup_DryRunEnumeratesDropCandidatesWithoutDropping(t *testing.T) {
+	client := &fakeCleanupDoltClient{
+		databases: []string{"hq", "beads", "testdb_abc", "doctest_x", "user_data"},
+	}
+	rigs := []resolverRig{
+		{Name: "hq", Path: "/city", HQ: true},
+		{Name: "beads", Path: "/beads"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Probe:             false,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Dropped.Count != 2 {
+		t.Errorf("Dropped.Count = %d, want 2 (testdb_abc, doctest_x)", r.Dropped.Count)
+	}
+	if len(client.dropped) != 0 {
+		t.Errorf("DropDatabase called %d times in dry-run; want 0", len(client.dropped))
+	}
+}
+
+func TestRunDoltCleanup_InvalidStaleIdentifiersCountAsDropErrors(t *testing.T) {
+	client := &fakeCleanupDoltClient{
+		databases: []string{"testdb_bad;drop"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Probe:             false,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Dropped.Count != 0 {
+		t.Errorf("Dropped.Count = %d, want 0", r.Dropped.Count)
+	}
+	if len(r.Dropped.Skipped) != 1 || r.Dropped.Skipped[0].Reason != DropSkipReasonInvalidIdentifier {
+		t.Fatalf("Dropped.Skipped = %+v, want one invalid-identifier skip", r.Dropped.Skipped)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "drop" || r.Errors[0].Name != "testdb_bad;drop" || !strings.Contains(r.Errors[0].Error, "invalid database identifier") {
+		t.Fatalf("Errors = %+v, want invalid identifier drop error", r.Errors)
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("DropDatabase called for invalid identifier: %v", client.dropped)
+	}
+}
+
+func TestRunDoltCleanup_ForceDropsStaleDatabases(t *testing.T) {
+	client := &fakeCleanupDoltClient{
+		databases: []string{"hq", "beads", "testdb_abc", "doctest_x"},
+	}
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/beads/.beads/metadata.json"] = []byte(`{"dolt_database":"beads"}`)
+	rigs := []resolverRig{
+		{Name: "hq", Path: "/city", HQ: true},
+		{Name: "beads", Path: "/beads"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if r.Dropped.Count != 2 {
+		t.Errorf("Dropped.Count = %d, want 2", r.Dropped.Count)
+	}
+	wantDropped := []string{"testdb_abc", "doctest_x"}
+	if !equalStringSlice(client.dropped, wantDropped) {
+		t.Errorf("dropped = %v, want %v", client.dropped, wantDropped)
+	}
+}
+
+func TestRunDoltCleanup_ForceDisablesDropAndPurgeWhenRigMetadataUnreadable(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Errors["/rigs/foo/.beads/metadata.json"] = os.ErrPermission
+	putFakeDirTree(fs, "/rigs/foo/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	client := &fakeCleanupDoltClient{
+		databases: []string{"foo", "testdb_registered"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "foo", Path: "/rigs/foo"}},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("dropped = %v, want no forced drops when rig DB identity is unknown", client.dropped)
+	}
+	if client.purged != 0 {
+		t.Fatalf("purged = %d, want no forced purge when rig DB identity is unknown", client.purged)
+	}
+	if r.Dropped.Count != 0 || len(r.Dropped.Names) != 0 {
+		t.Fatalf("Dropped = %+v, want no forced drop results when rig DB identity is unknown", r.Dropped)
+	}
+	if r.Purge.OK {
+		t.Fatalf("Purge.OK = true, want false when forced purge is disabled")
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "rig" || r.Errors[0].Name != "foo" || !strings.Contains(r.Errors[0].Error, "metadata") {
+		t.Fatalf("Errors = %+v, want typed rig metadata error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceDisablesDropAndPurgeWhenRigMetadataCorrupt(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rigs/foo/.beads/metadata.json"] = []byte(`{"dolt_database":`)
+	client := &fakeCleanupDoltClient{
+		databases: []string{"testdb_registered"},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "foo", Path: "/rigs/foo"}},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if len(client.dropped) != 0 {
+		t.Fatalf("dropped = %v, want no forced drops when rig metadata is corrupt", client.dropped)
+	}
+	if client.purged != 0 {
+		t.Fatalf("purged = %d, want no forced purge when rig metadata is corrupt", client.purged)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "rig" || r.Errors[0].Name != "foo" || !strings.Contains(r.Errors[0].Error, "metadata") {
+		t.Fatalf("Errors = %+v, want typed rig metadata error", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceRecordsDropFailureAndContinues(t *testing.T) {
+	client := &fakeCleanupDoltClient{
+		databases: []string{"testdb_a", "testdb_b", "testdb_c"},
+		dropErr: map[string]error{
+			"testdb_b": fmt.Errorf("boom"),
+		},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:                fsys.NewFake(),
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	// Drop failures don't fail the whole run — they're recorded into the
+	// report and the operator decides whether to retry. Exit code stays 0
+	// when the rest of the run succeeded; per-stage errors are visible
+	// via the JSON envelope and human-readable error section.
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	wantDropped := []string{"testdb_a", "testdb_c"}
+	if !equalStringSlice(client.dropped, wantDropped) {
+		t.Errorf("dropped = %v, want %v", client.dropped, wantDropped)
+	}
+	if !equalStringSlice(r.Dropped.Names, wantDropped) {
+		t.Errorf("Dropped.Names = %v, want successful drops only %v", r.Dropped.Names, wantDropped)
+	}
+	if len(r.Dropped.Failed) != 1 || r.Dropped.Failed[0].Name != "testdb_b" {
+		t.Errorf("Dropped.Failed = %+v, want one entry for testdb_b", r.Dropped.Failed)
+	}
+	if !strings.Contains(r.Dropped.Failed[0].Error, "boom") {
+		t.Errorf("failure error = %q, want to contain 'boom'", r.Dropped.Failed[0].Error)
+	}
+}
diff --git a/cmd/gc/dolt_cleanup_human_test.go b/cmd/gc/dolt_cleanup_human_test.go
new file mode 100644
index 0000000000..8e261018d1
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_human_test.go
@@ -0,0 +1,229 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"syscall"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestRunDoltCleanup_HumanOutputShowsAllWireframeSections(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_old/data": 4096,
+	})
+
+	procs := []DoltProcInfo{
+		{PID: 1281044, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestA/config.yaml"}},
+	}
+	client := &fakeCleanupDoltClient{
+		databases: []string{"hq", "testdb_xyz"},
+	}
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              false, // human mode
+		DoltClient:        client,
+		HomeDir:           "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return procs, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	out := stdout.String()
+
+	for _, want := range []string{
+		"Dolt server",
+		"28231",
+		"DROPPED-DATABASE DIRECTORIES",
+		"testdb_xyz",
+		"ORPHAN dolt sql-server PROCESSES",
+		"1281044",
+		"/tmp/TestA/config.yaml",
+		"PROTECTED",
+		"hq",
+		"SUMMARY",
+		"Re-run with --force to apply", // dry-run footer
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("human output missing %q\n--- output ---\n%s", want, out)
+		}
+	}
+}
+
+func TestRunDoltCleanup_HumanOutputForceOmitsDryRunFooter(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+	client := &fakeCleanupDoltClient{databases: []string{"hq"}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              false,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	out := stdout.String()
+	if strings.Contains(out, "Re-run with --force") {
+		t.Errorf("force-mode output should NOT show dry-run footer:\n%s", out)
+	}
+}
+
+func TestRunDoltCleanup_HumanOutputContainsNoANSIEscapes(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+	client := &fakeCleanupDoltClient{databases: []string{"hq", "testdb_x"}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              false,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	out := stdout.String()
+	if strings.Contains(out, "\033[") {
+		t.Errorf("human output contains ANSI escape sequence (should be plain text):\n%q", out)
+	}
+}
+
+func TestRunDoltCleanup_HumanOutputShowsErrorsSection(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+	client := &erroringCleanupClient{databases: []string{"hq", "testdb_x"}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              false,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "ERRORS") {
+		t.Errorf("human output missing ERRORS section when drops failed:\n%s", out)
+	}
+	if !strings.Contains(out, "drop-boom") {
+		t.Errorf("ERRORS section missing the actual error message:\n%s", out)
+	}
+}
+
+func TestRunDoltCleanup_HumanOutputShowsForceBlockersSection(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/rigs/silent/.beads/metadata.json"] = []byte(`{"database":"sqlite"}`)
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs: []resolverRig{
+			{Name: "missing", Path: "/rigs/missing"},
+			{Name: "silent", Path: "/rigs/silent"},
+		},
+		FS:                fs,
+		JSON:              false,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	out := stdout.String()
+	for _, want := range []string{
+		"FORCE BLOCKERS (2)",
+		"rig-protection",
+		"missing",
+		"silent",
+	} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("human output missing force-blocker detail %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestRunDoltCleanup_HumanOutputCountsPostSIGTERMGoneAsReaped(t *testing.T) {
+	discoverCalls := 0
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		FS:      fsys.NewFake(),
+		JSON:    false,
+		Force:   true,
+		HomeDir: "/home/u",
+		DiscoverProcesses: func() ([]DoltProcInfo, error) {
+			discoverCalls++
+			switch discoverCalls {
+			case 1, 2:
+				return []DoltProcInfo{{
+					PID:            4444,
+					Argv:           []string{"dolt", "sql-server", "--config", "/tmp/TestX/config.yaml"},
+					RSSBytes:       4096,
+					StartTimeTicks: 10,
+				}}, nil
+			default:
+				return nil, nil
+			}
+		},
+		KillProcess:     func(_ int, _ syscall.Signal) error { return nil },
+		ReapGracePeriod: 1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%s", code, stderr.String())
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "Reaped:        1") {
+		t.Errorf("human output did not count post-SIGTERM disappearance as reaped:\n%s", out)
+	}
+}
+
+type erroringCleanupClient struct {
+	databases []string
+}
+
+func (e *erroringCleanupClient) ListDatabases(_ context.Context) ([]string, error) {
+	return append([]string{}, e.databases...), nil
+}
+
+func (e *erroringCleanupClient) DropDatabase(_ context.Context, _ string) error {
+	return errBoom("drop-boom")
+}
+func (e *erroringCleanupClient) PurgeDroppedDatabases(_ context.Context, _ string) error { return nil }
+func (e *erroringCleanupClient) Close() error                                            { return nil }
+
+type errBoom string
+
+func (e errBoom) Error() string { return string(e) }
diff --git a/cmd/gc/dolt_cleanup_port.go b/cmd/gc/dolt_cleanup_port.go
new file mode 100644
index 0000000000..6bbc1329cb
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_port.go
@@ -0,0 +1,223 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// LegacyDefaultDoltPort is the historical hard-coded port used by the
+// shell-side cleanup script when no other source can be resolved.
+const LegacyDefaultDoltPort = 3307
+
+const maxTCPPort = 65535
+
+const flagDoltPortSource = "--port flag"
+
+const cityConfigDoltPortSource = "city config dolt.port"
+
+// PortResolverInput bundles the inputs needed for the dolt port discovery
+// chain (per AD-04 §4.1).
+type PortResolverInput struct {
+	// Flag carries the --port flag value (empty if not provided).
+	Flag string
+	// CityPort is the city.toml [dolt] port. Zero means "not set".
+	CityPort int
+	// Rigs is the list of registered rigs, in the order
+	// returned by the registry. The HQ rig is preferred when picking
+	// between candidate <rigRoot>/.beads/dolt-server.port files.
+	Rigs []resolverRig
+	// FS is used for reading rig port files.
+	FS fsys.FS
+}
+
+// resolverRig is the minimum rig info needed by ResolveDoltPort. It is
+// intentionally not the same type as RigListItem so the resolver does not
+// reach into HTTP/CLI types.
+type resolverRig struct {
+	Name string
+	Path string
+	HQ   bool
+}
+
+// PortResolution describes the outcome of the dolt port discovery chain.
+// Source identifies the winning input; Tried records every source consulted,
+// in order, so callers can render a port-fallback warning that explains why
+// each higher-priority source missed.
+type PortResolution struct {
+	Port     int
+	Source   string
+	Fallback bool
+	Tried    []PortResolutionAttempt
+}
+
+// PortResolutionAttempt captures a single source consulted by the resolver.
+// Status is one of: "not-provided", "not-set", "not-found", "found", "error".
+type PortResolutionAttempt struct {
+	Source string
+	Status string
+	Detail string
+}
+
+// ResolveDoltPort applies the discovery chain (AD-04 §4.1):
+//
+//	--port flag > city.toml dolt.port > <rigRoot>/.beads/dolt-server.port (HQ first) > legacy default 3307
+//
+// Returns a PortResolution; Fallback is true only when the legacy default
+// is selected. Never returns an error — caller decides whether the warn
+// state is fatal.
+func ResolveDoltPort(in PortResolverInput) PortResolution {
+	res := PortResolution{}
+
+	attempt, port, ok := tryFlagPort(in.Flag)
+	if ok {
+		res.Tried = append(res.Tried, attempt)
+		res.Port = port
+		res.Source = attempt.Source
+		return res
+	}
+	res.Tried = append(res.Tried, attempt)
+
+	attempt, port, ok = tryCityConfigPort(in.CityPort)
+	if ok {
+		res.Tried = append(res.Tried, attempt)
+		res.Port = port
+		res.Source = attempt.Source
+		return res
+	}
+	res.Tried = append(res.Tried, attempt)
+
+	for _, rig := range orderRigsHQFirst(in.Rigs) {
+		path := filepath.Join(rig.Path, ".beads", "dolt-server.port")
+		attempt, port, ok := tryRigPortFile(in.FS, path)
+		res.Tried = append(res.Tried, attempt)
+		if ok {
+			res.Port = port
+			res.Source = attempt.Source
+			return res
+		}
+		if attempt.Status == "error" {
+			res.Source = attempt.Source
+			return res
+		}
+	}
+
+	// Legacy default — record an attempt for the trail.
+	res.Tried = append(res.Tried, PortResolutionAttempt{
+		Source: "legacy default",
+		Status: "found",
+		Detail: strconv.Itoa(LegacyDefaultDoltPort),
+	})
+	res.Port = LegacyDefaultDoltPort
+	res.Source = "legacy default"
+	res.Fallback = true
+	return res
+}
+
+func tryFlagPort(flag string) (PortResolutionAttempt, int, bool) {
+	src := flagDoltPortSource
+	flag = strings.TrimSpace(flag)
+	if flag == "" {
+		return PortResolutionAttempt{Source: src, Status: "not-provided"}, 0, false
+	}
+	port, err := strconv.Atoi(flag)
+	if err != nil {
+		return PortResolutionAttempt{
+			Source: src,
+			Status: "error",
+			Detail: fmt.Sprintf("invalid port %q: %v", flag, err),
+		}, 0, false
+	}
+	if !validDoltPort(port) {
+		return PortResolutionAttempt{
+			Source: src,
+			Status: "error",
+			Detail: invalidDoltPortMessage(port),
+		}, 0, false
+	}
+	return PortResolutionAttempt{Source: src, Status: "found", Detail: strconv.Itoa(port)}, port, true
+}
+
+func tryCityConfigPort(port int) (PortResolutionAttempt, int, bool) {
+	src := cityConfigDoltPortSource
+	if port == 0 {
+		return PortResolutionAttempt{Source: src, Status: "not-set"}, 0, false
+	}
+	if !validDoltPort(port) {
+		return PortResolutionAttempt{
+			Source: src,
+			Status: "error",
+			Detail: invalidDoltPortMessage(port),
+		}, 0, false
+	}
+	return PortResolutionAttempt{Source: src, Status: "found", Detail: strconv.Itoa(port)}, port, true
+}
+
+func tryRigPortFile(fs fsys.FS, path string) (PortResolutionAttempt, int, bool) {
+	data, err := fs.ReadFile(path)
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			return PortResolutionAttempt{
+				Source: path,
+				Status: "error",
+				Detail: fmt.Sprintf("read port file: %v", err),
+			}, 0, false
+		}
+		return PortResolutionAttempt{Source: path, Status: "not-found"}, 0, false
+	}
+	text := strings.TrimSpace(string(data))
+	if text == "" {
+		return PortResolutionAttempt{
+			Source: path,
+			Status: "error",
+			Detail: "file is empty",
+		}, 0, false
+	}
+	port, err := strconv.Atoi(text)
+	if err != nil {
+		return PortResolutionAttempt{
+			Source: path,
+			Status: "error",
+			Detail: fmt.Sprintf("invalid port %q: %v", text, err),
+		}, 0, false
+	}
+	if !validDoltPort(port) {
+		return PortResolutionAttempt{
+			Source: path,
+			Status: "error",
+			Detail: invalidDoltPortMessage(port),
+		}, 0, false
+	}
+	return PortResolutionAttempt{Source: path, Status: "found", Detail: strconv.Itoa(port)}, port, true
+}
+
+func validDoltPort(port int) bool {
+	return port >= 1 && port <= maxTCPPort
+}
+
+func invalidDoltPortMessage(port int) string {
+	return fmt.Sprintf("invalid port %d (must be between 1 and %d)", port, maxTCPPort)
+}
+
+// orderRigsHQFirst returns the rigs reordered so the HQ rig (if any) is
+// consulted before non-HQ rigs. Original order is preserved among HQ rigs
+// and among non-HQ rigs respectively.
+func orderRigsHQFirst(rigs []resolverRig) []resolverRig {
+	out := make([]resolverRig, 0, len(rigs))
+	for _, r := range rigs {
+		if r.HQ {
+			out = append(out, r)
+		}
+	}
+	for _, r := range rigs {
+		if !r.HQ {
+			out = append(out, r)
+		}
+	}
+	return out
+}
diff --git a/cmd/gc/dolt_cleanup_port_test.go b/cmd/gc/dolt_cleanup_port_test.go
new file mode 100644
index 0000000000..792ff72f5e
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_port_test.go
@@ -0,0 +1,260 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestResolveDoltPort_FlagWins(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+	in := PortResolverInput{
+		Flag:     "9999",
+		CityPort: 4242,
+		Rigs:     []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:       fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 9999 {
+		t.Errorf("Port = %d, want 9999", got.Port)
+	}
+	if got.Fallback {
+		t.Errorf("Fallback = true, want false")
+	}
+	if got.Source != "--port flag" {
+		t.Errorf("Source = %q, want %q", got.Source, "--port flag")
+	}
+}
+
+func TestResolveDoltPort_FlagInvalidFallsThrough(t *testing.T) {
+	fs := fsys.NewFake()
+	in := PortResolverInput{
+		Flag:     "not-a-number",
+		CityPort: 4242,
+		FS:       fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 4242 {
+		t.Errorf("Port = %d, want 4242 (city config fallback)", got.Port)
+	}
+	if got.Source != "city config dolt.port" {
+		t.Errorf("Source = %q, want %q", got.Source, "city config dolt.port")
+	}
+	// First attempt should record the parse error.
+	if len(got.Tried) == 0 || got.Tried[0].Status != "error" {
+		t.Errorf("expected first attempt to record error, got %+v", got.Tried)
+	}
+}
+
+func TestResolveDoltPort_CityConfigBeatsRigFile(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+	in := PortResolverInput{
+		CityPort: 4242,
+		Rigs:     []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:       fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 4242 {
+		t.Errorf("Port = %d, want 4242", got.Port)
+	}
+	if got.Source != "city config dolt.port" {
+		t.Errorf("Source = %q, want city config dolt.port", got.Source)
+	}
+}
+
+func TestResolveDoltPort_HQRigPortFileWins(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231\n")
+	fs.Files["/elsewhere/.beads/dolt-server.port"] = []byte("19999\n")
+	in := PortResolverInput{
+		Rigs: []resolverRig{
+			{Name: "ext", Path: "/elsewhere", HQ: false},
+			{Name: "hq", Path: "/city", HQ: true},
+		},
+		FS: fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 28231 {
+		t.Errorf("Port = %d, want 28231 (HQ rig)", got.Port)
+	}
+	if got.Source != "/city/.beads/dolt-server.port" {
+		t.Errorf("Source = %q, want HQ port-file path", got.Source)
+	}
+	if got.Fallback {
+		t.Errorf("Fallback = true, want false")
+	}
+}
+
+func TestResolveDoltPort_NonHQRigUsedWhenHQAbsent(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/elsewhere/.beads/dolt-server.port"] = []byte("19999\n")
+	in := PortResolverInput{
+		Rigs: []resolverRig{
+			{Name: "ext", Path: "/elsewhere", HQ: false},
+			{Name: "hq", Path: "/city", HQ: true},
+		},
+		FS: fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 19999 {
+		t.Errorf("Port = %d, want 19999 (non-HQ rig)", got.Port)
+	}
+	if got.Source != "/elsewhere/.beads/dolt-server.port" {
+		t.Errorf("Source = %q, want non-HQ port-file path", got.Source)
+	}
+}
+
+func TestResolveDoltPort_LegacyFallbackWhenNothingResolves(t *testing.T) {
+	fs := fsys.NewFake()
+	in := PortResolverInput{
+		Rigs: []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:   fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 3307 {
+		t.Errorf("Port = %d, want 3307 (legacy default)", got.Port)
+	}
+	if !got.Fallback {
+		t.Errorf("Fallback = false, want true")
+	}
+	if got.Source != "legacy default" {
+		t.Errorf("Source = %q, want legacy default", got.Source)
+	}
+}
+
+func TestResolveDoltPort_TriedRecordsAllSources(t *testing.T) {
+	fs := fsys.NewFake()
+	in := PortResolverInput{
+		Rigs: []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+		FS:   fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if len(got.Tried) < 4 {
+		t.Fatalf("Tried = %d entries, want at least 4 (flag, config, rig file, legacy)", len(got.Tried))
+	}
+	wantSources := []string{
+		"--port flag",
+		"city config dolt.port",
+		"/city/.beads/dolt-server.port",
+		"legacy default",
+	}
+	for i, want := range wantSources {
+		if got.Tried[i].Source != want {
+			t.Errorf("Tried[%d].Source = %q, want %q", i, got.Tried[i].Source, want)
+		}
+	}
+}
+
+func TestResolveDoltPort_BadRigPortFileStopsBeforeLegacyFallback(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		setup      func(*fsys.Fake)
+		wantDetail string
+	}{
+		{
+			name:       "empty",
+			setup:      func(fs *fsys.Fake) { fs.Files["/city/.beads/dolt-server.port"] = []byte("\n") },
+			wantDetail: "empty",
+		},
+		{
+			name:       "malformed",
+			setup:      func(fs *fsys.Fake) { fs.Files["/city/.beads/dolt-server.port"] = []byte("not-a-port\n") },
+			wantDetail: "invalid port",
+		},
+		{
+			name:       "out of range",
+			setup:      func(fs *fsys.Fake) { fs.Files["/city/.beads/dolt-server.port"] = []byte("70000\n") },
+			wantDetail: "must be between 1 and 65535",
+		},
+		{
+			name:       "unreadable",
+			setup:      func(fs *fsys.Fake) { fs.Errors["/city/.beads/dolt-server.port"] = os.ErrPermission },
+			wantDetail: "permission",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fs := fsys.NewFake()
+			tc.setup(fs)
+			in := PortResolverInput{
+				Rigs: []resolverRig{{Name: "hq", Path: "/city", HQ: true}},
+				FS:   fs,
+			}
+
+			got := ResolveDoltPort(in)
+
+			if got.Port != 0 {
+				t.Errorf("Port = %d, want unresolved zero port", got.Port)
+			}
+			if got.Fallback {
+				t.Errorf("Fallback = true, want false for bad rig port file")
+			}
+			if got.Source != "/city/.beads/dolt-server.port" {
+				t.Errorf("Source = %q, want bad rig-port-file path", got.Source)
+			}
+			for _, attempt := range got.Tried {
+				if attempt.Source == "legacy default" {
+					t.Fatalf("legacy default was tried after bad rig port file: %+v", got.Tried)
+				}
+				if attempt.Source == "/city/.beads/dolt-server.port" {
+					if attempt.Status != "error" {
+						t.Errorf("rig-port-file attempt status = %q, want error", attempt.Status)
+					}
+					if !strings.Contains(attempt.Detail, tc.wantDetail) {
+						t.Errorf("rig-port-file detail = %q, want substring %q", attempt.Detail, tc.wantDetail)
+					}
+					return
+				}
+			}
+			t.Errorf("did not find /city/.beads/dolt-server.port in Tried entries: %+v", got.Tried)
+		})
+	}
+}
+
+func TestResolveDoltPort_NoRigsFalse_FallsThroughDirectly(t *testing.T) {
+	fs := fsys.NewFake()
+	in := PortResolverInput{
+		FS: fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port != 3307 || !got.Fallback {
+		t.Errorf("expected legacy fallback with no rigs, got %+v", got)
+	}
+}
+
+func TestResolveDoltPort_FlagZeroRejected(t *testing.T) {
+	fs := fsys.NewFake()
+	in := PortResolverInput{
+		Flag:     "0",
+		CityPort: 4242,
+		FS:       fs,
+	}
+
+	got := ResolveDoltPort(in)
+
+	if got.Port == 0 {
+		t.Errorf("Port = 0; resolver must reject a zero --port and fall through")
+	}
+	if got.Source != "city config dolt.port" {
+		t.Errorf("Source = %q, want city-config fallback after zero flag", got.Source)
+	}
+}
diff --git a/cmd/gc/dolt_cleanup_purge.go b/cmd/gc/dolt_cleanup_purge.go
new file mode 100644
index 0000000000..3a041e4998
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_purge.go
@@ -0,0 +1,204 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	iofs "io/fs"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// cleanupPurgeTimeout caps each per-rig CALL DOLT_PURGE_DROPPED_DATABASES.
+// The dolt server's purge work is bounded by the on-disk size of the
+// .dolt_dropped_databases directory; large reclaims can take longer than a
+// drop, so the cap is generous.
+const cleanupPurgeTimeout = 60 * time.Second
+
+// droppedDatabasesDir is the relative path under each rig root where the
+// dolt server stages dropped databases until DOLT_PURGE_DROPPED_DATABASES
+// reclaims them.
+const droppedDatabasesDir = ".beads/dolt/.dolt_dropped_databases"
+
+// runPurgeStage walks each rig's .dolt_dropped_databases directory to sum
+// reclaimable bytes. On --force it then calls DOLT_PURGE_DROPPED_DATABASES
+// against each rig database to actually free the disk. Errors are recorded
+// into report.Errors but never abort the run.
+//
+// Purge.OK is true only when --force was set and every purge call
+// succeeded; in dry-run mode OK stays false because no work was done.
+func runPurgeStage(report *CleanupReport, opts cleanupOptions) {
+	if opts.FS == nil {
+		return
+	}
+	if opts.Force && hasRigProtectionError(report) {
+		return
+	}
+
+	var totalBytes int64
+	bytesByRigDB := map[string]int64{}
+	eligibleRigDBs := map[string]bool{}
+	for _, rig := range opts.Rigs {
+		if !rigSharesResolvedDoltServer(rig, opts) {
+			continue
+		}
+		root := filepath.Join(rig.Path, droppedDatabasesDir)
+		bytes, err := sumBytesUnder(opts.FS, root)
+		if err != nil {
+			recordCleanupError(report, "purge", root, err)
+			continue
+		}
+		totalBytes += bytes
+		dbName := rigDoltDatabaseName(rig, opts.FS)
+		bytesByRigDB[dbName] += bytes
+		eligibleRigDBs[dbName] = true
+	}
+
+	if !opts.Force {
+		report.Purge.BytesReclaimed = totalBytes
+		return
+	}
+	if opts.DoltClient == nil {
+		if opts.DoltClientOpenErr != nil {
+			recordCleanupError(report, "purge", "", opts.DoltClientOpenErr)
+		}
+		return
+	}
+
+	listCtx, listCancel := context.WithTimeout(context.Background(), cleanupListTimeout)
+	liveDBs, err := opts.DoltClient.ListDatabases(listCtx)
+	listCancel()
+	if err != nil {
+		report.Errors = append(report.Errors, CleanupError{Stage: "purge", Error: err.Error()})
+		report.Summary.ErrorsTotal++
+		return
+	}
+	live := make(map[string]bool, len(liveDBs))
+	for _, name := range liveDBs {
+		live[name] = true
+	}
+
+	allOK := true
+	var reclaimedBytes int64
+	for _, rp := range report.RigsProtected {
+		if !eligibleRigDBs[rp.DB] {
+			continue
+		}
+		if !live[rp.DB] {
+			if bytesByRigDB[rp.DB] > 0 {
+				allOK = false
+				recordCleanupError(
+					report,
+					"purge",
+					rp.DB,
+					fmt.Errorf("database not live with %d reclaimable dropped-database bytes", bytesByRigDB[rp.DB]),
+				)
+			}
+			continue
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), cleanupPurgeTimeout)
+		err := opts.DoltClient.PurgeDroppedDatabases(ctx, rp.DB)
+		cancel()
+		if err != nil {
+			allOK = false
+			report.Errors = append(report.Errors, CleanupError{
+				Stage: "purge",
+				Name:  rp.DB,
+				Error: err.Error(),
+			})
+			report.Summary.ErrorsTotal++
+			continue
+		}
+		reclaimedBytes += bytesByRigDB[rp.DB]
+	}
+	report.Purge.BytesReclaimed = reclaimedBytes
+	report.Purge.OK = allOK
+}
+
+func rigSharesResolvedDoltServer(rig resolverRig, opts cleanupOptions) bool {
+	if opts.PortResolution.Port <= 0 || opts.FS == nil {
+		return true
+	}
+	port, state := rigPortFileValue(rig, opts.FS)
+	switch state {
+	case rigPortFileValid:
+		return port == opts.PortResolution.Port
+	case rigPortFileMissing:
+		return opts.PortResolution.Fallback || cityConfigPortSelectsRig(rig, opts)
+	default:
+		return false
+	}
+}
+
+func cityConfigPortSelectsRig(_ resolverRig, opts cleanupOptions) bool {
+	return opts.PortResolution.Source == cityConfigDoltPortSource &&
+		opts.CityPort == opts.PortResolution.Port
+}
+
+type rigPortFileState int
+
+const (
+	rigPortFileMissing rigPortFileState = iota
+	rigPortFileInvalid
+	rigPortFileValid
+)
+
+func rigPortFileValue(rig resolverRig, fs fsys.FS) (int, rigPortFileState) {
+	data, err := fs.ReadFile(filepath.Join(rig.Path, ".beads", "dolt-server.port"))
+	if err != nil {
+		if errors.Is(err, iofs.ErrNotExist) {
+			return 0, rigPortFileMissing
+		}
+		return 0, rigPortFileInvalid
+	}
+	text := strings.TrimSpace(string(data))
+	if text == "" {
+		return 0, rigPortFileInvalid
+	}
+	port, err := strconv.Atoi(text)
+	if err != nil || !validDoltPort(port) {
+		return 0, rigPortFileInvalid
+	}
+	return port, rigPortFileValid
+}
+
+// sumBytesUnder walks the given root recursively and returns the total
+// bytes of every regular file underneath. Returns 0, nil when the root
+// doesn't exist (callers treat this as "nothing to reclaim"). Symlinks
+// are followed via Stat (the dolt dropped-databases directory does not
+// contain symlinks in normal operation).
+func sumBytesUnder(fs fsys.FS, root string) (int64, error) {
+	return sumBytesUnderPath(fs, root, true)
+}
+
+func sumBytesUnderPath(fs fsys.FS, root string, allowMissingRoot bool) (int64, error) {
+	entries, err := fs.ReadDir(root)
+	if err != nil {
+		if allowMissingRoot && errors.Is(err, iofs.ErrNotExist) {
+			return 0, nil
+		}
+		return 0, fmt.Errorf("read %s: %w", root, err)
+	}
+	var total int64
+	for _, e := range entries {
+		full := filepath.Join(root, e.Name())
+		if e.IsDir() {
+			sub, err := sumBytesUnderPath(fs, full, false)
+			if err != nil {
+				return 0, err
+			}
+			total += sub
+			continue
+		}
+		info, err := fs.Stat(full)
+		if err != nil {
+			return 0, fmt.Errorf("stat %s: %w", full, err)
+		}
+		total += info.Size()
+	}
+	return total, nil
+}
diff --git a/cmd/gc/dolt_cleanup_purge_test.go b/cmd/gc/dolt_cleanup_purge_test.go
new file mode 100644
index 0000000000..6f505c87f2
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_purge_test.go
@@ -0,0 +1,830 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"database/sql/driver"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// putFakeDirTree adds a directory tree with given file sizes to the fake FS.
+// Files map values are dummy bytes of the requested length so Stat reports
+// the right size.
+func putFakeDirTree(fs *fsys.Fake, root string, fileSizes map[string]int64) {
+	fs.Dirs[root] = true
+	for relPath, size := range fileSizes {
+		full := root + "/" + relPath
+		// Mark intermediate dirs.
+		for d := full; d != root && d != "." && d != "/"; d = parentDir(d) {
+			parent := parentDir(d)
+			if parent == "" || parent == "." {
+				break
+			}
+			fs.Dirs[parent] = true
+			if parent == root {
+				break
+			}
+		}
+		fs.Files[full] = make([]byte, size)
+	}
+}
+
+func parentDir(p string) string {
+	for i := len(p) - 1; i >= 0; i-- {
+		if p[i] == '/' {
+			if i == 0 {
+				return "/"
+			}
+			return p[:i]
+		}
+	}
+	return ""
+}
+
+func TestRunDoltCleanup_DryRunComputesPurgeBytesFromDroppedDirs(t *testing.T) {
+	fs := fsys.NewFake()
+	// City rig has 3 dropped databases on disk, total 3000 bytes.
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin":     1000,
+		"db_b/manifest":     500,
+		"db_b/blob/abc.dat": 500,
+		"db_c/index":        1000,
+	})
+	// HQ metadata so the rig protection enumerates with DB="hq".
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+	client := &fakeCleanupDoltClient{databases: []string{"hq"}}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if r.Purge.BytesReclaimed != 3000 {
+		t.Errorf("Purge.BytesReclaimed = %d, want 3000", r.Purge.BytesReclaimed)
+	}
+	if client.purged != 0 {
+		t.Errorf("PurgeDroppedDatabases called %d times in dry-run; want 0", client.purged)
+	}
+}
+
+func TestRunDoltCleanup_ForceCallsPurgePerRigDatabase(t *testing.T) {
+	fs := fsys.NewFake()
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	putFakeDirTree(fs, "/rigs/foo/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_b/data.bin": 200,
+	})
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/rigs/foo/.beads/metadata.json"] = []byte(`{"dolt_database":"foo_db"}`)
+
+	rigs := []resolverRig{
+		{Name: "city", Path: "/city", HQ: true},
+		{Name: "foo", Path: "/rigs/foo"},
+	}
+	purgedNames := []string{}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"hq", "foo_db"},
+		onPurge:   func(name string) error { purgedNames = append(purgedNames, name); return nil },
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if !r.Purge.OK {
+		t.Errorf("Purge.OK = false, want true")
+	}
+	if r.Purge.BytesReclaimed != 300 {
+		t.Errorf("Purge.BytesReclaimed = %d, want 300", r.Purge.BytesReclaimed)
+	}
+	wantPurged := []string{"hq", "foo_db"}
+	if !equalStringSlice(purgedNames, wantPurged) {
+		t.Errorf("purged DBs = %v, want %v", purgedNames, wantPurged)
+	}
+}
+
+func TestRunDoltCleanup_PurgeFailureRecordedNotFatal(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"hq"},
+		onPurge:   func(_ string) error { return fmt.Errorf("purge boom") },
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if r.Purge.OK {
+		t.Errorf("Purge.OK = true, want false (purge failed)")
+	}
+	if r.Purge.BytesReclaimed != 0 {
+		t.Errorf("Purge.BytesReclaimed = %d, want 0 because purge failed", r.Purge.BytesReclaimed)
+	}
+	if r.Summary.BytesFreedDisk != 0 {
+		t.Errorf("Summary.BytesFreedDisk = %d, want 0 because purge failed", r.Summary.BytesFreedDisk)
+	}
+	hasPurgeError := false
+	for _, e := range r.Errors {
+		if e.Stage == "purge" && strings.Contains(e.Error, "purge boom") {
+			hasPurgeError = true
+		}
+	}
+	if !hasPurgeError {
+		t.Errorf("Errors missing purge entry: %+v", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceFailsPurgeWhenMissingRigDatabaseHasBytes(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+
+	rigs := []resolverRig{{Name: "hq", Path: "/city", HQ: true}}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"other"},
+		onPurge: func(name string) error {
+			t.Fatalf("PurgeDroppedDatabases(%q) called for missing database", name)
+			return nil
+		},
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+
+	if r.Purge.OK {
+		t.Errorf("Purge.OK = true, want false when reclaimable bytes belong to a non-live database")
+	}
+	if r.Purge.BytesReclaimed != 0 {
+		t.Errorf("Purge.BytesReclaimed = %d, want 0 because no purge call succeeded", r.Purge.BytesReclaimed)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "purge" || r.Errors[0].Name != "hq" || !strings.Contains(r.Errors[0].Error, "not live") {
+		t.Fatalf("Errors = %+v, want purge error for missing live database hq", r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_PurgeReportsUnexpectedFilesystemErrors(t *testing.T) {
+	fs := fsys.NewFake()
+	root := "/city/.beads/dolt/.dolt_dropped_databases"
+	fs.Errors[root] = os.ErrPermission
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              []resolverRig{{Name: "city", Path: "/city", HQ: true}},
+		FS:                fs,
+		JSON:              true,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Purge.BytesReclaimed != 0 {
+		t.Fatalf("Purge.BytesReclaimed = %d, want 0 when dropped-db walk failed", r.Purge.BytesReclaimed)
+	}
+	if r.Summary.ErrorsTotal != 1 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 1; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	if len(r.Errors) != 1 || r.Errors[0].Stage != "purge" || r.Errors[0].Name != root || !strings.Contains(r.Errors[0].Error, "permission") {
+		t.Fatalf("Errors = %+v, want purge filesystem permission error for %s", r.Errors, root)
+	}
+}
+
+func TestSQLCleanupDoltClientPurgePinsUseAndCallToOneConnection(t *testing.T) {
+	resetPurgeConnRecorder()
+
+	db, err := sql.Open("gc_cleanup_purge_conn_recorder", "")
+	if err != nil {
+		t.Fatalf("sql.Open: %v", err)
+	}
+	defer db.Close() //nolint:errcheck
+	db.SetMaxIdleConns(0)
+
+	client := &sqlCleanupDoltClient{db: db}
+	if err := client.PurgeDroppedDatabases(context.Background(), "rig_db"); err != nil {
+		t.Fatalf("PurgeDroppedDatabases: %v", err)
+	}
+
+	execs := purgeConnRecorderExecs()
+	if len(execs) != 2 {
+		t.Fatalf("execs = %+v, want USE and CALL", execs)
+	}
+	if execs[0].query != "USE `rig_db`" {
+		t.Errorf("first query = %q, want USE `rig_db`", execs[0].query)
+	}
+	if execs[1].query != "CALL DOLT_PURGE_DROPPED_DATABASES()" {
+		t.Errorf("second query = %q, want CALL DOLT_PURGE_DROPPED_DATABASES()", execs[1].query)
+	}
+	if execs[0].connID != execs[1].connID {
+		t.Fatalf("USE ran on conn %d and CALL ran on conn %d; want one pinned connection", execs[0].connID, execs[1].connID)
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsPurgeForMissingRigDatabases(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/rigs/fresh/.beads/metadata.json"] = []byte(`{"dolt_database":"fresh_db"}`)
+
+	rigs := []resolverRig{
+		{Name: "city", Path: "/city", HQ: true},
+		{Name: "fresh", Path: "/rigs/fresh"},
+	}
+	purgedNames := []string{}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"hq"},
+		onPurge:   func(name string) error { purgedNames = append(purgedNames, name); return nil },
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if !r.Purge.OK {
+		t.Errorf("Purge.OK = false, want true")
+	}
+	wantPurged := []string{"hq"}
+	if !equalStringSlice(purgedNames, wantPurged) {
+		t.Errorf("purged DBs = %v, want %v", purgedNames, wantPurged)
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Errorf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsPurgeBytesForRigsOnDifferentPort(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231")
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	fs.Files["/rigs/other/.beads/metadata.json"] = []byte(`{"dolt_database":"other_db"}`)
+	fs.Files["/rigs/other/.beads/dolt-server.port"] = []byte("28232")
+	putFakeDirTree(fs, "/rigs/other/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_b/data.bin": 200,
+	})
+
+	rigs := []resolverRig{
+		{Name: "city", Path: "/city", HQ: true},
+		{Name: "other", Path: "/rigs/other"},
+	}
+	purgedNames := []string{}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"hq"},
+		onPurge:   func(name string) error { purgedNames = append(purgedNames, name); return nil },
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs:              rigs,
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if !r.Purge.OK {
+		t.Errorf("Purge.OK = false, want true because non-resolved server was skipped")
+	}
+	if r.Purge.BytesReclaimed != 100 {
+		t.Errorf("Purge.BytesReclaimed = %d, want only resolved-server bytes", r.Purge.BytesReclaimed)
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+	wantPurged := []string{"hq"}
+	if !equalStringSlice(purgedNames, wantPurged) {
+		t.Errorf("purged DBs = %v, want %v", purgedNames, wantPurged)
+	}
+}
+
+func TestRunDoltCleanup_DryRunSkipsPurgeBytesForRigsOnDifferentPort(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231")
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	fs.Files["/rigs/other/.beads/metadata.json"] = []byte(`{"dolt_database":"other_db"}`)
+	fs.Files["/rigs/other/.beads/dolt-server.port"] = []byte("28232")
+	putFakeDirTree(fs, "/rigs/other/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_b/data.bin": 200,
+	})
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs: []resolverRig{
+			{Name: "city", Path: "/city", HQ: true},
+			{Name: "other", Path: "/rigs/other"},
+		},
+		FS:                fs,
+		JSON:              true,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Purge.BytesReclaimed != 100 {
+		t.Fatalf("Purge.BytesReclaimed = %d, want only resolved-server bytes", r.Purge.BytesReclaimed)
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_DryRunCountsCityConfigPortRigWithoutPortFile(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	fs.Files["/rigs/unknown/.beads/metadata.json"] = []byte(`{"dolt_database":"unknown_db"}`)
+	putFakeDirTree(fs, "/rigs/unknown/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_b/data.bin": 200,
+	})
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs: []resolverRig{
+			{Name: "city", Path: "/city", HQ: true},
+			{Name: "unknown", Path: "/rigs/unknown"},
+		},
+		CityPort:          28231,
+		PortResolution:    PortResolution{Port: 28231, Source: cityConfigDoltPortSource},
+		FS:                fs,
+		JSON:              true,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Purge.BytesReclaimed != 300 {
+		t.Fatalf("Purge.BytesReclaimed = %d, want city-config inherited rig bytes included", r.Purge.BytesReclaimed)
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_ForcePurgesCityConfigPortRigWithoutPortFile(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	fs.Files["/rigs/unknown/.beads/metadata.json"] = []byte(`{"dolt_database":"unknown_db"}`)
+	putFakeDirTree(fs, "/rigs/unknown/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_b/data.bin": 200,
+	})
+
+	purgedNames := []string{}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"hq", "unknown_db"},
+		onPurge:   func(name string) error { purgedNames = append(purgedNames, name); return nil },
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs: []resolverRig{
+			{Name: "city", Path: "/city", HQ: true},
+			{Name: "unknown", Path: "/rigs/unknown"},
+		},
+		CityPort:          28231,
+		PortResolution:    PortResolution{Port: 28231, Source: cityConfigDoltPortSource},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if !r.Purge.OK {
+		t.Errorf("Purge.OK = false, want true")
+	}
+	if r.Purge.BytesReclaimed != 300 {
+		t.Fatalf("Purge.BytesReclaimed = %d, want city-config inherited rig bytes included", r.Purge.BytesReclaimed)
+	}
+	wantPurged := []string{"hq", "unknown_db"}
+	if !equalStringSlice(purgedNames, wantPurged) {
+		t.Fatalf("purged DBs = %v, want %v", purgedNames, wantPurged)
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+}
+
+func TestRunDoltCleanup_DryRunSkipsPurgeBytesForInvalidRigPortWithCityConfig(t *testing.T) {
+	portFile := "/rigs/unknown/.beads/dolt-server.port"
+	tests := []struct {
+		name  string
+		setup func(*fsys.Fake)
+	}{
+		{
+			name: "unreadable",
+			setup: func(fs *fsys.Fake) {
+				fs.Files[portFile] = []byte("28231")
+				fs.Errors[portFile] = os.ErrPermission
+			},
+		},
+		{
+			name: "malformed",
+			setup: func(fs *fsys.Fake) {
+				fs.Files[portFile] = []byte("not-a-port")
+			},
+		},
+		{
+			name: "out-of-range",
+			setup: func(fs *fsys.Fake) {
+				fs.Files[portFile] = []byte("70000")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs := fsys.NewFake()
+			fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+			putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+				"db_a/data.bin": 100,
+			})
+			fs.Files["/rigs/unknown/.beads/metadata.json"] = []byte(`{"dolt_database":"unknown_db"}`)
+			putFakeDirTree(fs, "/rigs/unknown/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+				"db_b/data.bin": 200,
+			})
+			tt.setup(fs)
+
+			var stdout, stderr bytes.Buffer
+			opts := cleanupOptions{
+				Rigs: []resolverRig{
+					{Name: "city", Path: "/city", HQ: true},
+					{Name: "unknown", Path: "/rigs/unknown"},
+				},
+				CityPort:          28231,
+				PortResolution:    PortResolution{Port: 28231, Source: cityConfigDoltPortSource},
+				FS:                fs,
+				JSON:              true,
+				DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+			}
+			code := runDoltCleanup(opts, &stdout, &stderr)
+			if code != 0 {
+				t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+			}
+			var r CleanupReport
+			if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+				t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+			}
+			if r.Purge.BytesReclaimed != 100 {
+				t.Fatalf("Purge.BytesReclaimed = %d, want only city rig bytes", r.Purge.BytesReclaimed)
+			}
+			if r.Summary.ErrorsTotal != 0 {
+				t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+			}
+		})
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsPurgeForInvalidRigPortWithCityConfig(t *testing.T) {
+	portFile := "/rigs/unknown/.beads/dolt-server.port"
+	tests := []struct {
+		name  string
+		setup func(*fsys.Fake)
+	}{
+		{
+			name: "unreadable",
+			setup: func(fs *fsys.Fake) {
+				fs.Files[portFile] = []byte("28231")
+				fs.Errors[portFile] = os.ErrPermission
+			},
+		},
+		{
+			name: "malformed",
+			setup: func(fs *fsys.Fake) {
+				fs.Files[portFile] = []byte("not-a-port")
+			},
+		},
+		{
+			name: "out-of-range",
+			setup: func(fs *fsys.Fake) {
+				fs.Files[portFile] = []byte("70000")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs := fsys.NewFake()
+			fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+			putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+				"db_a/data.bin": 100,
+			})
+			fs.Files["/rigs/unknown/.beads/metadata.json"] = []byte(`{"dolt_database":"unknown_db"}`)
+			putFakeDirTree(fs, "/rigs/unknown/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+				"db_b/data.bin": 200,
+			})
+			tt.setup(fs)
+
+			purgedNames := []string{}
+			client := &fakeCleanupDoltClientCustomPurge{
+				databases: []string{"hq", "unknown_db"},
+				onPurge:   func(name string) error { purgedNames = append(purgedNames, name); return nil },
+			}
+
+			var stdout, stderr bytes.Buffer
+			opts := cleanupOptions{
+				Rigs: []resolverRig{
+					{Name: "city", Path: "/city", HQ: true},
+					{Name: "unknown", Path: "/rigs/unknown"},
+				},
+				CityPort:          28231,
+				PortResolution:    PortResolution{Port: 28231, Source: cityConfigDoltPortSource},
+				FS:                fs,
+				JSON:              true,
+				Force:             true,
+				DoltClient:        client,
+				DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+				ReapGracePeriod:   1,
+			}
+			code := runDoltCleanup(opts, &stdout, &stderr)
+			if code != 0 {
+				t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+			}
+			var r CleanupReport
+			if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+				t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+			}
+			if !r.Purge.OK {
+				t.Errorf("Purge.OK = false, want true")
+			}
+			if r.Purge.BytesReclaimed != 100 {
+				t.Fatalf("Purge.BytesReclaimed = %d, want only city rig bytes", r.Purge.BytesReclaimed)
+			}
+			wantPurged := []string{"hq"}
+			if !equalStringSlice(purgedNames, wantPurged) {
+				t.Fatalf("purged DBs = %v, want %v", purgedNames, wantPurged)
+			}
+			if r.Summary.ErrorsTotal != 0 {
+				t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+			}
+		})
+	}
+}
+
+func TestRunDoltCleanup_ForceSkipsPurgeWhenRigPortIsUnknownWithResolvedPort(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/city/.beads/metadata.json"] = []byte(`{"dolt_database":"hq"}`)
+	fs.Files["/city/.beads/dolt-server.port"] = []byte("28231")
+	putFakeDirTree(fs, "/city/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_a/data.bin": 100,
+	})
+	fs.Files["/rigs/unknown/.beads/metadata.json"] = []byte(`{"dolt_database":"unknown_db"}`)
+	putFakeDirTree(fs, "/rigs/unknown/.beads/dolt/.dolt_dropped_databases", map[string]int64{
+		"db_b/data.bin": 200,
+	})
+
+	purgedNames := []string{}
+	client := &fakeCleanupDoltClientCustomPurge{
+		databases: []string{"hq", "unknown_db"},
+		onPurge:   func(name string) error { purgedNames = append(purgedNames, name); return nil },
+	}
+
+	var stdout, stderr bytes.Buffer
+	opts := cleanupOptions{
+		Rigs: []resolverRig{
+			{Name: "city", Path: "/city", HQ: true},
+			{Name: "unknown", Path: "/rigs/unknown"},
+		},
+		FS:                fs,
+		JSON:              true,
+		Force:             true,
+		DoltClient:        client,
+		DiscoverProcesses: func() ([]DoltProcInfo, error) { return nil, nil },
+		ReapGracePeriod:   1,
+	}
+	code := runDoltCleanup(opts, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit=%d, stderr=%q", code, stderr.String())
+	}
+	var r CleanupReport
+	if err := json.Unmarshal(stdout.Bytes(), &r); err != nil {
+		t.Fatalf("Unmarshal: %v\nstdout: %s", err, stdout.String())
+	}
+	if r.Purge.BytesReclaimed != 100 {
+		t.Fatalf("Purge.BytesReclaimed = %d, want only proven resolved-server bytes", r.Purge.BytesReclaimed)
+	}
+	wantPurged := []string{"hq"}
+	if !equalStringSlice(purgedNames, wantPurged) {
+		t.Fatalf("purged DBs = %v, want %v", purgedNames, wantPurged)
+	}
+	if r.Summary.ErrorsTotal != 0 {
+		t.Fatalf("Summary.ErrorsTotal = %d, want 0; errors=%+v", r.Summary.ErrorsTotal, r.Errors)
+	}
+}
+
+// fakeCleanupDoltClientCustomPurge is like fakeCleanupDoltClient but lets a
+// test inject custom purge behavior so it can exercise failure paths and
+// observe call order.
+type fakeCleanupDoltClientCustomPurge struct {
+	databases []string
+	onPurge   func(name string) error
+}
+
+func (f *fakeCleanupDoltClientCustomPurge) ListDatabases(_ context.Context) ([]string, error) {
+	return append([]string{}, f.databases...), nil
+}
+
+func (f *fakeCleanupDoltClientCustomPurge) DropDatabase(_ context.Context, _ string) error {
+	return nil
+}
+
+func (f *fakeCleanupDoltClientCustomPurge) PurgeDroppedDatabases(_ context.Context, name string) error {
+	if f.onPurge != nil {
+		return f.onPurge(name)
+	}
+	return nil
+}
+
+func (f *fakeCleanupDoltClientCustomPurge) Close() error { return nil }
+
+type purgeConnRecord struct {
+	connID int
+	query  string
+}
+
+var purgeConnRecorder = struct {
+	sync.Mutex
+	nextConnID int
+	execs      []purgeConnRecord
+}{}
+
+func init() {
+	sql.Register("gc_cleanup_purge_conn_recorder", purgeConnRecorderDriver{})
+}
+
+func resetPurgeConnRecorder() {
+	purgeConnRecorder.Lock()
+	defer purgeConnRecorder.Unlock()
+	purgeConnRecorder.nextConnID = 0
+	purgeConnRecorder.execs = nil
+}
+
+func purgeConnRecorderExecs() []purgeConnRecord {
+	purgeConnRecorder.Lock()
+	defer purgeConnRecorder.Unlock()
+	out := make([]purgeConnRecord, len(purgeConnRecorder.execs))
+	copy(out, purgeConnRecorder.execs)
+	return out
+}
+
+type purgeConnRecorderDriver struct{}
+
+func (purgeConnRecorderDriver) Open(_ string) (driver.Conn, error) {
+	purgeConnRecorder.Lock()
+	defer purgeConnRecorder.Unlock()
+	purgeConnRecorder.nextConnID++
+	return &purgeConnRecorderConn{id: purgeConnRecorder.nextConnID}, nil
+}
+
+type purgeConnRecorderConn struct {
+	id int
+}
+
+func (c *purgeConnRecorderConn) Prepare(_ string) (driver.Stmt, error) {
+	return nil, errors.New("prepare unsupported")
+}
+
+func (c *purgeConnRecorderConn) Close() error { return nil }
+
+func (c *purgeConnRecorderConn) Begin() (driver.Tx, error) {
+	return nil, errors.New("transactions unsupported")
+}
+
+func (c *purgeConnRecorderConn) ExecContext(_ context.Context, query string, _ []driver.NamedValue) (driver.Result, error) {
+	purgeConnRecorder.Lock()
+	defer purgeConnRecorder.Unlock()
+	purgeConnRecorder.execs = append(purgeConnRecorder.execs, purgeConnRecord{connID: c.id, query: query})
+	return driver.RowsAffected(0), nil
+}
diff --git a/cmd/gc/dolt_cleanup_reaper.go b/cmd/gc/dolt_cleanup_reaper.go
new file mode 100644
index 0000000000..3a7173c4bf
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_reaper.go
@@ -0,0 +1,213 @@
+package main
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+)
+
+// DoltProcInfo describes a live `dolt sql-server` process candidate.
+//
+// PID is the OS pid; Argv is the raw command line split on NUL boundaries
+// (typically read from /proc/<pid>/cmdline). Ports lists the TCP ports the
+// process is listening on, used to cross-reference against active per-rig
+// dolt servers so the reaper never touches a production server. RSSBytes is
+// the best-effort resident set size used for operator cleanup summaries.
+// StartTimeTicks is /proc/<pid>/stat field 22 and lets force-mode revalidation
+// detect PID reuse before sending a signal.
+type DoltProcInfo struct {
+	PID            int
+	Argv           []string
+	Ports          []int
+	RSSBytes       int64
+	StartTimeTicks uint64
+}
+
+// reapClassification is the per-process decision produced by classifyDoltProcess.
+//
+// Action is "reap" or "protect". For reap, ConfigPath carries the test-config
+// path that matched the allowlist. For protect, Reason explains why so the
+// operator-facing report can echo it (e.g. "active rig dolt server (rig: beads)").
+type reapClassification struct {
+	Action     string
+	Reason     string
+	ConfigPath string
+}
+
+// ReapTarget is a single PID slated for SIGTERM+SIGKILL during the reap stage.
+type ReapTarget struct {
+	PID            int
+	ConfigPath     string
+	RSSBytes       int64
+	StartTimeTicks uint64
+}
+
+// ProtectedProcess is a single PID that the reaper refused to kill, with the
+// reason recorded so the report can show operators why nothing was done.
+type ProtectedProcess struct {
+	PID    int
+	Reason string
+}
+
+// ReapPlan is the outcome of planOrphanReap. Reap is the orphan list; Protected
+// covers production-side rigs and unknown processes that fall outside the
+// test-config-path allowlist (e.g. an active benchmark).
+type ReapPlan struct {
+	Reap      []ReapTarget
+	Protected []ProtectedProcess
+}
+
+// extractConfigPath pulls the --config <path> argument from a dolt sql-server
+// argv. Supports both `--config foo` and `--config=foo` forms; returns empty
+// when the flag is absent or has no value.
+func extractConfigPath(argv []string) string {
+	for i, arg := range argv {
+		if arg == "--config" {
+			if i+1 < len(argv) {
+				return argv[i+1]
+			}
+			return ""
+		}
+		if strings.HasPrefix(arg, "--config=") {
+			return strings.TrimPrefix(arg, "--config=")
+		}
+	}
+	return ""
+}
+
+// isTestConfigPath reports whether p matches the cleanup allowlist for test
+// Dolt configs: Go test temp roots, plus known Gas City unit-test prefixes
+// that use short socket-safe directories under os.TempDir().
+func isTestConfigPath(p, homeDir, tempDir string) bool {
+	if p == "" {
+		return false
+	}
+	clean := filepath.Clean(p)
+	if hasTestChildPrefix(clean, "/tmp", testConfigPathPrefixes()) {
+		return true
+	}
+	if hasTestChildPrefix(clean, tempDir, testConfigPathPrefixes()) {
+		return true
+	}
+	if homeDir == "" {
+		return false
+	}
+	return hasTestChildPrefix(clean, filepath.Join(homeDir, ".gotmp"), []string{"Test"})
+}
+
+func testConfigPathPrefixes() []string {
+	return []string{
+		"Test",
+		"gc-state-runtime-builtin-",
+		"gc-state-mutation-builtin-",
+		"gc-supervisor-city-",
+		"gc-reload-invalid-",
+		"gc-rename-",
+	}
+}
+
+func hasTestChildPrefix(cleanPath, root string, prefixes []string) bool {
+	if root == "" {
+		return false
+	}
+	cleanRoot := filepath.Clean(root)
+	if cleanRoot == "." || cleanRoot == string(filepath.Separator) {
+		return false
+	}
+	rootPrefix := cleanRoot + string(filepath.Separator)
+	if !strings.HasPrefix(cleanPath, rootPrefix) {
+		return false
+	}
+	child := strings.TrimPrefix(cleanPath, rootPrefix)
+	for _, prefix := range prefixes {
+		if strings.HasPrefix(child, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func configUnderActiveTestRoot(configPath string, activeTestRoots []string) bool {
+	if configPath == "" {
+		return false
+	}
+	cleanConfig := filepath.Clean(configPath)
+	for _, root := range activeTestRoots {
+		cleanRoot := filepath.Clean(root)
+		if cleanRoot == "." || cleanRoot == string(filepath.Separator) {
+			continue
+		}
+		if cleanConfig == cleanRoot || strings.HasPrefix(cleanConfig, cleanRoot+string(filepath.Separator)) {
+			return true
+		}
+	}
+	return false
+}
+
+// classifyDoltProcess applies the architect's reaper decision rules (§4.3) to a
+// single dolt sql-server process. Order matters:
+//
+//  1. Any port match against rigPortByPort → protected (active rig server),
+//     even if the cmdline says it's a test path (defense in depth).
+//  2. Else extract --config path; matches /tmp/Test*, os.TempDir()/Test*,
+//     known Gas City temp prefixes → reap.
+//  3. Else protect if the config sits under an active test root.
+//  4. Else protect with a reason that echoes the actual config path so
+//     operators can decide whether to kill it manually (architect Open Q 0).
+func classifyDoltProcess(p DoltProcInfo, rigPortByPort map[int]string, homeDir, tempDir string, activeTestRoots []string) reapClassification {
+	for _, port := range p.Ports {
+		if name, ok := rigPortByPort[port]; ok {
+			return reapClassification{
+				Action: "protect",
+				Reason: fmt.Sprintf("active rig dolt server (rig: %s, port: %d)", name, port),
+			}
+		}
+	}
+
+	cfgPath := extractConfigPath(p.Argv)
+	if cfgPath == "" {
+		return reapClassification{
+			Action: "protect",
+			Reason: "no --config path detected; refusing to kill an unidentified dolt server",
+		}
+	}
+	if configUnderActiveTestRoot(cfgPath, activeTestRoots) {
+		return reapClassification{
+			Action:     "protect",
+			Reason:     fmt.Sprintf("config %q is under an active test root", cfgPath),
+			ConfigPath: cfgPath,
+		}
+	}
+	if isTestConfigPath(cfgPath, homeDir, tempDir) {
+		return reapClassification{Action: "reap", ConfigPath: cfgPath}
+	}
+	return reapClassification{
+		Action: "protect",
+		Reason: fmt.Sprintf("config %q not on test-config-path allowlist; kill manually if not wanted", cfgPath),
+		// ConfigPath echoed so the human-readable layout (Wireframe 4) can
+		// render the tree-style annotation alongside the port and reason.
+		ConfigPath: cfgPath,
+	}
+}
+
+// planOrphanReap classifies each dolt sql-server process and partitions them
+// into reap targets vs protected processes. Order is preserved so the report
+// renders deterministically.
+func planOrphanReap(procs []DoltProcInfo, rigPortByPort map[int]string, homeDir, tempDir string, activeTestRoots []string) ReapPlan {
+	plan := ReapPlan{}
+	for _, p := range procs {
+		c := classifyDoltProcess(p, rigPortByPort, homeDir, tempDir, activeTestRoots)
+		switch c.Action {
+		case "reap":
+			plan.Reap = append(plan.Reap, ReapTarget{
+				PID:            p.PID,
+				ConfigPath:     c.ConfigPath,
+				RSSBytes:       p.RSSBytes,
+				StartTimeTicks: p.StartTimeTicks,
+			})
+		default:
+			plan.Protected = append(plan.Protected, ProtectedProcess{PID: p.PID, Reason: c.Reason})
+		}
+	}
+	return plan
+}
diff --git a/cmd/gc/dolt_cleanup_reaper_test.go b/cmd/gc/dolt_cleanup_reaper_test.go
new file mode 100644
index 0000000000..b6dbb2b3b9
--- /dev/null
+++ b/cmd/gc/dolt_cleanup_reaper_test.go
@@ -0,0 +1,213 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestExtractConfigPath_SpaceSeparated(t *testing.T) {
+	argv := []string{"dolt", "sql-server", "--config", "/tmp/TestFoo123/config.yaml"}
+	got := extractConfigPath(argv)
+	want := "/tmp/TestFoo123/config.yaml"
+	if got != want {
+		t.Errorf("extractConfigPath() = %q, want %q", got, want)
+	}
+}
+
+func TestExtractConfigPath_EqualsForm(t *testing.T) {
+	argv := []string{"dolt", "sql-server", "--config=/tmp/TestFoo/config.yaml"}
+	got := extractConfigPath(argv)
+	want := "/tmp/TestFoo/config.yaml"
+	if got != want {
+		t.Errorf("extractConfigPath() = %q, want %q", got, want)
+	}
+}
+
+func TestExtractConfigPath_Missing(t *testing.T) {
+	argv := []string{"dolt", "sql-server", "--port", "3307"}
+	got := extractConfigPath(argv)
+	if got != "" {
+		t.Errorf("extractConfigPath() = %q, want empty", got)
+	}
+}
+
+func TestExtractConfigPath_FlagAtEnd(t *testing.T) {
+	// --config with no value should return empty (malformed cmdline).
+	argv := []string{"dolt", "sql-server", "--config"}
+	got := extractConfigPath(argv)
+	if got != "" {
+		t.Errorf("extractConfigPath() = %q, want empty for trailing --config", got)
+	}
+}
+
+func TestIsTestConfigPath_TmpTestPrefix(t *testing.T) {
+	if !isTestConfigPath("/tmp/TestOrchestrator123/config.yaml", "/home/u", "") {
+		t.Error("expected /tmp/Test* to be a test path")
+	}
+}
+
+func TestIsTestConfigPath_HomeGotmpTestPrefix(t *testing.T) {
+	if !isTestConfigPath("/home/u/.gotmp/TestFuzz/config.yaml", "/home/u", "") {
+		t.Error("expected $HOME/.gotmp/Test* to be a test path")
+	}
+}
+
+func TestIsTestConfigPath_ProcessTempDirTestPrefix(t *testing.T) {
+	if !isTestConfigPath("/var/tmp/go-test/TestRepro/config.yaml", "/home/u", "/var/tmp/go-test") {
+		t.Error("expected os.TempDir()/Test* to be a test path")
+	}
+}
+
+func TestIsTestConfigPath_KnownGCTestPrefix(t *testing.T) {
+	if !isTestConfigPath("/data/tmp/gc-state-mutation-builtin-123/.gc/runtime/packs/dolt/dolt-config.yaml", "/home/u", "/data/tmp") {
+		t.Error("expected known gc-* test prefix under os.TempDir() to be a test path")
+	}
+}
+
+func TestIsTestConfigPath_NotTest(t *testing.T) {
+	cases := []string{
+		"/tmp/be-s9d-bench-dolt/config.yaml", // benchmark
+		"/var/lib/dolt/config.yaml",          // production-ish
+		"/tmp/random/config.yaml",            // tmp but not Test prefix
+		"/home/u/.gotmp/other/config.yaml",   // gotmp but not Test prefix
+		"/var/tmp/go-test/Other/config.yaml", // temp root but not Test prefix
+		"",                                   // missing
+	}
+	for _, p := range cases {
+		if isTestConfigPath(p, "/home/u", "/var/tmp/go-test") {
+			t.Errorf("isTestConfigPath(%q) = true, want false", p)
+		}
+	}
+}
+
+func TestClassifyDoltProcess_ProtectedByRigPort(t *testing.T) {
+	p := DoltProcInfo{
+		PID:   1234,
+		Argv:  []string{"dolt", "sql-server", "--config", "/tmp/TestFoo/config.yaml"},
+		Ports: []int{28231},
+	}
+	got := classifyDoltProcess(p, map[int]string{28231: "beads"}, "/home/u", "", nil)
+
+	if got.Action != "protect" {
+		t.Errorf("Action = %q, want protect", got.Action)
+	}
+	if got.Reason == "" || !strings.Contains(got.Reason, "rig") || !strings.Contains(got.Reason, "beads") {
+		t.Errorf("Reason = %q, want rig+beads reference", got.Reason)
+	}
+}
+
+func TestClassifyDoltProcess_OrphanByTestPath(t *testing.T) {
+	p := DoltProcInfo{
+		PID:   2222,
+		Argv:  []string{"dolt", "sql-server", "--config", "/tmp/TestMailRouter9182/config.yaml"},
+		Ports: []int{},
+	}
+	got := classifyDoltProcess(p, nil, "/home/u", "", nil)
+
+	if got.Action != "reap" {
+		t.Errorf("Action = %q, want reap", got.Action)
+	}
+	if got.ConfigPath != "/tmp/TestMailRouter9182/config.yaml" {
+		t.Errorf("ConfigPath = %q", got.ConfigPath)
+	}
+}
+
+func TestClassifyDoltProcess_ProtectsActiveTestRoot(t *testing.T) {
+	p := DoltProcInfo{
+		PID:   2223,
+		Argv:  []string{"dolt", "sql-server", "--config", "/tmp/TestPersonalWorkFormulaCompileAndRun123/001/city/.gc/runtime/packs/dolt/dolt-config.yaml"},
+		Ports: []int{},
+	}
+	got := classifyDoltProcess(p, nil, "/home/u", "", []string{"/tmp/TestPersonalWorkFormulaCompileAndRun123"})
+
+	if got.Action != "protect" {
+		t.Errorf("Action = %q, want protect", got.Action)
+	}
+	if !strings.Contains(got.Reason, "active test root") {
+		t.Errorf("Reason = %q, want active-test-root reason", got.Reason)
+	}
+}
+
+func TestClassifyDoltProcess_ProtectedByPathNotOnAllowlist(t *testing.T) {
+	// Active benchmark — config path doesn't match /tmp/Test*.
+	p := DoltProcInfo{
+		PID:   3333,
+		Argv:  []string{"dolt", "sql-server", "--config", "/tmp/be-s9d-bench-dolt/config.yaml"},
+		Ports: []int{33400},
+	}
+	got := classifyDoltProcess(p, nil, "/home/u", "", nil)
+
+	if got.Action != "protect" {
+		t.Errorf("Action = %q, want protect", got.Action)
+	}
+	if !strings.Contains(got.Reason, "allowlist") {
+		t.Errorf("Reason = %q, want mention of allowlist", got.Reason)
+	}
+	// Reason should echo the actual config path so operators can see it.
+	if !strings.Contains(got.Reason, "/tmp/be-s9d-bench-dolt") {
+		t.Errorf("Reason = %q, want config path echoed (architect Open Q 0)", got.Reason)
+	}
+}
+
+func TestClassifyDoltProcess_ProtectedWhenConfigMissing(t *testing.T) {
+	p := DoltProcInfo{
+		PID:   4444,
+		Argv:  []string{"dolt", "sql-server"},
+		Ports: []int{},
+	}
+	got := classifyDoltProcess(p, nil, "/home/u", "", nil)
+
+	if got.Action != "protect" {
+		t.Errorf("Action = %q, want protect", got.Action)
+	}
+	if !strings.Contains(got.Reason, "config") {
+		t.Errorf("Reason = %q, want config-path-related reason", got.Reason)
+	}
+}
+
+func TestClassifyDoltProcess_RigPortBeatsConfigPath(t *testing.T) {
+	// Even if the cmdline says /tmp/Test*, a rig-port match always protects.
+	p := DoltProcInfo{
+		PID:   5555,
+		Argv:  []string{"dolt", "sql-server", "--config", "/tmp/TestSomething/config.yaml"},
+		Ports: []int{28231},
+	}
+	got := classifyDoltProcess(p, map[int]string{28231: "beads"}, "/home/u", "", nil)
+
+	if got.Action != "protect" {
+		t.Errorf("Action = %q, want protect (rig port wins)", got.Action)
+	}
+}
+
+func TestPlanReap_BuildsOrphanAndProtectedLists(t *testing.T) {
+	procs := []DoltProcInfo{
+		{PID: 1138290, Ports: []int{28231}, Argv: []string{"dolt", "sql-server"}},
+		{PID: 1281044, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestA/config.yaml"}},
+		{PID: 1319499, Ports: []int{33400}, Argv: []string{"dolt", "sql-server", "--config", "/tmp/be-s9d-bench-dolt/config.yaml"}},
+		{PID: 1281099, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestB/config.yaml"}},
+		{PID: 1281100, Argv: []string{"dolt", "sql-server", "--config", "/data/tmp/gc-state-runtime-builtin-1/.gc/runtime/packs/dolt/dolt-config.yaml"}},
+		{PID: 1281101, Argv: []string{"dolt", "sql-server", "--config", "/tmp/TestActive/001/city/.gc/runtime/packs/dolt/dolt-config.yaml"}},
+	}
+	rigPorts := map[int]string{28231: "beads"}
+
+	plan := planOrphanReap(procs, rigPorts, "/home/u", "/data/tmp", []string{"/tmp/TestActive"})
+
+	wantReap := []int{1281044, 1281099, 1281100}
+	gotReap := make([]int, 0, len(plan.Reap))
+	for _, target := range plan.Reap {
+		gotReap = append(gotReap, target.PID)
+	}
+	if !reflect.DeepEqual(gotReap, wantReap) {
+		t.Errorf("Reap PIDs = %v, want %v", gotReap, wantReap)
+	}
+
+	wantProtected := []int{1138290, 1319499, 1281101}
+	gotProtected := make([]int, 0, len(plan.Protected))
+	for _, e := range plan.Protected {
+		gotProtected = append(gotProtected, e.PID)
+	}
+	if !reflect.DeepEqual(gotProtected, wantProtected) {
+		t.Errorf("Protected PIDs = %v, want %v", gotProtected, wantProtected)
+	}
+}
diff --git a/cmd/gc/dolt_gc_nudge_script_test.go b/cmd/gc/dolt_gc_nudge_script_test.go
index c4c32bf63f..6bf88aeb70 100644
--- a/cmd/gc/dolt_gc_nudge_script_test.go
+++ b/cmd/gc/dolt_gc_nudge_script_test.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"hash/fnv"
 	"net"
 	"os"
 	"os/exec"
@@ -462,7 +463,7 @@ func TestDoltGCNudgeLockIgnoresDifferentTmpDirs(t *testing.T) {
 	if err != nil {
 		t.Fatalf("LookPath(sleep): %v", err)
 	}
-	lockDir := filepath.Join("/tmp", "gc-dolt-gc", "127.0.0.1-3307.lock.d")
+	lockDir := doltGCNudgeTestLockDir(t)
 	_ = os.RemoveAll(lockDir)
 	t.Cleanup(func() { _ = os.RemoveAll(lockDir) })
 
@@ -526,7 +527,7 @@ func TestDoltGCNudgeRecoversStaleLockMarker(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			cityPath := writeDoltGCNudgeCity(t)
 			captureDir := t.TempDir()
-			lockDir := filepath.Join("/tmp", "gc-dolt-gc", "127.0.0.1-3307.lock.d")
+			lockDir := doltGCNudgeTestLockDir(t)
 			_ = os.RemoveAll(lockDir)
 			t.Cleanup(func() { _ = os.RemoveAll(lockDir) })
 			if err := os.MkdirAll(lockDir, 0o700); err != nil {
@@ -1003,10 +1004,34 @@ func doltGCNudgeCommand(t *testing.T, cityPath, binDir string, extraEnv ...strin
 		baseEnv = append(baseEnv, "GC_DOLT_MANAGED_LOCAL=1")
 	}
 	cmd.Env = append([]string{}, baseEnv...)
+	extraEnv = doltGCNudgeIsolatedEnv(t, extraEnv)
 	cmd.Env = append(cmd.Env, extraEnv...)
 	return cmd
 }
 
+func doltGCNudgeIsolatedEnv(t *testing.T, env []string) []string {
+	t.Helper()
+	out := append([]string{}, env...)
+	for i, entry := range out {
+		if entry == "GC_DOLT_PORT=3307" {
+			out[i] = "GC_DOLT_PORT=" + doltGCNudgeTestPort(t)
+		}
+	}
+	return out
+}
+
+func doltGCNudgeTestLockDir(t *testing.T) string {
+	t.Helper()
+	return filepath.Join("/tmp", "gc-dolt-gc", "127.0.0.1-"+doltGCNudgeTestPort(t)+".lock.d")
+}
+
+func doltGCNudgeTestPort(t *testing.T) string {
+	t.Helper()
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(t.Name()))
+	return strconv.Itoa(20000 + int(h.Sum32()%20000))
+}
+
 func doltGCNudgeEnvHasKey(env []string, key string) bool {
 	prefix := key + "="
 	for _, entry := range env {
diff --git a/cmd/gc/dolt_port_selection.go b/cmd/gc/dolt_port_selection.go
index 8f96868710..4135c35aca 100644
--- a/cmd/gc/dolt_port_selection.go
+++ b/cmd/gc/dolt_port_selection.go
@@ -45,8 +45,33 @@ func chooseManagedDoltPort(cityPath, stateFile string) (string, error) {
 			}
 			return strconv.Itoa(repaired.Port), nil
 		}
+		if hint, found, hintErr := readPublishedDoltRuntimeStateHint(cityPath); hintErr == nil && found {
+			if repaired, ok := repairedManagedDoltRuntimeState(cityPath, layout, hint); ok {
+				if err := writeDoltRuntimeStateFile(stateFile, repaired); err != nil {
+					return "", fmt.Errorf("repair provider runtime state from published hint: %w", err)
+				}
+				if samePath(stateFile, canonicalStateFile) {
+					if err := publishManagedDoltRuntimeStateIfOwned(cityPath); err != nil {
+						return "", fmt.Errorf("publish repaired managed dolt runtime state: %w", err)
+					}
+				}
+				return strconv.Itoa(repaired.Port), nil
+			}
+		}
 	} else if !os.IsNotExist(err) {
 		return "", fmt.Errorf("read provider runtime state: %w", err)
+	} else if hint, found, hintErr := readPublishedDoltRuntimeStateHint(cityPath); hintErr == nil && found {
+		if repaired, ok := repairedManagedDoltRuntimeState(cityPath, layout, hint); ok {
+			if err := writeDoltRuntimeStateFile(stateFile, repaired); err != nil {
+				return "", fmt.Errorf("repair missing provider runtime state: %w", err)
+			}
+			if samePath(stateFile, canonicalStateFile) {
+				if err := publishManagedDoltRuntimeStateIfOwned(cityPath); err != nil {
+					return "", fmt.Errorf("publish repaired managed dolt runtime state: %w", err)
+				}
+			}
+			return strconv.Itoa(repaired.Port), nil
+		}
 	}
 	seed := deterministicManagedDoltPortSeed(cityPath)
 	return strconv.Itoa(nextAvailableManagedDoltPort(seed)), nil
diff --git a/cmd/gc/dolt_preflight_cleanup.go b/cmd/gc/dolt_preflight_cleanup.go
index d8d7dfac53..f875f8e01e 100644
--- a/cmd/gc/dolt_preflight_cleanup.go
+++ b/cmd/gc/dolt_preflight_cleanup.go
@@ -8,15 +8,19 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 )
 
-var managedDoltPreflightCleanupFn = preflightManagedDoltCleanup
+var (
+	managedDoltPreflightCleanupFn     = preflightManagedDoltCleanup
+	retiredManagedDoltDatabasePattern = regexp.MustCompile(`^.+\.replaced-[0-9]{8}T[0-9]{6}Z$`)
+)
 
-const managedDoltLsofTimeout = 500 * time.Millisecond
+const managedDoltLsofTimeout = 3 * time.Second
 
 func preflightManagedDoltCleanup(cityPath string) error {
 	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
@@ -112,11 +116,15 @@ func quarantinePhantomManagedDoltDatabases(dataDir string, now time.Time) error
 		if !info.IsDir() {
 			continue
 		}
-		manifest := filepath.Join(doltDir, "noms", "manifest")
-		if _, err := os.Stat(manifest); err == nil {
-			continue
-		} else if !os.IsNotExist(err) {
-			return err
+		reason := "retired replacement"
+		if !retiredManagedDoltDatabaseName(entry.Name()) {
+			reason = "missing noms/manifest"
+			manifest := filepath.Join(doltDir, "noms", "manifest")
+			if _, err := os.Stat(manifest); err == nil {
+				continue
+			} else if !os.IsNotExist(err) {
+				return err
+			}
 		}
 		if err := os.MkdirAll(quarantineRoot, 0o755); err != nil {
 			return err
@@ -128,11 +136,16 @@ func quarantinePhantomManagedDoltDatabases(dataDir string, now time.Time) error
 		if err := os.Rename(dbDir, dest); err != nil {
 			return err
 		}
-		fmt.Fprintf(os.Stderr, "gc dolt preflight: quarantined phantom database %s -> %s\n", dbDir, dest) //nolint:errcheck // best-effort warning
+		fmt.Fprintf(os.Stderr, "gc dolt preflight: quarantined unservable database (%s) %s -> %s\n", reason, dbDir, dest) //nolint:errcheck // best-effort warning
 	}
 	return nil
 }
 
+func retiredManagedDoltDatabaseName(name string) bool {
+	name = strings.TrimSpace(name)
+	return retiredManagedDoltDatabasePattern.MatchString(name)
+}
+
 func uniqueQuarantineDestination(root, stamp, name string) (string, error) {
 	base := filepath.Join(root, stamp+"-"+name)
 	if _, err := os.Stat(base); os.IsNotExist(err) {
diff --git a/cmd/gc/dolt_preflight_cleanup_test.go b/cmd/gc/dolt_preflight_cleanup_test.go
index 0d9f3b0be1..bd14d32ed5 100644
--- a/cmd/gc/dolt_preflight_cleanup_test.go
+++ b/cmd/gc/dolt_preflight_cleanup_test.go
@@ -64,7 +64,7 @@ func TestFileOpenedByAnyProcessBoundsLsof(t *testing.T) {
 		t.Fatal(err)
 	}
 	binDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(binDir, "lsof"), []byte("#!/bin/sh\nexec sleep 2\n"), 0o755); err != nil {
+	if err := os.WriteFile(filepath.Join(binDir, "lsof"), []byte("#!/bin/sh\nexec sleep 10\n"), 0o755); err != nil {
 		t.Fatalf("WriteFile(lsof): %v", err)
 	}
 	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
@@ -77,7 +77,7 @@ func TestFileOpenedByAnyProcessBoundsLsof(t *testing.T) {
 	if open {
 		t.Fatal("fileOpenedByAnyProcess() = true, want false when lsof times out")
 	}
-	if elapsed := time.Since(start); elapsed > 3*time.Second {
+	if elapsed := time.Since(start); elapsed > 4*time.Second {
 		t.Fatalf("fileOpenedByAnyProcess() took %s, want bounded timeout", elapsed)
 	}
 }
@@ -106,6 +106,70 @@ func TestRemoveStaleManagedDoltLocksWithoutLsofUsesAvailableState(t *testing.T)
 	}
 }
 
+func TestQuarantinePhantomManagedDoltDatabasesQuarantinesRetiredReplacementDB(t *testing.T) {
+	dataDir := t.TempDir()
+	activeManifest := filepath.Join(dataDir, "ga", ".dolt", "noms", "manifest")
+	if err := os.MkdirAll(filepath.Dir(activeManifest), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(activeManifest, []byte("active\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	retiredManifest := filepath.Join(dataDir, "ga.replaced-20260428T100722Z", ".dolt", "noms", "manifest")
+	if err := os.MkdirAll(filepath.Dir(retiredManifest), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(retiredManifest, []byte("retired\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	replacementLikeManifest := filepath.Join(dataDir, "ga.replaced-pending", ".dolt", "noms", "manifest")
+	if err := os.MkdirAll(filepath.Dir(replacementLikeManifest), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(replacementLikeManifest, []byte("active\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	now := time.Date(2026, 4, 29, 16, 20, 0, 0, time.UTC)
+	if err := quarantinePhantomManagedDoltDatabases(dataDir, now); err != nil {
+		t.Fatalf("quarantinePhantomManagedDoltDatabases: %v", err)
+	}
+
+	if _, err := os.Stat(activeManifest); err != nil {
+		t.Fatalf("active manifest stat: %v", err)
+	}
+	if _, err := os.Stat(replacementLikeManifest); err != nil {
+		t.Fatalf("replacement-like active manifest stat: %v", err)
+	}
+	if _, err := os.Stat(retiredManifest); !os.IsNotExist(err) {
+		t.Fatalf("retired manifest stat err = %v, want moved out of data dir", err)
+	}
+	quarantined := filepath.Join(dataDir, ".quarantine", "20260429T162000-ga.replaced-20260428T100722Z", ".dolt", "noms", "manifest")
+	if _, err := os.Stat(quarantined); err != nil {
+		t.Fatalf("quarantined manifest stat: %v", err)
+	}
+}
+
+func TestRetiredManagedDoltDatabaseNameRequiresTimestampSuffix(t *testing.T) {
+	tests := []struct {
+		name string
+		want bool
+	}{
+		{name: "ga.replaced-20260428T100722Z", want: true},
+		{name: "ga.replaced-20260428T100722Z.bak", want: false},
+		{name: "ga.replaced-20260428T100722", want: false},
+		{name: "ga.replaced-pending", want: false},
+		{name: "replaced-20260428T100722Z", want: false},
+		{name: ".replaced-20260428T100722Z", want: false},
+		{name: "ga", want: false},
+	}
+	for _, tt := range tests {
+		if got := retiredManagedDoltDatabaseName(tt.name); got != tt.want {
+			t.Fatalf("retiredManagedDoltDatabaseName(%q) = %v, want %v", tt.name, got, tt.want)
+		}
+	}
+}
+
 func TestRemoveStaleManagedDoltSocketsWithoutLsofKeepsSocket(t *testing.T) {
 	socketPath := filepath.Join("/tmp", "dolt-preflight-cleanup-live-test.sock")
 	_ = os.Remove(socketPath)
diff --git a/cmd/gc/dolt_project_id.go b/cmd/gc/dolt_project_id.go
index 2476b9c4e9..b315c41fb8 100644
--- a/cmd/gc/dolt_project_id.go
+++ b/cmd/gc/dolt_project_id.go
@@ -239,12 +239,23 @@ func seedDatabaseProjectID(ctx context.Context, db *sql.DB, projectID string) (b
 		}
 		return false, nil
 	}
+	if err := ensureDatabaseMetadataTable(ctx, db); err != nil {
+		return false, err
+	}
 	if _, err := db.ExecContext(ctx, "INSERT INTO metadata (`key`, value) VALUES ('_project_id', ?) ON DUPLICATE KEY UPDATE value = VALUES(value)", projectID); err != nil {
 		return false, fmt.Errorf("seed database _project_id: %w", err)
 	}
 	return true, nil
 }
 
+func ensureDatabaseMetadataTable(ctx context.Context, db *sql.DB) error {
+	_, err := db.ExecContext(ctx, "CREATE TABLE IF NOT EXISTS metadata (`key` VARCHAR(255) PRIMARY KEY, value LONGTEXT)")
+	if err != nil {
+		return fmt.Errorf("ensure metadata table: %w", err)
+	}
+	return nil
+}
+
 func generateLocalProjectID() (string, error) {
 	buf := make([]byte, 16)
 	if _, err := rand.Read(buf); err != nil {
diff --git a/cmd/gc/dolt_project_id_test.go b/cmd/gc/dolt_project_id_test.go
index 0a389722a1..f2989b3e59 100644
--- a/cmd/gc/dolt_project_id_test.go
+++ b/cmd/gc/dolt_project_id_test.go
@@ -23,6 +23,7 @@ func TestEnsureManagedDoltProjectIDGeneratesLocalIdentityWhenMetadataAndDatabase
 			t.Skip("dolt not installed")
 		}
 	}
+	bdPath := waitTestRealBDPath(t)
 
 	cityDir := t.TempDir()
 	if err := os.MkdirAll(filepath.Join(cityDir, ".gc"), 0o755); err != nil {
@@ -48,7 +49,7 @@ func TestEnsureManagedDoltProjectIDGeneratesLocalIdentityWhenMetadataAndDatabase
 	t.Setenv("GC_CITY_PATH", cityDir)
 	t.Setenv("GC_BEADS", "bd")
 	t.Setenv("GC_DOLT", "")
-	t.Setenv("PATH", strings.Join([]string{"/home/ubuntu/.local/bin", filepath.Dir(doltPath), os.Getenv("PATH")}, string(os.PathListSeparator)))
+	t.Setenv("PATH", strings.Join([]string{filepath.Dir(bdPath), filepath.Dir(doltPath), os.Getenv("PATH")}, string(os.PathListSeparator)))
 
 	if err := ensureBeadsProvider(cityDir); err != nil {
 		t.Fatalf("ensureBeadsProvider: %v", err)
diff --git a/cmd/gc/dolt_recover_managed.go b/cmd/gc/dolt_recover_managed.go
index e69d667661..cb77538ba9 100644
--- a/cmd/gc/dolt_recover_managed.go
+++ b/cmd/gc/dolt_recover_managed.go
@@ -109,7 +109,7 @@ func recoverManagedDoltProcess(cityPath, host, port, user, logLevel string, time
 	}
 	time.Sleep(time.Second)
 
-	startReport, err := startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel, timeout, false)
+	startReport, err := startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel, -1, timeout, false)
 	report.Ready = startReport.Ready
 	if startReport.PID > 0 {
 		report.PID = startReport.PID
diff --git a/cmd/gc/dolt_recover_managed_test.go b/cmd/gc/dolt_recover_managed_test.go
new file mode 100644
index 0000000000..bbc94219bf
--- /dev/null
+++ b/cmd/gc/dolt_recover_managed_test.go
@@ -0,0 +1,131 @@
+package main
+
+import (
+	"testing"
+	"time"
+)
+
+func TestRecoverManagedDoltExistingObserveTimeout(t *testing.T) {
+	tests := []struct {
+		name    string
+		timeout time.Duration
+		want    time.Duration
+	}{
+		{name: "zero defaults to 5s", timeout: 0, want: 5 * time.Second},
+		{name: "negative defaults to 5s", timeout: -1, want: 5 * time.Second},
+		{name: "below 5s returns input", timeout: 2 * time.Second, want: 2 * time.Second},
+		{name: "exactly 5s returns 5s", timeout: 5 * time.Second, want: 5 * time.Second},
+		{name: "above 5s capped at 5s", timeout: 30 * time.Second, want: 5 * time.Second},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := recoverManagedDoltExistingObserveTimeout(tt.timeout); got != tt.want {
+				t.Errorf("recoverManagedDoltExistingObserveTimeout(%v) = %v, want %v", tt.timeout, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRecoverManagedDoltShouldReuseExisting(t *testing.T) {
+	tests := []struct {
+		name          string
+		existingPort  int
+		requestedPort string
+		want          bool
+	}{
+		{name: "zero port never reuses", existingPort: 0, requestedPort: "3306", want: false},
+		{name: "negative port never reuses", existingPort: -1, requestedPort: "3306", want: false},
+		{name: "empty requested always reuses", existingPort: 3306, requestedPort: "", want: true},
+		{name: "whitespace requested always reuses", existingPort: 3306, requestedPort: "  ", want: true},
+		{name: "different port reuses", existingPort: 3307, requestedPort: "3306", want: true},
+		{name: "same port does not reuse", existingPort: 3306, requestedPort: "3306", want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := recoverManagedDoltShouldReuseExisting(tt.existingPort, tt.requestedPort); got != tt.want {
+				t.Errorf("recoverManagedDoltShouldReuseExisting(%d, %q) = %v, want %v",
+					tt.existingPort, tt.requestedPort, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestManagedDoltRecoverFields(t *testing.T) {
+	report := managedDoltRecoverReport{
+		DiagnosedReadOnly: true,
+		HadPID:            true,
+		Forced:            false,
+		Ready:             true,
+		PID:               9876,
+		Port:              3311,
+		Healthy:           true,
+	}
+	fields := managedDoltRecoverFields(report)
+	want := []string{
+		"diagnosed_read_only\ttrue",
+		"had_pid\ttrue",
+		"forced\tfalse",
+		"ready\ttrue",
+		"pid\t9876",
+		"port\t3311",
+		"healthy\ttrue",
+	}
+	if len(fields) != len(want) {
+		t.Fatalf("got %d fields, want %d", len(fields), len(want))
+	}
+	for i, w := range want {
+		if fields[i] != w {
+			t.Errorf("fields[%d] = %q, want %q", i, fields[i], w)
+		}
+	}
+}
+
+func TestCleanupFailedManagedDoltRecovery_NilCause(t *testing.T) {
+	if err := cleanupFailedManagedDoltRecovery("/nonexistent", 0, 0, nil); err != nil {
+		t.Errorf("cleanupFailedManagedDoltRecovery(nil cause) = %v, want nil", err)
+	}
+}
+
+func TestRecoverManagedDoltObservedRebindPossible(t *testing.T) {
+	t.Run("empty port always possible", func(t *testing.T) {
+		if !recoverManagedDoltObservedRebindPossible(t.TempDir(), "") {
+			t.Error("empty requestedPort should return true")
+		}
+	})
+
+	t.Run("no state files returns false", func(t *testing.T) {
+		if recoverManagedDoltObservedRebindPossible(t.TempDir(), "3306") {
+			t.Error("missing state files should return false")
+		}
+	})
+
+	t.Run("state with different port returns true", func(t *testing.T) {
+		cityPath := t.TempDir()
+		statePath := providerManagedDoltStatePath(cityPath)
+		if err := writeDoltRuntimeStateFile(statePath, doltRuntimeState{
+			Running: true,
+			PID:     1234,
+			Port:    3307,
+		}); err != nil {
+			t.Fatalf("writeDoltRuntimeStateFile: %v", err)
+		}
+		if !recoverManagedDoltObservedRebindPossible(cityPath, "3306") {
+			t.Error("different port should return true")
+		}
+	})
+
+	t.Run("state with same port returns false", func(t *testing.T) {
+		cityPath := t.TempDir()
+		statePath := providerManagedDoltStatePath(cityPath)
+		if err := writeDoltRuntimeStateFile(statePath, doltRuntimeState{
+			Running: true,
+			PID:     1234,
+			Port:    3306,
+		}); err != nil {
+			t.Fatalf("writeDoltRuntimeStateFile: %v", err)
+		}
+		if recoverManagedDoltObservedRebindPossible(cityPath, "3306") {
+			t.Error("same port should return false")
+		}
+	})
+}
diff --git a/cmd/gc/dolt_runtime_publication.go b/cmd/gc/dolt_runtime_publication.go
index b0ddf13b29..892b5dc73c 100644
--- a/cmd/gc/dolt_runtime_publication.go
+++ b/cmd/gc/dolt_runtime_publication.go
@@ -48,6 +48,17 @@ func removeDoltRuntimeStateFile(path string) error {
 	return nil
 }
 
+func readPublishedDoltRuntimeStateHint(cityPath string) (doltRuntimeState, bool, error) {
+	hint, err := readDoltRuntimeStateFile(managedDoltStatePath(cityPath))
+	if err == nil {
+		return hint, true, nil
+	}
+	if os.IsNotExist(err) {
+		return doltRuntimeState{}, false, nil
+	}
+	return doltRuntimeState{}, false, fmt.Errorf("read published dolt runtime state hint: %w", err)
+}
+
 func managedDoltLifecycleOwned(cityPath string) (bool, error) {
 	if cityUsesBdStoreContract(cityPath) {
 		_, _, ok, invalid := resolveConfiguredCityDoltTarget(cityPath)
@@ -101,13 +112,52 @@ func syncManagedDoltPortMirrors(cityPath string) error {
 }
 
 func publishManagedDoltRuntimeState(cityPath string) error {
-	state, err := readDoltRuntimeStateFile(providerManagedDoltStatePath(cityPath))
-	if err != nil {
-		return fmt.Errorf("read provider dolt runtime state: %w", err)
-	}
-	if !validDoltRuntimeState(state, cityPath) {
-		return fmt.Errorf("invalid managed dolt runtime state")
+	providerStatePath := providerManagedDoltStatePath(cityPath)
+	state, readErr := readDoltRuntimeStateFile(providerStatePath)
+	if readErr != nil && !os.IsNotExist(readErr) {
+		return fmt.Errorf("read provider dolt runtime state: %w", readErr)
+	}
+	publishedHintFound := false
+	if readErr != nil || !validDoltRuntimeState(state, cityPath) {
+		// Provider state is missing or stale. Attempt recovery by inspecting
+		// the actual running dolt process. This handles the case where dolt
+		// was restarted (new PID) but the provider state file was not yet
+		// updated, or where a crash left the provider state file absent.
+		layout, layoutErr := resolveManagedDoltRuntimeLayout(cityPath)
+		if layoutErr != nil {
+			return fmt.Errorf("resolve managed dolt runtime layout: %w", layoutErr)
+		}
+		repaired, ok := repairedManagedDoltRuntimeState(cityPath, layout, state)
+		if !ok {
+			// The repair path needs a port hint. When the provider state is
+			// missing, or exists but points at a dead/stale port, the published
+			// runtime state is the only managed-local hint source.
+			hint, found, hintErr := readPublishedDoltRuntimeStateHint(cityPath)
+			if hintErr != nil {
+				return hintErr
+			}
+			if found {
+				state = hint
+				publishedHintFound = true
+				repaired, ok = repairedManagedDoltRuntimeState(cityPath, layout, state)
+			}
+		}
+		if !ok {
+			if readErr != nil {
+				if !publishedHintFound {
+					return fmt.Errorf("recover missing provider dolt runtime state: no published dolt runtime state hint")
+				}
+				return fmt.Errorf("recover missing provider dolt runtime state: no live managed dolt found for published port hint %d", state.Port)
+			}
+			return fmt.Errorf("invalid managed dolt runtime state")
+		}
+		// Repair the provider state file so future calls see a consistent view.
+		if err := writeDoltRuntimeStateFile(providerStatePath, repaired); err != nil {
+			return fmt.Errorf("repair provider dolt runtime state: %w", err)
+		}
+		state = repaired
 	}
+
 	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), state); err != nil {
 		return fmt.Errorf("write published dolt runtime state: %w", err)
 	}
diff --git a/cmd/gc/dolt_runtime_publication_test.go b/cmd/gc/dolt_runtime_publication_test.go
new file mode 100644
index 0000000000..c1182e9a52
--- /dev/null
+++ b/cmd/gc/dolt_runtime_publication_test.go
@@ -0,0 +1,368 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestPublishManagedDoltRuntimeStateRepairsStaleProviderState verifies that
+// publishManagedDoltRuntimeState recovers when dolt-provider-state.json has a
+// stale PID (e.g. dolt was restarted) but the process is actually running and
+// healthy. The repaired state must be written to both dolt-provider-state.json
+// and dolt-state.json.
+func TestPublishManagedDoltRuntimeStateRepairsStaleProviderState(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	// Write provider state with a stale PID — simulates dolt having been
+	// restarted but provider state not yet refreshed.
+	if err := writeDoltRuntimeStateFile(layout.StateFile, doltRuntimeState{
+		Running:   true,
+		PID:       999999, // stale — no such process
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(provider): %v", err)
+	}
+
+	if err := publishManagedDoltRuntimeState(cityPath); err != nil {
+		t.Fatalf("publishManagedDoltRuntimeState: %v", err)
+	}
+
+	// dolt-state.json must now exist and carry the correct live PID.
+	published, err := readDoltRuntimeStateFile(managedDoltStatePath(cityPath))
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(dolt-state.json): %v", err)
+	}
+	if !published.Running {
+		t.Fatal("published.Running = false, want true")
+	}
+	if published.Port != port {
+		t.Fatalf("published.Port = %d, want %d", published.Port, port)
+	}
+	if published.PID != listener.Process.Pid {
+		t.Fatalf("published.PID = %d, want %d (actual listener PID)", published.PID, listener.Process.Pid)
+	}
+
+	// Provider state must also be repaired.
+	repaired, err := readDoltRuntimeStateFile(layout.StateFile)
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(provider): %v", err)
+	}
+	if repaired.PID != listener.Process.Pid {
+		t.Fatalf("repaired provider PID = %d, want %d", repaired.PID, listener.Process.Pid)
+	}
+}
+
+// TestPublishManagedDoltRuntimeStateFailsWhenProviderStateMissingWithoutPortHint
+// verifies that publishManagedDoltRuntimeState fails clearly when
+// dolt-provider-state.json is absent and no persisted port hint exists.
+func TestPublishManagedDoltRuntimeStateFailsWhenProviderStateMissingWithoutPortHint(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+	// Ensure parent directory for provider state exists (normally written by script).
+	if err := os.MkdirAll(filepath.Dir(layout.StateFile), 0o755); err != nil {
+		t.Fatalf("MkdirAll(state dir): %v", err)
+	}
+
+	// No provider state file — absent entirely.
+	if _, err := os.Stat(layout.StateFile); err == nil {
+		if err := os.Remove(layout.StateFile); err != nil {
+			t.Fatalf("remove provider state: %v", err)
+		}
+	}
+
+	err = publishManagedDoltRuntimeState(cityPath)
+	if err == nil {
+		t.Fatal("publishManagedDoltRuntimeState() succeeded, want error (no port hint)")
+	}
+	if !strings.Contains(err.Error(), "no published dolt runtime state hint") {
+		t.Fatalf("error missing no-hint context: %v", err)
+	}
+	if _, statErr := os.Stat(layout.StateFile); statErr == nil {
+		t.Fatal("dolt-provider-state.json was created despite missing port hint")
+	}
+	if _, statErr := os.Stat(managedDoltStatePath(cityPath)); statErr == nil {
+		t.Fatal("dolt-state.json was created despite missing port hint")
+	}
+}
+
+// TestPublishManagedDoltRuntimeStateRecoversMissingProviderStateWithPortHint
+// verifies recovery when dolt-provider-state.json is absent but dolt IS running
+// AND we have a stale state with the correct port to probe.  This simulates the
+// scenario where the published dolt-state.json exists with a valid port but the
+// provider state was lost (e.g. runtime dir was wiped).
+func TestPublishManagedDoltRuntimeStateRecoversMissingProviderStateWithPortHint(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	// The provider state file is absent, but the published dolt-state.json
+	// still carries the correct port. This is the only safe hint source for
+	// repairing a missing provider state file.
+	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), doltRuntimeState{
+		Running:   false,
+		PID:       0,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(provider stopped): %v", err)
+	}
+
+	if err := publishManagedDoltRuntimeState(cityPath); err != nil {
+		t.Fatalf("publishManagedDoltRuntimeState: %v", err)
+	}
+
+	published, err := readDoltRuntimeStateFile(managedDoltStatePath(cityPath))
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(dolt-state.json): %v", err)
+	}
+	if !published.Running {
+		t.Fatal("published.Running = false, want true")
+	}
+	if published.Port != port {
+		t.Fatalf("published.Port = %d, want %d", published.Port, port)
+	}
+	if published.PID != listener.Process.Pid {
+		t.Fatalf("published.PID = %d, want %d (listener PID)", published.PID, listener.Process.Pid)
+	}
+
+	repaired, err := readDoltRuntimeStateFile(layout.StateFile)
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(provider): %v", err)
+	}
+	if !repaired.Running {
+		t.Fatal("repaired.Running = false, want true")
+	}
+	if repaired.Port != port {
+		t.Fatalf("repaired.Port = %d, want %d", repaired.Port, port)
+	}
+	if repaired.PID != listener.Process.Pid {
+		t.Fatalf("repaired.PID = %d, want %d (listener PID)", repaired.PID, listener.Process.Pid)
+	}
+}
+
+func TestPublishManagedDoltRuntimeStateRecoversStaleWrongPortProviderStateWithPublishedHint(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	stalePort := reserveRandomTCPPort(t)
+	if err := writeDoltRuntimeStateFile(layout.StateFile, doltRuntimeState{
+		Running:   true,
+		PID:       999999,
+		Port:      stalePort,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(provider): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), doltRuntimeState{
+		Running:   false,
+		PID:       0,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(published): %v", err)
+	}
+
+	if err := publishManagedDoltRuntimeState(cityPath); err != nil {
+		t.Fatalf("publishManagedDoltRuntimeState: %v", err)
+	}
+
+	published, err := readDoltRuntimeStateFile(managedDoltStatePath(cityPath))
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(dolt-state.json): %v", err)
+	}
+	if published.Port != port {
+		t.Fatalf("published.Port = %d, want %d", published.Port, port)
+	}
+	if published.PID != listener.Process.Pid {
+		t.Fatalf("published.PID = %d, want %d", published.PID, listener.Process.Pid)
+	}
+
+	repaired, err := readDoltRuntimeStateFile(layout.StateFile)
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(provider): %v", err)
+	}
+	if repaired.Port != port {
+		t.Fatalf("repaired.Port = %d, want %d", repaired.Port, port)
+	}
+	if repaired.PID != listener.Process.Pid {
+		t.Fatalf("repaired.PID = %d, want %d", repaired.PID, listener.Process.Pid)
+	}
+}
+
+func TestPublishManagedDoltRuntimeStateFailsWhenPublishedHintIsDead(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	if err := writeDoltRuntimeStateFile(managedDoltStatePath(cityPath), doltRuntimeState{
+		Running:   false,
+		PID:       0,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(published): %v", err)
+	}
+
+	err = publishManagedDoltRuntimeState(cityPath)
+	if err == nil {
+		t.Fatal("publishManagedDoltRuntimeState() succeeded, want error (dead port hint)")
+	}
+	want := "no live managed dolt found for published port hint " + strconv.Itoa(port)
+	if !strings.Contains(err.Error(), want) {
+		t.Fatalf("error = %v, want context %q", err, want)
+	}
+	if _, statErr := os.Stat(layout.StateFile); statErr == nil {
+		t.Fatal("dolt-provider-state.json was created despite dead port hint")
+	}
+}
+
+// TestPublishManagedDoltRuntimeStateSucceedsWhenAlreadyValid verifies the
+// normal (non-recovery) path still works correctly.
+func TestPublishManagedDoltRuntimeStateSucceedsWhenAlreadyValid(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+
+	port := reserveRandomTCPPort(t)
+	listener := startTCPListenerProcessInDir(t, port, layout.DataDir)
+	defer func() {
+		_ = listener.Process.Kill()
+		_ = listener.Wait()
+	}()
+
+	// Write a fully valid provider state.
+	if err := writeDoltRuntimeStateFile(layout.StateFile, doltRuntimeState{
+		Running:   true,
+		PID:       listener.Process.Pid,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(provider): %v", err)
+	}
+
+	if err := publishManagedDoltRuntimeState(cityPath); err != nil {
+		t.Fatalf("publishManagedDoltRuntimeState: %v", err)
+	}
+
+	published, err := readDoltRuntimeStateFile(managedDoltStatePath(cityPath))
+	if err != nil {
+		t.Fatalf("readDoltRuntimeStateFile(dolt-state.json): %v", err)
+	}
+	if !published.Running {
+		t.Fatal("published.Running = false, want true")
+	}
+	if published.Port != port {
+		t.Fatalf("published.Port = %d, want %d", published.Port, port)
+	}
+	if published.PID != listener.Process.Pid {
+		t.Fatalf("published.PID = %d, want %d", published.PID, listener.Process.Pid)
+	}
+}
+
+// TestPublishManagedDoltRuntimeStateFailsWhenDoltNotRunning verifies that
+// publishManagedDoltRuntimeState returns an error when dolt is not running
+// (stale PID, no port holder) and does not create a dolt-state.json.
+func TestPublishManagedDoltRuntimeStateFailsWhenDoltNotRunning(t *testing.T) {
+	cityPath := t.TempDir()
+	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
+	if err != nil {
+		t.Fatalf("resolveManagedDoltRuntimeLayout: %v", err)
+	}
+	if err := os.MkdirAll(layout.DataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(data dir): %v", err)
+	}
+	// Reserve a port and immediately release it so we have a valid port number
+	// but nothing listening there.
+	port := reserveRandomTCPPort(t)
+
+	if err := writeDoltRuntimeStateFile(layout.StateFile, doltRuntimeState{
+		Running:   true,
+		PID:       999999,
+		Port:      port,
+		DataDir:   layout.DataDir,
+		StartedAt: time.Now().UTC().Format(time.RFC3339),
+	}); err != nil {
+		t.Fatalf("writeDoltRuntimeStateFile(provider): %v", err)
+	}
+
+	err = publishManagedDoltRuntimeState(cityPath)
+	if err == nil {
+		t.Fatal("publishManagedDoltRuntimeState() succeeded, want error (nothing listening)")
+	}
+	if !strings.Contains(err.Error(), "managed dolt runtime state") {
+		t.Fatalf("error missing context: %v", err)
+	}
+
+	// dolt-state.json must not have been created.
+	if _, statErr := os.Stat(managedDoltStatePath(cityPath)); statErr == nil {
+		t.Fatal("dolt-state.json was created despite dolt not running")
+	}
+}
diff --git a/cmd/gc/dolt_sql_health.go b/cmd/gc/dolt_sql_health.go
index 87d6c88a9a..c79bb77ddd 100644
--- a/cmd/gc/dolt_sql_health.go
+++ b/cmd/gc/dolt_sql_health.go
@@ -3,7 +3,10 @@ package main
 import (
 	"context"
 	"database/sql"
+	"encoding/csv"
+	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"strconv"
@@ -19,8 +22,21 @@ type managedDoltSQLHealthReport struct {
 	ConnectionCount string
 }
 
+// managedDoltProbeDatabase is the legacy dedicated probe database name. The
+// read-only probe no longer creates or writes to it: Dolt's autostats subsystem
+// (statspro) randomly elects one server-wide database to host the on-disk
+// stats backing store, and a tiny dedicated DB lost the lottery in production
+// by accumulating stats noms it was never meant to hold. The probe now writes
+// into a GC-owned table inside a discovered user database instead so it shares
+// a backing store with real workload traffic. This constant remains so
+// `gc dolt-state reset-probe` can still drop the legacy DB on demand and so
+// `gc dolt-state init` can keep rejecting it as a user-supplied database name.
 const managedDoltProbeDatabase = "__gc_probe"
 
+const managedDoltProbeTable = "__gc_read_only_probe"
+
+var errManagedDoltNoUserDatabase = errors.New("no user database available for managed Dolt read-only probe")
+
 var (
 	managedDoltQueryProbeDirectFn      = managedDoltQueryProbeDirect
 	managedDoltReadOnlyStateDirectFn   = managedDoltReadOnlyStateDirect
@@ -29,16 +45,53 @@ var (
 	managedDoltSQLCommandTimeout       = 5 * time.Second
 )
 
-// The probe database is intentionally persistent. Dropping Dolt databases leaves
-// .dolt_dropped_databases backups, so the health check keeps a stable table and
-// rewrites a single row to test writability.
-var managedDoltReadOnlyProbeStatements = [...]string{
-	"CREATE DATABASE IF NOT EXISTS " + managedDoltProbeDatabase,
-	"CREATE TABLE IF NOT EXISTS " + managedDoltProbeDatabase + ".__probe (k INT PRIMARY KEY)",
-	"REPLACE INTO " + managedDoltProbeDatabase + ".__probe VALUES (1)",
+// managedDoltSystemDatabases lists databases that the read-only probe must not
+// pick as its write target. `__gc_probe` is included so existing legacy data
+// is left in place while we migrate off of it.
+var managedDoltSystemDatabases = map[string]struct{}{
+	"information_schema":     {},
+	"mysql":                  {},
+	"dolt_cluster":           {},
+	"performance_schema":     {},
+	"sys":                    {},
+	managedDoltProbeDatabase: {},
 }
 
-var managedDoltReadOnlyProbeSQL = strings.Join(managedDoltReadOnlyProbeStatements[:], "; ") + ";"
+// managedDoltReadOnlyProbeStatementsFor returns the read-only probe statements
+// for db. Each invocation creates the persistent GC-owned probe table inside db
+// (idempotent) and rewrites a single row to test writability. db must be a real
+// user database; the empty string returns nil so the caller can skip the probe
+// entirely. The database identifier is backtick-quoted because Dolt derives DB
+// names from repository directory names, which can start with a digit or contain
+// other characters that need quoting.
+func managedDoltReadOnlyProbeStatementsFor(db string) []string {
+	db = strings.TrimSpace(db)
+	if db == "" {
+		return nil
+	}
+	target := managedDoltQuoteIdent(db) + "." + managedDoltQuoteIdent(managedDoltProbeTable)
+	return []string{
+		"CREATE TABLE IF NOT EXISTS " + target + " (k INT PRIMARY KEY)",
+		"REPLACE INTO " + target + " VALUES (1)",
+	}
+}
+
+// managedDoltQuoteIdent backtick-quotes a SQL identifier and escapes any
+// embedded backticks by doubling them (MySQL convention).
+func managedDoltQuoteIdent(name string) string {
+	return "`" + strings.ReplaceAll(name, "`", "``") + "`"
+}
+
+// managedDoltReadOnlyProbeSQLFor joins managedDoltReadOnlyProbeStatementsFor
+// into a single semicolon-terminated SQL string suitable for passing to
+// `dolt sql -q`.
+func managedDoltReadOnlyProbeSQLFor(db string) string {
+	stmts := managedDoltReadOnlyProbeStatementsFor(db)
+	if len(stmts) == 0 {
+		return ""
+	}
+	return strings.Join(stmts, "; ") + ";"
+}
 
 func managedDoltQueryProbe(host, port, user string) error {
 	if managedDoltPassword() != "" {
@@ -58,7 +111,14 @@ func managedDoltReadOnlyState(host, port, user string) (string, error) {
 	if managedDoltPassword() != "" {
 		return managedDoltReadOnlyStateDirectFn(host, port, user)
 	}
-	_, err := runManagedDoltSQL(host, port, user, "-q", managedDoltReadOnlyProbeSQL)
+	db, err := managedDoltSelectUserDatabase(host, port, user)
+	if err != nil {
+		return "unknown", err
+	}
+	if db == "" {
+		return "unknown", errManagedDoltNoUserDatabase
+	}
+	_, err = runManagedDoltSQL(host, port, user, "-q", managedDoltReadOnlyProbeSQLFor(db))
 	if err == nil {
 		return "false", nil
 	}
@@ -69,6 +129,78 @@ func managedDoltReadOnlyState(host, port, user string) (string, error) {
 	return "unknown", err
 }
 
+// managedDoltSelectUserDatabase returns the first database from SHOW DATABASES
+// that is not a system database. It returns "" when the server has no user database.
+func managedDoltSelectUserDatabase(host, port, user string) (string, error) {
+	dbs, err := managedDoltSelectUserDatabases(host, port, user)
+	if err != nil || len(dbs) == 0 {
+		return "", err
+	}
+	return dbs[0], nil
+}
+
+func managedDoltSelectUserDatabases(host, port, user string) ([]string, error) {
+	out, err := runManagedDoltSQL(host, port, user, "-r", "csv", "-q", "SHOW DATABASES")
+	if err != nil {
+		return nil, err
+	}
+	return managedDoltUserDatabasesFromCSV(out)
+}
+
+// managedDoltFirstUserDatabaseFromCSV parses csv-format `SHOW DATABASES`
+// output and returns the first non-system database, or "" when none exist.
+func managedDoltFirstUserDatabaseFromCSV(out string) (string, error) {
+	dbs, err := managedDoltUserDatabasesFromCSV(out)
+	if err != nil || len(dbs) == 0 {
+		return "", err
+	}
+	return dbs[0], nil
+}
+
+func managedDoltUserDatabasesFromCSV(out string) ([]string, error) {
+	reader := csv.NewReader(strings.NewReader(out))
+	reader.FieldsPerRecord = 1
+	dbs := []string{}
+	for {
+		record, err := reader.Read()
+		if err == io.EOF {
+			return dbs, nil
+		}
+		if err != nil {
+			return nil, fmt.Errorf("parse SHOW DATABASES csv: %w", err)
+		}
+		dbs = append(dbs, managedDoltUserDatabases(record)...)
+	}
+}
+
+// managedDoltFirstUserDatabase scans database names and returns the first non-system
+// database, or "" when none exist.
+func managedDoltFirstUserDatabase(lines []string) string {
+	dbs := managedDoltUserDatabases(lines)
+	if len(dbs) == 0 {
+		return ""
+	}
+	return dbs[0]
+}
+
+func managedDoltUserDatabases(lines []string) []string {
+	dbs := []string{}
+	for _, line := range lines {
+		name := strings.TrimSpace(line)
+		if name == "" {
+			continue
+		}
+		if strings.EqualFold(name, "Database") {
+			continue
+		}
+		if _, system := managedDoltSystemDatabases[strings.ToLower(name)]; system {
+			continue
+		}
+		dbs = append(dbs, name)
+	}
+	return dbs
+}
+
 func managedDoltConnectionCount(host, port, user string) (string, error) {
 	if managedDoltPassword() != "" {
 		return managedDoltConnectionCountDirectFn(host, port, user)
@@ -103,7 +235,9 @@ func managedDoltHealthCheck(host, port, user string, checkReadOnly bool) (manage
 	if checkReadOnly {
 		state, err := managedDoltReadOnlyState(host, port, user)
 		if err != nil {
-			return managedDoltSQLHealthReport{}, err
+			if !errors.Is(err, errManagedDoltNoUserDatabase) {
+				return managedDoltSQLHealthReport{}, err
+			}
 		}
 		report.ReadOnly = state
 	}
@@ -187,7 +321,14 @@ func managedDoltReadOnlyStateDirect(host, port, user string) (string, error) {
 	}
 	defer conn.Close() //nolint:errcheck
 
-	for _, query := range managedDoltReadOnlyProbeStatements {
+	userDB, err := managedDoltSelectUserDatabaseFromConn(ctx, conn)
+	if err != nil {
+		return "unknown", err
+	}
+	if userDB == "" {
+		return "unknown", errManagedDoltNoUserDatabase
+	}
+	for _, query := range managedDoltReadOnlyProbeStatementsFor(userDB) {
 		if _, err := conn.ExecContext(ctx, query); err != nil {
 			msg := strings.ToLower(err.Error())
 			if strings.Contains(msg, "read only") || strings.Contains(msg, "read-only") {
@@ -199,6 +340,34 @@ func managedDoltReadOnlyStateDirect(host, port, user string) (string, error) {
 	return "false", nil
 }
 
+func managedDoltSelectUserDatabaseFromConn(ctx context.Context, conn *sql.Conn) (string, error) {
+	dbs, err := managedDoltSelectUserDatabasesFromConn(ctx, conn)
+	if err != nil || len(dbs) == 0 {
+		return "", err
+	}
+	return dbs[0], nil
+}
+
+func managedDoltSelectUserDatabasesFromConn(ctx context.Context, conn *sql.Conn) ([]string, error) {
+	rows, err := conn.QueryContext(ctx, "SHOW DATABASES")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close() //nolint:errcheck
+	names := []string{}
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, err
+		}
+		names = append(names, name)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return managedDoltUserDatabases(names), nil
+}
+
 func managedDoltConnectionCountDirect(host, port, user string) (string, error) {
 	db, err := managedDoltOpenDB(host, port, user)
 	if err != nil {
@@ -222,8 +391,19 @@ func managedDoltResetProbe(host, port, user string) error {
 	if managedDoltPassword() != "" {
 		return managedDoltResetProbeDirectFn(host, port, user)
 	}
-	_, err := runManagedDoltSQL(host, port, user, "-q", "DROP DATABASE IF EXISTS "+managedDoltProbeDatabase)
-	return err
+	if _, err := runManagedDoltSQL(host, port, user, "-q", "DROP DATABASE IF EXISTS "+managedDoltProbeDatabase); err != nil {
+		return err
+	}
+	dbs, err := managedDoltSelectUserDatabases(host, port, user)
+	if err != nil {
+		return err
+	}
+	for _, db := range dbs {
+		if _, err := runManagedDoltSQL(host, port, user, "-q", managedDoltDropProbeTableSQLFor(db)); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func managedDoltResetProbeDirect(host, port, user string) error {
@@ -238,8 +418,28 @@ func managedDoltResetProbeDirect(host, port, user string) error {
 	if err := db.PingContext(ctx); err != nil {
 		return err
 	}
-	_, err = db.ExecContext(ctx, "DROP DATABASE IF EXISTS "+managedDoltProbeDatabase)
-	return err
+	if _, err := db.ExecContext(ctx, "DROP DATABASE IF EXISTS "+managedDoltProbeDatabase); err != nil {
+		return err
+	}
+	conn, err := db.Conn(ctx)
+	if err != nil {
+		return err
+	}
+	defer conn.Close() //nolint:errcheck
+	dbs, err := managedDoltSelectUserDatabasesFromConn(ctx, conn)
+	if err != nil {
+		return err
+	}
+	for _, userDB := range dbs {
+		if _, err := conn.ExecContext(ctx, managedDoltDropProbeTableSQLFor(userDB)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func managedDoltDropProbeTableSQLFor(db string) string {
+	return "DROP TABLE IF EXISTS " + managedDoltQuoteIdent(db) + "." + managedDoltQuoteIdent(managedDoltProbeTable)
 }
 
 func runManagedDoltSQL(host, port, user string, args ...string) (string, error) {
diff --git a/cmd/gc/dolt_sql_health_test.go b/cmd/gc/dolt_sql_health_test.go
index 6f81ca97c7..226c362223 100644
--- a/cmd/gc/dolt_sql_health_test.go
+++ b/cmd/gc/dolt_sql_health_test.go
@@ -10,38 +10,276 @@ import (
 	"time"
 )
 
-func TestManagedDoltReadOnlyProbeDoesNotDropProbeDatabase(t *testing.T) {
-	for _, query := range append(append([]string{}, managedDoltReadOnlyProbeStatements[:]...), managedDoltReadOnlyProbeSQL) {
-		assertNoManagedDoltProbeDrop(t, "read-only probe", query)
-	}
-	assertManagedDoltProbeWrites(t, "joined read-only probe", managedDoltReadOnlyProbeSQL)
-	foundWriteStatement := false
-	for _, query := range managedDoltReadOnlyProbeStatements {
-		if strings.Contains(query, "REPLACE INTO __gc_probe.__probe VALUES (1)") {
-			foundWriteStatement = true
+func TestManagedDoltReadOnlyProbeStatementsForReturnsNothingForEmptyDB(t *testing.T) {
+	for _, db := range []string{"", " ", "\t"} {
+		if got := managedDoltReadOnlyProbeStatementsFor(db); got != nil {
+			t.Fatalf("managedDoltReadOnlyProbeStatementsFor(%q) = %v, want nil", db, got)
 		}
+		if got := managedDoltReadOnlyProbeSQLFor(db); got != "" {
+			t.Fatalf("managedDoltReadOnlyProbeSQLFor(%q) = %q, want \"\"", db, got)
+		}
+	}
+}
+
+func TestManagedDoltReadOnlyProbeNeverTargetsLegacyDatabase(t *testing.T) {
+	for _, db := range []string{"gascity", "gm", "be", "user_db", "003", "name-with-hyphen"} {
+		stmts := managedDoltReadOnlyProbeStatementsFor(db)
+		joined := managedDoltReadOnlyProbeSQLFor(db)
+		for _, q := range append(append([]string{}, stmts...), joined) {
+			assertNoManagedDoltProbeLegacyTarget(t, "probe stmts for "+db, q)
+			assertNoManagedDoltProbeDrop(t, "probe stmts for "+db, q)
+		}
+		wantTable := "`" + db + "`.`" + managedDoltProbeTable + "`"
+		for _, q := range stmts {
+			if !strings.Contains(q, wantTable) {
+				t.Fatalf("probe stmt for %s missing %q: %s", db, wantTable, q)
+			}
+			if strings.Contains(q, "`.`__probe`") {
+				t.Fatalf("probe stmt for %s uses generic probe table: %s", db, q)
+			}
+		}
+		if !strings.Contains(joined, "REPLACE INTO "+wantTable+" VALUES (1)") {
+			t.Fatalf("probe SQL for %s must write to %s: %s", db, wantTable, joined)
+		}
+	}
+}
+
+func TestManagedDoltQuoteIdentEscapesBackticks(t *testing.T) {
+	cases := map[string]string{
+		"gascity":          "`gascity`",
+		"003":              "`003`",
+		"with`backtick":    "`with``backtick`",
+		"name with spaces": "`name with spaces`",
+		"":                 "``",
+	}
+	for in, want := range cases {
+		if got := managedDoltQuoteIdent(in); got != want {
+			t.Fatalf("managedDoltQuoteIdent(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestManagedDoltFirstUserDatabaseSkipsSystemDatabases(t *testing.T) {
+	cases := []struct {
+		name  string
+		lines []string
+		want  string
+	}{
+		{"all system", []string{"Database", "information_schema", "mysql", "dolt_cluster", "performance_schema", "sys", "__gc_probe"}, ""},
+		{"first user wins", []string{"Database", "__gc_probe", "dolt_cluster", "performance_schema", "sys", "gascity", "be"}, "gascity"},
+		{"case-insensitive system match", []string{"Database", "Information_Schema", "MySQL", "DOLT_CLUSTER", "PERFORMANCE_SCHEMA", "SYS", "__GC_PROBE", "gm"}, "gm"},
+		{"empty", []string{}, ""},
+		{"only header", []string{"Database"}, ""},
+		{"whitespace + blanks ignored", []string{"Database", "", "  ", "gascity"}, "gascity"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := managedDoltFirstUserDatabase(tc.lines); got != tc.want {
+				t.Fatalf("managedDoltFirstUserDatabase(%v) = %q, want %q", tc.lines, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestManagedDoltFirstUserDatabaseFromCSVHandlesEscapedNames(t *testing.T) {
+	got, err := managedDoltFirstUserDatabaseFromCSV("Database\ninformation_schema\n\"tenant,one\"\n")
+	if err != nil {
+		t.Fatalf("managedDoltFirstUserDatabaseFromCSV() error = %v", err)
+	}
+	if got != "tenant,one" {
+		t.Fatalf("managedDoltFirstUserDatabaseFromCSV() = %q, want tenant,one", got)
 	}
-	if !foundWriteStatement {
-		t.Fatal("read-only probe statements must include a write to __gc_probe.__probe")
+
+	got, err = managedDoltFirstUserDatabaseFromCSV("Database\n\"tenant\"\"two\"\n")
+	if err != nil {
+		t.Fatalf("managedDoltFirstUserDatabaseFromCSV() quote error = %v", err)
+	}
+	if got != "tenant\"two" {
+		t.Fatalf("managedDoltFirstUserDatabaseFromCSV() = %q, want tenant\"two", got)
+	}
+}
+
+func TestManagedDoltReadOnlyStateNoUserDatabaseIsUnknown(t *testing.T) {
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*"__gc_read_only_probe"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`)
+	t.Setenv("INVOCATION_FILE", invocationFile)
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	state, err := managedDoltReadOnlyState("127.0.0.1", "3311", "root")
+	if err == nil {
+		t.Fatal("managedDoltReadOnlyState() error = nil, want no-user-database diagnostic")
+	}
+	if state != "unknown" {
+		t.Fatalf("managedDoltReadOnlyState() state = %q, want unknown", state)
+	}
+	if !strings.Contains(err.Error(), "no user database") {
+		t.Fatalf("managedDoltReadOnlyState() error = %v, want no user database", err)
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("managedDoltReadOnlyState() ran write probe without user database:\n%s", invocation)
+	}
+}
+
+func TestManagedDoltHealthCheckNoUserDatabaseIsUnknown(t *testing.T) {
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -q SELECT active_branch()"*)
+    exit 0
+    ;;
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ninformation_schema\nmysql\ndolt_cluster\nperformance_schema\nsys\n__gc_probe\n'
+    exit 0
+    ;;
+  *"sql -r csv -q SELECT COUNT(*) AS cnt FROM information_schema.PROCESSLIST"*)
+    printf 'cnt\n0\n'
+    exit 0
+    ;;
+  *"CREATE TABLE IF NOT EXISTS"*)
+    echo "unexpected write probe without a user database" >&2
+    exit 2
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`)
+	t.Setenv("INVOCATION_FILE", invocationFile)
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	report, err := managedDoltHealthCheck("127.0.0.1", "3311", "root", true)
+	if err != nil {
+		t.Fatalf("managedDoltHealthCheck() error = %v", err)
+	}
+	if !report.QueryReady || report.ReadOnly != "unknown" || report.ConnectionCount != "0" {
+		t.Fatalf("managedDoltHealthCheck() = %+v, want query-ready unknown with connection count", report)
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	if strings.Contains(string(invocation), "CREATE TABLE IF NOT EXISTS") {
+		t.Fatalf("managedDoltHealthCheck() ran write probe without user database:\n%s", invocation)
+	}
+}
+
+func TestManagedDoltResetProbeDropsUserProbeTables(t *testing.T) {
+	binDir := t.TempDir()
+	invocationFile := filepath.Join(t.TempDir(), "dolt-invocation.txt")
+	writeFakeDoltSQLBinary(t, binDir, invocationFile, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" >> "$INVOCATION_FILE"
+case "$*" in
+  *"sql -r csv -q SHOW DATABASES"*)
+    printf 'Database\ngascity\ninformation_schema\nwith-hyphen\n__gc_probe\n'
+    exit 0
+    ;;
+  *"DROP DATABASE IF EXISTS __gc_probe"*)
+    exit 0
+    ;;
+  *"DROP TABLE IF EXISTS"*"__gc_read_only_probe"*)
+    exit 0
+    ;;
+  *)
+    echo "unexpected command: $*" >&2
+    exit 2
+    ;;
+esac
+`)
+	t.Setenv("INVOCATION_FILE", invocationFile)
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	if err := managedDoltResetProbe("127.0.0.1", "3311", "root"); err != nil {
+		t.Fatalf("managedDoltResetProbe() error = %v", err)
+	}
+	invocation, err := os.ReadFile(invocationFile)
+	if err != nil {
+		t.Fatalf("ReadFile(invocation): %v", err)
+	}
+	text := string(invocation)
+	for _, want := range []string{
+		"DROP DATABASE IF EXISTS __gc_probe",
+		"DROP TABLE IF EXISTS `gascity`.`" + managedDoltProbeTable + "`",
+		"DROP TABLE IF EXISTS `with-hyphen`.`" + managedDoltProbeTable + "`",
+	} {
+		if !strings.Contains(text, want) {
+			t.Fatalf("managedDoltResetProbe() invocation = %s, want %q", text, want)
+		}
+	}
+	if strings.Contains(text, "information_schema`.`"+managedDoltProbeTable) || strings.Contains(text, "__gc_probe`.`"+managedDoltProbeTable) {
+		t.Fatalf("managedDoltResetProbe() dropped probe table in system database:\n%s", text)
+	}
+}
+
+func TestManagedDoltSystemDatabasesIncludesManagedAndDoltSystemDatabases(t *testing.T) {
+	for _, name := range []string{
+		"information_schema",
+		"mysql",
+		"dolt_cluster",
+		"performance_schema",
+		"sys",
+		managedDoltProbeDatabase,
+	} {
+		if _, ok := managedDoltSystemDatabases[name]; !ok {
+			t.Fatalf("managedDoltSystemDatabases missing %q", name)
+		}
 	}
 }
 
 func assertNoManagedDoltProbeDrop(t *testing.T, label, text string) {
 	t.Helper()
 	dropProbeDatabase := regexp.MustCompile("(?i)\\bDROP\\s+DATABASE\\s+(IF\\s+EXISTS\\s+)?`?__gc_probe`?")
-	dropProbeTable := regexp.MustCompile("(?i)\\bDROP\\s+TABLE\\s+(IF\\s+EXISTS\\s+)?(`?__gc_probe`?\\.)?`?__probe`?")
+	dropGenericProbeTable := regexp.MustCompile("(?i)\\bDROP\\s+TABLE\\s+(IF\\s+EXISTS\\s+)?(`?__gc_probe`?\\.)?`?__probe`?")
+	dropManagedProbeTable := regexp.MustCompile("(?i)\\bDROP\\s+TABLE\\s+(IF\\s+EXISTS\\s+)?(`?__gc_probe`?\\.)?`?" + regexp.QuoteMeta(managedDoltProbeTable) + "`?")
 	if dropProbeDatabase.MatchString(text) {
 		t.Fatalf("%s must not drop __gc_probe: %s", label, text)
 	}
-	if dropProbeTable.MatchString(text) {
-		t.Fatalf("%s must keep __gc_probe.__probe stable: %s", label, text)
+	if dropGenericProbeTable.MatchString(text) {
+		t.Fatalf("%s must not drop generic __probe tables: %s", label, text)
+	}
+	if dropManagedProbeTable.MatchString(text) {
+		t.Fatalf("%s must not drop %s from normal probe paths: %s", label, managedDoltProbeTable, text)
 	}
 }
 
-func assertManagedDoltProbeWrites(t *testing.T, label, text string) {
+// assertNoManagedDoltProbeLegacyTarget enforces that gc CLI probe SQL never
+// CREATEs or writes to the legacy `__gc_probe` database — that's what made
+// it dolt's stats backing store and accumulated 596k buckets in production.
+func assertNoManagedDoltProbeLegacyTarget(t *testing.T, label, text string) {
 	t.Helper()
-	if !strings.Contains(text, "REPLACE INTO __gc_probe.__probe VALUES (1)") {
-		t.Fatalf("%s must write to __gc_probe.__probe: %s", label, text)
+	createLegacy := regexp.MustCompile("(?i)\\bCREATE\\s+(DATABASE|TABLE)\\s+(IF\\s+NOT\\s+EXISTS\\s+)?`?__gc_probe`?")
+	writeLegacy := regexp.MustCompile("(?i)\\b(REPLACE|INSERT)\\s+INTO\\s+`?__gc_probe`?")
+	if createLegacy.MatchString(text) {
+		t.Fatalf("%s must not create __gc_probe: %s", label, text)
+	}
+	if writeLegacy.MatchString(text) {
+		t.Fatalf("%s must not write to __gc_probe: %s", label, text)
 	}
 }
 
diff --git a/cmd/gc/dolt_start_managed.go b/cmd/gc/dolt_start_managed.go
index 4f7431142b..e4586f4bd3 100644
--- a/cmd/gc/dolt_start_managed.go
+++ b/cmd/gc/dolt_start_managed.go
@@ -20,10 +20,10 @@ type managedDoltStartReport struct {
 }
 
 func startManagedDoltProcess(cityPath, host, port, user, logLevel string, timeout time.Duration) (managedDoltStartReport, error) {
-	return startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel, timeout, true)
+	return startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel, -1, timeout, true)
 }
 
-func startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel string, timeout time.Duration, publish bool) (managedDoltStartReport, error) {
+func startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel string, archiveLevel int, timeout time.Duration, publish bool) (managedDoltStartReport, error) {
 	layout, err := resolveManagedDoltRuntimeLayout(cityPath)
 	if err != nil {
 		return managedDoltStartReport{}, err
@@ -44,6 +44,7 @@ func startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel str
 	if timeout <= 0 {
 		timeout = 30 * time.Second
 	}
+	archiveLevel = resolveDoltArchiveLevel(archiveLevel)
 
 	report := managedDoltStartReport{}
 	currentPort := portNum
@@ -54,7 +55,7 @@ func startManagedDoltProcessWithOptions(cityPath, host, port, user, logLevel str
 		if err := managedDoltPreflightCleanupFn(cityPath); err != nil {
 			return report, err
 		}
-		if err := writeManagedDoltConfigFile(layout.ConfigFile, host, strconv.Itoa(currentPort), layout.DataDir, logLevel); err != nil {
+		if err := writeManagedDoltConfigFile(layout.ConfigFile, host, strconv.Itoa(currentPort), layout.DataDir, logLevel, archiveLevel); err != nil {
 			return report, err
 		}
 
@@ -189,6 +190,21 @@ func managedDoltLogSuffix(path string, offset int64) (string, error) {
 	return string(data[offset:]), nil
 }
 
+// resolveDoltArchiveLevel resolves the archive level for dolt auto_gc.
+// Explicit non-negative values are returned as-is. Negative values trigger
+// env-var fallback (GC_DOLT_ARCHIVE_LEVEL), defaulting to 0.
+func resolveDoltArchiveLevel(explicit int) int {
+	if explicit >= 0 {
+		return explicit
+	}
+	if v := os.Getenv("GC_DOLT_ARCHIVE_LEVEL"); v != "" {
+		if parsed, err := strconv.Atoi(v); err == nil {
+			return parsed
+		}
+	}
+	return 0
+}
+
 func terminateManagedDoltPID(pid int) error {
 	if pid <= 0 {
 		return nil
diff --git a/cmd/gc/dolt_start_managed_test.go b/cmd/gc/dolt_start_managed_test.go
index a7058f93ac..2bac35cc8e 100644
--- a/cmd/gc/dolt_start_managed_test.go
+++ b/cmd/gc/dolt_start_managed_test.go
@@ -6,6 +6,8 @@ import (
 	"runtime"
 	"strings"
 	"testing"
+
+	bdpack "github.com/gastownhall/gascity/examples/bd"
 )
 
 func TestDoltServerEnv_AppendsDefaultWhenMissing(t *testing.T) {
@@ -88,3 +90,193 @@ func TestGCBeadsBDScript_RespectsEmptyUserValue(t *testing.T) {
 		t.Fatalf("gc-beads-bd.sh must not clobber an explicitly empty DOLT_GC_SCHEDULER")
 	}
 }
+
+func TestGCBeadsBDScript_UsesPortableSleepMS(t *testing.T) {
+	_, thisFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller(0) failed")
+	}
+	scriptPath := filepath.Join(filepath.Dir(thisFile), "..", "..", "examples", "bd", "assets", "scripts", "gc-beads-bd.sh")
+	data, err := os.ReadFile(scriptPath)
+	if err != nil {
+		t.Fatalf("read %s: %v", scriptPath, err)
+	}
+	script := string(data)
+	embedded, err := bdpack.PackFS.ReadFile("assets/scripts/gc-beads-bd.sh")
+	if err != nil {
+		t.Fatalf("read embedded gc-beads-bd.sh: %v", err)
+	}
+	if string(embedded) != script {
+		t.Fatalf("embedded gc-beads-bd.sh differs from source script")
+	}
+
+	if !strings.Contains(script, "sleep_ms()") {
+		t.Fatalf("gc-beads-bd.sh must define portable sleep_ms helper")
+	}
+	if strings.Contains(script, `sleep "$(awk`) {
+		t.Fatalf("gc-beads-bd.sh must not use awk to calculate sleep durations")
+	}
+	if got := strings.Count(script, `sleep_ms "$backoff_ms" 2>/dev/null || sleep 1`); got < 3 {
+		t.Fatalf("gc-beads-bd.sh must use sleep_ms for retry backoff sleeps; found %d call sites", got)
+	}
+	if !strings.Contains(script, "for attempt in 1 2 3 4 5 6 7 8; do") {
+		t.Fatalf("gc-beads-bd.sh must allow slow bd runtime schema visibility after init")
+	}
+}
+
+func TestGCBeadsBDScript_QuarantinesRetiredReplacementDatabases(t *testing.T) {
+	_, thisFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller(0) failed")
+	}
+	scriptPath := filepath.Join(filepath.Dir(thisFile), "..", "..", "examples", "bd", "assets", "scripts", "gc-beads-bd.sh")
+	data, err := os.ReadFile(scriptPath)
+	if err != nil {
+		t.Fatalf("read %s: %v", scriptPath, err)
+	}
+	script := string(data)
+
+	required := []string{
+		"retired_replacement_db_name()",
+		"?*.replaced-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z)",
+		`reason="retired replacement"`,
+		`quarantining unservable database`,
+		`mv -f "$dir" "$quarantine_dir"`,
+	}
+	for _, want := range required {
+		if !strings.Contains(script, want) {
+			t.Fatalf("gc-beads-bd.sh missing retired replacement fallback fragment %q", want)
+		}
+	}
+	if strings.Contains(script, "quarantining phantom database") {
+		t.Fatal("gc-beads-bd.sh still logs the broader fallback as phantom-only")
+	}
+}
+
+func TestManagedDoltStartFields(t *testing.T) {
+	report := managedDoltStartReport{
+		Ready:        true,
+		PID:          4321,
+		Port:         3312,
+		AddressInUse: false,
+		Attempts:     2,
+	}
+	fields := managedDoltStartFields(report)
+	want := []string{
+		"ready\ttrue",
+		"pid\t4321",
+		"port\t3312",
+		"address_in_use\tfalse",
+		"attempts\t2",
+	}
+	if len(fields) != len(want) {
+		t.Fatalf("got %d fields, want %d", len(fields), len(want))
+	}
+	for i, w := range want {
+		if fields[i] != w {
+			t.Errorf("fields[%d] = %q, want %q", i, fields[i], w)
+		}
+	}
+}
+
+func TestManagedDoltLogSize(t *testing.T) {
+	t.Run("existing file", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "dolt.log")
+		if err := os.WriteFile(path, []byte("hello world\n"), 0o644); err != nil {
+			t.Fatalf("WriteFile: %v", err)
+		}
+		got, err := managedDoltLogSize(path)
+		if err != nil {
+			t.Fatalf("managedDoltLogSize: %v", err)
+		}
+		if got != 12 {
+			t.Errorf("managedDoltLogSize = %d, want 12", got)
+		}
+	})
+
+	t.Run("missing file returns zero", func(t *testing.T) {
+		got, err := managedDoltLogSize(filepath.Join(t.TempDir(), "no-such.log"))
+		if err != nil {
+			t.Fatalf("managedDoltLogSize: %v", err)
+		}
+		if got != 0 {
+			t.Errorf("managedDoltLogSize = %d, want 0", got)
+		}
+	})
+}
+
+func TestManagedDoltLogSuffix(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "dolt.log")
+	content := "line one\nline two\nline three\n"
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	t.Run("from offset", func(t *testing.T) {
+		got, err := managedDoltLogSuffix(path, 9)
+		if err != nil {
+			t.Fatalf("managedDoltLogSuffix: %v", err)
+		}
+		if got != "line two\nline three\n" {
+			t.Errorf("got %q, want %q", got, "line two\nline three\n")
+		}
+	})
+
+	t.Run("offset past end returns empty", func(t *testing.T) {
+		got, err := managedDoltLogSuffix(path, int64(len(content)+10))
+		if err != nil {
+			t.Fatalf("managedDoltLogSuffix: %v", err)
+		}
+		if got != "" {
+			t.Errorf("got %q, want empty", got)
+		}
+	})
+
+	t.Run("negative offset treated as zero", func(t *testing.T) {
+		got, err := managedDoltLogSuffix(path, -5)
+		if err != nil {
+			t.Fatalf("managedDoltLogSuffix: %v", err)
+		}
+		if got != content {
+			t.Errorf("got %q, want %q", got, content)
+		}
+	})
+
+	t.Run("missing file returns empty", func(t *testing.T) {
+		got, err := managedDoltLogSuffix(filepath.Join(dir, "no-such.log"), 0)
+		if err != nil {
+			t.Fatalf("managedDoltLogSuffix: %v", err)
+		}
+		if got != "" {
+			t.Errorf("got %q, want empty", got)
+		}
+	})
+}
+
+func TestResolveDoltArchiveLevel(t *testing.T) {
+	tests := []struct {
+		name     string
+		explicit int
+		envVal   string
+		want     int
+	}{
+		{name: "explicit zero", explicit: 0, want: 0},
+		{name: "explicit positive", explicit: 1, want: 1},
+		{name: "explicit large", explicit: 42, want: 42},
+		{name: "negative defaults to zero", explicit: -1, want: 0},
+		{name: "negative with valid env", explicit: -1, envVal: "1", want: 1},
+		{name: "negative with env zero", explicit: -1, envVal: "0", want: 0},
+		{name: "negative with non-numeric env falls back", explicit: -1, envVal: "abc", want: 0},
+		{name: "negative with empty env", explicit: -1, envVal: "", want: 0},
+		{name: "explicit overrides env", explicit: 2, envVal: "5", want: 2},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv("GC_DOLT_ARCHIVE_LEVEL", tt.envVal)
+			if got := resolveDoltArchiveLevel(tt.explicit); got != tt.want {
+				t.Errorf("resolveDoltArchiveLevel(%d) = %d, want %d", tt.explicit, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/cmd/gc/embed_builtin_packs_test.go b/cmd/gc/embed_builtin_packs_test.go
index a93035b0f7..864fdaecd8 100644
--- a/cmd/gc/embed_builtin_packs_test.go
+++ b/cmd/gc/embed_builtin_packs_test.go
@@ -111,18 +111,25 @@ func TestBuiltinDatabaseEnumeratorsSkipManagedProbeDatabase(t *testing.T) {
 		t.Fatalf("MaterializeBuiltinPacks() error: %v", err)
 	}
 
+	doltSystemNeedle := "information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe"
+	maintenanceScratchNeedle := "benchdb|testdb_*|beads_pt*|beads_vr*|doctest_*|doctortest_*"
+	maintenanceTempNeedle := "beads_t[0-9a-f]"
 	for _, tt := range []struct {
 		pack     string
 		rel      string
 		needle   string
 		minCount int
 	}{
-		{"maintenance", filepath.Join("assets", "scripts", "jsonl-export.sh"), "^dolt_cluster$\\|^__gc_probe$", 1},
-		{"maintenance", filepath.Join("assets", "scripts", "reaper.sh"), "^dolt_cluster$\\|^__gc_probe$", 1},
-		{"dolt", filepath.Join("commands", "list", "run.sh"), "information_schema|mysql|dolt_cluster|__gc_probe", 1},
-		{"dolt", filepath.Join("commands", "cleanup", "run.sh"), "information_schema|mysql|dolt_cluster|__gc_probe", 1},
-		{"dolt", filepath.Join("commands", "health", "run.sh"), "information_schema|mysql|dolt_cluster|__gc_probe", 2},
-		{"dolt", filepath.Join("commands", "sync", "run.sh"), "information_schema|mysql|dolt_cluster|__gc_probe", 2},
+		{"maintenance", filepath.Join("assets", "scripts", "jsonl-export.sh"), doltSystemNeedle, 1},
+		{"maintenance", filepath.Join("assets", "scripts", "jsonl-export.sh"), maintenanceScratchNeedle, 1},
+		{"maintenance", filepath.Join("assets", "scripts", "jsonl-export.sh"), maintenanceTempNeedle, 1},
+		{"maintenance", filepath.Join("assets", "scripts", "reaper.sh"), doltSystemNeedle, 1},
+		{"maintenance", filepath.Join("assets", "scripts", "reaper.sh"), maintenanceScratchNeedle, 1},
+		{"maintenance", filepath.Join("assets", "scripts", "reaper.sh"), maintenanceTempNeedle, 1},
+		{"dolt", filepath.Join("commands", "list", "run.sh"), doltSystemNeedle, 1},
+		{"dolt", filepath.Join("commands", "cleanup", "run.sh"), doltSystemNeedle, 1},
+		{"dolt", filepath.Join("commands", "health", "run.sh"), doltSystemNeedle, 2},
+		{"dolt", filepath.Join("commands", "sync", "run.sh"), doltSystemNeedle, 2},
 		{"dolt", filepath.Join("formulas", "mol-dog-stale-db.toml"), "__gc_probe", 1},
 		{"dolt", filepath.Join("formulas", "mol-dog-doctor.toml"), "__gc_probe", 1},
 	} {
@@ -138,7 +145,16 @@ func TestBuiltinDatabaseEnumeratorsSkipManagedProbeDatabase(t *testing.T) {
 }
 
 func TestDoltSyncRejectsManagedProbeDatabaseFilter(t *testing.T) {
-	for _, dbName := range []string{managedDoltProbeDatabase, strings.ToUpper(managedDoltProbeDatabase), " " + managedDoltProbeDatabase + " "} {
+	for _, dbName := range []string{
+		managedDoltProbeDatabase,
+		strings.ToUpper(managedDoltProbeDatabase),
+		" " + managedDoltProbeDatabase + " ",
+		"information_schema",
+		"mysql",
+		"dolt_cluster",
+		"performance_schema",
+		"sys",
+	} {
 		t.Run(dbName, func(t *testing.T) {
 			dir := t.TempDir()
 			if err := MaterializeBuiltinPacks(dir); err != nil {
@@ -152,14 +168,14 @@ func TestDoltSyncRejectsManagedProbeDatabaseFilter(t *testing.T) {
 			if err == nil {
 				t.Fatalf("gc dolt sync unexpectedly accepted %s:\n%s", dbName, out)
 			}
-			if !strings.Contains(string(out), "reserved Dolt database name: "+managedDoltProbeDatabase) {
+			if !strings.Contains(string(out), "reserved Dolt database name: "+strings.TrimSpace(dbName)) {
 				t.Fatalf("gc dolt sync output = %s, want reserved database error", out)
 			}
 		})
 	}
 }
 
-func TestBuiltinDoltDoctorAllowsOlderVersionWhenProbeSucceeds(t *testing.T) {
+func TestBuiltinDoltDoctorAllowsAtMinimumVersionWhenProbeSucceeds(t *testing.T) {
 	dir := t.TempDir()
 	if err := MaterializeBuiltinPacks(dir); err != nil {
 		t.Fatalf("MaterializeBuiltinPacks() error: %v", err)
@@ -170,7 +186,7 @@ func TestBuiltinDoltDoctorAllowsOlderVersionWhenProbeSucceeds(t *testing.T) {
 		name string
 		body string
 	}{
-		{name: "dolt", body: "#!/bin/sh\nprintf 'dolt version 1.75.2\\n'\n"},
+		{name: "dolt", body: "#!/bin/sh\nprintf 'dolt version 1.86.2\\n'\n"},
 		{name: "flock", body: "#!/bin/sh\nexit 0\n"},
 		{name: "lsof", body: "#!/bin/sh\nexit 0\n"},
 	} {
@@ -184,9 +200,9 @@ func TestBuiltinDoltDoctorAllowsOlderVersionWhenProbeSucceeds(t *testing.T) {
 	cmd.Env = append(sanitizedBaseEnv(), "PATH="+binDir+":"+os.Getenv("PATH"))
 	out, err := cmd.CombinedOutput()
 	if err != nil {
-		t.Fatalf("check-dolt unexpectedly rejected old Dolt probe: %v\n%s", err, out)
+		t.Fatalf("check-dolt unexpectedly rejected Dolt probe at minimum: %v\n%s", err, out)
 	}
-	if !strings.Contains(string(out), "dolt available (dolt version 1.75.2)") {
+	if !strings.Contains(string(out), "dolt available (dolt version 1.86.2)") {
 		t.Fatalf("check-dolt output = %s, want successful version probe", out)
 	}
 }
@@ -207,7 +223,7 @@ func TestBuiltinDoltDoctorBoundsVersionProbe(t *testing.T) {
 			name: "timeout",
 			body: "#!/bin/sh\nprintf '%s\\n' \"$*\" > \"$TIMEOUT_CAPTURE\"\nif [ \"$1\" = \"--kill-after=2\" ]; then\n  shift\nfi\nshift\nexec \"$@\"\n",
 		},
-		{name: "dolt", body: "#!/bin/sh\nprintf 'dolt version 1.86.1\\n'\n"},
+		{name: "dolt", body: "#!/bin/sh\nprintf 'dolt version 1.86.10\\n'\n"},
 		{name: "flock", body: "#!/bin/sh\nexit 0\n"},
 		{name: "lsof", body: "#!/bin/sh\nexit 0\n"},
 	} {
@@ -326,6 +342,84 @@ func TestMaterializeBuiltinPacks_Idempotent(t *testing.T) {
 	}
 }
 
+func TestMaterializeBuiltinPacksPiHookUsesCurrentExtensionAPI(t *testing.T) {
+	dir := t.TempDir()
+
+	if err := MaterializeBuiltinPacks(dir); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks() error: %v", err)
+	}
+
+	data := readMaterializedPiHook(t, dir)
+	for _, want := range []string{
+		"module.exports = function gascityPiExtension(pi)",
+		`pi.on("session_start"`,
+		`pi.on("session_compact"`,
+		`pi.on("before_agent_start"`,
+	} {
+		if !strings.Contains(data, want) {
+			t.Errorf("materialized Pi hook missing current extension API marker %q:\n%s", want, data)
+		}
+	}
+	if strings.Contains(data, "gc hook --inject") {
+		t.Errorf("materialized Pi hook should not install no-op gc hook --inject:\n%s", data)
+	}
+	for _, legacy := range []string{
+		"module.exports = {",
+		`"session.created"`,
+		`"session.compacted"`,
+		`"session.deleted"`,
+		`"experimental.chat.system.transform"`,
+	} {
+		if strings.Contains(data, legacy) {
+			t.Errorf("materialized Pi hook still contains legacy API marker %q:\n%s", legacy, data)
+		}
+	}
+}
+
+func TestMaterializeBuiltinPacksReplacesStaleMaterializedPiHook(t *testing.T) {
+	dir := t.TempDir()
+	hookPath := materializedPiHookPath(dir)
+	if err := os.MkdirAll(filepath.Dir(hookPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll(%s): %v", filepath.Dir(hookPath), err)
+	}
+	stale := []byte(`// Gas City hooks for Pi Coding Agent.
+module.exports = {
+  name: "gascity",
+  events: { "session.created": () => "" },
+  hooks: { "experimental.chat.system.transform": (system) => system },
+};
+`)
+	if err := os.WriteFile(hookPath, stale, 0o644); err != nil {
+		t.Fatalf("WriteFile(%s): %v", hookPath, err)
+	}
+
+	if err := MaterializeBuiltinPacks(dir); err != nil {
+		t.Fatalf("MaterializeBuiltinPacks() error: %v", err)
+	}
+
+	data := readMaterializedPiHook(t, dir)
+	if data == string(stale) {
+		t.Fatal("stale materialized Pi hook was preserved; expected core pack materialization to repair it")
+	}
+	if !strings.Contains(data, `pi.on("session_start"`) {
+		t.Fatalf("repaired materialized Pi hook does not use current extension API:\n%s", data)
+	}
+}
+
+func materializedPiHookPath(dir string) string {
+	return filepath.Join(dir, citylayout.SystemPacksRoot, "core", "overlay", "per-provider", "pi", ".pi", "extensions", "gc-hooks.js")
+}
+
+func readMaterializedPiHook(t *testing.T, dir string) string {
+	t.Helper()
+	path := materializedPiHookPath(dir)
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", path, err)
+	}
+	return string(data)
+}
+
 func TestMaterializeBuiltinPacks_DoesNotRewriteUnchangedFiles(t *testing.T) {
 	dir := t.TempDir()
 
diff --git a/cmd/gc/error_store.go b/cmd/gc/error_store.go
index dbe5db2e68..c09808c3cb 100644
--- a/cmd/gc/error_store.go
+++ b/cmd/gc/error_store.go
@@ -10,10 +10,11 @@ func (s unavailableStore) Create(beads.Bead) (beads.Bead, error)             { r
 func (s unavailableStore) Get(string) (beads.Bead, error)                    { return beads.Bead{}, s.err }
 func (s unavailableStore) Update(string, beads.UpdateOpts) error             { return s.err }
 func (s unavailableStore) Close(string) error                                { return s.err }
+func (s unavailableStore) Reopen(string) error                               { return s.err }
 func (s unavailableStore) CloseAll([]string, map[string]string) (int, error) { return 0, s.err }
 func (s unavailableStore) List(beads.ListQuery) ([]beads.Bead, error)        { return nil, s.err }
 func (s unavailableStore) ListOpen(...string) ([]beads.Bead, error)          { return nil, s.err }
-func (s unavailableStore) Ready() ([]beads.Bead, error)                      { return nil, s.err }
+func (s unavailableStore) Ready(...beads.ReadyQuery) ([]beads.Bead, error)   { return nil, s.err }
 func (s unavailableStore) Children(string, ...beads.QueryOpt) ([]beads.Bead, error) {
 	return nil, s.err
 }
diff --git a/cmd/gc/graph_dispatch_mem_test.go b/cmd/gc/graph_dispatch_mem_test.go
index c73d4d4446..ee15d6df48 100644
--- a/cmd/gc/graph_dispatch_mem_test.go
+++ b/cmd/gc/graph_dispatch_mem_test.go
@@ -433,8 +433,8 @@ func TestGraphWorkflowInMemoryRouteUsesControlDispatcherForControlBeads(t *testi
 		if bead.Assignee != config.ControlDispatcherAgentName {
 			t.Fatalf("control bead %s assignee = %q, want %q", bead.ID, bead.Assignee, config.ControlDispatcherAgentName)
 		}
-		if bead.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-			t.Fatalf("control bead %s gc.routed_to = %q, want %q", bead.ID, bead.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+		if got := bead.Metadata["gc.routed_to"]; got != "" {
+			t.Fatalf("control bead %s gc.routed_to = %q, want empty direct dispatcher assignee", bead.ID, got)
 		}
 	}
 	if !foundControl {
diff --git a/cmd/gc/hook_output.go b/cmd/gc/hook_output.go
index 648041418d..c3c31bb6bc 100644
--- a/cmd/gc/hook_output.go
+++ b/cmd/gc/hook_output.go
@@ -6,19 +6,51 @@ import (
 	"strings"
 )
 
-const hookOutputFormatGemini = "gemini"
+const (
+	hookOutputFormatCodex  = "codex"
+	hookOutputFormatGemini = "gemini"
+)
 
 func writeProviderHookContext(stdout io.Writer, format, content string) error {
+	return writeProviderHookContextForEvent(stdout, format, "", content)
+}
+
+func writeProviderHookContextForEvent(stdout io.Writer, format, eventName, content string) error {
 	if content == "" {
 		return nil
 	}
-	if strings.EqualFold(strings.TrimSpace(format), hookOutputFormatGemini) {
+	switch strings.ToLower(strings.TrimSpace(format)) {
+	case hookOutputFormatCodex:
+		return json.NewEncoder(stdout).Encode(codexHookOutput(eventName, content))
+	case hookOutputFormatGemini:
 		return json.NewEncoder(stdout).Encode(geminiHookAdditionalContext(content))
 	}
 	_, err := io.WriteString(stdout, content)
 	return err
 }
 
+func codexHookOutput(eventName, content string) map[string]any {
+	if strings.EqualFold(strings.TrimSpace(eventName), "Stop") {
+		return map[string]any{
+			"decision": "block",
+			"reason":   strings.TrimRight(content, "\n"),
+		}
+	}
+	return codexHookAdditionalContext(eventName, content)
+}
+
+func codexHookAdditionalContext(eventName, content string) map[string]any {
+	if eventName == "" {
+		eventName = "SessionStart"
+	}
+	return map[string]any{
+		"hookSpecificOutput": map[string]any{
+			"hookEventName":     eventName,
+			"additionalContext": strings.TrimRight(content, "\n"),
+		},
+	}
+}
+
 func geminiHookAdditionalContext(content string) map[string]any {
 	return map[string]any{
 		"hookSpecificOutput": map[string]any{
diff --git a/cmd/gc/hook_output_test.go b/cmd/gc/hook_output_test.go
index 7a8d83c0b9..dc532fa092 100644
--- a/cmd/gc/hook_output_test.go
+++ b/cmd/gc/hook_output_test.go
@@ -26,6 +26,52 @@ func TestWriteProviderHookContextGemini(t *testing.T) {
 	}
 }
 
+func TestWriteProviderHookContextCodex(t *testing.T) {
+	var out bytes.Buffer
+	err := writeProviderHookContextForEvent(&out, "codex", "Stop", "<system-reminder>\nhello\n</system-reminder>\n")
+	if err != nil {
+		t.Fatalf("writeProviderHookContextForEvent: %v", err)
+	}
+
+	var payload struct {
+		Decision string `json:"decision"`
+		Reason   string `json:"reason"`
+	}
+	if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
+		t.Fatalf("unmarshal output: %v\n%s", err, out.String())
+	}
+	if got, want := payload.Decision, "block"; got != want {
+		t.Fatalf("decision = %q, want %q", got, want)
+	}
+	if got, want := payload.Reason, "<system-reminder>\nhello\n</system-reminder>"; got != want {
+		t.Fatalf("reason = %q, want %q", got, want)
+	}
+}
+
+func TestWriteProviderHookContextCodexAdditionalContext(t *testing.T) {
+	var out bytes.Buffer
+	err := writeProviderHookContextForEvent(&out, "codex", "UserPromptSubmit", "<system-reminder>\nhello\n</system-reminder>\n")
+	if err != nil {
+		t.Fatalf("writeProviderHookContextForEvent: %v", err)
+	}
+
+	var payload struct {
+		HookSpecificOutput struct {
+			HookEventName     string `json:"hookEventName"`
+			AdditionalContext string `json:"additionalContext"`
+		} `json:"hookSpecificOutput"`
+	}
+	if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
+		t.Fatalf("unmarshal output: %v\n%s", err, out.String())
+	}
+	if got, want := payload.HookSpecificOutput.HookEventName, "UserPromptSubmit"; got != want {
+		t.Fatalf("hookEventName = %q, want %q", got, want)
+	}
+	if got, want := payload.HookSpecificOutput.AdditionalContext, "<system-reminder>\nhello\n</system-reminder>"; got != want {
+		t.Fatalf("additionalContext = %q, want %q", got, want)
+	}
+}
+
 func TestWriteProviderHookContextPlain(t *testing.T) {
 	var out bytes.Buffer
 	err := writeProviderHookContext(&out, "", "<system-reminder>\nhello\n</system-reminder>\n")
diff --git a/cmd/gc/hooks.go b/cmd/gc/hooks.go
index 48d0764845..8295d62ca5 100644
--- a/cmd/gc/hooks.go
+++ b/cmd/gc/hooks.go
@@ -23,9 +23,10 @@ func hookScript(eventType string) string {
 # Args: $1=issue_id  $2=event_type  stdin=issue JSON
 GC_BIN="${GC_BIN:-gc}"
 DATA=$(cat)
+PAYLOAD=$(printf '{"bead":%%s}' "$DATA")
 title=$(echo "$DATA" | grep -o '"title":"[^"]*"' | head -1 | cut -d'"' -f4)
 (
-  "$GC_BIN" event emit %s --subject "$1" --message "$title" --payload "$DATA" >/dev/null 2>&1 || true
+  "$GC_BIN" event emit %s --subject "$1" --message "$title" --payload "$PAYLOAD" >/dev/null 2>&1 || true
 ) </dev/null >/dev/null 2>&1 &
 `, eventType)
 }
@@ -42,9 +43,10 @@ func closeHookScript() string {
 # Args: $1=issue_id  $2=event_type  stdin=issue JSON
 GC_BIN="${GC_BIN:-gc}"
 DATA=$(cat)
+PAYLOAD=$(printf '{"bead":%s}' "$DATA")
 title=$(echo "$DATA" | grep -o '"title":"[^"]*"' | head -1 | cut -d'"' -f4)
 (
-  "$GC_BIN" event emit bead.closed --subject "$1" --message "$title" --payload "$DATA" >/dev/null 2>&1 || true
+  "$GC_BIN" event emit bead.closed --subject "$1" --message "$title" --payload "$PAYLOAD" >/dev/null 2>&1 || true
   # Auto-close parent convoy if all siblings are now closed.
   "$GC_BIN" convoy autoclose "$1" >/dev/null 2>&1 || true
   # Auto-close open molecule/wisp children so they don't outlive the parent.
diff --git a/cmd/gc/hooks_test.go b/cmd/gc/hooks_test.go
index be3034c531..1237aab7a9 100644
--- a/cmd/gc/hooks_test.go
+++ b/cmd/gc/hooks_test.go
@@ -57,6 +57,12 @@ func TestInstallBeadHooksCreatesScripts(t *testing.T) {
 			if !strings.Contains(content, `"$GC_BIN" event emit`) {
 				t.Errorf("hook %s missing '\"$GC_BIN\" event emit':\n%s", tc.filename, content)
 			}
+			if !strings.Contains(content, `PAYLOAD=$(printf '{"bead":%s}' "$DATA")`) {
+				t.Errorf("hook %s does not wrap bd JSON as BeadEventPayload:\n%s", tc.filename, content)
+			}
+			if !strings.Contains(content, `--payload "$PAYLOAD"`) {
+				t.Errorf("hook %s emits raw DATA instead of wrapped PAYLOAD:\n%s", tc.filename, content)
+			}
 			// Best-effort: stderr redirected, || true.
 			if !strings.Contains(content, "|| true") {
 				t.Errorf("hook %s missing '|| true' (best-effort):\n%s", tc.filename, content)
diff --git a/cmd/gc/init_provider_readiness.go b/cmd/gc/init_provider_readiness.go
index 7102c91163..20adb93993 100644
--- a/cmd/gc/init_provider_readiness.go
+++ b/cmd/gc/init_provider_readiness.go
@@ -558,13 +558,11 @@ func checkHardDependencies(cityPath string) []missingDep {
 			continue
 		}
 		if d.minVersion != "" {
-			if ver := parseDepVersion(d.name); ver != "" {
-				if compareVersions(ver, d.minVersion) < 0 {
-					missing = append(missing, missingDep{
-						name:        fmt.Sprintf("%s (found v%s, need v%s+)", d.name, ver, d.minVersion),
-						installHint: d.installHint,
-					})
-				}
+			if ver, ok := depMeetsMinVersion(d.name, d.minVersion); ver != "" && !ok {
+				missing = append(missing, missingDep{
+					name:        fmt.Sprintf("%s (found v%s, need v%s+)", d.name, ver, d.minVersion),
+					installHint: d.installHint,
+				})
 			}
 		}
 	}
@@ -600,13 +598,29 @@ func initNeedsBdTooling(cityPath string) bool {
 	return workspaceUsesManagedBdStoreContract(cityPath, cfg.Rigs)
 }
 
-// parseDepVersion runs "<binary> version" and extracts a semver-like version string.
-// Returns "" if the version cannot be determined (non-fatal).
-func parseDepVersion(binary string) string {
+func depMeetsMinVersion(binary, minVersion string) (string, bool) {
 	line, err := initRunVersion(binary)
 	if err != nil {
-		return ""
+		return "", true
+	}
+	if binary == "dolt" {
+		info, err := doltversion.CheckFinalMinimum(line, minVersion)
+		if errors.Is(err, doltversion.ErrPreRelease) || errors.Is(err, doltversion.ErrBelowMinimum) {
+			return info.Raw, false
+		}
+		if err != nil {
+			return "", true
+		}
+		return info.Raw, true
+	}
+	ver := parseDepVersionLine(line)
+	if ver == "" {
+		return "", true
 	}
+	return ver, compareVersions(ver, minVersion) >= 0
+}
+
+func parseDepVersionLine(line string) string {
 	// Patterns: "dolt version 1.86.1", "bd version 1.0.0 (3ac028bf: ...)"
 	for _, field := range strings.Fields(line) {
 		if len(field) > 0 && field[0] >= '0' && field[0] <= '9' && strings.Contains(field, ".") {
diff --git a/cmd/gc/init_provider_readiness_test.go b/cmd/gc/init_provider_readiness_test.go
index ab6612b614..ca2539f833 100644
--- a/cmd/gc/init_provider_readiness_test.go
+++ b/cmd/gc/init_provider_readiness_test.go
@@ -670,6 +670,39 @@ func TestCheckHardDependenciesAcceptsPythonFallbackForBdContract(t *testing.T) {
 	}
 }
 
+func TestCheckHardDependenciesRejectsDoltPreReleaseAtFloor(t *testing.T) {
+	t.Setenv("GC_BEADS", "bd")
+
+	oldLookPath := initLookPath
+	initLookPath = func(name string) (string, error) {
+		return "/usr/bin/" + name, nil
+	}
+	t.Cleanup(func() { initLookPath = oldLookPath })
+
+	oldRunVersion := initRunVersion
+	initRunVersion = func(binary string) (string, error) {
+		switch binary {
+		case "dolt":
+			return "dolt version 1.86.2-rc1", nil
+		case "bd":
+			return "bd version " + bdMinVersion, nil
+		case "flock", "tmux", "jq", "git", "pgrep", "lsof":
+			return binary + " version", nil
+		default:
+			return binary + " version " + doltMinVersion, nil
+		}
+	}
+	t.Cleanup(func() { initRunVersion = oldRunVersion })
+
+	missing := checkHardDependencies(t.TempDir())
+	if len(missing) != 1 {
+		t.Fatalf("missing deps = %#v, want only dolt prerelease rejection", missing)
+	}
+	if !strings.Contains(missing[0].name, "dolt") || !strings.Contains(missing[0].name, "1.86.2-rc1") {
+		t.Fatalf("missing dep = %#v, want dolt prerelease version in dependency name", missing[0])
+	}
+}
+
 func TestCheckHardDependenciesRequiresBdToolsForBdRigUnderFileCity(t *testing.T) {
 	cityDir := t.TempDir()
 	rigDir := filepath.Join(cityDir, "frontend")
diff --git a/cmd/gc/lifecycle_coordination_test.go b/cmd/gc/lifecycle_coordination_test.go
index 864b8ab44e..e4ba8a3be6 100644
--- a/cmd/gc/lifecycle_coordination_test.go
+++ b/cmd/gc/lifecycle_coordination_test.go
@@ -374,6 +374,47 @@ func TestLifecycleCoordination_InitDirIfReady_RetriesTransientManagedDoltFailure
 	}
 }
 
+func TestLifecycleCoordination_InitDirIfReady_RetriesManagedDoltSchemaNotReady(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	MaterializeBuiltinPacks(dir) //nolint:errcheck
+	t.Setenv("GC_BEADS", "bd")
+
+	originalEnsure := initDirIfReadyEnsureBeadsProvider
+	originalInitAndHook := initDirIfReadyInitAndHookDir
+	originalDelay := initDirIfReadyRetryDelay
+	t.Cleanup(func() {
+		initDirIfReadyEnsureBeadsProvider = originalEnsure
+		initDirIfReadyInitAndHookDir = originalInitAndHook
+		initDirIfReadyRetryDelay = originalDelay
+	})
+
+	initDirIfReadyRetryDelay = 0
+	initDirIfReadyEnsureBeadsProvider = func(_ string) error { return nil }
+
+	var initCalls int
+	initDirIfReadyInitAndHookDir = func(_, _, _ string) error {
+		initCalls++
+		if initCalls == 1 {
+			return fmt.Errorf("bd list: exit status 1: table not found: issues")
+		}
+		return nil
+	}
+
+	deferred, err := initDirIfReady(dir, dir, "gc")
+	if err != nil {
+		t.Fatalf("initDirIfReady() error = %v, want nil after retry", err)
+	}
+	if deferred {
+		t.Fatal("initDirIfReady() deferred = true, want false")
+	}
+	if initCalls != 2 {
+		t.Fatalf("initAndHookDir calls = %d, want 2", initCalls)
+	}
+}
+
 func TestLifecycleCoordination_InitDirIfReady_DoesNotRetryNonManagedProviderFailure(t *testing.T) {
 	dir := t.TempDir()
 	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
diff --git a/cmd/gc/lifecycle_live_query_test.go b/cmd/gc/lifecycle_live_query_test.go
index bbcfc1a2fe..85028f3272 100644
--- a/cmd/gc/lifecycle_live_query_test.go
+++ b/cmd/gc/lifecycle_live_query_test.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"io"
 	"testing"
 
@@ -9,7 +10,7 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 )
 
-func TestCollectAssignedWorkBeads_UsesLiveReadyForAssignedOpenHandoff(t *testing.T) {
+func TestCollectAssignedWorkBeads_UsesCachedReadyEventStateForAssignedOpenHandoff(t *testing.T) {
 	t.Parallel()
 
 	backing := beads.NewMemStore()
@@ -46,13 +47,103 @@ func TestCollectAssignedWorkBeads_UsesLiveReadyForAssignedOpenHandoff(t *testing
 	if err := backing.Update(blocker.ID, beads.UpdateOpts{Status: &closed}); err != nil {
 		t.Fatalf("Update(%s, closed): %v", blocker.ID, err)
 	}
+	closedBlocker, err := backing.Get(blocker.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", blocker.ID, err)
+	}
+	payload, err := json.Marshal(closedBlocker)
+	if err != nil {
+		t.Fatalf("Marshal(%s): %v", blocker.ID, err)
+	}
+	cache.ApplyEvent("bead.updated", payload)
 
 	got, _ := collectAssignedWorkBeads(&config.City{}, cache)
 	if len(got) != 1 || got[0].ID != handoff.ID {
-		t.Fatalf("collectAssignedWorkBeads() = %#v, want [%s] from live ready state", got, handoff.ID)
+		t.Fatalf("collectAssignedWorkBeads() = %#v, want [%s] from cached ready event state", got, handoff.ID)
 	}
 }
 
+func TestCollectAssignedWorkBeads_UsesExplicitDepEventsForCachedReady(t *testing.T) {
+	t.Parallel()
+
+	t.Run("dep add", func(t *testing.T) {
+		t.Parallel()
+
+		backing := beads.NewMemStore()
+		blocker, err := backing.Create(beads.Bead{
+			Title:  "blocker",
+			Type:   "task",
+			Status: "open",
+		})
+		if err != nil {
+			t.Fatalf("Create(blocker): %v", err)
+		}
+		handoff, err := backing.Create(beads.Bead{
+			Title:    "handoff",
+			Type:     "task",
+			Status:   "open",
+			Assignee: "worker",
+		})
+		if err != nil {
+			t.Fatalf("Create(handoff): %v", err)
+		}
+		cache := beads.NewCachingStoreForTest(backing, nil)
+		if err := cache.PrimeActive(); err != nil {
+			t.Fatalf("PrimeActive: %v", err)
+		}
+
+		if err := backing.DepAdd(handoff.ID, blocker.ID, "blocks"); err != nil {
+			t.Fatalf("backing DepAdd(%s <- %s): %v", handoff.ID, blocker.ID, err)
+		}
+		cache.ApplyDepEvent(handoff.ID, []beads.Dep{{IssueID: handoff.ID, DependsOnID: blocker.ID, Type: "blocks"}})
+
+		got, _ := collectAssignedWorkBeads(&config.City{}, cache)
+		if len(got) != 0 {
+			t.Fatalf("collectAssignedWorkBeads() = %#v, want explicit dep-add event to block handoff", got)
+		}
+	})
+
+	t.Run("dep remove", func(t *testing.T) {
+		t.Parallel()
+
+		backing := beads.NewMemStore()
+		blocker, err := backing.Create(beads.Bead{
+			Title:  "blocker",
+			Type:   "task",
+			Status: "open",
+		})
+		if err != nil {
+			t.Fatalf("Create(blocker): %v", err)
+		}
+		handoff, err := backing.Create(beads.Bead{
+			Title:    "handoff",
+			Type:     "task",
+			Status:   "open",
+			Assignee: "worker",
+		})
+		if err != nil {
+			t.Fatalf("Create(handoff): %v", err)
+		}
+		if err := backing.DepAdd(handoff.ID, blocker.ID, "blocks"); err != nil {
+			t.Fatalf("backing DepAdd(%s <- %s): %v", handoff.ID, blocker.ID, err)
+		}
+		cache := beads.NewCachingStoreForTest(backing, nil)
+		if err := cache.PrimeActive(); err != nil {
+			t.Fatalf("PrimeActive: %v", err)
+		}
+
+		if err := backing.DepRemove(handoff.ID, blocker.ID); err != nil {
+			t.Fatalf("backing DepRemove(%s <- %s): %v", handoff.ID, blocker.ID, err)
+		}
+		cache.ApplyDepEvent(handoff.ID, nil)
+
+		got, _ := collectAssignedWorkBeads(&config.City{}, cache)
+		if len(got) != 1 || got[0].ID != handoff.ID {
+			t.Fatalf("collectAssignedWorkBeads() = %#v, want [%s] after explicit dep-remove event", got, handoff.ID)
+		}
+	})
+}
+
 func TestSessionHasOpenAssignedWorkInStore_UsesLiveOpenOwnership(t *testing.T) {
 	t.Parallel()
 
@@ -111,7 +202,13 @@ func TestUnclaimWorkAssignedToRetiredSessionBead_UsesLiveOpenOwnership(t *testin
 		t.Fatalf("Update(%s, reassigned): %v", work.ID, err)
 	}
 
-	unclaimWorkAssignedToRetiredSessionBead(cache, "retired-session", "worker", io.Discard)
+	unclaimWorkAssignedToRetiredSessionBead(
+		cache,
+		nil,
+		beads.Bead{ID: "retired-session"},
+		"worker",
+		io.Discard,
+	)
 
 	got, err := backing.Get(work.ID)
 	if err != nil {
diff --git a/cmd/gc/main.go b/cmd/gc/main.go
index 73a0f7cccf..edd3887178 100644
--- a/cmd/gc/main.go
+++ b/cmd/gc/main.go
@@ -86,6 +86,13 @@ var rigFlag string
 // run executes the gc CLI with the given args, writing output to stdout and
 // errors to stderr. Returns the exit code.
 func run(args []string, stdout, stderr io.Writer) int {
+	prevCityFlag, prevRigFlag := cityFlag, rigFlag
+	cityFlag, rigFlag = "", ""
+	defer func() {
+		cityFlag = prevCityFlag
+		rigFlag = prevRigFlag
+	}()
+
 	// Initialize OTel telemetry (opt-in via GC_OTEL_METRICS_URL / GC_OTEL_LOGS_URL).
 	provider, err := telemetry.Init(context.Background(), "gascity", version)
 	if err != nil {
@@ -143,6 +150,7 @@ func newRootCmd(stdout, stderr io.Writer) *cobra.Command {
 		"path to the city directory (default: walk up from cwd)")
 	root.PersistentFlags().StringVar(&rigFlag, "rig", "",
 		"rig name or path (default: discover from cwd)")
+	_ = root.RegisterFlagCompletionFunc("rig", completeRigFlagNames)
 	root.AddCommand(
 		newStartCmd(stdout, stderr),
 		newInitCmd(stdout, stderr),
@@ -191,6 +199,7 @@ func newRootCmd(stdout, stderr io.Writer) *cobra.Command {
 		newFormulaCmd(stdout, stderr),
 		newBdCmd(stdout, stderr),
 		newBdStoreBridgeCmd(stdout, stderr),
+		newDoltCleanupCmd(stdout, stderr),
 		newDoltConfigCmd(stdout, stderr),
 		newDoltStateCmd(stdout, stderr),
 		newShellCmd(stdout, stderr),
@@ -450,11 +459,19 @@ func validateCityPath(p string) (string, error) {
 }
 
 // resolveRigToContext resolves a rig name or path to a full context by scanning
-// registered cities and their machine-local .gc/site.toml rig bindings.
+// registered cities and their machine-local .gc/site.toml rig bindings. This
+// is an explicit rig-resolution path, so stale-sibling warnings are emitted
+// to os.Stderr (deduped across the two registry scans below).
 func resolveRigToContext(nameOrPath string) (resolvedContext, error) {
-	if matches, err := registeredRigBindingsByName(nameOrPath, true); err != nil {
+	var allStale []staleRegisteredCity
+	defer func() { emitStaleRegisteredCityWarnings(os.Stderr, allStale) }()
+
+	matches, stale, err := registeredRigBindingsByName(nameOrPath, true)
+	allStale = append(allStale, stale...)
+	if err != nil {
 		return resolvedContext{}, err
-	} else if len(matches) > 0 {
+	}
+	if len(matches) > 0 {
 		return resolveRigBindingMatches(nameOrPath, matches)
 	}
 
@@ -462,17 +479,24 @@ func resolveRigToContext(nameOrPath string) (resolvedContext, error) {
 	if err != nil {
 		return resolvedContext{}, fmt.Errorf("rig %q: %w", nameOrPath, err)
 	}
-	if matches, err := registeredRigBindingsByPath(abs, true); err != nil {
+	matches, stale, err = registeredRigBindingsByPath(abs, true)
+	allStale = append(allStale, stale...)
+	if err != nil {
 		return resolvedContext{}, err
-	} else if len(matches) > 0 {
+	}
+	if len(matches) > 0 {
 		return resolveRigBindingMatches(abs, matches)
 	}
 
 	return resolvedContext{}, fmt.Errorf("rig %q is not registered in any city", nameOrPath)
 }
 
+// resolveRigPathToContext resolves an explicit path argument to a registered
+// rig context. Stale-sibling warnings are emitted to os.Stderr because the
+// caller is explicitly depending on the registry.
 func resolveRigPathToContext(dir string) (resolvedContext, bool, error) {
-	matches, err := registeredRigBindingsByPath(dir, true)
+	matches, stale, err := registeredRigBindingsByPath(dir, true)
+	emitStaleRegisteredCityWarnings(os.Stderr, stale)
 	if err != nil {
 		return resolvedContext{}, false, err
 	}
@@ -488,8 +512,10 @@ func resolveRigPathToContext(dir string) (resolvedContext, bool, error) {
 
 // lookupRigFromCwd checks registered city site bindings for a rig matching cwd.
 // Ambiguous bindings deliberately fall through to the city walk-up fallback.
+// This is an opportunistic probe (failOnLoadError=false): stale-sibling
+// warnings are intentionally dropped so unrelated commands stay quiet.
 func lookupRigFromCwd(cwd string) (resolvedContext, bool) {
-	matches, err := registeredRigBindingsByPath(cwd, false)
+	matches, _, err := registeredRigBindingsByPath(cwd, false)
 	if err != nil || len(matches) != 1 {
 		return resolvedContext{}, false
 	}
@@ -524,35 +550,70 @@ type registeredRigBinding struct {
 	Path string
 }
 
-func registeredRigBindingsByName(name string, failOnLoadError bool) ([]registeredRigBinding, error) {
+func registeredRigBindingsByName(name string, failOnLoadError bool) (matches []registeredRigBinding, stale []staleRegisteredCity, err error) {
 	return registeredRigBindings(failOnLoadError, func(binding registeredRigBinding) bool {
 		return binding.Rig.Name == name
 	})
 }
 
-func registeredRigBindingsByPath(dir string, failOnLoadError bool) ([]registeredRigBinding, error) {
+func registeredRigBindingsByPath(dir string, failOnLoadError bool) (matches []registeredRigBinding, stale []staleRegisteredCity, err error) {
 	dir = normalizePathForCompare(dir)
-	matches, err := registeredRigBindings(failOnLoadError, func(binding registeredRigBinding) bool {
+	matches, stale, err = registeredRigBindings(failOnLoadError, func(binding registeredRigBinding) bool {
 		rigPath := normalizePathForCompare(binding.Path)
 		return pathWithinScope(dir, rigPath)
 	})
 	if err != nil {
-		return nil, err
+		return nil, stale, err
 	}
-	return keepDeepestRigBindings(matches), nil
+	return keepDeepestRigBindings(matches), stale, nil
+}
+
+// staleRegisteredCity identifies a registered city whose city.toml is
+// missing on disk. registeredRigBindings returns these as structured data
+// instead of emitting to stderr so callers that are explicitly resolving a
+// registered rig can warn, while opportunistic probes stay quiet.
+type staleRegisteredCity struct {
+	Label string
+	Path  string
 }
 
-func registeredRigBindings(failOnLoadError bool, match func(registeredRigBinding) bool) ([]registeredRigBinding, error) {
+// emitStaleRegisteredCityWarnings writes one `warning: ...` line per stale
+// registry entry. Each Label is emitted at most once even if stale carries
+// duplicates (e.g. from callers that invoke registeredRigBindings twice in
+// one command).
+func emitStaleRegisteredCityWarnings(w io.Writer, stale []staleRegisteredCity) {
+	if w == nil || len(stale) == 0 {
+		return
+	}
+	seen := make(map[string]struct{}, len(stale))
+	for _, s := range stale {
+		if _, already := seen[s.Label]; already {
+			continue
+		}
+		seen[s.Label] = struct{}{}
+		fmt.Fprintf(w, "warning: skipping stale registered city %q: city.toml missing at %s\n", //nolint:errcheck // best-effort stderr
+			s.Label, s.Path)
+	}
+}
+
+func registeredRigBindings(failOnLoadError bool, match func(registeredRigBinding) bool) (_ []registeredRigBinding, stale []staleRegisteredCity, _ error) {
 	reg := supervisor.NewRegistry(supervisor.RegistryPath())
 	cities, err := reg.List()
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	var matched []registeredRigBinding
 	var loadErrors []string
 	for _, c := range cities {
 		cfg, err := loadCityConfigSuppressDeprecatedOrderWarnings(c.Path, io.Discard)
 		if err != nil {
+			// Tolerate stale registry entries whose city.toml has been
+			// deleted out from under the registry, but keep missing includes
+			// or other config dependencies as load errors.
+			if cityTOML, ok := missingRootCityTOML(err, c.Path); ok {
+				stale = append(stale, staleRegisteredCity{Label: registeredCityLabel(c), Path: cityTOML})
+				continue
+			}
 			loadErrors = append(loadErrors, fmt.Sprintf("%s: %v", registeredCityLabel(c), err))
 			continue
 		}
@@ -590,9 +651,21 @@ func registeredRigBindings(failOnLoadError bool, match func(registeredRigBinding
 		}
 	}
 	if len(loadErrors) > 0 && (failOnLoadError || len(matched) > 0) {
-		return nil, fmt.Errorf("loading registered city rig bindings: %s", strings.Join(loadErrors, "; "))
+		return nil, stale, fmt.Errorf("loading registered city rig bindings: %s", strings.Join(loadErrors, "; "))
+	}
+	return matched, stale, nil
+}
+
+func missingRootCityTOML(err error, cityPath string) (string, bool) {
+	if !errors.Is(err, os.ErrNotExist) {
+		return "", false
+	}
+	var pathErr *os.PathError
+	if !errors.As(err, &pathErr) {
+		return "", false
 	}
-	return matched, nil
+	cityTOML := filepath.Clean(filepath.Join(cityPath, "city.toml"))
+	return cityTOML, samePath(pathErr.Path, cityTOML)
 }
 
 func keepDeepestRigBindings(matches []registeredRigBinding) []registeredRigBinding {
diff --git a/cmd/gc/main_test.go b/cmd/gc/main_test.go
index 8e5387c642..143c802b40 100644
--- a/cmd/gc/main_test.go
+++ b/cmd/gc/main_test.go
@@ -60,6 +60,24 @@ func configureIsolatedRuntimeEnv(t *testing.T) {
 	}
 }
 
+func TestRunDoesNotLeakPersistentCityOrRigFlags(t *testing.T) {
+	prevCityFlag, prevRigFlag := cityFlag, rigFlag
+	t.Cleanup(func() {
+		cityFlag = prevCityFlag
+		rigFlag = prevRigFlag
+	})
+	cityFlag = "previous-city"
+	rigFlag = "previous-rig"
+
+	var stdout, stderr bytes.Buffer
+	if code := run([]string{"--city", "/tmp/leaked-city", "--rig", "leaked-rig", "version"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("run(version) = %d; stderr: %s", code, stderr.String())
+	}
+	if cityFlag != "previous-city" || rigFlag != "previous-rig" {
+		t.Fatalf("persistent flags leaked after run: city=%q rig=%q", cityFlag, rigFlag)
+	}
+}
+
 func mustLoadTestSiteBinding(t *testing.T, fs fsys.FS, cityPath string) *config.SiteBinding {
 	t.Helper()
 	binding, err := config.LoadSiteBinding(fs, cityPath)
@@ -896,6 +914,95 @@ func TestResolveSessionNameWithStore(t *testing.T) {
 	}
 }
 
+type noBroadSessionNameLookupStore struct {
+	*beads.MemStore
+	t *testing.T
+}
+
+func (s noBroadSessionNameLookupStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == sessionBeadLabel && len(query.Metadata) == 0 {
+		s.t.Fatalf("session name lookup used broad session label scan: %+v", query)
+	}
+	return s.MemStore.List(query)
+}
+
+func TestFindSessionNameByTemplateUsesTargetedLookup(t *testing.T) {
+	store := noBroadSessionNameLookupStore{MemStore: beads.NewMemStore(), t: t}
+	_, err := store.Create(beads.Bead{
+		Title:  "worker-pool",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"agent_name":           "worker",
+			"template":             "worker",
+			"session_name":         "s-pool",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"agent_name":   "worker",
+			"session_name": "s-worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := findSessionNameByTemplate(store, "worker")
+	if got != "s-worker" {
+		t.Fatalf("findSessionNameByTemplate(worker) = %q, want s-worker", got)
+	}
+}
+
+func TestResolveTemplateSessionBeadIDUsesTargetedLookup(t *testing.T) {
+	store := noBroadSessionNameLookupStore{MemStore: beads.NewMemStore(), t: t}
+	bead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"agent_name":   "worker",
+			"session_name": "s-worker",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	params := &agentBuildParams{
+		cityName:   "phase0-city",
+		cityPath:   t.TempDir(),
+		workspace:  &config.Workspace{Provider: "test-agent"},
+		providers:  map[string]config.ProviderSpec{"test-agent": {DisplayName: "Test Agent", Command: "true"}},
+		lookPath:   func(string) (string, error) { return filepath.Join("/usr/bin", "true"), nil },
+		fs:         fsys.OSFS{},
+		beaconTime: time.Unix(0, 0),
+		beadNames:  make(map[string]string),
+		beadStore:  store,
+		stderr:     io.Discard,
+	}
+	agentCfg := &config.Agent{
+		Name:     "worker",
+		Provider: "test-agent",
+	}
+
+	tp, err := resolveTemplate(params, agentCfg, agentCfg.QualifiedName(), nil)
+	if err != nil {
+		t.Fatalf("resolveTemplate: %v", err)
+	}
+	if got := tp.Env["GC_SESSION_ID"]; got != bead.ID {
+		t.Fatalf("GC_SESSION_ID = %q, want %q", got, bead.ID)
+	}
+}
+
 func TestFindSessionNameByTemplate_SkipsClosedBeads(t *testing.T) {
 	store := beads.NewMemStore()
 	b, err := store.Create(beads.Bead{
@@ -1087,197 +1194,931 @@ func TestDiscoverSessionBeads_SkipsPoolAgentWithZeroDesired(t *testing.T) {
 
 	cfg := &config.City{
 		Agents: []config.Agent{
-			{
-				Name:              "polecat",
-				StartCommand:      "echo",
-				MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(-1),
+			{
+				Name:              "polecat",
+				StartCommand:      "echo",
+				MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(-1),
+			},
+		},
+	}
+	sp := runtime.NewFake()
+	bp := newAgentBuildParams("test", t.TempDir(), cfg, sp, time.Now(), store, io.Discard)
+
+	// Empty desired = pool eval returned 0 (no work).
+	desired := make(map[string]TemplateParams)
+	discoverSessionBeads(bp, cfg, desired, io.Discard)
+
+	if len(desired) != 0 {
+		t.Errorf("pool agent with 0 desired should not be re-added from stale bead, got %d entries: %v",
+			len(desired), mapKeys(desired))
+	}
+}
+
+func TestDiscoverSessionBeads_IncludesPoolAgentWithDesired(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Two pool session beads — slot 1 and slot 2.
+	for _, slot := range []string{"1", "2"} {
+		_, err := store.Create(beads.Bead{
+			Title:  "polecat-" + slot,
+			Type:   "session",
+			Labels: []string{sessionBeadLabel, "template:polecat"},
+			Metadata: map[string]string{
+				"template":     "polecat",
+				"session_name": "polecat--polecat-" + slot,
+				"state":        "stopped",
+				"pool_slot":    slot,
+			},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{
+				Name:              "polecat",
+				StartCommand:      "echo",
+				MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(-1),
+			},
+		},
+	}
+	sp := runtime.NewFake()
+	bp := newAgentBuildParams("test", t.TempDir(), cfg, sp, time.Now(), store, io.Discard)
+
+	// Simulate pool eval returning 1 — slot 1 is in desired.
+	desired := map[string]TemplateParams{
+		"polecat--polecat-1": {TemplateName: "polecat", SessionName: "polecat--polecat-1"},
+	}
+	discoverSessionBeads(bp, cfg, desired, io.Discard)
+
+	// Slot 1 was already desired (should stay). Slot 2 is stopped and may
+	// or may not be included depending on pool discovery logic.
+	// Verify slot 1 is still present.
+	if _, ok := desired["polecat--polecat-1"]; !ok {
+		t.Errorf("slot 1 should remain in desired, got keys: %v", mapKeys(desired))
+	}
+}
+
+func TestFindSessionNameByTemplate_PrefersAgentNameMatch(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Create a managed agent bead (has agent_name from syncSessionBeads).
+	_, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   "session",
+		Labels: []string{"gc:session", "agent:worker"},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"agent_name":   "worker",
+			"session_name": "s-managed",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create an ad-hoc session bead (no agent_name, from gc session new).
+	_, err = store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   "session",
+		Labels: []string{"gc:session", "template:worker"},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "s-adhoc",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Should prefer the managed bead (agent_name match).
+	got := findSessionNameByTemplate(store, "worker")
+	if got != "s-managed" {
+		t.Errorf("findSessionNameByTemplate with managed + ad-hoc = %q, want s-managed", got)
+	}
+}
+
+func TestFindSessionNameByTemplate_TemplateMismatchNotFound(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Create a bead with template "worker" but query "myrig/worker".
+	_, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   "session",
+		Labels: []string{"gc:session", "template:worker"},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "s-gc-99",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Querying for rig-qualified name should NOT match bare template.
+	got := findSessionNameByTemplate(store, "myrig/worker")
+	if got != "" {
+		t.Errorf("findSessionNameByTemplate(myrig/worker) = %q, want empty (template mismatch)", got)
+	}
+}
+
+func TestFindSessionNameByTemplate_UsesLegacyAgentLabelForPoolInstance(t *testing.T) {
+	store := beads.NewMemStore()
+
+	_, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   "session",
+		Labels: []string{sessionBeadLabel, "agent:myrig/worker-1"},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"pool_slot":    "1",
+			"session_name": "s-legacy-worker-1",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got := findSessionNameByTemplate(store, "myrig/worker-1")
+	if got != "s-legacy-worker-1" {
+		t.Errorf("findSessionNameByTemplate(myrig/worker-1) = %q, want s-legacy-worker-1", got)
+	}
+}
+
+func TestLookupPoolSessionNames_RejectsSharedPrefixSiblingTemplates(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "worker",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel, "agent:frontend/worker-1"},
+			Metadata: map[string]string{
+				"template":     "worker",
+				"pool_slot":    "1",
+				"session_name": "s-worker-1",
+			},
+		},
+		{
+			Title:  "worker-supervisor",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel, "agent:frontend/worker-supervisor-1"},
+			Metadata: map[string]string{
+				"template":     "worker-supervisor",
+				"pool_slot":    "1",
+				"session_name": "s-worker-supervisor-1",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-1"] != "s-worker-1" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) missing worker-1: %#v", got)
+	}
+	if _, ok := got["frontend/worker-supervisor-1"]; ok {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) wrongly matched sibling template: %#v", got)
+	}
+}
+
+func TestLookupPoolSessionNames_PreservesUniqueLegacyLocalSessionNameIdentity(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "worker-5",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-5"] != "worker-5" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want unique local session_name to recover worker-5", got)
+	}
+}
+
+func TestLookupPoolSessionNames_DoesNotClaimAmbiguousLegacyLocalSessionNameIdentity(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(5)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "worker-5",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want ambiguous local session_name to stay unresolved", got)
+	}
+}
+
+func TestLookupPoolSessionNames_PreservesLegacyCommonNameSessionNameIdentity(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"common_name":  "worker",
+			"session_name": "worker-5",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-5"] != "worker-5" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want common_name-only legacy session_name to recover worker-5", got)
+	}
+}
+
+func TestLookupPoolSessionNames_DoesNotRecoverSessionNameSlotWhenAliasPresent(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "frontend/worker",
+			"alias":        "stale-worker-alias",
+			"session_name": "worker-5",
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want alias-bearing bead to stay unresolved", got)
+	}
+}
+
+type lookupPoolSessionNameCandidatesStore struct {
+	beads.Store
+	beads []beads.Bead
+}
+
+func (s lookupPoolSessionNameCandidatesStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	var result []beads.Bead
+	for _, bead := range s.beads {
+		if query.Label != "" {
+			matched := false
+			for _, label := range bead.Labels {
+				if label == query.Label {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				continue
+			}
+		}
+		result = append(result, bead)
+	}
+	return result, nil
+}
+
+func TestLookupPoolSessionNames_DoesNotRecoverOwnedPoolSessionNameSlot(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	store := lookupPoolSessionNameCandidatesStore{
+		beads: []beads.Bead{
+			{
+				ID:     "5",
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Status: "open",
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"template":     "frontend/worker",
+					"session_name": PoolSessionName("frontend/worker", "5"),
+				},
+			},
+		},
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want bead-owned pool session_name to stay unresolved", got)
+	}
+}
+
+func TestLookupPoolSessionNames_PrefersStampedBeadOverLegacyCollision(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "legacy worker",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+			},
+		},
+		{
+			Title:  "live worker",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-live-worker-7",
+				"agent_name":   "frontend/worker-7",
+				"pool_slot":    "7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-7"] != "s-live-worker-7" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want stamped bead to win the collision", got)
+	}
+}
+
+func TestLookupPoolSessionNames_DropsAmbiguousLegacyCollision(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "legacy worker a",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "legacy-worker-a",
+				"alias":        "frontend/worker-7",
+			},
+		},
+		{
+			Title:  "legacy worker b",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "legacy-worker-b",
+				"alias":        "frontend/worker-7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if _, ok := got["frontend/worker-7"]; ok {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want ambiguous legacy collision dropped", got)
+	}
+}
+
+func TestLookupPoolSessionNames_StampedBeadOverridesEarlierAmbiguousLegacyCollision(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "legacy worker a",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+			},
+		},
+		{
+			Title:  "legacy worker b",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "legacy-worker-b",
+				"alias":        "frontend/worker-7",
+			},
+		},
+		{
+			Title:  "live worker",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-live-worker-7",
+				"agent_name":   "frontend/worker-7",
+				"pool_slot":    "7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-7"] != "s-live-worker-7" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want stamped bead to override earlier ambiguous legacy collision", got)
+	}
+}
+
+func TestLookupPoolSessionNames_PrefersConcreteStampedBeadOverPoolSlotOnlyDuplicate(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "stale duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-stale-duplicate",
+				"pool_slot":    "7",
+			},
+		},
+		{
+			Title:  "live worker",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-live-worker-7",
+				"agent_name":   "frontend/worker-7",
+				"pool_slot":    "7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-7"] != "s-live-worker-7" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want concrete stamped bead to beat pool_slot-only duplicate", got)
+	}
+}
+
+func TestLookupPoolSessionNames_PrefersActiveStampedBeadOverCreatingScoreTie(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+		},
+	}
+	cfgAgent := &cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "creating duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "a-creating-worker-5",
+				"pool_slot":    "5",
+				"state":        "creating",
+			},
+		},
+		{
+			Title:  "active worker",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "z-active-worker-5",
+				"pool_slot":    "5",
+				"state":        "awake",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := lookupPoolSessionNames(store, cfg, cfgAgent)
+	if err != nil {
+		t.Fatalf("lookupPoolSessionNames: %v", err)
+	}
+	if got["frontend/worker-5"] != "z-active-worker-5" {
+		t.Fatalf("lookupPoolSessionNames(frontend/worker) = %#v, want active stamped bead to beat creating duplicate", got)
+	}
+}
+
+func TestResolvePoolSessionRefs_KeepsLowerScoredFallbackCandidate(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(10)},
+		},
+	}
+	agentCfg := cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "stale duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-stale-worker-7",
+				"pool_slot":    "7",
+			},
+		},
+		{
+			Title:  "live legacy",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+				"alias":        "frontend/worker-7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	refs := resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", runtime.NewFake(), io.Discard)
+	var got []string
+	for _, ref := range refs {
+		if ref.qualifiedInstance == "frontend/worker-7" {
+			got = append(got, ref.sessionName)
+		}
+	}
+	wantPrefix := []string{"s-stale-worker-7", "worker-7"}
+	if len(got) < len(wantPrefix) || !reflect.DeepEqual(got[:len(wantPrefix)], wantPrefix) {
+		t.Fatalf("resolvePoolSessionRefs(frontend/worker-7) = %v, want prefix %v", got, wantPrefix)
+	}
+}
+
+func TestSelectRunningPoolSessionRefs_PrefersLiveFallbackCandidate(t *testing.T) {
+	store := beads.NewMemStore()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(10)},
+		},
+	}
+	agentCfg := cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "stale duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"template":     "frontend/worker",
+				"session_name": "s-stale-worker-7",
+				"pool_slot":    "7",
+			},
+		},
+		{
+			Title:  "live legacy",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+				"alias":        "frontend/worker-7",
 			},
 		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
 	}
 	sp := runtime.NewFake()
-	bp := newAgentBuildParams("test", t.TempDir(), cfg, sp, time.Now(), store, io.Discard)
-
-	// Empty desired = pool eval returned 0 (no work).
-	desired := make(map[string]TemplateParams)
-	discoverSessionBeads(bp, cfg, desired, io.Discard)
+	if err := sp.Start(context.Background(), "worker-7", runtime.Config{Command: "echo"}); err != nil {
+		t.Fatal(err)
+	}
 
-	if len(desired) != 0 {
-		t.Errorf("pool agent with 0 desired should not be re-added from stale bead, got %d entries: %v",
-			len(desired), mapKeys(desired))
+	refs, err := selectRunningPoolSessionRefs(store, sp, cfg, resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", sp, io.Discard))
+	if err != nil {
+		t.Fatalf("selectRunningPoolSessionRefs: %v", err)
+	}
+	if len(refs) != 1 {
+		t.Fatalf("selectRunningPoolSessionRefs() returned %d refs, want 1: %#v", len(refs), refs)
+	}
+	if refs[0].qualifiedInstance != "frontend/worker-7" || refs[0].sessionName != "worker-7" {
+		t.Fatalf("selectRunningPoolSessionRefs() = %#v, want frontend/worker-7 -> worker-7", refs)
 	}
 }
 
-func TestDiscoverSessionBeads_IncludesPoolAgentWithDesired(t *testing.T) {
+func TestSelectRunningPoolSessionRefs_ReturnsAllLiveCandidatesForLogicalInstance(t *testing.T) {
 	store := beads.NewMemStore()
-
-	// Two pool session beads — slot 1 and slot 2.
-	for _, slot := range []string{"1", "2"} {
-		_, err := store.Create(beads.Bead{
-			Title:  "polecat-" + slot,
-			Type:   "session",
-			Labels: []string{sessionBeadLabel, "template:polecat"},
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(10)},
+		},
+	}
+	agentCfg := cfg.Agents[0]
+	for _, bead := range []beads.Bead{
+		{
+			Title:  "stale duplicate",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
 			Metadata: map[string]string{
-				"template":     "polecat",
-				"session_name": "polecat--polecat-" + slot,
-				"state":        "stopped",
-				"pool_slot":    slot,
+				"template":     "frontend/worker",
+				"session_name": "s-stale-worker-7",
+				"pool_slot":    "7",
 			},
-		})
-		if err != nil {
+		},
+		{
+			Title:  "live legacy",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: map[string]string{
+				"common_name":  "worker",
+				"session_name": "worker-7",
+				"alias":        "frontend/worker-7",
+			},
+		},
+	} {
+		if _, err := store.Create(bead); err != nil {
+			t.Fatal(err)
+		}
+	}
+	sp := runtime.NewFake()
+	for _, sessionName := range []string{"s-stale-worker-7", "worker-7"} {
+		if err := sp.Start(context.Background(), sessionName, runtime.Config{Command: "echo"}); err != nil {
 			t.Fatal(err)
 		}
 	}
 
+	refs, err := selectRunningPoolSessionRefs(store, sp, cfg, resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", sp, io.Discard))
+	if err != nil {
+		t.Fatalf("selectRunningPoolSessionRefs: %v", err)
+	}
+	got := make([]string, 0, len(refs))
+	for _, ref := range refs {
+		if ref.qualifiedInstance == "frontend/worker-7" {
+			got = append(got, ref.sessionName)
+		}
+	}
+	want := []string{"s-stale-worker-7", "worker-7"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("selectRunningPoolSessionRefs(frontend/worker-7) = %v, want %v", got, want)
+	}
+}
+
+func TestSelectRunningPoolSessionRefs_ReportsConcreteSessionOnProbeFailure(t *testing.T) {
 	cfg := &config.City{
 		Agents: []config.Agent{
-			{
-				Name:              "polecat",
-				StartCommand:      "echo",
-				MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(-1),
-			},
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(10)},
 		},
 	}
-	sp := runtime.NewFake()
-	bp := newAgentBuildParams("test", t.TempDir(), cfg, sp, time.Now(), store, io.Discard)
+	refs := []poolSessionRef{{
+		qualifiedInstance: "frontend/worker-7",
+		sessionName:       "custom-worker-7",
+	}}
 
-	// Simulate pool eval returning 1 — slot 1 is in desired.
-	desired := map[string]TemplateParams{
-		"polecat--polecat-1": {TemplateName: "polecat", SessionName: "polecat--polecat-1"},
+	_, err := selectRunningPoolSessionRefs(nil, nil, cfg, refs)
+	if err == nil {
+		t.Fatal("selectRunningPoolSessionRefs() unexpectedly succeeded")
 	}
-	discoverSessionBeads(bp, cfg, desired, io.Discard)
-
-	// Slot 1 was already desired (should stay). Slot 2 is stopped and may
-	// or may not be included depending on pool discovery logic.
-	// Verify slot 1 is still present.
-	if _, ok := desired["polecat--polecat-1"]; !ok {
-		t.Errorf("slot 1 should remain in desired, got keys: %v", mapKeys(desired))
+	if !strings.Contains(err.Error(), "custom-worker-7") {
+		t.Fatalf("selectRunningPoolSessionRefs() error = %q, want concrete session name", err)
 	}
 }
 
-func TestFindSessionNameByTemplate_PrefersAgentNameMatch(t *testing.T) {
+func TestResolvePoolSessionRefs_ResolvesBindingQualifiedNamepoolAlias(t *testing.T) {
 	store := beads.NewMemStore()
-
-	// Create a managed agent bead (has agent_name from syncSessionBeads).
-	_, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   "session",
-		Labels: []string{"gc:session", "agent:worker"},
-		Metadata: map[string]string{
-			"template":     "worker",
-			"agent_name":   "worker",
-			"session_name": "s-managed",
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{
+				Name:          "worker",
+				Dir:           "frontend",
+				BindingName:   "ops",
+				NamepoolNames: []string{"furiosa", "nux"},
+			},
 		},
-	})
-	if err != nil {
-		t.Fatal(err)
 	}
-
-	// Create an ad-hoc session bead (no agent_name, from gc session new).
-	_, err = store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   "session",
-		Labels: []string{"gc:session", "template:worker"},
+	agentCfg := cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "bound themed pool instance",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":     "worker",
-			"session_name": "s-adhoc",
+			"template":     "frontend/ops.worker",
+			"session_name": "ops-furiosa-session",
+			"alias":        "frontend/ops.furiosa",
+			"state":        "awake",
 		},
-	})
-	if err != nil {
+	}); err != nil {
 		t.Fatal(err)
 	}
 
-	// Should prefer the managed bead (agent_name match).
-	got := findSessionNameByTemplate(store, "worker")
-	if got != "s-managed" {
-		t.Errorf("findSessionNameByTemplate with managed + ad-hoc = %q, want s-managed", got)
+	refs := resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", runtime.NewFake(), io.Discard)
+	if len(refs) != 1 {
+		t.Fatalf("resolvePoolSessionRefs() returned %d refs, want 1: %#v", len(refs), refs)
+	}
+	if refs[0].qualifiedInstance != "frontend/ops.furiosa" || refs[0].sessionName != "ops-furiosa-session" {
+		t.Fatalf("resolvePoolSessionRefs() = %#v, want frontend/ops.furiosa -> ops-furiosa-session", refs)
 	}
 }
 
-func TestFindSessionNameByTemplate_TemplateMismatchNotFound(t *testing.T) {
+func TestResolvePoolSessionRefs_UsesBoundTemplatePoolSlotForCustomSessionName(t *testing.T) {
 	store := beads.NewMemStore()
-
-	// Create a bead with template "worker" but query "myrig/worker".
-	_, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   "session",
-		Labels: []string{"gc:session", "template:worker"},
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{
+				Name:          "worker",
+				Dir:           "frontend",
+				BindingName:   "ops",
+				NamepoolNames: []string{"furiosa", "nux"},
+			},
+		},
+	}
+	agentCfg := cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "bound themed pool instance",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":     "worker",
-			"session_name": "s-gc-99",
+			"template":     "frontend/ops.worker",
+			"session_name": "custom-ops-furiosa",
+			"pool_slot":    "1",
+			"state":        "awake",
 		},
-	})
-	if err != nil {
+	}); err != nil {
 		t.Fatal(err)
 	}
 
-	// Querying for rig-qualified name should NOT match bare template.
-	got := findSessionNameByTemplate(store, "myrig/worker")
-	if got != "" {
-		t.Errorf("findSessionNameByTemplate(myrig/worker) = %q, want empty (template mismatch)", got)
+	refs := resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", runtime.NewFake(), io.Discard)
+	if len(refs) != 1 {
+		t.Fatalf("resolvePoolSessionRefs() returned %d refs, want 1: %#v", len(refs), refs)
+	}
+	if refs[0].qualifiedInstance != "frontend/ops.furiosa" || refs[0].sessionName != "custom-ops-furiosa" {
+		t.Fatalf("resolvePoolSessionRefs() = %#v, want frontend/ops.furiosa -> custom-ops-furiosa", refs)
 	}
 }
 
-func TestFindSessionNameByTemplate_UsesLegacyAgentLabelForPoolInstance(t *testing.T) {
+func TestResolvePoolSessionRefs_RewritesTemplateIdentityAgentNameFromPoolSlot(t *testing.T) {
 	store := beads.NewMemStore()
-
-	_, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   "session",
-		Labels: []string{sessionBeadLabel, "agent:myrig/worker-1"},
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(10)},
+		},
+	}
+	agentCfg := cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "legacy pool instance",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":     "worker",
-			"pool_slot":    "1",
-			"session_name": "s-legacy-worker-1",
+			"template":     "frontend/worker",
+			"agent_name":   "frontend/worker",
+			"session_name": "custom-worker-7",
+			"pool_slot":    "7",
+			"state":        "awake",
 		},
-	})
-	if err != nil {
+	}); err != nil {
 		t.Fatal(err)
 	}
 
-	got := findSessionNameByTemplate(store, "myrig/worker-1")
-	if got != "s-legacy-worker-1" {
-		t.Errorf("findSessionNameByTemplate(myrig/worker-1) = %q, want s-legacy-worker-1", got)
+	refs := resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", runtime.NewFake(), io.Discard)
+	for _, ref := range refs {
+		if ref.sessionName == "custom-worker-7" {
+			if ref.qualifiedInstance != "frontend/worker-7" {
+				t.Fatalf("resolvePoolSessionRefs() custom ref = %#v, want frontend/worker-7 -> custom-worker-7", ref)
+			}
+			return
+		}
 	}
+	t.Fatalf("resolvePoolSessionRefs() = %#v, want custom-worker-7 candidate keyed by frontend/worker-7", refs)
 }
 
-func TestLookupPoolSessionNames_RejectsSharedPrefixSiblingTemplates(t *testing.T) {
+func TestResolvePoolSessionRefs_DoesNotRecoverOutOfBoundsAliasOnlyBoundedPoolIdentity(t *testing.T) {
 	store := beads.NewMemStore()
-	for _, bead := range []beads.Bead{
-		{
-			Title:  "worker",
-			Type:   sessionBeadType,
-			Labels: []string{sessionBeadLabel, "agent:frontend/worker-1"},
-			Metadata: map[string]string{
-				"template":     "worker",
-				"pool_slot":    "1",
-				"session_name": "s-worker-1",
-			},
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
 		},
-		{
-			Title:  "worker-supervisor",
-			Type:   sessionBeadType,
-			Labels: []string{sessionBeadLabel, "agent:frontend/worker-supervisor-1"},
-			Metadata: map[string]string{
-				"template":     "worker-supervisor",
-				"pool_slot":    "1",
-				"session_name": "s-worker-supervisor-1",
-			},
+	}
+	agentCfg := cfg.Agents[0]
+	if _, err := store.Create(beads.Bead{
+		Title:  "stale out-of-bounds pool instance",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "frontend/worker",
+			"alias":        "frontend/worker-7",
+			"session_name": "custom-worker-7",
+			"state":        "awake",
 		},
-	} {
-		if _, err := store.Create(bead); err != nil {
-			t.Fatal(err)
-		}
+	}); err != nil {
+		t.Fatal(err)
 	}
 
-	got, err := lookupPoolSessionNames(store, "frontend/worker")
-	if err != nil {
-		t.Fatalf("lookupPoolSessionNames: %v", err)
-	}
-	if got["frontend/worker-1"] != "s-worker-1" {
-		t.Fatalf("lookupPoolSessionNames(frontend/worker) missing worker-1: %#v", got)
-	}
-	if _, ok := got["frontend/worker-supervisor-1"]; ok {
-		t.Fatalf("lookupPoolSessionNames(frontend/worker) wrongly matched sibling template: %#v", got)
+	refs := resolvePoolSessionRefs(store, cfg, agentCfg.Name, agentCfg.Dir, scaleParamsFor(&agentCfg), &agentCfg, "test-city", "", runtime.NewFake(), io.Discard)
+	for _, ref := range refs {
+		if ref.sessionName == "custom-worker-7" {
+			t.Fatalf("resolvePoolSessionRefs() unexpectedly kept out-of-bounds ref %#v", ref)
+		}
 	}
 }
 
@@ -1706,7 +2547,7 @@ func TestDoInitSettingsIsValidJSON(t *testing.T) {
 	if !ok {
 		t.Fatal("settings.json 'hooks' is not an object")
 	}
-	for _, event := range []string{"SessionStart", "PreCompact", "UserPromptSubmit", "Stop"} {
+	for _, event := range []string{"SessionStart", "PreCompact", "UserPromptSubmit"} {
 		if _, ok := hookMap[event]; !ok {
 			t.Errorf("settings.json missing hook event %q", event)
 		}
@@ -4768,6 +5609,59 @@ max = -1
 	}
 }
 
+func TestDoPrimeFormulaV2GraphWorkerPromptClaimsRoutedWork(t *testing.T) {
+	dir := t.TempDir()
+	if err := materializeBuiltinPrompts(dir); err != nil {
+		t.Fatalf("materializeBuiltinPrompts: %v", err)
+	}
+	t.Setenv("GC_CITY", "")
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", "")
+	t.Setenv("GC_DIR", "")
+	t.Setenv("GC_RIG", "")
+	t.Setenv("GC_RIG_ROOT", "")
+	tomlContent := `[workspace]
+name = "test-city"
+
+[daemon]
+formula_v2 = true
+
+[[agent]]
+name = "worker"
+dir = "myrig"
+start_command = "echo"
+
+[agent.pool]
+min = 0
+max = -1
+`
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte(tomlContent), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	orig, _ := os.Getwd()
+	t.Cleanup(func() { _ = os.Chdir(orig) })
+	if err := os.Chdir(dir); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := doPrime([]string{"worker"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("doPrime = %d, want 0; stderr: %s", code, stderr.String())
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "gc hook") {
+		t.Fatalf("graph-worker prompt missing gc hook routed-queue lookup:\n%s", out)
+	}
+	if !strings.Contains(out, "bd update <id> --claim") {
+		t.Fatalf("graph-worker prompt missing atomic claim instruction:\n%s", out)
+	}
+	if !strings.Contains(out, "Do not start work with `bd update --status in_progress`") {
+		t.Fatalf("graph-worker prompt missing guard against unassigned in_progress work:\n%s", out)
+	}
+}
+
 func materializeBuiltinPrompts(cityPath string) error {
 	return MaterializeBuiltinPacks(cityPath)
 }
diff --git a/cmd/gc/nudge_acp_drain.go b/cmd/gc/nudge_acp_drain.go
new file mode 100644
index 0000000000..08c5bd51b9
--- /dev/null
+++ b/cmd/gc/nudge_acp_drain.go
@@ -0,0 +1,208 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/session"
+	"github.com/gastownhall/gascity/internal/telemetry"
+	"github.com/gastownhall/gascity/internal/worker"
+)
+
+// drainACPQueuedNudges claims due queued nudges for ACP sessions and
+// delivers them via the in-process session provider. It mirrors the
+// poller path (tryDeliverQueuedNudgesByPoller) — session fencing,
+// delivery blocking, message batching — so that nudge semantics are
+// identical regardless of transport.
+//
+// This must run inside the supervisor/controller process where the ACP
+// provider holds live connections.
+//
+// Returns the number of nudges successfully delivered.
+func drainACPQueuedNudges(
+	cityPath string,
+	sp runtime.Provider,
+	acpTargets []nudgeTarget,
+	now time.Time,
+) (int, error) {
+	if len(acpTargets) == 0 {
+		return 0, nil
+	}
+
+	totalDelivered := 0
+	store := openNudgeBeadStore(cityPath)
+	for _, target := range acpTargets {
+		if !sp.IsRunning(target.sessionName) {
+			continue
+		}
+
+		// Claim due nudges matching this target (agent key + session fence).
+		claimed, err := claimDueQueuedNudgesForTarget(cityPath, target, now)
+		if err != nil {
+			return totalDelivered, fmt.Errorf("claiming ACP nudges for %s: %w", target.sessionName, err)
+		}
+		if len(claimed) == 0 {
+			continue
+		}
+
+		// Filter out nudges that don't match the session fence
+		// (SessionID / ContinuationEpoch mismatch).
+		items, rejected := splitQueuedNudgesForTarget(target, claimed)
+		if len(rejected) > 0 {
+			if err := recordQueuedNudgeFailure(cityPath, queuedNudgeIDs(rejected), errNudgeSessionFenceMismatch, now); err != nil {
+				return totalDelivered, fmt.Errorf("recording fenced ACP nudge failures: %w", err)
+			}
+		}
+
+		// Filter out nudges blocked by wait-bead state (canceled,
+		// expired, etc.).
+		items, blocked, err := splitQueuedNudgesForDelivery(store, items)
+		if err != nil {
+			return totalDelivered, fmt.Errorf("checking ACP nudge delivery: %w", err)
+		}
+		if len(blocked) > 0 {
+			if err := terminalizeBlockedQueuedNudges(cityPath, blocked); err != nil {
+				return totalDelivered, fmt.Errorf("terminalizing blocked ACP nudges: %w", err)
+			}
+		}
+		if len(items) == 0 {
+			continue
+		}
+
+		// Batch into one message per session (matches poller behavior).
+		msg := formatNudgeRuntimeMessage(items)
+
+		// Deliver via worker handle to get delivery confirmation,
+		// matching the poller path (tryDeliverQueuedNudgesByPoller).
+		handle, err := workerHandleForNudgeTarget(target, store, sp)
+		if err != nil {
+			telemetry.RecordNudge(context.Background(), target.agentKey(), err)
+			if recErr := recordQueuedNudgeFailure(cityPath, queuedNudgeIDs(items), err, now); recErr != nil {
+				return totalDelivered, fmt.Errorf("recording ACP handle failure: %w", recErr)
+			}
+			continue
+		}
+		result, err := handle.Nudge(context.Background(), worker.NudgeRequest{
+			Text:     msg,
+			Delivery: worker.NudgeDeliveryDefault,
+			Source:   "queue",
+			Wake:     worker.NudgeWakeLiveOnly,
+		})
+		if err != nil {
+			telemetry.RecordNudge(context.Background(), target.agentKey(), err)
+			if recErr := recordQueuedNudgeFailure(cityPath, queuedNudgeIDs(items), err, now); recErr != nil {
+				return totalDelivered, fmt.Errorf("recording ACP nudge failure: %w", recErr)
+			}
+			continue
+		}
+		if !result.Delivered {
+			continue
+		}
+
+		telemetry.RecordNudge(context.Background(), target.agentKey(), nil)
+		if err := ackQueuedNudges(cityPath, queuedNudgeIDs(items)); err != nil {
+			return totalDelivered, fmt.Errorf("acking ACP nudges: %w", err)
+		}
+		totalDelivered += len(items)
+	}
+
+	return totalDelivered, nil
+}
+
+// buildACPNudgeTargets builds nudgeTarget values for all active ACP
+// sessions, using session bead metadata for fencing (SessionID,
+// ContinuationEpoch) and DesiredStateResult for ACP routing.
+//
+// This mirrors how resolveNudgeTargetFromSessionBead builds targets for
+// the poller, but sources data from the reconciler's in-memory state
+// instead of a fresh store query.
+func buildACPNudgeTargets(
+	cityPath string,
+	cfg *config.City,
+	result DesiredStateResult,
+	sessionBeads *sessionBeadSnapshot,
+) []nudgeTarget {
+	// Build a set of ACP session names from desired state.
+	acpSessions := make(map[string]TemplateParams)
+	for _, tp := range result.State {
+		if tp.IsACP && tp.SessionName != "" {
+			acpSessions[tp.SessionName] = tp
+		}
+	}
+	if len(acpSessions) == 0 {
+		return nil
+	}
+
+	cityName := loadedCityName(cfg, cityPath)
+
+	// Match session beads to ACP sessions for fencing metadata.
+	var targets []nudgeTarget
+	matched := make(map[string]bool)
+	if sessionBeads != nil {
+		for _, b := range sessionBeads.Open() {
+			sessName := strings.TrimSpace(b.Metadata["session_name"])
+			tp, ok := acpSessions[sessName]
+			if !ok {
+				continue
+			}
+			matched[sessName] = true
+			targets = append(targets, nudgeTarget{
+				cityPath:          cityPath,
+				cityName:          cityName,
+				cfg:               cfg,
+				alias:             tp.Alias,
+				identity:          firstNonEmpty(tp.InstanceName, tp.TemplateName),
+				transport:         "acp",
+				resolved:          tp.ResolvedProvider,
+				sessionID:         b.ID,
+				continuationEpoch: strings.TrimSpace(b.Metadata["continuation_epoch"]),
+				sessionName:       sessName,
+				aliasHistory:      session.AliasHistory(b.Metadata),
+				agent:             resolveAgentForNudge(cfg, tp),
+			})
+		}
+	}
+
+	// ACP sessions without a session bead (e.g., just started, bead not
+	// yet created) get a target without fencing — they'll only match
+	// nudges that don't carry SessionID/ContinuationEpoch.
+	for sessName, tp := range acpSessions {
+		if matched[sessName] {
+			continue
+		}
+		targets = append(targets, nudgeTarget{
+			cityPath:    cityPath,
+			cityName:    cityName,
+			cfg:         cfg,
+			alias:       tp.Alias,
+			identity:    firstNonEmpty(tp.InstanceName, tp.TemplateName),
+			transport:   "acp",
+			resolved:    tp.ResolvedProvider,
+			sessionName: sessName,
+			agent:       resolveAgentForNudge(cfg, tp),
+		})
+	}
+
+	return targets
+}
+
+// resolveAgentForNudge looks up the agent config for a TemplateParams.
+func resolveAgentForNudge(cfg *config.City, tp TemplateParams) config.Agent {
+	if cfg == nil {
+		return config.Agent{}
+	}
+	for _, candidate := range []string{tp.InstanceName, tp.TemplateName, tp.Alias} {
+		if candidate == "" {
+			continue
+		}
+		found, ok := resolveAgentIdentity(cfg, candidate, "")
+		if ok {
+			return found
+		}
+	}
+	return config.Agent{}
+}
diff --git a/cmd/gc/nudge_acp_drain_test.go b/cmd/gc/nudge_acp_drain_test.go
new file mode 100644
index 0000000000..4ccc2fee06
--- /dev/null
+++ b/cmd/gc/nudge_acp_drain_test.go
@@ -0,0 +1,944 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/nudgequeue"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+func TestDrainACPQueuedNudges_DeliversDueNudge(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-1",
+			Agent:        "hermes/polecat",
+			Message:      "hello from queue",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 1 {
+		t.Errorf("delivered = %d, want 1", delivered)
+	}
+
+	// Verify exactly one Nudge call was made with the queued message.
+	var nudgeCalled bool
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" && c.Name == "hermes--polecat" {
+			nudgeCalled = true
+			if !strings.Contains(c.Message, "hello from queue") {
+				t.Errorf("Nudge message = %q, want to contain 'hello from queue'", c.Message)
+			}
+		}
+	}
+	if !nudgeCalled {
+		t.Error("no Nudge call recorded — delivery did not happen")
+	}
+
+	// Verify nudge removed from both pending and in_flight (acked).
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 0 {
+		t.Errorf("pending = %d, want 0", len(remaining.Pending))
+	}
+	if len(remaining.InFlight) != 0 {
+		t.Errorf("in_flight = %d, want 0 (should be acked)", len(remaining.InFlight))
+	}
+}
+
+func TestDrainACPQueuedNudges_SkipsNotYetDue(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-future",
+			Agent:        "hermes/polecat",
+			Message:      "not yet",
+			Source:       "session",
+			CreatedAt:    now,
+			DeliverAfter: now.Add(1 * time.Hour),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0 (not yet due)", delivered)
+	}
+
+	// Nudge should still be pending — not claimed or delivered.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Errorf("pending = %d, want 1 (not yet due)", len(remaining.Pending))
+	}
+	if len(remaining.InFlight) != 0 {
+		t.Errorf("in_flight = %d, want 0", len(remaining.InFlight))
+	}
+	// No Nudge calls should have been made.
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" {
+			t.Errorf("unexpected Nudge call for not-yet-due nudge: %v", c)
+		}
+	}
+}
+
+func TestDrainACPQueuedNudges_AgentMismatch_NotClaimed(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	// Start the polecat session so IsRunning passes — proving the skip
+	// is due to agent-key mismatch in claim, not a session state issue.
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-dog",
+			Agent:        "dog",
+			Message:      "woof",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	// Target is polecat; queued nudge is for "dog". The nudge should
+	// not match because the agent keys differ.
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0 (agent mismatch)", delivered)
+	}
+
+	// Nudge must remain pending — claim should not match it.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Errorf("pending = %d, want 1 (dog nudge untouched)", len(remaining.Pending))
+	}
+	// No Nudge calls should have been made.
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" {
+			t.Errorf("unexpected Nudge call: %v", c)
+		}
+	}
+}
+
+func TestDrainACPQueuedNudges_SessionNotRunning_Skipped(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	// Don't start the session — it won't be running.
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-norun",
+			Agent:        "hermes/polecat",
+			Message:      "nobody home",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0", delivered)
+	}
+
+	// Nudge should still be pending — session not running means we skip,
+	// not claim-and-fail.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Errorf("pending = %d, want 1 (left for next tick)", len(remaining.Pending))
+	}
+	// No Nudge calls — session not running means we skip entirely.
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" {
+			t.Errorf("unexpected Nudge call for non-running session: %v", c)
+		}
+	}
+}
+
+func TestDrainACPQueuedNudges_SessionFenceMismatch_NotClaimed(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	now := time.Now()
+	// Queue a nudge fenced to a different session ID.
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-fenced",
+			Agent:        "hermes/polecat",
+			SessionID:    "old-session-bead-id",
+			Message:      "for old session",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	// Target has a different session ID (current session). The fenced
+	// nudge should not be claimable by this target.
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		sessionID:   "current-session-bead-id",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0 (fenced nudge not claimable)", delivered)
+	}
+
+	// Nudge should remain in pending — it belongs to a different session.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Errorf("pending = %d, want 1 (fenced nudge stays for its session)", len(remaining.Pending))
+	}
+	// No Nudge calls should have been made.
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" {
+			t.Errorf("unexpected Nudge call: %v", c)
+		}
+	}
+}
+
+func TestDrainACPQueuedNudges_BatchesMultipleNudges(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		for i, msg := range []string{"first", "second", "third"} {
+			s.Pending = append(s.Pending, nudgequeue.Item{
+				ID:           fmt.Sprintf("nudge-%d", i),
+				Agent:        "hermes/polecat",
+				Message:      msg,
+				Source:       "session",
+				CreatedAt:    now.Add(-1 * time.Second),
+				DeliverAfter: now.Add(-1 * time.Second),
+				ExpiresAt:    now.Add(24 * time.Hour),
+			})
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 3 {
+		t.Errorf("delivered = %d, want 3", delivered)
+	}
+
+	// Verify only ONE Nudge call was made (batched).
+	nudgeCalls := 0
+	var nudgeMsg string
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" && c.Name == "hermes--polecat" {
+			nudgeCalls++
+			nudgeMsg = c.Message
+		}
+	}
+	if nudgeCalls != 1 {
+		t.Errorf("Nudge calls = %d, want 1 (batched)", nudgeCalls)
+	}
+	// All three messages should appear in the batched output.
+	for _, msg := range []string{"first", "second", "third"} {
+		if !strings.Contains(nudgeMsg, msg) {
+			t.Errorf("batched message missing %q: %s", msg, nudgeMsg)
+		}
+	}
+}
+
+func TestDrainACPQueuedNudges_NoTargets(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-orphan",
+			Agent:        "hermes/polecat",
+			Message:      "should stay",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	delivered, err := drainACPQueuedNudges(cityPath, sp, nil, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0", delivered)
+	}
+
+	// Queue should be untouched.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Errorf("pending = %d, want 1 (untouched)", len(remaining.Pending))
+	}
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" {
+			t.Errorf("unexpected Nudge call: %v", c)
+		}
+	}
+}
+
+func TestBuildACPNudgeTargets(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{Agents: []config.Agent{{Name: "polecat", Dir: "hermes"}}}
+
+	// Create a session bead with fencing metadata.
+	store := beads.NewMemStore()
+	sessionBead, err := store.Create(beads.Bead{
+		Title:  "polecat session",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "hermes--polecat",
+			"continuation_epoch": "3",
+			"agent_name":         "hermes/polecat",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{sessionBead})
+
+	result := DesiredStateResult{
+		State: map[string]TemplateParams{
+			"hermes--polecat": {SessionName: "hermes--polecat", IsACP: true, Alias: "hermes/polecat", TemplateName: "polecat"},
+			"dog-1":           {SessionName: "dog-1", IsACP: false, Alias: "dog"},
+		},
+	}
+
+	targets := buildACPNudgeTargets(cityPath, cfg, result, snapshot)
+	if len(targets) != 1 {
+		t.Fatalf("targets = %d, want 1", len(targets))
+	}
+	target := targets[0]
+	if target.sessionName != "hermes--polecat" {
+		t.Errorf("sessionName = %q, want hermes--polecat", target.sessionName)
+	}
+	if target.alias != "hermes/polecat" {
+		t.Errorf("alias = %q, want hermes/polecat", target.alias)
+	}
+	if target.sessionID != sessionBead.ID {
+		t.Errorf("sessionID = %q, want %q (from session bead)", target.sessionID, sessionBead.ID)
+	}
+	if target.continuationEpoch != "3" {
+		t.Errorf("continuationEpoch = %q, want '3'", target.continuationEpoch)
+	}
+	if target.transport != "acp" {
+		t.Errorf("transport = %q, want 'acp'", target.transport)
+	}
+}
+
+func TestBuildACPNudgeTargets_NoSessionBead(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{Agents: []config.Agent{{Name: "polecat", Dir: "hermes"}}}
+
+	result := DesiredStateResult{
+		State: map[string]TemplateParams{
+			"hermes--polecat": {SessionName: "hermes--polecat", IsACP: true, Alias: "hermes/polecat"},
+		},
+	}
+
+	// No session beads — target should still be created, but without fencing.
+	targets := buildACPNudgeTargets(cityPath, cfg, result, newSessionBeadSnapshot(nil))
+	if len(targets) != 1 {
+		t.Fatalf("targets = %d, want 1", len(targets))
+	}
+	if targets[0].sessionID != "" {
+		t.Errorf("sessionID = %q, want empty (no bead)", targets[0].sessionID)
+	}
+	if targets[0].continuationEpoch != "" {
+		t.Errorf("continuationEpoch = %q, want empty (no bead)", targets[0].continuationEpoch)
+	}
+	if targets[0].sessionName != "hermes--polecat" {
+		t.Errorf("sessionName = %q, want hermes--polecat", targets[0].sessionName)
+	}
+	if targets[0].alias != "hermes/polecat" {
+		t.Errorf("alias = %q, want hermes/polecat", targets[0].alias)
+	}
+	if targets[0].transport != "acp" {
+		t.Errorf("transport = %q, want acp", targets[0].transport)
+	}
+}
+
+func TestBeadReconcileTick_DrainsACPQueuedNudges(t *testing.T) {
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	cityPath := t.TempDir()
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-via-tick",
+			Agent:        "hermes/polecat",
+			Message:      "tick nudge",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	cr := &CityRuntime{
+		cityPath:            cityPath,
+		cityName:            "test-city",
+		cfg:                 &config.City{Agents: []config.Agent{{Name: "polecat", Dir: "hermes"}}},
+		sp:                  sp,
+		standaloneCityStore: beads.NewMemStore(),
+		sessionDrains:       newDrainTracker(),
+		rec:                 events.Discard,
+		stdout:              io.Discard,
+		stderr:              io.Discard,
+	}
+
+	result := DesiredStateResult{
+		State: map[string]TemplateParams{
+			"hermes--polecat": {SessionName: "hermes--polecat", IsACP: true, Alias: "hermes/polecat"},
+		},
+	}
+
+	sessionBeads := newSessionBeadSnapshot(nil)
+	cr.beadReconcileTick(context.Background(), result, sessionBeads, nil)
+
+	// Verify the nudge was delivered via Nudge call.
+	var found bool
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" && c.Name == "hermes--polecat" && strings.Contains(c.Message, "tick nudge") {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("expected Nudge call containing 'tick nudge', got calls: %v", sp.Calls)
+	}
+
+	// Verify the queue is empty (both pending and in_flight).
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 0 {
+		t.Errorf("pending = %d, want 0", len(remaining.Pending))
+	}
+	if len(remaining.InFlight) != 0 {
+		t.Errorf("in_flight = %d, want 0", len(remaining.InFlight))
+	}
+}
+
+// stoppingProvider wraps a Fake and stops the named session after the
+// first IsRunning call returns true. This simulates a session stopping
+// between the drain's IsRunning pre-check and the worker handle's
+// delivery attempt, ensuring nudges are not acked without confirmation.
+type stoppingProvider struct {
+	*runtime.Fake
+	stopAfter string
+	stopped   bool
+}
+
+func (p *stoppingProvider) IsRunning(name string) bool {
+	running := p.Fake.IsRunning(name)
+	if running && name == p.stopAfter && !p.stopped {
+		p.stopped = true
+		_ = p.Stop(name)
+	}
+	return running
+}
+
+// nudgeErrProvider wraps a Fake so that Nudge returns an error while
+// IsRunning still reports true. This exercises the handle.Nudge error
+// path (telemetry recording + failure recording) without affecting the
+// running state pre-check.
+type nudgeErrProvider struct {
+	*runtime.Fake
+	nudgeErr error
+}
+
+func (p *nudgeErrProvider) Nudge(name string, content []runtime.ContentBlock) error {
+	p.Fake.Nudge(name, content) //nolint:errcheck // record the call
+	return p.nudgeErr
+}
+
+func TestDrainACPQueuedNudges_SessionStopsBeforeDelivery_NotAcked(t *testing.T) {
+	cityPath := t.TempDir()
+	fake := runtime.NewFake()
+	if err := fake.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	// Wrap: first IsRunning returns true (drain pre-check passes),
+	// but stops the session so the worker handle's IsRunning returns false.
+	sp := &stoppingProvider{Fake: fake, stopAfter: "hermes--polecat"}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-vanish",
+			Agent:        "hermes/polecat",
+			Message:      "should not be acked",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if !sp.stopped {
+		t.Error("stoppingProvider did not trigger — race path was not exercised")
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0 (session stopped before delivery)", delivered)
+	}
+
+	// Nudge must NOT be acked — it should remain in-flight (claimed but
+	// not delivered) so a future tick can retry.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.InFlight) != 1 {
+		t.Errorf("in_flight = %d, want 1 (claimed but not delivered)", len(remaining.InFlight))
+	}
+	if len(remaining.Pending) != 0 {
+		t.Errorf("pending = %d, want 0 (should have been claimed)", len(remaining.Pending))
+	}
+}
+
+func TestDrainACPQueuedNudges_NudgeError_RecordsFailure(t *testing.T) {
+	cityPath := t.TempDir()
+	fake := runtime.NewFake()
+	if err := fake.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	sp := &nudgeErrProvider{Fake: fake, nudgeErr: fmt.Errorf("connection reset")}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-err",
+			Agent:        "hermes/polecat",
+			Message:      "will fail",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{{
+		cityPath:    cityPath,
+		alias:       "hermes/polecat",
+		sessionName: "hermes--polecat",
+		transport:   "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0 (nudge errored)", delivered)
+	}
+
+	// Verify the Nudge call was actually attempted (proves the error
+	// comes from handle.Nudge, not an earlier short-circuit).
+	var nudgeAttempted bool
+	for _, c := range fake.Calls {
+		if c.Method == "Nudge" && c.Name == "hermes--polecat" {
+			nudgeAttempted = true
+			break
+		}
+	}
+	if !nudgeAttempted {
+		t.Error("no Nudge call recorded — error path was not reached")
+	}
+
+	// Nudge should be requeued after failure (not acked, not stuck in-flight).
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Errorf("pending = %d, want 1 (requeued after failure)", len(remaining.Pending))
+	}
+	if len(remaining.InFlight) != 0 {
+		t.Errorf("in_flight = %d, want 0 (not stuck in-flight)", len(remaining.InFlight))
+	}
+	if remaining.Pending[0].Attempts != 1 {
+		t.Errorf("attempts = %d, want 1 (single failure recorded)", remaining.Pending[0].Attempts)
+	}
+	if remaining.Pending[0].LastError == "" {
+		t.Error("last_error is empty, want error message recorded")
+	}
+}
+
+func TestDrainACPQueuedNudges_StaleEpoch_ClaimedThenRejected(t *testing.T) {
+	cityPath := t.TempDir()
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	now := time.Now()
+	// Queue a nudge fenced to the same session ID but a stale epoch.
+	// claimDueQueuedNudgesForTarget will claim it (session ID matches),
+	// but splitQueuedNudgesForTarget will reject it (epoch mismatch).
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:                "nudge-stale-epoch",
+			Agent:             "hermes/polecat",
+			SessionID:         "sess-bead-1",
+			ContinuationEpoch: "2",
+			Message:           "for old epoch",
+			Source:            "session",
+			CreatedAt:         now.Add(-1 * time.Second),
+			DeliverAfter:      now.Add(-1 * time.Second),
+			ExpiresAt:         now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	// Target has the same session ID but a newer epoch.
+	targets := []nudgeTarget{{
+		cityPath:          cityPath,
+		alias:             "hermes/polecat",
+		sessionName:       "hermes--polecat",
+		sessionID:         "sess-bead-1",
+		continuationEpoch: "3",
+		transport:         "acp",
+	}}
+	delivered, err := drainACPQueuedNudges(cityPath, sp, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	if delivered != 0 {
+		t.Errorf("delivered = %d, want 0 (stale epoch rejected)", delivered)
+	}
+
+	// The nudge was claimed (removed from pending) then rejected by the
+	// fence split, so it should be recorded as failed — not left pending
+	// or in-flight.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 0 {
+		t.Errorf("pending = %d, want 0 (claimed and failed)", len(remaining.Pending))
+	}
+	if len(remaining.InFlight) != 0 {
+		t.Errorf("in_flight = %d, want 0 (fence rejection recorded)", len(remaining.InFlight))
+	}
+	// No Nudge calls — rejected before delivery attempt.
+	for _, c := range sp.Calls {
+		if c.Method == "Nudge" {
+			t.Errorf("unexpected Nudge call for stale-epoch nudge: %v", c)
+		}
+	}
+}
+
+func TestDrainACPQueuedNudges_MultipleTargets_MixedResults(t *testing.T) {
+	cityPath := t.TempDir()
+	fake := runtime.NewFake()
+	// Start polecat (will succeed) but not owl (will be skipped).
+	if err := fake.Start(context.Background(), "hermes--polecat", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("Start polecat: %v", err)
+	}
+
+	now := time.Now()
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		s.Pending = append(s.Pending, nudgequeue.Item{
+			ID:           "nudge-polecat",
+			Agent:        "hermes/polecat",
+			Message:      "polecat msg",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		}, nudgequeue.Item{
+			ID:           "nudge-owl",
+			Agent:        "hermes/owl",
+			Message:      "owl msg",
+			Source:       "session",
+			CreatedAt:    now.Add(-1 * time.Second),
+			DeliverAfter: now.Add(-1 * time.Second),
+			ExpiresAt:    now.Add(24 * time.Hour),
+		})
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+
+	targets := []nudgeTarget{
+		{
+			cityPath:    cityPath,
+			alias:       "hermes/polecat",
+			sessionName: "hermes--polecat",
+			transport:   "acp",
+		},
+		{
+			cityPath:    cityPath,
+			alias:       "hermes/owl",
+			sessionName: "hermes--owl",
+			transport:   "acp",
+		},
+	}
+	delivered, err := drainACPQueuedNudges(cityPath, fake, targets, now)
+	if err != nil {
+		t.Fatalf("drainACPQueuedNudges: %v", err)
+	}
+	// Only polecat should deliver (owl is not running).
+	if delivered != 1 {
+		t.Errorf("delivered = %d, want 1 (only polecat running)", delivered)
+	}
+
+	// Verify polecat nudge acked, owl nudge still pending.
+	var remaining nudgequeue.State
+	if err := nudgequeue.WithState(cityPath, func(s *nudgequeue.State) error {
+		remaining = *s
+		return nil
+	}); err != nil {
+		t.Fatalf("WithState: %v", err)
+	}
+	if len(remaining.Pending) != 1 {
+		t.Fatalf("pending = %d, want 1 (owl nudge remains)", len(remaining.Pending))
+	}
+	if remaining.Pending[0].ID != "nudge-owl" {
+		t.Errorf("remaining pending ID = %q, want nudge-owl", remaining.Pending[0].ID)
+	}
+	if len(remaining.InFlight) != 0 {
+		t.Errorf("in_flight = %d, want 0", len(remaining.InFlight))
+	}
+
+	// Verify Nudge was only called for polecat.
+	for _, c := range fake.Calls {
+		if c.Method == "Nudge" && c.Name == "hermes--owl" {
+			t.Errorf("unexpected Nudge call for non-running owl session")
+		}
+	}
+}
+
+func TestResolveAgentForNudge_CandidatePriority(t *testing.T) {
+	cfg := &config.City{Agents: []config.Agent{
+		{Name: "polecat", Dir: "hermes"},
+		{Name: "owl", Dir: "barn"},
+	}}
+
+	// InstanceName takes priority over TemplateName.
+	got := resolveAgentForNudge(cfg, TemplateParams{
+		InstanceName: "hermes/polecat",
+		TemplateName: "owl",
+		Alias:        "barn/owl",
+	})
+	if got.Name != "polecat" {
+		t.Errorf("Name = %q, want polecat (InstanceName priority)", got.Name)
+	}
+
+	// Falls through to TemplateName when InstanceName is empty.
+	got = resolveAgentForNudge(cfg, TemplateParams{
+		TemplateName: "owl",
+		Alias:        "hermes/polecat",
+	})
+	if got.Name != "owl" {
+		t.Errorf("Name = %q, want owl (TemplateName fallback)", got.Name)
+	}
+
+	// Falls through to Alias when InstanceName and TemplateName don't match.
+	got = resolveAgentForNudge(cfg, TemplateParams{
+		InstanceName: "nonexistent/thing",
+		TemplateName: "also-nonexistent",
+		Alias:        "hermes/polecat",
+	})
+	if got.Name != "polecat" {
+		t.Errorf("Name = %q, want polecat (Alias fallback)", got.Name)
+	}
+
+	// Returns empty when nothing matches.
+	got = resolveAgentForNudge(cfg, TemplateParams{
+		Alias: "nonexistent/agent",
+	})
+	if got.Name != "" {
+		t.Errorf("Name = %q, want empty (no match)", got.Name)
+	}
+
+	// nil config returns empty.
+	got = resolveAgentForNudge(nil, TemplateParams{TemplateName: "polecat"})
+	if got.Name != "" {
+		t.Errorf("Name = %q, want empty (nil config)", got.Name)
+	}
+}
diff --git a/cmd/gc/nudge_beads.go b/cmd/gc/nudge_beads.go
index 76cff03e38..cf45d50dac 100644
--- a/cmd/gc/nudge_beads.go
+++ b/cmd/gc/nudge_beads.go
@@ -182,7 +182,9 @@ func isMissingQueuedNudgeBeadErr(err error, beadID string) bool {
 	}
 	msg := strings.ToLower(err.Error())
 	return strings.Contains(msg, "no issue found matching "+strings.ToLower(strconv.Quote(beadID))) ||
-		strings.Contains(msg, "error resolving "+beadID+": no issue found")
+		strings.Contains(msg, "error resolving "+beadID+": no issue found") ||
+		strings.Contains(msg, "ambiguous id") ||
+		strings.Contains(msg, "use more characters to disambiguate")
 }
 
 func marshalNudgeReference(ref *nudgeReference) string {
diff --git a/cmd/gc/order_dispatch.go b/cmd/gc/order_dispatch.go
index 913038070f..9ca4975c66 100644
--- a/cmd/gc/order_dispatch.go
+++ b/cmd/gc/order_dispatch.go
@@ -5,29 +5,50 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/execenv"
 	"github.com/gastownhall/gascity/internal/formula"
 	"github.com/gastownhall/gascity/internal/molecule"
 	"github.com/gastownhall/gascity/internal/orders"
 )
 
-const labelOrderTracking = "order-tracking"
+const (
+	labelOrderTracking = "order-tracking"
+
+	orderTrackingSweepOrder                = "order-tracking-sweep"
+	defaultOrderTrackingSweepStaleAfter    = 10 * time.Minute
+	orderTrackingSweepWatchdogInterval     = 30 * time.Second
+	orderTrackingSweepWatchdogStaleAfter   = 2 * time.Minute
+	orderTrackingSweepMetadataReason       = "stale-order-tracking"
+	orderTrackingSweepMetadataInitiator    = "order-tracking-sweep"
+	orderTrackingWatchdogMetadataInitiator = "controller-watchdog"
+)
 
 // orderDispatcher evaluates order trigger conditions and dispatches due
 // orders as wisps or exec scripts. Follows the nil-guard tracker pattern:
 // nil means no auto-dispatchable orders exist.
 //
-// dispatch is fire-and-forget: trigger evaluation is synchronous, but each due
-// order's dispatch action runs in its own goroutine. The tracking bead
-// is created before the goroutine launches to prevent re-fire on the next tick.
+// dispatch runs trigger evaluation synchronously, then spawns a goroutine
+// per due order's dispatch action. The tracking bead is created before the
+// goroutine launches to prevent re-fire on the next tick.
+//
+// drain waits for all in-flight dispatch goroutines spawned by prior
+// dispatch calls to complete, bounded by ctx. It returns true when all
+// tracked dispatches completed. Callers use this on controller exit and
+// config reload to ensure tracking bead outcome metadata is persisted
+// before the dispatcher is replaced or discarded.
 type orderDispatcher interface {
 	dispatch(ctx context.Context, cityPath string, now time.Time)
+	drain(ctx context.Context) bool
 }
 
 // ExecRunner runs a shell command with context, working directory, and
@@ -54,7 +75,7 @@ func mergeOrderExecEnv(environ, env []string) []string {
 }
 
 func logDispatchError(stderr io.Writer, format string, args ...any) {
-	msg := fmt.Sprintf(format, args...)
+	msg := execenv.RedactText(fmt.Sprintf(format, args...), os.Environ())
 	log.Print(msg)
 	if stderr != nil {
 		fmt.Fprintln(stderr, msg) //nolint:errcheck // best-effort stderr
@@ -64,16 +85,36 @@ func logDispatchError(stderr io.Writer, format string, args ...any) {
 type orderStoreFunc func(execStoreTarget) (beads.Store, error)
 
 // memoryOrderDispatcher is the production implementation.
+//
+// inflightN + inflightDone together track dispatchOne goroutines so
+// drain can select on either completion or ctx.Done without spawning an
+// orphaned waiter goroutine. dispatch is only ever called from the tick
+// goroutine, so addInflight's check-and-create happens-before any
+// concurrent drain call on the same instance.
+//
+// dispatchCtx is the parent context for every dispatchOne goroutine. The
+// per-goroutine ctx is derived to cancel when EITHER the caller's tick
+// ctx OR dispatchCtx is done (see launchDispatchOne). cancel() cancels
+// dispatchCtx.
 type memoryOrderDispatcher struct {
-	aa         []orders.Order
-	storeFn    orderStoreFunc
-	ep         events.Provider
-	execRun    ExecRunner
-	rec        events.Recorder
-	stderr     io.Writer
-	maxTimeout time.Duration
-	cfg        *config.City
-	cityName   string
+	aa           []orders.Order
+	storeFn      orderStoreFunc
+	ep           events.Provider
+	execRun      ExecRunner
+	rec          events.Recorder
+	stderr       io.Writer
+	maxTimeout   time.Duration
+	cfg          *config.City
+	cityName     string
+	cacheMu      sync.Mutex
+	lastRunCache map[string]time.Time
+
+	dispatchCtx    context.Context
+	dispatchCancel context.CancelFunc
+
+	inflightMu   sync.Mutex
+	inflightN    int
+	inflightDone chan struct{} // closed when inflightN returns to 0; nil when idle
 }
 
 // buildOrderDispatcher scans formula layers for orders and returns a
@@ -110,18 +151,21 @@ func buildOrderDispatcher(cityPath string, cfg *config.City, rec events.Recorder
 		ep = p
 	}
 
+	dispatchCtx, dispatchCancel := context.WithCancel(context.Background())
 	return &memoryOrderDispatcher{
 		aa: auto,
 		storeFn: func(target execStoreTarget) (beads.Store, error) {
 			return openStoreAtForCity(target.ScopeRoot, cityPath)
 		},
-		ep:         ep,
-		execRun:    shellExecRunner,
-		rec:        rec,
-		stderr:     stderr,
-		maxTimeout: cfg.Orders.MaxTimeoutDuration(),
-		cfg:        cfg,
-		cityName:   loadedCityName(cfg, cityPath),
+		ep:             ep,
+		execRun:        shellExecRunner,
+		rec:            rec,
+		stderr:         stderr,
+		maxTimeout:     cfg.Orders.MaxTimeoutDuration(),
+		cfg:            cfg,
+		cityName:       loadedCityName(cfg, cityPath),
+		dispatchCtx:    dispatchCtx,
+		dispatchCancel: dispatchCancel,
 	}
 }
 
@@ -164,13 +208,21 @@ func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, n
 		if legacyStore != nil {
 			storesForGate = append(storesForGate, legacyStore)
 		}
+		storeKeysForGate := []string{storeKey}
+		if legacyStore != nil {
+			storeKeysForGate = append(storeKeysForGate, orderStoreTargetKey(legacyOrderCityTarget(cityPath, m.cfg)))
+		}
 		baseLastRunFn := orders.LastRunAcrossStores(storesForGate...)
 		var lastRunErr error
+		var lastRunFromCache bool
 		lastRunFn := func(orderName string) (time.Time, error) {
-			last, err := baseLastRunFn(orderName)
+			last, fromCache, err := m.cachedLastRun(orderName, storeKeysForGate, baseLastRunFn)
 			if err != nil {
 				lastRunErr = err
 			}
+			if fromCache {
+				lastRunFromCache = true
+			}
 			return last, err
 		}
 		cursorFn := orders.CursorAcrossStores(storesForGate...)
@@ -184,7 +236,8 @@ func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, n
 				return cursor
 			}
 		}
-		result := orders.CheckTrigger(a, now, lastRunFn, m.ep, cursorFn)
+		triggerOpts := orderTriggerOptionsForTarget(cityPath, m.cfg, target, a)
+		result := orders.CheckTriggerWithOptions(a, now, lastRunFn, m.ep, cursorFn, triggerOpts)
 		if lastRunErr != nil {
 			logDispatchError(m.stderr, "gc: order dispatch: reading last run for %s: %v", a.ScopedName(), lastRunErr)
 			continue
@@ -192,6 +245,23 @@ func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, n
 		if !result.Due {
 			continue
 		}
+		if lastRunFromCache && orderTriggerUsesLastRun(a) {
+			refreshedLastRun, err := baseLastRunFn(a.ScopedName())
+			if err != nil {
+				logDispatchError(m.stderr, "gc: order dispatch: refreshing last run for %s: %v", a.ScopedName(), err)
+				continue
+			}
+			if refreshedLastRun.After(result.LastRun) {
+				m.rememberLastRun(a.ScopedName(), storeKeysForGate, refreshedLastRun)
+				refreshedLastRunFn := func(string) (time.Time, error) {
+					return refreshedLastRun, nil
+				}
+				result = orders.CheckTriggerWithOptions(a, now, refreshedLastRunFn, m.ep, cursorFn, triggerOpts)
+				if !result.Due {
+					continue
+				}
+			}
+		}
 
 		// Skip dispatch if previous work hasn't been processed yet.
 		scoped := a.ScopedName()
@@ -214,10 +284,89 @@ func (m *memoryOrderDispatcher) dispatch(ctx context.Context, cityPath string, n
 			logDispatchError(m.stderr, "gc: order dispatch: creating tracking bead for %s: %v", scoped, err)
 			continue
 		}
+		m.rememberLastRun(scoped, storeKeysForGate, trackingBead.CreatedAt)
 
-		// Fire and forget with timeout.
+		// Fire with timeout; inflight tracks the spawned goroutine so
+		// drain can wait for tracking-bead outcome persistence before
+		// controller exit or config reload.
 		a := a // capture loop variable
-		go m.dispatchOne(ctx, store, target, a, cityPath, trackingBead.ID)
+		m.addInflight()
+		m.launchDispatchOne(ctx, store, target, a, cityPath, trackingBead.ID)
+	}
+}
+
+// launchDispatchOne spawns dispatchOne with a context that cancels when
+// EITHER the caller's tick ctx OR m.dispatchCtx is done — required so
+// cancel() reaches goroutines whose tick ctx was context.Background().
+// Falls back to the bare caller ctx when m.dispatchCtx is nil (test
+// sites that don't initialize the cancel fields).
+func (m *memoryOrderDispatcher) launchDispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string) {
+	if m.dispatchCtx == nil {
+		go m.dispatchOne(ctx, store, target, a, cityPath, trackingID)
+		return
+	}
+	mergedCtx, cancelMerged := context.WithCancel(ctx)
+	stopAfter := context.AfterFunc(m.dispatchCtx, cancelMerged)
+	go func() {
+		defer stopAfter()
+		defer cancelMerged()
+		m.dispatchOne(mergedCtx, store, target, a, cityPath, trackingID)
+	}()
+}
+
+// cancel signals all in-flight dispatchOne goroutines to terminate. Safe
+// to call multiple times. Caller should follow with drain to wait for
+// goroutine completion (exec.CommandContext propagates the cancel as
+// SIGKILL; dispatchOne's deferred cleanup writes the tracking-bead
+// outcome before doneInflight signals drain).
+func (m *memoryOrderDispatcher) cancel() {
+	if m.dispatchCancel != nil {
+		m.dispatchCancel()
+	}
+}
+
+// addInflight increments the in-flight count and lazily creates the done
+// signal. Called synchronously from dispatch on the tick goroutine.
+func (m *memoryOrderDispatcher) addInflight() {
+	m.inflightMu.Lock()
+	m.inflightN++
+	if m.inflightN == 1 {
+		m.inflightDone = make(chan struct{})
+	}
+	m.inflightMu.Unlock()
+}
+
+// doneInflight decrements the count and signals completion when the last
+// goroutine finishes. Called from dispatchOne's deferred cleanup.
+func (m *memoryOrderDispatcher) doneInflight() {
+	m.inflightMu.Lock()
+	m.inflightN--
+	if m.inflightN == 0 && m.inflightDone != nil {
+		close(m.inflightDone)
+		m.inflightDone = nil
+	}
+	m.inflightMu.Unlock()
+}
+
+// drain blocks until all in-flight dispatchOne goroutines complete or ctx
+// expires. It returns true when no work remains and returns immediately if
+// nothing is in flight. When ctx expires, any still-running dispatches keep
+// running (they will still write tracking-bead outcomes via ctx-unaware store
+// calls); the startup sweep closes orphaned tracking beads on the next boot if
+// drain did not have enough time to let them finish. The channel-signal design
+// spawns no waiter goroutine and cannot leak state past return.
+func (m *memoryOrderDispatcher) drain(ctx context.Context) bool {
+	m.inflightMu.Lock()
+	done := m.inflightDone
+	m.inflightMu.Unlock()
+	if done == nil {
+		return true
+	}
+	select {
+	case <-done:
+		return true
+	case <-ctx.Done():
+		return false
 	}
 }
 
@@ -239,10 +388,59 @@ func (m *memoryOrderDispatcher) legacyCityStoreForTarget(cityPath string, target
 	return store, true
 }
 
+func (m *memoryOrderDispatcher) cachedLastRun(orderName string, storeKeys []string, read orders.LastRunFunc) (time.Time, bool, error) {
+	key := orderHistoryCacheKey(orderName, storeKeys)
+	m.cacheMu.Lock()
+	if m.lastRunCache != nil {
+		if last, ok := m.lastRunCache[key]; ok {
+			m.cacheMu.Unlock()
+			return last, true, nil
+		}
+	}
+	m.cacheMu.Unlock()
+
+	last, err := read(orderName)
+	if err != nil {
+		return time.Time{}, false, err
+	}
+	m.rememberLastRun(orderName, storeKeys, last)
+	return last, false, nil
+}
+
+func (m *memoryOrderDispatcher) rememberLastRun(orderName string, storeKeys []string, last time.Time) {
+	key := orderHistoryCacheKey(orderName, storeKeys)
+	m.cacheMu.Lock()
+	defer m.cacheMu.Unlock()
+	if m.lastRunCache == nil {
+		m.lastRunCache = make(map[string]time.Time)
+	}
+	if existing, ok := m.lastRunCache[key]; !ok || existing.IsZero() || last.After(existing) {
+		m.lastRunCache[key] = last
+	}
+}
+
+func orderHistoryCacheKey(orderName string, storeKeys []string) string {
+	return orderName + "\x00" + strings.Join(storeKeys, "\x00")
+}
+
+func orderTriggerUsesLastRun(a orders.Order) bool {
+	return a.Trigger == "cooldown" || a.Trigger == "cron"
+}
+
+func eventCursorLabels(scoped string, headSeq uint64) []string {
+	return []string{
+		fmt.Sprintf("order:%s", scoped),
+		fmt.Sprintf("seq:%d", headSeq),
+	}
+}
+
 // dispatchOne runs a single order dispatch in its own goroutine.
 // For exec orders, runs the script directly. For formula orders,
 // instantiates a wisp. Emits events and updates the tracking bead.
 func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string) {
+	// Defer order matters: doneInflight runs last, after Close makes the
+	// tracking bead outcome observable to a waiting drain.
+	defer m.doneInflight()
 	defer store.Close(trackingID) //nolint:errcheck // best-effort close
 
 	timeout := effectiveTimeout(a, m.maxTimeout)
@@ -267,31 +465,91 @@ func (m *memoryOrderDispatcher) dispatchOne(ctx context.Context, store beads.Sto
 func (m *memoryOrderDispatcher) dispatchExec(ctx context.Context, store beads.Store, target execStoreTarget, a orders.Order, cityPath, trackingID string) {
 	scoped := a.ScopedName()
 	labels := []string{"exec"}
+	var headSeq uint64
+	var hasEventCursor bool
+	if a.Trigger == "event" && m.ep != nil {
+		var err error
+		headSeq, err = m.ep.LatestSeq()
+		if err != nil {
+			errMsg := fmt.Sprintf("reading event cursor: %v", err)
+			labels = []string{"exec-failed"}
+			logDispatchError(m.stderr, "gc: order dispatch: reading event cursor for %s: %v", scoped, err)
+			if updateErr := store.Update(trackingID, beads.UpdateOpts{Labels: labels}); updateErr != nil {
+				logDispatchError(m.stderr, "gc: order %s: failed to label exec tracking bead %s: %v", scoped, trackingID, updateErr)
+			}
+			m.rec.Record(events.Event{
+				Type:    events.OrderFailed,
+				Actor:   "controller",
+				Subject: scoped,
+				Message: errMsg,
+			})
+			return
+		}
+		hasEventCursor = true
+		// Event-triggered exec orders persist the cursor before the command
+		// runs; otherwise a crash after the side effect can replay the event.
+		if err := store.Update(trackingID, beads.UpdateOpts{Labels: eventCursorLabels(scoped, headSeq)}); err != nil {
+			logDispatchError(m.stderr, "gc: order %s: failed to label exec event cursor on tracking bead %s: %v", scoped, trackingID, err)
+			labels = []string{"exec-failed"}
+			if updateErr := store.Update(trackingID, beads.UpdateOpts{Labels: labels}); updateErr != nil {
+				logDispatchError(m.stderr, "gc: order %s: failed to label exec tracking bead %s: %v", scoped, trackingID, updateErr)
+			}
+			m.rec.Record(events.Event{
+				Type:    events.OrderFailed,
+				Actor:   "controller",
+				Subject: scoped,
+				Message: fmt.Sprintf("exec tracking bead %s event cursor label failed for seq=%d: %v", trackingID, headSeq, err),
+			})
+			return
+		}
+	}
 
 	env := orderExecEnv(cityPath, m.cfg, target, a)
 	output, err := m.execRun(ctx, a.Exec, target.ScopeRoot, env)
+	var execErrMsg string
 	if err != nil {
-		labels = append(labels, "exec-failed")
-		logDispatchError(m.stderr, "gc: order exec %s failed: %v", scoped, err)
+		redactionEnv := append(os.Environ(), env...)
+		execErrMsg = execenv.RedactText(err.Error(), redactionEnv)
+		labels = []string{"exec-failed"}
+		logDispatchError(m.stderr, "gc: order exec %s failed: %s", scoped, execErrMsg)
 		if len(output) > 0 {
-			logDispatchError(m.stderr, "gc: order exec %s output: %s", scoped, output)
+			logDispatchError(m.stderr, "gc: order exec %s output: %s", scoped, execenv.RedactText(string(output), redactionEnv))
+		}
+	}
+
+	// Label tracking bead with outcome via store (not CLI). For event execs,
+	// cursor labels were already persisted before the command ran.
+	if err := store.Update(trackingID, beads.UpdateOpts{Labels: labels}); err != nil {
+		logDispatchError(m.stderr, "gc: order %s: failed to label exec tracking bead %s: %v", scoped, trackingID, err)
+		msg := fmt.Sprintf("exec tracking bead %s label failed: %v", trackingID, err)
+		if hasEventCursor {
+			msg = fmt.Sprintf("seq=%d: %s", headSeq, msg)
 		}
 		m.rec.Record(events.Event{
 			Type:    events.OrderFailed,
 			Actor:   "controller",
 			Subject: scoped,
-			Message: err.Error(),
+			Message: msg,
 		})
-	} else {
+		return
+	}
+	if execErrMsg != "" {
+		if hasEventCursor {
+			execErrMsg = fmt.Sprintf("seq=%d: %s", headSeq, execErrMsg)
+		}
 		m.rec.Record(events.Event{
-			Type:    events.OrderCompleted,
+			Type:    events.OrderFailed,
 			Actor:   "controller",
 			Subject: scoped,
+			Message: execErrMsg,
 		})
+		return
 	}
-
-	// Label tracking bead with outcome via store (not CLI).
-	store.Update(trackingID, beads.UpdateOpts{Labels: labels}) //nolint:errcheck // best-effort
+	m.rec.Record(events.Event{
+		Type:    events.OrderCompleted,
+		Actor:   "controller",
+		Subject: scoped,
+	})
 }
 
 // dispatchWisp instantiates a wisp from the order's formula.
@@ -309,10 +567,24 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 		return
 	}
 
-	// Capture event head before wisp creation for event triggers.
+	// Capture event head before wisp creation for event triggers. Event runs
+	// fail closed when the cursor cannot be read.
 	var headSeq uint64
 	if a.Trigger == "event" && m.ep != nil {
-		headSeq, _ = m.ep.LatestSeq()
+		var err error
+		headSeq, err = m.ep.LatestSeq()
+		if err != nil {
+			errMsg := fmt.Sprintf("reading event cursor: %v", err)
+			logDispatchError(m.stderr, "gc: order dispatch: reading event cursor for %s: %v", scoped, err)
+			m.rec.Record(events.Event{
+				Type:    events.OrderFailed,
+				Actor:   "controller",
+				Subject: scoped,
+				Message: errMsg,
+			})
+			m.markTrackingFailure(store, trackingID, scoped, a, 0)
+			return
+		}
 	}
 
 	var searchPaths []string
@@ -327,7 +599,7 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 			Subject: scoped,
 			Message: err.Error(),
 		})
-		store.Update(trackingID, beads.UpdateOpts{Labels: []string{"wisp", "wisp-failed"}}) //nolint:errcheck // best-effort
+		m.markTrackingFailure(store, trackingID, scoped, a, headSeq)
 		return
 	}
 	if err := molecule.ValidateRecipeRuntimeVars(recipe, molecule.Options{}); err != nil {
@@ -337,14 +609,29 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 			Subject: scoped,
 			Message: err.Error(),
 		})
-		store.Update(trackingID, beads.UpdateOpts{Labels: []string{"wisp", "wisp-failed"}}) //nolint:errcheck // best-effort
+		m.markTrackingFailure(store, trackingID, scoped, a, headSeq)
 		return
 	}
 
+	var pool string
+	if a.Pool != "" {
+		pool, err = qualifyOrderPool(a, m.cfg)
+		if err != nil {
+			logDispatchError(m.stderr, "gc: order %s: %v", scoped, err)
+			m.rec.Record(events.Event{
+				Type:    events.OrderFailed,
+				Actor:   "controller",
+				Subject: scoped,
+				Message: err.Error(),
+			})
+			m.markTrackingFailure(store, trackingID, scoped, a, headSeq)
+			return
+		}
+	}
+
 	// Decorate graph workflow recipes with routing metadata so child step
 	// beads get gc.routed_to set before instantiation.
 	if a.Pool != "" {
-		pool := qualifyPool(a.Pool, a.Rig)
 		if err := applyGraphRouting(recipe, nil, pool, nil, "", "", "", "", store, m.cityName, cityPath, m.cfg); err != nil {
 			logDispatchError(m.stderr, "gc: order %s: routing decoration failed: %v", scoped, err)
 			// Non-fatal — molecule still works, just without step-level routing.
@@ -359,7 +646,7 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 			Subject: scoped,
 			Message: err.Error(),
 		})
-		store.Update(trackingID, beads.UpdateOpts{Labels: []string{"wisp", "wisp-failed"}}) //nolint:errcheck // best-effort
+		m.markTrackingFailure(store, trackingID, scoped, a, headSeq)
 		return
 	}
 	rootID := cookResult.RootID
@@ -374,7 +661,6 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 		)
 	}
 	if a.Pool != "" {
-		pool := qualifyPool(a.Pool, a.Rig)
 		update.Metadata = map[string]string{"gc.routed_to": pool}
 	}
 	if err := store.Update(rootID, update); err != nil {
@@ -387,7 +673,7 @@ func (m *memoryOrderDispatcher) dispatchWisp(ctx context.Context, store beads.St
 			Subject: scoped,
 			Message: fmt.Sprintf("wisp %s created but label failed: %v", rootID, err),
 		})
-		store.Update(trackingID, beads.UpdateOpts{Labels: []string{"wisp", "wisp-failed"}}) //nolint:errcheck // best-effort
+		m.markTrackingFailure(store, trackingID, scoped, a, headSeq)
 		return
 	}
 
@@ -409,11 +695,28 @@ func (m *memoryOrderDispatcher) orderRigSuspended(a orders.Order) bool {
 	if m.cfg == nil {
 		return false
 	}
-	qualified := qualifyPool(a.Pool, a.Rig)
+	qualified, err := qualifyOrderPool(a, m.cfg)
+	if err != nil {
+		return m.rigSuspendedByName(a.Rig)
+	}
 	rigName, _ := config.ParseQualifiedName(qualified)
 	if rigName == "" {
 		rigName = a.Rig
 	}
+	return m.rigSuspendedByName(rigName)
+}
+
+func (m *memoryOrderDispatcher) markTrackingFailure(store beads.Store, trackingID, scoped string, a orders.Order, headSeq uint64) {
+	labels := []string{"wisp", "wisp-failed"}
+	if a.Trigger == "event" && headSeq > 0 {
+		labels = append(labels, eventCursorLabels(scoped, headSeq)...)
+	}
+	if err := store.Update(trackingID, beads.UpdateOpts{Labels: labels}); err != nil {
+		logDispatchError(m.stderr, "gc: order %s: failed to mark tracking bead %s as failed: %v", scoped, trackingID, err)
+	}
+}
+
+func (m *memoryOrderDispatcher) rigSuspendedByName(rigName string) bool {
 	if rigName == "" {
 		return false
 	}
@@ -425,9 +728,9 @@ func (m *memoryOrderDispatcher) orderRigSuspended(a orders.Order) bool {
 	return false
 }
 
-// hasOpenWorkStrict reports whether any non-closed work bead exists for this
-// order. Tracking beads (title "order:<name>") are excluded, so only actual
-// work (wisps, exec results) counts.
+// hasOpenWorkStrict reports whether any non-closed work or tracking bead
+// exists for this order. Open tracking beads represent in-flight dispatch and
+// must block condition/event orders that do not consult LastRun.
 func (m *memoryOrderDispatcher) hasOpenWorkStrict(store beads.Store, scopedName string) (bool, error) {
 	results, err := store.List(beads.ListQuery{
 		Label: "order-run:" + scopedName,
@@ -436,9 +739,8 @@ func (m *memoryOrderDispatcher) hasOpenWorkStrict(store beads.Store, scopedName
 	if err != nil {
 		return false, fmt.Errorf("listing order work beads: %w", err)
 	}
-	trackingTitle := "order:" + scopedName
 	for _, b := range results {
-		if b.Status != "closed" && b.Title != trackingTitle {
+		if b.Status != "closed" {
 			return true, nil
 		}
 	}
@@ -484,6 +786,63 @@ func sweepOrphanedOrderTracking(store beads.Store) (int, error) {
 	return n, nil
 }
 
+// sweepStaleOrderTracking closes open order-tracking beads whose creation
+// timestamp is older than staleAfter. When onlyOrders is non-empty, it only
+// closes tracking beads for those scoped order names.
+func sweepStaleOrderTracking(store beads.Store, now time.Time, staleAfter time.Duration, onlyOrders map[string]struct{}, initiator string) (int, error) {
+	if staleAfter <= 0 {
+		return 0, fmt.Errorf("stale-after must be positive")
+	}
+	all, err := store.ListByLabel(labelOrderTracking, 0)
+	if err != nil {
+		return 0, fmt.Errorf("listing order-tracking beads: %w", err)
+	}
+
+	cutoff := now.Add(-staleAfter)
+	var ids []string
+	for _, b := range all {
+		if len(onlyOrders) > 0 {
+			name, ok := orderNameFromTrackingBead(b)
+			if !ok {
+				continue
+			}
+			if _, ok := onlyOrders[name]; !ok {
+				continue
+			}
+		}
+		if b.CreatedAt.IsZero() || b.CreatedAt.After(cutoff) {
+			continue
+		}
+		ids = append(ids, b.ID)
+	}
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	metadata := map[string]string{
+		"order_tracking_sweep": orderTrackingSweepMetadataReason,
+	}
+	if initiator != "" {
+		metadata["order_tracking_sweep_by"] = initiator
+	}
+	n, err := store.CloseAll(ids, metadata)
+	if err != nil {
+		return n, fmt.Errorf("closing stale order-tracking beads: %w", err)
+	}
+	return n, nil
+}
+
+func orderNameFromTrackingBead(b beads.Bead) (string, bool) {
+	for _, label := range b.Labels {
+		if name, ok := strings.CutPrefix(label, "order-run:"); ok && name != "" {
+			return name, true
+		}
+	}
+	if name, ok := strings.CutPrefix(b.Title, "order:"); ok && name != "" {
+		return name, true
+	}
+	return "", false
+}
+
 // sweepOrphanedOrderTrackingRetry calls sweepOrphanedOrderTracking with
 // bounded retries. On startup the bead store's backing server may not be
 // query-ready yet (dolt cold-start race, #753). Errors are retried; the
@@ -533,14 +892,116 @@ func rigExclusiveLayers(rigLayers, cityLayers []string) []string {
 	return rigLayers[len(cityLayers):]
 }
 
-// qualifyPool prefixes an unqualified pool name with the rig name for
-// rig-scoped orders. Already-qualified names (containing "/") are
-// returned as-is. City orders (empty rig) are unchanged.
-func qualifyPool(pool, rig string) string {
-	if rig == "" || strings.Contains(pool, "/") {
-		return pool
+// qualifyPool resolves a raw pool name from an order TOML to the qualified
+// form used by Agent.QualifiedName() — the same string the scaler queries
+// via gc.routed_to. Three layers of qualification stack:
+//
+//  1. If pool already contains "/" it is rig-qualified — pass through.
+//  2. If pool exactly matches a configured binding-qualified target
+//     ("binding.name"), preserve that target and still stack the rig prefix
+//     when present.
+//  3. If the order came from an imported pack, prefer same-source agents when
+//     resolving a bare pool name so pack-local orders stay pack-local even if
+//     other scopes also export the same bare agent name.
+//  4. Otherwise look up agents in cfg.Agents whose Dir matches rig
+//     (city orders use rig=="") and Name matches pool. If exactly one target
+//     resolves, swap pool for the binding-qualified form ("binding.name")
+//     before any rig prefixing. This handles V2 pack imports where the
+//     dispatched wisp must carry "binding.name" so the agent's default
+//     scale_check matches its own qualified name.
+//
+// Ambiguity is a hard failure: silently stamping the bare pool string would
+// recreate the exact route/scaler mismatch this helper exists to prevent.
+// nil cfg preserves the rig-only behavior so call sites without a loaded
+// city remain stable. Dotted values that do not match a configured bound
+// target are preserved for backward compatibility.
+func qualifyOrderPool(a orders.Order, cfg *config.City) (string, error) {
+	return qualifyPool(a.Pool, a.Rig, cfg, orderPoolSourceDirHint(a))
+}
+
+func orderPoolSourceDirHint(a orders.Order) string {
+	if a.FormulaLayer == "" {
+		return ""
+	}
+	return filepath.Clean(filepath.Dir(a.FormulaLayer))
+}
+
+func qualifyPool(pool, rig string, cfg *config.City, sourceDirHint string) (string, error) {
+	if strings.Contains(pool, "/") {
+		return pool, nil
+	}
+	if cfg == nil {
+		if rig == "" {
+			return pool, nil
+		}
+		return rig + "/" + pool, nil
+	}
+
+	qualified := pool
+	scope := "city order"
+	if rig != "" {
+		scope = fmt.Sprintf("rig %q", rig)
+	}
+
+	var exactQualified []string
+	var sourceScopedMatches []string
+	var localBareMatches []string
+	var bareMatches []string
+	cleanHint := ""
+	if sourceDirHint != "" {
+		cleanHint = filepath.Clean(sourceDirHint)
+	}
+	for i := range cfg.Agents {
+		a := &cfg.Agents[i]
+		if a.Dir != rig {
+			continue
+		}
+		switch {
+		case strings.Contains(pool, ".") && a.BindingQualifiedName() == pool:
+			exactQualified = appendUniquePoolTarget(exactQualified, a.BindingQualifiedName())
+		case a.Name == pool:
+			bareMatches = appendUniquePoolTarget(bareMatches, a.BindingQualifiedName())
+			if a.BindingName == "" {
+				localBareMatches = appendUniquePoolTarget(localBareMatches, a.BindingQualifiedName())
+			}
+			if cleanHint != "" && filepath.Clean(a.SourceDir) == cleanHint {
+				sourceScopedMatches = appendUniquePoolTarget(sourceScopedMatches, a.BindingQualifiedName())
+			}
+		}
+	}
+
+	switch {
+	case len(exactQualified) == 1:
+		qualified = exactQualified[0]
+	case len(exactQualified) > 1:
+		return "", fmt.Errorf("ambiguous pool %q for %s: matches %s", pool, scope, strings.Join(exactQualified, ", "))
+	case len(sourceScopedMatches) == 1:
+		qualified = sourceScopedMatches[0]
+	case len(sourceScopedMatches) > 1:
+		return "", fmt.Errorf("ambiguous pool %q for %s: matches %s", pool, scope, strings.Join(sourceScopedMatches, ", "))
+	case len(localBareMatches) == 1:
+		qualified = localBareMatches[0]
+	case len(localBareMatches) > 1:
+		return "", fmt.Errorf("ambiguous pool %q for %s: matches %s", pool, scope, strings.Join(localBareMatches, ", "))
+	case len(bareMatches) == 1:
+		qualified = bareMatches[0]
+	case len(bareMatches) > 1:
+		return "", fmt.Errorf("ambiguous pool %q for %s: matches %s", pool, scope, strings.Join(bareMatches, ", "))
+	}
+
+	if rig == "" {
+		return qualified, nil
+	}
+	return rig + "/" + qualified, nil
+}
+
+func appendUniquePoolTarget(values []string, want string) []string {
+	for _, value := range values {
+		if value == want {
+			return values
+		}
 	}
-	return rig + "/" + pool
+	return append(values, want)
 }
 
 // convertOverrides converts config.OrderOverride to orders.Override.
diff --git a/cmd/gc/order_dispatch_test.go b/cmd/gc/order_dispatch_test.go
index bd8cd8336e..4ce3e6ad60 100644
--- a/cmd/gc/order_dispatch_test.go
+++ b/cmd/gc/order_dispatch_test.go
@@ -28,20 +28,49 @@ func trackingBeads(t *testing.T, store beads.Store, label string) []beads.Bead {
 
 func workBeadByOrderLabel(t *testing.T, store beads.Store, label string) beads.Bead {
 	t.Helper()
-	all := trackingBeads(t, store, label)
-	for _, b := range all {
-		if !strings.HasPrefix(b.Title, "order:") {
-			return b
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		all := trackingBeads(t, store, label)
+		for _, b := range all {
+			if !strings.HasPrefix(b.Title, "order:") {
+				return b
+			}
 		}
+		if time.Now().After(deadline) {
+			t.Fatalf("no non-tracking bead found for %q", label)
+		}
+		time.Sleep(10 * time.Millisecond)
 	}
-	t.Fatalf("no non-tracking bead found for %q", label)
-	return beads.Bead{}
 }
 
 type selectiveUpdateFailStore struct {
 	beads.Store
 }
 
+type execLabelUpdateFailStore struct {
+	beads.Store
+}
+
+type eventCursorUpdateFailStore struct {
+	beads.Store
+}
+
+type latestSeqFailProvider struct {
+	events.Provider
+}
+
+type countingListStore struct {
+	beads.Store
+
+	includeClosedLists int
+}
+
+type createdAtOverrideStore struct {
+	beads.Store
+
+	createdAt map[string]time.Time
+}
+
 func (s selectiveUpdateFailStore) Update(id string, opts beads.UpdateOpts) error {
 	for _, label := range opts.Labels {
 		if strings.HasPrefix(label, "order-run:") {
@@ -51,6 +80,67 @@ func (s selectiveUpdateFailStore) Update(id string, opts beads.UpdateOpts) error
 	return s.Store.Update(id, opts)
 }
 
+func (s execLabelUpdateFailStore) Update(id string, opts beads.UpdateOpts) error {
+	for _, label := range opts.Labels {
+		if label == "exec" {
+			return fmt.Errorf("exec label failed")
+		}
+	}
+	return s.Store.Update(id, opts)
+}
+
+func (s eventCursorUpdateFailStore) Update(id string, opts beads.UpdateOpts) error {
+	for _, label := range opts.Labels {
+		if strings.HasPrefix(label, "order:") {
+			return fmt.Errorf("event cursor label failed")
+		}
+	}
+	return s.Store.Update(id, opts)
+}
+
+func (p latestSeqFailProvider) LatestSeq() (uint64, error) {
+	return 0, fmt.Errorf("latest seq failed")
+}
+
+func (s *countingListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.IncludeClosed || query.Status == "closed" {
+		s.includeClosedLists++
+	}
+	return s.Store.List(query)
+}
+
+func (s *countingListStore) reset() {
+	s.includeClosedLists = 0
+}
+
+func (s *createdAtOverrideStore) Create(b beads.Bead) (beads.Bead, error) {
+	created, err := s.Store.Create(b)
+	if err != nil {
+		return beads.Bead{}, err
+	}
+	if !b.CreatedAt.IsZero() {
+		if s.createdAt == nil {
+			s.createdAt = make(map[string]time.Time)
+		}
+		s.createdAt[created.ID] = b.CreatedAt
+		created.CreatedAt = b.CreatedAt
+	}
+	return created, nil
+}
+
+func (s *createdAtOverrideStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	results, err := s.Store.List(query)
+	if err != nil {
+		return nil, err
+	}
+	for i := range results {
+		if created, ok := s.createdAt[results[i].ID]; ok {
+			results[i].CreatedAt = created
+		}
+	}
+	return results, nil
+}
+
 func TestOrderDispatcherNil(t *testing.T) {
 	ad := buildOrderDispatcher(t.TempDir(), &config.City{}, events.Discard, &bytes.Buffer{})
 	if ad != nil {
@@ -94,34 +184,741 @@ func TestOrderDispatchCooldownDue(t *testing.T) {
 		t.Fatal("expected non-nil dispatcher")
 	}
 
-	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	ad.drain(context.Background())
+
+	// Verify tracking bead was created.
+	all := trackingBeads(t, store, "order-run:test-order")
+	if len(all) == 0 {
+		t.Fatal("expected tracking bead to be created")
+	}
+	found := false
+	for _, b := range all {
+		for _, l := range b.Labels {
+			if l == "order-run:test-order" {
+				found = true
+			}
+		}
+	}
+	if !found {
+		t.Error("tracking bead missing order-run:test-order label")
+	}
+
+	work := workBeadByOrderLabel(t, store, "order-run:test-order")
+	if !slicesContain(work.Labels, "order-run:test-order") {
+		t.Errorf("work bead missing order-run:test-order label, got %v", work.Labels)
+	}
+	if work.Metadata["gc.routed_to"] != "worker" {
+		t.Errorf("gc.routed_to = %q, want %q", work.Metadata["gc.routed_to"], "worker")
+	}
+}
+
+// TestOrderDispatchResolvesPackBindingForPool reproduces issue #1268: a
+// pack-imported agent has BindingName set, so its qualified name is
+// "binding.name". A city-level order with pool="<name>" must resolve to the
+// binding-qualified value at dispatch so the wisp's gc.routed_to matches what
+// the scaler queries via Agent.QualifiedName().
+func TestOrderDispatchResolvesPackBindingForPool(t *testing.T) {
+	store := beads.NewMemStore()
+
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog", BindingName: "maintenance"},
+		},
+	}
+
+	aa := []orders.Order{{
+		Name:         "mol-dog-doctor",
+		Trigger:      "cooldown",
+		Interval:     "5m",
+		Formula:      "test-formula",
+		Pool:         "dog",
+		FormulaLayer: sharedTestFormulaDir,
+	}}
+
+	m := &memoryOrderDispatcher{
+		aa: aa,
+		storeFn: func(_ execStoreTarget) (beads.Store, error) {
+			return store, nil
+		},
+		execRun: shellExecRunner,
+		rec:     events.Discard,
+		stderr:  &bytes.Buffer{},
+		cfg:     cfg,
+	}
+
+	m.dispatch(context.Background(), t.TempDir(), time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	work := workBeadByOrderLabel(t, store, "order-run:mol-dog-doctor")
+	if got := work.Metadata["gc.routed_to"]; got != "maintenance.dog" {
+		t.Errorf("gc.routed_to = %q, want %q (pack binding must qualify pool target)", got, "maintenance.dog")
+	}
+}
+
+func TestOrderDispatchPrefersCityShadowForPool(t *testing.T) {
+	store := beads.NewMemStore()
+
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog"},
+			{Name: "dog", BindingName: "maintenance", SourceDir: "/city/packs/maintenance"},
+		},
+	}
+
+	aa := []orders.Order{{
+		Name:         "mol-dog-doctor",
+		Trigger:      "cooldown",
+		Interval:     "5m",
+		Formula:      "test-formula",
+		Pool:         "dog",
+		FormulaLayer: sharedTestFormulaDir,
+	}}
+
+	m := &memoryOrderDispatcher{
+		aa: aa,
+		storeFn: func(_ execStoreTarget) (beads.Store, error) {
+			return store, nil
+		},
+		execRun: shellExecRunner,
+		rec:     events.Discard,
+		stderr:  &bytes.Buffer{},
+		cfg:     cfg,
+	}
+
+	m.dispatch(context.Background(), t.TempDir(), time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	work := workBeadByOrderLabel(t, store, "order-run:mol-dog-doctor")
+	if got := work.Metadata["gc.routed_to"]; got != "dog" {
+		t.Errorf("gc.routed_to = %q, want %q (city-local shadow should stay local)", got, "dog")
+	}
+}
+
+func TestOrderDispatchRejectsAmbiguousPackPool(t *testing.T) {
+	store := beads.NewMemStore()
+	var rec memRecorder
+	var stderr bytes.Buffer
+
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog", BindingName: "gastown"},
+			{Name: "dog", BindingName: "maintenance"},
+		},
+	}
+
+	aa := []orders.Order{{
+		Name:         "mol-dog-doctor",
+		Trigger:      "cooldown",
+		Interval:     "5m",
+		Formula:      "test-formula",
+		Pool:         "dog",
+		FormulaLayer: sharedTestFormulaDir,
+	}}
+
+	m := &memoryOrderDispatcher{
+		aa: aa,
+		storeFn: func(_ execStoreTarget) (beads.Store, error) {
+			return store, nil
+		},
+		execRun: shellExecRunner,
+		rec:     &rec,
+		stderr:  &stderr,
+		cfg:     cfg,
+	}
+
+	m.dispatch(context.Background(), t.TempDir(), time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	if !rec.hasType(events.OrderFailed) {
+		t.Fatal("missing order.failed event for ambiguous pool")
+	}
+	if !strings.Contains(stderr.String(), `ambiguous pool "dog"`) {
+		t.Fatalf("stderr = %q, want ambiguity error", stderr.String())
+	}
+	all := trackingBeads(t, store, "order-run:mol-dog-doctor")
+	var workCount int
+	for _, bead := range all {
+		if !strings.HasPrefix(bead.Title, "order:") {
+			workCount++
+		}
+	}
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label = %d, want 1", len(all))
+	}
+	if workCount != 0 {
+		t.Fatalf("work bead count = %d, want 0", workCount)
+	}
+
+	// An ambiguous failure should still count as the authoritative last run,
+	// so the next patrol tick within the cooldown interval must not create a
+	// second tracking bead or emit another order.failed event.
+	failedEvents := 0
+	for _, event := range rec.events {
+		if event.Type == events.OrderFailed && event.Subject == "mol-dog-doctor" {
+			failedEvents++
+		}
+	}
+	if failedEvents != 1 {
+		t.Fatalf("order.failed count after first dispatch = %d, want 1", failedEvents)
+	}
+
+	m.dispatch(context.Background(), t.TempDir(), time.Now().Add(10*time.Second))
+	time.Sleep(50 * time.Millisecond)
+
+	all = trackingBeads(t, store, "order-run:mol-dog-doctor")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after second dispatch = %d, want 1", len(all))
+	}
+	failedEvents = 0
+	for _, event := range rec.events {
+		if event.Type == events.OrderFailed && event.Subject == "mol-dog-doctor" {
+			failedEvents++
+		}
+	}
+	if failedEvents != 1 {
+		t.Fatalf("order.failed count after second dispatch = %d, want 1", failedEvents)
+	}
+}
+
+func TestOrderDispatchRejectsAmbiguousEventPoolOncePerEvent(t *testing.T) {
+	store := beads.NewMemStore()
+	var rec memRecorder
+	var stderr bytes.Buffer
+
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "dog", BindingName: "gastown"},
+			{Name: "dog", BindingName: "maintenance"},
+		},
+	}
+
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+
+	aa := []orders.Order{{
+		Name:         "release-watch",
+		Trigger:      "event",
+		On:           events.BeadClosed,
+		Formula:      "test-formula",
+		Pool:         "dog",
+		FormulaLayer: sharedTestFormulaDir,
+	}}
+
+	m := &memoryOrderDispatcher{
+		aa: aa,
+		storeFn: func(_ execStoreTarget) (beads.Store, error) {
+			return store, nil
+		},
+		ep:      eventLog,
+		execRun: shellExecRunner,
+		rec:     &rec,
+		stderr:  &stderr,
+		cfg:     cfg,
+	}
+
+	m.dispatch(context.Background(), t.TempDir(), time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	all := trackingBeads(t, store, "order-run:release-watch")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after first dispatch = %d, want 1", len(all))
+	}
+	if !slicesContain(all[0].Labels, "order:release-watch") {
+		t.Fatalf("tracking bead labels = %v, want order cursor label", all[0].Labels)
+	}
+	if !slicesContain(all[0].Labels, fmt.Sprintf("seq:%d", headSeq)) {
+		t.Fatalf("tracking bead labels = %v, want seq:%d", all[0].Labels, headSeq)
+	}
+
+	failedEvents := 0
+	for _, event := range rec.events {
+		if event.Type == events.OrderFailed && event.Subject == "release-watch" {
+			failedEvents++
+		}
+	}
+	if failedEvents != 1 {
+		t.Fatalf("order.failed count after first dispatch = %d, want 1", failedEvents)
+	}
+
+	m.dispatch(context.Background(), t.TempDir(), time.Now().Add(10*time.Second))
+	time.Sleep(50 * time.Millisecond)
+
+	all = trackingBeads(t, store, "order-run:release-watch")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after second dispatch = %d, want 1", len(all))
+	}
+	failedEvents = 0
+	for _, event := range rec.events {
+		if event.Type == events.OrderFailed && event.Subject == "release-watch" {
+			failedEvents++
+		}
+	}
+	if failedEvents != 1 {
+		t.Fatalf("order.failed count after second dispatch = %d, want 1", failedEvents)
+	}
+}
+
+func TestOrderDispatchEventExecAdvancesCursor(t *testing.T) {
+	store := beads.NewMemStore()
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+
+	var calls int
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		calls++
+		return []byte("ok"), nil
+	}
+
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:    "release-exec",
+		Trigger: "event",
+		On:      events.BeadClosed,
+		Exec:    "scripts/release.sh",
+	}}, store, eventLog, execRun, events.Discard)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	ad.drain(context.Background())
+
+	all := trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after first dispatch = %d, want 1", len(all))
+	}
+	if !slicesContain(all[0].Labels, "order:release-exec") {
+		t.Fatalf("tracking bead labels = %v, want order cursor label", all[0].Labels)
+	}
+	if !slicesContain(all[0].Labels, fmt.Sprintf("seq:%d", headSeq)) {
+		t.Fatalf("tracking bead labels = %v, want seq:%d", all[0].Labels, headSeq)
+	}
+	if calls != 1 {
+		t.Fatalf("exec calls after first dispatch = %d, want 1", calls)
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now().Add(10*time.Second))
+	ad.drain(context.Background())
+
+	all = trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after second dispatch = %d, want 1", len(all))
+	}
+	if calls != 1 {
+		t.Fatalf("exec calls after second dispatch = %d, want 1", calls)
+	}
+}
+
+func TestOrderDispatchEventExecFailureAdvancesCursor(t *testing.T) {
+	store := beads.NewMemStore()
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+
+	var calls int
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		calls++
+		return []byte("failed"), fmt.Errorf("exit status 1")
+	}
+
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:    "release-exec",
+		Trigger: "event",
+		On:      events.BeadClosed,
+		Exec:    "scripts/release.sh",
+	}}, store, eventLog, execRun, events.Discard)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	ad.drain(context.Background())
+
+	all := trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after first dispatch = %d, want 1", len(all))
+	}
+	for _, want := range []string{"order:release-exec", fmt.Sprintf("seq:%d", headSeq), "exec-failed"} {
+		if !slicesContain(all[0].Labels, want) {
+			t.Fatalf("tracking bead labels = %v, want %s", all[0].Labels, want)
+		}
+	}
+	if calls != 1 {
+		t.Fatalf("exec calls after first dispatch = %d, want 1", calls)
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	ad.drain(context.Background())
+
+	all = trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after second dispatch = %d, want 1", len(all))
+	}
+	if calls != 1 {
+		t.Fatalf("exec calls after second dispatch = %d, want 1", calls)
+	}
+}
+
+func TestOrderDispatchEventExecLatestSeqErrorDoesNotRunExec(t *testing.T) {
+	store := beads.NewMemStore()
+	tracking, err := store.Create(beads.Bead{
+		Title:  "order:release-exec",
+		Labels: []string{"order-run:release-exec", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var calls int
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		calls++
+		return []byte("ok"), nil
+	}
+	var rec memRecorder
+	var stderr bytes.Buffer
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:    "release-exec",
+		Trigger: "event",
+		On:      events.BeadClosed,
+		Exec:    "scripts/release.sh",
+	}}, store, events.NewFailFake(), execRun, &rec)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	mad := ad.(*memoryOrderDispatcher)
+	mad.stderr = &stderr
+
+	logs := captureCmdOrderLogs(t, func() {
+		mad.dispatchExec(context.Background(), store, execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID)
+	})
+
+	if calls != 0 {
+		t.Fatalf("exec calls = %d, want 0", calls)
+	}
+	all := trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads = %d, want 1", len(all))
+	}
+	if !slicesContain(all[0].Labels, "exec-failed") {
+		t.Fatalf("tracking bead labels = %v, want exec-failed", all[0].Labels)
+	}
+	if !rec.hasType(events.OrderFailed) {
+		t.Fatal("missing order.failed event")
+	}
+	combined := logs + "\n" + stderr.String()
+	if !strings.Contains(combined, "reading event cursor for release-exec") {
+		t.Fatalf("logs = %q, want event cursor read failure", combined)
+	}
+
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	mad.ep = eventLog
+	mad.dispatchExec(context.Background(), store, execStoreTarget{ScopeRoot: t.TempDir()}, mad.aa[0], t.TempDir(), tracking.ID)
+
+	if calls != 1 {
+		t.Fatalf("exec calls after cursor read recovers = %d, want 1", calls)
+	}
+	all = trackingBeads(t, store, "order-run:release-exec")
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+	for _, want := range []string{"order:release-exec", fmt.Sprintf("seq:%d", headSeq), "exec"} {
+		if !slicesContain(all[0].Labels, want) {
+			t.Fatalf("tracking bead labels after retry = %v, want %s", all[0].Labels, want)
+		}
+	}
+}
+
+func TestOrderDispatchEventExecLabelFailureRecordsOrderFailure(t *testing.T) {
+	store := beads.NewMemStore()
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+	headSeq, err := eventLog.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq(): %v", err)
+	}
+
+	var calls int
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		calls++
+		return []byte("ok"), nil
+	}
+	var rec memRecorder
+	var stderr bytes.Buffer
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:    "release-exec",
+		Trigger: "event",
+		On:      events.BeadClosed,
+		Exec:    "scripts/release.sh",
+	}}, execLabelUpdateFailStore{Store: store}, eventLog, execRun, &rec)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	mad := ad.(*memoryOrderDispatcher)
+	mad.stderr = &stderr
+
+	logs := captureCmdOrderLogs(t, func() {
+		ad.dispatch(context.Background(), t.TempDir(), time.Now())
+		ad.drain(context.Background())
+	})
+
+	if calls != 1 {
+		t.Fatalf("exec calls = %d, want 1", calls)
+	}
+	if !rec.hasType(events.OrderFailed) {
+		t.Fatal("missing order.failed event")
+	}
+	if rec.hasType(events.OrderCompleted) {
+		t.Fatal("unexpected order.completed event")
+	}
+	all := trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after first dispatch = %d, want 1", len(all))
+	}
+	for _, want := range []string{"order:release-exec", fmt.Sprintf("seq:%d", headSeq)} {
+		if !slicesContain(all[0].Labels, want) {
+			t.Fatalf("tracking bead labels = %v, want %s", all[0].Labels, want)
+		}
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now().Add(10*time.Second))
+	ad.drain(context.Background())
+
+	all = trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label after second dispatch = %d, want 1", len(all))
+	}
+	if calls != 1 {
+		t.Fatalf("exec calls after second dispatch = %d, want 1", calls)
+	}
+	combined := logs + "\n" + stderr.String()
+	if !strings.Contains(combined, "failed to label exec tracking bead") {
+		t.Fatalf("logs = %q, want tracking label failure", combined)
+	}
+}
+
+func TestOrderDispatchEventExecCursorLabelFailureMarksExecFailed(t *testing.T) {
+	store := beads.NewMemStore()
+	eventLog := events.NewFake()
+	eventLog.Record(events.Event{Type: events.BeadClosed, Actor: "test"})
+
+	var calls int
+	execRun := func(context.Context, string, string, []string) ([]byte, error) {
+		calls++
+		return []byte("ok"), nil
+	}
+	var rec memRecorder
+	var stderr bytes.Buffer
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:    "release-exec",
+		Trigger: "event",
+		On:      events.BeadClosed,
+		Exec:    "scripts/release.sh",
+	}}, eventCursorUpdateFailStore{Store: store}, eventLog, execRun, &rec)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	mad := ad.(*memoryOrderDispatcher)
+	mad.stderr = &stderr
+
+	logs := captureCmdOrderLogs(t, func() {
+		ad.dispatch(context.Background(), t.TempDir(), time.Now())
+		ad.drain(context.Background())
+	})
+
+	if calls != 0 {
+		t.Fatalf("exec calls = %d, want 0", calls)
+	}
+	if !rec.hasType(events.OrderFailed) {
+		t.Fatal("missing order.failed event")
+	}
+	if rec.hasType(events.OrderCompleted) {
+		t.Fatal("unexpected order.completed event")
+	}
+	all := trackingBeads(t, store, "order-run:release-exec")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label = %d, want 1", len(all))
+	}
+	if !slicesContain(all[0].Labels, "exec-failed") {
+		t.Fatalf("tracking bead labels = %v, want exec-failed", all[0].Labels)
+	}
+	combined := logs + "\n" + stderr.String()
+	if !strings.Contains(combined, "failed to label exec event cursor") {
+		t.Fatalf("logs = %q, want cursor label failure", combined)
+	}
+}
+
+func TestOrderDispatchEventWispLatestSeqErrorDoesNotInstantiate(t *testing.T) {
+	store := beads.NewMemStore()
+	tracking, err := store.Create(beads.Bead{
+		Title:  "order:release-watch",
+		Labels: []string{"order-run:release-watch", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var rec memRecorder
+	var stderr bytes.Buffer
+	ad := buildOrderDispatcherFromListExec([]orders.Order{{
+		Name:         "release-watch",
+		Trigger:      "event",
+		On:           events.BeadClosed,
+		Formula:      "test-formula",
+		FormulaLayer: sharedTestFormulaDir,
+	}}, store, latestSeqFailProvider{Provider: events.NewFake()}, successfulExec, &rec)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	mad := ad.(*memoryOrderDispatcher)
+	mad.stderr = &stderr
+
+	mad.dispatchWisp(context.Background(), store, mad.aa[0], t.TempDir(), tracking.ID)
+
+	all := trackingBeads(t, store, "order-run:release-watch")
+	if len(all) != 1 {
+		t.Fatalf("tracking beads with order-run label = %d, want only tracking bead", len(all))
+	}
+	if !slicesContain(all[0].Labels, "wisp-failed") {
+		t.Fatalf("tracking bead labels = %v, want wisp-failed", all[0].Labels)
+	}
+	if !rec.hasType(events.OrderFailed) {
+		t.Fatal("missing order.failed event")
+	}
+	if !strings.Contains(stderr.String(), "reading event cursor for release-watch") {
+		t.Fatalf("stderr = %q, want event cursor read failure", stderr.String())
+	}
+}
+
+func TestOrderDispatchResolvesImportedPackPoolAgainstCityShadow(t *testing.T) {
+	cityDir := t.TempDir()
+	writeImportedDogOrderFixture(t, cityDir, true)
+	cfg, aa := loadImportedDogOrders(t, cityDir)
+	store := beads.NewMemStore()
+
+	m := &memoryOrderDispatcher{
+		aa: aa,
+		storeFn: func(_ execStoreTarget) (beads.Store, error) {
+			return store, nil
+		},
+		execRun: shellExecRunner,
+		rec:     events.Discard,
+		stderr:  &bytes.Buffer{},
+		cfg:     cfg,
+	}
+
+	m.dispatch(context.Background(), cityDir, time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	work := workBeadByOrderLabel(t, store, "order-run:digest")
+	if got := work.Metadata["gc.routed_to"]; got != "maintenance.dog" {
+		t.Fatalf("gc.routed_to = %q, want maintenance.dog", got)
+	}
+}
+
+func TestOrderDispatchResolvesImportedPackPoolAgainstSiblingImportCollision(t *testing.T) {
+	cityDir := t.TempDir()
+	writeImportedDogOrderFixture(t, cityDir, false, "gastown")
+	cfg, aa := loadImportedDogOrders(t, cityDir)
+	store := beads.NewMemStore()
+
+	m := &memoryOrderDispatcher{
+		aa: aa,
+		storeFn: func(_ execStoreTarget) (beads.Store, error) {
+			return store, nil
+		},
+		execRun: shellExecRunner,
+		rec:     events.Discard,
+		stderr:  &bytes.Buffer{},
+		cfg:     cfg,
+	}
+
+	m.dispatch(context.Background(), cityDir, time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	work := workBeadByOrderLabel(t, store, "order-run:digest")
+	if got := work.Metadata["gc.routed_to"]; got != "maintenance.dog" {
+		t.Fatalf("gc.routed_to = %q, want maintenance.dog", got)
+	}
+}
+
+func TestDoltPackDogOrdersResolveWithNonGastownMaintenanceBinding(t *testing.T) {
+	cityDir := t.TempDir()
+	opsDir := filepath.Join(cityDir, "packs", "ops")
+	if err := os.MkdirAll(opsDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(cityDir, "city.toml"), `
+[workspace]
+name = "portable-city"
+`)
+	writeFile(t, filepath.Join(opsDir, "pack.toml"), `
+[pack]
+name = "ops"
+schema = 2
+
+[[agent]]
+name = "dog"
+scope = "city"
+`)
+	doltDir, err := filepath.Abs(filepath.Join("..", "..", "examples", "dolt"))
+	if err != nil {
+		t.Fatalf("Abs(examples/dolt): %v", err)
+	}
+	writeFile(t, filepath.Join(cityDir, "pack.toml"), `
+[pack]
+name = "portable-city"
+schema = 2
+
+[imports.ops]
+source = "./packs/ops"
 
-	// Wait briefly for goroutine to complete.
-	time.Sleep(50 * time.Millisecond)
+[imports.dolt]
+source = "`+doltDir+`"
+`)
 
-	// Verify tracking bead was created.
-	all := trackingBeads(t, store, "order-run:test-order")
-	if len(all) == 0 {
-		t.Fatal("expected tracking bead to be created")
-	}
-	found := false
-	for _, b := range all {
-		for _, l := range b.Labels {
-			if l == "order-run:test-order" {
-				found = true
-			}
-		}
+	cfg, err := loadCityConfig(cityDir)
+	if err != nil {
+		t.Fatalf("loadCityConfig: %v", err)
 	}
-	if !found {
-		t.Error("tracking bead missing order-run:test-order label")
+	var stderr bytes.Buffer
+	aa, err := scanAllOrders(cityDir, cfg, &stderr, "gc order list")
+	if err != nil {
+		t.Fatalf("scanAllOrders: %v; stderr: %s", err, stderr.String())
 	}
 
-	work := workBeadByOrderLabel(t, store, "order-run:test-order")
-	if !slicesContain(work.Labels, "order-run:test-order") {
-		t.Errorf("work bead missing order-run:test-order label, got %v", work.Labels)
+	const wantDogOrders = 5
+	var gotDogOrders int
+	for _, a := range aa {
+		if !strings.HasPrefix(a.Name, "mol-dog-") {
+			continue
+		}
+		gotDogOrders++
+		if a.Pool != "dog" {
+			t.Fatalf("%s pool = %q, want portable bare dog", a.Name, a.Pool)
+		}
+		got, err := qualifyOrderPool(a, cfg)
+		if err != nil {
+			t.Fatalf("qualifyOrderPool(%s): %v", a.Name, err)
+		}
+		if got != "ops.dog" {
+			t.Fatalf("qualifyOrderPool(%s) = %q, want ops.dog", a.Name, got)
+		}
 	}
-	if work.Metadata["gc.routed_to"] != "worker" {
-		t.Errorf("gc.routed_to = %q, want %q", work.Metadata["gc.routed_to"], "worker")
+	if gotDogOrders != wantDogOrders {
+		t.Fatalf("Dolt dog order count = %d, want %d", gotDogOrders, wantDogOrders)
 	}
 }
 
@@ -149,9 +946,7 @@ func TestOrderDispatchCooldownNotDue(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-
-	// Wait briefly.
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	// Should still have only the seed bead.
 	all, _ := store.ListOpen()
@@ -182,9 +977,7 @@ func TestOrderDispatchMultiple(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-
-	// Wait briefly for goroutine.
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	// Should have the seed bead + 1 tracking bead for order-a.
 	all := trackingBeads(t, store, "order-run:order-a")
@@ -201,6 +994,129 @@ func TestOrderDispatchMultiple(t *testing.T) {
 	}
 }
 
+func TestOrderDispatchCachesLastRunBetweenDispatches(t *testing.T) {
+	store := &countingListStore{Store: beads.NewMemStore()}
+
+	if _, err := store.Create(beads.Bead{
+		Title:  "recent run",
+		Labels: []string{"order-run:test-order"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	aa := []orders.Order{{
+		Name:     "test-order",
+		Trigger:  "cooldown",
+		Interval: "1h",
+		Formula:  "test-formula",
+	}}
+	ad := buildOrderDispatcherFromList(aa, store, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	cityPath := t.TempDir()
+	now := time.Now()
+	ad.dispatch(context.Background(), cityPath, now)
+	if store.includeClosedLists == 0 {
+		t.Fatal("first dispatch did not read persisted order history")
+	}
+
+	store.reset()
+	ad.dispatch(context.Background(), cityPath, now.Add(time.Second))
+	if store.includeClosedLists != 0 {
+		t.Fatalf("second dispatch performed %d closed-history reads, want cached last-run result", store.includeClosedLists)
+	}
+
+	all, _ := store.ListOpen()
+	if len(all) != 1 {
+		t.Errorf("expected only seed bead, got %d", len(all))
+	}
+}
+
+func TestOrderDispatchRefreshesCachedLastRunBeforeDueDispatch(t *testing.T) {
+	baseStore := &createdAtOverrideStore{Store: beads.NewMemStore()}
+	store := &countingListStore{Store: baseStore}
+	now := time.Date(2026, 4, 27, 12, 0, 0, 0, time.UTC)
+
+	if _, err := store.Create(beads.Bead{
+		Title:     "recent run",
+		Labels:    []string{"order-run:test-order"},
+		CreatedAt: now.Add(-30 * time.Minute),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	aa := []orders.Order{{
+		Name:     "test-order",
+		Trigger:  "cooldown",
+		Interval: "1h",
+		Exec:     "true",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, successfulExec, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	cityPath := t.TempDir()
+	ad.dispatch(context.Background(), cityPath, now)
+	if store.includeClosedLists == 0 {
+		t.Fatal("first dispatch did not read persisted order history")
+	}
+
+	store.reset()
+	if _, err := store.Create(beads.Bead{
+		Title:     "manual run",
+		Labels:    []string{"order-run:test-order"},
+		CreatedAt: now.Add(20 * time.Minute),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	ad.dispatch(context.Background(), cityPath, now.Add(31*time.Minute))
+	if store.includeClosedLists == 0 {
+		t.Fatal("due cached dispatch did not refresh persisted order history")
+	}
+
+	all := trackingBeads(t, store, "order-run:test-order")
+	if len(all) != 2 {
+		t.Fatalf("order-run beads = %d, want only seed plus manual run", len(all))
+	}
+}
+
+func TestOrderDispatchCachesAutoTrackingBeadCreatedAt(t *testing.T) {
+	store := &countingListStore{Store: beads.NewMemStore()}
+	now := time.Now()
+
+	aa := []orders.Order{{
+		Name:     "test-order",
+		Trigger:  "cooldown",
+		Interval: "1h",
+		Exec:     "true",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, successfulExec, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	cityPath := t.TempDir()
+	ad.dispatch(context.Background(), cityPath, now)
+	all := trackingBeads(t, store, "order-run:test-order")
+	if len(all) != 1 {
+		t.Fatalf("order-run beads after first dispatch = %d, want 1", len(all))
+	}
+
+	store.reset()
+	ad.dispatch(context.Background(), cityPath, now.Add(time.Second))
+	if store.includeClosedLists != 0 {
+		t.Fatalf("second dispatch performed %d closed-history reads, want cached tracking bead timestamp", store.includeClosedLists)
+	}
+	all = trackingBeads(t, store, "order-run:test-order")
+	if len(all) != 1 {
+		t.Fatalf("order-run beads after second dispatch = %d, want cached cooldown suppression", len(all))
+	}
+}
+
 // --- exec order dispatch tests ---
 
 func TestOrderDispatchExecDue(t *testing.T) {
@@ -226,7 +1142,7 @@ func TestOrderDispatchExecDue(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	if !ran {
 		t.Error("exec runner was not called")
@@ -315,6 +1231,53 @@ func TestOrderDispatchExecFailure(t *testing.T) {
 	}
 }
 
+func TestOrderDispatchExecFailureRedactsSecrets(t *testing.T) {
+	t.Setenv("GITHUB_TOKEN", "ghs_order_secret")
+	store := beads.NewMemStore()
+	var rec memRecorder
+	var stderr bytes.Buffer
+	tracking, err := store.Create(beads.Bead{
+		Title:  "order:leaky-exec",
+		Labels: []string{"order-run:leaky-exec", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fakeExec := func(_ context.Context, _, _ string, _ []string) ([]byte, error) {
+		return []byte("GITHUB_TOKEN=ghs_order_secret\n--password hunter2\n"), fmt.Errorf("token=ghs_order_secret password=hunter2")
+	}
+
+	aa := []orders.Order{{
+		Name:     "leaky-exec",
+		Trigger:  "cooldown",
+		Interval: "2m",
+		Exec:     "scripts/fail.sh",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, &rec)
+	mad := ad.(*memoryOrderDispatcher)
+	mad.stderr = &stderr
+
+	logs := captureCmdOrderLogs(t, func() {
+		mad.dispatchExec(context.Background(), store, execStoreTarget{ScopeRoot: t.TempDir()}, aa[0], t.TempDir(), tracking.ID)
+	})
+
+	combined := logs + "\n" + stderr.String()
+	for _, secret := range []string{"ghs_order_secret", "hunter2"} {
+		if strings.Contains(combined, secret) {
+			t.Fatalf("order exec logs leaked %q:\n%s", secret, combined)
+		}
+	}
+	if !strings.Contains(combined, "[redacted]") {
+		t.Fatalf("order exec logs = %q, want redaction marker", combined)
+	}
+	for _, event := range rec.events {
+		if strings.Contains(event.Message, "ghs_order_secret") || strings.Contains(event.Message, "hunter2") {
+			t.Fatalf("order failed event leaked secret: %#v", event)
+		}
+	}
+}
+
 func TestOrderDispatchFormulaCookFailureLabelsTrackingBead(t *testing.T) {
 	store := beads.NewMemStore()
 	var rec memRecorder
@@ -335,7 +1298,7 @@ func TestOrderDispatchFormulaCookFailureLabelsTrackingBead(t *testing.T) {
 	mad.rec = &rec
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	all := trackingBeads(t, store, "order-run:fail-formula")
 	hasFailed := false
@@ -454,7 +1417,7 @@ func TestOrderDispatchFormulaLabelFailureLabelsTrackingBead(t *testing.T) {
 	mad.stderr = &stderr
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	all := trackingBeads(t, store, "order-run:fail-label")
 	hasFailed := false
@@ -500,7 +1463,7 @@ func TestOrderDispatchExecCooldown(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	if ran {
 		t.Error("exec should not have run — cooldown not elapsed")
@@ -526,7 +1489,7 @@ func TestOrderDispatchExecOrderDir(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
 
 	ad.dispatch(context.Background(), "/city-root", time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	foundDir := false
 	foundCity := false
@@ -580,7 +1543,7 @@ func TestOrderDispatchExecPackDir(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
 
 	ad.dispatch(context.Background(), "/city-root", time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	foundPackDir := false
 	foundAutoDir := false
@@ -742,12 +1705,84 @@ provider = "bd"
 	if got["GC_CITY_RUNTIME_DIR"] != customRuntimeDir {
 		t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q; env=%v", got["GC_CITY_RUNTIME_DIR"], customRuntimeDir, got)
 	}
+	wantControlTrace := filepath.Join(customRuntimeDir, "control-dispatcher-trace.log")
+	if got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != wantControlTrace {
+		t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q; env=%v", got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"], wantControlTrace, got)
+	}
 	wantStateFile := filepath.Join(packStateDir, "dolt-state.json")
 	if got["GC_DOLT_STATE_FILE"] != wantStateFile {
 		t.Fatalf("GC_DOLT_STATE_FILE = %q, want %q; env=%v", got["GC_DOLT_STATE_FILE"], wantStateFile, got)
 	}
 }
 
+func TestOrderDispatchExecManagedDoltCoercesInCityRuntimeDirForControlTraceDefault(t *testing.T) {
+	store := beads.NewMemStore()
+	cityDir := t.TempDir()
+	dataDir := filepath.Join(cityDir, ".beads", "dolt")
+	unsafeRuntimeDir := filepath.Join(cityDir, "runtime-outside-gc")
+	packStateDir := filepath.Join(unsafeRuntimeDir, "packs", "dolt")
+	t.Setenv("GC_CITY_PATH", cityDir)
+	t.Setenv("GC_CITY_RUNTIME_DIR", unsafeRuntimeDir)
+	if err := os.MkdirAll(dataDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(packStateDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(cityDir, "city.toml"), `[workspace]
+name = "test-city"
+prefix = "ct"
+
+[beads]
+provider = "bd"
+`)
+	writeFile(t, filepath.Join(cityDir, ".beads", "config.yaml"), strings.Join([]string{
+		"issue_prefix: ct",
+		"gc.endpoint_origin: managed_city",
+		"gc.endpoint_status: verified",
+		"dolt.auto-start: false",
+		"",
+	}, "\n"))
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("Listen: %v", err)
+	}
+	defer func() {
+		if err := listener.Close(); err != nil {
+			t.Fatalf("Close listener: %v", err)
+		}
+	}()
+	writeFile(t, filepath.Join(packStateDir, "dolt-state.json"), fmt.Sprintf(
+		`{"running":true,"pid":%d,"port":%d,"data_dir":%q}`,
+		os.Getpid(),
+		listener.Addr().(*net.TCPAddr).Port,
+		dataDir,
+	))
+
+	envCh := make(chan []string, 1)
+	fakeExec := func(_ context.Context, _, _ string, env []string) ([]byte, error) {
+		envCh <- env
+		return nil, nil
+	}
+	aa := []orders.Order{{
+		Name:     "dolt-gc-nudge",
+		Trigger:  "cooldown",
+		Interval: "1m",
+		Exec:     "gc dolt gc-nudge",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
+	ad.dispatch(context.Background(), cityDir, time.Now())
+
+	got := orderDispatchTestEnv(t, envCh)
+	if got["GC_CITY_RUNTIME_DIR"] != unsafeRuntimeDir {
+		t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q; env=%v", got["GC_CITY_RUNTIME_DIR"], unsafeRuntimeDir, got)
+	}
+	wantControlTrace := filepath.Join(cityDir, ".gc", "runtime", "control-dispatcher-trace.log")
+	if got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != wantControlTrace {
+		t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q; env=%v", got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"], wantControlTrace, got)
+	}
+}
+
 func TestOrderDispatchExecPackDirEmpty(t *testing.T) {
 	// When FormulaLayer is empty, PACK_DIR should not be in env.
 	store := beads.NewMemStore()
@@ -769,7 +1804,7 @@ func TestOrderDispatchExecPackDirEmpty(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
 
 	ad.dispatch(context.Background(), "/city-root", time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	for _, e := range gotEnv {
 		if strings.HasPrefix(e, "PACK_DIR=") {
@@ -817,7 +1852,7 @@ func TestOrderDispatchExecRigUsesScopedWorkdirAndStoreEnv(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), cityDir, time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	if gotDir != rigDir {
 		t.Fatalf("exec dir = %q, want %q", gotDir, rigDir)
@@ -894,8 +1929,8 @@ func TestOrderDispatchExecMarksExternalDoltTargetForManagedLocalOnlyOrders(t *te
 
 func TestOrderDispatchExecPropagatesManagedDoltLayout(t *testing.T) {
 	store := beads.NewMemStore()
-	cityDir := t.TempDir()
-	dataDir := filepath.Join(t.TempDir(), "managed-dolt")
+	cityDir := normalizePathForCompare(t.TempDir())
+	dataDir := normalizePathForCompare(filepath.Join(t.TempDir(), "managed-dolt"))
 	configFile := filepath.Join(cityDir, ".gc", "runtime", "packs", "dolt", "dolt-config.yaml")
 	if err := os.MkdirAll(filepath.Join(cityDir, ".beads"), 0o755); err != nil {
 		t.Fatal(err)
@@ -965,8 +2000,8 @@ func TestOrderDispatchExecPropagatesManagedDoltLayout(t *testing.T) {
 
 func TestOrderDispatchExecPropagatesLegacyManagedDoltDataDir(t *testing.T) {
 	store := beads.NewMemStore()
-	cityDir := t.TempDir()
-	dataDir := filepath.Join(cityDir, ".gc", "dolt-data")
+	cityDir := normalizePathForCompare(t.TempDir())
+	dataDir := normalizePathForCompare(filepath.Join(cityDir, ".gc", "dolt-data"))
 	if err := os.MkdirAll(filepath.Join(cityDir, ".beads"), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -1143,7 +2178,7 @@ func TestOrderDispatchExecTimeout(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, &rec)
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(300 * time.Millisecond)
+	ad.drain(context.Background())
 
 	// Should have failed due to timeout.
 	if !rec.hasType(events.OrderFailed) {
@@ -1199,7 +2234,7 @@ func TestOrderDispatchSkipsSuspendedRig(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	// No tracking bead should be created for a suspended rig.
 	all := trackingBeads(t, store, "order-run:rig-order:rig:demo")
@@ -1231,7 +2266,7 @@ func TestOrderDispatchSkipsSuspendedRigQualifiedPool(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	all := trackingBeads(t, store, "order-run:city-order")
 	if len(all) != 0 {
@@ -1262,7 +2297,7 @@ func TestOrderDispatchAllowsNonSuspendedRig(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	all := trackingBeads(t, store, "order-run:rig-order:rig:demo")
 	if len(all) == 0 {
@@ -1293,7 +2328,7 @@ func TestOrderDispatchSkipsCitySuspended(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	all := trackingBeads(t, store, "order-run:city-order")
 	if len(all) != 0 {
@@ -1322,7 +2357,7 @@ func TestOrderDispatchSkipsSuspendedRigExec(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	all := trackingBeads(t, store, "order-run:exec-order:rig:demo")
 	if len(all) != 0 {
@@ -1368,6 +2403,23 @@ func TestOrderRigSuspended(t *testing.T) {
 	}
 }
 
+func TestOrderRigSuspendedFallsBackToOrderRigOnPoolResolutionError(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "frozen", Path: "/tmp/frozen", Suspended: true},
+		},
+		Agents: []config.Agent{
+			{Name: "dog", Dir: "frozen", BindingName: "alpha"},
+			{Name: "dog", Dir: "frozen", BindingName: "beta"},
+		},
+	}
+	m := &memoryOrderDispatcher{cfg: cfg}
+
+	if got := m.orderRigSuspended(orders.Order{Rig: "frozen", Pool: "dog"}); !got {
+		t.Fatal("orderRigSuspended() = false, want true for suspended rig when pool resolution fails")
+	}
+}
+
 // --- orphaned tracking bead sweep tests (#520) ---
 
 func TestSweepOrphanedOrderTracking_ClosesOpenTrackingBeads(t *testing.T) {
@@ -1445,26 +2497,85 @@ func TestSweepOrphanedOrderTracking_NoOrphans(t *testing.T) {
 	}
 }
 
-func TestSweepOrphanedOrderTracking_OnlyClosedBeads(t *testing.T) {
+func TestSweepOrphanedOrderTracking_OnlyClosedBeads(t *testing.T) {
+	store := beads.NewMemStore()
+
+	b, err := store.Create(beads.Bead{
+		Title:  "order:dolt-health",
+		Labels: []string{"order-run:dolt-health", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := store.Close(b.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	closed, err := sweepOrphanedOrderTracking(store)
+	if err != nil {
+		t.Fatalf("sweepOrphanedOrderTracking: %v", err)
+	}
+	if closed != 0 {
+		t.Fatalf("closed = %d, want 0", closed)
+	}
+}
+
+func TestSweepStaleOrderTracking_ClosesOnlyOldOpenTrackingBeads(t *testing.T) {
 	store := beads.NewMemStore()
 
-	b, err := store.Create(beads.Bead{
-		Title:  "order:dolt-health",
-		Labels: []string{"order-run:dolt-health", labelOrderTracking},
+	old, err := store.Create(beads.Bead{
+		Title:  "order:old-sweep",
+		Labels: []string{"order-run:old-sweep", labelOrderTracking},
 	})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatalf("Create(old): %v", err)
 	}
-	if err := store.Close(b.ID); err != nil {
-		t.Fatalf("Close: %v", err)
+	oldWork, err := store.Create(beads.Bead{
+		Title:  "real work",
+		Labels: []string{"order-run:old-sweep"},
+	})
+	if err != nil {
+		t.Fatalf("Create(work): %v", err)
 	}
 
-	closed, err := sweepOrphanedOrderTracking(store)
+	time.Sleep(150 * time.Millisecond)
+
+	fresh, err := store.Create(beads.Bead{
+		Title:  "order:fresh-sweep",
+		Labels: []string{"order-run:fresh-sweep", labelOrderTracking},
+	})
 	if err != nil {
-		t.Fatalf("sweepOrphanedOrderTracking: %v", err)
+		t.Fatalf("Create(fresh): %v", err)
 	}
-	if closed != 0 {
-		t.Fatalf("closed = %d, want 0", closed)
+
+	closed, err := sweepStaleOrderTracking(store, time.Now(), 100*time.Millisecond, nil, orderTrackingSweepMetadataInitiator)
+	if err != nil {
+		t.Fatalf("sweepStaleOrderTracking: %v", err)
+	}
+	if closed != 1 {
+		t.Fatalf("closed = %d, want 1", closed)
+	}
+
+	gotOld, err := store.Get(old.ID)
+	if err != nil {
+		t.Fatalf("Get(old): %v", err)
+	}
+	if gotOld.Status != "closed" {
+		t.Fatalf("old tracking status = %s, want closed", gotOld.Status)
+	}
+	gotFresh, err := store.Get(fresh.ID)
+	if err != nil {
+		t.Fatalf("Get(fresh): %v", err)
+	}
+	if gotFresh.Status != "open" {
+		t.Fatalf("fresh tracking status = %s, want open", gotFresh.Status)
+	}
+	gotWork, err := store.Get(oldWork.ID)
+	if err != nil {
+		t.Fatalf("Get(work): %v", err)
+	}
+	if gotWork.Status != "open" {
+		t.Fatalf("non-tracking work status = %s, want open", gotWork.Status)
 	}
 }
 
@@ -1668,16 +2779,19 @@ func buildOrderDispatcherFromListExec(aa []orders.Order, store beads.Store, ep e
 	if execRun == nil {
 		execRun = shellExecRunner
 	}
+	dispatchCtx, dispatchCancel := context.WithCancel(context.Background())
 	return &memoryOrderDispatcher{
 		aa: auto,
 		storeFn: func(_ execStoreTarget) (beads.Store, error) {
 			return store, nil
 		},
-		ep:      ep,
-		execRun: execRun,
-		rec:     rec,
-		stderr:  &bytes.Buffer{},
-		cfg:     cfg,
+		ep:             ep,
+		execRun:        execRun,
+		rec:            rec,
+		stderr:         &bytes.Buffer{},
+		cfg:            cfg,
+		dispatchCtx:    dispatchCtx,
+		dispatchCancel: dispatchCancel,
 	}
 }
 
@@ -1702,7 +2816,7 @@ func orderDispatchTestEnv(t *testing.T, envCh <-chan []string) map[string]string
 			}
 		}
 		return env
-	case <-time.After(2 * time.Second):
+	case <-time.After(10 * time.Second):
 		t.Fatal("timed out waiting for order exec env")
 	}
 	return nil
@@ -1770,7 +2884,7 @@ func TestOrderDispatchRigScoped(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	work := workBeadByOrderLabel(t, store, "order-run:db-health:rig:demo-repo")
 	if !slicesContain(work.Labels, "order-run:db-health:rig:demo-repo") {
@@ -1803,7 +2917,7 @@ func TestOrderDispatchRigCooldownIndependent(t *testing.T) {
 	}
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	// rig-b should have a tracking bead, rig-a should not.
 	all := trackingBeads(t, store, "order-run:db-health:rig:rig-b")
@@ -1860,18 +2974,94 @@ func TestRigExclusiveLayersNoCityPrefix(t *testing.T) {
 }
 
 func TestQualifyPool(t *testing.T) {
+	cityBindingCfg := &config.City{Agents: []config.Agent{
+		{Name: "dog", BindingName: "maintenance"},
+	}}
+	cityNoBindingCfg := &config.City{Agents: []config.Agent{
+		{Name: "dog"},
+	}}
+	rigBindingCfg := &config.City{Agents: []config.Agent{
+		{Name: "dog", BindingName: "foo", Dir: "api"},
+	}}
+	ambiguousCfg := &config.City{Agents: []config.Agent{
+		{Name: "dog", BindingName: "gastown"},
+		{Name: "dog", BindingName: "maintenance"},
+	}}
+	importedOnlyCollisionCfg := &config.City{Agents: []config.Agent{
+		{Name: "dog", BindingName: "maintenance", SourceDir: "/city/packs/maintenance"},
+		{Name: "dog", BindingName: "gastown", SourceDir: "/city/packs/gastown"},
+	}}
+	importedShadowCfg := &config.City{Agents: []config.Agent{
+		{Name: "dog"},
+		{Name: "dog", BindingName: "maintenance", SourceDir: "/city/packs/maintenance"},
+		{Name: "dog", BindingName: "gastown", SourceDir: "/city/packs/gastown"},
+	}}
+	dirIsolatedCfg := &config.City{Agents: []config.Agent{
+		// City-level binding agent should NOT match a rig-scoped order.
+		{Name: "dog", BindingName: "maintenance"},
+	}}
+
 	tests := []struct {
-		pool, rig, want string
+		name          string
+		cfg           *config.City
+		pool, rig     string
+		sourceDirHint string
+		want          string
+		wantErr       string
 	}{
-		{"polecat", "demo-repo", "demo-repo/polecat"},
-		{"demo-repo/polecat", "demo-repo", "demo-repo/polecat"}, // already qualified
-		{"dog", "", "dog"}, // city order
+		// Existing behavior preserved when cfg is nil (call sites that
+		// don't have a loaded city, e.g. TestOrderRun fixtures).
+		{"nil cfg city order", nil, "dog", "", "", "dog", ""},
+		{"nil cfg rig order", nil, "polecat", "demo-repo", "", "demo-repo/polecat", ""},
+		{"nil cfg pre-rig-qualified", nil, "demo-repo/polecat", "demo-repo", "", "demo-repo/polecat", ""},
+
+		// Already-qualified passthroughs.
+		{"already rig-qualified passthrough", cityBindingCfg, "demo-repo/dog", "", "", "demo-repo/dog", ""},
+		{"already binding-qualified passthrough", cityBindingCfg, "maintenance.dog", "", "", "maintenance.dog", ""},
+		{"binding-qualified gets rig prefix", rigBindingCfg, "foo.dog", "api", "", "api/foo.dog", ""},
+
+		// City-order binding lookup (the bug fix).
+		{"city order resolves binding", cityBindingCfg, "dog", "", "", "maintenance.dog", ""},
+		{"city order no binding agent", cityNoBindingCfg, "dog", "", "", "dog", ""},
+		{"city order miss falls through", cityBindingCfg, "wolf", "", "", "wolf", ""},
+		{"city local shadow wins without hint", importedShadowCfg, "dog", "", "", "dog", ""},
+		{"no hint stays ambiguous", importedOnlyCollisionCfg, "dog", "", "", "", `ambiguous pool "dog" for city order: matches maintenance.dog, gastown.dog`},
+		{"source hint beats city shadow", importedShadowCfg, "dog", "", "/city/packs/maintenance", "maintenance.dog", ""},
+		{"source hint beats sibling import collision", importedShadowCfg, "dog", "", "/city/packs/gastown", "gastown.dog", ""},
+
+		// Rig-order binding lookup.
+		{"rig order resolves binding", rigBindingCfg, "dog", "api", "", "api/foo.dog", ""},
+		{"rig order isolated from city agent", dirIsolatedCfg, "dog", "api", "", "api/dog", ""},
+
+		// Ambiguity is a hard failure — dispatch must not recreate the
+		// original bare-name route/scaler mismatch.
+		{"ambiguous bindings fail", ambiguousCfg, "dog", "", "", "", `ambiguous pool "dog" for city order: matches gastown.dog, maintenance.dog`},
+
+		// Unresolved dotted pools preserve the legacy pass-through behavior.
+		{"unresolved dotted pool passes through", cityBindingCfg, "team.alpha", "", "", "team.alpha", ""},
+
+		// Empty/edge cases.
+		{"empty cfg agents", &config.City{}, "dog", "", "", "dog", ""},
 	}
 	for _, tt := range tests {
-		got := qualifyPool(tt.pool, tt.rig)
-		if got != tt.want {
-			t.Errorf("qualifyPool(%q, %q) = %q, want %q", tt.pool, tt.rig, got, tt.want)
-		}
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := qualifyPool(tt.pool, tt.rig, tt.cfg, tt.sourceDirHint)
+			if tt.wantErr != "" {
+				if err == nil {
+					t.Fatalf("qualifyPool(%q, %q, cfg) error = nil, want %q", tt.pool, tt.rig, tt.wantErr)
+				}
+				if err.Error() != tt.wantErr {
+					t.Fatalf("qualifyPool(%q, %q, cfg) error = %q, want %q", tt.pool, tt.rig, err.Error(), tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("qualifyPool(%q, %q, cfg) error = %v", tt.pool, tt.rig, err)
+			}
+			if got != tt.want {
+				t.Errorf("qualifyPool(%q, %q, cfg) = %q, want %q", tt.pool, tt.rig, got, tt.want)
+			}
+		})
 	}
 }
 
@@ -1879,6 +3069,7 @@ func TestQualifyPool(t *testing.T) {
 
 func TestBuildOrderDispatcherUsesProviderAwareFileStore(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 
 	cityDir := t.TempDir()
 	layerDir := filepath.Join(cityDir, "formulas")
@@ -1911,7 +3102,7 @@ pool = "worker"
 	}
 
 	ad.dispatch(context.Background(), cityDir, time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	store, err := openStoreAtForCity(cityDir, cityDir)
 	if err != nil {
@@ -1925,6 +3116,7 @@ pool = "worker"
 
 func TestBuildOrderDispatcherRigOrderUsesRigFileStore(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 
 	cityDir := t.TempDir()
 	rigDir := filepath.Join(cityDir, "frontend")
@@ -1979,7 +3171,7 @@ pool = "worker"
 	}
 
 	ad.dispatch(context.Background(), cityDir, time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	cityStore, err := openStoreAtForCity(cityDir, cityDir)
 	if err != nil {
@@ -2002,6 +3194,7 @@ pool = "worker"
 
 func TestBuildOrderDispatcherRigOrderHonorsLegacyCityRunHistory(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 
 	cityDir := t.TempDir()
 	rigDir := filepath.Join(cityDir, "frontend")
@@ -2067,7 +3260,7 @@ pool = "worker"
 	}
 
 	ad.dispatch(context.Background(), cityDir, time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	rigStore, err := openStoreAtForCity(rigDir, cityDir)
 	if err != nil {
@@ -2111,7 +3304,7 @@ func TestOrderDispatchSkipsRigOrderWhenLegacyCityFallbackUnavailable(t *testing.
 	}
 
 	m.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	m.drain(context.Background())
 
 	rigRuns := trackingBeads(t, rigStore, "order-run:rig-digest:rig:frontend")
 	if len(rigRuns) != 0 {
@@ -2161,7 +3354,7 @@ func TestOrderDispatchSkipsRigEventWhenLegacyCursorReadFails(t *testing.T) {
 	}
 
 	m.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	m.drain(context.Background())
 
 	rigRuns := trackingBeads(t, rigStore, "order-run:release-watch:rig:frontend")
 	if len(rigRuns) != 0 {
@@ -2173,6 +3366,11 @@ func TestOrderDispatchSkipsRigEventWhenLegacyCursorReadFails(t *testing.T) {
 }
 
 func TestOrderDispatchSkipsRigConditionWhenLegacyOpenWorkReadFails(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "frontend")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
 	rigStore := beads.NewMemStore()
 	legacyStore := labelFailListStore{
 		Store:     beads.NewMemStore(),
@@ -2202,13 +3400,13 @@ func TestOrderDispatchSkipsRigConditionWhenLegacyOpenWorkReadFails(t *testing.T)
 		cfg: &config.City{
 			Rigs: []config.Rig{{
 				Name: "frontend",
-				Path: "frontend",
+				Path: rigDir,
 			}},
 		},
 	}
 
-	m.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	m.dispatch(context.Background(), cityDir, time.Now())
+	m.drain(context.Background())
 
 	rigRuns := trackingBeads(t, rigStore, "order-run:rig-digest:rig:frontend")
 	if len(rigRuns) != 0 {
@@ -2219,6 +3417,40 @@ func TestOrderDispatchSkipsRigConditionWhenLegacyOpenWorkReadFails(t *testing.T)
 	}
 }
 
+func TestOrderDispatchConditionUsesScopedEnv(t *testing.T) {
+	cityDir := normalizePathForCompare(t.TempDir())
+	store := beads.NewMemStore()
+	if err := os.WriteFile(filepath.Join(cityDir, "scoped-marker"), []byte("ok\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	check := fmt.Sprintf(
+		`test "$GC_CITY_PATH" = '%s' && test "$GC_STORE_ROOT" = '%s' && test "$GC_STORE_SCOPE" = city && test "$(pwd -P)" = "$(cd '%s' && pwd -P)" && test -f scoped-marker`,
+		cityDir,
+		cityDir,
+		cityDir,
+	)
+	ran := make(chan struct{}, 1)
+	fakeExec := func(_ context.Context, _, _ string, _ []string) ([]byte, error) {
+		ran <- struct{}{}
+		return nil, nil
+	}
+	aa := []orders.Order{{
+		Name:    "scoped-check",
+		Trigger: "condition",
+		Check:   check,
+		Exec:    "true",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
+
+	ad.dispatch(context.Background(), cityDir, time.Now())
+
+	select {
+	case <-ran:
+	case <-time.After(2 * time.Second):
+		t.Fatal("condition order did not dispatch with scoped cwd/env")
+	}
+}
+
 func TestOrderDispatchSkipsRigCooldownWhenLegacyLastRunReadFails(t *testing.T) {
 	rigStore := beads.NewMemStore()
 	legacyStore := labelFailListStore{
@@ -2256,7 +3488,7 @@ func TestOrderDispatchSkipsRigCooldownWhenLegacyLastRunReadFails(t *testing.T) {
 	}
 
 	m.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	m.drain(context.Background())
 
 	rigRuns := trackingBeads(t, rigStore, "order-run:rig-digest:rig:frontend")
 	if len(rigRuns) != 0 {
@@ -2269,6 +3501,7 @@ func TestOrderDispatchSkipsRigCooldownWhenLegacyLastRunReadFails(t *testing.T) {
 
 func TestBuildOrderDispatcherReopensStoreForScopedFileReads(t *testing.T) {
 	t.Setenv("GC_BEADS", "file")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "")
 
 	cityDir := t.TempDir()
 	layerDir := filepath.Join(cityDir, "formulas")
@@ -2311,7 +3544,7 @@ pool = "worker"
 	}
 
 	ad.dispatch(context.Background(), cityDir, time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	results := trackingBeads(t, store, "order-run:file-order")
 	tracking := 0
@@ -2502,6 +3735,97 @@ func writeFile(t *testing.T, path, content string) {
 	}
 }
 
+func writeImportedDogOrderFixture(t *testing.T, cityDir string, includeCityDog bool, extraBindings ...string) {
+	t.Helper()
+
+	const orderBinding = "maintenance"
+	packRoot := filepath.Join(cityDir, "packs")
+	if err := os.MkdirAll(packRoot, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	cityToml := `
+[workspace]
+name = "test-city"
+`
+	if includeCityDog {
+		cityToml += `
+
+[[agent]]
+name = "dog"
+scope = "city"
+`
+	}
+	writeFile(t, filepath.Join(cityDir, "city.toml"), cityToml)
+
+	formulaText, err := os.ReadFile(filepath.Join(sharedTestFormulaDir, "test-formula.formula.toml"))
+	if err != nil {
+		t.Fatalf("ReadFile(test-formula): %v", err)
+	}
+
+	allBindings := append([]string{orderBinding}, extraBindings...)
+	var packToml strings.Builder
+	packToml.WriteString(`
+[pack]
+name = "test-city"
+schema = 1
+`)
+
+	for _, binding := range allBindings {
+		packDir := filepath.Join(packRoot, binding)
+		if err := os.MkdirAll(filepath.Join(packDir, "orders"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.MkdirAll(filepath.Join(packDir, "formulas"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		writeFile(t, filepath.Join(packDir, "pack.toml"), `
+[pack]
+name = "`+binding+`"
+schema = 1
+
+[[agent]]
+name = "dog"
+scope = "city"
+`)
+		if binding == orderBinding {
+			writeFile(t, filepath.Join(packDir, "orders", "digest.toml"), `
+[order]
+formula = "test-formula"
+trigger = "cooldown"
+interval = "24h"
+pool = "dog"
+`)
+			writeFile(t, filepath.Join(packDir, "formulas", "test-formula.formula.toml"), string(formulaText))
+		}
+		packToml.WriteString(`
+[imports.` + binding + `]
+source = "./packs/` + binding + `"
+`)
+	}
+
+	writeFile(t, filepath.Join(cityDir, "pack.toml"), packToml.String())
+}
+
+func loadImportedDogOrders(t *testing.T, cityDir string) (*config.City, []orders.Order) {
+	t.Helper()
+
+	cfg, err := loadCityConfig(cityDir)
+	if err != nil {
+		t.Fatalf("loadCityConfig: %v", err)
+	}
+
+	var stderr bytes.Buffer
+	aa, err := scanAllOrders(cityDir, cfg, &stderr, "gc order list")
+	if err != nil {
+		t.Fatalf("scanAllOrders: %v; stderr: %s", err, stderr.String())
+	}
+	if len(aa) != 1 {
+		t.Fatalf("scanAllOrders() len = %d, want 1 (%#v)", len(aa), aa)
+	}
+	return cfg, aa
+}
+
 // memRecorder records events in memory for test assertions.
 type memRecorder struct {
 	events []events.Event
@@ -2548,7 +3872,7 @@ func TestOrderDispatchClosesTrackingBead(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, &rec)
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	// Tracking bead should be closed after dispatch completes.
 	all := trackingBeads(t, store, "order-run:health-check")
@@ -2592,7 +3916,7 @@ func TestOrderDispatchSkipsOpenWork(t *testing.T) {
 	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
 
 	ad.dispatch(context.Background(), t.TempDir(), time.Now())
-	time.Sleep(50 * time.Millisecond)
+	ad.drain(context.Background())
 
 	if ran {
 		t.Error("exec should not have run — open work exists")
@@ -2605,6 +3929,39 @@ func TestOrderDispatchSkipsOpenWork(t *testing.T) {
 	}
 }
 
+func TestOrderDispatchSkipsOpenTrackingBeadForConditionOrder(t *testing.T) {
+	store := beads.NewMemStore()
+
+	_, err := store.Create(beads.Bead{
+		Title:  "order:my-auto",
+		Labels: []string{"order-run:my-auto", labelOrderTracking},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ran := false
+	fakeExec := func(_ context.Context, _, _ string, _ []string) ([]byte, error) {
+		ran = true
+		return nil, nil
+	}
+
+	aa := []orders.Order{{
+		Name:    "my-auto",
+		Trigger: "condition",
+		Check:   "true",
+		Exec:    "scripts/run.sh",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	time.Sleep(50 * time.Millisecond)
+
+	if ran {
+		t.Error("exec should not have run while an order-tracking bead is open")
+	}
+}
+
 func TestOrderDispatchFiresAfterWorkClosed(t *testing.T) {
 	store := beads.NewMemStore()
 
@@ -2636,7 +3993,7 @@ func TestOrderDispatchFiresAfterWorkClosed(t *testing.T) {
 
 	// Use a future "now" so cooldown trigger sees the seed bead as old enough.
 	ad.dispatch(context.Background(), t.TempDir(), time.Now().Add(5*time.Second))
-	time.Sleep(100 * time.Millisecond)
+	ad.drain(context.Background())
 
 	if !ran {
 		t.Error("exec should have run — all previous work is closed")
@@ -2691,3 +4048,183 @@ func TestResolveOrderExecTarget_BoundRigDispatchesNormally(t *testing.T) {
 		t.Errorf("ScopeRoot = %q, want %q", target.ScopeRoot, "/home/user/frontend")
 	}
 }
+
+// --- drain tests (#991) ---
+
+// TestOrderDispatcherDrainWaitsForInFlightDispatch confirms drain blocks
+// until all in-flight dispatchOne goroutines finish, so the tracking bead
+// outcome label is written before the controller exit path returns.
+func TestOrderDispatcherDrainWaitsForInFlightDispatch(t *testing.T) {
+	store := beads.NewMemStore()
+	release := make(chan struct{})
+	execStarted := make(chan struct{})
+
+	fakeExec := func(_ context.Context, _, _ string, _ []string) ([]byte, error) {
+		close(execStarted)
+		<-release
+		return []byte("ok\n"), nil
+	}
+
+	aa := []orders.Order{{
+		Name:     "drain-test",
+		Trigger:  "cooldown",
+		Interval: "2m",
+		Exec:     "scripts/drain.sh",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	<-execStarted
+
+	drainDone := make(chan struct{})
+	go func() {
+		ad.drain(context.Background())
+		close(drainDone)
+	}()
+
+	select {
+	case <-drainDone:
+		t.Fatal("drain returned before in-flight dispatch completed")
+	case <-time.After(50 * time.Millisecond):
+	}
+
+	close(release)
+
+	select {
+	case <-drainDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("drain did not return after in-flight dispatch released")
+	}
+
+	all := trackingBeads(t, store, "order-run:drain-test")
+	hasExec := false
+	for _, b := range all {
+		for _, l := range b.Labels {
+			if l == "exec" {
+				hasExec = true
+			}
+		}
+	}
+	if !hasExec {
+		t.Fatalf("tracking bead missing exec outcome label after drain; beads=%+v", all)
+	}
+}
+
+// TestOrderDispatcherDrainRespectsContext verifies drain returns when the
+// provided context expires, so shutdown remains bounded even when a
+// dispatch goroutine is wedged. Compensating control: startup sweep closes
+// any orphaned tracking beads on the next boot.
+func TestOrderDispatcherDrainRespectsContext(t *testing.T) {
+	store := beads.NewMemStore()
+	release := make(chan struct{})
+	defer close(release)
+	execStarted := make(chan struct{})
+
+	fakeExec := func(_ context.Context, _, _ string, _ []string) ([]byte, error) {
+		close(execStarted)
+		<-release
+		return nil, nil
+	}
+
+	aa := []orders.Order{{
+		Name:     "wedged",
+		Trigger:  "cooldown",
+		Interval: "2m",
+		Exec:     "scripts/wedged.sh",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	<-execStarted
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	ad.drain(ctx)
+	elapsed := time.Since(start)
+	if elapsed > 500*time.Millisecond {
+		t.Fatalf("drain exceeded context deadline by too much: %v", elapsed)
+	}
+	if ctx.Err() == nil {
+		t.Fatal("expected context to be expired after drain returned")
+	}
+}
+
+// TestOrderDispatcherDrainIdleReturnsImmediately verifies drain is a no-op
+// when no dispatchOne goroutines are in flight.
+func TestOrderDispatcherDrainIdleReturnsImmediately(t *testing.T) {
+	aa := []orders.Order{{Name: "noop", Trigger: "cooldown", Interval: "2m", Exec: "true"}}
+	ad := buildOrderDispatcherFromListExec(aa, beads.NewMemStore(), nil, successfulExec, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	done := make(chan struct{})
+	go func() {
+		ad.drain(context.Background())
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("drain on idle dispatcher did not return promptly")
+	}
+}
+
+// TestOrderDispatcherCancelTerminatesInFlight verifies cancel() propagates
+// to in-flight dispatchOne goroutines via context, so a follow-up drain
+// returns promptly without waiting out the per-order timeout. Without
+// this, shutdown can race t.TempDir cleanup against subprocesses still
+// holding files inside .gc/ open.
+func TestOrderDispatcherCancelTerminatesInFlight(t *testing.T) {
+	store := beads.NewMemStore()
+	execStarted := make(chan struct{})
+
+	// Exec respects ctx — returns when canceled. This mirrors what
+	// exec.CommandContext does in production: SIGKILL on ctx.Done.
+	fakeExec := func(ctx context.Context, _, _ string, _ []string) ([]byte, error) {
+		close(execStarted)
+		<-ctx.Done()
+		return nil, ctx.Err()
+	}
+
+	aa := []orders.Order{{
+		Name:     "cancel-test",
+		Trigger:  "cooldown",
+		Interval: "2m",
+		Exec:     "scripts/cancel.sh",
+	}}
+	ad := buildOrderDispatcherFromListExec(aa, store, nil, fakeExec, nil)
+	if ad == nil {
+		t.Fatal("expected non-nil dispatcher")
+	}
+	m, ok := ad.(*memoryOrderDispatcher)
+	if !ok {
+		t.Fatalf("expected *memoryOrderDispatcher, got %T", ad)
+	}
+
+	// Use Background so the only ctx that can cancel the dispatchOne is
+	// the one cancel() controls — proves the hookup works.
+	ad.dispatch(context.Background(), t.TempDir(), time.Now())
+	<-execStarted
+
+	m.cancel()
+
+	drainDone := make(chan struct{})
+	go func() {
+		ad.drain(context.Background())
+		close(drainDone)
+	}()
+
+	select {
+	case <-drainDone:
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("drain did not return promptly after cancel()")
+	}
+}
diff --git a/cmd/gc/order_store.go b/cmd/gc/order_store.go
index 7afa8f658e..40a23f4022 100644
--- a/cmd/gc/order_store.go
+++ b/cmd/gc/order_store.go
@@ -128,6 +128,27 @@ func orderExecEnv(cityPath string, cfg *config.City, target execStoreTarget, a o
 	return mergeRuntimeEnv(nil, env)
 }
 
+func orderTriggerOptions(cityPath string, cfg *config.City, a orders.Order) (orders.TriggerOptions, error) {
+	if a.Trigger != "condition" || strings.TrimSpace(cityPath) == "" {
+		return orders.TriggerOptions{}, nil
+	}
+	target, err := resolveOrderExecTarget(cityPath, cfg, a)
+	if err != nil {
+		return orders.TriggerOptions{}, err
+	}
+	return orderTriggerOptionsForTarget(cityPath, cfg, target, a), nil
+}
+
+func orderTriggerOptionsForTarget(cityPath string, cfg *config.City, target execStoreTarget, a orders.Order) orders.TriggerOptions {
+	if a.Trigger != "condition" || strings.TrimSpace(cityPath) == "" {
+		return orders.TriggerOptions{}
+	}
+	return orders.TriggerOptions{
+		ConditionDir: target.ScopeRoot,
+		ConditionEnv: orderExecEnv(cityPath, cfg, target, a),
+	}
+}
+
 func applyOrderExecCanonicalDoltEnv(cityPath, scopeRoot string, env map[string]string) {
 	if env == nil {
 		return
@@ -235,7 +256,7 @@ func resolveManagedDoltOrderRuntimeLayout(cityPath string, env map[string]string
 }
 
 func managedDoltOrderPackStateDir(cityPath string, env map[string]string) string {
-	if runtimeDir := trustedAmbientCityRuntimeDir(cityPath); runtimeDir != "" {
+	if runtimeDir := citylayout.TrustedAmbientCityRuntimeDir(cityPath); runtimeDir != "" {
 		return normalizePathForCompare(filepath.Join(runtimeDir, "packs", "dolt"))
 	}
 	if env != nil {
diff --git a/cmd/gc/path_helpers_test.go b/cmd/gc/path_helpers_test.go
index 5847e0528b..7bdaf3b922 100644
--- a/cmd/gc/path_helpers_test.go
+++ b/cmd/gc/path_helpers_test.go
@@ -1,7 +1,9 @@
 package main
 
 import (
+	"io"
 	"testing"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/testutil"
 )
@@ -19,3 +21,49 @@ func shortSocketTempDir(t *testing.T, prefix string) string {
 	t.Helper()
 	return testutil.ShortTempDir(t, prefix)
 }
+
+// clearInheritedBeadsEnv prevents tests that explicitly write
+// [beads]\nprovider = "file" from being silently overridden by an agent
+// session's inherited GC_BEADS=bd, which would trigger gc-beads-bd.sh and
+// leak an orphan dolt sql-server because test cleanup paths do not call
+// shutdownBeadsProvider.
+func clearInheritedBeadsEnv(t *testing.T) {
+	t.Helper()
+	for _, key := range []string{
+		"GC_BEADS",
+		"GC_DOLT",
+		"GC_DOLT_HOST",
+		"GC_DOLT_PORT",
+		"GC_DOLT_USER",
+		"GC_DOLT_PASSWORD",
+		"BEADS_DOLT_SERVER_HOST",
+		"BEADS_DOLT_SERVER_PORT",
+		"BEADS_DOLT_SERVER_USER",
+		"BEADS_DOLT_PASSWORD",
+		"GC_BEADS_SCOPE_ROOT",
+	} {
+		t.Setenv(key, "")
+	}
+}
+
+func cleanupManagedDoltTestCity(t *testing.T, cityPath string) {
+	t.Helper()
+	t.Cleanup(func() {
+		tryStopController(cityPath, io.Discard)
+		deadline := time.Now().Add(5 * time.Second)
+		for time.Now().Before(deadline) {
+			if controllerAlive(cityPath) == 0 {
+				break
+			}
+			time.Sleep(50 * time.Millisecond)
+		}
+		if port := currentManagedDoltPort(cityPath); port != "" {
+			if _, err := stopManagedDoltProcess(cityPath, port); err != nil {
+				t.Logf("stopManagedDoltProcess(%s, %s): %v", cityPath, port, err)
+			}
+		}
+		if err := shutdownBeadsProvider(cityPath); err != nil {
+			t.Logf("shutdownBeadsProvider(%s): %v", cityPath, err)
+		}
+	})
+}
diff --git a/cmd/gc/phase2_real_transport_test.go b/cmd/gc/phase2_real_transport_test.go
index c5a40b3d06..cf7e45a3f9 100644
--- a/cmd/gc/phase2_real_transport_test.go
+++ b/cmd/gc/phase2_real_transport_test.go
@@ -193,7 +193,7 @@ func launchPhase2RealTransportSession(t *testing.T, tc phase2ProviderCase, mater
 		`printf "%s" "${GC_SESSION_ORIGIN:-}" > "$GC_REAL_TRANSPORT_SESSION_ORIGIN_PATH"`,
 		`printf "%s" "${GC_STARTUP_PROMPT_DELIVERED:-}" > "$GC_REAL_TRANSPORT_STARTUP_DELIVERED_PATH"`,
 		`printf "started\n" > "$GC_REAL_TRANSPORT_STARTED_PATH"`,
-		`printf "%s" "$0" > "$GC_REAL_TRANSPORT_STARTUP_PROMPT_PATH"`,
+		`if [ -n "${GC_REAL_TRANSPORT_STARTUP_PROMPT_FLAG:-}" ]; then printf "%s" "${1:-}" > "$GC_REAL_TRANSPORT_STARTUP_PROMPT_PATH"; else printf "%s" "$0" > "$GC_REAL_TRANSPORT_STARTUP_PROMPT_PATH"; fi`,
 		`if cmp -s "$GC_REAL_TRANSPORT_STARTUP_PROMPT_PATH" "$GC_REAL_TRANSPORT_EXPECTED_PROMPT_PATH"; then printf "launch-prompt\n" > "$GC_REAL_TRANSPORT_AUTONOMOUS_PATH"; fi`,
 		`IFS= read -r line`,
 		`printf "%s\n" "$line" > "$GC_REAL_TRANSPORT_INPUT_PATH"`,
@@ -223,6 +223,9 @@ func launchPhase2RealTransportSession(t *testing.T, tc phase2ProviderCase, mater
 	cfg.Env["GC_REAL_TRANSPORT_EXPECTED_PROMPT_PATH"] = expectedPromptPath
 	cfg.Env["GC_REAL_TRANSPORT_AUTONOMOUS_PATH"] = autonomousPath
 	cfg.Env["GC_REAL_TRANSPORT_STOP_PATH"] = stopPath
+	if cfg.PromptFlag != "" {
+		cfg.Env["GC_REAL_TRANSPORT_STARTUP_PROMPT_FLAG"] = cfg.PromptFlag
+	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), phase2RealTransportBound)
 	defer cancel()
diff --git a/cmd/gc/phase2_reporting_test.go b/cmd/gc/phase2_reporting_test.go
index 63de8f1236..8fde8fdbf9 100644
--- a/cmd/gc/phase2_reporting_test.go
+++ b/cmd/gc/phase2_reporting_test.go
@@ -25,15 +25,19 @@ func newPhase2Reporter(t *testing.T, suite string) *workertest.SuiteReporter {
 
 func startupCommandMaterializationResult(tc phase2ProviderCase, tp TemplateParams) workertest.Result {
 	evidence := phase2TemplateEvidence(tc, tp)
+	wantPromptMode := tc.wantPromptMode
+	if wantPromptMode == "" {
+		wantPromptMode = "arg"
+	}
 	switch {
 	case tp.ResolvedProvider == nil:
 		return workertest.Fail(tc.profileID, workertest.RequirementStartupCommandMaterialization, "ResolvedProvider = nil").WithEvidence(evidence)
 	case tp.ResolvedProvider.Name != tc.family:
 		return workertest.Fail(tc.profileID, workertest.RequirementStartupCommandMaterialization,
 			fmt.Sprintf("ResolvedProvider.Name = %q, want %q", tp.ResolvedProvider.Name, tc.family)).WithEvidence(evidence)
-	case tp.ResolvedProvider.PromptMode != "arg":
+	case tp.ResolvedProvider.PromptMode != wantPromptMode:
 		return workertest.Fail(tc.profileID, workertest.RequirementStartupCommandMaterialization,
-			fmt.Sprintf("PromptMode = %q, want arg", tp.ResolvedProvider.PromptMode)).WithEvidence(evidence)
+			fmt.Sprintf("PromptMode = %q, want %s", tp.ResolvedProvider.PromptMode, wantPromptMode)).WithEvidence(evidence)
 	case tc.wantCommand != "" && tp.Command != tc.wantCommand:
 		return workertest.Fail(tc.profileID, workertest.RequirementStartupCommandMaterialization,
 			fmt.Sprintf("Command = %q, want %q", tp.Command, tc.wantCommand)).WithEvidence(evidence)
@@ -73,7 +77,10 @@ func startupRuntimeConfigMaterializationResult(tc phase2ProviderCase, tp Templat
 	case cfg.PromptSuffix == "":
 		return workertest.Fail(tc.profileID, workertest.RequirementStartupRuntimeConfigMaterialization,
 			"cfg.PromptSuffix = empty, want beacon prompt materialized").WithEvidence(evidence)
-	case cfg.PromptFlag != "":
+	case tc.wantPromptFlag != "" && cfg.PromptFlag != tc.wantPromptFlag:
+		return workertest.Fail(tc.profileID, workertest.RequirementStartupRuntimeConfigMaterialization,
+			fmt.Sprintf("cfg.PromptFlag = %q, want %q", cfg.PromptFlag, tc.wantPromptFlag)).WithEvidence(evidence)
+	case tc.wantPromptFlag == "" && cfg.PromptFlag != "":
 		return workertest.Fail(tc.profileID, workertest.RequirementStartupRuntimeConfigMaterialization,
 			fmt.Sprintf("cfg.PromptFlag = %q, want empty for arg-mode provider", cfg.PromptFlag)).WithEvidence(evidence)
 	case cfg.Env["GC_DIR"] != tp.WorkDir:
@@ -267,6 +274,7 @@ func phase2ConfigEvidence(tc phase2ProviderCase, tp TemplateParams, cfg runtime.
 	evidence["cfg_workdir"] = cfg.WorkDir
 	evidence["cfg_prompt_flag"] = cfg.PromptFlag
 	evidence["cfg_prompt_suffix"] = cfg.PromptSuffix
+	evidence["cfg_nudge"] = cfg.Nudge
 	evidence["cfg_ready_delay_ms"] = strconv.Itoa(cfg.ReadyDelayMs)
 	evidence["cfg_ready_prompt_prefix"] = cfg.ReadyPromptPrefix
 	evidence["cfg_process_names"] = strings.Join(cfg.ProcessNames, ",")
diff --git a/cmd/gc/pool.go b/cmd/gc/pool.go
index 7172b3df2b..f3ed467d7a 100644
--- a/cmd/gc/pool.go
+++ b/cmd/gc/pool.go
@@ -72,9 +72,7 @@ func shellCommand(command, dir string, timeout time.Duration, env map[string]str
 	if dir != "" {
 		cmd.Dir = dir
 	}
-	if env != nil {
-		cmd.Env = mergeRuntimeEnv(os.Environ(), env)
-	}
+	cmd.Env = mergeRuntimeEnv(os.Environ(), env)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("running command %q: %w", command, err)
@@ -127,17 +125,10 @@ func evaluatePool(agentName string, sp scaleParams, dir string, env map[string]s
 		telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, sp.Min, err)
 		return sp.Min, fmt.Errorf("agent %q: %w", agentName, err)
 	}
-	trimmed := strings.TrimSpace(out)
-	if trimmed == "" {
-		checkErr := fmt.Errorf("agent %q: check %q produced empty output", agentName, sp.Check)
-		telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, sp.Min, checkErr)
-		return sp.Min, checkErr
-	}
-	n, err := strconv.Atoi(trimmed)
+	n, err := parseScaleCheckCount(agentName, sp.Check, out)
 	if err != nil {
-		parseErr := fmt.Errorf("agent %q: check output %q is not an integer", agentName, trimmed)
-		telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, sp.Min, parseErr)
-		return sp.Min, parseErr
+		telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, sp.Min, err)
+		return sp.Min, err
 	}
 	desired := n
 	if desired < sp.Min {
@@ -150,6 +141,38 @@ func evaluatePool(agentName string, sp scaleParams, dir string, env map[string]s
 	return desired, nil
 }
 
+func evaluatePoolNewDemand(agentName string, sp scaleParams, dir string, env map[string]string, runner ScaleCheckRunner) (int, error) {
+	start := time.Now()
+	out, err := runner(sp.Check, dir, env)
+	durationMs := float64(time.Since(start).Milliseconds())
+	if err != nil {
+		telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, 0, err)
+		return 0, fmt.Errorf("agent %q: %w", agentName, err)
+	}
+	n, err := parseScaleCheckCount(agentName, sp.Check, out)
+	if err != nil {
+		telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, 0, err)
+		return 0, err
+	}
+	telemetry.RecordPoolCheck(context.Background(), agentName, durationMs, n, nil)
+	return n, nil
+}
+
+func parseScaleCheckCount(agentName, check, out string) (int, error) {
+	trimmed := strings.TrimSpace(out)
+	if trimmed == "" {
+		return 0, fmt.Errorf("agent %q: check %q produced empty output", agentName, check)
+	}
+	n, err := strconv.Atoi(trimmed)
+	if err != nil {
+		return 0, fmt.Errorf("agent %q: check output %q is not an integer", agentName, trimmed)
+	}
+	if n < 0 {
+		return 0, fmt.Errorf("agent %q: check output %q is negative", agentName, trimmed)
+	}
+	return n, nil
+}
+
 // SessionSetupContext holds template variables for session_setup command expansion.
 type SessionSetupContext struct {
 	Session   string // tmux session name
@@ -405,7 +428,9 @@ func discoverPoolInstances(agentName, agentDir string, sp0 scaleParams, a *confi
 		for i := 1; i <= sp0.Max; i++ {
 			instanceName := poolInstanceName(agentName, i, a)
 			qn := instanceName
-			if agentDir != "" {
+			if a != nil {
+				qn = a.QualifiedInstanceName(instanceName)
+			} else if agentDir != "" {
 				qn = agentDir + "/" + instanceName
 			}
 			names = append(names, qn)
@@ -418,7 +443,9 @@ func discoverPoolInstances(agentName, agentDir string, sp0 scaleParams, a *confi
 	// When bead-derived session names ("s-{beadID}") are active, this prefix
 	// match will fail. Migrate to bead store query by template metadata.
 	qnPrefix := agentName + "-"
-	if agentDir != "" {
+	if a != nil {
+		qnPrefix = a.QualifiedName() + "-"
+	} else if agentDir != "" {
 		qnPrefix = agentDir + "/" + agentName + "-"
 	}
 	// Build the session name prefix to match against running sessions.
@@ -449,6 +476,7 @@ func discoverPoolInstances(agentName, agentDir string, sp0 scaleParams, a *confi
 
 func resolvePoolSessionRefs(
 	store beads.Store,
+	cfg *config.City,
 	agentName, agentDir string,
 	sp0 scaleParams, a *config.Agent,
 	cityName, sessionTemplate string,
@@ -456,12 +484,14 @@ func resolvePoolSessionRefs(
 	stderr io.Writer,
 ) []poolSessionRef {
 	template := agentName
-	if agentDir != "" {
+	if a != nil {
+		template = a.QualifiedName()
+	} else if agentDir != "" {
 		template = agentDir + "/" + agentName
 	}
 	seenSessions := make(map[string]bool)
 	var refs []poolSessionRef
-	poolSessions, err := lookupPoolSessionNames(store, template)
+	poolSessions, err := lookupPoolSessionNameCandidates(store, template, cfg, a)
 	if err != nil && stderr != nil {
 		fmt.Fprintf(stderr, "gc lifecycle: pool bead lookup for %s returned error (legacy discovery also runs): %v\n", template, err) //nolint:errcheck
 	}
@@ -471,15 +501,17 @@ func resolvePoolSessionRefs(
 	}
 	sort.Strings(poolInstances)
 	for _, qualifiedInstance := range poolInstances {
-		sessionName := poolSessions[qualifiedInstance]
-		if sessionName == "" || seenSessions[sessionName] {
-			continue
+		for _, candidate := range poolSessions[qualifiedInstance] {
+			sessionName := candidate.sessionName
+			if sessionName == "" || seenSessions[sessionName] {
+				continue
+			}
+			seenSessions[sessionName] = true
+			refs = append(refs, poolSessionRef{
+				qualifiedInstance: qualifiedInstance,
+				sessionName:       sessionName,
+			})
 		}
-		seenSessions[sessionName] = true
-		refs = append(refs, poolSessionRef{
-			qualifiedInstance: qualifiedInstance,
-			sessionName:       sessionName,
-		})
 	}
 	for _, qualifiedInstance := range discoverPoolInstances(agentName, agentDir, sp0, a, cityName, sessionTemplate, sp) {
 		sessionName := lookupSessionNameOrLegacy(store, cityName, qualifiedInstance, sessionTemplate)
@@ -494,3 +526,28 @@ func resolvePoolSessionRefs(
 	}
 	return refs
 }
+
+func selectRunningPoolSessionRefs(store beads.Store, sp runtime.Provider, cfg *config.City, refs []poolSessionRef) ([]poolSessionRef, error) {
+	grouped := make(map[string][]poolSessionRef)
+	order := make([]string, 0, len(refs))
+	for _, ref := range refs {
+		if _, ok := grouped[ref.qualifiedInstance]; !ok {
+			order = append(order, ref.qualifiedInstance)
+		}
+		grouped[ref.qualifiedInstance] = append(grouped[ref.qualifiedInstance], ref)
+	}
+
+	live := make([]poolSessionRef, 0, len(order))
+	for _, qualifiedInstance := range order {
+		for _, ref := range grouped[qualifiedInstance] {
+			running, err := workerSessionTargetRunningWithConfig("", store, sp, cfg, ref.sessionName)
+			if err != nil {
+				return nil, fmt.Errorf("observing %s: %w", ref.sessionName, err)
+			}
+			if running {
+				live = append(live, ref)
+			}
+		}
+	}
+	return live, nil
+}
diff --git a/cmd/gc/pool_desired_state.go b/cmd/gc/pool_desired_state.go
index db5cf5ef9a..ee80f72d3a 100644
--- a/cmd/gc/pool_desired_state.go
+++ b/cmd/gc/pool_desired_state.go
@@ -13,7 +13,7 @@ type SessionRequest struct {
 	Template      string // agent template qualified name (e.g., "gascity/claude")
 	BeadPriority  int    // priority of the driving work bead
 	Tier          string // "resume" (in-progress work with assigned session) or "new" (ready unassigned work)
-	SessionBeadID string // for resume tier: the session bead to restart
+	SessionBeadID string // concrete session to preserve for resume or in-flight new demand
 	WorkBeadID    string // the work bead driving this request
 }
 
@@ -54,7 +54,7 @@ func PoolDesiredCounts(states []PoolDesiredState) map[string]int {
 // from scale_check, while this function only preserves sessions that already
 // own actionable work.
 // Each bead's gc.routed_to determines which agent template it belongs to.
-// scaleCheckCounts maps agent template → desired count from scale_check.
+// scaleCheckCounts maps agent template → new session demand from scale_check.
 // Pass nil for either when unavailable.
 func ComputePoolDesiredStates(
 	cfg *config.City,
@@ -103,8 +103,7 @@ func computePoolDesiredStates(
 		}
 	}
 
-	// Collect uncapped requests per agent template.
-	var allRequests []SessionRequest
+	var resumeRequests []SessionRequest
 
 	for i := range cfg.Agents {
 		agent := &cfg.Agents[i]
@@ -138,7 +137,7 @@ func computePoolDesiredStates(
 				continue
 			}
 			if sessionBeadID != "" {
-				allRequests = append(allRequests, SessionRequest{
+				resumeRequests = append(resumeRequests, SessionRequest{
 					Template:      template,
 					BeadPriority:  beadPriority(wb),
 					Tier:          "resume",
@@ -151,17 +150,26 @@ func computePoolDesiredStates(
 		}
 	}
 
-	// Merge scale_check demand: for each agent, if scale_check wants more
-	// sessions than bead-driven requests already cover, add the difference
-	// as "new" tier requests. This ensures the scale_check command (which
-	// runs in the correct rig directory) is always the authoritative demand
-	// signal, while bead-driven resume requests preserve running sessions.
-	if len(scaleCheckCounts) > 0 {
-		beadDriven := make(map[string]int, len(allRequests))
-		for _, r := range allRequests {
-			beadDriven[r.Template]++
+	limits := newNestedCapLimits(cfg)
+	usage := acceptedNestedCapUsage(limits, resumeRequests)
+	allRequests := append([]SessionRequest(nil), resumeRequests...)
+	resumeSessionBeadIDs := make(map[string]struct{}, len(resumeRequests))
+	for _, req := range resumeRequests {
+		if req.SessionBeadID != "" {
+			resumeSessionBeadIDs[req.SessionBeadID] = struct{}{}
 		}
-		for _, agent := range cfg.Agents {
+	}
+	inFlightNewRequests := poolInFlightNewRequests(cfg, sessionBeads, resumeSessionBeadIDs)
+
+	// Merge scale_check demand. In bead-backed reconciliation, scale_check is
+	// the authoritative signal for new unassigned demand only; resume requests
+	// are calculated independently from assigned work and must not be deducted
+	// from that count. Pool-created sessions that have not claimed work yet
+	// represent already-spent new demand, so they occupy the first new-demand
+	// slots explicitly before anonymous creates are materialized.
+	if len(scaleCheckCounts) > 0 {
+		for i := range cfg.Agents {
+			agent := &cfg.Agents[i]
 			if agent.Suspended {
 				continue
 			}
@@ -170,12 +178,29 @@ func computePoolDesiredStates(
 			if !ok {
 				continue
 			}
-			deficit := scaleCount - beadDriven[template]
-			for j := 0; j < deficit; j++ {
-				allRequests = append(allRequests, SessionRequest{
+			newCount := capNewDemandCount(limits, usage, agent, scaleCount)
+			inFlight := inFlightNewRequests[template]
+			inFlightCount := minInt(len(inFlight), newCount)
+			if scaleCount > 0 && len(inFlight) > 0 && trace != nil {
+				trace.recordDecision(string(TraceSitePoolInFlightReuse), template, "", string(TraceReasonInFlightReuse), "accepted", traceRecordPayload{
+					"scale_check":   scaleCount,
+					"in_flight":     len(inFlight),
+					"reused":        inFlightCount,
+					"anonymous_new": newCount - inFlightCount,
+				}, nil, "")
+			}
+			for j := 0; j < inFlightCount; j++ {
+				req := inFlight[j]
+				allRequests = append(allRequests, req)
+				usage.accept(req, limits)
+			}
+			for j := inFlightCount; j < newCount; j++ {
+				req := SessionRequest{
 					Template: template,
 					Tier:     "new",
-				})
+				}
+				allRequests = append(allRequests, req)
+				usage.accept(req, limits)
 			}
 		}
 	}
@@ -183,6 +208,57 @@ func computePoolDesiredStates(
 	return applyNestedCaps(cfg, allRequests, trace)
 }
 
+func poolInFlightNewRequests(cfg *config.City, sessionBeads []beads.Bead, resumeSessionBeadIDs map[string]struct{}) map[string][]SessionRequest {
+	requests := make(map[string][]SessionRequest)
+	sortedSessionBeads := append([]beads.Bead(nil), sessionBeads...)
+	sort.SliceStable(sortedSessionBeads, func(i, j int) bool {
+		if !sortedSessionBeads[i].CreatedAt.Equal(sortedSessionBeads[j].CreatedAt) {
+			return sortedSessionBeads[i].CreatedAt.Before(sortedSessionBeads[j].CreatedAt)
+		}
+		return sortedSessionBeads[i].ID < sortedSessionBeads[j].ID
+	})
+	for i := range cfg.Agents {
+		agent := &cfg.Agents[i]
+		if agent.Suspended || !agent.SupportsGenericEphemeralSessions() {
+			continue
+		}
+		template := agent.QualifiedName()
+		for _, sb := range sortedSessionBeads {
+			if sb.ID == "" || sb.Status == "closed" {
+				continue
+			}
+			if _, ok := resumeSessionBeadIDs[sb.ID]; ok {
+				continue
+			}
+			if !isEphemeralSessionBeadForAgent(sb, agent) || !isPoolManagedSessionBead(sb) {
+				continue
+			}
+			if normalizedSessionTemplate(sb, cfg) != template {
+				continue
+			}
+			if !poolSessionConsumesNewDemand(sb) {
+				continue
+			}
+			requests[template] = append(requests[template], SessionRequest{
+				Template:      template,
+				Tier:          "new",
+				SessionBeadID: sb.ID,
+			})
+		}
+	}
+	return requests
+}
+
+func poolSessionConsumesNewDemand(session beads.Bead) bool {
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) == boolMetadata(true) {
+		return true
+	}
+	// This pure desired-state pass has no reconciler clock. Creating sessions
+	// still represent already-spent new demand; lifecycle code owns stale
+	// creating recovery with its clock-aware predicate.
+	return strings.TrimSpace(session.Metadata["state"]) == "creating"
+}
+
 // applyNestedCaps enforces workspace, rig, and agent max_active_sessions caps.
 // Accepts requests in priority order, rejecting any that would exceed a cap.
 func applyNestedCaps(cfg *config.City, requests []SessionRequest, trace *sessionReconcilerTraceCycle) []PoolDesiredState {
@@ -198,92 +274,20 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, trace *session
 		return false
 	})
 
-	// Counters for nested caps.
-	agentCount := make(map[string]int) // template → count
-	rigCount := make(map[string]int)   // rig name → count
-	workspaceCount := 0
-
-	// Resolve caps.
-	workspaceMax := -1 // -1 = unlimited
-	if cfg.Workspace.MaxActiveSessions != nil {
-		workspaceMax = *cfg.Workspace.MaxActiveSessions
-	}
-	rigMaxMap := make(map[string]int) // rig name → max (-1 = unlimited)
-	for _, rig := range cfg.Rigs {
-		if rig.MaxActiveSessions != nil {
-			rigMaxMap[rig.Name] = *rig.MaxActiveSessions
-		} else {
-			rigMaxMap[rig.Name] = -1
-		}
-	}
-	agentMaxMap := make(map[string]int)    // template → max (-1 = unlimited)
-	agentRigMap := make(map[string]string) // template → rig name
-	for i := range cfg.Agents {
-		agent := &cfg.Agents[i]
-		template := agent.QualifiedName()
-		agentRigMap[template] = agent.Dir
-		resolved := agent.ResolvedMaxActiveSessions(cfg)
-		if resolved != nil {
-			agentMaxMap[template] = *resolved
-		} else {
-			agentMaxMap[template] = -1
-		}
-	}
+	limits := newNestedCapLimits(cfg)
+	usage := newNestedCapUsage()
 
 	// Walk sorted requests, accepting each if all caps have room.
 	accepted := make(map[string][]SessionRequest) // template → accepted requests
-	// Dedup: don't accept multiple requests for the same session bead.
-	seenSessionBeads := make(map[string]bool)
 
 	for _, req := range requests {
-		// Dedup resume requests for the same session bead.
-		if req.Tier == "resume" && req.SessionBeadID != "" {
-			if seenSessionBeads[req.SessionBeadID] {
-				continue
-			}
-		}
-
 		template := req.Template
-		rig := agentRigMap[template]
-
-		// Check agent cap.
-		agentMax := agentMaxMap[template]
-		if agentMax >= 0 && agentCount[template] >= agentMax {
-			if trace != nil {
-				trace.recordDecision("reconciler.pool.agent_cap", template, "", "agent_cap", "rejected", traceRecordPayload{
-					"agent_max": agentMax,
-					"current":   agentCount[template],
-					"tier":      req.Tier,
-				}, nil, "")
-			}
+		if usage.isDuplicateSessionRequest(req) {
 			continue
 		}
-		// Check rig cap.
-		if rig != "" {
-			rigMax, ok := rigMaxMap[rig]
-			if !ok {
-				rigMax = -1
-			}
-			if rigMax >= 0 && rigCount[rig] >= rigMax {
-				if trace != nil {
-					trace.recordDecision("reconciler.pool.rig_cap", template, "", "rig_cap", "rejected", traceRecordPayload{
-						"rig":     rig,
-						"rig_max": rigMax,
-						"current": rigCount[rig],
-						"tier":    req.Tier,
-					}, nil, "")
-				}
-				continue
-			}
-		}
-		// Check workspace cap.
-		if workspaceMax >= 0 && workspaceCount >= workspaceMax {
+		if site, reason, payload, rejected := usage.rejection(req, limits); rejected {
 			if trace != nil {
-				trace.recordDecision("reconciler.pool.workspace_cap", template, "", "workspace_cap", "rejected", traceRecordPayload{
-					"workspace_max": workspaceMax,
-					"current":       workspaceCount,
-					"tier":          req.Tier,
-				}, nil, "")
+				trace.recordDecision(site, template, "", reason, "rejected", payload, nil, "")
 			}
 			continue
 		}
@@ -295,14 +299,7 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, trace *session
 				"tier": req.Tier,
 			}, nil, "")
 		}
-		agentCount[template]++
-		if rig != "" {
-			rigCount[rig]++
-		}
-		workspaceCount++
-		if req.Tier == "resume" && req.SessionBeadID != "" {
-			seenSessionBeads[req.SessionBeadID] = true
-		}
+		usage.accept(req, limits)
 	}
 
 	// Fill agent mins (if caps allow).
@@ -313,41 +310,23 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, trace *session
 		}
 		template := agent.QualifiedName()
 		minSess := agent.EffectiveMinActiveSessions()
-		for agentCount[template] < minSess {
-			rig := agentRigMap[template]
-			// Check caps before adding idle session.
-			agentMax := agentMaxMap[template]
-			if agentMax >= 0 && agentCount[template] >= agentMax {
-				break
-			}
-			if rig != "" {
-				rigMax, ok := rigMaxMap[rig]
-				if !ok {
-					rigMax = -1
-				}
-				if rigMax >= 0 && rigCount[rig] >= rigMax {
-					break
-				}
+		for usage.agentCount[template] < minSess {
+			req := SessionRequest{
+				Template: template,
+				Tier:     "new",
 			}
-			if workspaceMax >= 0 && workspaceCount >= workspaceMax {
+			if _, _, _, rejected := usage.rejection(req, limits); rejected {
 				break
 			}
-			accepted[template] = append(accepted[template], SessionRequest{
-				Template: template,
-				Tier:     "new",
-			})
+			accepted[template] = append(accepted[template], req)
 			if trace != nil {
 				trace.recordDecision("reconciler.pool.min_fill", template, "", "min_fill", "accepted", traceRecordPayload{
 					"min":     minSess,
-					"current": agentCount[template],
+					"current": usage.agentCount[template],
 					"tier":    "new",
 				}, nil, "")
 			}
-			agentCount[template]++
-			if rig != "" {
-				rigCount[rig]++
-			}
-			workspaceCount++
+			usage.accept(req, limits)
 		}
 	}
 
@@ -365,3 +344,167 @@ func applyNestedCaps(cfg *config.City, requests []SessionRequest, trace *session
 	})
 	return result
 }
+
+type nestedCapLimits struct {
+	workspaceMax int
+	rigMax       map[string]int
+	agentMax     map[string]int
+	agentRig     map[string]string
+}
+
+type nestedCapUsage struct {
+	agentCount      map[string]int
+	rigCount        map[string]int
+	workspaceCount  int
+	seenSessionBead map[string]bool
+}
+
+func newNestedCapLimits(cfg *config.City) nestedCapLimits {
+	limits := nestedCapLimits{
+		workspaceMax: -1,
+		rigMax:       make(map[string]int),
+		agentMax:     make(map[string]int),
+		agentRig:     make(map[string]string),
+	}
+	if cfg.Workspace.MaxActiveSessions != nil {
+		limits.workspaceMax = *cfg.Workspace.MaxActiveSessions
+	}
+	for _, rig := range cfg.Rigs {
+		if rig.MaxActiveSessions != nil {
+			limits.rigMax[rig.Name] = *rig.MaxActiveSessions
+		} else {
+			limits.rigMax[rig.Name] = -1
+		}
+	}
+	for i := range cfg.Agents {
+		agent := &cfg.Agents[i]
+		template := agent.QualifiedName()
+		limits.agentRig[template] = agent.Dir
+		resolved := agent.ResolvedMaxActiveSessions(cfg)
+		if resolved != nil {
+			limits.agentMax[template] = *resolved
+		} else {
+			limits.agentMax[template] = -1
+		}
+	}
+	return limits
+}
+
+func newNestedCapUsage() nestedCapUsage {
+	return nestedCapUsage{
+		agentCount:      make(map[string]int),
+		rigCount:        make(map[string]int),
+		seenSessionBead: make(map[string]bool),
+	}
+}
+
+func acceptedNestedCapUsage(limits nestedCapLimits, requests []SessionRequest) nestedCapUsage {
+	usage := newNestedCapUsage()
+	sorted := append([]SessionRequest(nil), requests...)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		if sorted[i].BeadPriority != sorted[j].BeadPriority {
+			return sorted[i].BeadPriority > sorted[j].BeadPriority
+		}
+		if sorted[i].Tier != sorted[j].Tier {
+			return sorted[i].Tier == "resume"
+		}
+		return false
+	})
+	for _, req := range sorted {
+		if usage.canAccept(req, limits) {
+			usage.accept(req, limits)
+		}
+	}
+	return usage
+}
+
+func capNewDemandCount(limits nestedCapLimits, usage nestedCapUsage, agent *config.Agent, demand int) int {
+	if demand <= 0 {
+		return 0
+	}
+	template := agent.QualifiedName()
+	remaining := demand
+	if agentMax := limits.agentMax[template]; agentMax >= 0 {
+		remaining = minInt(remaining, agentMax-usage.agentCount[template])
+	}
+	if rig := limits.agentRig[template]; rig != "" {
+		rigMax, ok := limits.rigMax[rig]
+		if !ok {
+			rigMax = -1
+		}
+		if rigMax >= 0 {
+			remaining = minInt(remaining, rigMax-usage.rigCount[rig])
+		}
+	}
+	if limits.workspaceMax >= 0 {
+		remaining = minInt(remaining, limits.workspaceMax-usage.workspaceCount)
+	}
+	if remaining < 0 {
+		return 0
+	}
+	return remaining
+}
+
+func (u nestedCapUsage) canAccept(req SessionRequest, limits nestedCapLimits) bool {
+	if u.isDuplicateSessionRequest(req) {
+		return false
+	}
+	_, _, _, rejected := u.rejection(req, limits)
+	return !rejected
+}
+
+func (u nestedCapUsage) isDuplicateSessionRequest(req SessionRequest) bool {
+	return req.SessionBeadID != "" && u.seenSessionBead[req.SessionBeadID]
+}
+
+func (u nestedCapUsage) rejection(req SessionRequest, limits nestedCapLimits) (string, string, traceRecordPayload, bool) {
+	template := req.Template
+	if agentMax := limits.agentMax[template]; agentMax >= 0 && u.agentCount[template] >= agentMax {
+		return "reconciler.pool.agent_cap", "agent_cap", traceRecordPayload{
+			"agent_max": agentMax,
+			"current":   u.agentCount[template],
+			"tier":      req.Tier,
+		}, true
+	}
+	rig := limits.agentRig[template]
+	if rig != "" {
+		rigMax, ok := limits.rigMax[rig]
+		if !ok {
+			rigMax = -1
+		}
+		if rigMax >= 0 && u.rigCount[rig] >= rigMax {
+			return "reconciler.pool.rig_cap", "rig_cap", traceRecordPayload{
+				"rig":     rig,
+				"rig_max": rigMax,
+				"current": u.rigCount[rig],
+				"tier":    req.Tier,
+			}, true
+		}
+	}
+	if limits.workspaceMax >= 0 && u.workspaceCount >= limits.workspaceMax {
+		return "reconciler.pool.workspace_cap", "workspace_cap", traceRecordPayload{
+			"workspace_max": limits.workspaceMax,
+			"current":       u.workspaceCount,
+			"tier":          req.Tier,
+		}, true
+	}
+	return "", "", nil, false
+}
+
+func (u *nestedCapUsage) accept(req SessionRequest, limits nestedCapLimits) {
+	u.agentCount[req.Template]++
+	if rig := limits.agentRig[req.Template]; rig != "" {
+		u.rigCount[rig]++
+	}
+	u.workspaceCount++
+	if req.SessionBeadID != "" {
+		u.seenSessionBead[req.SessionBeadID] = true
+	}
+}
+
+func minInt(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
diff --git a/cmd/gc/pool_desired_state_test.go b/cmd/gc/pool_desired_state_test.go
index e211c6daea..930050bdf2 100644
--- a/cmd/gc/pool_desired_state_test.go
+++ b/cmd/gc/pool_desired_state_test.go
@@ -1,7 +1,9 @@
 package main
 
 import (
+	"strconv"
 	"testing"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
@@ -24,6 +26,73 @@ func sessionBead(id, status string) beads.Bead {
 	return beads.Bead{ID: id, Status: status, Type: "session"}
 }
 
+func pendingPoolSessionBead(id string) beads.Bead {
+	return poolSessionBeadWithState(id, "creating", boolMetadata(true))
+}
+
+func pendingPoolSessionBeadAt(id string, createdAt time.Time) beads.Bead {
+	session := pendingPoolSessionBead(id)
+	session.CreatedAt = createdAt
+	return session
+}
+
+func poolSessionBeadWithState(id, state, pendingCreateClaim string) beads.Bead {
+	const template = "claude"
+	return beads.Bead{
+		ID:     id,
+		Status: "open",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         PoolSessionName(template, id),
+			"state":                state,
+			"pending_create_claim": pendingCreateClaim,
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	}
+}
+
+func poolTraceDecision(t *testing.T, trace *sessionReconcilerTraceCycle, site TraceSiteCode) SessionReconcilerTraceRecord {
+	t.Helper()
+	for _, rec := range trace.records {
+		if rec.RecordType == TraceRecordDecision && rec.SiteCode == site {
+			return rec
+		}
+	}
+	t.Fatalf("missing trace decision for %s; records=%#v", site, trace.records)
+	return SessionReconcilerTraceRecord{}
+}
+
+func poolTraceFieldInt(t *testing.T, fields map[string]any, key string) int {
+	t.Helper()
+	got, ok := fields[key].(int)
+	if !ok {
+		t.Fatalf("trace field %s = %#v, want int", key, fields[key])
+	}
+	return got
+}
+
+func newPoolDesiredStateTestTrace(templates ...string) *sessionReconcilerTraceCycle {
+	detail := make(map[string]TraceSource, len(templates))
+	for _, template := range templates {
+		detail[normalizedTraceTemplate(template)] = TraceSourceManual
+	}
+	return &sessionReconcilerTraceCycle{
+		tracer:            &SessionReconcilerTracer{detail: detail},
+		dropReasons:       make(map[string]int),
+		pendingDetail:     make(map[string][]SessionReconcilerTraceRecord),
+		pendingDropped:    make(map[string]int),
+		templatesTouched:  make(map[string]struct{}),
+		detailedTemplates: make(map[string]struct{}),
+		decisionCounts:    make(map[string]int),
+		operationCounts:   make(map[string]int),
+		mutationCounts:    make(map[string]int),
+		reasonCounts:      make(map[string]int),
+		outcomeCounts:     make(map[string]int),
+	}
+}
+
 func poolAgent(name, dir string, maxSess *int, minSess int) config.Agent {
 	var minPtr *int
 	if minSess > 0 {
@@ -41,12 +110,13 @@ func TestComputePoolDesiredStates_ResumeBeatsNew(t *testing.T) {
 	cfg := &config.City{
 		Agents: []config.Agent{poolAgent("claude", "rig", intPtr(2), 0)},
 	}
-	// 1 assigned (resume) + 2 unassigned. scale_check reports 3 total demand.
+	// 1 assigned (resume) + 2 new demand. scale_check reports only the new
+	// demand, and the max cap admits one of those two new requests.
 	work := []beads.Bead{
 		workBead("w1", "rig/claude", "sess-1", "in_progress", 5),
 	}
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
-	scaleCheck := map[string]int{"rig/claude": 3}
+	scaleCheck := map[string]int{"rig/claude": 2}
 
 	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
 
@@ -54,7 +124,7 @@ func TestComputePoolDesiredStates_ResumeBeatsNew(t *testing.T) {
 		t.Fatalf("len(result) = %d, want 1", len(result))
 	}
 	reqs := result[0].Requests
-	// Max=2: resume (w1) + 1 new from scale_check deficit (3-1=2, capped at max=2).
+	// Max=2: resume (w1) + 1 new from scale_check, capped at max=2.
 	if len(reqs) != 2 {
 		t.Fatalf("len(requests) = %d, want 2 (max=2)", len(reqs))
 	}
@@ -423,6 +493,43 @@ func TestComputePoolDesiredStates_ScaleCheckRespectsCaps(t *testing.T) {
 	}
 }
 
+func TestComputePoolDesiredStates_CapsNewDemandBeforeMaterializingRequests(t *testing.T) {
+	workspaceMax := 2
+	cfg := &config.City{
+		Workspace: config.Workspace{MaxActiveSessions: &workspaceMax},
+		Agents:    []config.Agent{poolAgent("claude", "", nil, 0)},
+	}
+	work := []beads.Bead{
+		workBead("w1", "claude", "sess-1", "in_progress", 5),
+	}
+	sessions := []beads.Bead{sessionBead("sess-1", "open")}
+	trace := newPoolDesiredStateTestTrace("claude")
+
+	result := computePoolDesiredStates(cfg, work, sessions, map[string]int{"claude": 10}, trace)
+
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	if len(result[0].Requests) != 2 {
+		t.Fatalf("len(requests) = %d, want 2 (one resume plus one new demand within workspace cap)", len(result[0].Requests))
+	}
+	newCount := 0
+	for _, req := range result[0].Requests {
+		if req.Tier == "new" {
+			newCount++
+		}
+	}
+	if newCount != 1 {
+		t.Fatalf("new requests = %d, want 1", newCount)
+	}
+	capRejections := trace.decisionCounts[string(TraceSitePoolAgentCap)] +
+		trace.decisionCounts[string(TraceSitePoolRigCap)] +
+		trace.decisionCounts[string(TraceSitePoolWorkspaceCap)]
+	if capRejections != 0 {
+		t.Fatalf("cap rejections = %d, want 0; new demand should be capped before request materialization", capRejections)
+	}
+}
+
 func TestComputePoolDesiredStates_OpenAssignedWorkResumes(t *testing.T) {
 	cfg := &config.City{
 		Agents: []config.Agent{poolAgent("claude", "", intPtr(5), 0)},
@@ -487,7 +594,7 @@ func TestComputePoolDesiredStates_NoDemandNoAssignment(t *testing.T) {
 	}
 }
 
-// Regression: scale_check=3 with 1 assigned → poolDesired=3 (1 resume + 2 new).
+// Regression: scale_check reports new demand, not total desired sessions.
 func TestComputePoolDesiredStates_ScaleCheckAndResumeAddUp(t *testing.T) {
 	cfg := &config.City{
 		Agents: []config.Agent{poolAgent("claude", "", intPtr(5), 0)},
@@ -496,7 +603,7 @@ func TestComputePoolDesiredStates_ScaleCheckAndResumeAddUp(t *testing.T) {
 		workBead("w1", "claude", "sess-1", "in_progress", 5),
 	}
 	sessions := []beads.Bead{sessionBead("sess-1", "open")}
-	scaleCheck := map[string]int{"claude": 3}
+	scaleCheck := map[string]int{"claude": 2}
 
 	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
 
@@ -504,7 +611,7 @@ func TestComputePoolDesiredStates_ScaleCheckAndResumeAddUp(t *testing.T) {
 		t.Fatalf("len(result) = %d, want 1", len(result))
 	}
 	if len(result[0].Requests) != 3 {
-		t.Fatalf("len(requests) = %d, want 3 (1 resume + 2 new from scale_check deficit)", len(result[0].Requests))
+		t.Fatalf("len(requests) = %d, want 3 (1 resume + 2 new from scale_check)", len(result[0].Requests))
 	}
 	resumeCount := 0
 	newCount := 0
@@ -521,6 +628,354 @@ func TestComputePoolDesiredStates_ScaleCheckAndResumeAddUp(t *testing.T) {
 	}
 }
 
+func TestComputePoolDesiredStates_AssignedSessionsDoNotConsumeNewDemand(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(20), 0)},
+	}
+	var work []beads.Bead
+	var sessions []beads.Bead
+	for i := 1; i <= 5; i++ {
+		suffix := strconv.Itoa(i)
+		sessionID := "sess-" + suffix
+		work = append(work, workBead("w"+suffix, "claude", sessionID, "in_progress", 0))
+		sessions = append(sessions, sessionBead(sessionID, "open"))
+	}
+
+	result := ComputePoolDesiredStates(cfg, work, sessions, map[string]int{"claude": 5})
+
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	if got := len(result[0].Requests); got != 10 {
+		t.Fatalf("len(requests) = %d, want 10 (5 assigned resume + 5 new ready)", got)
+	}
+	resumeCount := 0
+	newCount := 0
+	for _, request := range result[0].Requests {
+		switch request.Tier {
+		case "resume":
+			resumeCount++
+		case "new":
+			newCount++
+		}
+	}
+	if resumeCount != 5 || newCount != 5 {
+		t.Fatalf("request tiers = resume:%d new:%d, want resume:5 new:5", resumeCount, newCount)
+	}
+}
+
+// Regression: scale_check counts unassigned ready work, which remains
+// unassigned while just-created sessions are still starting. Those in-flight
+// sessions must consume new demand or every reconciler tick can create another
+// session for the same ready bead.
+func TestComputePoolDesiredStates_InFlightNewSessionsConsumeScaleDemand(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	sessions := []beads.Bead{
+		pendingPoolSessionBead("sess-1"),
+		pendingPoolSessionBead("sess-2"),
+		pendingPoolSessionBead("sess-3"),
+	}
+	scaleCheck := map[string]int{"claude": 3}
+
+	result := ComputePoolDesiredStates(cfg, nil, sessions, scaleCheck)
+
+	counts := PoolDesiredCounts(result)
+	if counts["claude"] != 3 {
+		t.Fatalf("poolDesired[claude] = %d, want 3 in-flight sessions preserving total demand", counts["claude"])
+	}
+	seen := make(map[string]bool)
+	for _, req := range result[0].Requests {
+		if req.Tier != "new" {
+			t.Fatalf("tier = %q, want new", req.Tier)
+		}
+		if req.SessionBeadID == "" {
+			t.Fatalf("in-flight session should be represented as an explicit desired request: %+v", req)
+		}
+		seen[req.SessionBeadID] = true
+	}
+	for _, id := range []string{"sess-1", "sess-2", "sess-3"} {
+		if !seen[id] {
+			t.Fatalf("missing in-flight request for %s; saw %#v", id, seen)
+		}
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightNewSessionsDoNotCreateZeroDemand(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	sessions := []beads.Bead{
+		pendingPoolSessionBead("sess-1"),
+	}
+	scaleCheck := map[string]int{"claude": 0}
+
+	result := ComputePoolDesiredStates(cfg, nil, sessions, scaleCheck)
+
+	counts := PoolDesiredCounts(result)
+	if counts["claude"] != 0 {
+		t.Fatalf("poolDesired[claude] = %d, want 0 when scale_check reports no new demand", counts["claude"])
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightNewSessionsOnlySubtractCoveredDemand(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	sessions := []beads.Bead{
+		pendingPoolSessionBead("sess-1"),
+		pendingPoolSessionBead("sess-2"),
+	}
+	scaleCheck := map[string]int{"claude": 5}
+
+	result := ComputePoolDesiredStates(cfg, nil, sessions, scaleCheck)
+
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	reqs := result[0].Requests
+	if len(reqs) != 5 {
+		t.Fatalf("len(requests) = %d, want 5 total desired sessions", len(reqs))
+	}
+	explicit := make(map[string]bool)
+	anonymous := 0
+	for _, req := range reqs {
+		if req.Tier != "new" {
+			t.Fatalf("tier = %q, want new", req.Tier)
+		}
+		if req.SessionBeadID == "" {
+			anonymous++
+			continue
+		}
+		explicit[req.SessionBeadID] = true
+	}
+	if anonymous != 3 {
+		t.Fatalf("anonymous new requests = %d, want 3 after two in-flight sessions consume demand", anonymous)
+	}
+	for _, id := range []string{"sess-1", "sess-2"} {
+		if !explicit[id] {
+			t.Fatalf("missing explicit in-flight request for %s; saw %#v", id, explicit)
+		}
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightResumeBeadsDoNotConsumeNewDemand(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	work := []beads.Bead{
+		workBead("w1", "claude", "sess-1", "in_progress", 5),
+	}
+	sessions := []beads.Bead{
+		pendingPoolSessionBead("sess-1"),
+		pendingPoolSessionBead("sess-2"),
+	}
+	scaleCheck := map[string]int{"claude": 3}
+
+	result := ComputePoolDesiredStates(cfg, work, sessions, scaleCheck)
+
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	reqs := result[0].Requests
+	if len(reqs) != 4 {
+		t.Fatalf("len(requests) = %d, want 4 (one resume plus three new-demand slots)", len(reqs))
+	}
+	resume := 0
+	explicitNew := 0
+	anonymousNew := 0
+	for _, req := range reqs {
+		switch {
+		case req.Tier == "resume":
+			resume++
+			if req.SessionBeadID != "sess-1" {
+				t.Fatalf("resume SessionBeadID = %q, want sess-1", req.SessionBeadID)
+			}
+		case req.Tier == "new" && req.SessionBeadID == "sess-2":
+			explicitNew++
+		case req.Tier == "new" && req.SessionBeadID == "":
+			anonymousNew++
+		default:
+			t.Fatalf("unexpected request: %+v", req)
+		}
+	}
+	if resume != 1 || explicitNew != 1 || anonymousNew != 2 {
+		t.Fatalf("resume=%d explicitNew=%d anonymousNew=%d, want 1/1/2", resume, explicitNew, anonymousNew)
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightPredicateBranches(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	tests := []struct {
+		name    string
+		session beads.Bead
+	}{
+		{
+			name:    "pending create claim",
+			session: poolSessionBeadWithState("sess-pending", "active", boolMetadata(true)),
+		},
+		{
+			name:    "creating state",
+			session: poolSessionBeadWithState("sess-creating", "creating", ""),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := ComputePoolDesiredStates(cfg, nil, []beads.Bead{tt.session}, map[string]int{"claude": 1})
+
+			if len(result) != 1 || len(result[0].Requests) != 1 {
+				t.Fatalf("result = %#v, want one in-flight request", result)
+			}
+			if got := result[0].Requests[0].SessionBeadID; got != tt.session.ID {
+				t.Fatalf("SessionBeadID = %q, want %q", got, tt.session.ID)
+			}
+		})
+	}
+}
+
+func TestComputePoolDesiredStates_StaleCreatingBeadStillConsumesNewDemand(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	stale := poolSessionBeadWithState("sess-stale", "creating", "")
+	stale.CreatedAt = time.Date(2026, 5, 4, 12, 0, 0, 0, time.UTC).Add(-2 * staleCreatingStateTimeout)
+
+	result := ComputePoolDesiredStates(cfg, nil, []beads.Bead{stale}, map[string]int{"claude": 1})
+
+	if len(result) != 1 || len(result[0].Requests) != 1 {
+		t.Fatalf("result = %#v, want one stale creating request preserving already-spent demand", result)
+	}
+	if got := result[0].Requests[0].SessionBeadID; got != stale.ID {
+		t.Fatalf("SessionBeadID = %q, want %q", got, stale.ID)
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightSelectionRespectsCapsInStableOrder(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(2), 0)},
+	}
+	base := time.Date(2026, 5, 4, 12, 0, 0, 0, time.UTC)
+	sessions := []beads.Bead{
+		pendingPoolSessionBeadAt("sess-newest", base.Add(4*time.Minute)),
+		pendingPoolSessionBeadAt("sess-oldest", base.Add(time.Minute)),
+		pendingPoolSessionBeadAt("sess-tie-b", base.Add(2*time.Minute)),
+		pendingPoolSessionBeadAt("sess-tie-a", base.Add(2*time.Minute)),
+	}
+
+	result := ComputePoolDesiredStates(cfg, nil, sessions, map[string]int{"claude": 10})
+
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	reqs := result[0].Requests
+	if len(reqs) != 2 {
+		t.Fatalf("len(requests) = %d, want 2 after agent cap", len(reqs))
+	}
+	wantIDs := []string{"sess-oldest", "sess-tie-a"}
+	for i, want := range wantIDs {
+		if got := reqs[i].SessionBeadID; got != want {
+			t.Fatalf("request[%d].SessionBeadID = %q, want %q; requests=%#v", i, got, want, reqs)
+		}
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightDemandRecordsTrace(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	sessions := []beads.Bead{
+		pendingPoolSessionBead("sess-1"),
+		pendingPoolSessionBead("sess-2"),
+	}
+	trace := newPoolDesiredStateTestTrace("claude")
+
+	result := computePoolDesiredStates(cfg, nil, sessions, map[string]int{"claude": 5}, trace)
+
+	if len(result) != 1 || len(result[0].Requests) != 5 {
+		t.Fatalf("result = %#v, want five desired requests", result)
+	}
+	if got := trace.decisionCounts[string(TraceSitePoolInFlightReuse)]; got != 1 {
+		t.Fatalf("in-flight trace decisions = %d, want 1", got)
+	}
+	rec := poolTraceDecision(t, trace, TraceSitePoolInFlightReuse)
+	for key, want := range map[string]int{
+		"scale_check":   5,
+		"in_flight":     2,
+		"reused":        2,
+		"anonymous_new": 3,
+	} {
+		if got := poolTraceFieldInt(t, rec.Fields, key); got != want {
+			t.Fatalf("%s = %d, want %d", key, got, want)
+		}
+	}
+}
+
+func TestComputePoolDesiredStates_InFlightDemandRecordsTraceWhenCapsSuppressReuse(t *testing.T) {
+	workspaceMax := 0
+	cfg := &config.City{
+		Workspace: config.Workspace{MaxActiveSessions: &workspaceMax},
+		Agents:    []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	sessions := []beads.Bead{
+		pendingPoolSessionBead("sess-1"),
+		pendingPoolSessionBead("sess-2"),
+	}
+	trace := newPoolDesiredStateTestTrace("claude")
+
+	result := computePoolDesiredStates(cfg, nil, sessions, map[string]int{"claude": 5}, trace)
+
+	if len(result) != 0 {
+		t.Fatalf("result = %#v, want no desired requests when workspace cap is exhausted", result)
+	}
+	if got := trace.decisionCounts[string(TraceSitePoolInFlightReuse)]; got != 1 {
+		t.Fatalf("in-flight trace decisions = %d, want 1", got)
+	}
+	rec := poolTraceDecision(t, trace, TraceSitePoolInFlightReuse)
+	for key, want := range map[string]int{
+		"scale_check":   5,
+		"in_flight":     2,
+		"reused":        0,
+		"anonymous_new": 0,
+	} {
+		if got := poolTraceFieldInt(t, rec.Fields, key); got != want {
+			t.Fatalf("%s = %d, want %d", key, got, want)
+		}
+	}
+}
+
+func TestApplyNestedCaps_DedupsConcreteSessionRequestsAcrossTiers(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{poolAgent("claude", "", intPtr(10), 0)},
+	}
+	requests := []SessionRequest{
+		{Template: "claude", Tier: "resume", SessionBeadID: "sess-1", BeadPriority: 10},
+		{Template: "claude", Tier: "new", SessionBeadID: "sess-1"},
+		{Template: "claude", Tier: "new", SessionBeadID: "sess-2"},
+	}
+
+	result := applyNestedCaps(cfg, requests, nil)
+
+	if len(result) != 1 {
+		t.Fatalf("len(result) = %d, want 1", len(result))
+	}
+	reqs := result[0].Requests
+	if len(reqs) != 2 {
+		t.Fatalf("len(requests) = %d, want duplicate concrete session suppressed; requests=%#v", len(reqs), reqs)
+	}
+	seenSess1 := 0
+	for _, req := range reqs {
+		if req.SessionBeadID == "sess-1" {
+			seenSess1++
+		}
+	}
+	if seenSess1 != 1 {
+		t.Fatalf("sess-1 accepted %d times, want once; requests=%#v", seenSess1, reqs)
+	}
+}
+
 // Regression: poolDesired must be per-rig scoped. City-scoped agent sees
 // only city work beads, rig-scoped agent sees only its rig's work beads.
 func TestComputePoolDesiredStates_PerRigScoping(t *testing.T) {
diff --git a/cmd/gc/pool_session_name.go b/cmd/gc/pool_session_name.go
index 07754b5602..e36e849b9f 100644
--- a/cmd/gc/pool_session_name.go
+++ b/cmd/gc/pool_session_name.go
@@ -45,15 +45,38 @@ func GCSweepSessionBeads(store beads.Store, rigStores map[string]beads.Store, se
 	return closed
 }
 
+// releaseOrphanedPoolAssignmentsWhenSnapshotsComplete skips orphan release
+// unless both the assigned-work and open-session snapshots are complete.
+func releaseOrphanedPoolAssignmentsWhenSnapshotsComplete(
+	store beads.Store,
+	cfg *config.City,
+	cityPath string,
+	openSessionBeads []beads.Bead,
+	result DesiredStateResult,
+	rigStores map[string]beads.Store,
+) []releasedPoolAssignment {
+	// Partial input snapshots can make active work look orphaned for this
+	// tick only: missing work affects drain decisions, and missing sessions
+	// affects assigned-work orphan release.
+	if result.snapshotQueryPartial() {
+		return nil
+	}
+	return releaseOrphanedPoolAssignments(store, cfg, cityPath, openSessionBeads, result.AssignedWorkBeads, result.AssignedWorkStores, result.AssignedWorkStoreRefs, rigStores)
+}
+
 // releaseOrphanedPoolAssignments reopens active pool-routed work whose
-// assignee no longer maps to any open session bead. This recovers attempts
-// that were left in_progress after a pooled worker exited or was swept.
+// assignee no longer maps to any open session bead. This also recovers
+// pool-routed work left in_progress with no assignee, which cannot be claimed
+// again until it is moved back to open.
 func releaseOrphanedPoolAssignments(
 	store beads.Store,
 	cfg *config.City,
+	cityPath string,
 	openSessionBeads []beads.Bead,
 	assignedWorkBeads []beads.Bead,
 	assignedWorkStores []beads.Store,
+	assignedWorkStoreRefs []string,
+	rigStores map[string]beads.Store,
 ) []releasedPoolAssignment {
 	if store == nil || cfg == nil || len(assignedWorkBeads) == 0 {
 		return nil
@@ -62,20 +85,25 @@ func releaseOrphanedPoolAssignments(
 	if storeAware && len(assignedWorkStores) != len(assignedWorkBeads) {
 		log.Printf("releaseOrphanedPoolAssignments: assigned work/store length mismatch: work=%d stores=%d", len(assignedWorkBeads), len(assignedWorkStores))
 	}
+	storeRefAware := len(assignedWorkStoreRefs) == len(assignedWorkBeads)
+	if len(assignedWorkStoreRefs) > 0 && !storeRefAware {
+		log.Printf("releaseOrphanedPoolAssignments: assigned work/store-ref length mismatch: work=%d storeRefs=%d", len(assignedWorkBeads), len(assignedWorkStoreRefs))
+	}
 
-	openIdentifiers := make(map[string]struct{}, len(openSessionBeads)*3)
+	openIdentifiers := makeOpenSessionStoreRefIndex(cityPath, cfg, openSessionBeads, storeRefAware)
+	legacyOpenIdentifiers := make(map[string]struct{}, len(openSessionBeads)*3)
 	for _, sb := range openSessionBeads {
 		if sb.Status == "closed" {
 			continue
 		}
 		if id := strings.TrimSpace(sb.ID); id != "" {
-			openIdentifiers[id] = struct{}{}
+			legacyOpenIdentifiers[id] = struct{}{}
 		}
 		if sn := strings.TrimSpace(sb.Metadata["session_name"]); sn != "" {
-			openIdentifiers[sn] = struct{}{}
+			legacyOpenIdentifiers[sn] = struct{}{}
 		}
 		if ni := strings.TrimSpace(sb.Metadata["configured_named_identity"]); ni != "" {
-			openIdentifiers[ni] = struct{}{}
+			legacyOpenIdentifiers[ni] = struct{}{}
 		}
 	}
 
@@ -85,12 +113,6 @@ func releaseOrphanedPoolAssignments(
 			continue
 		}
 		assignee := strings.TrimSpace(wb.Assignee)
-		if assignee == "" {
-			continue
-		}
-		if _, ok := openIdentifiers[assignee]; ok {
-			continue
-		}
 		template := strings.TrimSpace(wb.Metadata["gc.routed_to"])
 		if template == "" {
 			continue
@@ -99,17 +121,35 @@ func releaseOrphanedPoolAssignments(
 		if agentCfg == nil || !agentCfg.SupportsGenericEphemeralSessions() {
 			continue
 		}
-		if assigneePreservesNamedSessionRoute(cfg, template, assignee) {
-			continue
+		if assignee == "" {
+			if wb.Status != "in_progress" {
+				continue
+			}
+		} else {
+			workStoreRef := ""
+			if storeRefAware {
+				workStoreRef = assignedWorkStoreRefs[i]
+			}
+			if openSessionOwnsWork(legacyOpenIdentifiers, openIdentifiers, assignee, workStoreRef, storeRefAware) {
+				continue
+			}
+			if assigneePreservesNamedSessionRoute(cfg, cityPath, template, assignee, workStoreRef, storeRefAware) {
+				continue
+			}
 		}
 
-		ownerStore := store
+		var ownerStore beads.Store
 		if storeAware {
 			if i >= len(assignedWorkStores) || assignedWorkStores[i] == nil {
 				log.Printf("releaseOrphanedPoolAssignments: missing owner store for assigned work %q at index %d", wb.ID, i)
 				continue
 			}
 			ownerStore = assignedWorkStores[i]
+		} else {
+			ownerStore = storeForPoolAssignment(cfg, store, rigStores, wb)
+			if ownerStore == nil {
+				continue
+			}
 		}
 		if !releaseOrphanedPoolAssignment(ownerStore, wb.ID) {
 			continue
@@ -119,6 +159,99 @@ func releaseOrphanedPoolAssignments(
 	return released
 }
 
+const unresolvedOpenSessionStoreRef = "\x00unresolved"
+
+func makeOpenSessionStoreRefIndex(cityPath string, cfg *config.City, openSessionBeads []beads.Bead, storeRefAware bool) map[string]map[string]struct{} {
+	index := make(map[string]map[string]struct{}, len(openSessionBeads)*3)
+	if !storeRefAware {
+		return index
+	}
+	for _, sb := range openSessionBeads {
+		if sb.Status == "closed" {
+			continue
+		}
+		storeRef, ok := assignedWorkStoreRefForSession(cityPath, cfg, sb)
+		if !ok {
+			storeRef = unresolvedOpenSessionStoreRef
+		}
+		addOpenSessionStoreRef(index, sb.ID, storeRef)
+		addOpenSessionStoreRef(index, sb.Metadata["session_name"], storeRef)
+		addOpenSessionStoreRef(index, sb.Metadata["configured_named_identity"], storeRef)
+	}
+	return index
+}
+
+func addOpenSessionStoreRef(index map[string]map[string]struct{}, identifier, storeRef string) {
+	identifier = strings.TrimSpace(identifier)
+	if identifier == "" {
+		return
+	}
+	refs := index[identifier]
+	if refs == nil {
+		refs = make(map[string]struct{}, 1)
+		index[identifier] = refs
+	}
+	refs[storeRef] = struct{}{}
+}
+
+func openSessionOwnsWork(legacyIdentifiers map[string]struct{}, scopedIdentifiers map[string]map[string]struct{}, assignee, workStoreRef string, storeRefAware bool) bool {
+	if !storeRefAware {
+		_, ok := legacyIdentifiers[assignee]
+		return ok
+	}
+	refs := scopedIdentifiers[assignee]
+	if refs == nil {
+		return false
+	}
+	if _, ok := refs[unresolvedOpenSessionStoreRef]; ok {
+		return true
+	}
+	_, ok := refs[workStoreRef]
+	return ok
+}
+
+func storeForPoolAssignment(cfg *config.City, cityStore beads.Store, rigStores map[string]beads.Store, wb beads.Bead) beads.Store {
+	if cfg == nil || len(rigStores) == 0 {
+		return cityStore
+	}
+	if routed := strings.TrimSpace(wb.Metadata["gc.routed_to"]); routed != "" {
+		if slash := strings.IndexByte(routed, '/'); slash > 0 {
+			if store := rigStores[routed[:slash]]; store != nil {
+				return store
+			}
+		}
+	}
+	idPrefix := beadIDPrefix(wb.ID)
+	for _, rig := range cfg.Rigs {
+		if idPrefix == rig.EffectivePrefix() {
+			if store := rigStores[rig.Name]; store != nil {
+				return store
+			}
+		}
+	}
+	return cityStore
+}
+
+func isRecoverableUnassignedInProgressPoolWork(cfg *config.City, wb beads.Bead) bool {
+	if wb.Status != "in_progress" || strings.TrimSpace(wb.Assignee) != "" {
+		return false
+	}
+	template := strings.TrimSpace(wb.Metadata["gc.routed_to"])
+	if template == "" {
+		return false
+	}
+	agentCfg := findAgentByTemplate(cfg, template)
+	return agentCfg != nil && agentCfg.SupportsGenericEphemeralSessions()
+}
+
+func beadIDPrefix(id string) string {
+	trimmed := strings.TrimSpace(id)
+	if dash := strings.IndexByte(trimmed, '-'); dash > 0 {
+		return trimmed[:dash]
+	}
+	return ""
+}
+
 func releaseOrphanedPoolAssignment(store beads.Store, id string) bool {
 	if store == nil || id == "" {
 		return false
@@ -130,7 +263,7 @@ func releaseOrphanedPoolAssignment(store beads.Store, id string) bool {
 	return store.Update(id, opts) == nil
 }
 
-func assigneePreservesNamedSessionRoute(cfg *config.City, template, assignee string) bool {
+func assigneePreservesNamedSessionRoute(cfg *config.City, cityPath, template, assignee, workStoreRef string, storeRefAware bool) bool {
 	if cfg == nil {
 		return false
 	}
@@ -138,7 +271,13 @@ func assigneePreservesNamedSessionRoute(cfg *config.City, template, assignee str
 	if !ok {
 		return false
 	}
-	return namedSessionBackingTemplate(spec) == template
+	if namedSessionBackingTemplate(spec) != template {
+		return false
+	}
+	if !storeRefAware {
+		return true
+	}
+	return assignedWorkStoreRefForAgent(cityPath, cfg, spec.Agent) == workStoreRef
 }
 
 func stringPtr(s string) *string { return &s }
diff --git a/cmd/gc/pool_session_name_test.go b/cmd/gc/pool_session_name_test.go
index f73bd610bd..db60cd4760 100644
--- a/cmd/gc/pool_session_name_test.go
+++ b/cmd/gc/pool_session_name_test.go
@@ -162,9 +162,58 @@ func TestReleaseOrphanedPoolAssignments_ReopensMissingPoolAssignee(t *testing.T)
 	released := releaseOrphanedPoolAssignments(
 		store,
 		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		"",
 		nil,
 		[]beads.Bead{work},
 		nil,
+		nil,
+		nil,
+	)
+	if len(released) != 1 || released[0].ID != work.ID {
+		t.Fatalf("released = %v, want [%s]", released, work.ID)
+	}
+
+	got, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get work bead: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("status = %q, want open", got.Status)
+	}
+	if got.Assignee != "" {
+		t.Fatalf("assignee = %q, want empty", got.Assignee)
+	}
+}
+
+func TestReleaseOrphanedPoolAssignments_ReopensUnassignedInProgressPoolWork(t *testing.T) {
+	store := beads.NewMemStore()
+	work, err := store.Create(beads.Bead{
+		Title:    "stranded pool work",
+		Metadata: map[string]string{"gc.routed_to": "worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set work status: %v", err)
+	}
+	work, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Reload work bead: %v", err)
+	}
+	if work.Assignee != "" {
+		t.Fatalf("test setup assignee = %q, want empty", work.Assignee)
+	}
+
+	released := releaseOrphanedPoolAssignments(
+		store,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		"",
+		nil,
+		[]beads.Bead{work},
+		nil,
+		nil,
+		nil,
 	)
 	if len(released) != 1 || released[0].ID != work.ID {
 		t.Fatalf("released = %v, want [%s]", released, work.ID)
@@ -182,6 +231,88 @@ func TestReleaseOrphanedPoolAssignments_ReopensMissingPoolAssignee(t *testing.T)
 	}
 }
 
+func TestCollectAssignedWorkBeadsIncludesUnassignedInProgressPoolWorkForRecovery(t *testing.T) {
+	store := beads.NewMemStore()
+	work, err := store.Create(beads.Bead{
+		Title:    "stranded pool work",
+		Metadata: map[string]string{"gc.routed_to": "worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set work status: %v", err)
+	}
+
+	found, stores, _, partial := collectAssignedWorkBeadsWithStores(
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		store,
+		nil,
+		nil,
+		nil,
+	)
+	if partial {
+		t.Fatal("collectAssignedWorkBeadsWithStores reported partial results")
+	}
+	if len(found) != 1 || found[0].ID != work.ID {
+		t.Fatalf("found = %#v, want stranded work %s", found, work.ID)
+	}
+	if len(stores) != 1 || stores[0] != store {
+		t.Fatalf("stores = %#v, want owner store", stores)
+	}
+}
+
+func TestReleaseOrphanedPoolAssignments_UpdatesRigStoreFallback(t *testing.T) {
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	work, err := rigStore.Create(beads.Bead{
+		Title:    "orphaned rig pool work",
+		Assignee: "worker-dead",
+		Metadata: map[string]string{"gc.routed_to": "rig/worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	if err := rigStore.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set work status: %v", err)
+	}
+	work, err = rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Reload work bead: %v", err)
+	}
+
+	released := releaseOrphanedPoolAssignments(
+		cityStore,
+		&config.City{
+			Rigs:   []config.Rig{{Name: "rig", Prefix: "ga"}},
+			Agents: []config.Agent{{Name: "worker", Dir: "rig", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}},
+		},
+		"",
+		nil,
+		[]beads.Bead{work},
+		nil,
+		nil,
+		map[string]beads.Store{"rig": rigStore},
+	)
+	if len(released) != 1 || released[0].ID != work.ID {
+		t.Fatalf("released = %v, want [%s]", released, work.ID)
+	}
+
+	got, err := rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get rig work bead: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("rig status = %q, want open", got.Status)
+	}
+	if got.Assignee != "" {
+		t.Fatalf("rig assignee = %q, want empty", got.Assignee)
+	}
+	if _, err := cityStore.Get(work.ID); err == nil {
+		t.Fatalf("city store unexpectedly contains rig work bead %s", work.ID)
+	}
+}
+
 func TestReleaseOrphanedPoolAssignments_ReopensRigStoreMissingPoolAssignee(t *testing.T) {
 	cityStore := beads.NewMemStore()
 	rigStore := beads.NewMemStore()
@@ -224,9 +355,12 @@ func TestReleaseOrphanedPoolAssignments_ReopensRigStoreMissingPoolAssignee(t *te
 			Rigs:   []config.Rig{{Name: "repo"}},
 			Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}},
 		},
+		"",
 		nil,
 		[]beads.Bead{work},
 		[]beads.Store{rigStore},
+		nil,
+		nil,
 	)
 	if len(released) != 1 || released[0].ID != work.ID {
 		t.Fatalf("released = %v, want [%s]", released, work.ID)
@@ -302,9 +436,12 @@ func TestReleaseOrphanedPoolAssignments_ReopensCrossStoreIDCollisions(t *testing
 			Rigs:   []config.Rig{{Name: "repo"}},
 			Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}},
 		},
+		"",
 		nil,
 		[]beads.Bead{cityWork, rigWork},
 		[]beads.Store{cityStore, rigStore},
+		nil,
+		nil,
 	)
 	if len(released) != 2 || released[0].ID != cityWork.ID || released[1].ID != rigWork.ID {
 		t.Fatalf("released = %v, want [%s %s]", released, cityWork.ID, rigWork.ID)
@@ -347,9 +484,12 @@ func TestReleaseOrphanedPoolAssignments_SkipsStoreAwareEntryWithoutOwnerStore(t
 	released := releaseOrphanedPoolAssignments(
 		cityStore,
 		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		"",
 		nil,
 		[]beads.Bead{work},
 		[]beads.Store{nil},
+		nil,
+		nil,
 	)
 	if len(released) != 0 {
 		t.Fatalf("released = %v, want none without owner store", released)
@@ -398,8 +538,140 @@ func TestReleaseOrphanedPoolAssignments_KeepsOpenSessionOwnership(t *testing.T)
 	released := releaseOrphanedPoolAssignments(
 		store,
 		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		"",
+		[]beads.Bead{session},
+		[]beads.Bead{work},
+		nil,
+		nil,
+		nil,
+	)
+	if len(released) != 0 {
+		t.Fatalf("released = %v, want none", released)
+	}
+
+	got, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get work bead: %v", err)
+	}
+	if got.Status != "in_progress" {
+		t.Fatalf("status = %q, want in_progress", got.Status)
+	}
+	if got.Assignee != "worker-live" {
+		t.Fatalf("assignee = %q, want worker-live", got.Assignee)
+	}
+}
+
+func TestReleaseOrphanedPoolAssignments_ReleasesRigWorkAssignedToUnreachableOpenSession(t *testing.T) {
+	cityPath := t.TempDir()
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	session, err := cityStore.Create(beads.Bead{
+		Title:  "city worker",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name":         "worker-live",
+			"template":             "worker",
+			"agent_name":           "worker",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create city session bead: %v", err)
+	}
+	work, err := rigStore.Create(beads.Bead{
+		Title:    "misassigned rig pool work",
+		Assignee: "worker-live",
+		Metadata: map[string]string{"gc.routed_to": "repo/worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create rig work bead: %v", err)
+	}
+	if err := rigStore.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set rig work status: %v", err)
+	}
+	work, err = rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Reload rig work bead: %v", err)
+	}
+
+	released := releaseOrphanedPoolAssignments(
+		cityStore,
+		&config.City{
+			Rigs: []config.Rig{{Name: "repo", Path: t.TempDir()}},
+			Agents: []config.Agent{
+				{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)},
+				{Name: "worker", Dir: "repo", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)},
+			},
+		},
+		cityPath,
+		[]beads.Bead{session},
+		[]beads.Bead{work},
+		[]beads.Store{rigStore},
+		[]string{"repo"},
+		map[string]beads.Store{"repo": rigStore},
+	)
+	if len(released) != 1 || released[0].ID != work.ID {
+		t.Fatalf("released = %v, want [%s]", released, work.ID)
+	}
+
+	got, err := rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get rig work bead: %v", err)
+	}
+	if got.Status != "open" || got.Assignee != "" {
+		t.Fatalf("rig work = status %q assignee %q, want open/unassigned", got.Status, got.Assignee)
+	}
+	gotSession, err := cityStore.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get city session bead: %v", err)
+	}
+	if gotSession.Status != "open" || gotSession.Metadata["session_name"] != "worker-live" {
+		t.Fatalf("city session changed: status=%q metadata=%#v", gotSession.Status, gotSession.Metadata)
+	}
+}
+
+func TestReleaseOrphanedPoolAssignments_KeepsSameStoreScopedOpenSessionOwnership(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name":         "worker-live",
+			"template":             "worker",
+			"agent_name":           "worker",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session bead: %v", err)
+	}
+	work, err := store.Create(beads.Bead{
+		Title:    "live pool work",
+		Assignee: "worker-live",
+		Metadata: map[string]string{"gc.routed_to": "worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set work status: %v", err)
+	}
+	work, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Reload work bead: %v", err)
+	}
+
+	released := releaseOrphanedPoolAssignments(
+		store,
+		&config.City{Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}}},
+		cityPath,
 		[]beads.Bead{session},
 		[]beads.Bead{work},
+		[]beads.Store{store},
+		[]string{""},
 		nil,
 	)
 	if len(released) != 0 {
@@ -446,7 +718,7 @@ func TestReleaseOrphanedPoolAssignments_ReopensStaleDirectAssigneeForNamedBacked
 		ResolvedWorkspaceName: "test-city",
 	}
 
-	released := releaseOrphanedPoolAssignments(store, cfg, nil, []beads.Bead{work}, nil)
+	released := releaseOrphanedPoolAssignments(store, cfg, "", nil, []beads.Bead{work}, nil, nil, nil)
 	if len(released) != 1 || released[0].ID != work.ID {
 		t.Fatalf("released = %v, want [%s]", released, work.ID)
 	}
@@ -491,7 +763,116 @@ func TestReleaseOrphanedPoolAssignments_PreservesCanonicalNamedIdentity(t *testi
 		ResolvedWorkspaceName: "test-city",
 	}
 
-	released := releaseOrphanedPoolAssignments(store, cfg, nil, []beads.Bead{work}, nil)
+	released := releaseOrphanedPoolAssignments(store, cfg, "", nil, []beads.Bead{work}, nil, nil, nil)
+	if len(released) != 0 {
+		t.Fatalf("released = %v, want none", released)
+	}
+
+	got, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get work bead: %v", err)
+	}
+	if got.Status != "in_progress" {
+		t.Fatalf("status = %q, want in_progress", got.Status)
+	}
+	if got.Assignee != "reviewer" {
+		t.Fatalf("assignee = %q, want reviewer", got.Assignee)
+	}
+}
+
+func TestReleaseOrphanedPoolAssignments_ReleasesNamedIdentityForUnreachableStore(t *testing.T) {
+	cityPath := t.TempDir()
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	work, err := rigStore.Create(beads.Bead{
+		Title:    "misassigned named work",
+		Assignee: "reviewer",
+		Metadata: map[string]string{"gc.routed_to": "worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create rig work bead: %v", err)
+	}
+	if err := rigStore.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set rig work status: %v", err)
+	}
+	work, err = rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Reload rig work bead: %v", err)
+	}
+
+	cfg := &config.City{
+		Rigs:   []config.Rig{{Name: "repo", Path: t.TempDir()}},
+		Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "reviewer",
+			Template: "worker",
+			Mode:     "on_demand",
+		}},
+		ResolvedWorkspaceName: "test-city",
+	}
+
+	released := releaseOrphanedPoolAssignments(
+		cityStore,
+		cfg,
+		cityPath,
+		nil,
+		[]beads.Bead{work},
+		[]beads.Store{rigStore},
+		[]string{"repo"},
+		map[string]beads.Store{"repo": rigStore},
+	)
+	if len(released) != 1 || released[0].ID != work.ID {
+		t.Fatalf("released = %v, want [%s]", released, work.ID)
+	}
+
+	got, err := rigStore.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Get rig work bead: %v", err)
+	}
+	if got.Status != "open" || got.Assignee != "" {
+		t.Fatalf("rig work = status %q assignee %q, want open/unassigned", got.Status, got.Assignee)
+	}
+}
+
+func TestReleaseOrphanedPoolAssignments_PreservesNamedIdentityForSameStore(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	work, err := store.Create(beads.Bead{
+		Title:    "named owner work",
+		Assignee: "reviewer",
+		Metadata: map[string]string{"gc.routed_to": "worker"},
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: stringPtr("in_progress")}); err != nil {
+		t.Fatalf("Set work status: %v", err)
+	}
+	work, err = store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("Reload work bead: %v", err)
+	}
+
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker", MinActiveSessions: intPtr(0), MaxActiveSessions: intPtr(2)}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "reviewer",
+			Template: "worker",
+			Mode:     "on_demand",
+		}},
+		ResolvedWorkspaceName: "test-city",
+	}
+
+	released := releaseOrphanedPoolAssignments(
+		store,
+		cfg,
+		cityPath,
+		nil,
+		[]beads.Bead{work},
+		[]beads.Store{store},
+		[]string{""},
+		nil,
+	)
 	if len(released) != 0 {
 		t.Fatalf("released = %v, want none", released)
 	}
diff --git a/cmd/gc/pool_test.go b/cmd/gc/pool_test.go
index b5e8ffa3af..9e0239d802 100644
--- a/cmd/gc/pool_test.go
+++ b/cmd/gc/pool_test.go
@@ -144,7 +144,7 @@ func TestEvaluatePoolDefaultScaleCheckCountsRoutedReadyWork(t *testing.T) {
 	}
 }
 
-func TestEvaluatePoolDefaultScaleCheckCountsRoutedActiveUnassignedWork(t *testing.T) {
+func TestEvaluatePoolDefaultScaleCheckIgnoresRoutedActiveUnassignedWork(t *testing.T) {
 	skipSlowCmdGCTest(t, "uses real bd and jq for default scale_check coverage; run make test-cmd-gc-process for full coverage")
 	bdPath, err := findPreferredBinary("bd", "/home/ubuntu/.local/bin/bd")
 	if err != nil {
@@ -187,8 +187,34 @@ func TestEvaluatePoolDefaultScaleCheckCountsRoutedActiveUnassignedWork(t *testin
 	if err != nil {
 		t.Fatalf("evaluatePool with routed in-progress work: %v", err)
 	}
-	if got != 1 {
-		t.Fatalf("evaluatePool with routed in-progress work = %d, want 1", got)
+	if got != 0 {
+		t.Fatalf("evaluatePool with routed in-progress work = %d, want 0", got)
+	}
+}
+
+func TestEvaluatePoolNewDemandDoesNotApplyMinOrMax(t *testing.T) {
+	sp := scaleParams{Min: 2, Max: 3, Check: "ignored"}
+	runner := func(_, _ string, _ map[string]string) (string, error) { return "5\n", nil }
+
+	got, err := evaluatePoolNewDemand("worker", sp, "", nil, runner)
+	if err != nil {
+		t.Fatalf("evaluatePoolNewDemand: %v", err)
+	}
+	if got != 5 {
+		t.Fatalf("evaluatePoolNewDemand = %d, want raw new demand 5", got)
+	}
+}
+
+func TestEvaluatePoolNewDemandErrorFallsBackToZero(t *testing.T) {
+	sp := scaleParams{Min: 2, Max: 3, Check: "ignored"}
+	runner := func(_, _ string, _ map[string]string) (string, error) { return "not-a-number\n", nil }
+
+	got, err := evaluatePoolNewDemand("worker", sp, "", nil, runner)
+	if err == nil {
+		t.Fatal("expected parse error")
+	}
+	if got != 0 {
+		t.Fatalf("evaluatePoolNewDemand error fallback = %d, want 0", got)
 	}
 }
 
diff --git a/cmd/gc/prompt.go b/cmd/gc/prompt.go
index 52c3080301..6e83c119e5 100644
--- a/cmd/gc/prompt.go
+++ b/cmd/gc/prompt.go
@@ -26,6 +26,8 @@ type PromptContext struct {
 	CityRoot      string
 	AgentName     string // qualified: "rig/polecat-1" or "mayor"
 	TemplateName  string // config name: "polecat" (template) or "mayor" (named backing template)
+	BindingName   string
+	BindingPrefix string
 	RigName       string
 	RigRoot       string
 	WorkDir       string
@@ -211,7 +213,7 @@ func effectivePromptFragments(global, inject, appendFragments, inherited, defaul
 // buildTemplateData merges Env (lower priority) with SDK fields (higher
 // priority) into a single map for template execution.
 func buildTemplateData(ctx PromptContext) map[string]string {
-	m := make(map[string]string, len(ctx.Env)+8)
+	m := make(map[string]string, len(ctx.Env)+10)
 	for k, v := range ctx.Env {
 		m[k] = v
 	}
@@ -219,6 +221,8 @@ func buildTemplateData(ctx PromptContext) map[string]string {
 	m["CityRoot"] = ctx.CityRoot
 	m["AgentName"] = ctx.AgentName
 	m["TemplateName"] = ctx.TemplateName
+	m["BindingName"] = ctx.BindingName
+	m["BindingPrefix"] = ctx.BindingPrefix
 	m["RigName"] = ctx.RigName
 	m["RigRoot"] = ctx.RigRoot
 	m["WorkDir"] = ctx.WorkDir
diff --git a/cmd/gc/prompt_test.go b/cmd/gc/prompt_test.go
index 38b727ef64..0e07b0519d 100644
--- a/cmd/gc/prompt_test.go
+++ b/cmd/gc/prompt_test.go
@@ -140,6 +140,51 @@ prompt_template = "agents/mayor/prompt.template.md"
 	}
 }
 
+func TestRenderPromptAgentBlockAppendFragmentsAffectRenderedPrompt(t *testing.T) {
+	data := []byte(`
+[workspace]
+name = "test-city"
+
+[[agent]]
+name = "mayor"
+prompt_template = "agents/mayor/prompt.template.md"
+append_fragments = ["footer"]
+`)
+	cfg, err := config.Parse(data)
+	if err != nil {
+		t.Fatalf("config.Parse: %v", err)
+	}
+	var mayor config.Agent
+	found := false
+	for _, a := range cfg.Agents {
+		if a.Name == "mayor" {
+			mayor = a
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf(`expected [[agent]] with name "mayor" in parsed config`)
+	}
+	if got := mayor.AppendFragments; len(got) != 1 || got[0] != "footer" {
+		t.Fatalf("[[agent]] AppendFragments = %v, want [footer]", got)
+	}
+	f := fsys.NewFake()
+	f.Files["/city/agents/mayor/prompt.template.md"] = []byte("Hello")
+	f.Files["/city/agents/mayor/template-fragments/footer.template.md"] = []byte(`{{ define "footer" }}Goodbye{{ end }}`)
+	fragments := effectivePromptFragments(
+		cfg.Workspace.GlobalFragments,
+		mayor.InjectFragments,
+		mayor.AppendFragments,
+		mayor.InheritedAppendFragments,
+		cfg.AgentDefaults.AppendFragments,
+	)
+	got := renderPrompt(f, "/city", "", "agents/mayor/prompt.template.md", PromptContext{}, "", io.Discard, nil, fragments, nil)
+	if got != "Hello\n\nGoodbye" {
+		t.Errorf("renderPrompt([[agent]] append_fragments) = %q, want %q", got, "Hello\n\nGoodbye")
+	}
+}
+
 func TestRenderPromptPatchedTemplateSuffixRenders(t *testing.T) {
 	f := fsys.NewFake()
 	f.Files["/city/patches/gastown-mayor-prompt.template.md"] = []byte("Hello {{ .AgentName }}")
@@ -302,12 +347,15 @@ Branch: {{ .Branch }}
 Run {{ cmd }} to start
 Session: {{ session "deacon" }}
 Custom: {{ .DefaultBranch }}
+Binding: {{ .BindingName }} {{ .BindingPrefix }}
 `
 	f.Files["/city/prompts/full.md.tmpl"] = []byte(tmpl)
 	ctx := PromptContext{
 		CityRoot:      "/home/user/city",
 		AgentName:     "myrig/polecat-1",
 		TemplateName:  "polecat",
+		BindingName:   "gastown",
+		BindingPrefix: "gastown.",
 		RigName:       "myrig",
 		WorkDir:       "/home/user/city/myrig/polecats/polecat-1",
 		IssuePrefix:   "mr-",
@@ -342,6 +390,9 @@ Custom: {{ .DefaultBranch }}
 	if !strings.Contains(got, "Custom: main") {
 		t.Errorf("missing env var: %q", got)
 	}
+	if !strings.Contains(got, "Binding: gastown gastown.") {
+		t.Errorf("missing binding namespace: %q", got)
+	}
 }
 
 func TestRenderPromptWorkQuery(t *testing.T) {
@@ -359,6 +410,8 @@ func TestBuildTemplateData(t *testing.T) {
 		CityRoot:      "/city",
 		AgentName:     "a/b",
 		TemplateName:  "b",
+		BindingName:   "dep",
+		BindingPrefix: "dep.",
 		RigName:       "a",
 		WorkDir:       "/city/a",
 		IssuePrefix:   "te-",
@@ -377,6 +430,12 @@ func TestBuildTemplateData(t *testing.T) {
 	if data["TemplateName"] != "b" {
 		t.Errorf("TemplateName = %q, want %q", data["TemplateName"], "b")
 	}
+	if data["BindingName"] != "dep" {
+		t.Errorf("BindingName = %q, want %q", data["BindingName"], "dep")
+	}
+	if data["BindingPrefix"] != "dep." {
+		t.Errorf("BindingPrefix = %q, want %q", data["BindingPrefix"], "dep.")
+	}
 	if data["DefaultBranch"] != "main" {
 		t.Errorf("DefaultBranch = %q, want %q", data["DefaultBranch"], "main")
 	}
diff --git a/cmd/gc/providers.go b/cmd/gc/providers.go
index 91320a27c4..87672f0b06 100644
--- a/cmd/gc/providers.go
+++ b/cmd/gc/providers.go
@@ -164,6 +164,26 @@ func newSessionProviderForCity(cfg *config.City, cityPath string) runtime.Provid
 	return newSessionProviderFromContext(ctx, sessionBeads)
 }
 
+func newStatusSessionProviderForCity(cfg *config.City, cityPath string) runtime.Provider {
+	ctx := sessionProviderContextForCity(cfg, cityPath, os.Getenv("GC_SESSION"))
+	return newSessionProviderFromContext(ctx, nil)
+}
+
+func newStatusSessionProviderForCityWithSnapshot(cfg *config.City, cityPath string, sessionBeads *sessionBeadSnapshot) runtime.Provider {
+	ctx := sessionProviderContextForCity(cfg, cityPath, os.Getenv("GC_SESSION"))
+	return newSessionProviderFromContext(ctx, sessionBeads)
+}
+
+func registerStatusProviderACPRoutes(sp runtime.Provider, snapshot *sessionBeadSnapshot, cityName string, cfg *config.City) {
+	router, ok := sp.(interface{ RouteACP(string) })
+	if !ok {
+		return
+	}
+	for _, sessName := range configuredACPRouteNames(snapshot, cityName, cfg) {
+		router.RouteACP(sessName)
+	}
+}
+
 func loadProviderSessionSnapshot(ctx sessionProviderContext) *sessionBeadSnapshot {
 	if ctx.cityPath == "" || ctx.providerName == "acp" {
 		return nil
@@ -189,7 +209,7 @@ func newSessionProviderFromContext(ctx sessionProviderContext, sessionBeads *ses
 }
 
 func newSessionProviderFromContextWithError(ctx sessionProviderContext, sessionBeads *sessionBeadSnapshot) (runtime.Provider, error) {
-	sp, err := newSessionProviderByName(ctx.providerName, ctx.sc, ctx.cityName, ctx.cityPath)
+	sp, err := buildSessionProviderByName(ctx.providerName, ctx.sc, ctx.cityName, ctx.cityPath)
 	if err != nil {
 		return nil, err
 	}
@@ -426,6 +446,9 @@ func displayProviderName(name string) string {
 
 func configuredBeadsProviderValue(cityPath string) string {
 	if v := strings.TrimSpace(os.Getenv("GC_BEADS")); v != "" {
+		if scopedRoot := strings.TrimSpace(os.Getenv("GC_BEADS_SCOPE_ROOT")); scopedRoot != "" && cityPath != "" && !samePath(resolveStoreScopeRoot(cityPath, scopedRoot), cityPath) {
+			return strings.TrimSpace(peekBeadsProvider(filepath.Join(cityPath, "city.toml")))
+		}
 		return v
 	}
 	return strings.TrimSpace(peekBeadsProvider(filepath.Join(cityPath, "city.toml")))
@@ -565,6 +588,27 @@ func scopeUsesFileStoreContract(scopeRoot string) bool {
 	return err == nil
 }
 
+// bdProviderMismatchHint returns an actionable diagnostic when gc bd
+// rejects a scope as non-bd-backed. It names the marker that tipped
+// the resolver and suggests a fix. Returns "" when the cause is not
+// a local scope-marker issue (e.g., explicit city/env provider).
+func bdProviderMismatchHint(scopeRoot, resolvedProvider string) string {
+	if resolvedProvider == "file" && scopeUsesFileStoreContract(scopeRoot) {
+		return fmt.Sprintf(
+			"%s/.gc/beads.json exists, which marks this scope as file-backed. "+
+				"If it is a stale artifact from a previous city or pre-migration "+
+				"layout, move it aside (e.g., rename to .gc/beads.json.bak). To "+
+				"positively mark this scope as bd-backed, add "+
+				"%s/.beads/metadata.json (with backend=dolt and the dolt_database "+
+				"name).",
+			scopeRoot, scopeRoot)
+	}
+	if strings.TrimSpace(os.Getenv("GC_BEADS")) != "" {
+		return "GC_BEADS env var overrides the provider. Unset it, or set GC_BEADS=bd for this scope."
+	}
+	return "check city.toml [beads].provider and any per-rig provider overrides."
+}
+
 // beadsProvider returns the bead store provider name for lifecycle operations.
 // Maps "bd" → "exec:<cityPath>/.gc/system/packs/bd/assets/scripts/gc-beads-bd.sh"
 // so all lifecycle operations route through the exec: protocol. Other providers
@@ -603,7 +647,8 @@ func mailProviderName() string {
 
 // newMailProvider returns a mail.Provider based on the mail provider name
 // (env var → city.toml → default) and the given bead store (used as the
-// default backend).
+// default backend). Shared callers such as the API use the stateless beadmail
+// provider so long-lived instances observe fresh session state.
 //
 //   - "fake" → in-memory fake (all ops succeed)
 //   - "fail" → broken fake (all ops return errors)
@@ -624,20 +669,35 @@ func newMailProvider(store beads.Store) mail.Provider {
 	}
 }
 
+func newCommandMailProvider(store beads.Store) mail.Provider {
+	v := mailProviderName()
+	if strings.HasPrefix(v, "exec:") {
+		return mailexec.NewProvider(strings.TrimPrefix(v, "exec:"))
+	}
+	switch v {
+	case "fake":
+		return mail.NewFake()
+	case "fail":
+		return mail.NewFailFake()
+	default:
+		return beadmail.NewCached(store)
+	}
+}
+
 // openCityMailProvider opens the city's bead store and wraps it in a
 // mail.Provider. Returns (nil, exitCode) on failure.
 func openCityMailProvider(stderr io.Writer, cmdName string) (mail.Provider, int) {
 	// For exec: and test doubles, no store needed.
 	v := mailProviderName()
 	if strings.HasPrefix(v, "exec:") || v == "fake" || v == "fail" {
-		return newMailProvider(nil), 0
+		return newCommandMailProvider(nil), 0
 	}
 
 	store, code := openCityStore(stderr, cmdName)
 	if store == nil {
 		return nil, code
 	}
-	return newMailProvider(store), 0
+	return newCommandMailProvider(store), 0
 }
 
 // eventsProviderName returns the events provider name.
diff --git a/cmd/gc/providers_test.go b/cmd/gc/providers_test.go
index e4dd0d17ff..7abb2cc9e8 100644
--- a/cmd/gc/providers_test.go
+++ b/cmd/gc/providers_test.go
@@ -156,6 +156,9 @@ provider = "file"
 	if got := rawBeadsProviderForScope(cityDir, cityDir); got != "file" {
 		t.Fatalf("rawBeadsProviderForScope(city) = %q, want file outside scoped override", got)
 	}
+	if got := beadsProvider(cityDir); got != "file" {
+		t.Fatalf("beadsProvider(city) = %q, want file outside scoped override", got)
+	}
 }
 
 func TestRawBeadsProviderForScopeIgnoresConfigYamlWithoutMetadata(t *testing.T) {
@@ -695,6 +698,62 @@ func TestLoadProviderSessionSnapshotLoadsStoreWithoutACPAgents(t *testing.T) {
 	}
 }
 
+func TestStatusSessionProviderSkipsSessionSnapshot(t *testing.T) {
+	oldOpen := openSessionProviderStore
+	t.Cleanup(func() { openSessionProviderStore = oldOpen })
+
+	calls := 0
+	openSessionProviderStore = func(string) (beads.Store, error) {
+		calls++
+		return nil, errors.New("session snapshot should not load for status")
+	}
+
+	sp := newStatusSessionProviderForCity(&config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Session:   config.SessionConfig{Provider: "subprocess"},
+	}, "/tmp/city")
+	if sp == nil {
+		t.Fatal("newStatusSessionProviderForCity() = nil")
+	}
+	if calls != 0 {
+		t.Fatalf("openSessionProviderStore called %d times, want 0", calls)
+	}
+}
+
+func TestStatusSessionProviderUsesProvidedSnapshotToWrapObservedACPSessions(t *testing.T) {
+	oldBuild := buildSessionProviderByName
+	t.Cleanup(func() { buildSessionProviderByName = oldBuild })
+
+	defaultSP := runtime.NewFake()
+	acpSP := runtime.NewFake()
+	buildSessionProviderByName = func(name string, _ config.SessionConfig, _, _ string) (runtime.Provider, error) {
+		if name == "acp" {
+			return acpSP, nil
+		}
+		return defaultSP, nil
+	}
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "city"},
+		Session:   config.SessionConfig{Provider: "fake"},
+		Agents:    []config.Agent{{Name: "mayor"}},
+	}
+	snapshot := newSessionBeadSnapshot([]beads.Bead{{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "orphan-acp",
+			"transport":    "acp",
+			"session_name": "provider-session",
+		},
+	}})
+
+	sp := newStatusSessionProviderForCityWithSnapshot(cfg, t.TempDir(), snapshot)
+	if err := sp.Attach("provider-session"); err == nil || !strings.Contains(err.Error(), "ACP transport") {
+		t.Fatalf("Attach(provider-session) error = %v, want ACP transport error from snapshot-backed wrapper", err)
+	}
+}
+
 func TestLoadProviderSessionSnapshotLoadsOpenACPAgents(t *testing.T) {
 	oldOpen := openSessionProviderStore
 	t.Cleanup(func() { openSessionProviderStore = oldOpen })
diff --git a/cmd/gc/rig_anywhere_test.go b/cmd/gc/rig_anywhere_test.go
index f74eef1368..b10cc149a4 100644
--- a/cmd/gc/rig_anywhere_test.go
+++ b/cmd/gc/rig_anywhere_test.go
@@ -1309,6 +1309,237 @@ func TestRigAnywhere_ResolveRigToContext(t *testing.T) {
 		}
 	})
 
+	// Regression: gc stop (and other commands that scan registered rig
+	// bindings) must not abort when a sibling city's directory has been
+	// deleted out from under the registry. Resolution still succeeds on
+	// the healthy target and registeredRigBindingsByPath reports the
+	// stale entry as structured data so only explicit-rig-resolution
+	// callers (not opportunistic probes) need to warn about it.
+	t.Run("stale_sibling_directory_is_skipped_with_warning", func(t *testing.T) {
+		gcHome := t.TempDir()
+		t.Setenv("GC_HOME", gcHome)
+
+		goodCity := setupCity(t, "stale-sibling-good")
+		rigDir := filepath.Join(t.TempDir(), "stale-sibling-rig")
+		if err := os.MkdirAll(rigDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		registerRigBindingForResolution(t, gcHome, goodCity, "stale-sibling-good", "stale-sibling-rig", rigDir)
+
+		// Register a second city, then delete its directory to simulate
+		// "gc stop ~/my-city" after the sibling city was rm -rf'd.
+		staleDir := filepath.Join(t.TempDir(), "vanished-city")
+		if err := os.MkdirAll(filepath.Join(staleDir, ".gc"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(staleDir, "city.toml"),
+			[]byte("[workspace]\nname = \"stale-sibling-bad\"\n\n[[agent]]\nname = \"mayor\"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		registerCityForRigResolution(t, gcHome, staleDir, "stale-sibling-bad")
+		if err := os.RemoveAll(staleDir); err != nil {
+			t.Fatal(err)
+		}
+
+		ctx, err := resolveContextFromPath(rigDir)
+		if err != nil {
+			t.Fatalf("resolveContextFromPath error: %v (want success with stale sibling skipped)", err)
+		}
+		assertSameTestPath(t, ctx.CityPath, goodCity)
+		if ctx.RigName != "stale-sibling-rig" {
+			t.Errorf("RigName = %q, want %q", ctx.RigName, "stale-sibling-rig")
+		}
+
+		// registeredRigBindingsByPath returns stale entries as structured
+		// data; callers decide whether to emit a user-facing warning. This
+		// asserts the diagnostic is available without coupling the test to
+		// a particular stderr routing scheme.
+		_, stale, err := registeredRigBindingsByPath(rigDir, true)
+		if err != nil {
+			t.Fatalf("registeredRigBindingsByPath error: %v", err)
+		}
+		if len(stale) == 0 {
+			t.Fatal("expected a stale-registered-city entry, got none")
+		}
+		var found bool
+		for _, s := range stale {
+			if strings.Contains(s.Label, "stale-sibling-bad") {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("stale = %+v, want an entry mentioning stale-sibling-bad", stale)
+		}
+
+		// The helper renders the structured list to a command's stderr.
+		var warnings bytes.Buffer
+		emitStaleRegisteredCityWarnings(&warnings, stale)
+		warn := warnings.String()
+		if !strings.Contains(warn, "stale-sibling-bad") {
+			t.Errorf("warning = %q, want it to mention the stale city name", warn)
+		}
+		if !strings.Contains(warn, "city.toml missing") {
+			t.Errorf("warning = %q, want it to explain city.toml is missing", warn)
+		}
+		if !strings.Contains(warn, filepath.Join(staleDir, "city.toml")) {
+			t.Errorf("warning = %q, want it to mention the missing city.toml path", warn)
+		}
+	})
+
+	// Regression: the stale-entry check handles ENOENT from the config-load
+	// path itself. A registered city whose directory exists but whose city.toml
+	// is missing must still be skipped rather than abort the resolver.
+	t.Run("stale_sibling_city_toml_missing_hits_load_path", func(t *testing.T) {
+		gcHome := t.TempDir()
+		t.Setenv("GC_HOME", gcHome)
+
+		goodCity := setupCity(t, "load-path-good")
+		rigDir := filepath.Join(t.TempDir(), "load-path-rig")
+		if err := os.MkdirAll(rigDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		registerRigBindingForResolution(t, gcHome, goodCity, "load-path-good", "load-path-rig", rigDir)
+
+		// Register a second city whose directory exists but whose
+		// city.toml was never created. The load path (not a Stat
+		// pre-check) has to handle ENOENT here.
+		emptyDir := filepath.Join(t.TempDir(), "empty-city")
+		if err := os.MkdirAll(filepath.Join(emptyDir, ".gc"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		registerCityForRigResolution(t, gcHome, emptyDir, "empty-city")
+
+		ctx, err := resolveContextFromPath(rigDir)
+		if err != nil {
+			t.Fatalf("resolveContextFromPath error: %v (want success with ENOENT on load path)", err)
+		}
+		assertSameTestPath(t, ctx.CityPath, goodCity)
+
+		_, stale, err := registeredRigBindingsByPath(rigDir, true)
+		if err != nil {
+			t.Fatalf("registeredRigBindingsByPath error: %v", err)
+		}
+		var found bool
+		for _, s := range stale {
+			if strings.Contains(s.Label, "empty-city") {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("stale = %+v, want an entry mentioning empty-city", stale)
+		}
+	})
+
+	t.Run("registered_city_with_missing_include_fails_closed_not_stale", func(t *testing.T) {
+		gcHome := t.TempDir()
+		t.Setenv("GC_HOME", gcHome)
+
+		goodCity := setupCity(t, "missing-include-good")
+		rigDir := filepath.Join(t.TempDir(), "missing-include-rig")
+		if err := os.MkdirAll(rigDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		registerRigBindingForResolution(t, gcHome, goodCity, "missing-include-good", "missing-include-rig", rigDir)
+
+		brokenCity := setupCity(t, "missing-include-broken")
+		if err := os.WriteFile(filepath.Join(brokenCity, "city.toml"), []byte(`
+include = ["missing.toml"]
+
+[workspace]
+name = "missing-include-broken"
+
+[[agent]]
+name = "missing-include-agent"
+`), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		registerCityForRigResolution(t, gcHome, brokenCity, "missing-include-broken")
+
+		_, stale, err := registeredRigBindingsByPath(rigDir, true)
+		if err == nil {
+			t.Fatal("registeredRigBindingsByPath should fail closed on missing include")
+		}
+		if !strings.Contains(err.Error(), "loading registered city rig bindings") {
+			t.Fatalf("error = %q, want registered binding load error", err)
+		}
+		if !strings.Contains(err.Error(), "missing.toml") {
+			t.Fatalf("error = %q, want missing include path", err)
+		}
+		for _, s := range stale {
+			if strings.Contains(s.Label, "missing-include-broken") {
+				t.Fatalf("stale = %+v, missing include must not be reported as stale", stale)
+			}
+		}
+	})
+
+	t.Run("path_lookup_error_preserves_stale_entries", func(t *testing.T) {
+		gcHome := t.TempDir()
+		t.Setenv("GC_HOME", gcHome)
+
+		goodCity := setupCity(t, "path-stale-error-good")
+		rigDir := filepath.Join(t.TempDir(), "path-stale-error-rig")
+		if err := os.MkdirAll(rigDir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		registerRigBindingForResolution(t, gcHome, goodCity, "path-stale-error-good", "path-stale-error-rig", rigDir)
+
+		staleDir := filepath.Join(t.TempDir(), "path-stale-error-vanished")
+		if err := os.MkdirAll(filepath.Join(staleDir, ".gc"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(staleDir, "city.toml"), []byte("[workspace]\nname = \"path-stale-error-vanished\"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		registerCityForRigResolution(t, gcHome, staleDir, "path-stale-error-vanished")
+		if err := os.RemoveAll(staleDir); err != nil {
+			t.Fatal(err)
+		}
+
+		badCity := setupCity(t, "path-stale-error-bad")
+		if err := os.WriteFile(config.SiteBindingPath(badCity), []byte("[[rig]\nname = \"broken\"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		registerCityForRigResolution(t, gcHome, badCity, "path-stale-error-bad")
+
+		_, stale, err := registeredRigBindingsByPath(rigDir, true)
+		if err == nil {
+			t.Fatal("registeredRigBindingsByPath should fail closed on the malformed site binding")
+		}
+		var found bool
+		for _, s := range stale {
+			if strings.Contains(s.Label, "path-stale-error-vanished") {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("stale = %+v, want vanished city preserved on error", stale)
+		}
+	})
+
+	// Regression: emitStaleRegisteredCityWarnings dedupes by Label so a
+	// command that invokes registeredRigBindings twice (e.g.
+	// resolveRigToContext tries both name and path lookups) emits each
+	// stale entry at most once.
+	t.Run("emit_stale_warnings_deduplicates_by_label", func(t *testing.T) {
+		stale := []staleRegisteredCity{
+			{Label: "city-a", Path: "/tmp/a"},
+			{Label: "city-b", Path: "/tmp/b"},
+			{Label: "city-a", Path: "/tmp/a"}, // duplicate from a second scan
+		}
+		var out bytes.Buffer
+		emitStaleRegisteredCityWarnings(&out, stale)
+		got := out.String()
+		if strings.Count(got, "city-a") != 1 {
+			t.Errorf("city-a should appear once, got %d in %q", strings.Count(got, "city-a"), got)
+		}
+		if strings.Count(got, "city-b") != 1 {
+			t.Errorf("city-b should appear once, got %d in %q", strings.Count(got, "city-b"), got)
+		}
+	})
+
 	t.Run("rig_ambiguous_no_default_helpful_error", func(t *testing.T) {
 		gcHome := t.TempDir()
 		t.Setenv("GC_HOME", gcHome)
diff --git a/cmd/gc/scaffold_fs.go b/cmd/gc/scaffold_fs.go
new file mode 100644
index 0000000000..e42536a6ea
--- /dev/null
+++ b/cmd/gc/scaffold_fs.go
@@ -0,0 +1,8 @@
+package main
+
+import (
+	"github.com/gastownhall/gascity/internal/cityinit"
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+var _ cityinit.ScaffoldFS = fsys.OSScaffoldFS{}
diff --git a/cmd/gc/script_resolve_test.go b/cmd/gc/script_resolve_test.go
index 0246c7feb1..32c161f1d9 100644
--- a/cmd/gc/script_resolve_test.go
+++ b/cmd/gc/script_resolve_test.go
@@ -312,6 +312,7 @@ func TestPruneLegacyConfiguredScripts_FallbackPreservesTopLevelScriptsTargets(t
 func TestPrepareCityForSupervisorPrunesLegacyScripts(t *testing.T) {
 	dir := t.TempDir()
 	cityPath := filepath.Join(dir, "city")
+	cleanupManagedDoltTestCity(t, cityPath)
 	rigPath := filepath.Join(dir, "rig")
 	cityPackScripts := filepath.Join(dir, "packs/city/assets/scripts")
 	rigPackScripts := filepath.Join(dir, "packs/rig/assets/scripts")
diff --git a/cmd/gc/session_bead_snapshot.go b/cmd/gc/session_bead_snapshot.go
index 4906256c6a..3173ee8a31 100644
--- a/cmd/gc/session_bead_snapshot.go
+++ b/cmd/gc/session_bead_snapshot.go
@@ -1,33 +1,55 @@
 package main
 
 import (
+	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	sessionpkg "github.com/gastownhall/gascity/internal/session"
 )
 
-// sessionBeadSnapshot caches open session-bead state for a single reconcile
-// cycle so build/sync/reconcile can reuse one store scan.
+// sessionBeadSnapshot caches active session-bead state for a single reconcile
+// cycle. Closed-session history is intentionally not loaded here: the
+// reconciler calls this several times per tick, and closed history grows
+// without bound. Callers that need a closed record must fetch that one ID
+// explicitly.
 type sessionBeadSnapshot struct {
 	open                      []beads.Bead
+	beadIDByAgentName         map[string]string
+	beadIDByTemplateHint      map[string]string
 	sessionNameByAgentName    map[string]string
 	sessionNameByTemplateHint map[string]string
 }
 
 func loadSessionBeadSnapshot(store beads.Store) (*sessionBeadSnapshot, error) {
-	open, err := loadSessionBeads(store)
+	if store == nil {
+		return newSessionBeadSnapshot(nil), nil
+	}
+	all, err := store.List(beads.ListQuery{
+		Label: sessionBeadLabel,
+	})
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("listing session beads: %w", err)
+	}
+	sessions := make([]beads.Bead, 0, len(all))
+	for _, bead := range all {
+		if sessionpkg.IsSessionBeadOrRepairable(bead) {
+			sessions = append(sessions, bead)
+		}
 	}
-	return newSessionBeadSnapshot(open), nil
+	return newSessionBeadSnapshot(sessions), nil
 }
 
-func newSessionBeadSnapshot(open []beads.Bead) *sessionBeadSnapshot {
-	filtered := make([]beads.Bead, 0, len(open))
+func newSessionBeadSnapshot(beadsIn []beads.Bead) *sessionBeadSnapshot {
+	filtered := make([]beads.Bead, 0, len(beadsIn))
+	beadIDByAgentName := make(map[string]string)
+	beadIDByTemplateHint := make(map[string]string)
 	sessionNameByAgentName := make(map[string]string)
 	sessionNameByTemplateHint := make(map[string]string)
 
-	for _, b := range open {
+	for _, b := range beadsIn {
 		if b.Status == "closed" {
 			continue
 		}
@@ -40,7 +62,7 @@ func newSessionBeadSnapshot(open []beads.Bead) *sessionBeadSnapshot {
 		isCanonicalNamed := strings.TrimSpace(b.Metadata["configured_named_identity"]) != ""
 		if agentName := sessionBeadAgentName(b); agentName != "" {
 			if isPoolManagedSessionBead(b) && agentName == b.Metadata["template"] {
-				agentName = ""
+				agentName = stampedPoolQualifiedIdentity(b)
 			}
 			if agentName == "" {
 				continue
@@ -49,6 +71,7 @@ func newSessionBeadSnapshot(open []beads.Bead) *sessionBeadSnapshot {
 			// resolveSessionName returns the correct session_name even
 			// when leaked pool-style beads exist for the same template.
 			if _, exists := sessionNameByAgentName[agentName]; !exists || isCanonicalNamed {
+				beadIDByAgentName[agentName] = b.ID
 				sessionNameByAgentName[agentName] = sn
 			}
 		}
@@ -57,11 +80,13 @@ func newSessionBeadSnapshot(open []beads.Bead) *sessionBeadSnapshot {
 		}
 		if template := b.Metadata["template"]; template != "" {
 			if _, exists := sessionNameByTemplateHint[template]; !exists || isCanonicalNamed {
+				beadIDByTemplateHint[template] = b.ID
 				sessionNameByTemplateHint[template] = sn
 			}
 		}
 		if commonName := b.Metadata["common_name"]; commonName != "" {
 			if _, exists := sessionNameByTemplateHint[commonName]; !exists {
+				beadIDByTemplateHint[commonName] = b.ID
 				sessionNameByTemplateHint[commonName] = sn
 			}
 		}
@@ -69,6 +94,8 @@ func newSessionBeadSnapshot(open []beads.Bead) *sessionBeadSnapshot {
 
 	return &sessionBeadSnapshot{
 		open:                      filtered,
+		beadIDByAgentName:         beadIDByAgentName,
+		beadIDByTemplateHint:      beadIDByTemplateHint,
 		sessionNameByAgentName:    sessionNameByAgentName,
 		sessionNameByTemplateHint: sessionNameByTemplateHint,
 	}
@@ -116,6 +143,31 @@ func (s *sessionBeadSnapshot) FindSessionNameByTemplate(template string) string
 	return s.sessionNameByTemplateHint[template]
 }
 
+func (s *sessionBeadSnapshot) FindSessionBeadByTemplate(template string) (beads.Bead, bool) {
+	if s == nil {
+		return beads.Bead{}, false
+	}
+	if id := s.beadIDByAgentName[template]; id != "" {
+		return s.FindByID(id)
+	}
+	if id := s.beadIDByTemplateHint[template]; id != "" {
+		return s.FindByID(id)
+	}
+	return beads.Bead{}, false
+}
+
+func (s *sessionBeadSnapshot) FindByID(id string) (beads.Bead, bool) {
+	if s == nil || strings.TrimSpace(id) == "" {
+		return beads.Bead{}, false
+	}
+	for _, bead := range s.open {
+		if bead.ID == id {
+			return bead, true
+		}
+	}
+	return beads.Bead{}, false
+}
+
 func (s *sessionBeadSnapshot) FindSessionNameByNamedIdentity(identity string) string {
 	if s == nil || strings.TrimSpace(identity) == "" {
 		return ""
@@ -130,3 +182,26 @@ func (s *sessionBeadSnapshot) FindSessionNameByNamedIdentity(identity string) st
 	}
 	return ""
 }
+
+func stampedPoolQualifiedIdentity(bead beads.Bead) string {
+	if !isPoolManagedSessionBead(bead) {
+		return ""
+	}
+	slot, err := strconv.Atoi(strings.TrimSpace(bead.Metadata["pool_slot"]))
+	if err != nil || slot <= 0 {
+		return ""
+	}
+	template := strings.TrimSpace(bead.Metadata["template"])
+	if template == "" {
+		return ""
+	}
+	scope, name := config.ParseQualifiedName(template)
+	if name == "" {
+		return ""
+	}
+	instance := fmt.Sprintf("%s-%d", name, slot)
+	if scope != "" {
+		return scope + "/" + instance
+	}
+	return instance
+}
diff --git a/cmd/gc/session_bead_snapshot_test.go b/cmd/gc/session_bead_snapshot_test.go
new file mode 100644
index 0000000000..a3b9aa5d52
--- /dev/null
+++ b/cmd/gc/session_bead_snapshot_test.go
@@ -0,0 +1,86 @@
+package main
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+// seedSessionBeads populates a Store with the given number of open and
+// closed session beads. Open beads carry a fresh session_name and template
+// so newSessionBeadSnapshot's identity indexes get exercised the same way
+// as in production.
+func seedSessionBeads(tb testing.TB, store beads.Store, openCount, closedCount int) {
+	tb.Helper()
+	for i := 0; i < openCount; i++ {
+		bead, err := store.Create(beads.Bead{
+			Title:  fmt.Sprintf("open session %d", i),
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"session_name": fmt.Sprintf("agent-open-%d", i),
+				"template":     fmt.Sprintf("template-open-%d", i),
+			},
+		})
+		if err != nil {
+			tb.Fatalf("seed open session bead %d: %v", i, err)
+		}
+		_ = bead
+	}
+	for i := 0; i < closedCount; i++ {
+		bead, err := store.Create(beads.Bead{
+			Title:  fmt.Sprintf("closed session %d", i),
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"session_name": fmt.Sprintf("agent-closed-%d", i),
+				"template":     fmt.Sprintf("template-closed-%d", i),
+			},
+		})
+		if err != nil {
+			tb.Fatalf("seed closed session bead %d: %v", i, err)
+		}
+		if err := store.Close(bead.ID); err != nil {
+			tb.Fatalf("close session bead %d: %v", i, err)
+		}
+	}
+}
+
+// BenchmarkLoadSessionBeadSnapshot_LargeStore exercises the hot-path
+// snapshot loader against a store dominated by closed session beads. After
+// the IncludeClosed drop in loadSessionBeadSnapshot, runtime should scale
+// with the open count, not the open+closed total.
+func BenchmarkLoadSessionBeadSnapshot_LargeStore(b *testing.B) {
+	store := beads.NewMemStore()
+	seedSessionBeads(b, store, 50, 5000)
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		snap, err := loadSessionBeadSnapshot(store)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if got := len(snap.Open()); got != 50 {
+			b.Fatalf("Open()=%d, want 50", got)
+		}
+	}
+}
+
+// BenchmarkLoadSessionBeadSnapshot_OpenOnlyBaseline establishes a control
+// for BenchmarkLoadSessionBeadSnapshot_LargeStore: same open count, no
+// closed history. The two benchmarks should report comparable ns/op.
+func BenchmarkLoadSessionBeadSnapshot_OpenOnlyBaseline(b *testing.B) {
+	store := beads.NewMemStore()
+	seedSessionBeads(b, store, 50, 0)
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		snap, err := loadSessionBeadSnapshot(store)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if got := len(snap.Open()); got != 50 {
+			b.Fatalf("Open()=%d, want 50", got)
+		}
+	}
+}
diff --git a/cmd/gc/session_beads.go b/cmd/gc/session_beads.go
index fc73806103..9c0ce3b268 100644
--- a/cmd/gc/session_beads.go
+++ b/cmd/gc/session_beads.go
@@ -24,6 +24,12 @@ const sessionBeadLabel = "gc:session"
 // sessionBeadType is the bead type for session beads.
 const sessionBeadType = "session"
 
+const (
+	poolAliasConflictMetadataKey      = "pool_alias_conflict"
+	poolAliasConflictCountMetadataKey = "pool_alias_conflict_count"
+	poolAliasConflictAtMetadataKey    = "pool_alias_conflict_at"
+)
+
 // loadSessionBeads returns all open session beads from the store.
 func loadSessionBeads(store beads.Store) ([]beads.Bead, error) {
 	if store == nil {
@@ -55,6 +61,103 @@ func snapshotOrLoadSessionBeads(store beads.Store, sessionBeads *sessionBeadSnap
 	return loadSessionBeads(store)
 }
 
+func syncSessionCachedState(sessionName string, existing beads.Bead, exists bool, sp runtime.Provider) string {
+	if exists {
+		switch session.State(strings.TrimSpace(existing.Metadata["state"])) {
+		case "", session.StateActive, session.StateAwake:
+			return string(session.StateActive)
+		case session.StateCreating:
+			return string(session.StateCreating)
+		case session.StateAsleep, session.StateSuspended, session.StateDraining, session.StateArchived, session.StateQuarantined:
+			return strings.TrimSpace(existing.Metadata["state"])
+		default:
+			if state := strings.TrimSpace(existing.Metadata["state"]); state != "" {
+				return state
+			}
+			return string(session.StateActive)
+		}
+	}
+	if sp != nil && strings.TrimSpace(sessionName) != "" && sp.IsRunning(sessionName) {
+		return string(session.StateActive)
+	}
+	return "stopped"
+}
+
+func canonicalDuplicateSessionBead(incumbent, candidate beads.Bead) beads.Bead {
+	incumbentOwnsName := beadOwnsPoolSessionName(incumbent)
+	candidateOwnsName := beadOwnsPoolSessionName(candidate)
+	switch {
+	case candidateOwnsName && !incumbentOwnsName:
+		return candidate
+	case incumbentOwnsName && !candidateOwnsName:
+		return incumbent
+	default:
+		return candidate
+	}
+}
+
+func beadOwnsPoolSessionName(b beads.Bead) bool {
+	id := strings.TrimSpace(b.ID)
+	sn := strings.TrimSpace(b.Metadata["session_name"])
+	if id == "" || sn == "" {
+		return false
+	}
+	if template := strings.TrimSpace(b.Metadata["template"]); template != "" && sn == PoolSessionName(template, id) {
+		return true
+	}
+	return strings.HasSuffix(sn, "-"+id)
+}
+
+func pendingPoolSessionName(template, instanceToken string) string {
+	base := targetBasename(template)
+	if base == "" {
+		base = "pool"
+	}
+	token := strings.TrimSpace(instanceToken)
+	if token == "" {
+		token = session.NewInstanceToken()
+	}
+	return base + "-pending-" + token
+}
+
+func indexSessionBeadsByName(open []beads.Bead) map[string]beads.Bead {
+	byName := make(map[string]beads.Bead, len(open))
+	for _, b := range open {
+		if b.Status == "closed" {
+			continue
+		}
+		sn := strings.TrimSpace(b.Metadata["session_name"])
+		if sn == "" {
+			continue
+		}
+		if incumbent, ok := byName[sn]; ok {
+			byName[sn] = canonicalDuplicateSessionBead(incumbent, b)
+			continue
+		}
+		byName[sn] = b
+	}
+	return byName
+}
+
+func upsertOpenSessionBead(openBeads []beads.Bead, indexBySessionName map[string]int, b beads.Bead) []beads.Bead {
+	sn := strings.TrimSpace(b.Metadata["session_name"])
+	for i := range openBeads {
+		if openBeads[i].ID != b.ID {
+			continue
+		}
+		openBeads[i] = b
+		if sn != "" {
+			indexBySessionName[sn] = i
+		}
+		return openBeads
+	}
+	openBeads = append(openBeads, b)
+	if sn != "" {
+		indexBySessionName[sn] = len(openBeads) - 1
+	}
+	return openBeads
+}
+
 func stampResolvedProviderSessionMetadata(meta map[string]string, resolved *config.ResolvedProvider) {
 	if meta == nil || resolved == nil {
 		return
@@ -122,7 +225,38 @@ func preserveConfiguredNamedSessionBead(b beads.Bead, cfg *config.City, cityName
 	if !ok {
 		return false
 	}
-	return strings.TrimSpace(b.Metadata["session_name"]) == spec.SessionName
+	if strings.TrimSpace(b.Metadata["session_name"]) != spec.SessionName {
+		return false
+	}
+	// Identity match. Gate on terminal-ish state so a dead bead releases its
+	// alias instead of holding it forever (ga-ue1r / gm-0fl34g5 incident).
+	state := strings.TrimSpace(b.Metadata["state"])
+	switch state {
+	case "stopped":
+		// Deliberate sleep markers (city-stop, idle-timeout, drained,
+		// user-hold, wait-hold, context-churn, quarantine, no-wake-reason,
+		// config-drift) all signal "the runtime is gone but we plan to
+		// resume this bead" — hold the alias.
+		if strings.TrimSpace(b.Metadata["sleep_reason"]) != "" {
+			return true
+		}
+		// Race guard: preWakeCommit writes last_woke_at atomically before
+		// the runtime confirms started; state stays "stopped" until
+		// ConfirmStartedPatch. Mirror the precedent at city_runtime.go.
+		if lastWoke, ok := parseRFC3339Metadata(b.Metadata["last_woke_at"]); ok {
+			if time.Since(lastWoke) < staleCreatingStateTimeout {
+				return true
+			}
+		}
+		return false
+	case "failed-create":
+		// rollbackPendingCreate sets state="failed-create" only with
+		// Status=closed atomically. A Status=open + state="failed-create"
+		// combination means a write failed mid-rollback — release the
+		// alias so the next spawn can recover.
+		return false
+	}
+	return true
 }
 
 func reopenClosedConfiguredNamedSessionBead(
@@ -191,6 +325,16 @@ func reopenClosedConfiguredNamedSessionBead(
 			"pending_create_claim": pendingCreateClaim,
 			"synced_at":            now.Format("2006-01-02T15:04:05Z07:00"),
 		}
+		// Reset the pending-create stale clock to NOW. The bead row's
+		// CreatedAt reflects when it was first minted (potentially
+		// long ago); this reopen is a fresh spawn attempt, so the
+		// staleCreatingState window must start counting from here,
+		// not from CreatedAt.
+		if pendingCreateClaim == "true" {
+			batch["pending_create_started_at"] = pendingCreateStartedAtNow(now)
+		} else {
+			batch["pending_create_started_at"] = ""
+		}
 		for k, v := range extraMeta {
 			batch[k] = v
 		}
@@ -216,6 +360,7 @@ func reopenClosedConfiguredNamedSessionBead(
 
 func retireDuplicateConfiguredNamedSessionBeads(
 	store beads.Store,
+	rigStores map[string]beads.Store,
 	sp runtime.Provider,
 	cfg *config.City,
 	cityName string,
@@ -260,14 +405,9 @@ func retireDuplicateConfiguredNamedSessionBeads(
 			}
 			b := openBeads[idx]
 			oldSessionName := strings.TrimSpace(b.Metadata["session_name"])
-			running := false
-			if oldSessionName != "" && oldSessionName != winnerSessionName && sp != nil {
-				running, _ = workerSessionTargetRunningWithConfig("", store, sp, cfg, oldSessionName)
-			}
-			if running {
-				if err := workerKillSessionTargetWithConfig("", store, sp, cfg, oldSessionName); err != nil {
-					fmt.Fprintf(stderr, "session beads: stopping duplicate named session %q: %v\n", oldSessionName, err) //nolint:errcheck
-				}
+			if oldSessionName != "" && oldSessionName != winnerSessionName &&
+				!stopRuntimeBeforeSessionBeadMutation(store, sp, cfg, b, "duplicate named session", stderr) {
+				continue
 			}
 			batch := session.RetireNamedSessionPatch(now, "duplicate-repair", identity)
 			if setMetaBatch(store, b.ID, batch, stderr) != nil {
@@ -278,7 +418,7 @@ func retireDuplicateConfiguredNamedSessionBeads(
 				fmt.Fprintf(stderr, "session beads: archiving duplicate named session %s: %v\n", b.ID, err) //nolint:errcheck
 				continue
 			}
-			reassignWorkAssignedToRetiredSessionBead(store, b.ID, openBeads[winner].ID, stderr)
+			reassignWorkAssignedToRetiredSessionBead(store, rigStores, b, openBeads[winner].ID, stderr)
 			reassignStateAssignedToRetiredSessionBead(store, b.ID, openBeads[winner].ID, now, stderr)
 			if b.Metadata == nil {
 				b.Metadata = make(map[string]string, len(batch))
@@ -327,6 +467,7 @@ func namedSessionBeadWinsCanonicalRepair(candidate, incumbent beads.Bead, canoni
 
 func retireRemovedConfiguredNamedSessionBead(
 	store beads.Store,
+	rigStores map[string]beads.Store,
 	sp runtime.Provider,
 	b beads.Bead,
 	now time.Time,
@@ -335,15 +476,8 @@ func retireRemovedConfiguredNamedSessionBead(
 	if store == nil {
 		return false
 	}
-	oldSessionName := strings.TrimSpace(b.Metadata["session_name"])
-	running := false
-	if oldSessionName != "" && sp != nil {
-		running, _ = workerSessionTargetRunningWithConfig("", store, sp, nil, oldSessionName)
-	}
-	if running {
-		if err := workerKillSessionTargetWithConfig("", store, sp, nil, oldSessionName); err != nil {
-			fmt.Fprintf(stderr, "session beads: stopping removed named session %q: %v\n", oldSessionName, err) //nolint:errcheck
-		}
+	if !stopRuntimeBeforeSessionBeadMutation(store, sp, nil, b, "removed named session", stderr) {
+		return false
 	}
 	batch := session.RetireNamedSessionPatch(now, "removed-configured-named-session", namedSessionIdentity(b))
 	if setMetaBatch(store, b.ID, batch, stderr) != nil {
@@ -354,7 +488,7 @@ func retireRemovedConfiguredNamedSessionBead(
 		fmt.Fprintf(stderr, "session beads: archiving removed named session %s: %v\n", b.ID, err) //nolint:errcheck
 		return false
 	}
-	unclaimWorkAssignedToRetiredSessionBead(store, b.ID, retiredSessionFallbackRoute(b), stderr)
+	unclaimWorkAssignedToRetiredSessionBead(store, rigStores, b, retiredSessionFallbackRoute(b), stderr)
 	cancelStateAssignedToRetiredSessionBead(store, b.ID, now, stderr)
 	return true
 }
@@ -366,54 +500,139 @@ func retiredSessionFallbackRoute(b beads.Bead) string {
 	return strings.TrimSpace(b.Metadata["agent_name"])
 }
 
-func unclaimWorkAssignedToRetiredSessionBead(store beads.Store, sessionID, fallbackRoute string, stderr io.Writer) {
-	if store == nil || strings.TrimSpace(sessionID) == "" {
+func sessionAssignmentIdentifiers(sessionBead beads.Bead) []string {
+	raw := []string{
+		strings.TrimSpace(sessionBead.ID),
+		strings.TrimSpace(sessionBead.Metadata["session_name"]),
+		strings.TrimSpace(sessionBead.Metadata[namedSessionIdentityMetadata]),
+	}
+	seen := make(map[string]struct{}, len(raw))
+	identifiers := make([]string, 0, len(raw))
+	for _, id := range raw {
+		if id == "" {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		identifiers = append(identifiers, id)
+	}
+	return identifiers
+}
+
+func workAssignmentStores(store beads.Store, rigStores map[string]beads.Store) []beads.Store {
+	if store == nil {
+		return nil
+	}
+	stores := []beads.Store{store}
+	if len(rigStores) == 0 {
+		return stores
+	}
+	names := make([]string, 0, len(rigStores))
+	for name, rs := range rigStores {
+		if rs == nil {
+			continue
+		}
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		stores = append(stores, rigStores[name])
+	}
+	return stores
+}
+
+func unclaimWorkAssignedToRetiredSessionBead(
+	store beads.Store,
+	rigStores map[string]beads.Store,
+	sessionBead beads.Bead,
+	fallbackRoute string,
+	stderr io.Writer,
+) {
+	if store == nil || strings.TrimSpace(sessionBead.ID) == "" {
 		return
 	}
 	if stderr == nil {
 		stderr = io.Discard
 	}
 	empty := ""
-	for _, status := range []string{"open", "in_progress"} {
-		work, err := store.List(beads.ListQuery{Assignee: sessionID, Status: status, Live: true})
-		if err != nil {
-			fmt.Fprintf(stderr, "session beads: listing work assigned to retired session %s: %v\n", sessionID, err) //nolint:errcheck
-			continue
-		}
-		for _, item := range work {
-			if session.IsSessionBeadOrRepairable(item) {
-				continue
-			}
-			update := beads.UpdateOpts{Assignee: &empty}
-			if fallbackRoute != "" && strings.TrimSpace(item.Metadata["gc.routed_to"]) == "" {
-				update.Metadata = map[string]string{"gc.routed_to": fallbackRoute}
-			}
-			if err := store.Update(item.ID, update); err != nil {
-				fmt.Fprintf(stderr, "session beads: unclaiming work %s assigned to retired session %s: %v\n", item.ID, sessionID, err) //nolint:errcheck
+	open := "open"
+	identifiers := sessionAssignmentIdentifiers(sessionBead)
+	seen := make(map[string]struct{})
+	for storeIndex, ownerStore := range workAssignmentStores(store, rigStores) {
+		for _, status := range []string{"open", "in_progress"} {
+			for _, assignee := range identifiers {
+				work, err := ownerStore.List(beads.ListQuery{Assignee: assignee, Status: status, Live: true})
+				if err != nil {
+					fmt.Fprintf(stderr, "session beads: listing work assigned to retired session %s via %q: %v\n", sessionBead.ID, assignee, err) //nolint:errcheck
+					continue
+				}
+				for _, item := range work {
+					if session.IsSessionBeadOrRepairable(item) {
+						continue
+					}
+					key := strconv.Itoa(storeIndex) + "\x00" + item.ID
+					if _, ok := seen[key]; ok {
+						continue
+					}
+					seen[key] = struct{}{}
+					update := beads.UpdateOpts{Assignee: &empty}
+					// Clearing assignee on an in_progress bead leaves it invisible to
+					// the work_query: Tier 1 needs an assignee match, Tiers 2/3 only
+					// match "ready" status. Reset to "open" so a fresh worker can
+					// re-claim via the routed queue (gc.routed_to + --unassigned).
+					if item.Status == "in_progress" {
+						update.Status = &open
+					}
+					if fallbackRoute != "" && strings.TrimSpace(item.Metadata["gc.routed_to"]) == "" {
+						update.Metadata = map[string]string{"gc.routed_to": fallbackRoute}
+					}
+					if err := ownerStore.Update(item.ID, update); err != nil {
+						fmt.Fprintf(stderr, "session beads: unclaiming work %s assigned to retired session %s: %v\n", item.ID, sessionBead.ID, err) //nolint:errcheck
+					}
+				}
 			}
 		}
 	}
 }
 
-func reassignWorkAssignedToRetiredSessionBead(store beads.Store, oldSessionID, newSessionID string, stderr io.Writer) {
-	if store == nil || strings.TrimSpace(oldSessionID) == "" || strings.TrimSpace(newSessionID) == "" {
+func reassignWorkAssignedToRetiredSessionBead(
+	store beads.Store,
+	rigStores map[string]beads.Store,
+	retiredSession beads.Bead,
+	newSessionID string,
+	stderr io.Writer,
+) {
+	if store == nil || strings.TrimSpace(retiredSession.ID) == "" || strings.TrimSpace(newSessionID) == "" {
 		return
 	}
 	if stderr == nil {
 		stderr = io.Discard
 	}
-	for _, status := range []string{"open", "in_progress"} {
-		work, err := store.List(beads.ListQuery{Assignee: oldSessionID, Status: status, Live: true})
-		if err != nil {
-			fmt.Fprintf(stderr, "session beads: listing work assigned to retired session %s: %v\n", oldSessionID, err) //nolint:errcheck
-			continue
-		}
-		for _, item := range work {
-			if session.IsSessionBeadOrRepairable(item) {
-				continue
-			}
-			if err := store.Update(item.ID, beads.UpdateOpts{Assignee: &newSessionID}); err != nil {
-				fmt.Fprintf(stderr, "session beads: reassigning work %s from retired session %s to %s: %v\n", item.ID, oldSessionID, newSessionID, err) //nolint:errcheck
+	identifiers := sessionAssignmentIdentifiers(retiredSession)
+	seen := make(map[string]struct{})
+	for storeIndex, ownerStore := range workAssignmentStores(store, rigStores) {
+		for _, status := range []string{"open", "in_progress"} {
+			for _, assignee := range identifiers {
+				work, err := ownerStore.List(beads.ListQuery{Assignee: assignee, Status: status, Live: true})
+				if err != nil {
+					fmt.Fprintf(stderr, "session beads: listing work assigned to retired session %s via %q: %v\n", retiredSession.ID, assignee, err) //nolint:errcheck
+					continue
+				}
+				for _, item := range work {
+					if session.IsSessionBeadOrRepairable(item) {
+						continue
+					}
+					key := strconv.Itoa(storeIndex) + "\x00" + item.ID
+					if _, ok := seen[key]; ok {
+						continue
+					}
+					seen[key] = struct{}{}
+					if err := ownerStore.Update(item.ID, beads.UpdateOpts{Assignee: &newSessionID}); err != nil {
+						fmt.Fprintf(stderr, "session beads: reassigning work %s from retired session %s to %s: %v\n", item.ID, retiredSession.ID, newSessionID, err) //nolint:errcheck
+					}
+				}
 			}
 		}
 	}
@@ -477,8 +696,8 @@ func syncSessionBeads(
 	stderr io.Writer,
 	skipClose bool,
 ) map[string]string {
-	openIndex, _ := syncSessionBeadsWithSnapshot(
-		cityPath, store, desiredState, sp, configuredNames, cfg, clk, stderr, skipClose, nil,
+	openIndex, _ := syncSessionBeadsWithSnapshotAndRigStores(
+		cityPath, store, nil, desiredState, sp, configuredNames, cfg, clk, stderr, skipClose, nil,
 	)
 	return openIndex
 }
@@ -494,6 +713,24 @@ func syncSessionBeadsWithSnapshot(
 	stderr io.Writer,
 	skipClose bool,
 	sessionBeads *sessionBeadSnapshot,
+) (map[string]string, *sessionBeadSnapshot) {
+	return syncSessionBeadsWithSnapshotAndRigStores(
+		cityPath, store, nil, desiredState, sp, configuredNames, cfg, clk, stderr, skipClose, sessionBeads,
+	)
+}
+
+func syncSessionBeadsWithSnapshotAndRigStores(
+	cityPath string,
+	store beads.Store,
+	rigStores map[string]beads.Store,
+	desiredState map[string]TemplateParams,
+	sp runtime.Provider,
+	configuredNames map[string]bool,
+	cfg *config.City,
+	clk clock.Clock,
+	stderr io.Writer,
+	skipClose bool,
+	sessionBeads *sessionBeadSnapshot,
 ) (map[string]string, *sessionBeadSnapshot) {
 	if store == nil {
 		return nil, nil
@@ -531,24 +768,25 @@ func syncSessionBeadsWithSnapshot(
 	indexBySessionName := make(map[string]int, len(existing))
 	openBeads := make([]beads.Bead, len(existing))
 	copy(openBeads, existing)
-	for _, b := range existing {
-		if b.Status == "closed" {
-			continue
-		}
-		if sn := b.Metadata["session_name"]; sn != "" {
-			bySessionName[sn] = b
-		}
-	}
 	for i, b := range openBeads {
 		if b.Status == "closed" {
 			continue
 		}
-		if sn := b.Metadata["session_name"]; sn != "" {
+		if sn := strings.TrimSpace(b.Metadata["session_name"]); sn != "" {
+			if incumbent, ok := bySessionName[sn]; ok {
+				winner := canonicalDuplicateSessionBead(incumbent, b)
+				bySessionName[sn] = winner
+				if winner.ID == b.ID {
+					indexBySessionName[sn] = i
+				}
+				continue
+			}
+			bySessionName[sn] = b
 			indexBySessionName[sn] = i
 		}
 	}
 
-	// Close duplicate open beads: only the last bead per session_name
+	// Close duplicate open beads: only the canonical bead per session_name
 	// (the one in bySessionName) should remain open. This prevents bead
 	// accumulation when multiple beads are created for the same session
 	// across restarts or config-drift cycles.
@@ -562,7 +800,7 @@ func syncSessionBeadsWithSnapshot(
 		}
 		canonical, ok := bySessionName[sn]
 		if ok && canonical.ID != b.ID {
-			if closeBead(store, b.ID, "duplicate", clk.Now().UTC(), stderr) {
+			if closeSessionBeadIfUnassigned(store, rigStores, b, "duplicate", clk.Now().UTC(), stderr) {
 				openBeads[i].Status = "closed"
 			}
 		}
@@ -570,10 +808,31 @@ func syncSessionBeadsWithSnapshot(
 
 	// Track open bead IDs for the returned index.
 	openIndex := make(map[string]string, len(desiredState))
+	desiredNames := make(map[string]bool, len(desiredState))
+	for sn := range desiredState {
+		desiredNames[sn] = true
+	}
 
 	now := clk.Now().UTC()
 	cityName := config.EffectiveCityName(cfg, filepath.Base(cityPath))
+	var (
+		visibleBySessionName map[string]beads.Bead
+		visibleLoaded        bool
+	)
+	loadVisibleBySessionName := func() (map[string]beads.Bead, error) {
+		if visibleLoaded {
+			return visibleBySessionName, nil
+		}
+		open, err := loadSessionBeads(store)
+		if err != nil {
+			return nil, err
+		}
+		visibleBySessionName = indexSessionBeadsByName(open)
+		visibleLoaded = true
+		return visibleBySessionName, nil
+	}
 
+	blockedReconfiguredNamedIdentities := map[string]bool{}
 	if cfg != nil {
 		for i, b := range openBeads {
 			if b.Status == "closed" || !isNamedSessionBead(b) {
@@ -587,21 +846,15 @@ func syncSessionBeadsWithSnapshot(
 			if strings.TrimSpace(b.Metadata["session_name"]) == spec.SessionName {
 				continue
 			}
-			if closeBead(store, b.ID, "reconfigured", now, stderr) {
-				if sn := strings.TrimSpace(b.Metadata["session_name"]); sn != "" {
-					running, _ := workerSessionTargetRunningWithConfig("", store, sp, cfg, sn)
-					if running {
-						if err := workerKillSessionTargetWithConfig("", store, sp, cfg, sn); err != nil {
-							fmt.Fprintf(stderr, "session beads: stopping drifted named session %q: %v\n", sn, err) //nolint:errcheck
-						}
-					}
-				}
-				existing[i].Status = "closed"
-				openBeads[i].Status = "closed"
+			if !closeSessionBeadIfRuntimeStoppedAndUnassigned(store, rigStores, sp, cfg, b, "reconfigured", "reconfigured named session", now, stderr) {
+				blockedReconfiguredNamedIdentities[identity] = true
+				continue
 			}
+			existing[i].Status = "closed"
+			openBeads[i].Status = "closed"
 		}
 		openBeads = retireDuplicateConfiguredNamedSessionBeads(
-			store, sp, cfg, cityName, openBeads, bySessionName, indexBySessionName, now, stderr,
+			store, rigStores, sp, cfg, cityName, openBeads, bySessionName, indexBySessionName, now, stderr,
 		)
 	}
 
@@ -610,29 +863,55 @@ func syncSessionBeadsWithSnapshot(
 		liveHash := runtime.LiveFingerprint(agentCfg)
 		managedAlias := strings.TrimSpace(tp.Alias)
 		isConfiguredNamed := strings.TrimSpace(tp.ConfiguredNamedIdentity) != ""
-		origin := templateParamsSessionOrigin(tp)
-
-		// Use provider for liveness check (includes zombie detection).
-		state := "stopped"
-		alive, _ := workerSessionTargetAliveWithConfig(store, sp, cfg, sn, tp.Hints.ProcessNames)
-		if alive {
-			state = "active"
+		if isConfiguredNamed && blockedReconfiguredNamedIdentities[strings.TrimSpace(tp.ConfiguredNamedIdentity)] {
+			continue
 		}
+		origin := templateParamsSessionOrigin(tp)
 
 		agentName := tp.TemplateName
 		// For pool instances, use the qualified instance name as the agent_name.
-		if slot := resolvePoolSlot(tp.InstanceName, tp.TemplateName); slot > 0 {
+		poolSlot := tp.PoolSlot
+		if poolSlot <= 0 {
+			poolSlot = resolvePoolSlot(tp.InstanceName, tp.TemplateName)
+		}
+		if poolSlot > 0 {
 			agentName = tp.InstanceName
 		} else if tp.InstanceName != "" && tp.InstanceName != tp.TemplateName {
 			agentName = tp.InstanceName
 		}
 		isManagedPool := origin == "ephemeral"
+		isPoolInstance := poolSlot > 0
 
 		b, exists := bySessionName[sn]
+		if !exists && isPoolInstance {
+			visible, err := loadVisibleBySessionName()
+			if err != nil {
+				fmt.Fprintf(stderr, "session beads: reloading visible bead for %s: %v\n", sn, err) //nolint:errcheck
+			} else if recovered, ok := visible[sn]; ok {
+				b = recovered
+				exists = true
+				bySessionName[sn] = recovered
+				fmt.Fprintf(stderr, "session beads: recovered visible owner %s for session_name %q from store\n", recovered.ID, sn) //nolint:errcheck
+				for i, open := range openBeads {
+					if open.Status == "closed" || open.ID == recovered.ID {
+						continue
+					}
+					if strings.TrimSpace(open.Metadata["session_name"]) != sn {
+						continue
+					}
+					if closeSessionBeadIfUnassigned(store, rigStores, open, "duplicate", now, stderr) {
+						openBeads[i].Status = "closed"
+					}
+				}
+				openBeads = upsertOpenSessionBead(openBeads, indexBySessionName, recovered)
+			}
+		}
+		state := syncSessionCachedState(sn, b, exists, sp)
 		if !exists && isConfiguredNamed {
 			if reopened, ok := reopenClosedConfiguredNamedSessionBead(cityPath, store, cfg, cityName, tp.ConfiguredNamedIdentity, sn, state, now, nil, stderr); ok {
 				b = reopened
 				exists = true
+				state = syncSessionCachedState(sn, b, exists, sp)
 				bySessionName[sn] = reopened
 				openBeads = append(openBeads, reopened)
 				indexBySessionName[sn] = len(openBeads) - 1
@@ -640,19 +919,27 @@ func syncSessionBeadsWithSnapshot(
 		}
 		if !exists {
 			// Create a new session bead.
+			createState := state
+			if createState != "active" {
+				createState = "creating"
+			}
+			instanceToken := session.NewInstanceToken()
 			meta := map[string]string{
-				"session_name":       sn,
 				"agent_name":         agentName,
 				"live_hash":          liveHash,
 				"session_origin":     origin,
 				"generation":         strconv.Itoa(session.DefaultGeneration),
 				"continuation_epoch": strconv.Itoa(session.DefaultContinuationEpoch),
-				"instance_token":     session.NewInstanceToken(),
-				"state":              state,
+				"instance_token":     instanceToken,
+				"state":              createState,
 				"synced_at":          now.Format("2006-01-02T15:04:05Z07:00"),
 			}
-			if state != "active" {
+			if !isPoolInstance {
+				meta["session_name"] = sn
+			}
+			if createState != "active" {
 				meta["pending_create_claim"] = "true"
+				meta["pending_create_started_at"] = pendingCreateStartedAtNow(now)
 			}
 			if tp.DependencyOnly {
 				meta["dependency_only"] = boolMetadata(true)
@@ -681,15 +968,14 @@ func syncSessionBeadsWithSnapshot(
 			}
 			// Store the qualified template name so the API can derive the
 			// rig from it (e.g., "tower-of-hanoi/polecat" not just "polecat").
+			qualifiedTemplate := tp.TemplateName
 			if tp.RigName != "" && !strings.Contains(tp.TemplateName, "/") {
-				meta["template"] = tp.RigName + "/" + tp.TemplateName
-			} else {
-				meta["template"] = tp.TemplateName
+				qualifiedTemplate = tp.RigName + "/" + tp.TemplateName
 			}
-			if tp.PoolSlot > 0 {
-				meta["pool_slot"] = strconv.Itoa(tp.PoolSlot)
-			} else if slot := resolvePoolSlot(tp.InstanceName, tp.TemplateName); slot > 0 {
-				meta["pool_slot"] = strconv.Itoa(slot)
+			meta["template"] = qualifiedTemplate
+			if poolSlot > 0 {
+				meta["pool_slot"] = strconv.Itoa(poolSlot)
+				meta["session_name"] = pendingPoolSessionName(qualifiedTemplate, instanceToken)
 			}
 			// Store command and resume fields so gc session attach can
 			// reconstruct the resume command from bead metadata alone.
@@ -762,11 +1048,29 @@ func syncSessionBeadsWithSnapshot(
 			if createErr != nil {
 				fmt.Fprintf(stderr, "session beads: creating bead for %s: %v\n", agentName, createErr) //nolint:errcheck
 			} else {
-				openIndex[sn] = newBead.ID
+				createdSessionName := strings.TrimSpace(newBead.Metadata["session_name"])
+				if isPoolInstance {
+					createdSessionName = PoolSessionName(qualifiedTemplate, newBead.ID)
+					if err := store.SetMetadata(newBead.ID, "session_name", createdSessionName); err != nil {
+						fmt.Fprintf(stderr, "session beads: setting pool session_name for %s: %v\n", agentName, err) //nolint:errcheck
+						closeFailedCreateBead(store, newBead.ID, now, stderr)
+						continue
+					}
+					if newBead.Metadata == nil {
+						newBead.Metadata = make(map[string]string, 1)
+					}
+					newBead.Metadata["session_name"] = createdSessionName
+				}
+				if createdSessionName == "" {
+					createdSessionName = sn
+				}
+				desiredNames[createdSessionName] = true
+				openIndex[createdSessionName] = newBead.ID
 				openBeads = append(openBeads, newBead)
-				indexBySessionName[sn] = len(openBeads) - 1
+				bySessionName[createdSessionName] = newBead
+				indexBySessionName[createdSessionName] = len(openBeads) - 1
 				if liveAlias := strings.TrimSpace(meta["alias"]); liveAlias != "" && state == "active" {
-					if err := session.SyncRuntimeAlias(sp, sn, liveAlias); err != nil {
+					if err := session.SyncRuntimeAlias(sp, createdSessionName, liveAlias); err != nil {
 						fmt.Fprintf(stderr, "session beads: syncing runtime alias %q for %s: %v\n", liveAlias, agentName, err) //nolint:errcheck
 					}
 				}
@@ -786,9 +1090,18 @@ func syncSessionBeadsWithSnapshot(
 		// per-key writes are expensive enough to stall unrelated reconciler
 		// work during city startup.
 		batch := map[string]string{}
+		aliasGuardedBatch := map[string]string{}
 		queueMeta := func(key, value string) {
 			batch[key] = value
 		}
+		queueAliasGuardedMeta := func(key, value string) {
+			aliasGuardedBatch[key] = value
+		}
+		mergeAliasGuardedBatch := func() {
+			for key, value := range aliasGuardedBatch {
+				queueMeta(key, value)
+			}
+		}
 
 		// Backfill template and pool_slot metadata for beads created
 		// before Phase 2f. Also upgrade unqualified template names to
@@ -814,11 +1127,16 @@ func syncSessionBeadsWithSnapshot(
 				queueMeta("pool_slot", "")
 			}
 		}
+		needsAliasSync := b.Metadata["alias"] != managedAlias
 		if b.Metadata["pool_slot"] == "" {
+			queuePoolSlotMeta := queueMeta
+			if needsAliasSync && isManagedPool && isPoolInstance {
+				queuePoolSlotMeta = queueAliasGuardedMeta
+			}
 			if tp.PoolSlot > 0 {
-				queueMeta("pool_slot", strconv.Itoa(tp.PoolSlot))
+				queuePoolSlotMeta("pool_slot", strconv.Itoa(tp.PoolSlot))
 			} else if slot := resolvePoolSlot(tp.InstanceName, tp.TemplateName); slot > 0 {
-				queueMeta("pool_slot", strconv.Itoa(slot))
+				queuePoolSlotMeta("pool_slot", strconv.Itoa(slot))
 			}
 		}
 		existingAgentName := strings.TrimSpace(b.Metadata["agent_name"])
@@ -832,14 +1150,18 @@ func syncSessionBeadsWithSnapshot(
 				// Legacy active sessions are still running in their original
 				// work_dir. Don't repoint metadata until the session stops.
 				if !legacyNeedsConcreteIdentity || state != "active" {
-					queueMeta("work_dir", tp.WorkDir)
+					if legacyNeedsConcreteIdentity {
+						queueAliasGuardedMeta("work_dir", tp.WorkDir)
+					} else {
+						queueMeta("work_dir", tp.WorkDir)
+					}
 				}
 			case legacyNeedsConcreteIdentity && b.Metadata["work_dir"] != tp.WorkDir && state != "active":
-				queueMeta("work_dir", tp.WorkDir)
+				queueAliasGuardedMeta("work_dir", tp.WorkDir)
 			}
 		}
 		if legacyNeedsConcreteIdentity && agentName != "" {
-			queueMeta("agent_name", agentName)
+			queueAliasGuardedMeta("agent_name", agentName)
 		}
 		if b.Metadata["dependency_only"] != boolMetadata(tp.DependencyOnly) {
 			queueMeta("dependency_only", boolMetadata(tp.DependencyOnly))
@@ -865,7 +1187,6 @@ func syncSessionBeadsWithSnapshot(
 				queueMeta(namedSessionModeMetadata, "")
 			}
 		}
-		needsAliasSync := b.Metadata["alias"] != managedAlias
 		if b.Metadata["wake_mode"] != tp.WakeMode {
 			queueMeta("wake_mode", tp.WakeMode)
 		}
@@ -947,6 +1268,26 @@ func syncSessionBeadsWithSnapshot(
 				setMeta(store, b.ID, "synced_at", now.Format("2006-01-02T15:04:05Z07:00"), stderr) //nolint:errcheck
 			}
 		}
+		clearAliasConflict := func() {
+			if b.Metadata[poolAliasConflictMetadataKey] != "" {
+				queueMeta(poolAliasConflictMetadataKey, "")
+			}
+			if b.Metadata[poolAliasConflictCountMetadataKey] != "" {
+				queueMeta(poolAliasConflictCountMetadataKey, "")
+			}
+			if b.Metadata[poolAliasConflictAtMetadataKey] != "" {
+				queueMeta(poolAliasConflictAtMetadataKey, "")
+			}
+		}
+		recordAliasConflict := func() {
+			count := 0
+			if existing, err := strconv.Atoi(strings.TrimSpace(b.Metadata[poolAliasConflictCountMetadataKey])); err == nil && existing > 0 {
+				count = existing
+			}
+			queueMeta(poolAliasConflictMetadataKey, managedAlias)
+			queueMeta(poolAliasConflictCountMetadataKey, strconv.Itoa(count+1))
+			queueMeta(poolAliasConflictAtMetadataKey, now.Format(time.RFC3339))
+		}
 		if needsAliasSync {
 			lockAlias := managedAlias
 			if lockAlias == "" {
@@ -961,11 +1302,14 @@ func syncSessionBeadsWithSnapshot(
 					err = session.EnsureAliasAvailableWithConfig(store, cfg, managedAlias, b.ID)
 				}
 				if err != nil {
+					recordAliasConflict()
 					fmt.Fprintf(stderr, "session beads: alias %q for %s unavailable: %v\n", managedAlias, agentName, err) //nolint:errcheck
 				} else {
+					clearAliasConflict()
 					for key, value := range session.UpdatedAliasMetadata(b.Metadata, managedAlias) {
 						queueMeta(key, value)
 					}
+					mergeAliasGuardedBatch()
 				}
 				applyBatch()
 				appliedWithLock = true
@@ -978,6 +1322,10 @@ func syncSessionBeadsWithSnapshot(
 				continue
 			}
 		}
+		if !needsAliasSync {
+			clearAliasConflict()
+			mergeAliasGuardedBatch()
+		}
 		applyBatch()
 	}
 	openBeads = syncDesiredPoolSlots(store, desiredState, openBeads, indexBySessionName, cfg, now, stderr)
@@ -989,7 +1337,7 @@ func syncSessionBeadsWithSnapshot(
 			if sn == "" {
 				continue
 			}
-			if _, hasDesired := desiredState[sn]; hasDesired {
+			if desiredNames[sn] {
 				continue
 			}
 			if b.Status == "closed" {
@@ -998,7 +1346,7 @@ func syncSessionBeadsWithSnapshot(
 			if isNamedSessionBead(b) {
 				identity := namedSessionIdentity(b)
 				if identity != "" && (cfg == nil || config.FindNamedSession(cfg, identity) == nil) {
-					if retireRemovedConfiguredNamedSessionBead(store, sp, b, now, stderr) {
+					if retireRemovedConfiguredNamedSessionBead(store, rigStores, sp, b, now, stderr) {
 						if idx, ok := indexBySessionName[sn]; ok {
 							openBeads[idx].Status = "open"
 							if openBeads[idx].Metadata == nil {
@@ -1022,7 +1370,7 @@ func syncSessionBeadsWithSnapshot(
 				continue
 			}
 			if configuredNames[sn] {
-				if closeBead(store, b.ID, "suspended", now, stderr) {
+				if closeSessionBeadIfRuntimeStoppedAndUnassigned(store, rigStores, sp, cfg, b, "suspended", "suspended session", now, stderr) {
 					if idx, ok := indexBySessionName[sn]; ok {
 						openBeads[idx].Status = "closed"
 					}
@@ -1036,7 +1384,7 @@ func syncSessionBeadsWithSnapshot(
 						}
 					}
 				}
-				if closeBead(store, b.ID, "orphaned", now, stderr) {
+				if closeSessionBeadIfRuntimeStoppedAndUnassigned(store, rigStores, sp, cfg, b, "orphaned", "orphaned session", now, stderr) {
 					if idx, ok := indexBySessionName[sn]; ok {
 						openBeads[idx].Status = "closed"
 					}
@@ -1077,6 +1425,7 @@ func syncDesiredPoolSlots(
 	}
 
 	for template, names := range desiredByTemplate {
+		agentCfg := findAgentByTemplate(cfg, template)
 		sort.Strings(names)
 		usedSlots := make(map[int]string)
 		slotByName := make(map[string]int, len(names))
@@ -1085,8 +1434,13 @@ func syncDesiredPoolSlots(
 			if !ok {
 				continue
 			}
-			slot, _ := strconv.Atoi(openBeads[idx].Metadata["pool_slot"])
-			if slot <= 0 || slot > len(names) || usedSlots[slot] != "" {
+			bead := openBeads[idx]
+			tp := desiredState[sn]
+			if tp.Alias != "" && bead.Metadata["alias"] != tp.Alias {
+				continue
+			}
+			slot := existingPoolSlotWithConfig(cfg, agentCfg, openBeads[idx])
+			if slot <= 0 || usedSlots[slot] != "" {
 				continue
 			}
 			usedSlots[slot] = sn
@@ -1111,6 +1465,10 @@ func syncDesiredPoolSlots(
 				continue
 			}
 			bead := openBeads[idx]
+			tp := desiredState[sn]
+			if tp.Alias != "" && bead.Metadata["alias"] != tp.Alias {
+				continue
+			}
 			wantSlot := strconv.Itoa(slotByName[sn])
 			batch := map[string]string{}
 			if bead.Metadata[poolManagedMetadataKey] != boolMetadata(true) {
@@ -1205,13 +1563,38 @@ func setMetaBatch(store beads.Store, id string, batch map[string]string, stderr
 	return nil
 }
 
-// reapStaleSessionBeads cross-references open session beads against live
-// tmux sessions. If a bead claims a session_name but no matching tmux
-// session exists, and the bead has been in that state past the startup
-// grace period, the bead is closed.
+func closeFailedCreateBead(store beads.Store, id string, now time.Time, stderr io.Writer) bool {
+	patch := session.ClosePatch(now.UTC(), "failed-create")
+	patch["pending_create_claim"] = ""
+	patch["pending_create_started_at"] = ""
+	if setMetaBatch(store, id, patch, stderr) != nil {
+		return false
+	}
+	if err := store.Close(id); err != nil {
+		fmt.Fprintf(stderr, "session beads: closing failed-create bead %s: %v\n", id, err) //nolint:errcheck
+		return false
+	}
+	return true
+}
+
+// reapStaleSessionBeads closes beads whose runtime is gone while startup is
+// still incomplete. cleanupDeadRuntimeSessionCorpses handles the inverse
+// mismatch: open beads whose runtime artifact is visible but confirmed dead.
+//
+// This function only targets session beads stuck in the creating state past the
+// startup grace period — sessions whose tmux process never completed startup,
+// so they are guaranteed not to hold work claims (claim is the first thing a
+// worker does after startup).
 //
-// This prevents infinite retry loops where a dead tmux session's bead
-// blocks name availability for new sessions (see #742).
+// Sessions that completed startup (state=active, awake, etc.) are NEVER reaped
+// here even if their tmux session has died: they may hold in_progress claims,
+// and reaping would orphan that work without a way for the reconciler to
+// recover via the assignee-keyed wake path. The session lifecycle reconciler
+// is responsible for restarting completed-but-dead session beads so the
+// original assignee resumes its work.
+//
+// This prevents infinite retry loops for stuck-creating sessions while
+// preserving claim continuity across tmux death+restart for active ones.
 //
 // Returns the number of beads reaped.
 func reapStaleSessionBeads(
@@ -1236,8 +1619,14 @@ func reapStaleSessionBeads(
 		if sn == "" {
 			continue
 		}
-		// Don't reap beads whose tmux session hasn't been started yet.
-		if b.Metadata["state"] == "creating" || strings.TrimSpace(b.Metadata["pending_create_claim"]) == "true" {
+		// Only reap beads stuck in the creating state after their one-shot
+		// pending_create_claim has already been cleared. The pending create
+		// claim is authoritative across the lifecycle model: it keeps an
+		// in-flight or partially-healed start eligible for retry even when
+		// the bead's cached state has already moved past creating.
+		state := strings.TrimSpace(b.Metadata["state"])
+		pendingCreate := strings.TrimSpace(b.Metadata["pending_create_claim"]) == "true"
+		if state != "creating" || pendingCreate {
 			continue
 		}
 		// Don't reap beads with an active drain — the drainTracker is
@@ -1246,23 +1635,180 @@ func reapStaleSessionBeads(
 		if dt != nil && dt.get(b.ID) != nil {
 			continue
 		}
+		// Configured named-session beads are controller-owned identities.
+		// They may legitimately be stopped between supervisor restarts; the
+		// named-session reconciler is responsible for preserving, waking, or
+		// retiring them after desired state is rebuilt from config.
+		if isNamedSessionBead(b) {
+			continue
+		}
 		// Session is alive — nothing to reap.
 		if sp.IsRunning(sn) {
 			continue
 		}
 		// Startup grace: don't reap beads younger than the creating-state
-		// timeout. Zero CreatedAt means unknown age — skip conservatively.
-		if b.CreatedAt.IsZero() || now.Sub(b.CreatedAt) < staleCreatingStateTimeout {
+		// timeout. Use the latest known start boundary, not just CreatedAt,
+		// because a long-lived bead may have been woken moments ago.
+		// Zero CreatedAt means unknown age — skip conservatively.
+		startedAt, ok := staleReapStartBoundary(b)
+		if !ok || now.Sub(startedAt) < staleCreatingStateTimeout {
 			continue
 		}
 		if closeBead(store, b.ID, "stale-session", now.UTC(), stderr) {
-			fmt.Fprintf(stderr, "WARN: reconciler: reaped stale session bead %s — tmux session %q not found\n", b.ID, sn) //nolint:errcheck
+			fmt.Fprintf(stderr, "WARN: reconciler: reaped stuck-creating session bead %s — tmux session %q not found\n", b.ID, sn) //nolint:errcheck
 			reaped++
 		}
 	}
 	return reaped
 }
 
+func cleanupDeadRuntimeSessionCorpses(
+	sessionBeads *sessionBeadSnapshot,
+	dt *drainTracker,
+	sp runtime.Provider,
+	stderr io.Writer,
+) int {
+	if sessionBeads == nil || sp == nil {
+		return 0
+	}
+	deadChecker, ok := sp.(runtime.DeadRuntimeSessionChecker)
+	if !ok {
+		return 0
+	}
+	visible, err := sp.ListRunning("")
+	partialList := runtime.IsPartialListError(err)
+	if err != nil && !partialList {
+		fmt.Fprintf(stderr, "session reconciler: listing runtime sessions for dead cleanup: %v\n", err) //nolint:errcheck
+		return 0
+	}
+	if partialList {
+		fmt.Fprintf(stderr, "session reconciler: listing runtime sessions partially failed for dead cleanup; checking %d visible session(s): %v\n", len(visible), err) //nolint:errcheck
+	}
+	if len(visible) == 0 {
+		return 0
+	}
+	visibleSet := make(map[string]bool, len(visible))
+	for _, name := range visible {
+		name = strings.TrimSpace(name)
+		if name != "" {
+			visibleSet[name] = true
+		}
+	}
+	if len(visibleSet) == 0 {
+		return 0
+	}
+
+	cleaned := 0
+	seen := make(map[string]bool)
+	for _, b := range sessionBeads.Open() {
+		pendingCreate := strings.TrimSpace(b.Metadata["pending_create_claim"]) == "true"
+		if pendingCreate || (dt != nil && dt.get(b.ID) != nil) || isNamedSessionBead(b) {
+			continue
+		}
+		name := strings.TrimSpace(b.Metadata["session_name"])
+		if name == "" || seen[name] || !visibleSet[name] {
+			continue
+		}
+		seen[name] = true
+		dead, err := deadChecker.IsDeadRuntimeSession(name)
+		if err != nil {
+			fmt.Fprintf(stderr, "session reconciler: confirming dead runtime session %s: %v\n", name, err) //nolint:errcheck
+			continue
+		}
+		if !dead {
+			continue
+		}
+		if err := sp.Stop(name); err != nil {
+			if runtime.IsSessionGone(err) {
+				continue
+			}
+			fmt.Fprintf(stderr, "session reconciler: cleaning dead runtime session %s: %v\n", name, err) //nolint:errcheck
+			continue
+		}
+		fmt.Fprintf(stderr, "session reconciler: cleaned dead runtime session %s\n", name) //nolint:errcheck
+		cleaned++
+	}
+	return cleaned
+}
+
+func closeSessionBeadIfRuntimeStoppedAndUnassigned(
+	store beads.Store,
+	rigStores map[string]beads.Store,
+	sp runtime.Provider,
+	cfg *config.City,
+	b beads.Bead,
+	closeReason string,
+	stopReason string,
+	now time.Time,
+	stderr io.Writer,
+) bool {
+	if stderr == nil {
+		stderr = io.Discard
+	}
+	hasAssignedWork, err := sessionHasOpenAssignedWork(store, rigStores, b)
+	if err != nil {
+		fmt.Fprintf(stderr, "session work guard: checking assigned work for %s: %v\n", b.ID, err) //nolint:errcheck
+		return false
+	}
+	if hasAssignedWork {
+		return false
+	}
+	if !stopRuntimeBeforeSessionBeadMutation(store, sp, cfg, b, stopReason, stderr) {
+		return false
+	}
+	hasAssignedWork, err = sessionHasOpenAssignedWork(store, rigStores, b)
+	if err != nil {
+		fmt.Fprintf(stderr, "session work guard: checking assigned work for %s: %v\n", b.ID, err) //nolint:errcheck
+		return false
+	}
+	if hasAssignedWork {
+		return false
+	}
+	return closeBead(store, b.ID, closeReason, now, stderr)
+}
+
+func stopRuntimeBeforeSessionBeadMutation(
+	store beads.Store,
+	sp runtime.Provider,
+	cfg *config.City,
+	b beads.Bead,
+	reason string,
+	stderr io.Writer,
+) bool {
+	if stderr == nil {
+		stderr = io.Discard
+	}
+	sessionName := strings.TrimSpace(b.Metadata["session_name"])
+	if sessionName == "" || sp == nil {
+		return true
+	}
+	if !sp.IsRunning(sessionName) {
+		return true
+	}
+	if err := workerKillSessionTargetWithConfig("", store, sp, cfg, sessionName); err != nil {
+		fmt.Fprintf(stderr, "session beads: stopping %s %q (bead %s): %v\n", reason, sessionName, b.ID, err) //nolint:errcheck
+		return false
+	}
+	if sp.IsRunning(sessionName) {
+		fmt.Fprintf(stderr, "session beads: stopping %s %q (bead %s): still running after stop\n", reason, sessionName, b.ID) //nolint:errcheck
+		return false
+	}
+	return true
+}
+
+func staleReapStartBoundary(b beads.Bead) (time.Time, bool) {
+	if b.CreatedAt.IsZero() {
+		return time.Time{}, false
+	}
+	startedAt := b.CreatedAt
+	if raw := strings.TrimSpace(b.Metadata["last_woke_at"]); raw != "" {
+		if wokeAt, err := time.Parse(time.RFC3339, raw); err == nil && wokeAt.After(startedAt) {
+			startedAt = wokeAt
+		}
+	}
+	return startedAt, true
+}
+
 // closeBead sets final metadata on a session bead and closes it.
 // This completes the bead's lifecycle record. The close_reason distinguishes
 // why the bead was closed (e.g., "orphaned", "suspended").
@@ -1270,6 +1816,12 @@ func reapStaleSessionBeads(
 // Follows the commit-signal pattern: metadata is written first, and Close
 // is only called if all writes succeed. If any write fails, the bead stays
 // open so the next tick retries the entire sequence.
+//
+// Ownership checks live in closeSessionBeadIfUnassigned, which can see the
+// full cross-store, multi-identifier assignment picture. closeBead remains
+// the low-level metadata+close helper used once a caller has already decided
+// the bead is safe to retire (or the close reason is unrelated to work
+// ownership, such as failed-create cleanup).
 func closeBead(store beads.Store, id, reason string, now time.Time, stderr io.Writer) bool {
 	if setMetaBatch(store, id, session.ClosePatch(now, reason), stderr) != nil {
 		return false
diff --git a/cmd/gc/session_beads_test.go b/cmd/gc/session_beads_test.go
index fc4a849b62..4c3769094d 100644
--- a/cmd/gc/session_beads_test.go
+++ b/cmd/gc/session_beads_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -27,14 +28,113 @@ type countingMetadataStore struct {
 	batchCalls  int
 }
 
+type sessionGetSpyStore struct {
+	beads.Store
+	getIDs []string
+}
+
+type sessionSnapshotListSpyStore struct {
+	beads.Store
+	queries []beads.ListQuery
+}
+
+func (s *sessionSnapshotListSpyStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.queries = append(s.queries, query)
+	return s.Store.List(query)
+}
+
 type failingCloseStore struct {
 	*beads.MemStore
 }
 
+type stopHookProvider struct {
+	*runtime.Fake
+	beforeStop func(string)
+}
+
+type deadRuntimeArtifactProvider struct {
+	*runtime.Fake
+	visible   map[string]bool
+	live      map[string]bool
+	dead      map[string]bool
+	deadErrs  map[string]error
+	stopErrs  map[string]error
+	listErr   error
+	stopped   []string
+	stopCalls map[string]int
+}
+
+func newDeadRuntimeArtifactProvider() *deadRuntimeArtifactProvider {
+	return &deadRuntimeArtifactProvider{
+		Fake:      runtime.NewFake(),
+		visible:   make(map[string]bool),
+		live:      make(map[string]bool),
+		dead:      make(map[string]bool),
+		deadErrs:  make(map[string]error),
+		stopErrs:  make(map[string]error),
+		stopCalls: make(map[string]int),
+	}
+}
+
+func (p *deadRuntimeArtifactProvider) ListRunning(prefix string) ([]string, error) {
+	var names []string
+	for name := range p.visible {
+		if strings.HasPrefix(name, prefix) {
+			names = append(names, name)
+		}
+	}
+	return names, p.listErr
+}
+
+func (p *deadRuntimeArtifactProvider) IsRunning(name string) bool {
+	return p.live[name]
+}
+
+func (p *deadRuntimeArtifactProvider) IsDeadRuntimeSession(name string) (bool, error) {
+	if err := p.deadErrs[name]; err != nil {
+		return false, err
+	}
+	return p.dead[name], nil
+}
+
+func (p *deadRuntimeArtifactProvider) Stop(name string) error {
+	p.stopCalls[name]++
+	if err := p.stopErrs[name]; err != nil {
+		return err
+	}
+	p.stopped = append(p.stopped, name)
+	delete(p.visible, name)
+	delete(p.live, name)
+	delete(p.dead, name)
+	return nil
+}
+
 func (s *failingCloseStore) Close(_ string) error {
 	return errors.New("close failed")
 }
 
+func (p *stopHookProvider) Stop(name string) error {
+	if p.beforeStop != nil {
+		p.beforeStop(name)
+	}
+	return p.Fake.Stop(name)
+}
+
+type failingPoolSessionNameStore struct {
+	*beads.MemStore
+}
+
+func (s *failingPoolSessionNameStore) SetMetadata(id, key, value string) error {
+	if key == "session_name" {
+		return errors.New("session_name metadata failed")
+	}
+	return s.MemStore.SetMetadata(id, key, value)
+}
+
+func (s *failingPoolSessionNameStore) Close(_ string) error {
+	return errors.New("close failed")
+}
+
 func newCountingMetadataStore() *countingMetadataStore {
 	return &countingMetadataStore{MemStore: beads.NewMemStore()}
 }
@@ -49,6 +149,11 @@ func (s *countingMetadataStore) SetMetadataBatch(id string, kvs map[string]strin
 	return s.MemStore.SetMetadataBatch(id, kvs)
 }
 
+func (s *sessionGetSpyStore) Get(id string) (beads.Bead, error) {
+	s.getIDs = append(s.getIDs, id)
+	return s.Store.Get(id)
+}
+
 // allConfiguredDS builds configuredNames from a desiredState map.
 func allConfiguredDS(ds map[string]TemplateParams) map[string]bool {
 	m := make(map[string]bool, len(ds))
@@ -110,6 +215,84 @@ func TestSyncSessionBeads_CreatesNewBeads(t *testing.T) {
 	}
 }
 
+func TestSyncSessionBeads_CreatesNonActiveBeadWithPendingCreateStartedAt(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 5, 1, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+
+	ds := map[string]TemplateParams{
+		"helper": {TemplateName: "helper", Command: "true"},
+	}
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+
+	all := allSessionBeads(t, store)
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(all))
+	}
+	b := all[0]
+	if got := b.Metadata["state"]; got != "creating" {
+		t.Fatalf("state = %q, want creating", got)
+	}
+	if got := b.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+	if got, want := b.Metadata["pending_create_started_at"], pendingCreateStartedAtNow(clk.Now()); got != want {
+		t.Fatalf("pending_create_started_at = %q, want %q", got, want)
+	}
+}
+
+func TestSyncSessionBeads_ExistingDesiredUsesSnapshotStateWithoutWorkerLookup(t *testing.T) {
+	base := beads.NewMemStore()
+	store := &sessionGetSpyStore{Store: base}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 22, 0, 0, 0, time.UTC)}
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "control-dispatcher",
+			"agent_name":         "control-dispatcher",
+			"template":           "control-dispatcher",
+			"command":            "claude",
+			"state":              string(session.StateActive),
+			"generation":         "1",
+			"continuation_epoch": "1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	ds := map[string]TemplateParams{
+		"control-dispatcher": {TemplateName: "control-dispatcher", Command: "claude"},
+	}
+	sp := runtime.NewFake()
+
+	var stderr bytes.Buffer
+	syncSessionBeadsWithSnapshot(
+		"", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false,
+		newSessionBeadSnapshot([]beads.Bead{sessionBead}),
+	)
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+	for _, id := range store.getIDs {
+		if id == "control-dispatcher" {
+			t.Fatalf("sync looked up configured session name as bead id; getIDs=%v", store.getIDs)
+		}
+	}
+	for _, call := range sp.Calls {
+		switch call.Method {
+		case "IsRunning", "ProcessAlive", "IsAttached", "GetLastActivity", "GetMeta":
+			t.Fatalf("sync should trust the session snapshot for existing desired sessions, saw provider call %#v", call)
+		}
+	}
+}
+
 func TestSyncSessionBeads_CreatesImportedConfiguredNamedSessionBeads(t *testing.T) {
 	cityPath := t.TempDir()
 	rigPath := filepath.Join(cityPath, "repo")
@@ -822,11 +1005,73 @@ func TestSyncSessionBeads_ReopensClosedConfiguredNamedSession(t *testing.T) {
 	if got := all[0].Metadata["pending_create_claim"]; got != "true" {
 		t.Fatalf("pending_create_claim = %q, want true", got)
 	}
+	if got, want := all[0].Metadata["pending_create_started_at"], pendingCreateStartedAtNow(clk.Now()); got != want {
+		t.Fatalf("pending_create_started_at = %q, want %q", got, want)
+	}
 	if got := all[0].Metadata["session_name"]; got != sessionName {
 		t.Fatalf("session_name = %q, want %q", got, sessionName)
 	}
 }
 
+func TestReopenClosedConfiguredNamedSessionBeadClearsPendingCreateStartedAtWhenActive(t *testing.T) {
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	now := time.Date(2026, 5, 1, 9, 30, 0, 0, time.UTC)
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "refinery", StartCommand: "true", MaxActiveSessions: intPtr(2)},
+		},
+		NamedSessions: []config.NamedSession{
+			{Template: "refinery", Mode: "on_demand"},
+		},
+	}
+	sessionName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, "refinery")
+	closed, err := store.Create(beads.Bead{
+		Title:  "refinery",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               sessionName,
+			"alias":                      "refinery",
+			"template":                   "refinery",
+			"state":                      "suspended",
+			"close_reason":               "suspended",
+			"pending_create_started_at":  pendingCreateStartedAtNow(now.Add(-2 * time.Minute)),
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "refinery",
+			namedSessionModeMetadata:     "on_demand",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create closed canonical bead: %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("close canonical bead: %v", err)
+	}
+
+	var stderr bytes.Buffer
+	reopened, ok := reopenClosedConfiguredNamedSessionBead(
+		cityPath, store, cfg, "test-city", "refinery", sessionName, "active", now, nil, &stderr,
+	)
+	if !ok {
+		t.Fatalf("reopenClosedConfiguredNamedSessionBead failed: %s", stderr.String())
+	}
+	if reopened.Metadata["pending_create_claim"] != "" {
+		t.Fatalf("pending_create_claim = %q, want empty", reopened.Metadata["pending_create_claim"])
+	}
+	if reopened.Metadata["pending_create_started_at"] != "" {
+		t.Fatalf("pending_create_started_at = %q, want empty", reopened.Metadata["pending_create_started_at"])
+	}
+	stored, err := store.Get(closed.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", closed.ID, err)
+	}
+	if stored.Metadata["pending_create_started_at"] != "" {
+		t.Fatalf("stored pending_create_started_at = %q, want empty", stored.Metadata["pending_create_started_at"])
+	}
+}
+
 func TestSyncSessionBeads_BackfillsLegacyConcretePoolIdentity(t *testing.T) {
 	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
@@ -1170,7 +1415,7 @@ func TestRetireDuplicateConfiguredNamedSessionBeads_DoesNotStopWinnerSharingSess
 	indexBySessionName := map[string]int{sessionName: 1}
 
 	retired := retireDuplicateConfiguredNamedSessionBeads(
-		store, sp, cfg, "test-city", openBeads, bySessionName, indexBySessionName, time.Now().UTC(), io.Discard,
+		store, nil, sp, cfg, "test-city", openBeads, bySessionName, indexBySessionName, time.Now().UTC(), io.Discard,
 	)
 
 	if !sp.IsRunning(sessionName) {
@@ -1222,462 +1467,672 @@ func TestRetireDuplicateConfiguredNamedSessionBeads_DoesNotStopWinnerSharingSess
 	}
 }
 
-func TestSyncSessionBeads_PreservesConfiguredNamedSessionWithoutDesiredEntry(t *testing.T) {
+func TestRetireDuplicateConfiguredNamedSessionBeads_StopFailureKeepsRuntimeOwner(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
 	cfg := &config.City{
 		Workspace: config.Workspace{Name: "test-city"},
 		Agents: []config.Agent{
-			{Name: "refinery", StartCommand: "true", MaxActiveSessions: intPtr(2)},
+			{Name: "worker", StartCommand: "true"},
 		},
 		NamedSessions: []config.NamedSession{
-			{Template: "refinery", Mode: "on_demand"},
+			{Name: "reviewer", Template: "worker", Mode: "on_demand"},
 		},
 	}
-	sessionName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, "refinery")
-	bead, err := store.Create(beads.Bead{
-		Title:  "refinery",
+	winnerSessionName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, "reviewer")
+	loserSessionName := "old-reviewer-runtime"
+	if err := sp.Start(context.Background(), loserSessionName, runtime.Config{}); err != nil {
+		t.Fatalf("start loser runtime %s: %v", loserSessionName, err)
+	}
+	sp.StopErrors[loserSessionName] = errors.New("stop failed")
+	loser, err := store.Create(beads.Bead{
+		Title:  "reviewer old",
 		Type:   sessionBeadType,
+		Status: "open",
 		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"session_name":               sessionName,
-			"alias":                      "refinery",
-			"template":                   "refinery",
-			"state":                      "stopped",
+			"session_name":               loserSessionName,
+			"template":                   "worker",
+			"generation":                 "1",
+			"state":                      "active",
 			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "refinery",
+			namedSessionIdentityMetadata: "reviewer",
 			namedSessionModeMetadata:     "on_demand",
 		},
 	})
 	if err != nil {
-		t.Fatalf("create canonical bead: %v", err)
+		t.Fatalf("create loser: %v", err)
+	}
+	winner, err := store.Create(beads.Bead{
+		Title:  "reviewer",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               winnerSessionName,
+			"template":                   "worker",
+			"generation":                 "2",
+			"state":                      "active",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "reviewer",
+			namedSessionModeMetadata:     "on_demand",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create winner: %v", err)
+	}
+	work, err := store.Create(beads.Bead{
+		Title:    "owned work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: loser.ID,
+	})
+	if err != nil {
+		t.Fatalf("create loser-owned work: %v", err)
 	}
 
-	var stderr bytes.Buffer
-	syncSessionBeads("", store, nil, sp, map[string]bool{sessionName: true}, cfg, clk, &stderr, false)
+	openBeads := []beads.Bead{loser, winner}
+	bySessionName := map[string]beads.Bead{
+		loserSessionName:  loser,
+		winnerSessionName: winner,
+	}
+	indexBySessionName := map[string]int{
+		loserSessionName:  0,
+		winnerSessionName: 1,
+	}
 
-	got, err := store.Get(bead.ID)
-	if err != nil {
-		t.Fatalf("Get(%s): %v", bead.ID, err)
+	retired := retireDuplicateConfiguredNamedSessionBeads(
+		store, nil, sp, cfg, "test-city", openBeads, bySessionName, indexBySessionName, time.Now().UTC(), io.Discard,
+	)
+
+	if !sp.IsRunning(loserSessionName) {
+		t.Fatalf("loser runtime %q unexpectedly stopped", loserSessionName)
 	}
-	if got.Status != "open" {
-		t.Fatalf("status = %q, want open", got.Status)
+	if retired[0].Metadata["session_name"] != loserSessionName {
+		t.Fatalf("loser session_name = %q, want %q", retired[0].Metadata["session_name"], loserSessionName)
 	}
-	if got.Metadata["close_reason"] != "" {
-		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
+	if retired[0].Metadata["state"] == "archived" {
+		t.Fatal("loser was archived even though its runtime stop failed")
+	}
+	updatedWork, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("get loser-owned work: %v", err)
+	}
+	if updatedWork.Assignee != loser.ID {
+		t.Fatalf("loser-owned work assignee = %q, want unchanged loser %q", updatedWork.Assignee, loser.ID)
 	}
 }
 
-func TestSyncSessionBeads_RecreatesDriftedNamedSessionRuntimeName(t *testing.T) {
+func TestRetireRemovedConfiguredNamedSessionBead_StopFailureKeepsRuntimeOwner(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	cfg := &config.City{
-		Workspace: config.Workspace{Name: "test-city"},
-		Agents: []config.Agent{
-			{Name: "witness", Dir: "myrig"},
-		},
-		NamedSessions: []config.NamedSession{
-			{Template: "witness", Dir: "myrig"},
-		},
+	now := time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)
+	sessionName := "removed-reviewer-runtime"
+	if err := sp.Start(context.Background(), sessionName, runtime.Config{}); err != nil {
+		t.Fatalf("start runtime %s: %v", sessionName, err)
 	}
-	identity := "myrig/witness"
-	expectedName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, identity)
-	oldName := "s-gc-old"
-
-	if _, err := store.Create(beads.Bead{
-		Title:  "myrig/witness",
+	sp.StopErrors[sessionName] = errors.New("stop failed")
+	b, err := store.Create(beads.Bead{
+		Title:  "retired reviewer",
 		Type:   sessionBeadType,
+		Status: "open",
 		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"session_name":               oldName,
-			"alias":                      identity,
-			"template":                   identity,
+			"session_name":               sessionName,
+			"template":                   "worker",
 			"state":                      "active",
 			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: identity,
+			namedSessionIdentityMetadata: "reviewer",
 			namedSessionModeMetadata:     "on_demand",
 		},
-	}); err != nil {
-		t.Fatalf("creating drifted canonical bead: %v", err)
-	}
-	if err := sp.Start(context.Background(), oldName, runtime.Config{Command: "claude"}); err != nil {
-		t.Fatalf("starting drifted runtime: %v", err)
+	})
+	if err != nil {
+		t.Fatalf("create named session bead: %v", err)
 	}
-
-	ds := map[string]TemplateParams{
-		expectedName: {
-			TemplateName:            identity,
-			InstanceName:            identity,
-			Alias:                   identity,
-			Command:                 "claude",
-			ConfiguredNamedIdentity: identity,
-			ConfiguredNamedMode:     "on_demand",
-		},
+	work, err := store.Create(beads.Bead{
+		Title:    "owned work",
+		Type:     "task",
+		Status:   "in_progress",
+		Assignee: b.ID,
+	})
+	if err != nil {
+		t.Fatalf("create owned work: %v", err)
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), cfg, clk, &stderr, false)
+	retired := retireRemovedConfiguredNamedSessionBead(store, nil, sp, b, now, &stderr)
 
-	all := allSessionBeads(t, store)
-	if len(all) != 2 {
-		t.Fatalf("session bead count = %d, want 2", len(all))
+	if retired {
+		t.Fatal("retireRemovedConfiguredNamedSessionBead returned true after runtime stop failed")
 	}
-	var (
-		closedOld beads.Bead
-		openNew   beads.Bead
-	)
-	for _, b := range all {
-		switch strings.TrimSpace(b.Metadata["session_name"]) {
-		case oldName:
-			closedOld = b
-		case expectedName:
-			openNew = b
-		}
+	if !strings.Contains(stderr.String(), b.ID) {
+		t.Fatalf("stderr = %q, want bead ID %q", stderr.String(), b.ID)
 	}
-	if closedOld.ID == "" {
-		t.Fatalf("did not find closed drifted bead among %+v", all)
+	got, err := store.Get(b.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", b.ID, err)
 	}
-	if closedOld.Status != "closed" || closedOld.Metadata["close_reason"] != "reconfigured" {
-		t.Fatalf("drifted bead status=%q close_reason=%q, want closed/reconfigured", closedOld.Status, closedOld.Metadata["close_reason"])
+	if got.Metadata["session_name"] != sessionName {
+		t.Fatalf("session_name = %q, want %q", got.Metadata["session_name"], sessionName)
 	}
-	if openNew.ID == "" {
-		t.Fatalf("did not find recreated canonical bead with session_name %q", expectedName)
+	if got.Metadata["state"] != "active" {
+		t.Fatalf("state = %q, want active", got.Metadata["state"])
 	}
-	if got := openNew.Metadata["alias"]; got != identity {
-		t.Fatalf("new bead alias = %q, want %q", got, identity)
+	updatedWork, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("get owned work: %v", err)
 	}
-	if sp.IsRunning(oldName) {
-		t.Fatalf("drifted runtime %q still running after reconcile", oldName)
+	if updatedWork.Assignee != b.ID {
+		t.Fatalf("owned work assignee = %q, want unchanged %q", updatedWork.Assignee, b.ID)
 	}
 }
 
-func TestSyncSessionBeads_KeepsDiscoveredPlainTemplateSessionOpen(t *testing.T) {
+func TestCloseSessionBeadIfRuntimeStoppedAndUnassigned_RechecksAssignedWorkAfterStop(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
-	sp := runtime.NewFake()
-	cfg := &config.City{
-		Agents: []config.Agent{
-			{Name: "helper", StartCommand: "echo"},
-		},
+	sp := &stopHookProvider{Fake: runtime.NewFake()}
+	now := time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)
+	if err := sp.Start(context.Background(), "worker", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start worker: %v", err)
 	}
-
-	bead, err := store.Create(beads.Bead{
-		Title:  "helper chat",
+	b, err := store.Create(beads.Bead{
+		Title:  "worker",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:helper"},
+		Status: "open",
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":       "helper",
-			"session_name":   "s-gc-plain",
-			"state":          "active",
-			"manual_session": "true",
+			"session_name": "worker",
+			"template":     "worker",
+			"state":        "active",
 		},
 	})
 	if err != nil {
-		t.Fatalf("creating plain template bead: %v", err)
+		t.Fatalf("create session bead: %v", err)
 	}
-
-	bp := newAgentBuildParams("test", t.TempDir(), cfg, sp, clk.Now(), store, io.Discard)
-	desired := make(map[string]TemplateParams)
-	discoverSessionBeads(bp, cfg, desired, io.Discard)
-	if _, ok := desired["s-gc-plain"]; !ok {
-		t.Fatalf("discoverSessionBeads() missing plain session, got keys: %v", mapKeys(desired))
+	sp.beforeStop = func(name string) {
+		if name != "worker" {
+			t.Fatalf("Stop(%q), want worker", name)
+		}
+		if _, err := store.Create(beads.Bead{
+			Title:    "assigned during stop",
+			Type:     "task",
+			Status:   "open",
+			Assignee: b.ID,
+		}); err != nil {
+			t.Fatalf("create assigned work during stop: %v", err)
+		}
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, desired, sp, configuredSessionNamesWithSnapshot(cfg, "", nil), cfg, clk, &stderr, false)
+	closed := closeSessionBeadIfRuntimeStoppedAndUnassigned(
+		store, nil, sp, nil, b, "suspended", "suspended session", now, &stderr,
+	)
 
-	got, err := store.Get(bead.ID)
+	if closed {
+		t.Fatal("closeSessionBeadIfRuntimeStoppedAndUnassigned closed bead after work appeared during stop")
+	}
+	got, err := store.Get(b.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", bead.ID, err)
+		t.Fatalf("Get(%s): %v", b.ID, err)
 	}
-	if got.Status == "closed" {
-		t.Fatalf("plain template session was closed unexpectedly: close_reason=%q stderr=%q", got.Metadata["close_reason"], stderr.String())
+	if got.Status != "open" {
+		t.Fatalf("status = %q, want open", got.Status)
 	}
 	if got.Metadata["close_reason"] != "" {
 		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
 	}
 }
 
-func TestSyncSessionBeads_PreservesManualSessionExplicitAlias(t *testing.T) {
-	cityPath := t.TempDir()
+func TestCloseSessionBeadIfRuntimeStoppedAndUnassigned_StopLeavesRunningKeepsBeadOpen(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	sessionName := "s-gc-hal"
-	if err := sp.Start(context.TODO(), sessionName, runtime.Config{Command: "claude"}); err != nil {
-		t.Fatalf("start runtime session: %v", err)
+	now := time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)
+	if err := sp.Start(context.Background(), "worker", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start worker: %v", err)
+	}
+	sp.StopLeavesRunning["worker"] = true
+	b, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"template":     "worker",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	var stderr bytes.Buffer
+	closed := closeSessionBeadIfRuntimeStoppedAndUnassigned(
+		store, nil, sp, nil, b, "orphaned", "orphaned session", now, &stderr,
+	)
+
+	if closed {
+		t.Fatal("closeSessionBeadIfRuntimeStoppedAndUnassigned closed bead while runtime was still running")
+	}
+	if !sp.IsRunning("worker") {
+		t.Fatal("worker runtime unexpectedly stopped")
 	}
+	if !strings.Contains(stderr.String(), b.ID) {
+		t.Fatalf("stderr = %q, want bead ID %q", stderr.String(), b.ID)
+	}
+	got, err := store.Get(b.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", b.ID, err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("status = %q, want open", got.Status)
+	}
+}
+
+func TestSyncSessionBeads_PreservesConfiguredNamedSessionWithoutDesiredEntry(t *testing.T) {
+	// A configured named session with state=stopped + non-empty sleep_reason
+	// (deliberate sleep marker) must remain Status=open so gc start /
+	// next-wake reuses the same bead. See ga-ue1r policy Q1.
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
 	cfg := &config.City{
 		Workspace: config.Workspace{Name: "test-city"},
 		Agents: []config.Agent{
-			{Name: "helper", StartCommand: "echo"},
+			{Name: "refinery", StartCommand: "true", MaxActiveSessions: intPtr(2)},
+		},
+		NamedSessions: []config.NamedSession{
+			{Template: "refinery", Mode: "on_demand"},
 		},
 	}
-
+	sessionName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, "refinery")
 	bead, err := store.Create(beads.Bead{
-		Title:  "hal",
+		Title:  "refinery",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:helper"},
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"template":       "helper",
-			"session_name":   sessionName,
-			"alias":          "hal",
-			"state":          "active",
-			"manual_session": "true",
+			"session_name":               sessionName,
+			"alias":                      "refinery",
+			"template":                   "refinery",
+			"state":                      "stopped",
+			"sleep_reason":               "city-stop",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "refinery",
+			namedSessionModeMetadata:     "on_demand",
 		},
 	})
 	if err != nil {
-		t.Fatalf("creating manual helper bead: %v", err)
-	}
-
-	bp := newAgentBuildParams("test-city", cityPath, cfg, sp, clk.Now(), store, io.Discard)
-	desired := make(map[string]TemplateParams)
-	discoverSessionBeads(bp, cfg, desired, io.Discard)
-
-	tp, ok := desired[sessionName]
-	if !ok {
-		t.Fatalf("discoverSessionBeads() missing manual session, got keys: %v", mapKeys(desired))
-	}
-	if tp.Alias != "hal" {
-		t.Fatalf("discovered alias = %q, want %q", tp.Alias, "hal")
+		t.Fatalf("create canonical bead: %v", err)
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads(cityPath, store, desired, sp, configuredSessionNames(cfg, "test-city", store), cfg, clk, &stderr, false)
+	syncSessionBeads("", store, nil, sp, map[string]bool{sessionName: true}, cfg, clk, &stderr, false)
 
 	got, err := store.Get(bead.ID)
 	if err != nil {
 		t.Fatalf("Get(%s): %v", bead.ID, err)
 	}
-	if got.Metadata["alias"] != "hal" {
-		t.Fatalf("alias after sync = %q, want %q (stderr=%q)", got.Metadata["alias"], "hal", stderr.String())
-	}
-
-	resolvedID, err := resolveSessionIDWithConfig(cityPath, cfg, store, "hal")
-	if err != nil {
-		t.Fatalf("resolveSessionIDWithConfig(hal): %v", err)
+	if got.Status != "open" {
+		t.Fatalf("status = %q, want open", got.Status)
 	}
-	if resolvedID != bead.ID {
-		t.Fatalf("resolveSessionIDWithConfig(hal) = %q, want %q", resolvedID, bead.ID)
+	if got.Metadata["close_reason"] != "" {
+		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
 	}
 }
 
-func TestSyncSessionBeads_PreservesManagedAliasHistory(t *testing.T) {
+// TestSyncSessionBeads_ReleasesStoppedNamedBeadWithoutSleepReason covers the
+// converse of the test above: a stopped bead with no sleep_reason and no
+// fresh last_woke_at is dead, not deliberately asleep. Its alias must be
+// released (close the bead) so the next spawn can claim the identity. The
+// existing close→reopen path (TestSyncSessionBeads_ReopensClosedConfiguredNamedSession)
+// preserves continuity by reusing the same bead ID on next demand. See
+// ga-ue1r policy Q2.
+func TestSyncSessionBeads_ReleasesStoppedNamedBeadWithoutSleepReason(t *testing.T) {
 	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-
-	if _, err := store.Create(beads.Bead{
-		Title:  "myrig/witness",
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "refinery", StartCommand: "true", MaxActiveSessions: intPtr(2)},
+		},
+		NamedSessions: []config.NamedSession{
+			{Template: "refinery", Mode: "on_demand"},
+		},
+	}
+	sessionName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, "refinery")
+	bead, err := store.Create(beads.Bead{
+		Title:  "refinery",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"session_name": "s-gc-123",
-			"template":     "myrig/witness",
-			"alias":        "old-witness",
-			"state":        "stopped",
-		},
-	}); err != nil {
-		t.Fatalf("Create(seed): %v", err)
-	}
-
-	ds := map[string]TemplateParams{
-		"s-gc-123": {
-			TemplateName: "myrig/witness",
-			InstanceName: "myrig/witness",
-			Alias:        "myrig/witness",
-			Command:      "claude",
+			"session_name":               sessionName,
+			"alias":                      "refinery",
+			"template":                   "refinery",
+			"state":                      "stopped",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "refinery",
+			namedSessionModeMetadata:     "on_demand",
 		},
+	})
+	if err != nil {
+		t.Fatalf("create canonical bead: %v", err)
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	syncSessionBeads("", store, nil, sp, map[string]bool{sessionName: true}, cfg, clk, &stderr, false)
 
-	all, err := store.ListByLabel(sessionBeadLabel, 0)
+	got, err := store.Get(bead.ID)
 	if err != nil {
-		t.Fatalf("listing beads: %v", err)
-	}
-	if len(all) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(all))
-	}
-	if got := all[0].Metadata["alias"]; got != "myrig/witness" {
-		t.Fatalf("alias = %q, want %q", got, "myrig/witness")
+		t.Fatalf("Get(%s): %v", bead.ID, err)
 	}
-	if got := all[0].Metadata["alias_history"]; got != "old-witness" {
-		t.Fatalf("alias_history = %q, want %q", got, "old-witness")
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed (alias released for re-claim)", got.Status)
 	}
 }
 
-func TestSyncSessionBeads_ClearsManagedAliasWhenRemoved(t *testing.T) {
+func TestSyncSessionBeads_RecreatesDriftedNamedSessionRuntimeName(t *testing.T) {
 	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	if err := sp.Start(context.Background(), "s-gc-123", runtime.Config{Command: "claude"}); err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-	if err := sp.SetMeta("s-gc-123", "GC_ALIAS", "old-witness"); err != nil {
-		t.Fatalf("SetMeta: %v", err)
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "witness", Dir: "myrig"},
+		},
+		NamedSessions: []config.NamedSession{
+			{Template: "witness", Dir: "myrig"},
+		},
 	}
+	identity := "myrig/witness"
+	expectedName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, identity)
+	oldName := "s-gc-old"
+
 	if _, err := store.Create(beads.Bead{
 		Title:  "myrig/witness",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"session_name": "s-gc-123",
-			"template":     "myrig/witness",
-			"alias":        "old-witness",
-			"state":        "active",
+			"session_name":               oldName,
+			"alias":                      identity,
+			"template":                   identity,
+			"state":                      "active",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: identity,
+			namedSessionModeMetadata:     "on_demand",
 		},
 	}); err != nil {
-		t.Fatalf("Create(seed): %v", err)
+		t.Fatalf("creating drifted canonical bead: %v", err)
+	}
+	if err := sp.Start(context.Background(), oldName, runtime.Config{Command: "claude"}); err != nil {
+		t.Fatalf("starting drifted runtime: %v", err)
 	}
 
 	ds := map[string]TemplateParams{
-		"s-gc-123": {
-			TemplateName: "myrig/witness",
-			InstanceName: "myrig/witness",
-			Command:      "claude",
+		expectedName: {
+			TemplateName:            identity,
+			InstanceName:            identity,
+			Alias:                   identity,
+			Command:                 "claude",
+			ConfiguredNamedIdentity: identity,
+			ConfiguredNamedMode:     "on_demand",
 		},
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), cfg, clk, &stderr, false)
 
-	all, err := store.ListByLabel(sessionBeadLabel, 0)
-	if err != nil {
-		t.Fatalf("listing beads: %v", err)
+	all := allSessionBeads(t, store)
+	if len(all) != 2 {
+		t.Fatalf("session bead count = %d, want 2", len(all))
 	}
-	if len(all) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(all))
+	var (
+		closedOld beads.Bead
+		openNew   beads.Bead
+	)
+	for _, b := range all {
+		switch strings.TrimSpace(b.Metadata["session_name"]) {
+		case oldName:
+			closedOld = b
+		case expectedName:
+			openNew = b
+		}
 	}
-	if got := all[0].Metadata["alias"]; got != "" {
-		t.Fatalf("alias = %q, want empty", got)
+	if closedOld.ID == "" {
+		t.Fatalf("did not find closed drifted bead among %+v", all)
 	}
-	if got := all[0].Metadata["alias_history"]; got != "old-witness" {
-		t.Fatalf("alias_history = %q, want %q", got, "old-witness")
+	if closedOld.Status != "closed" || closedOld.Metadata["close_reason"] != "reconfigured" {
+		t.Fatalf("drifted bead status=%q close_reason=%q, want closed/reconfigured", closedOld.Status, closedOld.Metadata["close_reason"])
 	}
-	if got, err := sp.GetMeta("s-gc-123", "GC_ALIAS"); err != nil {
-		t.Fatalf("GetMeta(GC_ALIAS): %v", err)
-	} else if got != "" {
-		t.Fatalf("GC_ALIAS = %q, want empty", got)
+	if openNew.ID == "" {
+		t.Fatalf("did not find recreated canonical bead with session_name %q", expectedName)
+	}
+	if got := openNew.Metadata["alias"]; got != identity {
+		t.Fatalf("new bead alias = %q, want %q", got, identity)
+	}
+	if sp.IsRunning(oldName) {
+		t.Fatalf("drifted runtime %q still running after reconcile", oldName)
 	}
 }
 
-func TestSyncSessionBeads_Idempotent(t *testing.T) {
+func TestSyncSessionBeads_ReconfiguredNamedSessionStopFailureKeepsOldBeadOpen(t *testing.T) {
 	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "witness", Dir: "myrig", StartCommand: "true"},
+		},
+		NamedSessions: []config.NamedSession{
+			{Template: "witness", Dir: "myrig"},
+		},
+	}
+	identity := "myrig/witness"
+	expectedName := config.NamedSessionRuntimeName(cfg.Workspace.Name, cfg.Workspace, identity)
+	oldName := "s-gc-old"
+
+	oldBead, err := store.Create(beads.Bead{
+		Title:  identity,
+		Type:   sessionBeadType,
+		Status: "open",
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               oldName,
+			"alias":                      identity,
+			"template":                   identity,
+			"state":                      "active",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: identity,
+			namedSessionModeMetadata:     "on_demand",
+		},
+	})
+	if err != nil {
+		t.Fatalf("creating drifted canonical bead: %v", err)
+	}
+	if err := sp.Start(context.Background(), oldName, runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("starting drifted runtime: %v", err)
+	}
+	sp.StopErrors[oldName] = errors.New("stop failed")
 
 	ds := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude"},
+		expectedName: {
+			TemplateName:            identity,
+			InstanceName:            identity,
+			Alias:                   identity,
+			Command:                 "true",
+			ConfiguredNamedIdentity: identity,
+			ConfiguredNamedMode:     "on_demand",
+		},
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), cfg, clk, &stderr, false)
 
-	// Get the created bead's token and generation.
-	all := allSessionBeads(t, store)
-	token1 := all[0].Metadata["instance_token"]
-	gen1 := all[0].Metadata["generation"]
-	epoch1 := all[0].Metadata["continuation_epoch"]
+	gotOld, err := store.Get(oldBead.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", oldBead.ID, err)
+	}
+	if gotOld.Status != "open" {
+		t.Fatalf("old bead status = %q, want open while runtime is still running", gotOld.Status)
+	}
+	if gotOld.Metadata["session_name"] != oldName {
+		t.Fatalf("old bead session_name = %q, want %q", gotOld.Metadata["session_name"], oldName)
+	}
+	if gotOld.Metadata["close_reason"] != "" {
+		t.Fatalf("old bead close_reason = %q, want empty", gotOld.Metadata["close_reason"])
+	}
+	if !sp.IsRunning(oldName) {
+		t.Fatalf("old runtime %q unexpectedly stopped", oldName)
+	}
+	for _, b := range allSessionBeads(t, store) {
+		if b.ID != oldBead.ID && strings.TrimSpace(b.Metadata["session_name"]) == expectedName {
+			t.Fatalf("created replacement bead %s while old runtime %q still has an open owner", b.ID, oldName)
+		}
+	}
+}
 
-	// Run again — should be idempotent.
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+func TestSyncSessionBeads_KeepsDiscoveredPlainTemplateSessionOpen(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "helper", StartCommand: "echo"},
+		},
+	}
 
-	all = allSessionBeads(t, store)
-	if len(all) != 1 {
-		t.Fatalf("expected 1 bead after re-sync, got %d", len(all))
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper chat",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"template":       "helper",
+			"session_name":   "s-gc-plain",
+			"state":          "active",
+			"manual_session": "true",
+		},
+	})
+	if err != nil {
+		t.Fatalf("creating plain template bead: %v", err)
 	}
 
-	// Token and generation should NOT change when config is unchanged.
-	if all[0].Metadata["instance_token"] != token1 {
-		t.Error("instance_token changed on idempotent re-sync")
+	bp := newAgentBuildParams("test", t.TempDir(), cfg, sp, clk.Now(), store, io.Discard)
+	desired := make(map[string]TemplateParams)
+	discoverSessionBeads(bp, cfg, desired, io.Discard)
+	if _, ok := desired["s-gc-plain"]; !ok {
+		t.Fatalf("discoverSessionBeads() missing plain session, got keys: %v", mapKeys(desired))
 	}
-	if all[0].Metadata["generation"] != gen1 {
-		t.Error("generation changed on idempotent re-sync")
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, desired, sp, configuredSessionNamesWithSnapshot(cfg, "", nil), cfg, clk, &stderr, false)
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", bead.ID, err)
 	}
-	if all[0].Metadata["continuation_epoch"] != epoch1 {
-		t.Error("continuation_epoch changed on idempotent re-sync")
+	if got.Status == "closed" {
+		t.Fatalf("plain template session was closed unexpectedly: close_reason=%q stderr=%q", got.Metadata["close_reason"], stderr.String())
+	}
+	if got.Metadata["close_reason"] != "" {
+		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
 	}
 }
 
-func TestSyncSessionBeads_SyncsWakeMode(t *testing.T) {
+func TestSyncSessionBeads_PreservesManualSessionExplicitAlias(t *testing.T) {
+	cityPath := t.TempDir()
 	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
+	sessionName := "s-gc-hal"
+	if err := sp.Start(context.TODO(), sessionName, runtime.Config{Command: "claude"}); err != nil {
+		t.Fatalf("start runtime session: %v", err)
+	}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{
+			{Name: "helper", StartCommand: "echo"},
+		},
+	}
 
-	ds := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude", WakeMode: "fresh"},
+	bead, err := store.Create(beads.Bead{
+		Title:  "hal",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"template":       "helper",
+			"session_name":   sessionName,
+			"alias":          "hal",
+			"state":          "active",
+			"manual_session": "true",
+		},
+	})
+	if err != nil {
+		t.Fatalf("creating manual helper bead: %v", err)
+	}
+
+	bp := newAgentBuildParams("test-city", cityPath, cfg, sp, clk.Now(), store, io.Discard)
+	desired := make(map[string]TemplateParams)
+	discoverSessionBeads(bp, cfg, desired, io.Discard)
+
+	tp, ok := desired[sessionName]
+	if !ok {
+		t.Fatalf("discoverSessionBeads() missing manual session, got keys: %v", mapKeys(desired))
+	}
+	if tp.Alias != "hal" {
+		t.Fatalf("discovered alias = %q, want %q", tp.Alias, "hal")
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	syncSessionBeads(cityPath, store, desired, sp, configuredSessionNames(cfg, "test-city", store), cfg, clk, &stderr, false)
 
-	all, err := store.ListByLabel(sessionBeadLabel, 0)
+	got, err := store.Get(bead.ID)
 	if err != nil {
-		t.Fatalf("listing beads: %v", err)
+		t.Fatalf("Get(%s): %v", bead.ID, err)
 	}
-	if got := all[0].Metadata["wake_mode"]; got != "fresh" {
-		t.Fatalf("wake_mode = %q, want fresh", got)
+	if got.Metadata["alias"] != "hal" {
+		t.Fatalf("alias after sync = %q, want %q (stderr=%q)", got.Metadata["alias"], "hal", stderr.String())
 	}
 
-	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: "claude"}
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-
-	all, err = store.ListByLabel(sessionBeadLabel, 0)
+	resolvedID, err := resolveSessionIDWithConfig(cityPath, cfg, store, "hal")
 	if err != nil {
-		t.Fatalf("listing beads after clear: %v", err)
+		t.Fatalf("resolveSessionIDWithConfig(hal): %v", err)
 	}
-	if got := all[0].Metadata["wake_mode"]; got != "" {
-		t.Fatalf("wake_mode = %q, want empty after revert to resume", got)
+	if resolvedID != bead.ID {
+		t.Fatalf("resolveSessionIDWithConfig(hal) = %q, want %q", resolvedID, bead.ID)
 	}
 }
 
-func TestSyncSessionBeads_BatchesExistingMetadataBackfill(t *testing.T) {
-	store := newCountingMetadataStore()
+func TestSyncSessionBeads_PreservesManagedAliasHistory(t *testing.T) {
+	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
 
-	_, err := store.Create(beads.Bead{
-		Title:  "worker",
+	if _, err := store.Create(beads.Bead{
+		Title:  "myrig/witness",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"session_name": "worker",
+			"session_name": "s-gc-123",
+			"template":     "myrig/witness",
+			"alias":        "old-witness",
 			"state":        "stopped",
 		},
-	})
-	if err != nil {
-		t.Fatalf("creating seed bead: %v", err)
+	}); err != nil {
+		t.Fatalf("Create(seed): %v", err)
 	}
 
 	ds := map[string]TemplateParams{
-		"worker": {
-			TemplateName: "worker",
-			Command:      "true",
-			WorkDir:      "/tmp/worktree",
-			WakeMode:     "fresh",
+		"s-gc-123": {
+			TemplateName: "myrig/witness",
+			InstanceName: "myrig/witness",
+			Alias:        "myrig/witness",
+			Command:      "claude",
 		},
 	}
 
 	var stderr bytes.Buffer
 	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	if stderr.Len() > 0 {
-		t.Fatalf("unexpected stderr: %s", stderr.String())
-	}
-	if store.batchCalls != 1 {
-		t.Fatalf("batchCalls = %d, want 1", store.batchCalls)
-	}
-	if store.singleCalls != 0 {
-		t.Fatalf("singleCalls = %d, want 0", store.singleCalls)
-	}
-
 	all, err := store.ListByLabel(sessionBeadLabel, 0)
 	if err != nil {
 		t.Fatalf("listing beads: %v", err)
@@ -1685,12 +2140,195 @@ func TestSyncSessionBeads_BatchesExistingMetadataBackfill(t *testing.T) {
 	if len(all) != 1 {
 		t.Fatalf("expected 1 bead, got %d", len(all))
 	}
-	b := all[0]
-	if got := b.Metadata["template"]; got != "worker" {
-		t.Fatalf("template = %q, want worker", got)
-	}
-	if got := b.Metadata["command"]; got != "true" {
-		t.Fatalf("command = %q, want true", got)
+	if got := all[0].Metadata["alias"]; got != "myrig/witness" {
+		t.Fatalf("alias = %q, want %q", got, "myrig/witness")
+	}
+	if got := all[0].Metadata["alias_history"]; got != "old-witness" {
+		t.Fatalf("alias_history = %q, want %q", got, "old-witness")
+	}
+}
+
+func TestSyncSessionBeads_ClearsManagedAliasWhenRemoved(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "s-gc-123", runtime.Config{Command: "claude"}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := sp.SetMeta("s-gc-123", "GC_ALIAS", "old-witness"); err != nil {
+		t.Fatalf("SetMeta: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:  "myrig/witness",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "s-gc-123",
+			"template":     "myrig/witness",
+			"alias":        "old-witness",
+			"state":        "active",
+		},
+	}); err != nil {
+		t.Fatalf("Create(seed): %v", err)
+	}
+
+	ds := map[string]TemplateParams{
+		"s-gc-123": {
+			TemplateName: "myrig/witness",
+			InstanceName: "myrig/witness",
+			Command:      "claude",
+		},
+	}
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	all, err := store.ListByLabel(sessionBeadLabel, 0)
+	if err != nil {
+		t.Fatalf("listing beads: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(all))
+	}
+	if got := all[0].Metadata["alias"]; got != "" {
+		t.Fatalf("alias = %q, want empty", got)
+	}
+	if got := all[0].Metadata["alias_history"]; got != "old-witness" {
+		t.Fatalf("alias_history = %q, want %q", got, "old-witness")
+	}
+	if got, err := sp.GetMeta("s-gc-123", "GC_ALIAS"); err != nil {
+		t.Fatalf("GetMeta(GC_ALIAS): %v", err)
+	} else if got != "" {
+		t.Fatalf("GC_ALIAS = %q, want empty", got)
+	}
+}
+
+func TestSyncSessionBeads_Idempotent(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
+
+	ds := map[string]TemplateParams{
+		"mayor": {TemplateName: "mayor", Command: "claude"},
+	}
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	// Get the created bead's token and generation.
+	all := allSessionBeads(t, store)
+	token1 := all[0].Metadata["instance_token"]
+	gen1 := all[0].Metadata["generation"]
+	epoch1 := all[0].Metadata["continuation_epoch"]
+
+	// Run again — should be idempotent.
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	all = allSessionBeads(t, store)
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead after re-sync, got %d", len(all))
+	}
+
+	// Token and generation should NOT change when config is unchanged.
+	if all[0].Metadata["instance_token"] != token1 {
+		t.Error("instance_token changed on idempotent re-sync")
+	}
+	if all[0].Metadata["generation"] != gen1 {
+		t.Error("generation changed on idempotent re-sync")
+	}
+	if all[0].Metadata["continuation_epoch"] != epoch1 {
+		t.Error("continuation_epoch changed on idempotent re-sync")
+	}
+}
+
+func TestSyncSessionBeads_SyncsWakeMode(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+
+	ds := map[string]TemplateParams{
+		"mayor": {TemplateName: "mayor", Command: "claude", WakeMode: "fresh"},
+	}
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	all, err := store.ListByLabel(sessionBeadLabel, 0)
+	if err != nil {
+		t.Fatalf("listing beads: %v", err)
+	}
+	if got := all[0].Metadata["wake_mode"]; got != "fresh" {
+		t.Fatalf("wake_mode = %q, want fresh", got)
+	}
+
+	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: "claude"}
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	all, err = store.ListByLabel(sessionBeadLabel, 0)
+	if err != nil {
+		t.Fatalf("listing beads after clear: %v", err)
+	}
+	if got := all[0].Metadata["wake_mode"]; got != "" {
+		t.Fatalf("wake_mode = %q, want empty after revert to resume", got)
+	}
+}
+
+func TestSyncSessionBeads_BatchesExistingMetadataBackfill(t *testing.T) {
+	store := newCountingMetadataStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+
+	_, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"state":        "stopped",
+		},
+	})
+	if err != nil {
+		t.Fatalf("creating seed bead: %v", err)
+	}
+
+	ds := map[string]TemplateParams{
+		"worker": {
+			TemplateName: "worker",
+			Command:      "true",
+			WorkDir:      "/tmp/worktree",
+			WakeMode:     "fresh",
+		},
+	}
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+	if store.batchCalls != 1 {
+		t.Fatalf("batchCalls = %d, want 1", store.batchCalls)
+	}
+	if store.singleCalls != 0 {
+		t.Fatalf("singleCalls = %d, want 0", store.singleCalls)
+	}
+
+	all, err := store.ListByLabel(sessionBeadLabel, 0)
+	if err != nil {
+		t.Fatalf("listing beads: %v", err)
+	}
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(all))
+	}
+	b := all[0]
+	if got := b.Metadata["template"]; got != "worker" {
+		t.Fatalf("template = %q, want worker", got)
+	}
+	if got := b.Metadata["command"]; got != "true" {
+		t.Fatalf("command = %q, want true", got)
 	}
 	if got := b.Metadata["work_dir"]; got != "/tmp/worktree" {
 		t.Fatalf("work_dir = %q, want /tmp/worktree", got)
@@ -1703,6 +2341,140 @@ func TestSyncSessionBeads_BatchesExistingMetadataBackfill(t *testing.T) {
 	}
 }
 
+// eofOnBeadStore wraps a MemStore and returns one unexpected-EOF error from
+// SetMetadataBatch, simulating a transient Dolt packet failure on a single
+// write. All other writes pass through to the underlying MemStore.
+type eofOnBeadStore struct {
+	*beads.MemStore
+	failNext  bool
+	failedID  string
+	failCalls int
+}
+
+func (s *eofOnBeadStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if s.failNext {
+		s.failNext = false
+		s.failedID = id
+		s.failCalls++
+		return fmt.Errorf(
+			"setting metadata on %q: exit status 1: [mysql] 2026/04/12 22:39:29 packets.go:58 unexpected EOF",
+			id,
+		)
+	}
+	return s.MemStore.SetMetadataBatch(id, kvs)
+}
+
+// TestSyncSessionBeads_IsolatesSetMetadataBatchEOFToSingleBead is a
+// regression test for issue #663: a transient unexpected-EOF on a single
+// session bead's SetMetadataBatch write must not prevent other session
+// beads in the same reconciliation tick from being updated. Per-bead
+// isolation keeps the reconciler resilient to transient Dolt packet
+// failures without cascading into a full-city interrupt wave.
+//
+// Before this contract was enforced, a single EOF from the Dolt MySQL
+// driver during the supervisor's reconciliation loop could propagate
+// through syncSessionBeads and trigger downstream failure handling that
+// stopped every managed session. The reconciler MUST iterate through the
+// remaining beads after one fails, logging the error but continuing.
+func TestSyncSessionBeads_IsolatesSetMetadataBatchEOFToSingleBead(t *testing.T) {
+	inner := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+
+	// Seed three session beads, each missing the template field so
+	// syncSessionBeads will queue a backfill batch write for every bead.
+	seed := func(name string) beads.Bead {
+		b, err := inner.Create(beads.Bead{
+			Title:  name,
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel, "agent:" + name},
+			Metadata: map[string]string{
+				"session_name": name,
+				"state":        "active",
+			},
+		})
+		if err != nil {
+			t.Fatalf("creating bead %s: %v", name, err)
+		}
+		return b
+	}
+	beadA := seed("configured-alpha")
+	beadB := seed("configured-beta")
+	beadC := seed("configured-gamma")
+
+	ds := map[string]TemplateParams{
+		"configured-alpha": {TemplateName: "configured-alpha", Command: "true"},
+		"configured-beta":  {TemplateName: "configured-beta", Command: "true"},
+		"configured-gamma": {TemplateName: "configured-gamma", Command: "true"},
+	}
+	expectedTemplates := map[string]string{
+		beadA.ID: "configured-alpha",
+		beadB.ID: "configured-beta",
+		beadC.ID: "configured-gamma",
+	}
+
+	// Wrap the store so the first SetMetadataBatch returns an EOF-shaped
+	// error. Because syncSessionBeads ranges over a map, failing the first
+	// metadata write makes the continuation assertion order-independent.
+	store := &eofOnBeadStore{MemStore: inner, failNext: true}
+
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	// The EOF must have been observed on exactly one seeded bead.
+	if store.failCalls != 1 {
+		t.Fatalf("SetMetadataBatch failure calls = %d, want 1", store.failCalls)
+	}
+	failedID := store.failedID
+	failedTemplate, ok := expectedTemplates[failedID]
+	if failedID == "" || !ok {
+		t.Fatalf("failed metadata write ID = %q, want one of %v", failedID, expectedTemplates)
+	}
+
+	// stderr must identify the failed bead and the transient EOF marker
+	// so operators can correlate the log with the underlying transport
+	// failure.
+	msg := stderr.String()
+	if !strings.Contains(msg, failedID) {
+		t.Errorf("stderr missing failed bead ID %q:\n%s", failedID, msg)
+	}
+	if !strings.Contains(strings.ToLower(msg), "unexpected eof") {
+		t.Errorf("stderr missing 'unexpected EOF' marker:\n%s", msg)
+	}
+
+	// Every non-failed bead MUST have its template backfilled in the same
+	// tick. The failed bead MUST remain unwritten so the next tick retries
+	// the full backfill from a clean state.
+	for id, want := range expectedTemplates {
+		got, err := inner.Get(id)
+		if err != nil {
+			t.Fatalf("Get(%s): %v", id, err)
+		}
+		if id == failedID {
+			if got.Metadata["template"] != "" {
+				t.Errorf("failed bead template = %q, want empty (EOF should block write)",
+					got.Metadata["template"])
+			}
+			continue
+		}
+		if got.Metadata["template"] != want {
+			t.Errorf("non-failed bead %s template = %q, want %q (isolation broken)",
+				id, got.Metadata["template"], want)
+		}
+	}
+
+	var retryStderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &retryStderr, false)
+
+	retried, err := inner.Get(failedID)
+	if err != nil {
+		t.Fatalf("Get(%s) after retry: %v", failedID, err)
+	}
+	if retried.Metadata["template"] != failedTemplate {
+		t.Errorf("retried bead template = %q, want %q", retried.Metadata["template"], failedTemplate)
+	}
+}
+
 func TestSyncSessionBeads_DoesNotRewriteReconcilerOwnedState(t *testing.T) {
 	store := newCountingMetadataStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
@@ -1792,876 +2564,1303 @@ func TestCloseBeadPreservesPendingCreateClaimWhenCloseFails(t *testing.T) {
 	}
 }
 
-// TestSyncSessionBeads_RefreshesStoredCommandOnConfigChange reproduces an
-// observed bug where an agent that got an `[option_defaults] model = "opus"`
-// entry added to its config after its session bead was created never picked up
-// the resulting `--model claude-opus-4-6` flag — even across `gc restart`.
-//
-// Root cause: session_beads.go only wrote `metadata.command` when it was empty
-// ("backfill") so the stored value was frozen at first-create time. If any
-// respawn path reads `metadata.command` (used by `gc session attach` and the
-// fallback in worker/handle_lifecycle.go:427), the agent runs with stale CLI
-// flags forever.
-//
-// This test captures the contract that `syncSessionBeadsWithSnapshot` MUST
-// refresh `metadata.command` to match freshly resolved `tp.Command` whenever
-// the two differ.
-func TestSyncSessionBeads_RefreshesStoredCommandOnConfigChange(t *testing.T) {
-	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 4, 17, 12, 0, 0, 0, time.UTC)}
-	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude --dangerously-skip-permissions --effort max"})
-
-	// Tick 1: initial bead creation. Command lacks --model (mirrors a session
-	// created before option_defaults.model was added to the agent config).
-	beforeCmd := "claude --dangerously-skip-permissions --effort max"
-	ds := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: beforeCmd},
+func TestBeadOwnsPoolSessionName(t *testing.T) {
+	template := "pack/worker"
+	tests := []struct {
+		name string
+		bead beads.Bead
+		want bool
+	}{
+		{
+			name: "template derived name",
+			bead: beads.Bead{
+				ID: "gc-1",
+				Metadata: map[string]string{
+					"template":     template,
+					"session_name": PoolSessionName(template, "gc-1"),
+				},
+			},
+			want: true,
+		},
+		{
+			name: "legacy suffix without template",
+			bead: beads.Bead{
+				ID: "gc-2",
+				Metadata: map[string]string{
+					"session_name": "worker-gc-2",
+				},
+			},
+			want: true,
+		},
+		{
+			name: "empty id",
+			bead: beads.Bead{
+				Metadata: map[string]string{
+					"template":     template,
+					"session_name": PoolSessionName(template, ""),
+				},
+			},
+			want: false,
+		},
+		{
+			name: "empty session name",
+			bead: beads.Bead{
+				ID: "gc-3",
+				Metadata: map[string]string{
+					"template": template,
+				},
+			},
+			want: false,
+		},
+		{
+			name: "unowned name",
+			bead: beads.Bead{
+				ID: "gc-4",
+				Metadata: map[string]string{
+					"template":     template,
+					"session_name": "worker-other",
+				},
+			},
+			want: false,
+		},
 	}
-	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := beadOwnsPoolSessionName(tt.bead); got != tt.want {
+				t.Fatalf("beadOwnsPoolSessionName() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
 
-	beads1 := allSessionBeads(t, store)
-	if len(beads1) != 1 {
-		t.Fatalf("expected 1 bead after tick 1, got %d", len(beads1))
+func TestCanonicalDuplicateSessionBead(t *testing.T) {
+	template := "pack/worker"
+	incumbentOwner := beads.Bead{
+		ID: "gc-1",
+		Metadata: map[string]string{
+			"template":     template,
+			"session_name": PoolSessionName(template, "gc-1"),
+		},
 	}
-	if got := beads1[0].Metadata["command"]; got != beforeCmd {
-		t.Fatalf("tick 1: command = %q, want %q", got, beforeCmd)
+	candidateOwner := beads.Bead{
+		ID: "gc-2",
+		Metadata: map[string]string{
+			"template":     template,
+			"session_name": PoolSessionName(template, "gc-2"),
+		},
 	}
-
-	// Tick 2: agent config grows an option_defaults.model entry. Fresh
-	// tp.Command now includes --model claude-opus-4-6. This is the scenario
-	// that broke in production: stored metadata.command was never updated.
-	afterCmd := "claude --dangerously-skip-permissions --effort max --model claude-opus-4-6"
-	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: afterCmd}
-	clk.Advance(3 * 24 * time.Hour) // 2026-04-17 → 2026-04-20
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-
-	beads2 := allSessionBeads(t, store)
-	if len(beads2) != 1 {
-		t.Fatalf("expected 1 bead after tick 2, got %d", len(beads2))
+	incumbentPlain := beads.Bead{
+		ID: "gc-3",
+		Metadata: map[string]string{
+			"session_name": "worker-shared",
+		},
 	}
-	if got := beads2[0].Metadata["command"]; got != afterCmd {
-		t.Errorf("tick 2: stored command was not refreshed.\n  got:  %q\n  want: %q\nthis is the option_defaults-propagation bug — stale command persists across config changes", got, afterCmd)
+	candidatePlain := beads.Bead{
+		ID: "gc-4",
+		Metadata: map[string]string{
+			"session_name": "worker-shared",
+		},
 	}
 
-	// Sanity: an empty tp.Command (e.g., resolution failure) must NOT clobber
-	// the stored value — the refresh is guarded on `tp.Command != ""`.
-	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: ""}
-	clk.Advance(time.Minute)
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-	beads3 := allSessionBeads(t, store)
-	if got := beads3[0].Metadata["command"]; got != afterCmd {
-		t.Errorf("tick 3: empty tp.Command should not clobber stored command.\n  got:  %q\n  want: %q", got, afterCmd)
+	tests := []struct {
+		name      string
+		incumbent beads.Bead
+		candidate beads.Bead
+		wantID    string
+	}{
+		{
+			name:      "candidate owner beats non-owner",
+			incumbent: incumbentPlain,
+			candidate: candidateOwner,
+			wantID:    candidateOwner.ID,
+		},
+		{
+			name:      "incumbent owner beats non-owner",
+			incumbent: incumbentOwner,
+			candidate: candidatePlain,
+			wantID:    incumbentOwner.ID,
+		},
+		{
+			name:      "neither owner preserves last wins",
+			incumbent: incumbentPlain,
+			candidate: candidatePlain,
+			wantID:    candidatePlain.ID,
+		},
+		{
+			name:      "both owners preserves last wins",
+			incumbent: incumbentOwner,
+			candidate: candidateOwner,
+			wantID:    candidateOwner.ID,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := canonicalDuplicateSessionBead(tt.incumbent, tt.candidate); got.ID != tt.wantID {
+				t.Fatalf("canonicalDuplicateSessionBead() = %s, want %s", got.ID, tt.wantID)
+			}
+		})
 	}
 }
 
-func TestSyncSessionBeads_ConfigDrift(t *testing.T) {
+func TestSyncSessionBeads_DuplicatePoolSessionNameKeepsVisibleOwner(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
+	template := "pack/worker"
 
-	ds := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude"},
+	owner, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"agent_name":           template,
+			"state":                "creating",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ownerSessionName := PoolSessionName(template, owner.ID)
+	if err := store.SetMetadata(owner.ID, "session_name", ownerSessionName); err != nil {
+		t.Fatal(err)
 	}
 
-	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	duplicate, err := store.Create(beads.Bead{
+		Title:  "worker-2",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template + "-2"},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         ownerSessionName,
+			"agent_name":           template + "-2",
+			"pool_slot":            "2",
+			"state":                "active",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	all := allSessionBeads(t, store)
-	token1 := all[0].Metadata["instance_token"]
+	visible, err := loadSessionBeads(store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ownerVisible := false
+	duplicateVisible := false
+	for _, b := range visible {
+		switch b.ID {
+		case owner.ID:
+			ownerVisible = true
+		case duplicate.ID:
+			duplicateVisible = true
+		}
+	}
+	if !ownerVisible || !duplicateVisible {
+		t.Fatalf("precondition failed: owner visible=%v duplicate visible=%v", ownerVisible, duplicateVisible)
+	}
 
-	// Change config — different command.
-	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: "gemini"}
-	clk.Advance(5 * time.Second)
+	ds := map[string]TemplateParams{
+		ownerSessionName: {
+			TemplateName: template,
+			InstanceName: template + "-2",
+			PoolSlot:     2,
+			Command:      "codex",
+		},
+	}
+	var stderr bytes.Buffer
 	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
 
-	// syncSessionBeads no longer updates config_hash for existing beads.
-	// The bead-driven reconciler (reconcileSessionBeads) detects drift by
-	// comparing bead config_hash against the current desired config and
-	// updates it only after successful restart.
-	all, _ = store.ListByLabel(sessionBeadLabel, 0)
-	if all[0].Metadata["generation"] != "1" {
-		t.Errorf("generation = %q, want %q (should not change on sync)", all[0].Metadata["generation"], "1")
+	ownerAfter, err := store.Get(owner.ID)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if all[0].Metadata["instance_token"] != token1 {
-		t.Error("instance_token should NOT change on sync (drift handled by reconciler)")
+	if ownerAfter.Status == "closed" {
+		t.Fatalf("owner bead %s was closed even though it owns visible session_name %q", owner.ID, ownerSessionName)
+	}
+	duplicateAfter, err := store.Get(duplicate.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if duplicateAfter.Status != "closed" {
+		t.Fatalf("duplicate bead %s status = %q, want closed", duplicate.ID, duplicateAfter.Status)
+	}
+	if got := duplicateAfter.Metadata["close_reason"]; got != "duplicate" {
+		t.Fatalf("duplicate close_reason = %q, want duplicate", got)
 	}
 }
 
-func TestSyncSessionBeads_OrphanDetection(t *testing.T) {
+func TestSyncSessionBeads_StalePoolSnapshotReusesVisibleOwner(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
+	template := "pack/worker"
 
-	// Create a bead for "old-agent".
-	ds := map[string]TemplateParams{
-		"old-agent": {TemplateName: "old-agent", Command: "claude"},
+	owner, err := createPoolSessionBead(store, template, nil, clk.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	ownerSessionName := owner.Metadata["session_name"]
+	visible, err := loadSessionBeads(store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ownerVisible := false
+	for _, b := range visible {
+		if b.ID == owner.ID {
+			ownerVisible = true
+			break
+		}
+	}
+	if !ownerVisible {
+		t.Fatalf("precondition failed: owner bead %s is not visible in the store", owner.ID)
 	}
 
+	staleSnapshot := newSessionBeadSnapshot(nil)
+	ds := map[string]TemplateParams{
+		ownerSessionName: {
+			TemplateName: template,
+			InstanceName: template + "-2",
+			PoolSlot:     2,
+			Command:      "codex",
+		},
+	}
 	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-
-	// Now sync with a different agent list (old-agent removed from config too).
-	ds2 := map[string]TemplateParams{
-		"new-agent": {TemplateName: "new-agent", Command: "claude"},
+	syncSessionBeadsWithSnapshot("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false, staleSnapshot)
+	if !strings.Contains(stderr.String(), "recovered visible owner") {
+		t.Fatalf("stderr %q does not mention recovered visible owner", stderr.String())
 	}
-	clk.Advance(5 * time.Second)
-	// configuredNames only has new-agent — old-agent is truly orphaned.
-	syncSessionBeads("", store, ds2, sp, allConfiguredDS(ds2), nil, clk, &stderr, false)
 
-	// old-agent's bead should be closed with reason "orphaned".
 	all := allSessionBeads(t, store)
-	var oldBead beads.Bead
+	if len(all) != 1 {
+		t.Fatalf("sync created %d session beads, want only the visible owner bead", len(all))
+	}
 	for _, b := range all {
-		if b.Metadata["session_name"] == "old-agent" {
-			oldBead = b
-			break
+		if b.ID != owner.ID && b.Metadata["session_name"] == ownerSessionName {
+			t.Fatalf("new bead %s reused visible owner bead %s session_name %q", b.ID, owner.ID, ownerSessionName)
+		}
+		if b.ID != owner.ID && b.Metadata["pool_slot"] == "2" {
+			if got, want := b.Metadata["session_name"], PoolSessionName(template, b.ID); got != want {
+				t.Fatalf("new pool bead session_name = %q, want %q", got, want)
+			}
 		}
 	}
-	if oldBead.Status != "closed" {
-		t.Errorf("old-agent status = %q, want %q", oldBead.Status, "closed")
-	}
-	if oldBead.Metadata["state"] != "orphaned" {
-		t.Errorf("old-agent state = %q, want %q", oldBead.Metadata["state"], "orphaned")
+}
+
+func TestSyncSessionBeads_DoesNotCompactLivePoolSlotIdentity(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 5, 5, 17, 30, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               "pack",
+			MaxActiveSessions: intPtr(10),
+		}},
 	}
-	if oldBead.Metadata["close_reason"] != "orphaned" {
-		t.Errorf("old-agent close_reason = %q, want %q", oldBead.Metadata["close_reason"], "orphaned")
+	template := "pack/worker"
+	sessionName := "pack-worker-mc-live"
+
+	live, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         sessionName,
+			"agent_name":           "pack/worker-6",
+			"alias":                "pack/worker-6",
+			"pool_slot":            "6",
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if oldBead.Metadata["closed_at"] == "" {
-		t.Error("old-agent closed_at is empty")
+
+	desired := map[string]TemplateParams{
+		sessionName: {
+			TemplateName: template,
+			InstanceName: "pack/worker-6",
+			Alias:        "pack/worker-6",
+			PoolSlot:     6,
+		},
+		"pack-worker-mc-other": {
+			TemplateName: template,
+			InstanceName: "pack/worker-1",
+			Alias:        "pack/worker-1",
+			PoolSlot:     1,
+		},
 	}
-}
 
-func TestSyncSessionBeads_NilStore(t *testing.T) {
-	// Verify nil store does not panic.
 	var stderr bytes.Buffer
-	syncSessionBeads("", nil, nil, nil, nil, nil, &clock.Fake{}, &stderr, false)
+	syncSessionBeads("", store, desired, sp, allConfiguredDS(desired), cfg, clk, &stderr, false)
 	if stderr.Len() > 0 {
 		t.Fatalf("unexpected stderr: %s", stderr.String())
 	}
-}
-
-func TestSyncSessionBeads_StoppedAgent(t *testing.T) {
-	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
-	sp := runtime.NewFake() // mayor NOT started → IsRunning returns false
 
-	ds := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude"},
+	got, err := store.Get(live.ID)
+	if err != nil {
+		t.Fatal(err)
 	}
-
-	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-
-	all := allSessionBeads(t, store)
-	if len(all) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(all))
+	if got.Metadata["pool_slot"] != "6" {
+		t.Fatalf("pool_slot = %q, want live identity slot 6", got.Metadata["pool_slot"])
 	}
-	if all[0].Metadata["state"] != "stopped" {
-		t.Errorf("state = %q, want %q", all[0].Metadata["state"], "stopped")
+	if got.Metadata["alias"] != "pack/worker-6" {
+		t.Fatalf("alias = %q, want pack/worker-6", got.Metadata["alias"])
 	}
-	if all[0].Metadata["pending_create_claim"] != "true" {
-		t.Errorf("pending_create_claim = %q, want true", all[0].Metadata["pending_create_claim"])
+	if got.Metadata["agent_name"] != "pack/worker-6" {
+		t.Fatalf("agent_name = %q, want pack/worker-6", got.Metadata["agent_name"])
 	}
 }
 
-func TestSyncSessionBeads_ClosedBeadCreatesNew(t *testing.T) {
+func TestSyncSessionBeads_RewritesStalePoolSlotWhenConcreteIdentityAgrees(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 5, 6, 2, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               "pack",
+			MaxActiveSessions: intPtr(10),
+		}},
+	}
+	template := "pack/worker"
+	sessionName := "pack-worker-live"
 
-	ds := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude"},
+	live, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         sessionName,
+			"agent_name":           "pack/worker-6",
+			"alias":                "pack/worker-6",
+			"pool_slot":            "1",
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	desired := map[string]TemplateParams{
+		sessionName: {
+			TemplateName: template,
+			InstanceName: "pack/worker-6",
+			Alias:        "pack/worker-6",
+			PoolSlot:     6,
+		},
 	}
 
 	var stderr bytes.Buffer
+	syncSessionBeads("", store, desired, sp, allConfiguredDS(desired), cfg, clk, &stderr, false)
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
 
-	// First sync creates the bead.
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-
-	all, _ := store.ListByLabel(sessionBeadLabel, 0)
-	if len(all) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(all))
+	got, err := store.Get(live.ID)
+	if err != nil {
+		t.Fatal(err)
 	}
+	if got.Metadata["pool_slot"] != "6" {
+		t.Fatalf("pool_slot = %q, want repaired slot 6", got.Metadata["pool_slot"])
+	}
+}
 
-	// Close the bead to simulate a completed lifecycle.
-	_ = store.Close(all[0].ID)
-
-	// Re-sync should create a NEW bead, not reuse the closed one.
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+func TestSyncSessionBeads_DoesNotRewriteOwnershipWhenAliasRepairFails(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 5, 6, 2, 5, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               "pack",
+			MaxActiveSessions: intPtr(10),
+		}},
+	}
+	template := "pack/worker"
+	if _, err := store.Create(beads.Bead{
+		Title:  "incumbent",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         "pack-worker-incumbent",
+			"agent_name":           "pack/worker-2",
+			"alias":                "pack/worker-2",
+			"pool_slot":            "2",
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	live, err := store.Create(beads.Bead{
+		Title:  "legacy worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         "pack-worker-legacy",
+			"agent_name":           template,
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	all = allSessionBeads(t, store)
-	if len(all) != 2 {
-		t.Fatalf("expected 2 beads (1 closed + 1 new), got %d", len(all))
+	desired := map[string]TemplateParams{
+		"pack-worker-legacy": {
+			TemplateName: template,
+			InstanceName: "pack/worker-2",
+			Alias:        "pack/worker-2",
+			PoolSlot:     2,
+		},
 	}
 
-	// Find the open bead.
-	var openBead beads.Bead
-	for _, b := range all {
-		if b.Status == "open" {
-			openBead = b
-			break
-		}
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, desired, sp, allConfiguredDS(desired), cfg, clk, &stderr, false)
+	got, err := store.Get(live.ID)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if openBead.ID == "" {
-		t.Fatal("no open bead found after re-sync")
+	if got.Metadata["agent_name"] != template {
+		t.Fatalf("agent_name = %q, want unchanged template identity after alias conflict", got.Metadata["agent_name"])
 	}
-	if openBead.Metadata["state"] != "active" {
-		t.Errorf("state = %q, want %q", openBead.Metadata["state"], "active")
+	if got.Metadata["pool_slot"] != "" {
+		t.Fatalf("pool_slot = %q, want unset after alias conflict", got.Metadata["pool_slot"])
 	}
-	if openBead.Metadata["generation"] != "1" {
-		t.Errorf("generation = %q, want %q (fresh bead)", openBead.Metadata["generation"], "1")
+	if got.Metadata["alias"] != "" {
+		t.Fatalf("alias = %q, want unchanged empty alias after conflict", got.Metadata["alias"])
+	}
+	if got.Metadata[poolAliasConflictMetadataKey] != "pack/worker-2" {
+		t.Fatalf("pool_alias_conflict = %q, want pack/worker-2", got.Metadata[poolAliasConflictMetadataKey])
+	}
+	if got.Metadata[poolAliasConflictCountMetadataKey] != "1" {
+		t.Fatalf("pool_alias_conflict_count = %q, want 1", got.Metadata[poolAliasConflictCountMetadataKey])
+	}
+	if got.Metadata[poolAliasConflictAtMetadataKey] != "2026-05-06T02:05:00Z" {
+		t.Fatalf("pool_alias_conflict_at = %q, want 2026-05-06T02:05:00Z", got.Metadata[poolAliasConflictAtMetadataKey])
+	}
+	if !strings.Contains(stderr.String(), "unavailable") {
+		t.Fatalf("stderr %q does not mention alias conflict", stderr.String())
 	}
 }
 
-func TestSyncSessionBeads_PoolInstanceOrphaned(t *testing.T) {
+func TestSyncSessionBeads_DoesNotReservePoolSlotForAliasConflictBead(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 5, 6, 2, 10, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "city-worker-1", runtime.Config{Command: "claude"})
-	_ = sp.Start(context.TODO(), "city-worker-2", runtime.Config{Command: "claude"})
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               "pack",
+			MaxActiveSessions: intPtr(10),
+		}},
+	}
+	template := "pack/worker"
+	if _, err := store.Create(beads.Bead{
+		Title:  "alias owner",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         "pack-worker-owner-2",
+			"agent_name":           "pack/worker-2",
+			"alias":                "pack/worker-2",
+			"pool_slot":            "2",
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:  "legacy worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         "pack-worker-a-legacy",
+			"agent_name":           template,
+			"pool_slot":            "6",
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	live, err := store.Create(beads.Bead{
+		Title:  "live worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":             template,
+			"session_name":         "pack-worker-z-live",
+			"agent_name":           "pack/worker-6",
+			"alias":                "pack/worker-6",
+			"pool_slot":            "6",
+			"state":                "awake",
+			"session_origin":       "ephemeral",
+			poolManagedMetadataKey: boolMetadata(true),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	ds := map[string]TemplateParams{
-		"city-worker-1": {TemplateName: "worker", Command: "claude"},
-		"city-worker-2": {TemplateName: "worker", Command: "claude"},
+	desired := map[string]TemplateParams{
+		"pack-worker-a-legacy": {
+			TemplateName: template,
+			InstanceName: "pack/worker-2",
+			Alias:        "pack/worker-2",
+			PoolSlot:     2,
+		},
+		"pack-worker-z-live": {
+			TemplateName: template,
+			InstanceName: "pack/worker-6",
+			Alias:        "pack/worker-6",
+			PoolSlot:     6,
+		},
 	}
 
 	var stderr bytes.Buffer
-	// configuredNames has the template name, not instance names.
-	configuredNames := map[string]bool{"city-worker": true}
-	syncSessionBeads("", store, ds, sp, configuredNames, nil, clk, &stderr, false)
-
-	// Remove instances from runnable agents but keep template configured.
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, nil, sp, configuredNames, nil, clk, &stderr, false)
+	syncSessionBeads("", store, desired, sp, allConfiguredDS(desired), cfg, clk, &stderr, false)
+	if !strings.Contains(stderr.String(), "unavailable") {
+		t.Fatalf("stderr %q does not mention alias conflict", stderr.String())
+	}
 
-	// Pool instances are ephemeral (not user-configured), so they become
-	// closed with reason "orphaned" when no longer running.
-	all, _ := store.ListByLabel(sessionBeadLabel, 0)
-	for _, b := range all {
-		if b.Status != "closed" {
-			t.Errorf("pool instance %s status = %q, want %q",
-				b.Metadata["session_name"], b.Status, "closed")
-		}
-		if b.Metadata["state"] != "orphaned" {
-			t.Errorf("pool instance %s state = %q, want %q",
-				b.Metadata["session_name"], b.Metadata["state"], "orphaned")
-		}
-		if b.Metadata["close_reason"] != "orphaned" {
-			t.Errorf("pool instance %s close_reason = %q, want %q",
-				b.Metadata["session_name"], b.Metadata["close_reason"], "orphaned")
-		}
+	got, err := store.Get(live.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Metadata["pool_slot"] != "6" {
+		t.Fatalf("pool_slot = %q, want live identity slot 6 preserved", got.Metadata["pool_slot"])
 	}
 }
 
-func TestSyncSessionBeads_ResumedAfterSuspension(t *testing.T) {
+func TestSyncSessionBeads_PreservesAliasConflictMetadataWhenAliasLockFails(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 5, 6, 2, 15, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
-
-	ds := map[string]TemplateParams{
-		"worker": {TemplateName: "worker", Command: "claude"},
+	cfg := &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			Dir:               "pack",
+			MaxActiveSessions: intPtr(10),
+		}},
+	}
+	template := "pack/worker"
+	live, err := store.Create(beads.Bead{
+		Title:  "legacy worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:" + template},
+		Metadata: map[string]string{
+			"template":                        template,
+			"session_name":                    "pack-worker-legacy",
+			"agent_name":                      template,
+			"state":                           "awake",
+			"session_origin":                  "ephemeral",
+			poolManagedMetadataKey:            boolMetadata(true),
+			poolAliasConflictMetadataKey:      "pack/worker-2",
+			poolAliasConflictCountMetadataKey: "3",
+			poolAliasConflictAtMetadataKey:    "2026-05-06T02:10:00Z",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
 	}
 
-	var stderr bytes.Buffer
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	desired := map[string]TemplateParams{
+		"pack-worker-legacy": {
+			TemplateName: template,
+			InstanceName: "pack/worker-2",
+			Alias:        "pack/worker-2",
+			PoolSlot:     2,
+		},
+	}
 
-	// Suspend the agent: remove from runnable but keep in configuredNames.
-	clk.Advance(5 * time.Second)
-	configuredNames := map[string]bool{"worker": true}
-	syncSessionBeads("", store, nil, sp, configuredNames, nil, clk, &stderr, false)
+	cityRoot := t.TempDir()
+	cityPath := filepath.Join(cityRoot, "not-a-dir")
+	if err := os.WriteFile(cityPath, []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
-	// Verify the bead is closed.
-	all := allSessionBeads(t, store)
-	if len(all) != 1 {
-		t.Fatalf("expected 1 bead after suspension, got %d", len(all))
+	var stderr bytes.Buffer
+	syncSessionBeads(cityPath, store, desired, sp, allConfiguredDS(desired), cfg, clk, &stderr, false)
+	got, err := store.Get(live.ID)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if all[0].Status != "closed" {
-		t.Fatalf("bead status = %q, want %q", all[0].Status, "closed")
+	if got.Metadata[poolAliasConflictMetadataKey] != "pack/worker-2" {
+		t.Fatalf("pool_alias_conflict = %q, want preserved %q", got.Metadata[poolAliasConflictMetadataKey], "pack/worker-2")
+	}
+	if got.Metadata[poolAliasConflictCountMetadataKey] != "3" {
+		t.Fatalf("pool_alias_conflict_count = %q, want preserved %q", got.Metadata[poolAliasConflictCountMetadataKey], "3")
 	}
+	if got.Metadata[poolAliasConflictAtMetadataKey] != "2026-05-06T02:10:00Z" {
+		t.Fatalf("pool_alias_conflict_at = %q, want preserved %q", got.Metadata[poolAliasConflictAtMetadataKey], "2026-05-06T02:10:00Z")
+	}
+	if !strings.Contains(stderr.String(), "locking alias") {
+		t.Fatalf("stderr %q does not mention alias lock failure", stderr.String())
+	}
+}
 
-	// Resume the agent: return it to the runnable set.
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+func TestCreatePoolSessionBead_MetadataFailureLeavesReachablePlaceholder(t *testing.T) {
+	store := &failingPoolSessionNameStore{MemStore: beads.NewMemStore()}
+	template := "pack/worker"
 
-	// Should have 2 beads: 1 closed (old lifecycle) + 1 open (new lifecycle).
-	all = allSessionBeads(t, store)
-	if len(all) != 2 {
-		t.Fatalf("expected 2 beads after resume, got %d", len(all))
+	if _, err := createPoolSessionBead(store, template, nil, time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)); err == nil {
+		t.Fatal("createPoolSessionBead returned nil error, want session_name metadata failure")
 	}
 
-	var closedCount, openCount int
-	for _, b := range all {
-		switch b.Status {
-		case "closed":
-			closedCount++
-		case "open":
-			openCount++
-			if b.Metadata["state"] != "active" {
-				t.Errorf("resumed bead state = %q, want %q", b.Metadata["state"], "active")
-			}
-			if b.Metadata["generation"] != "1" {
-				t.Errorf("resumed bead generation = %q, want %q (fresh lifecycle)", b.Metadata["generation"], "1")
-			}
-		}
+	all := allSessionBeads(t, store)
+	if len(all) != 1 {
+		t.Fatalf("created %d session beads, want 1 failed-create bead", len(all))
 	}
-	if closedCount != 1 || openCount != 1 {
-		t.Errorf("expected 1 closed + 1 open, got %d closed + %d open", closedCount, openCount)
+	if got := strings.TrimSpace(all[0].Metadata["session_name"]); got == "" {
+		t.Fatalf("failed pool bead session_name is empty: %+v", all[0])
+	}
+	if got, final := all[0].Metadata["session_name"], PoolSessionName(template, all[0].ID); got == final {
+		t.Fatalf("failed pool bead session_name = final name %q even though SetMetadata failed", got)
 	}
 }
 
-func TestSyncSessionBeads_StaleCloseMetadataCleared(t *testing.T) {
-	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+func TestSyncSessionBeads_PoolSessionNameFailureLeavesReachableFailedCreate(t *testing.T) {
+	store := &failingPoolSessionNameStore{MemStore: beads.NewMemStore()}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
-
+	template := "pack/worker"
 	ds := map[string]TemplateParams{
-		"worker": {TemplateName: "worker", Command: "claude"},
+		"legacy-worker-1": {
+			TemplateName: template,
+			InstanceName: template + "-1",
+			PoolSlot:     1,
+			Command:      "codex",
+		},
 	}
 
 	var stderr bytes.Buffer
 	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	// Simulate a partially-failed closeBead: set close_reason on the
-	// open bead as if setMeta("close_reason") succeeded but store.Close
-	// failed. The bead stays open with stale terminal metadata.
-	all, _ := store.ListByLabel(sessionBeadLabel, 0)
-	_ = store.SetMetadata(all[0].ID, "close_reason", "orphaned")
-	_ = store.SetMetadata(all[0].ID, "closed_at", "2026-03-07T12:00:05Z")
-
-	// Agent resumes — sync should clear the stale close metadata.
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
-
-	all, _ = store.ListByLabel(sessionBeadLabel, 0)
+	all := allSessionBeads(t, store)
 	if len(all) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(all))
+		t.Fatalf("created %d session beads, want 1 failed-create bead", len(all))
 	}
-	b := all[0]
-	if b.Status != "open" {
-		t.Errorf("status = %q, want %q", b.Status, "open")
+	failed := all[0]
+	if failed.Status != "open" {
+		t.Fatalf("failed-create bead status = %q, want open because Close failed", failed.Status)
 	}
-	if b.Metadata["state"] != "active" {
-		t.Errorf("state = %q, want %q", b.Metadata["state"], "active")
+	if got := strings.TrimSpace(failed.Metadata["session_name"]); got == "" {
+		t.Fatalf("failed-create bead session_name is empty: %+v", failed)
 	}
-	if b.Metadata["close_reason"] != "" {
-		t.Errorf("close_reason = %q, want empty (stale metadata not cleared)", b.Metadata["close_reason"])
+	if got := failed.Metadata["close_reason"]; got != "failed-create" {
+		t.Fatalf("failed-create close_reason = %q, want failed-create", got)
 	}
-	if b.Metadata["closed_at"] != "" {
-		t.Errorf("closed_at = %q, want empty (stale metadata not cleared)", b.Metadata["closed_at"])
+	if got := failed.Metadata["pending_create_claim"]; got != "" {
+		t.Fatalf("failed-create pending_create_claim = %q, want cleared", got)
+	}
+	if !strings.Contains(stderr.String(), "session_name metadata failed") {
+		t.Fatalf("stderr %q does not mention session_name metadata failure", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "close failed") {
+		t.Fatalf("stderr %q does not mention failed cleanup close", stderr.String())
 	}
 }
 
-func TestSyncSessionBeads_SuspendedAgentNotOrphaned(t *testing.T) {
+// TestSyncSessionBeads_RefreshesStoredCommandOnConfigChange reproduces an
+// observed bug where an agent that got an `[option_defaults] model = "opus"`
+// entry added to its config after its session bead was created never picked up
+// the resulting `--model claude-opus-4-6` flag — even across `gc restart`.
+//
+// Root cause: session_beads.go only wrote `metadata.command` when it was empty
+// ("backfill") so the stored value was frozen at first-create time. If any
+// respawn path reads `metadata.command` (used by `gc session attach` and the
+// fallback in worker/handle_lifecycle.go:427), the agent runs with stale CLI
+// flags forever.
+//
+// This test captures the contract that `syncSessionBeadsWithSnapshot` MUST
+// refresh `metadata.command` to match freshly resolved `tp.Command` whenever
+// the two differ.
+func TestSyncSessionBeads_RefreshesStoredCommandOnConfigChange(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 17, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
-	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
+	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude --dangerously-skip-permissions --effort max"})
 
+	// Tick 1: initial bead creation. Command lacks --model (mirrors a session
+	// created before option_defaults.model was added to the agent config).
+	beforeCmd := "claude --dangerously-skip-permissions --effort max"
 	ds := map[string]TemplateParams{
-		"mayor":  {TemplateName: "mayor", Command: "claude"},
-		"worker": {TemplateName: "worker", Command: "claude"},
+		"mayor": {TemplateName: "mayor", Command: beforeCmd},
 	}
-
 	var stderr bytes.Buffer
 	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	// Now "suspend" worker: remove from runnable agents but keep in configuredNames.
-	dsOnlyMayor := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude"},
+	beads1 := allSessionBeads(t, store)
+	if len(beads1) != 1 {
+		t.Fatalf("expected 1 bead after tick 1, got %d", len(beads1))
 	}
-	configuredNames := map[string]bool{
-		"mayor":  true,
-		"worker": true, // still configured, just suspended
+	if got := beads1[0].Metadata["command"]; got != beforeCmd {
+		t.Fatalf("tick 1: command = %q, want %q", got, beforeCmd)
 	}
-	clk.Advance(5 * time.Second)
-	syncSessionBeads("", store, dsOnlyMayor, sp, configuredNames, nil, clk, &stderr, false)
 
-	// Worker should be closed with reason "suspended", not "orphaned".
-	all := allSessionBeads(t, store)
-	var workerBead beads.Bead
-	for _, b := range all {
-		if b.Metadata["session_name"] == "worker" {
-			workerBead = b
-			break
-		}
-	}
-	if workerBead.Status != "closed" {
-		t.Errorf("worker status = %q, want %q", workerBead.Status, "closed")
+	// Tick 2: agent config grows an option_defaults.model entry. Fresh
+	// tp.Command now includes --model claude-opus-4-6. This is the scenario
+	// that broke in production: stored metadata.command was never updated.
+	afterCmd := "claude --dangerously-skip-permissions --effort max --model claude-opus-4-6"
+	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: afterCmd}
+	clk.Advance(3 * 24 * time.Hour) // 2026-04-17 → 2026-04-20
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	beads2 := allSessionBeads(t, store)
+	if len(beads2) != 1 {
+		t.Fatalf("expected 1 bead after tick 2, got %d", len(beads2))
 	}
-	if workerBead.Metadata["state"] != "suspended" {
-		t.Errorf("worker state = %q, want %q", workerBead.Metadata["state"], "suspended")
+	if got := beads2[0].Metadata["command"]; got != afterCmd {
+		t.Errorf("tick 2: stored command was not refreshed.\n  got:  %q\n  want: %q\nthis is the option_defaults-propagation bug — stale command persists across config changes", got, afterCmd)
 	}
-	if workerBead.Metadata["close_reason"] != "suspended" {
-		t.Errorf("worker close_reason = %q, want %q", workerBead.Metadata["close_reason"], "suspended")
+
+	// Sanity: an empty tp.Command (e.g., resolution failure) must NOT clobber
+	// the stored value — the refresh is guarded on `tp.Command != ""`.
+	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: ""}
+	clk.Advance(time.Minute)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	beads3 := allSessionBeads(t, store)
+	if got := beads3[0].Metadata["command"]; got != afterCmd {
+		t.Errorf("tick 3: empty tp.Command should not clobber stored command.\n  got:  %q\n  want: %q", got, afterCmd)
 	}
 }
 
-func TestSyncSessionBeads_ReturnsIndex(t *testing.T) {
+func TestSyncSessionBeads_ConfigDrift(t *testing.T) {
 	store := beads.NewMemStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
 	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
-	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
 
 	ds := map[string]TemplateParams{
-		"mayor":  {TemplateName: "mayor", Command: "claude"},
-		"worker": {TemplateName: "worker", Command: "claude"},
+		"mayor": {TemplateName: "mayor", Command: "claude"},
 	}
 
 	var stderr bytes.Buffer
-	idx := syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	if stderr.Len() > 0 {
-		t.Fatalf("unexpected stderr: %s", stderr.String())
-	}
+	all := allSessionBeads(t, store)
+	token1 := all[0].Metadata["instance_token"]
 
-	// Index should contain both agents.
-	if len(idx) != 2 {
-		t.Fatalf("index length = %d, want 2", len(idx))
+	// Change config — different command.
+	ds["mayor"] = TemplateParams{TemplateName: "mayor", Command: "gemini"}
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	// syncSessionBeads no longer updates config_hash for existing beads.
+	// The bead-driven reconciler (reconcileSessionBeads) detects drift by
+	// comparing bead config_hash against the current desired config and
+	// updates it only after successful restart.
+	all, _ = store.ListByLabel(sessionBeadLabel, 0)
+	if all[0].Metadata["generation"] != "1" {
+		t.Errorf("generation = %q, want %q (should not change on sync)", all[0].Metadata["generation"], "1")
 	}
-	if idx["mayor"] == "" {
-		t.Error("index missing mayor")
+	if all[0].Metadata["instance_token"] != token1 {
+		t.Error("instance_token should NOT change on sync (drift handled by reconciler)")
 	}
-	if idx["worker"] == "" {
-		t.Error("index missing worker")
+}
+
+func TestSyncSessionBeads_OrphanDetection(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+
+	// Create a bead for "old-agent".
+	ds := map[string]TemplateParams{
+		"old-agent": {TemplateName: "old-agent", Command: "claude"},
 	}
 
-	// Verify IDs match actual beads.
-	all, _ := store.ListByLabel(sessionBeadLabel, 0)
-	beadIDs := make(map[string]string)
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	// Now sync with a different agent list (old-agent removed from config too).
+	ds2 := map[string]TemplateParams{
+		"new-agent": {TemplateName: "new-agent", Command: "claude"},
+	}
+	clk.Advance(5 * time.Second)
+	// configuredNames only has new-agent — old-agent is truly orphaned.
+	syncSessionBeads("", store, ds2, sp, allConfiguredDS(ds2), nil, clk, &stderr, false)
+
+	// old-agent's bead should be closed with reason "orphaned".
+	all := allSessionBeads(t, store)
+	var oldBead beads.Bead
 	for _, b := range all {
-		beadIDs[b.Metadata["session_name"]] = b.ID
+		if b.Metadata["session_name"] == "old-agent" {
+			oldBead = b
+			break
+		}
 	}
-	if idx["mayor"] != beadIDs["mayor"] {
-		t.Errorf("mayor ID = %q, want %q", idx["mayor"], beadIDs["mayor"])
+	if oldBead.Status != "closed" {
+		t.Errorf("old-agent status = %q, want %q", oldBead.Status, "closed")
 	}
-	if idx["worker"] != beadIDs["worker"] {
-		t.Errorf("worker ID = %q, want %q", idx["worker"], beadIDs["worker"])
+	if oldBead.Metadata["state"] != "orphaned" {
+		t.Errorf("old-agent state = %q, want %q", oldBead.Metadata["state"], "orphaned")
+	}
+	if oldBead.Metadata["close_reason"] != "orphaned" {
+		t.Errorf("old-agent close_reason = %q, want %q", oldBead.Metadata["close_reason"], "orphaned")
+	}
+	if oldBead.Metadata["closed_at"] == "" {
+		t.Error("old-agent closed_at is empty")
 	}
+}
 
-	// Suspend worker — closed beads excluded from index.
-	clk.Advance(5 * time.Second)
-	cfgNames := map[string]bool{"mayor": true, "worker": true}
-	dsOnlyMayor := map[string]TemplateParams{
-		"mayor": {TemplateName: "mayor", Command: "claude"},
+func TestSyncSessionBeads_OrphanStopFailureKeepsRunningBeadOpen(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "old-agent", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start old-agent: %v", err)
 	}
-	idx2 := syncSessionBeads("", store, dsOnlyMayor, sp, cfgNames, nil, clk, &stderr, false)
+	sp.StopErrors["old-agent"] = errors.New("stop failed")
 
-	if len(idx2) != 1 {
-		t.Fatalf("after suspend, index length = %d, want 1", len(idx2))
+	ds := map[string]TemplateParams{
+		"old-agent": {TemplateName: "old-agent", Command: "true"},
 	}
-	if idx2["mayor"] == "" {
-		t.Error("after suspend, index missing mayor")
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	ds2 := map[string]TemplateParams{
+		"new-agent": {TemplateName: "new-agent", Command: "true"},
 	}
-	if _, ok := idx2["worker"]; ok {
-		t.Error("after suspend, index should not contain worker")
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds2, sp, allConfiguredDS(ds2), nil, clk, &stderr, false)
+
+	all := allSessionBeads(t, store)
+	var oldBead beads.Bead
+	for _, b := range all {
+		if b.Metadata["session_name"] == "old-agent" {
+			oldBead = b
+			break
+		}
+	}
+	if oldBead.ID == "" {
+		t.Fatal("old-agent bead was not found by session_name while runtime is still running")
+	}
+	if oldBead.Status != "open" {
+		t.Fatalf("old-agent status = %q, want open", oldBead.Status)
+	}
+	if oldBead.Metadata["close_reason"] != "" {
+		t.Fatalf("old-agent close_reason = %q, want empty", oldBead.Metadata["close_reason"])
+	}
+	if !sp.IsRunning("old-agent") {
+		t.Fatal("old-agent runtime unexpectedly stopped")
 	}
 }
 
-// --- loadSessionBeads tests ---
+func TestSyncSessionBeads_NilStore(t *testing.T) {
+	// Verify nil store does not panic.
+	var stderr bytes.Buffer
+	syncSessionBeads("", nil, nil, nil, nil, nil, &clock.Fake{}, &stderr, false)
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+}
 
-func TestLoadSessionBeads_SingleBead(t *testing.T) {
+func TestSyncSessionBeads_StoppedAgent(t *testing.T) {
 	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake() // mayor NOT started → IsRunning returns false
 
-	_, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name": "worker",
-			"state":        "active",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
+	ds := map[string]TemplateParams{
+		"mayor": {TemplateName: "mayor", Command: "claude"},
 	}
 
-	result, err := loadSessionBeads(store)
-	if err != nil {
-		t.Fatal(err)
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	all := allSessionBeads(t, store)
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(all))
 	}
-	if len(result) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(result))
+	if all[0].Metadata["state"] != "creating" {
+		t.Errorf("state = %q, want %q", all[0].Metadata["state"], "creating")
 	}
-	if result[0].Metadata["session_name"] != "worker" {
-		t.Errorf("session_name = %q, want worker", result[0].Metadata["session_name"])
+	if all[0].Metadata["pending_create_claim"] != "true" {
+		t.Errorf("pending_create_claim = %q, want true", all[0].Metadata["pending_create_claim"])
 	}
 }
 
-func TestSyncSessionBeads_RepairsEmptyType(t *testing.T) {
+func TestSyncSessionBeads_ClosedBeadCreatesNew(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 4, 2, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
 	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
 
-	// Create a session bead, then corrupt its type to empty string.
-	// MemStore defaults empty types to "task", so we create normally then
-	// update to empty to simulate the corruption seen in production (BdStore
-	// preserves empty types from the database).
-	b, err := store.Create(beads.Bead{
-		Title:  "mayor",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name": "mayor",
-			"state":        "active",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	emptyType := ""
-	if err := store.Update(b.ID, beads.UpdateOpts{Type: &emptyType}); err != nil {
-		t.Fatal(err)
-	}
-
 	ds := map[string]TemplateParams{
 		"mayor": {TemplateName: "mayor", Command: "claude"},
 	}
 
 	var stderr bytes.Buffer
+
+	// First sync creates the bead.
 	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	// The bead's type should have been repaired to "session".
-	got, err := store.Get(b.ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.Type != sessionBeadType {
-		t.Errorf("type after repair = %q, want %q", got.Type, sessionBeadType)
+	all, _ := store.ListByLabel(sessionBeadLabel, 0)
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(all))
 	}
-}
 
-func TestLoadSessionBeads_NewTypeOnly(t *testing.T) {
-	store := beads.NewMemStore()
+	// Close the bead to simulate a completed lifecycle.
+	_ = store.Close(all[0].ID)
 
-	_, err := store.Create(beads.Bead{
-		Title:  "worker",
-		Type:   "session",
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name": "worker",
-			"state":        "active",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	// Re-sync should create a NEW bead, not reuse the closed one.
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	result, err := loadSessionBeads(store)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(result) != 1 {
-		t.Fatalf("expected 1 bead, got %d", len(result))
+	all = allSessionBeads(t, store)
+	if len(all) != 2 {
+		t.Fatalf("expected 2 beads (1 closed + 1 new), got %d", len(all))
 	}
-}
-
-func TestLoadSessionBeads_PoolOccupancy(t *testing.T) {
-	store := beads.NewMemStore()
-
-	// Three session beads for different pool slots.
-	_, _ = store.Create(beads.Bead{
-		Title:  "worker-1",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name": "worker-1",
-			"template":     "worker",
-			"state":        "active",
-			"pool_slot":    "1",
-		},
-	})
-	_, _ = store.Create(beads.Bead{
-		Title:  "worker-2",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name": "worker-2",
-			"template":     "worker",
-			"state":        "active",
-			"pool_slot":    "2",
-		},
-	})
-	_, _ = store.Create(beads.Bead{
-		Title:  "worker-3",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name": "worker-3",
-			"template":     "worker",
-			"state":        "active",
-			"pool_slot":    "3",
-		},
-	})
 
-	result, err := loadSessionBeads(store)
-	if err != nil {
-		t.Fatal(err)
+	// Find the open bead.
+	var openBead beads.Bead
+	for _, b := range all {
+		if b.Status == "open" {
+			openBead = b
+			break
+		}
 	}
-	// All 3 should be returned.
-	if len(result) != 3 {
-		t.Fatalf("expected 3 beads for pool occupancy, got %d", len(result))
+	if openBead.ID == "" {
+		t.Fatal("no open bead found after re-sync")
+	}
+	if openBead.Metadata["state"] != "active" {
+		t.Errorf("state = %q, want %q", openBead.Metadata["state"], "active")
+	}
+	if openBead.Metadata["generation"] != "1" {
+		t.Errorf("generation = %q, want %q (fresh bead)", openBead.Metadata["generation"], "1")
 	}
 }
 
-func TestConfiguredSessionNames_IncludesForkSessions(t *testing.T) {
+func TestSyncSessionBeads_PoolInstanceOrphaned(t *testing.T) {
 	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	_ = sp.Start(context.TODO(), "city-worker-1", runtime.Config{Command: "claude"})
+	_ = sp.Start(context.TODO(), "city-worker-2", runtime.Config{Command: "claude"})
 
-	// Create the primary session bead (managed, has agent_name).
-	_, err := store.Create(beads.Bead{
-		Title:  "overseer",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "agent:overseer"},
-		Metadata: map[string]string{
-			"template":                   "overseer",
-			"agent_name":                 "overseer",
-			"session_name":               "s-primary",
-			"state":                      "active",
-			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "overseer",
-			namedSessionModeMetadata:     "on_demand",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Create a fork bead (no agent_name, from gc session new).
-	_, err = store.Create(beads.Bead{
-		Title:  "overseer fork",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:overseer"},
-		Metadata: map[string]string{
-			"template":     "overseer",
-			"session_name": "s-fork-1",
-			"state":        "active",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
+	ds := map[string]TemplateParams{
+		"city-worker-1": {TemplateName: "worker", Command: "claude"},
+		"city-worker-2": {TemplateName: "worker", Command: "claude"},
 	}
 
-	cfg := &config.City{
-		Agents:        []config.Agent{{Name: "overseer"}},
-		NamedSessions: []config.NamedSession{{Template: "overseer"}},
-	}
+	var stderr bytes.Buffer
+	// configuredNames has the template name, not instance names.
+	configuredNames := map[string]bool{"city-worker": true}
+	syncSessionBeads("", store, ds, sp, configuredNames, nil, clk, &stderr, false)
 
-	names := configuredSessionNames(cfg, "test", store)
+	// Remove instances from runnable agents but keep template configured.
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, nil, sp, configuredNames, nil, clk, &stderr, false)
 
-	// Only the canonical configured session is controller-owned.
-	if !names["s-primary"] {
-		t.Errorf("configuredSessionNames missing primary session s-primary, got: %v", names)
-	}
-	if names["s-fork-1"] {
-		t.Errorf("configuredSessionNames should not include fork session s-fork-1, got: %v", names)
+	// Pool instances are ephemeral (not user-configured), so they become
+	// closed with reason "orphaned" when no longer running.
+	all, _ := store.ListByLabel(sessionBeadLabel, 0)
+	for _, b := range all {
+		if b.Status != "closed" {
+			t.Errorf("pool instance %s status = %q, want %q",
+				b.Metadata["session_name"], b.Status, "closed")
+		}
+		if b.Metadata["state"] != "orphaned" {
+			t.Errorf("pool instance %s state = %q, want %q",
+				b.Metadata["session_name"], b.Metadata["state"], "orphaned")
+		}
+		if b.Metadata["close_reason"] != "orphaned" {
+			t.Errorf("pool instance %s close_reason = %q, want %q",
+				b.Metadata["session_name"], b.Metadata["close_reason"], "orphaned")
+		}
 	}
 }
 
-func TestConfiguredSessionNames_ExcludesClosedForks(t *testing.T) {
+func TestSyncSessionBeads_ResumedAfterSuspension(t *testing.T) {
 	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
 
-	// Primary bead.
-	_, err := store.Create(beads.Bead{
-		Title:  "overseer",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "agent:overseer"},
-		Metadata: map[string]string{
-			"template":                   "overseer",
-			"agent_name":                 "overseer",
-			"session_name":               "s-primary",
-			"state":                      "active",
-			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "overseer",
-			namedSessionModeMetadata:     "on_demand",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Closed fork bead — should NOT be in configured names.
-	fork, err := store.Create(beads.Bead{
-		Title:  "overseer old fork",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "template:overseer"},
-		Metadata: map[string]string{
-			"template":     "overseer",
-			"session_name": "s-closed-fork",
-			"state":        "closed",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
+	ds := map[string]TemplateParams{
+		"worker": {TemplateName: "worker", Command: "claude"},
 	}
-	_ = store.Close(fork.ID)
 
-	cfg := &config.City{
-		Agents:        []config.Agent{{Name: "overseer"}},
-		NamedSessions: []config.NamedSession{{Template: "overseer"}},
-	}
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	names := configuredSessionNames(cfg, "test", store)
+	// Suspend the agent: remove from runnable but keep in configuredNames.
+	clk.Advance(5 * time.Second)
+	configuredNames := map[string]bool{"worker": true}
+	syncSessionBeads("", store, nil, sp, configuredNames, nil, clk, &stderr, false)
 
-	if !names["s-primary"] {
-		t.Errorf("configuredSessionNames missing primary s-primary")
+	// Verify the bead is closed.
+	all := allSessionBeads(t, store)
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead after suspension, got %d", len(all))
 	}
-	if names["s-closed-fork"] {
-		t.Errorf("configuredSessionNames should NOT include closed fork s-closed-fork")
+	if all[0].Status != "closed" {
+		t.Fatalf("bead status = %q, want %q", all[0].Status, "closed")
 	}
-}
 
-func TestConfiguredSessionNames_DoesNotIncludePoolForks(t *testing.T) {
-	store := beads.NewMemStore()
+	// Resume the agent: return it to the runnable set.
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	cfg := &config.City{
-		Agents: []config.Agent{
-			{Name: "worker", MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(3)},
-		},
+	// Should have 2 beads: 1 closed (old lifecycle) + 1 open (new lifecycle).
+	all = allSessionBeads(t, store)
+	if len(all) != 2 {
+		t.Fatalf("expected 2 beads after resume, got %d", len(all))
 	}
 
-	// Create a pool instance bead that looks like a "fork" but is actually
-	// a pool instance. Should NOT be in configured names (pool orphan detection
-	// must still work).
-	_, err := store.Create(beads.Bead{
-		Title:  "worker-extra",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"template":     "worker",
-			"session_name": "s-worker-extra",
-			"state":        "active",
-			"pool_slot":    "5",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
+	var closedCount, openCount int
+	for _, b := range all {
+		switch b.Status {
+		case "closed":
+			closedCount++
+		case "open":
+			openCount++
+			if b.Metadata["state"] != "creating" {
+				t.Errorf("resumed bead state = %q, want %q", b.Metadata["state"], "creating")
+			}
+			if b.Metadata["pending_create_claim"] != "true" {
+				t.Errorf("resumed bead pending_create_claim = %q, want true", b.Metadata["pending_create_claim"])
+			}
+			if b.Metadata["generation"] != "1" {
+				t.Errorf("resumed bead generation = %q, want %q (fresh lifecycle)", b.Metadata["generation"], "1")
+			}
+		}
 	}
-
-	names := configuredSessionNames(cfg, "test", store)
-
-	// The pool base name should be in configured names.
-	// But the excess pool instance should NOT be (it's a pool, not a singleton).
-	if names["s-worker-extra"] {
-		t.Errorf("configuredSessionNames should NOT include pool instance s-worker-extra")
+	if closedCount != 1 || openCount != 1 {
+		t.Errorf("expected 1 closed + 1 open, got %d closed + %d open", closedCount, openCount)
 	}
 }
 
-func TestSyncSessionBeads_OrphansLegacyPoolBaseSession(t *testing.T) {
+func TestSyncSessionBeads_StaleCloseMetadataCleared(t *testing.T) {
 	store := beads.NewMemStore()
-	clk := &clock.Fake{Time: time.Date(2026, 4, 2, 12, 0, 0, 0, time.UTC)}
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
 	sp := runtime.NewFake()
-	cfg := &config.City{
-		Workspace: config.Workspace{Name: "test-city"},
-		Agents: []config.Agent{{
-			Name:              "polecat",
-			Dir:               "repo",
-			MinActiveSessions: intPtr(0),
-			MaxActiveSessions: intPtr(5),
-		}},
+	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
+
+	ds := map[string]TemplateParams{
+		"worker": {TemplateName: "worker", Command: "claude"},
 	}
 
-	legacySessionName := agent.SessionNameFor(
-		config.EffectiveCityName(cfg, ""),
-		cfg.Agents[0].QualifiedName(),
-		cfg.Workspace.SessionTemplate,
-	)
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	legacy, err := store.Create(beads.Bead{
-		Title:  "repo/polecat",
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel, "agent:repo/polecat"},
-		Metadata: map[string]string{
-			"template":     "repo/polecat",
-			"agent_name":   "repo/polecat",
-			"session_name": legacySessionName,
-			"alias":        "repo/polecat",
-			"state":        "asleep",
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
+	// Simulate a partially-failed closeBead: set close_reason on the
+	// open bead as if setMeta("close_reason") succeeded but store.Close
+	// failed. The bead stays open with stale terminal metadata.
+	all, _ := store.ListByLabel(sessionBeadLabel, 0)
+	_ = store.SetMetadata(all[0].ID, "close_reason", "orphaned")
+	_ = store.SetMetadata(all[0].ID, "closed_at", "2026-03-07T12:00:05Z")
+
+	// Agent resumes — sync should clear the stale close metadata.
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	all, _ = store.ListByLabel(sessionBeadLabel, 0)
+	if len(all) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(all))
+	}
+	b := all[0]
+	if b.Status != "open" {
+		t.Errorf("status = %q, want %q", b.Status, "open")
+	}
+	if b.Metadata["state"] != "active" {
+		t.Errorf("state = %q, want %q", b.Metadata["state"], "active")
+	}
+	if b.Metadata["close_reason"] != "" {
+		t.Errorf("close_reason = %q, want empty (stale metadata not cleared)", b.Metadata["close_reason"])
 	}
+	if b.Metadata["closed_at"] != "" {
+		t.Errorf("closed_at = %q, want empty (stale metadata not cleared)", b.Metadata["closed_at"])
+	}
+}
 
-	desired := map[string]TemplateParams{
-		"polecat-ci-1jb": {
-			TemplateName: "repo/polecat",
-			InstanceName: "repo/polecat/polecat-ci-1jb",
-			Alias:        "repo/polecat/polecat-ci-1jb",
-			Command:      "claude",
-		},
+func TestSyncSessionBeads_SuspendedAgentNotOrphaned(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
+	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
+
+	ds := map[string]TemplateParams{
+		"mayor":  {TemplateName: "mayor", Command: "claude"},
+		"worker": {TemplateName: "worker", Command: "claude"},
 	}
 
 	var stderr bytes.Buffer
-	syncSessionBeads(
-		"",
-		store,
-		desired,
-		sp,
-		configuredSessionNames(cfg, "", store),
-		cfg,
-		clk,
-		&stderr,
-		false,
-	)
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
 
-	all := allSessionBeads(t, store)
+	// Now "suspend" worker: remove from runnable agents but keep in configuredNames.
+	dsOnlyMayor := map[string]TemplateParams{
+		"mayor": {TemplateName: "mayor", Command: "claude"},
+	}
+	configuredNames := map[string]bool{
+		"mayor":  true,
+		"worker": true, // still configured, just suspended
+	}
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, dsOnlyMayor, sp, configuredNames, nil, clk, &stderr, false)
 
-	var (
-		closedLegacy beads.Bead
-		openPool     beads.Bead
-	)
+	// Worker should be closed with reason "suspended", not "orphaned".
+	all := allSessionBeads(t, store)
+	var workerBead beads.Bead
 	for _, b := range all {
-		switch b.Metadata["session_name"] {
-		case legacySessionName:
-			closedLegacy = b
-		case "polecat-ci-1jb":
-			openPool = b
+		if b.Metadata["session_name"] == "worker" {
+			workerBead = b
+			break
 		}
 	}
+	if workerBead.Status != "closed" {
+		t.Errorf("worker status = %q, want %q", workerBead.Status, "closed")
+	}
+	if workerBead.Metadata["state"] != "suspended" {
+		t.Errorf("worker state = %q, want %q", workerBead.Metadata["state"], "suspended")
+	}
+	if workerBead.Metadata["close_reason"] != "suspended" {
+		t.Errorf("worker close_reason = %q, want %q", workerBead.Metadata["close_reason"], "suspended")
+	}
+}
 
-	if closedLegacy.ID == "" {
-		t.Fatalf("did not find legacy pool base bead in %+v", all)
+func TestSyncSessionBeads_SuspendedStopFailureKeepsRunningBeadOpen(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start worker: %v", err)
 	}
-	if closedLegacy.ID != legacy.ID {
-		t.Fatalf("legacy bead id = %q, want %q", closedLegacy.ID, legacy.ID)
+	sp.StopErrors["worker"] = errors.New("stop failed")
+
+	ds := map[string]TemplateParams{
+		"coordinator": {TemplateName: "coordinator", Command: "true"},
+		"worker":      {TemplateName: "worker", Command: "true"},
 	}
-	if closedLegacy.Status != "closed" {
-		t.Fatalf("legacy bead status = %q, want closed", closedLegacy.Status)
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	dsOnlyCoordinator := map[string]TemplateParams{
+		"coordinator": {TemplateName: "coordinator", Command: "true"},
 	}
-	if closedLegacy.Metadata["close_reason"] != "orphaned" {
-		t.Fatalf("legacy bead close_reason = %q, want orphaned", closedLegacy.Metadata["close_reason"])
+	configuredNames := map[string]bool{
+		"coordinator": true,
+		"worker":      true,
 	}
-	if openPool.ID == "" {
-		t.Fatalf("did not find new pool session bead in %+v", all)
+	clk.Advance(5 * time.Second)
+	syncSessionBeads("", store, dsOnlyCoordinator, sp, configuredNames, nil, clk, &stderr, false)
+
+	all := allSessionBeads(t, store)
+	var workerBead beads.Bead
+	for _, b := range all {
+		if b.Metadata["session_name"] == "worker" {
+			workerBead = b
+			break
+		}
 	}
-	if openPool.Metadata["alias"] != "repo/polecat/polecat-ci-1jb" {
-		t.Fatalf("new pool bead alias = %q, want repo/polecat/polecat-ci-1jb", openPool.Metadata["alias"])
+	if workerBead.ID == "" {
+		t.Fatal("worker bead was not found by session_name while runtime is still running")
+	}
+	if workerBead.Status != "open" {
+		t.Fatalf("worker status = %q, want open", workerBead.Status)
+	}
+	if workerBead.Metadata["close_reason"] != "" {
+		t.Fatalf("worker close_reason = %q, want empty", workerBead.Metadata["close_reason"])
+	}
+	if !sp.IsRunning("worker") {
+		t.Fatal("worker runtime unexpectedly stopped")
 	}
 }
 
-func TestLoadSessionBeads_NilStore(t *testing.T) {
-	result, err := loadSessionBeads(nil)
-	if err != nil {
-		t.Fatalf("nil store should not error: %v", err)
+func TestSyncSessionBeads_ReturnsIndex(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 7, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
+	_ = sp.Start(context.TODO(), "worker", runtime.Config{Command: "claude"})
+
+	ds := map[string]TemplateParams{
+		"mayor":  {TemplateName: "mayor", Command: "claude"},
+		"worker": {TemplateName: "worker", Command: "claude"},
 	}
-	if result != nil {
-		t.Errorf("nil store should return nil, got %v", result)
+
+	var stderr bytes.Buffer
+	idx := syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	if stderr.Len() > 0 {
+		t.Fatalf("unexpected stderr: %s", stderr.String())
+	}
+
+	// Index should contain both agents.
+	if len(idx) != 2 {
+		t.Fatalf("index length = %d, want 2", len(idx))
+	}
+	if idx["mayor"] == "" {
+		t.Error("index missing mayor")
+	}
+	if idx["worker"] == "" {
+		t.Error("index missing worker")
+	}
+
+	// Verify IDs match actual beads.
+	all, _ := store.ListByLabel(sessionBeadLabel, 0)
+	beadIDs := make(map[string]string)
+	for _, b := range all {
+		beadIDs[b.Metadata["session_name"]] = b.ID
+	}
+	if idx["mayor"] != beadIDs["mayor"] {
+		t.Errorf("mayor ID = %q, want %q", idx["mayor"], beadIDs["mayor"])
+	}
+	if idx["worker"] != beadIDs["worker"] {
+		t.Errorf("worker ID = %q, want %q", idx["worker"], beadIDs["worker"])
+	}
+
+	// Suspend worker — closed beads excluded from index.
+	clk.Advance(5 * time.Second)
+	cfgNames := map[string]bool{"mayor": true, "worker": true}
+	dsOnlyMayor := map[string]TemplateParams{
+		"mayor": {TemplateName: "mayor", Command: "claude"},
+	}
+	idx2 := syncSessionBeads("", store, dsOnlyMayor, sp, cfgNames, nil, clk, &stderr, false)
+
+	if len(idx2) != 1 {
+		t.Fatalf("after suspend, index length = %d, want 1", len(idx2))
+	}
+	if idx2["mayor"] == "" {
+		t.Error("after suspend, index missing mayor")
+	}
+	if _, ok := idx2["worker"]; ok {
+		t.Error("after suspend, index should not contain worker")
 	}
 }
 
-func TestLoadSessionBeads_SkipsClosedBeads(t *testing.T) {
+// --- loadSessionBeads tests ---
+
+func TestLoadSessionBeads_SingleBead(t *testing.T) {
 	store := beads.NewMemStore()
 
-	b, _ := store.Create(beads.Bead{
+	_, err := store.Create(beads.Bead{
 		Title:  "worker",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel},
@@ -2670,433 +3869,1642 @@ func TestLoadSessionBeads_SkipsClosedBeads(t *testing.T) {
 			"state":        "active",
 		},
 	})
-	_ = store.Close(b.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	result, err := loadSessionBeads(store)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(result) != 0 {
-		t.Errorf("expected 0 beads (closed), got %d", len(result))
+	if len(result) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(result))
+	}
+	if result[0].Metadata["session_name"] != "worker" {
+		t.Errorf("session_name = %q, want worker", result[0].Metadata["session_name"])
 	}
 }
 
-// TestFindClosedNamedSessionBead_ReopensOnRestart verifies that when a named
-// session bead is closed (e.g., after gc stop), findClosedNamedSessionBead
-// finds it by identity so the caller can reopen it. This preserves the bead
-// ID for reference continuity (slings, convoys, messages). Supersedes PR #204
-// which would have allowed name reuse by creating a new bead.
-func TestFindClosedNamedSessionBead_ReopensOnRestart(t *testing.T) {
+func TestSyncSessionBeads_RepairsEmptyType(t *testing.T) {
 	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 2, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	_ = sp.Start(context.TODO(), "mayor", runtime.Config{Command: "claude"})
 
-	// Create a named session bead with identity "mayor".
-	b, err := store.Create(beads.Bead{
-		Type:   "gc:session",
-		Labels: []string{"gc:session"},
+	// Create a session bead, then corrupt its type to empty string.
+	// MemStore defaults empty types to "task", so we create normally then
+	// update to empty to simulate the corruption seen in production (BdStore
+	// preserves empty types from the database).
+	b, err := store.Create(beads.Bead{
+		Title:  "mayor",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			"session_name":               "mayor",
-			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "mayor",
+			"session_name": "mayor",
+			"state":        "active",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatal(err)
+	}
+	emptyType := ""
+	if err := store.Update(b.ID, beads.UpdateOpts{Type: &emptyType}); err != nil {
+		t.Fatal(err)
 	}
-	originalID := b.ID
 
-	// Close it (simulates gc stop).
-	if err := store.Close(b.ID); err != nil {
-		t.Fatalf("Close: %v", err)
+	ds := map[string]TemplateParams{
+		"mayor": {TemplateName: "mayor", Command: "claude"},
 	}
 
-	// findClosedNamedSessionBead should find it.
-	found, ok := findClosedNamedSessionBead(store, "mayor")
-	if !ok {
-		t.Fatal("findClosedNamedSessionBead did not find closed mayor bead")
+	var stderr bytes.Buffer
+	syncSessionBeads("", store, ds, sp, allConfiguredDS(ds), nil, clk, &stderr, false)
+
+	// The bead's type should have been repaired to "session".
+	got, err := store.Get(b.ID)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if found.ID != originalID {
-		t.Errorf("found bead ID = %q, want %q (must reopen same bead)", found.ID, originalID)
+	if got.Type != sessionBeadType {
+		t.Errorf("type after repair = %q, want %q", got.Type, sessionBeadType)
 	}
+}
 
-	// Reopen it (the caller's responsibility).
-	open := "open"
-	if err := store.Update(found.ID, beads.UpdateOpts{Status: &open}); err != nil {
-		t.Fatalf("Reopen: %v", err)
-	}
+func TestLoadSessionBeads_NewTypeOnly(t *testing.T) {
+	store := beads.NewMemStore()
 
-	// Verify the bead is open with the original ID.
-	reopened, err := store.Get(originalID)
+	_, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   "session",
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"state":        "active",
+		},
+	})
 	if err != nil {
-		t.Fatalf("Get reopened bead: %v", err)
+		t.Fatal(err)
 	}
-	if reopened.Status != "open" {
-		t.Errorf("reopened status = %q, want %q", reopened.Status, "open")
+
+	result, err := loadSessionBeads(store)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if reopened.Metadata["session_name"] != "mayor" {
-		t.Errorf("reopened session_name = %q, want %q", reopened.Metadata["session_name"], "mayor")
+	if len(result) != 1 {
+		t.Fatalf("expected 1 bead, got %d", len(result))
 	}
 }
 
-func TestFindClosedNamedSessionBeadForSessionName_PrefersMatchingCanonicalCandidate(t *testing.T) {
+func TestLoadSessionBeads_PoolOccupancy(t *testing.T) {
 	store := beads.NewMemStore()
 
-	retired, err := store.Create(beads.Bead{
+	// Three session beads for different pool slots.
+	_, _ = store.Create(beads.Bead{
+		Title:  "worker-1",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel},
 		Metadata: map[string]string{
-			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "mayor",
+			"session_name": "worker-1",
+			"template":     "worker",
+			"state":        "active",
+			"pool_slot":    "1",
+		},
+	})
+	_, _ = store.Create(beads.Bead{
+		Title:  "worker-2",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-2",
+			"template":     "worker",
+			"state":        "active",
+			"pool_slot":    "2",
 		},
 	})
+	_, _ = store.Create(beads.Bead{
+		Title:  "worker-3",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-3",
+			"template":     "worker",
+			"state":        "active",
+			"pool_slot":    "3",
+		},
+	})
+
+	result, err := loadSessionBeads(store)
 	if err != nil {
-		t.Fatalf("Create(retired): %v", err)
+		t.Fatal(err)
 	}
-	if err := store.Close(retired.ID); err != nil {
-		t.Fatalf("Close(retired): %v", err)
+	// All 3 should be returned.
+	if len(result) != 3 {
+		t.Fatalf("expected 3 beads for pool occupancy, got %d", len(result))
 	}
+}
 
-	canonical, err := store.Create(beads.Bead{
+func TestConfiguredSessionNames_IncludesForkSessions(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Create the primary session bead (managed, has agent_name).
+	_, err := store.Create(beads.Bead{
+		Title:  "overseer",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
+		Labels: []string{sessionBeadLabel, "agent:overseer"},
 		Metadata: map[string]string{
-			"session_name":               "test-city--mayor",
+			"template":                   "overseer",
+			"agent_name":                 "overseer",
+			"session_name":               "s-primary",
+			"state":                      "active",
 			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "mayor",
+			namedSessionIdentityMetadata: "overseer",
+			namedSessionModeMetadata:     "on_demand",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create(canonical): %v", err)
-	}
-	if err := store.Close(canonical.ID); err != nil {
-		t.Fatalf("Close(canonical): %v", err)
+		t.Fatal(err)
 	}
 
-	found, ok := findClosedNamedSessionBeadForSessionName(store, "mayor", "test-city--mayor")
-	if !ok {
-		t.Fatal("findClosedNamedSessionBeadForSessionName did not find canonical mayor bead")
+	// Create a fork bead (no agent_name, from gc session new).
+	_, err = store.Create(beads.Bead{
+		Title:  "overseer fork",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:overseer"},
+		Metadata: map[string]string{
+			"template":     "overseer",
+			"session_name": "s-fork-1",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if found.ID != canonical.ID {
-		t.Fatalf("found bead ID = %q, want canonical %q", found.ID, canonical.ID)
+
+	cfg := &config.City{
+		Agents:        []config.Agent{{Name: "overseer"}},
+		NamedSessions: []config.NamedSession{{Template: "overseer"}},
 	}
 
-	generic, ok := findClosedNamedSessionBead(store, "mayor")
-	if !ok {
-		t.Fatal("findClosedNamedSessionBead did not find closed mayor bead")
+	names := configuredSessionNames(cfg, "test", store)
+
+	// Only the canonical configured session is controller-owned.
+	if !names["s-primary"] {
+		t.Errorf("configuredSessionNames missing primary session s-primary, got: %v", names)
 	}
-	if generic.ID != canonical.ID {
-		t.Fatalf("generic lookup bead ID = %q, want canonical %q", generic.ID, canonical.ID)
+	if names["s-fork-1"] {
+		t.Errorf("configuredSessionNames should not include fork session s-fork-1, got: %v", names)
 	}
 }
 
-func TestFindClosedNamedSessionBead_PrefersNewestClosedCanonical(t *testing.T) {
+func TestConfiguredSessionNames_ExcludesClosedForks(t *testing.T) {
 	store := beads.NewMemStore()
 
-	older, err := store.Create(beads.Bead{
+	// Primary bead.
+	_, err := store.Create(beads.Bead{
+		Title:  "overseer",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
+		Labels: []string{sessionBeadLabel, "agent:overseer"},
 		Metadata: map[string]string{
-			"session_name":               "test-city--mayor",
+			"template":                   "overseer",
+			"agent_name":                 "overseer",
+			"session_name":               "s-primary",
+			"state":                      "active",
 			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "mayor",
+			namedSessionIdentityMetadata: "overseer",
+			namedSessionModeMetadata:     "on_demand",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create(older): %v", err)
-	}
-	if err := store.Close(older.ID); err != nil {
-		t.Fatalf("Close(older): %v", err)
+		t.Fatal(err)
 	}
 
-	newer, err := store.Create(beads.Bead{
+	// Closed fork bead — should NOT be in configured names.
+	fork, err := store.Create(beads.Bead{
+		Title:  "overseer old fork",
 		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
+		Labels: []string{sessionBeadLabel, "template:overseer"},
 		Metadata: map[string]string{
-			"session_name":               "test-city--mayor",
-			namedSessionMetadataKey:      "true",
-			namedSessionIdentityMetadata: "mayor",
+			"template":     "overseer",
+			"session_name": "s-closed-fork",
+			"state":        "closed",
 		},
 	})
 	if err != nil {
-		t.Fatalf("Create(newer): %v", err)
+		t.Fatal(err)
 	}
-	if err := store.Close(newer.ID); err != nil {
-		t.Fatalf("Close(newer): %v", err)
+	_ = store.Close(fork.ID)
+
+	cfg := &config.City{
+		Agents:        []config.Agent{{Name: "overseer"}},
+		NamedSessions: []config.NamedSession{{Template: "overseer"}},
 	}
 
-	found, ok := findClosedNamedSessionBead(store, "mayor")
-	if !ok {
-		t.Fatal("findClosedNamedSessionBead did not find closed mayor bead")
+	names := configuredSessionNames(cfg, "test", store)
+
+	if !names["s-primary"] {
+		t.Errorf("configuredSessionNames missing primary s-primary")
 	}
-	if found.ID != newer.ID {
-		t.Fatalf("found bead ID = %q, want newest canonical %q", found.ID, newer.ID)
+	if names["s-closed-fork"] {
+		t.Errorf("configuredSessionNames should NOT include closed fork s-closed-fork")
 	}
 }
 
-func TestReapStaleSessionBeads(t *testing.T) {
-	// MemStore.Create sets CreatedAt = time.Now(). Each subtest computes
-	// its fake clock relative to the created bead's CreatedAt so the test
-	// is deterministic regardless of wall-clock latency.
-	type clockMode int
-	const (
-		clockPastGrace   clockMode = iota // 2 min past bead creation
-		clockWithinGrace                  // 30s past bead creation
-	)
+func TestConfiguredSessionNames_DoesNotIncludePoolForks(t *testing.T) {
+	store := beads.NewMemStore()
 
-	tests := []struct {
-		name       string
-		beads      []beads.Bead
-		running    []string // session names that are alive in the provider
-		draining   []string // bead IDs with active drains
-		clock      clockMode
-		wantReaped int
-		wantOpen   int // expected number of open beads after reap
-	}{
-		{
-			name: "dead_session_reaped",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"session_name": "worker-1",
-					"state":        "active",
-				},
-			}},
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", MinActiveSessions: intPtr(1), MaxActiveSessions: intPtr(3)},
+		},
+	}
+
+	// Create a pool instance bead that looks like a "fork" but is actually
+	// a pool instance. Should NOT be in configured names (pool orphan detection
+	// must still work).
+	_, err := store.Create(beads.Bead{
+		Title:  "worker-extra",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"template":     "worker",
+			"session_name": "s-worker-extra",
+			"state":        "active",
+			"pool_slot":    "5",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	names := configuredSessionNames(cfg, "test", store)
+
+	// The pool base name should be in configured names.
+	// But the excess pool instance should NOT be (it's a pool, not a singleton).
+	if names["s-worker-extra"] {
+		t.Errorf("configuredSessionNames should NOT include pool instance s-worker-extra")
+	}
+}
+
+func TestSyncSessionBeads_OrphansLegacyPoolBaseSession(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 2, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "polecat",
+			Dir:               "repo",
+			MinActiveSessions: intPtr(0),
+			MaxActiveSessions: intPtr(5),
+		}},
+	}
+
+	legacySessionName := agent.SessionNameFor(
+		config.EffectiveCityName(cfg, ""),
+		cfg.Agents[0].QualifiedName(),
+		cfg.Workspace.SessionTemplate,
+	)
+
+	legacy, err := store.Create(beads.Bead{
+		Title:  "repo/polecat",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:repo/polecat"},
+		Metadata: map[string]string{
+			"template":     "repo/polecat",
+			"agent_name":   "repo/polecat",
+			"session_name": legacySessionName,
+			"alias":        "repo/polecat",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	desired := map[string]TemplateParams{
+		"polecat-ci-1jb": {
+			TemplateName: "repo/polecat",
+			InstanceName: "repo/polecat/polecat-ci-1jb",
+			Alias:        "repo/polecat/polecat-ci-1jb",
+			Command:      "claude",
+		},
+	}
+
+	var stderr bytes.Buffer
+	syncSessionBeads(
+		"",
+		store,
+		desired,
+		sp,
+		configuredSessionNames(cfg, "", store),
+		cfg,
+		clk,
+		&stderr,
+		false,
+	)
+
+	all := allSessionBeads(t, store)
+
+	var (
+		closedLegacy beads.Bead
+		openPool     beads.Bead
+	)
+	for _, b := range all {
+		switch b.Metadata["session_name"] {
+		case legacySessionName:
+			closedLegacy = b
+		case "polecat-ci-1jb":
+			openPool = b
+		}
+	}
+
+	if closedLegacy.ID == "" {
+		t.Fatalf("did not find legacy pool base bead in %+v", all)
+	}
+	if closedLegacy.ID != legacy.ID {
+		t.Fatalf("legacy bead id = %q, want %q", closedLegacy.ID, legacy.ID)
+	}
+	if closedLegacy.Status != "closed" {
+		t.Fatalf("legacy bead status = %q, want closed", closedLegacy.Status)
+	}
+	if closedLegacy.Metadata["close_reason"] != "orphaned" {
+		t.Fatalf("legacy bead close_reason = %q, want orphaned", closedLegacy.Metadata["close_reason"])
+	}
+	if openPool.ID == "" {
+		t.Fatalf("did not find new pool session bead in %+v", all)
+	}
+	if openPool.Metadata["alias"] != "repo/polecat/polecat-ci-1jb" {
+		t.Fatalf("new pool bead alias = %q, want repo/polecat/polecat-ci-1jb", openPool.Metadata["alias"])
+	}
+}
+
+func TestLoadSessionBeads_NilStore(t *testing.T) {
+	result, err := loadSessionBeads(nil)
+	if err != nil {
+		t.Fatalf("nil store should not error: %v", err)
+	}
+	if result != nil {
+		t.Errorf("nil store should return nil, got %v", result)
+	}
+}
+
+func TestLoadSessionBeads_SkipsClosedBeads(t *testing.T) {
+	store := beads.NewMemStore()
+
+	b, _ := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"state":        "active",
+		},
+	})
+	_ = store.Close(b.ID)
+
+	result, err := loadSessionBeads(store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result) != 0 {
+		t.Errorf("expected 0 beads (closed), got %d", len(result))
+	}
+}
+
+func TestLoadSessionBeadSnapshotUsesActiveOnlyQuery(t *testing.T) {
+	base := beads.NewMemStore()
+	store := &sessionSnapshotListSpyStore{Store: base}
+	open, err := store.Create(beads.Bead{
+		Title:  "open",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"state":        string(session.StateActive),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create open session bead: %v", err)
+	}
+	closed, err := store.Create(beads.Bead{
+		Title:  "closed",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "old-worker",
+			"state":        string(session.StateClosed),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create closed session bead: %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("close session bead: %v", err)
+	}
+
+	snapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		t.Fatalf("loadSessionBeadSnapshot: %v", err)
+	}
+	if len(store.queries) != 1 {
+		t.Fatalf("List query count = %d, want 1", len(store.queries))
+	}
+	if store.queries[0].IncludeClosed {
+		t.Fatalf("loadSessionBeadSnapshot used IncludeClosed query: %+v", store.queries[0])
+	}
+	if _, ok := snapshot.FindByID(open.ID); !ok {
+		t.Fatalf("snapshot missing open session bead %s", open.ID)
+	}
+	if _, ok := snapshot.FindByID(closed.ID); ok {
+		t.Fatalf("snapshot retained closed session bead %s", closed.ID)
+	}
+}
+
+// TestFindClosedNamedSessionBead_ReopensOnRestart verifies that when a named
+// session bead is closed (e.g., after gc stop), findClosedNamedSessionBead
+// finds it by identity so the caller can reopen it. This preserves the bead
+// ID for reference continuity (slings, convoys, messages). Supersedes PR #204
+// which would have allowed name reuse by creating a new bead.
+func TestFindClosedNamedSessionBead_ReopensOnRestart(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Create a named session bead with identity "mayor".
+	b, err := store.Create(beads.Bead{
+		Type:   "gc:session",
+		Labels: []string{"gc:session"},
+		Metadata: map[string]string{
+			"session_name":               "mayor",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	originalID := b.ID
+
+	// Close it (simulates gc stop).
+	if err := store.Close(b.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	// findClosedNamedSessionBead should find it.
+	found, ok := findClosedNamedSessionBead(store, "mayor")
+	if !ok {
+		t.Fatal("findClosedNamedSessionBead did not find closed mayor bead")
+	}
+	if found.ID != originalID {
+		t.Errorf("found bead ID = %q, want %q (must reopen same bead)", found.ID, originalID)
+	}
+
+	// Reopen it (the caller's responsibility).
+	open := "open"
+	if err := store.Update(found.ID, beads.UpdateOpts{Status: &open}); err != nil {
+		t.Fatalf("Reopen: %v", err)
+	}
+
+	// Verify the bead is open with the original ID.
+	reopened, err := store.Get(originalID)
+	if err != nil {
+		t.Fatalf("Get reopened bead: %v", err)
+	}
+	if reopened.Status != "open" {
+		t.Errorf("reopened status = %q, want %q", reopened.Status, "open")
+	}
+	if reopened.Metadata["session_name"] != "mayor" {
+		t.Errorf("reopened session_name = %q, want %q", reopened.Metadata["session_name"], "mayor")
+	}
+}
+
+func TestFindClosedNamedSessionBeadForSessionName_PrefersMatchingCanonicalCandidate(t *testing.T) {
+	store := beads.NewMemStore()
+
+	retired, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(retired): %v", err)
+	}
+	if err := store.Close(retired.ID); err != nil {
+		t.Fatalf("Close(retired): %v", err)
+	}
+
+	canonical, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               "test-city--mayor",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(canonical): %v", err)
+	}
+	if err := store.Close(canonical.ID); err != nil {
+		t.Fatalf("Close(canonical): %v", err)
+	}
+
+	found, ok := findClosedNamedSessionBeadForSessionName(store, "mayor", "test-city--mayor")
+	if !ok {
+		t.Fatal("findClosedNamedSessionBeadForSessionName did not find canonical mayor bead")
+	}
+	if found.ID != canonical.ID {
+		t.Fatalf("found bead ID = %q, want canonical %q", found.ID, canonical.ID)
+	}
+
+	generic, ok := findClosedNamedSessionBead(store, "mayor")
+	if !ok {
+		t.Fatal("findClosedNamedSessionBead did not find closed mayor bead")
+	}
+	if generic.ID != canonical.ID {
+		t.Fatalf("generic lookup bead ID = %q, want canonical %q", generic.ID, canonical.ID)
+	}
+}
+
+func TestFindClosedNamedSessionBead_PrefersNewestClosedCanonical(t *testing.T) {
+	store := beads.NewMemStore()
+
+	older, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               "test-city--mayor",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(older): %v", err)
+	}
+	if err := store.Close(older.ID); err != nil {
+		t.Fatalf("Close(older): %v", err)
+	}
+
+	newer, err := store.Create(beads.Bead{
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               "test-city--mayor",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(newer): %v", err)
+	}
+	if err := store.Close(newer.ID); err != nil {
+		t.Fatalf("Close(newer): %v", err)
+	}
+
+	found, ok := findClosedNamedSessionBead(store, "mayor")
+	if !ok {
+		t.Fatal("findClosedNamedSessionBead did not find closed mayor bead")
+	}
+	if found.ID != newer.ID {
+		t.Fatalf("found bead ID = %q, want newest canonical %q", found.ID, newer.ID)
+	}
+}
+
+func TestReapStaleSessionBeads(t *testing.T) {
+	// MemStore.Create sets CreatedAt = time.Now(). Each subtest computes
+	// its fake clock relative to the created bead's CreatedAt so the test
+	// is deterministic regardless of wall-clock latency.
+	type clockMode int
+	const (
+		clockPastGrace   clockMode = iota // 2 min past bead creation
+		clockWithinGrace                  // 30s past bead creation
+	)
+
+	tests := []struct {
+		name       string
+		beads      []beads.Bead
+		running    []string // session names that are alive in the provider
+		draining   []string // bead IDs with active drains
+		clock      clockMode
+		wantReaped int
+		wantOpen   int // expected number of open beads after reap
+	}{
+		{
+			name: "stuck_creating_reaped",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name": "worker-1",
+					"state":        "creating",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 1,
+			wantOpen:   0,
+		},
+		{
+			name: "pending_create_creating_kept",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name":         "worker-1",
+					"state":                "creating",
+					"pending_create_claim": "true",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "pending_create_active_kept",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name":         "worker-1",
+					"state":                "active",
+					"pending_create_claim": "true",
+				},
+			}},
 			running:    nil,
 			clock:      clockPastGrace,
-			wantReaped: 1,
-			wantOpen:   0,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "active_session_dead_tmux_kept",
+			// Bug 1 fix: a session past creating must NEVER be reaped here,
+			// even when its tmux is dead. It may hold in_progress claims; the
+			// session lifecycle reconciler is responsible for restarting the
+			// same bead so the original assignee resumes the work.
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name": "worker-1",
+					"state":        "active",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "awake_session_dead_tmux_kept",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name": "worker-1",
+					"state":        "awake",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "live_session_kept",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name": "worker-1",
+					"state":        "creating",
+				},
+			}},
+			running:    []string{"worker-1"},
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "creating_within_grace_kept",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name": "worker-1",
+					"state":        "creating",
+				},
+			}},
+			running:    nil,
+			clock:      clockWithinGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "no_session_name_skipped",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"state": "creating",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "draining_creating_session_skipped",
+			beads: []beads.Bead{{
+				Title:  "worker",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name": "worker-1",
+					"state":        "creating",
+				},
+			}},
+			running:    nil,
+			draining:   []string{""}, // uses createdIDs[0] as bead ID
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "configured_named_session_skipped",
+			beads: []beads.Bead{{
+				Title:  "gascity/control-dispatcher",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name":              "gascity--control-dispatcher",
+					"template":                  "gascity/control-dispatcher",
+					"state":                     "active",
+					"configured_named_session":  "true",
+					"configured_named_identity": "gascity/control-dispatcher",
+					"configured_named_mode":     "always",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "configured_named_creating_session_skipped",
+			beads: []beads.Bead{{
+				Title:  "gascity/control-dispatcher",
+				Type:   sessionBeadType,
+				Labels: []string{sessionBeadLabel},
+				Metadata: map[string]string{
+					"session_name":              "gascity--control-dispatcher",
+					"template":                  "gascity/control-dispatcher",
+					"state":                     "creating",
+					"configured_named_session":  "true",
+					"configured_named_identity": "gascity/control-dispatcher",
+					"configured_named_mode":     "always",
+				},
+			}},
+			running:    nil,
+			clock:      clockPastGrace,
+			wantReaped: 0,
+			wantOpen:   1,
+		},
+		{
+			name: "only_creating_among_dead_reaped",
+			// Mixed pool: alpha is stuck creating, beta is past creating
+			// (active) with dead tmux, gamma is alive. Only alpha is reaped.
+			beads: []beads.Bead{
+				{
+					Title:  "session alpha",
+					Type:   sessionBeadType,
+					Labels: []string{sessionBeadLabel},
+					Metadata: map[string]string{
+						"session_name": "session-alpha",
+						"state":        "creating",
+					},
+				},
+				{
+					Title:  "session beta",
+					Type:   sessionBeadType,
+					Labels: []string{sessionBeadLabel},
+					Metadata: map[string]string{
+						"session_name": "session-beta",
+						"state":        "active",
+					},
+				},
+				{
+					Title:  "session gamma",
+					Type:   sessionBeadType,
+					Labels: []string{sessionBeadLabel},
+					Metadata: map[string]string{
+						"session_name": "session-gamma",
+						"state":        "creating",
+					},
+				},
+			},
+			running:    []string{"session-gamma"}, // gamma's tmux is alive
+			clock:      clockPastGrace,
+			wantReaped: 1, // only alpha (creating + dead tmux) is reaped
+			wantOpen:   2, // beta (active dead tmux), gamma (creating live tmux)
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := beads.NewMemStore()
+			sp := runtime.NewFake()
+
+			// Clock is set after bead creation, relative to CreatedAt.
+			var clk *clock.Fake
+
+			// Start running sessions in the provider.
+			for _, name := range tt.running {
+				if err := sp.Start(context.TODO(), name, runtime.Config{Command: "test"}); err != nil {
+					t.Fatalf("Start(%s): %v", name, err)
+				}
+			}
+
+			// Create beads in the store. MemStore sets CreatedAt = time.Now().
+			var createdIDs []string
+			var firstCreatedAt time.Time
+			for _, b := range tt.beads {
+				created, err := store.Create(b)
+				if err != nil {
+					t.Fatalf("Create: %v", err)
+				}
+				createdIDs = append(createdIDs, created.ID)
+				if firstCreatedAt.IsZero() {
+					firstCreatedAt = created.CreatedAt
+				}
+			}
+
+			// Set the fake clock relative to bead creation time.
+			switch tt.clock {
+			case clockPastGrace:
+				clk = &clock.Fake{Time: firstCreatedAt.Add(2 * time.Minute)}
+			case clockWithinGrace:
+				clk = &clock.Fake{Time: firstCreatedAt.Add(30 * time.Second)}
+			}
+
+			// Set up drain tracker with draining beads.
+			var dt *drainTracker
+			if len(tt.draining) > 0 {
+				dt = newDrainTracker()
+				for i, id := range tt.draining {
+					beadID := id
+					if beadID == "" && i < len(createdIDs) {
+						beadID = createdIDs[i]
+					}
+					dt.mu.Lock()
+					dt.drains[beadID] = &drainState{reason: "test"}
+					dt.mu.Unlock()
+				}
+			}
+
+			var stderr bytes.Buffer
+			got := reapStaleSessionBeads(store, sp, dt, clk, &stderr)
+			if got != tt.wantReaped {
+				t.Errorf("reapStaleSessionBeads() = %d, want %d\nstderr: %s", got, tt.wantReaped, stderr.String())
+			}
+
+			// Verify open bead count.
+			open, err := loadSessionBeads(store)
+			if err != nil {
+				t.Fatalf("loadSessionBeads: %v", err)
+			}
+			if len(open) != tt.wantOpen {
+				t.Errorf("open beads = %d, want %d", len(open), tt.wantOpen)
+			}
+
+			// For reaped beads, verify close_reason.
+			if tt.wantReaped > 0 {
+				all := allSessionBeads(t, store)
+				for _, b := range all {
+					if b.Status == "closed" && b.Metadata["close_reason"] != "stale-session" {
+						t.Errorf("closed bead %s has close_reason=%q, want %q",
+							b.ID, b.Metadata["close_reason"], "stale-session")
+					}
+				}
+				if !strings.Contains(stderr.String(), "WARN: reconciler: reaped stuck-creating session bead") {
+					t.Errorf("expected WARN log line for reaped bead; stderr=%q", stderr.String())
+				}
+			}
+		})
+	}
+}
+
+func TestReapStaleSessionBeads_HonorsRecentWakeGrace(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	created, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-1",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	now := created.CreatedAt.Add(2 * time.Minute)
+	recentWake := now.Add(-15 * time.Second).UTC().Format(time.RFC3339)
+	if err := store.SetMetadata(created.ID, "last_woke_at", recentWake); err != nil {
+		t.Fatalf("SetMetadata(last_woke_at): %v", err)
+	}
+
+	var stderr bytes.Buffer
+	got := reapStaleSessionBeads(store, sp, nil, &clock.Fake{Time: now}, &stderr)
+	if got != 0 {
+		t.Fatalf("reapStaleSessionBeads() = %d, want 0\nstderr: %s", got, stderr.String())
+	}
+	open, err := loadSessionBeads(store)
+	if err != nil {
+		t.Fatalf("loadSessionBeads: %v", err)
+	}
+	if len(open) != 1 {
+		t.Fatalf("open beads = %d, want 1", len(open))
+	}
+}
+
+func TestReapStaleSessionBeads_NilStoreAndProvider(t *testing.T) {
+	clk := &clock.Fake{Time: time.Now()}
+	var stderr bytes.Buffer
+
+	if got := reapStaleSessionBeads(nil, nil, nil, clk, &stderr); got != 0 {
+		t.Errorf("nil store+provider: got %d, want 0", got)
+	}
+	if got := reapStaleSessionBeads(beads.NewMemStore(), nil, nil, clk, &stderr); got != 0 {
+		t.Errorf("nil provider: got %d, want 0", got)
+	}
+	if got := reapStaleSessionBeads(nil, runtime.NewFake(), nil, clk, &stderr); got != 0 {
+		t.Errorf("nil store: got %d, want 0", got)
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesStopsVisibleDeadSessions(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	sp.visible["dead-worker"] = true
+	sp.visible["live-worker"] = true
+	sp.visible["untracked-worker"] = true
+	sp.live["live-worker"] = true
+	sp.dead["dead-worker"] = true
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{
+		{
+			ID:     "s1",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name": "dead-worker",
+				"template":     "worker",
+			},
 		},
 		{
-			name: "live_session_kept",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"session_name": "worker-1",
-					"state":        "active",
-				},
-			}},
-			running:    []string{"worker-1"},
-			clock:      clockPastGrace,
-			wantReaped: 0,
-			wantOpen:   1,
+			ID:     "s2",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name": "live-worker",
+				"template":     "worker",
+			},
 		},
 		{
-			name: "creating_state_skipped",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"session_name": "worker-1",
-					"state":        "creating",
-				},
-			}},
-			running:    nil,
-			clock:      clockPastGrace,
-			wantReaped: 0,
-			wantOpen:   1,
+			ID:     "s3",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name": "absent-worker",
+				"template":     "worker",
+			},
+		},
+	})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, nil, sp, &stderr)
+	if got != 1 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 1; stderr=%q", got, stderr.String())
+	}
+	if len(sp.stopped) != 1 || sp.stopped[0] != "dead-worker" {
+		t.Fatalf("stopped = %v, want [dead-worker]", sp.stopped)
+	}
+	if !sp.visible["live-worker"] || !sp.visible["untracked-worker"] {
+		t.Fatalf("cleanup stopped live or untracked session: visible=%v", sp.visible)
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesSkipsLivenessUncertainty(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	sp.visible["worker"] = true
+	sp.deadErrs["worker"] = errors.New("pane state unavailable")
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{{
+		ID:     "s1",
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker",
+		},
+	}})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, nil, sp, &stderr)
+	if got != 0 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 0", got)
+	}
+	if sp.stopCalls["worker"] != 0 {
+		t.Fatalf("Stop called for liveness-uncertain session: calls=%d stderr=%q", sp.stopCalls["worker"], stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "confirming dead runtime session worker") {
+		t.Fatalf("stderr = %q, want dead-confirmation warning", stderr.String())
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesSkipsVisibleSessionWhenCheckerReportsLive(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	sp.visible["mixed-pane-worker"] = true
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{{
+		ID:     "s1",
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "mixed-pane-worker",
+		},
+	}})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, nil, sp, &stderr)
+	if got != 0 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 0", got)
+	}
+	if sp.stopCalls["mixed-pane-worker"] != 0 {
+		t.Fatalf("Stop calls = %d, want 0 for checker-live session", sp.stopCalls["mixed-pane-worker"])
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesUsesPartialListResults(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	sp.visible["worker"] = true
+	sp.dead["worker"] = true
+	sp.listErr = &runtime.PartialListError{Err: errors.New("remote backend down")}
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{{
+		ID:     "s1",
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker",
 		},
+	}})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, nil, sp, &stderr)
+	if got != 1 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 1; stderr=%q", got, stderr.String())
+	}
+	if sp.stopCalls["worker"] != 1 {
+		t.Fatalf("Stop calls = %d, want 1", sp.stopCalls["worker"])
+	}
+	if !strings.Contains(stderr.String(), "listing runtime sessions partially failed") {
+		t.Fatalf("stderr = %q, want partial-list warning", stderr.String())
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesSkipsLifecycleOwnedBeads(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	for _, name := range []string{"pending-worker", "draining-worker", "named-worker", "ordinary-worker"} {
+		sp.visible[name] = true
+		sp.dead[name] = true
+	}
+
+	dt := newDrainTracker()
+	dt.set("draining", &drainState{reason: "user"})
+	snapshot := newSessionBeadSnapshot([]beads.Bead{
 		{
-			name: "pending_create_skipped",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"session_name":         "worker-1",
-					"state":                "stopped",
-					"pending_create_claim": "true",
-				},
-			}},
-			running:    nil,
-			clock:      clockPastGrace,
-			wantReaped: 0,
-			wantOpen:   1,
+			ID:     "pending",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name":         "pending-worker",
+				"pending_create_claim": "true",
+			},
 		},
 		{
-			name: "grace_period_honored",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"session_name": "worker-1",
-					"state":        "active",
-				},
-			}},
-			running:    nil,
-			clock:      clockWithinGrace,
-			wantReaped: 0,
-			wantOpen:   1,
+			ID:     "draining",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name": "draining-worker",
+			},
 		},
 		{
-			name: "no_session_name_skipped",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"state": "active",
-				},
-			}},
-			running:    nil,
-			clock:      clockPastGrace,
-			wantReaped: 0,
-			wantOpen:   1,
+			ID:     "named",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name":                       "named-worker",
+				session.NamedSessionMetadataKey:      "true",
+				session.NamedSessionIdentityMetadata: "rig/worker",
+				session.NamedSessionModeMetadata:     "always",
+			},
 		},
 		{
-			name: "draining_session_skipped",
-			beads: []beads.Bead{{
-				Title:  "worker",
-				Type:   sessionBeadType,
-				Labels: []string{sessionBeadLabel},
-				Metadata: map[string]string{
-					"session_name": "worker-1",
-					"state":        "active",
-				},
-			}},
-			running:    nil,
-			draining:   []string{""}, // uses createdIDs[0] as bead ID
-			clock:      clockPastGrace,
-			wantReaped: 0,
-			wantOpen:   1,
+			ID:     "ordinary",
+			Status: "open",
+			Metadata: map[string]string{
+				"session_name": "ordinary-worker",
+			},
+		},
+	})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, dt, sp, &stderr)
+	if got != 1 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 1; stderr=%q", got, stderr.String())
+	}
+	if sp.stopCalls["ordinary-worker"] != 1 {
+		t.Fatalf("ordinary Stop calls = %d, want 1", sp.stopCalls["ordinary-worker"])
+	}
+	for _, name := range []string{"pending-worker", "draining-worker", "named-worker"} {
+		if sp.stopCalls[name] != 0 {
+			t.Fatalf("Stop(%s) calls = %d, want 0", name, sp.stopCalls[name])
+		}
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesSkipsBlankAndDeduplicatesNames(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	sp.visible["worker"] = true
+	sp.dead["worker"] = true
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{
+		{ID: "blank", Status: "open", Metadata: map[string]string{"session_name": "  "}},
+		{ID: "first", Status: "open", Metadata: map[string]string{"session_name": "worker"}},
+		{ID: "second", Status: "open", Metadata: map[string]string{"session_name": " worker "}},
+	})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, nil, sp, &stderr)
+	if got != 1 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 1; stderr=%q", got, stderr.String())
+	}
+	if sp.stopCalls["worker"] != 1 {
+		t.Fatalf("Stop calls = %d, want 1", sp.stopCalls["worker"])
+	}
+}
+
+func TestCleanupDeadRuntimeSessionCorpsesReportsStopErrors(t *testing.T) {
+	sp := newDeadRuntimeArtifactProvider()
+	sp.visible["worker"] = true
+	sp.dead["worker"] = true
+	sp.stopErrs["worker"] = errors.New("stop failed")
+
+	snapshot := newSessionBeadSnapshot([]beads.Bead{{
+		ID:     "s1",
+		Status: "open",
+		Metadata: map[string]string{
+			"session_name": "worker",
+		},
+	}})
+
+	var stderr bytes.Buffer
+	got := cleanupDeadRuntimeSessionCorpses(snapshot, nil, sp, &stderr)
+	if got != 0 {
+		t.Fatalf("cleanupDeadRuntimeSessionCorpses() = %d, want 0", got)
+	}
+	if sp.stopCalls["worker"] != 1 {
+		t.Fatalf("Stop calls = %d, want 1", sp.stopCalls["worker"])
+	}
+	if !strings.Contains(stderr.String(), "cleaning dead runtime session worker: stop failed") {
+		t.Fatalf("stderr = %q, want Stop error", stderr.String())
+	}
+}
+
+// TestUnclaimResetsInProgressStatus verifies the Bug 2 fix: unclaiming a
+// retired session's in_progress work must reset status to "open" so a fresh
+// worker can re-claim via the routed queue (Tier 3: gc.routed_to +
+// --unassigned). Leaving status=in_progress with no assignee makes the bead
+// invisible to every work_query tier.
+func TestUnclaimResetsInProgressStatus(t *testing.T) {
+	store := beads.NewMemStore()
+
+	// Session bead the work was assigned to (mimics a retired worker).
+	sessionBead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-1",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	// In-progress work assigned to that session, with gc.routed_to set so
+	// Tier 3 of the work_query can re-route it after unclaim.
+	work, err := store.Create(beads.Bead{
+		Title:    "finalize",
+		Status:   "in_progress",
+		Assignee: sessionBead.ID,
+		Metadata: map[string]string{"gc.routed_to": "myrig/codex-max"},
+	})
+	if err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+	inProgress := "in_progress"
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatalf("mark work in_progress: %v", err)
+	}
+
+	// Open work also assigned: should also be cleared but stays "open".
+	openWork, err := store.Create(beads.Bead{
+		Title:    "queued",
+		Status:   "open",
+		Assignee: sessionBead.ID,
+		Metadata: map[string]string{"gc.routed_to": "myrig/codex-max"},
+	})
+	if err != nil {
+		t.Fatalf("create open work: %v", err)
+	}
+
+	var stderr bytes.Buffer
+	unclaimWorkAssignedToRetiredSessionBead(store, nil, sessionBead, "myrig/codex-max", &stderr)
+
+	gotInProgress, err := store.Get(work.ID)
+	if err != nil {
+		t.Fatalf("get in_progress work: %v", err)
+	}
+	if gotInProgress.Assignee != "" {
+		t.Errorf("in_progress assignee = %q, want empty", gotInProgress.Assignee)
+	}
+	if gotInProgress.Status != "open" {
+		t.Errorf("in_progress status = %q, want %q (status must reset so the bead is visible to the work_query)", gotInProgress.Status, "open")
+	}
+
+	gotOpen, err := store.Get(openWork.ID)
+	if err != nil {
+		t.Fatalf("get open work: %v", err)
+	}
+	if gotOpen.Assignee != "" {
+		t.Errorf("open assignee = %q, want empty", gotOpen.Assignee)
+	}
+	if gotOpen.Status != "open" {
+		t.Errorf("open status = %q, want %q (already open, must stay open)", gotOpen.Status, "open")
+	}
+}
+
+// closeBead is the low-level metadata+close helper. Ownership checks live in
+// closeSessionBeadIfUnassigned, which has the full multi-store, multi-identifier
+// view of assigned work. closeBead itself must stay dumb so it doesn't
+// introduce a narrower contract than the live-query helper.
+func TestCloseBeadDoesNotDuplicateOwnershipGuard(t *testing.T) {
+	store := beads.NewMemStore()
+
+	sessionBead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-1",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	if _, err := store.Create(beads.Bead{
+		Title:    "finalize",
+		Status:   "in_progress",
+		Assignee: sessionBead.ID,
+	}); err != nil {
+		t.Fatalf("create assigned work: %v", err)
+	}
+
+	var stderr bytes.Buffer
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	if !closeBead(store, sessionBead.ID, "stale-session", now, &stderr) {
+		t.Fatalf("closeBead returned false; want true because ownership gating belongs to closeSessionBeadIfUnassigned: stderr=%s", stderr.String())
+	}
+	got, err := store.Get(sessionBead.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("session bead status = %q, want closed", got.Status)
+	}
+}
+
+func TestCloseSessionBeadIfUnassignedRefusesWhenRigStoreWorkAssignedBySessionName(t *testing.T) {
+	store := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+
+	sessionBead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-1",
+			"state":        "active",
 		},
-		{
-			name: "multiple_stale_reaped",
-			beads: []beads.Bead{
-				{
-					Title:  "session alpha",
-					Type:   sessionBeadType,
-					Labels: []string{sessionBeadLabel},
-					Metadata: map[string]string{
-						"session_name": "session-alpha",
-						"state":        "active",
-					},
-				},
-				{
-					Title:  "session beta",
-					Type:   sessionBeadType,
-					Labels: []string{sessionBeadLabel},
-					Metadata: map[string]string{
-						"session_name": "session-beta",
-						"state":        "awake",
-					},
-				},
-				{
-					Title:  "session gamma",
-					Type:   sessionBeadType,
-					Labels: []string{sessionBeadLabel},
-					Metadata: map[string]string{
-						"session_name": "session-gamma",
-						"state":        "active",
-					},
-				},
-			},
-			running:    []string{"session-gamma"}, // only gamma is alive
-			clock:      clockPastGrace,
-			wantReaped: 2,
-			wantOpen:   1,
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+
+	if _, err := rigStore.Create(beads.Bead{
+		Title:    "rig work",
+		Status:   "open",
+		Assignee: "worker-1",
+	}); err != nil {
+		t.Fatalf("create rig work: %v", err)
+	}
+
+	var stderr bytes.Buffer
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	if closeSessionBeadIfUnassigned(store, map[string]beads.Store{"demo": rigStore}, sessionBead, "stale-session", now, &stderr) {
+		t.Fatal("closeSessionBeadIfUnassigned returned true; want false because rig-store work is still assigned by session_name")
+	}
+	got, err := store.Get(sessionBead.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("session bead status = closed; want still open after helper refused close")
+	}
+}
+
+func TestUnclaimWorkAssignedToRetiredSessionBeadClearsRigStoreSessionIdentifiers(t *testing.T) {
+	store := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+
+	sessionBead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               "worker-1",
+			"state":                      "retired",
+			namedSessionIdentityMetadata: "frontend/worker",
 		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
 	}
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			store := beads.NewMemStore()
-			sp := runtime.NewFake()
+	bySessionName, err := rigStore.Create(beads.Bead{
+		Title:    "session-name work",
+		Status:   "open",
+		Assignee: "worker-1",
+	})
+	if err != nil {
+		t.Fatalf("create session-name work: %v", err)
+	}
 
-			// Clock is set after bead creation, relative to CreatedAt.
-			var clk *clock.Fake
+	byIdentity, err := rigStore.Create(beads.Bead{
+		Title:    "named-identity work",
+		Status:   "open",
+		Assignee: "frontend/worker",
+	})
+	if err != nil {
+		t.Fatalf("create named-identity work: %v", err)
+	}
+	inProgress := "in_progress"
+	if err := rigStore.Update(byIdentity.ID, beads.UpdateOpts{Status: &inProgress}); err != nil {
+		t.Fatalf("mark named-identity work in_progress: %v", err)
+	}
 
-			// Start running sessions in the provider.
-			for _, name := range tt.running {
-				if err := sp.Start(context.TODO(), name, runtime.Config{Command: "test"}); err != nil {
-					t.Fatalf("Start(%s): %v", name, err)
-				}
-			}
+	var stderr bytes.Buffer
+	unclaimWorkAssignedToRetiredSessionBead(
+		store,
+		map[string]beads.Store{"frontend": rigStore},
+		sessionBead,
+		"frontend/codex-max",
+		&stderr,
+	)
 
-			// Create beads in the store. MemStore sets CreatedAt = time.Now().
-			var createdIDs []string
-			var firstCreatedAt time.Time
-			for _, b := range tt.beads {
-				created, err := store.Create(b)
-				if err != nil {
-					t.Fatalf("Create: %v", err)
-				}
-				createdIDs = append(createdIDs, created.ID)
-				if firstCreatedAt.IsZero() {
-					firstCreatedAt = created.CreatedAt
-				}
-			}
+	gotBySessionName, err := rigStore.Get(bySessionName.ID)
+	if err != nil {
+		t.Fatalf("get session-name work: %v", err)
+	}
+	if gotBySessionName.Assignee != "" {
+		t.Fatalf("session-name assignee = %q, want empty", gotBySessionName.Assignee)
+	}
+	if gotBySessionName.Status != "open" {
+		t.Fatalf("session-name status = %q, want open", gotBySessionName.Status)
+	}
 
-			// Set the fake clock relative to bead creation time.
-			switch tt.clock {
-			case clockPastGrace:
-				clk = &clock.Fake{Time: firstCreatedAt.Add(2 * time.Minute)}
-			case clockWithinGrace:
-				clk = &clock.Fake{Time: firstCreatedAt.Add(30 * time.Second)}
-			}
+	gotByIdentity, err := rigStore.Get(byIdentity.ID)
+	if err != nil {
+		t.Fatalf("get named-identity work: %v", err)
+	}
+	if gotByIdentity.Assignee != "" {
+		t.Fatalf("named-identity assignee = %q, want empty", gotByIdentity.Assignee)
+	}
+	if gotByIdentity.Status != "open" {
+		t.Fatalf("named-identity status = %q, want open after unclaim", gotByIdentity.Status)
+	}
+	if gotByIdentity.Metadata["gc.routed_to"] != "frontend/codex-max" {
+		t.Fatalf("named-identity gc.routed_to = %q, want frontend/codex-max", gotByIdentity.Metadata["gc.routed_to"])
+	}
+}
 
-			// Set up drain tracker with draining beads.
-			var dt *drainTracker
-			if len(tt.draining) > 0 {
-				dt = newDrainTracker()
-				for i, id := range tt.draining {
-					beadID := id
-					if beadID == "" && i < len(createdIDs) {
-						beadID = createdIDs[i]
-					}
-					dt.mu.Lock()
-					dt.drains[beadID] = &drainState{reason: "test"}
-					dt.mu.Unlock()
-				}
-			}
+func TestReassignWorkAssignedToRetiredSessionBeadReassignsRigStoreSessionIdentifiers(t *testing.T) {
+	store := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
 
-			var stderr bytes.Buffer
-			got := reapStaleSessionBeads(store, sp, dt, clk, &stderr)
-			if got != tt.wantReaped {
-				t.Errorf("reapStaleSessionBeads() = %d, want %d\nstderr: %s", got, tt.wantReaped, stderr.String())
-			}
+	retired, err := store.Create(beads.Bead{
+		Title:  "old worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               "worker-1",
+			"state":                      "retired",
+			namedSessionIdentityMetadata: "frontend/worker",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create retired session bead: %v", err)
+	}
+	successor, err := store.Create(beads.Bead{
+		Title:  "new worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-2",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create successor session bead: %v", err)
+	}
 
-			// Verify open bead count.
-			open, err := loadSessionBeads(store)
-			if err != nil {
-				t.Fatalf("loadSessionBeads: %v", err)
-			}
-			if len(open) != tt.wantOpen {
-				t.Errorf("open beads = %d, want %d", len(open), tt.wantOpen)
-			}
+	bySessionName, err := rigStore.Create(beads.Bead{
+		Title:    "session-name work",
+		Status:   "open",
+		Assignee: "worker-1",
+	})
+	if err != nil {
+		t.Fatalf("create session-name work: %v", err)
+	}
+	byIdentity, err := rigStore.Create(beads.Bead{
+		Title:    "named-identity work",
+		Status:   "open",
+		Assignee: "frontend/worker",
+	})
+	if err != nil {
+		t.Fatalf("create named-identity work: %v", err)
+	}
 
-			// For reaped beads, verify close_reason.
-			if tt.wantReaped > 0 {
-				all := allSessionBeads(t, store)
-				for _, b := range all {
-					if b.Status == "closed" && b.Metadata["close_reason"] != "stale-session" {
-						t.Errorf("closed bead %s has close_reason=%q, want %q",
-							b.ID, b.Metadata["close_reason"], "stale-session")
-					}
-				}
-				if !strings.Contains(stderr.String(), "WARN: reconciler: reaped stale session bead") {
-					t.Error("expected WARN log line for reaped bead")
-				}
-			}
-		})
+	var stderr bytes.Buffer
+	reassignWorkAssignedToRetiredSessionBead(
+		store,
+		map[string]beads.Store{"frontend": rigStore},
+		retired,
+		successor.ID,
+		&stderr,
+	)
+
+	gotBySessionName, err := rigStore.Get(bySessionName.ID)
+	if err != nil {
+		t.Fatalf("get session-name work: %v", err)
+	}
+	if gotBySessionName.Assignee != successor.ID {
+		t.Fatalf("session-name assignee = %q, want %q", gotBySessionName.Assignee, successor.ID)
+	}
+
+	gotByIdentity, err := rigStore.Get(byIdentity.ID)
+	if err != nil {
+		t.Fatalf("get named-identity work: %v", err)
+	}
+	if gotByIdentity.Assignee != successor.ID {
+		t.Fatalf("named-identity assignee = %q, want %q", gotByIdentity.Assignee, successor.ID)
 	}
 }
 
-func TestReapStaleSessionBeads_NilStoreAndProvider(t *testing.T) {
-	clk := &clock.Fake{Time: time.Now()}
+func TestSyncSessionBeadsWithSnapshotAndRigStoresLeavesOrphanedSessionBeadOpenWhenRigStoreWorkAssigned(t *testing.T) {
+	store := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	sp := runtime.NewFake()
+	clk := &clock.Fake{}
+
+	sessionBead, err := store.Create(beads.Bead{
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "worker-1",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if _, err := rigStore.Create(beads.Bead{
+		Title:    "rig work",
+		Status:   "open",
+		Assignee: "worker-1",
+	}); err != nil {
+		t.Fatalf("create rig work: %v", err)
+	}
+
 	var stderr bytes.Buffer
+	syncSessionBeadsWithSnapshotAndRigStores(
+		"",
+		store,
+		map[string]beads.Store{"frontend": rigStore},
+		nil,
+		sp,
+		map[string]bool{},
+		nil,
+		clk,
+		&stderr,
+		false,
+		nil,
+	)
 
-	if got := reapStaleSessionBeads(nil, nil, nil, clk, &stderr); got != 0 {
-		t.Errorf("nil store+provider: got %d, want 0", got)
+	got, err := store.Get(sessionBead.ID)
+	if err != nil {
+		t.Fatalf("get session bead: %v", err)
 	}
-	if got := reapStaleSessionBeads(beads.NewMemStore(), nil, nil, clk, &stderr); got != 0 {
-		t.Errorf("nil provider: got %d, want 0", got)
+	if got.Status != "open" {
+		t.Fatalf("session bead status = %q, want open because rig-store work still owns it", got.Status)
 	}
-	if got := reapStaleSessionBeads(nil, runtime.NewFake(), nil, clk, &stderr); got != 0 {
-		t.Errorf("nil store: got %d, want 0", got)
+}
+
+// TestPreserveConfiguredNamedSessionBead_StateGate covers ga-ue1r: a named
+// bead in a terminal-ish state (state="stopped" with no sleep_reason and no
+// fresh last_woke_at, or state="failed-create") must release its alias so the
+// next spawn can claim the identity.
+func TestPreserveConfiguredNamedSessionBead_StateGate(t *testing.T) {
+	cityName := "test-city"
+	workspace := config.Workspace{Name: cityName}
+	cfg := &config.City{
+		Workspace: workspace,
+		Agents: []config.Agent{
+			{Name: "mayor", StartCommand: "true"},
+		},
+		NamedSessions: []config.NamedSession{
+			{Template: "mayor", Mode: "always"},
+		},
+	}
+	sessionName := config.NamedSessionRuntimeName(cityName, workspace, "mayor")
+	freshWoke := time.Now().UTC().Add(-30 * time.Second).Format(time.RFC3339Nano)
+	staleWoke := time.Now().UTC().Add(-2 * time.Minute).Format(time.RFC3339Nano)
+
+	cases := []struct {
+		name        string
+		state       string
+		sleepReason string
+		lastWokeAt  string
+		want        bool
+	}{
+		{name: "active live bead", state: "active", want: true},
+		{name: "asleep with idle-timeout reason", state: "asleep", sleepReason: "idle-timeout", want: true},
+		{name: "stopped with city-stop reason holds", state: "stopped", sleepReason: "city-stop", want: true},
+		{name: "stopped with idle-timeout reason holds", state: "stopped", sleepReason: "idle-timeout", lastWokeAt: freshWoke, want: true},
+		{name: "stopped fresh wake holds (race guard)", state: "stopped", lastWokeAt: freshWoke, want: true},
+		{name: "stopped stale wake releases", state: "stopped", lastWokeAt: staleWoke, want: false},
+		{name: "stopped never woke releases", state: "stopped", want: false},
+		{name: "failed-create always releases", state: "failed-create", want: false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			meta := map[string]string{
+				"session_name":               sessionName,
+				"alias":                      "mayor",
+				"template":                   "mayor",
+				"agent_name":                 "mayor",
+				"state":                      tc.state,
+				namedSessionMetadataKey:      "true",
+				namedSessionIdentityMetadata: "mayor",
+				namedSessionModeMetadata:     "always",
+			}
+			if tc.sleepReason != "" {
+				meta["sleep_reason"] = tc.sleepReason
+			}
+			if tc.lastWokeAt != "" {
+				meta["last_woke_at"] = tc.lastWokeAt
+			}
+			b := beads.Bead{
+				ID:       "gm-test-" + tc.name,
+				Title:    "mayor",
+				Type:     sessionBeadType,
+				Status:   "open",
+				Labels:   []string{sessionBeadLabel, "agent:mayor"},
+				Metadata: meta,
+			}
+			got := preserveConfiguredNamedSessionBead(b, cfg, cityName)
+			if got != tc.want {
+				t.Fatalf("preserveConfiguredNamedSessionBead(state=%q sleep_reason=%q last_woke_at=%q) = %v, want %v",
+					tc.state, tc.sleepReason, tc.lastWokeAt, got, tc.want)
+			}
+		})
 	}
 }
diff --git a/cmd/gc/session_circuit_breaker.go b/cmd/gc/session_circuit_breaker.go
new file mode 100644
index 0000000000..00052d60e5
--- /dev/null
+++ b/cmd/gc/session_circuit_breaker.go
@@ -0,0 +1,928 @@
+// session_circuit_breaker.go implements a respawn circuit breaker for named
+// sessions. The supervisor reconciler will otherwise restart a named session
+// indefinitely with zero awareness of loop conditions. When a named session
+// is stuck in a respawn loop with no observable progress, this breaker trips
+// and blocks further respawn attempts until an operator intervenes (or the
+// automatic cooldown reset fires). The breaker here is the minimal
+// infrastructure to interrupt repeated no-progress respawn loops. See also the
+// instructions logged in the ERROR path below for the manual reset knob.
+package main
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+// sessionCircuitBreakerConfig controls the breaker thresholds. Zero values
+// fall back to package defaults so callers can construct with only the
+// fields they want to override.
+type sessionCircuitBreakerConfig struct {
+	// Window is the rolling window over which restart timestamps are
+	// counted. Default: 30 minutes.
+	Window time.Duration
+	// MaxRestarts is the number of restarts allowed within Window before
+	// the breaker considers tripping. Default: 5.
+	MaxRestarts int
+	// ResetAfter is the cooldown interval after which an OPEN breaker
+	// automatically resets back to CLOSED. Default: 2 * Window.
+	ResetAfter time.Duration
+}
+
+const (
+	defaultCircuitBreakerWindow      = 30 * time.Minute
+	defaultCircuitBreakerMaxRestarts = 5
+)
+
+const (
+	sessionCircuitStateMetadata             = "session_circuit_state"
+	sessionCircuitRestartsMetadata          = "session_circuit_restarts"
+	sessionCircuitLastRestartMetadata       = "session_circuit_last_restart"
+	sessionCircuitLastProgressMetadata      = "session_circuit_last_progress"
+	sessionCircuitLastObservedMetadata      = "session_circuit_last_observed"
+	sessionCircuitProgressSignatureMetadata = "session_circuit_progress_signature"
+	sessionCircuitOpenedAtMetadata          = "session_circuit_opened_at"
+	sessionCircuitOpenRestartCountMetadata  = "session_circuit_open_restart_count"
+	sessionCircuitResetGenerationMetadata   = "session_circuit_reset_generation"
+)
+
+var sessionCircuitMetadataKeys = []string{
+	sessionCircuitStateMetadata,
+	sessionCircuitRestartsMetadata,
+	sessionCircuitLastRestartMetadata,
+	sessionCircuitLastProgressMetadata,
+	sessionCircuitLastObservedMetadata,
+	sessionCircuitProgressSignatureMetadata,
+	sessionCircuitOpenedAtMetadata,
+	sessionCircuitOpenRestartCountMetadata,
+	sessionCircuitResetGenerationMetadata,
+}
+
+func (c sessionCircuitBreakerConfig) withDefaults() sessionCircuitBreakerConfig {
+	if c.Window <= 0 {
+		c.Window = defaultCircuitBreakerWindow
+	}
+	if c.MaxRestarts <= 0 {
+		c.MaxRestarts = defaultCircuitBreakerMaxRestarts
+	}
+	if c.ResetAfter <= 0 {
+		c.ResetAfter = 2 * c.Window
+	}
+	return c
+}
+
+func sessionCircuitBreakerConfigFromCity(cfg *config.City) (sessionCircuitBreakerConfig, bool) {
+	if cfg == nil || !cfg.Daemon.SessionCircuitBreaker {
+		return sessionCircuitBreakerConfig{}, false
+	}
+	maxRestarts := cfg.Daemon.SessionCircuitBreakerMaxRestartsOrDefault()
+	if maxRestarts <= 0 {
+		return sessionCircuitBreakerConfig{}, false
+	}
+	cbCfg := sessionCircuitBreakerConfig{
+		Window:      cfg.Daemon.SessionCircuitBreakerWindowDuration(),
+		MaxRestarts: maxRestarts,
+		ResetAfter:  cfg.Daemon.SessionCircuitBreakerResetAfterDuration(),
+	}
+	return cbCfg.withDefaults(), true
+}
+
+// circuitBreakerStateKind is the logical state of a single identity's
+// breaker entry. CLOSED is the normal case (respawns allowed). OPEN means
+// the supervisor MUST NOT materialize or spawn this session.
+type circuitBreakerStateKind int
+
+const (
+	circuitClosed circuitBreakerStateKind = iota
+	circuitOpen
+)
+
+func (k circuitBreakerStateKind) String() string {
+	switch k {
+	case circuitOpen:
+		return "CIRCUIT_OPEN"
+	default:
+		return "CIRCUIT_CLOSED"
+	}
+}
+
+// circuitBreakerEntry is the in-memory state tracked for a single named
+// session identity. All fields are owned by the parent breaker and are only
+// read/written with the breaker's mutex held.
+type circuitBreakerEntry struct {
+	restarts       []time.Time // timestamps within the rolling window
+	lastRestart    time.Time
+	lastProgress   time.Time
+	lastObserved   time.Time
+	progressSig    string // last observed assigned-bead status signature
+	observedSig    bool
+	state          circuitBreakerStateKind
+	openedAt       time.Time
+	openRestartCnt int // snapshot of restart count at the moment the breaker opened
+	loggedOpenOnce bool
+}
+
+// CircuitBreakerSnapshot is a point-in-time view of a single identity's
+// breaker state. Exposed to the status hook so operators can see who is
+// tripped without reaching into breaker internals.
+type CircuitBreakerSnapshot struct {
+	Identity         string    `json:"identity"`
+	State            string    `json:"state"`
+	RestartCount     int       `json:"restart_count"`
+	OpenRestartCount int       `json:"open_restart_count,omitempty"`
+	WindowStart      time.Time `json:"window_start,omitempty"`
+	LastRestart      time.Time `json:"last_restart,omitempty"`
+	LastProgress     time.Time `json:"last_progress,omitempty"`
+	OpenedAt         time.Time `json:"opened_at,omitempty"`
+	ResetAfter       time.Time `json:"reset_after,omitempty"`
+}
+
+// sessionCircuitBreaker tracks restart attempts for named sessions and
+// enforces a rolling-window circuit-breaker policy. It is safe for
+// concurrent use by multiple reconciler ticks.
+type sessionCircuitBreaker struct {
+	cfg              sessionCircuitBreakerConfig
+	mu               sync.Mutex
+	entries          map[string]*circuitBreakerEntry
+	resetGenerations map[string]uint64
+}
+
+type sessionCircuitBreakerIdentitySnapshot struct {
+	entry         *circuitBreakerEntry
+	hadEntry      bool
+	generation    uint64
+	hadGeneration bool
+}
+
+// newSessionCircuitBreaker constructs a breaker with the given config.
+// Zero-valued config fields fall back to defaults.
+func newSessionCircuitBreaker(cfg sessionCircuitBreakerConfig) *sessionCircuitBreaker {
+	return &sessionCircuitBreaker{
+		cfg:              cfg.withDefaults(),
+		entries:          make(map[string]*circuitBreakerEntry),
+		resetGenerations: make(map[string]uint64),
+	}
+}
+
+func (b *sessionCircuitBreaker) configure(cfg sessionCircuitBreakerConfig) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.cfg = cfg.withDefaults()
+}
+
+// trimLocked discards restart timestamps older than the rolling window. The
+// caller must hold b.mu.
+func (b *sessionCircuitBreaker) trimLocked(e *circuitBreakerEntry, now time.Time) {
+	cutoff := now.Add(-b.cfg.Window)
+	i := 0
+	for ; i < len(e.restarts); i++ {
+		if !e.restarts[i].Before(cutoff) {
+			break
+		}
+	}
+	if i > 0 {
+		e.restarts = append(e.restarts[:0], e.restarts[i:]...)
+	}
+}
+
+// maybeAutoResetLocked resets an OPEN entry to CLOSED after its wall-clock
+// cooldown expires. While OPEN, the supervisor may keep ticking, but respawn
+// attempts are blocked before RecordRestart, so this is not a silence detector.
+// The caller must hold b.mu.
+func (b *sessionCircuitBreaker) maybeAutoResetLocked(e *circuitBreakerEntry, now time.Time) bool {
+	if e.state != circuitOpen {
+		return false
+	}
+	if e.lastRestart.IsZero() {
+		return false
+	}
+	if now.Sub(e.lastRestart) >= b.cfg.ResetAfter {
+		e.state = circuitClosed
+		e.restarts = nil
+		e.lastRestart = time.Time{}
+		e.lastProgress = time.Time{}
+		e.openedAt = time.Time{}
+		e.openRestartCnt = 0
+		e.loggedOpenOnce = false
+		e.lastObserved = time.Time{}
+		e.progressSig = ""
+		e.observedSig = false
+		return true
+	}
+	return false
+}
+
+// RecordRestart records a restart attempt for the given identity at time
+// `now`. If the rolling-window restart count exceeds the configured max AND
+// there is no progress signal inside the window, the entry transitions to
+// CIRCUIT_OPEN. Returns the post-record state kind.
+func (b *sessionCircuitBreaker) RecordRestart(identity string, now time.Time) circuitBreakerStateKind {
+	if identity == "" {
+		return circuitClosed
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.recordRestartLocked(identity, now)
+}
+
+func (b *sessionCircuitBreaker) recordRestartLocked(identity string, now time.Time) circuitBreakerStateKind {
+	e := b.entries[identity]
+	if e == nil {
+		e = &circuitBreakerEntry{}
+		b.entries[identity] = e
+	}
+	b.maybeAutoResetLocked(e, now)
+	if e.state == circuitOpen {
+		return e.state
+	}
+	e.restarts = append(e.restarts, now)
+	e.lastRestart = now
+	b.trimLocked(e, now)
+
+	if len(e.restarts) > b.cfg.MaxRestarts {
+		// No progress signal inside the window = trip the breaker. A
+		// progress event that landed inside the window keeps us CLOSED.
+		if !progressWithinWindow(e, now, b.cfg.Window) {
+			e.state = circuitOpen
+			e.openedAt = now
+			e.openRestartCnt = len(e.restarts)
+		}
+	}
+	return e.state
+}
+
+// RecordProgress records an observable progress signal (a bead state
+// transition attributable to the identity) at time `now`. Progress events
+// do NOT clear an already-OPEN breaker — only automatic reset or the manual
+// reset knob can do that — but they do keep a CLOSED breaker from tripping
+// even if restarts accumulate.
+func (b *sessionCircuitBreaker) RecordProgress(identity string, now time.Time) {
+	if identity == "" {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	e := b.entries[identity]
+	if e == nil {
+		e = &circuitBreakerEntry{}
+		b.entries[identity] = e
+	}
+	e.lastProgress = now
+}
+
+// ObserveProgressSignature records an arbitrary opaque signature
+// describing what the reconciler sees for `identity` (typically a digest of
+// its assigned beads' statuses). If the signature has changed since the
+// last observation, that counts as a progress event. The first observation
+// is NOT counted as progress (there is nothing to compare against yet);
+// the reconciler's very first tick after process start should not magically
+// reset a breaker that is already OPEN.
+func (b *sessionCircuitBreaker) ObserveProgressSignature(identity, sig string, now time.Time) bool {
+	if identity == "" {
+		return false
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	e := b.entries[identity]
+	if e == nil {
+		if sig == "" {
+			return false
+		}
+		e = &circuitBreakerEntry{progressSig: sig, observedSig: true, lastObserved: now}
+		b.entries[identity] = e
+		return true
+	}
+	e.lastObserved = now
+	if !e.observedSig {
+		e.progressSig = sig
+		e.observedSig = true
+		return true
+	}
+	if e.progressSig != sig {
+		e.progressSig = sig
+		e.lastProgress = now
+		return true
+	}
+	return false
+}
+
+func (b *sessionCircuitBreaker) restoreFromMetadata(identity string, meta map[string]string, now time.Time) (bool, error) {
+	if identity == "" || len(meta) == 0 {
+		return false, nil
+	}
+	if !hasSessionCircuitMetadata(meta) {
+		return false, nil
+	}
+	resetGeneration, err := parseCircuitResetGeneration(meta[sessionCircuitResetGenerationMetadata])
+	if err != nil {
+		return false, err
+	}
+
+	e := &circuitBreakerEntry{
+		progressSig: meta[sessionCircuitProgressSignatureMetadata],
+	}
+	if e.restarts, err = parseCircuitTimeList(meta[sessionCircuitRestartsMetadata]); err != nil {
+		return false, fmt.Errorf("parsing %s: %w", sessionCircuitRestartsMetadata, err)
+	}
+	if e.lastRestart, err = parseCircuitTime(meta[sessionCircuitLastRestartMetadata]); err != nil {
+		return false, fmt.Errorf("parsing %s: %w", sessionCircuitLastRestartMetadata, err)
+	}
+	if e.lastProgress, err = parseCircuitTime(meta[sessionCircuitLastProgressMetadata]); err != nil {
+		return false, fmt.Errorf("parsing %s: %w", sessionCircuitLastProgressMetadata, err)
+	}
+	if e.lastObserved, err = parseCircuitTime(meta[sessionCircuitLastObservedMetadata]); err != nil {
+		return false, fmt.Errorf("parsing %s: %w", sessionCircuitLastObservedMetadata, err)
+	}
+	if e.openedAt, err = parseCircuitTime(meta[sessionCircuitOpenedAtMetadata]); err != nil {
+		return false, fmt.Errorf("parsing %s: %w", sessionCircuitOpenedAtMetadata, err)
+	}
+	if s := strings.TrimSpace(meta[sessionCircuitOpenRestartCountMetadata]); s != "" {
+		n, err := strconv.Atoi(s)
+		if err != nil {
+			return false, fmt.Errorf("parsing %s: %w", sessionCircuitOpenRestartCountMetadata, err)
+		}
+		e.openRestartCnt = n
+	}
+	e.observedSig = !e.lastObserved.IsZero() || strings.TrimSpace(e.progressSig) != ""
+	switch meta[sessionCircuitStateMetadata] {
+	case circuitOpen.String():
+		e.state = circuitOpen
+	case "", circuitClosed.String():
+		e.state = circuitClosed
+	default:
+		return false, fmt.Errorf("parsing %s: unknown state %q", sessionCircuitStateMetadata, meta[sessionCircuitStateMetadata])
+	}
+
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	currentGeneration := b.resetGenerationLocked(identity)
+	if resetGeneration < currentGeneration {
+		return false, nil
+	}
+	if b.entries[identity] != nil {
+		return false, nil
+	}
+	reset := b.maybeAutoResetLocked(e, now)
+	b.trimLocked(e, now)
+	b.entries[identity] = e
+	return reset, nil
+}
+
+func hasSessionCircuitMetadata(meta map[string]string) bool {
+	for _, key := range sessionCircuitMetadataKeys {
+		if key == sessionCircuitResetGenerationMetadata {
+			continue
+		}
+		if strings.TrimSpace(meta[key]) != "" {
+			return true
+		}
+	}
+	return false
+}
+
+func parseCircuitResetGeneration(value string) (uint64, error) {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return 0, nil
+	}
+	generation, err := strconv.ParseUint(value, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("parsing %s: %w", sessionCircuitResetGenerationMetadata, err)
+	}
+	return generation, nil
+}
+
+func parseCircuitTime(value string) (time.Time, error) {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return time.Time{}, nil
+	}
+	return time.Parse(time.RFC3339Nano, value)
+}
+
+func parseCircuitTimeList(value string) ([]time.Time, error) {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return nil, nil
+	}
+	var raw []string
+	if err := json.Unmarshal([]byte(value), &raw); err != nil {
+		return nil, err
+	}
+	out := make([]time.Time, 0, len(raw))
+	for _, s := range raw {
+		tm, err := parseCircuitTime(s)
+		if err != nil {
+			return nil, err
+		}
+		if !tm.IsZero() {
+			out = append(out, tm)
+		}
+	}
+	return out, nil
+}
+
+// pruneIdle removes stale entries that were created only to remember progress
+// signatures for configured sessions that never restarted. It bounds map
+// growth when named-session configuration changes over a long-running
+// supervisor process.
+func (b *sessionCircuitBreaker) pruneIdle(now time.Time) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	for id, e := range b.entries {
+		if e.state != circuitClosed || !e.lastRestart.IsZero() || e.lastObserved.IsZero() {
+			continue
+		}
+		if now.Sub(e.lastObserved) >= b.cfg.ResetAfter {
+			delete(b.entries, id)
+			// Keep resetGenerations: it is the stale-snapshot rejection floor
+			// for this identity if the named session is later configured again.
+		}
+	}
+}
+
+// IsOpen returns true if the breaker for `identity` is currently OPEN and
+// the reconciler MUST NOT materialize or spawn the session. The call may
+// transition the entry to CLOSED if the cooldown has elapsed.
+func (b *sessionCircuitBreaker) IsOpen(identity string, now time.Time) bool {
+	if identity == "" {
+		return false
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	e := b.entries[identity]
+	if e == nil {
+		return false
+	}
+	b.maybeAutoResetLocked(e, now)
+	return e.state == circuitOpen
+}
+
+// LogOpenOnce writes a loud ERROR-level message the first time a given
+// OPEN breaker is observed during respawn suppression. The message tells
+// operators exactly how to clear the state. Subsequent calls for the same
+// OPEN incident are suppressed to avoid log floods (the supervisor may
+// re-check the breaker on every tick).
+func (b *sessionCircuitBreaker) LogOpenOnce(identity string, w io.Writer) {
+	if identity == "" || w == nil {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	e := b.entries[identity]
+	if e == nil || e.state != circuitOpen || e.loggedOpenOnce {
+		return
+	}
+	e.loggedOpenOnce = true
+	fmt.Fprintf(w, //nolint:errcheck // best-effort stderr
+		"ERROR session-circuit-breaker: CIRCUIT_OPEN for named session %q (restarts=%d in last %s, no progress). "+
+			"Supervisor will NOT respawn. Run `gc session reset %s` to clear.\n",
+		identity, e.openRestartCnt, b.cfg.Window, identity)
+}
+
+// Reset forces the entry for `identity` back to CLOSED, discards any
+// accumulated restart history, and advances the reset generation used to
+// reject stale reconciler metadata snapshots.
+func (b *sessionCircuitBreaker) Reset(identity string) uint64 {
+	if identity == "" {
+		return 0
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	delete(b.entries, identity)
+	b.resetGenerations[identity] = b.resetGenerationLocked(identity) + 1
+	return b.resetGenerations[identity]
+}
+
+func (b *sessionCircuitBreaker) observeResetGenerationFromMetadata(identity string, meta map[string]string) error {
+	if b == nil || identity == "" || len(meta) == 0 {
+		return nil
+	}
+	generation, err := parseCircuitResetGeneration(meta[sessionCircuitResetGenerationMetadata])
+	if err != nil {
+		return err
+	}
+	b.observeResetGeneration(identity, generation)
+	return nil
+}
+
+func (b *sessionCircuitBreaker) observeResetGeneration(identity string, generation uint64) {
+	if b == nil || identity == "" || generation == 0 {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if generation > b.resetGenerationLocked(identity) {
+		b.resetGenerations[identity] = generation
+	}
+}
+
+func (b *sessionCircuitBreaker) resetGenerationLocked(identity string) uint64 {
+	if b.resetGenerations == nil {
+		b.resetGenerations = make(map[string]uint64)
+	}
+	return b.resetGenerations[identity]
+}
+
+func (b *sessionCircuitBreaker) metadata(identity string, now time.Time) (map[string]string, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.metadataLocked(identity, now)
+}
+
+func (b *sessionCircuitBreaker) metadataLocked(identity string, now time.Time) (map[string]string, error) {
+	out := emptySessionCircuitMetadata()
+	if identity == "" {
+		return out, nil
+	}
+
+	e := b.entries[identity]
+	if e == nil {
+		return out, nil
+	}
+	b.maybeAutoResetLocked(e, now)
+	b.trimLocked(e, now)
+	restarts := make([]string, 0, len(e.restarts))
+	for _, tm := range e.restarts {
+		restarts = append(restarts, tm.UTC().Format(time.RFC3339Nano))
+	}
+	if len(restarts) > 0 {
+		data, err := json.Marshal(restarts)
+		if err != nil {
+			return nil, fmt.Errorf("encoding restart history: %w", err)
+		}
+		out[sessionCircuitRestartsMetadata] = string(data)
+	}
+	out[sessionCircuitStateMetadata] = e.state.String()
+	out[sessionCircuitLastRestartMetadata] = formatCircuitTime(e.lastRestart)
+	out[sessionCircuitLastProgressMetadata] = formatCircuitTime(e.lastProgress)
+	out[sessionCircuitLastObservedMetadata] = formatCircuitTime(e.lastObserved)
+	out[sessionCircuitProgressSignatureMetadata] = e.progressSig
+	if e.state == circuitOpen {
+		out[sessionCircuitOpenedAtMetadata] = formatCircuitTime(e.openedAt)
+		out[sessionCircuitOpenRestartCountMetadata] = strconv.Itoa(e.openRestartCnt)
+	}
+	if generation := b.resetGenerationLocked(identity); generation > 0 {
+		out[sessionCircuitResetGenerationMetadata] = strconv.FormatUint(generation, 10)
+	}
+	return out, nil
+}
+
+func emptySessionCircuitMetadata() map[string]string {
+	out := make(map[string]string, len(sessionCircuitMetadataKeys))
+	for _, key := range sessionCircuitMetadataKeys {
+		out[key] = ""
+	}
+	return out
+}
+
+func formatCircuitTime(tm time.Time) string {
+	if tm.IsZero() {
+		return ""
+	}
+	return tm.UTC().Format(time.RFC3339Nano)
+}
+
+func persistSessionCircuitBreakerMetadata(
+	store beads.Store,
+	session *beads.Bead,
+	cb *sessionCircuitBreaker,
+	identity string,
+	now time.Time,
+) error {
+	if store == nil || session == nil || cb == nil {
+		return nil
+	}
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+	metadata, err := cb.metadataLocked(identity, now)
+	if err != nil {
+		return err
+	}
+	if sessionCircuitMetadataEqual(session.Metadata, metadata) {
+		return nil
+	}
+	if err := store.SetMetadataBatch(session.ID, metadata); err != nil {
+		return fmt.Errorf("persisting session circuit breaker metadata for %s: %w", session.ID, err)
+	}
+	if session.Metadata == nil {
+		session.Metadata = make(map[string]string, len(metadata))
+	}
+	for key, value := range metadata {
+		session.Metadata[key] = value
+	}
+	return nil
+}
+
+func recordSessionCircuitBreakerRestart(
+	store beads.Store,
+	session *beads.Bead,
+	cb *sessionCircuitBreaker,
+	identity string,
+	now time.Time,
+) (circuitBreakerStateKind, error) {
+	if store == nil || session == nil {
+		return circuitClosed, nil
+	}
+	identity = strings.TrimSpace(identity)
+	if identity == "" {
+		return circuitClosed, nil
+	}
+	if cb == nil {
+		cb = defaultSessionCircuitBreaker()
+	}
+
+	cb.mu.Lock()
+	defer cb.mu.Unlock()
+	previous, hadPrevious := cloneCircuitBreakerEntry(cb.entries[identity]), cb.entries[identity] != nil
+	state := cb.recordRestartLocked(identity, now)
+	metadata, err := cb.metadataLocked(identity, now)
+	if err != nil {
+		cb.restoreEntryLocked(identity, previous, hadPrevious)
+		return state, err
+	}
+	if sessionCircuitMetadataEqual(session.Metadata, metadata) {
+		return state, nil
+	}
+	if err := store.SetMetadataBatch(session.ID, metadata); err != nil {
+		cb.restoreEntryLocked(identity, previous, hadPrevious)
+		return state, fmt.Errorf("persisting session circuit breaker metadata for %s: %w", session.ID, err)
+	}
+	if session.Metadata == nil {
+		session.Metadata = make(map[string]string, len(metadata))
+	}
+	for key, value := range metadata {
+		session.Metadata[key] = value
+	}
+	return state, nil
+}
+
+func cloneCircuitBreakerEntry(e *circuitBreakerEntry) *circuitBreakerEntry {
+	if e == nil {
+		return nil
+	}
+	clone := *e
+	if e.restarts != nil {
+		clone.restarts = append([]time.Time(nil), e.restarts...)
+	}
+	return &clone
+}
+
+func (b *sessionCircuitBreaker) restoreEntryLocked(identity string, entry *circuitBreakerEntry, existed bool) {
+	if existed {
+		b.entries[identity] = entry
+		return
+	}
+	delete(b.entries, identity)
+}
+
+func (b *sessionCircuitBreaker) snapshotIdentity(identity string) sessionCircuitBreakerIdentitySnapshot {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	entry, hadEntry := b.entries[identity]
+	generation, hadGeneration := b.resetGenerations[identity]
+	return sessionCircuitBreakerIdentitySnapshot{
+		entry:         cloneCircuitBreakerEntry(entry),
+		hadEntry:      hadEntry,
+		generation:    generation,
+		hadGeneration: hadGeneration,
+	}
+}
+
+func (b *sessionCircuitBreaker) restoreIdentity(identity string, snapshot sessionCircuitBreakerIdentitySnapshot) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.restoreEntryLocked(identity, snapshot.entry, snapshot.hadEntry)
+	if snapshot.hadGeneration {
+		b.resetGenerations[identity] = snapshot.generation
+		return
+	}
+	delete(b.resetGenerations, identity)
+}
+
+func sessionCircuitMetadataEqual(existing map[string]string, next map[string]string) bool {
+	for _, key := range sessionCircuitMetadataKeys {
+		if existing[key] != next[key] {
+			return false
+		}
+	}
+	return true
+}
+
+func loadPersistedSessionCircuitResetGeneration(store beads.Store, sessionID, identity string, cb *sessionCircuitBreaker) error {
+	if store == nil || cb == nil || strings.TrimSpace(sessionID) == "" || strings.TrimSpace(identity) == "" {
+		return nil
+	}
+	session, err := store.Get(sessionID)
+	if err != nil {
+		return fmt.Errorf("loading session circuit breaker metadata for %s: %w", sessionID, err)
+	}
+	if err := cb.observeResetGenerationFromMetadata(identity, session.Metadata); err != nil {
+		return fmt.Errorf("loading session circuit breaker reset generation for %s: %w", sessionID, err)
+	}
+	return nil
+}
+
+func clearPersistedSessionCircuitBreakerMetadata(store beads.Store, sessionID string, resetGeneration uint64) error {
+	if store == nil || strings.TrimSpace(sessionID) == "" {
+		return nil
+	}
+	metadata := make(map[string]string, len(sessionCircuitMetadataKeys))
+	for _, key := range sessionCircuitMetadataKeys {
+		metadata[key] = ""
+	}
+	if resetGeneration > 0 {
+		metadata[sessionCircuitResetGenerationMetadata] = strconv.FormatUint(resetGeneration, 10)
+	}
+	if err := store.SetMetadataBatch(sessionID, metadata); err != nil {
+		return fmt.Errorf("clearing session circuit breaker metadata for %s: %w", sessionID, err)
+	}
+	return nil
+}
+
+// Snapshot returns a stable-ordered point-in-time view of all tracked
+// identities. Used by status output and by tests.
+func (b *sessionCircuitBreaker) Snapshot(now time.Time) []CircuitBreakerSnapshot {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	out := make([]CircuitBreakerSnapshot, 0, len(b.entries))
+	for id, e := range b.entries {
+		b.maybeAutoResetLocked(e, now)
+		b.trimLocked(e, now)
+		snap := CircuitBreakerSnapshot{
+			Identity:     id,
+			State:        e.state.String(),
+			RestartCount: len(e.restarts),
+			LastRestart:  e.lastRestart,
+			LastProgress: e.lastProgress,
+		}
+		if len(e.restarts) > 0 {
+			snap.WindowStart = e.restarts[0]
+		}
+		if e.state == circuitOpen {
+			snap.OpenedAt = e.openedAt
+			snap.OpenRestartCount = e.openRestartCnt
+			if !e.lastRestart.IsZero() {
+				snap.ResetAfter = e.lastRestart.Add(b.cfg.ResetAfter)
+			}
+		}
+		out = append(out, snap)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Identity < out[j].Identity })
+	return out
+}
+
+// progressWithinWindow reports whether a progress event is recent enough
+// to keep the breaker CLOSED. "Recent enough" means "no earlier than the
+// start of the current restart rolling window", which is `now - window`.
+func progressWithinWindow(e *circuitBreakerEntry, now time.Time, window time.Duration) bool {
+	if e.lastProgress.IsZero() {
+		return false
+	}
+	return !e.lastProgress.Before(now.Add(-window))
+}
+
+// -----------------------------------------------------------------------------
+// Package-level singleton used by the reconciler. Kept as an indirection so
+// tests can swap it out without threading a new parameter through every
+// reconcileSessionBeads call site.
+// -----------------------------------------------------------------------------
+
+var (
+	sessionCircuitBreakerMu        sync.Mutex
+	sessionCircuitBreakerSingleton *sessionCircuitBreaker
+)
+
+// defaultSessionCircuitBreaker returns the process-wide breaker, lazily
+// constructing it with defaults on first use.
+func defaultSessionCircuitBreaker() *sessionCircuitBreaker {
+	sessionCircuitBreakerMu.Lock()
+	defer sessionCircuitBreakerMu.Unlock()
+	if sessionCircuitBreakerSingleton == nil {
+		sessionCircuitBreakerSingleton = newSessionCircuitBreaker(sessionCircuitBreakerConfig{})
+	}
+	return sessionCircuitBreakerSingleton
+}
+
+// setSessionCircuitBreakerForTest swaps the singleton, returning a cleanup
+// function that restores the previous value. Tests call this to inject a
+// fake-clocked breaker without touching production wiring.
+func setSessionCircuitBreakerForTest(b *sessionCircuitBreaker) func() {
+	sessionCircuitBreakerMu.Lock()
+	prev := sessionCircuitBreakerSingleton
+	sessionCircuitBreakerSingleton = b
+	sessionCircuitBreakerMu.Unlock()
+	return func() {
+		sessionCircuitBreakerMu.Lock()
+		sessionCircuitBreakerSingleton = prev
+		sessionCircuitBreakerMu.Unlock()
+	}
+}
+
+// computeNamedSessionProgressSignatures returns a signature per named
+// session identity derived from the identities of its assigned work beads
+// and their statuses. A signature change between reconciler ticks means a
+// bead changed status (open -> in_progress, in_progress -> closed, a new
+// bead was routed, an old one dropped, etc.), which is treated as a
+// progress signal by the circuit breaker.
+//
+// Assignee on a work bead may be a bead ID, a session name, or an alias;
+// we resolve to the named-session identity via session bead metadata the
+// same way the rest of the reconciler does.
+func computeNamedSessionProgressSignatures(
+	sessionBeads []beads.Bead,
+	assignedWorkBeads []beads.Bead,
+) map[string]string {
+	if len(sessionBeads) == 0 {
+		return nil
+	}
+	// Build: resolver key -> identity. Bare session names and aliases are
+	// ignored when more than one configured identity claims the same key.
+	resolve := make(map[string]string, len(sessionBeads)*3)
+	bareResolve := make(map[string]string, len(sessionBeads)*2)
+	ambiguous := make(map[string]bool)
+	knownIdentities := make(map[string]bool)
+	for _, sb := range sessionBeads {
+		identity := strings.TrimSpace(sb.Metadata[namedSessionIdentityMetadata])
+		if identity == "" {
+			continue
+		}
+		knownIdentities[identity] = true
+		resolve[identity] = identity
+		if id := strings.TrimSpace(sb.ID); id != "" {
+			resolve[id] = identity
+		}
+		if sn := strings.TrimSpace(sb.Metadata["session_name"]); sn != "" {
+			addSessionCircuitResolverKey(bareResolve, ambiguous, sn, identity)
+		}
+		if alias := strings.TrimSpace(sb.Metadata["alias"]); alias != "" {
+			addSessionCircuitResolverKey(bareResolve, ambiguous, alias, identity)
+		}
+	}
+	if len(knownIdentities) == 0 {
+		return nil
+	}
+	for key, identity := range bareResolve {
+		if ambiguous[key] {
+			continue
+		}
+		if _, exact := resolve[key]; exact {
+			continue
+		}
+		resolve[key] = identity
+	}
+
+	// Gather per-identity (beadID, status) pairs.
+	perIdentity := make(map[string][]string, len(knownIdentities))
+	for _, wb := range assignedWorkBeads {
+		assignee := strings.TrimSpace(wb.Assignee)
+		if assignee == "" {
+			continue
+		}
+		identity, ok := resolve[assignee]
+		if !ok {
+			continue
+		}
+		perIdentity[identity] = append(perIdentity[identity],
+			wb.ID+"="+wb.Status)
+	}
+
+	out := make(map[string]string, len(knownIdentities))
+	for identity := range knownIdentities {
+		pairs := perIdentity[identity]
+		if len(pairs) == 0 {
+			out[identity] = ""
+			continue
+		}
+		sort.Strings(pairs)
+		h := sha1.Sum([]byte(strings.Join(pairs, "|")))
+		out[identity] = hex.EncodeToString(h[:])
+	}
+	return out
+}
+
+func addSessionCircuitResolverKey(resolve map[string]string, ambiguous map[string]bool, key, identity string) {
+	if existing, ok := resolve[key]; ok && existing != identity {
+		delete(resolve, key)
+		ambiguous[key] = true
+		return
+	}
+	if ambiguous[key] {
+		return
+	}
+	resolve[key] = identity
+}
+
+func sessionCircuitBreakerSnapshot(now time.Time) []CircuitBreakerSnapshot {
+	return defaultSessionCircuitBreaker().Snapshot(now)
+}
diff --git a/cmd/gc/session_circuit_breaker_test.go b/cmd/gc/session_circuit_breaker_test.go
new file mode 100644
index 0000000000..43c6442d95
--- /dev/null
+++ b/cmd/gc/session_circuit_breaker_test.go
@@ -0,0 +1,1204 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// breakerAt is a tiny helper that returns a breaker with explicit config
+// for tests so we can use fake clocks freely.
+func breakerAt(window time.Duration, maxRestarts int) *sessionCircuitBreaker {
+	return newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:      window,
+		MaxRestarts: maxRestarts,
+	})
+}
+
+func TestSessionCircuitBreaker_TrippingAndStaying(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+
+	type step struct {
+		kind     string // "restart" or "progress" or "isopen"
+		offset   time.Duration
+		wantOpen bool
+	}
+	tests := []struct {
+		name    string
+		window  time.Duration
+		maxRest int
+		steps   []step
+	}{
+		{
+			name:    "6th restart inside 30m with no progress trips breaker",
+			window:  30 * time.Minute,
+			maxRest: 5,
+			steps: []step{
+				{"restart", 0, false},
+				{"restart", 1 * time.Minute, false},
+				{"restart", 2 * time.Minute, false},
+				{"restart", 3 * time.Minute, false},
+				{"restart", 4 * time.Minute, false},
+				// Sixth restart exceeds max=5 -> CIRCUIT_OPEN.
+				{"restart", 5 * time.Minute, true},
+				{"isopen", 6 * time.Minute, true},
+			},
+		},
+		{
+			name:    "progress inside window keeps breaker CLOSED",
+			window:  30 * time.Minute,
+			maxRest: 5,
+			steps: []step{
+				{"restart", 0, false},
+				{"restart", 1 * time.Minute, false},
+				{"progress", 2 * time.Minute, false},
+				{"restart", 3 * time.Minute, false},
+				{"restart", 4 * time.Minute, false},
+				{"restart", 5 * time.Minute, false},
+				{"restart", 6 * time.Minute, false},
+				{"isopen", 7 * time.Minute, false},
+			},
+		},
+		{
+			name:    "restarts spread beyond window never trip",
+			window:  30 * time.Minute,
+			maxRest: 5,
+			steps: []step{
+				{"restart", 0, false},
+				{"restart", 10 * time.Minute, false},
+				{"restart", 20 * time.Minute, false},
+				{"restart", 31 * time.Minute, false}, // oldest trimmed
+				{"restart", 42 * time.Minute, false}, // oldest trimmed
+				{"restart", 53 * time.Minute, false}, // oldest trimmed
+				{"isopen", 60 * time.Minute, false},
+			},
+		},
+		{
+			name:    "stale progress (outside window) does not save us",
+			window:  30 * time.Minute,
+			maxRest: 5,
+			steps: []step{
+				{"progress", 0, false},               // recorded, then becomes stale
+				{"restart", 45 * time.Minute, false}, // progress is now 45m old, outside 30m
+				{"restart", 46 * time.Minute, false},
+				{"restart", 47 * time.Minute, false},
+				{"restart", 48 * time.Minute, false},
+				{"restart", 49 * time.Minute, false},
+				{"restart", 50 * time.Minute, true}, // trip
+			},
+		},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			cb := breakerAt(tc.window, tc.maxRest)
+			const id = "rig-a/session-a"
+			for i, s := range tc.steps {
+				at := t0.Add(s.offset)
+				switch s.kind {
+				case "restart":
+					got := cb.RecordRestart(id, at) == circuitOpen
+					if got != s.wantOpen {
+						t.Fatalf("step %d restart: wantOpen=%v got=%v", i, s.wantOpen, got)
+					}
+				case "progress":
+					cb.RecordProgress(id, at)
+				case "isopen":
+					got := cb.IsOpen(id, at)
+					if got != s.wantOpen {
+						t.Fatalf("step %d isopen: wantOpen=%v got=%v", i, s.wantOpen, got)
+					}
+				default:
+					t.Fatalf("unknown step kind %q", s.kind)
+				}
+			}
+		})
+	}
+}
+
+func TestSessionCircuitBreaker_AutoResetAfterCooldown(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:      30 * time.Minute,
+		MaxRestarts: 5,
+		// ResetAfter defaults to 2 * Window = 60 minutes.
+	})
+	const id = "rig-a/session-a"
+
+	// Trip the breaker with 6 rapid restarts.
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(id, t0.Add(6*time.Minute)) {
+		t.Fatalf("precondition: breaker should be open after 6 restarts")
+	}
+
+	// 59 minutes of cooldown: still OPEN.
+	if !cb.IsOpen(id, t0.Add(5*time.Minute+59*time.Minute)) {
+		t.Fatalf("breaker should stay OPEN until 2 x window cooldown")
+	}
+
+	// 60 minutes since last restart (last restart was at t0+5m, so probe at t0+65m):
+	// cooldown interval == 60m == 2 * window, breaker auto-resets to CLOSED.
+	if cb.IsOpen(id, t0.Add(5*time.Minute+60*time.Minute)) {
+		t.Fatalf("breaker should auto-reset to CLOSED after 60m cooldown")
+	}
+
+	// After reset, new restarts accumulate fresh — so we can't trip with just 1.
+	if got := cb.RecordRestart(id, t0.Add(5*time.Minute+61*time.Minute)); got == circuitOpen {
+		t.Fatalf("post-reset: single restart should not re-open breaker, got %v", got)
+	}
+}
+
+func TestSessionCircuitBreaker_AutoResetClearsProgressSignature(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+
+	cb.ObserveProgressSignature(id, "assigned-work-before-open", t0)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(id, t0.Add(6*time.Minute)) {
+		t.Fatalf("precondition: breaker should be open after 6 restarts")
+	}
+
+	resetAt := t0.Add(65 * time.Minute)
+	if cb.IsOpen(id, resetAt) {
+		t.Fatalf("breaker should auto-reset to CLOSED after cooldown")
+	}
+	cb.ObserveProgressSignature(id, "assigned-work-after-reset", resetAt.Add(time.Minute))
+	for i := 0; i < 6; i++ {
+		state := cb.RecordRestart(id, resetAt.Add(time.Duration(i+2)*time.Minute))
+		if i == 5 && state != circuitOpen {
+			t.Fatalf("expected breaker to re-open after reset with no post-reset progress, got %v", state)
+		}
+	}
+}
+
+func TestSessionCircuitBreaker_ManualReset(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+	if !cb.IsOpen(id, t0.Add(6*time.Minute)) {
+		t.Fatalf("precondition: should be OPEN")
+	}
+	// Manual reset (the hook a future `gc session reset` CLI would call).
+	cb.Reset(id)
+	if cb.IsOpen(id, t0.Add(6*time.Minute)) {
+		t.Fatalf("after Reset, breaker should be CLOSED")
+	}
+}
+
+func TestSessionCircuitBreaker_LogOpenOnce(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+	var buf bytes.Buffer
+	cb.LogOpenOnce(id, &buf)
+	first := buf.String()
+	if !strings.Contains(first, "CIRCUIT_OPEN") {
+		t.Fatalf("expected CIRCUIT_OPEN message, got %q", first)
+	}
+	if !strings.Contains(first, "gc session reset") {
+		t.Fatalf("expected reset instructions in log, got %q", first)
+	}
+	if !strings.Contains(first, id) {
+		t.Fatalf("expected identity in log, got %q", first)
+	}
+	// Second call is a no-op.
+	cb.LogOpenOnce(id, &buf)
+	if buf.String() != first {
+		t.Fatalf("LogOpenOnce should only log once per OPEN incident, got repeat: %q", buf.String())
+	}
+}
+
+func TestSessionCircuitBreaker_Snapshot(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	cb.RecordRestart("rig-a/session-a", t0)
+	cb.RecordRestart("rig-a/session-b", t0.Add(1*time.Minute))
+	snap := cb.Snapshot(t0.Add(2 * time.Minute))
+	if len(snap) != 2 {
+		t.Fatalf("snapshot len = %d, want 2", len(snap))
+	}
+	if snap[0].Identity != "rig-a/session-a" || snap[1].Identity != "rig-a/session-b" {
+		t.Fatalf("snapshot not sorted: %+v", snap)
+	}
+	for _, s := range snap {
+		if s.State != "CIRCUIT_CLOSED" {
+			t.Fatalf("expected CLOSED, got %s for %s", s.State, s.Identity)
+		}
+	}
+}
+
+func TestSessionCircuitBreaker_SnapshotTrimsExpiredRestartWindow(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	cb.RecordRestart("rig-a/session-a", t0)
+	cb.RecordRestart("rig-a/session-a", t0.Add(time.Minute))
+
+	snap := cb.Snapshot(t0.Add(32 * time.Minute))
+	if len(snap) != 1 {
+		t.Fatalf("snapshot len = %d, want 1", len(snap))
+	}
+	if snap[0].RestartCount != 0 {
+		t.Fatalf("restart count = %d, want expired entries trimmed", snap[0].RestartCount)
+	}
+	if !snap[0].WindowStart.IsZero() {
+		t.Fatalf("window start = %v, want zero after all entries expire", snap[0].WindowStart)
+	}
+}
+
+func TestSessionCircuitBreaker_SnapshotPreservesOpenRestartCountAfterWindowExpires(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:      30 * time.Minute,
+		MaxRestarts: 5,
+		ResetAfter:  3 * time.Hour,
+	})
+	const id = "rig-a/session-a"
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+
+	snap := cb.Snapshot(t0.Add(40 * time.Minute))
+	if len(snap) != 1 {
+		t.Fatalf("snapshot len = %d, want 1", len(snap))
+	}
+	if snap[0].State != "CIRCUIT_OPEN" {
+		t.Fatalf("state = %q, want CIRCUIT_OPEN", snap[0].State)
+	}
+	if snap[0].RestartCount != 0 {
+		t.Fatalf("restart count = %d, want expired rolling count", snap[0].RestartCount)
+	}
+	if snap[0].OpenRestartCount != 6 {
+		t.Fatalf("open restart count = %d, want trip-time count", snap[0].OpenRestartCount)
+	}
+}
+
+func TestSessionCircuitBreaker_RecordRestartDoesNotMutateOpenEntry(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:      30 * time.Minute,
+		MaxRestarts: 5,
+		ResetAfter:  3 * time.Hour,
+	})
+	const id = "rig-a/session-a"
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+	before := cb.Snapshot(t0.Add(6 * time.Minute))[0]
+
+	if got := cb.RecordRestart(id, t0.Add(10*time.Minute)); got != circuitOpen {
+		t.Fatalf("RecordRestart while open = %v, want circuitOpen", got)
+	}
+	after := cb.Snapshot(t0.Add(10 * time.Minute))[0]
+	if !after.LastRestart.Equal(before.LastRestart) {
+		t.Fatalf("last restart changed from %v to %v while open", before.LastRestart, after.LastRestart)
+	}
+	if after.RestartCount != before.RestartCount {
+		t.Fatalf("restart count changed from %d to %d while open", before.RestartCount, after.RestartCount)
+	}
+}
+
+func TestSessionCircuitBreaker_ObserveEmptyProgressSignatureDoesNotCreateIdleEntry(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+
+	cb.ObserveProgressSignature("rig-a/session-a", "", t0)
+
+	if snap := cb.Snapshot(t0); len(snap) != 0 {
+		t.Fatalf("snapshot len = %d, want no idle entry: %+v", len(snap), snap)
+	}
+}
+
+func TestSessionCircuitBreaker_PruneIdleProgressOnlyEntry(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:     30 * time.Minute,
+		ResetAfter: time.Hour,
+	})
+
+	cb.ObserveProgressSignature("rig-a/session-a", "assigned-work", t0)
+	if snap := cb.Snapshot(t0); len(snap) != 1 {
+		t.Fatalf("snapshot len = %d, want one seeded progress entry: %+v", len(snap), snap)
+	}
+
+	cb.pruneIdle(t0.Add(time.Hour))
+	if snap := cb.Snapshot(t0.Add(time.Hour)); len(snap) != 0 {
+		t.Fatalf("snapshot len = %d, want stale progress-only entry pruned: %+v", len(snap), snap)
+	}
+}
+
+func TestSessionCircuitBreaker_ObserveProgressSignature(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+	// First observation seeds the signature — no progress event.
+	cb.ObserveProgressSignature(id, "sig-1", t0)
+	// Trip the breaker: 6 restarts with no progress.
+	for i := 0; i < 5; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+	// Same signature -> no progress recorded.
+	cb.ObserveProgressSignature(id, "sig-1", t0.Add(5*time.Minute+30*time.Second))
+	if got := cb.RecordRestart(id, t0.Add(5*time.Minute+40*time.Second)); got != circuitOpen {
+		t.Fatalf("expected circuitOpen on 6th restart with no progress, got %v", got)
+	}
+}
+
+func TestSessionCircuitBreaker_EmptyToAssignedWorkSignatureCountsAsProgress(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+
+	cb.RecordRestart(id, t0)
+	cb.ObserveProgressSignature(id, "", t0.Add(time.Second))
+	for i := 1; i < 5; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+
+	if changed := cb.ObserveProgressSignature(id, "new-assigned-work", t0.Add(25*time.Minute)); !changed {
+		t.Fatal("empty-to-non-empty signature transition after an observation should be recorded")
+	}
+	if got := cb.RecordRestart(id, t0.Add(26*time.Minute)); got != circuitClosed {
+		t.Fatalf("newly assigned work should keep breaker closed on threshold restart, got %v", got)
+	}
+	snap := cb.Snapshot(t0.Add(26 * time.Minute))
+	if len(snap) != 1 || !snap[0].LastProgress.Equal(t0.Add(25*time.Minute)) {
+		t.Fatalf("last progress = %+v, want transition timestamp", snap)
+	}
+}
+
+func TestSessionCircuitBreaker_NonEmptyToEmptySignatureCountsAsProgress(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+
+	cb.ObserveProgressSignature(id, "assigned-work", t0)
+	for i := 0; i < 5; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+
+	if changed := cb.ObserveProgressSignature(id, "", t0.Add(25*time.Minute)); !changed {
+		t.Fatal("non-empty-to-empty signature transition should be recorded")
+	}
+	if got := cb.RecordRestart(id, t0.Add(26*time.Minute)); got != circuitClosed {
+		t.Fatalf("completed work should keep breaker closed on threshold restart, got %v", got)
+	}
+}
+
+func TestSessionCircuitBreaker_RestoreFromMetadata(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	openMeta := func() map[string]string {
+		return map[string]string{
+			sessionCircuitStateMetadata:             circuitOpen.String(),
+			sessionCircuitRestartsMetadata:          `["2026-04-01T12:00:00Z","2026-04-01T12:01:00Z"]`,
+			sessionCircuitLastRestartMetadata:       t0.Add(time.Minute).Format(time.RFC3339Nano),
+			sessionCircuitLastProgressMetadata:      t0.Add(-time.Hour).Format(time.RFC3339Nano),
+			sessionCircuitLastObservedMetadata:      t0.Add(2 * time.Minute).Format(time.RFC3339Nano),
+			sessionCircuitProgressSignatureMetadata: "assigned-work",
+			sessionCircuitOpenedAtMetadata:          t0.Add(2 * time.Minute).Format(time.RFC3339Nano),
+			sessionCircuitOpenRestartCountMetadata:  "6",
+		}
+	}
+
+	tests := []struct {
+		name      string
+		meta      map[string]string
+		now       time.Time
+		wantReset bool
+		wantSnap  bool
+		wantState circuitBreakerStateKind
+		wantErr   string
+	}{
+		{
+			name: "empty metadata short-circuits",
+			meta: map[string]string{},
+			now:  t0,
+		},
+		{
+			name:      "valid open restores",
+			meta:      openMeta(),
+			now:       t0.Add(3 * time.Minute),
+			wantSnap:  true,
+			wantState: circuitOpen,
+		},
+		{
+			name:      "stale open auto-resets",
+			meta:      openMeta(),
+			now:       t0.Add(2 * time.Hour),
+			wantReset: true,
+			wantSnap:  true,
+			wantState: circuitClosed,
+		},
+		{
+			name:    "malformed restart json errors",
+			meta:    mapWith(openMeta(), sessionCircuitRestartsMetadata, "not-json"),
+			now:     t0,
+			wantErr: "parsing session_circuit_restarts",
+		},
+		{
+			name:    "invalid timestamp errors",
+			meta:    mapWith(openMeta(), sessionCircuitLastRestartMetadata, "not-time"),
+			now:     t0,
+			wantErr: "parsing session_circuit_last_restart",
+		},
+		{
+			name:    "invalid open restart count errors",
+			meta:    mapWith(openMeta(), sessionCircuitOpenRestartCountMetadata, "NaN"),
+			now:     t0,
+			wantErr: "parsing session_circuit_open_restart_count",
+		},
+		{
+			name:    "unknown state errors",
+			meta:    mapWith(openMeta(), sessionCircuitStateMetadata, "BROKEN"),
+			now:     t0,
+			wantErr: "unknown state",
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			cb := breakerAt(30*time.Minute, 5)
+			gotReset, err := cb.restoreFromMetadata("rig-a/session-a", tc.meta, tc.now)
+			if tc.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
+					t.Fatalf("restoreFromMetadata error = %v, want containing %q", err, tc.wantErr)
+				}
+				if snap := cb.Snapshot(tc.now); len(snap) != 0 {
+					t.Fatalf("snapshot after failed restore = %+v, want empty", snap)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("restoreFromMetadata: %v", err)
+			}
+			if gotReset != tc.wantReset {
+				t.Fatalf("auto-reset = %v, want %v", gotReset, tc.wantReset)
+			}
+			snap := cb.Snapshot(tc.now)
+			if !tc.wantSnap {
+				if len(snap) != 0 {
+					t.Fatalf("snapshot = %+v, want empty", snap)
+				}
+				return
+			}
+			if len(snap) != 1 || snap[0].State != tc.wantState.String() {
+				t.Fatalf("snapshot = %+v, want one %s entry", snap, tc.wantState)
+			}
+		})
+	}
+}
+
+func TestSessionCircuitBreaker_RestoreFromMetadataDuplicateIsNoOp(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+	cb.RecordRestart(id, t0)
+
+	reset, err := cb.restoreFromMetadata(id, map[string]string{
+		sessionCircuitStateMetadata:             circuitOpen.String(),
+		sessionCircuitRestartsMetadata:          `["2026-04-01T12:00:00Z"]`,
+		sessionCircuitLastRestartMetadata:       t0.Format(time.RFC3339Nano),
+		sessionCircuitLastObservedMetadata:      t0.Format(time.RFC3339Nano),
+		sessionCircuitProgressSignatureMetadata: "assigned-work",
+		sessionCircuitOpenedAtMetadata:          t0.Format(time.RFC3339Nano),
+		sessionCircuitOpenRestartCountMetadata:  "6",
+	}, t0.Add(time.Minute))
+	if err != nil {
+		t.Fatalf("restoreFromMetadata: %v", err)
+	}
+	if reset {
+		t.Fatal("duplicate restore should not report auto-reset")
+	}
+	snap := cb.Snapshot(t0.Add(time.Minute))
+	if len(snap) != 1 || snap[0].State != circuitClosed.String() || snap[0].RestartCount != 1 {
+		t.Fatalf("duplicate restore overwrote existing entry: %+v", snap)
+	}
+}
+
+func TestSessionCircuitBreaker_MetadataRoundTrip(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	const id = "rig-a/session-a"
+	cb := breakerAt(30*time.Minute, 5)
+	cb.ObserveProgressSignature(id, "assigned-work", t0)
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(id, t0.Add(time.Duration(i)*time.Minute))
+	}
+
+	metadata, err := cb.metadata(id, t0.Add(6*time.Minute))
+	if err != nil {
+		t.Fatalf("metadata: %v", err)
+	}
+	restored := breakerAt(30*time.Minute, 5)
+	if reset, err := restored.restoreFromMetadata(id, metadata, t0.Add(6*time.Minute)); err != nil || reset {
+		t.Fatalf("restoreFromMetadata reset=%v err=%v", reset, err)
+	}
+	got, err := restored.metadata(id, t0.Add(6*time.Minute))
+	if err != nil {
+		t.Fatalf("metadata after restore: %v", err)
+	}
+	if !reflect.DeepEqual(got, metadata) {
+		t.Fatalf("metadata round trip mismatch\ngot:  %#v\nwant: %#v", got, metadata)
+	}
+}
+
+func TestPersistSessionCircuitBreakerMetadataSkipsUnchangedSnapshot(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	store := &metadataCountingStore{Store: beads.NewMemStore()}
+	session, err := store.Create(beads.Bead{
+		Title:    "session-a",
+		Type:     sessionBeadType,
+		Metadata: map[string]string{namedSessionIdentityMetadata: "rig-a/session-a"},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+	cb.RecordRestart(id, t0)
+
+	if err := persistSessionCircuitBreakerMetadata(store, &session, cb, id, t0); err != nil {
+		t.Fatalf("first persist: %v", err)
+	}
+	if store.writes != 1 {
+		t.Fatalf("metadata writes = %d, want 1", store.writes)
+	}
+	if err := persistSessionCircuitBreakerMetadata(store, &session, cb, id, t0); err != nil {
+		t.Fatalf("second persist: %v", err)
+	}
+	if store.writes != 1 {
+		t.Fatalf("unchanged metadata writes = %d, want still 1", store.writes)
+	}
+
+	cb.RecordRestart(id, t0.Add(time.Minute))
+	if err := persistSessionCircuitBreakerMetadata(store, &session, cb, id, t0.Add(time.Minute)); err != nil {
+		t.Fatalf("changed persist: %v", err)
+	}
+	if store.writes != 2 {
+		t.Fatalf("changed metadata writes = %d, want 2", store.writes)
+	}
+}
+
+func TestSessionCircuitMetadataHelpersIncludeResetGeneration(t *testing.T) {
+	empty := emptySessionCircuitMetadata()
+	if _, ok := empty[sessionCircuitResetGenerationMetadata]; !ok {
+		t.Fatalf("empty metadata missing %s", sessionCircuitResetGenerationMetadata)
+	}
+
+	existing := emptySessionCircuitMetadata()
+	next := emptySessionCircuitMetadata()
+	existing[sessionCircuitResetGenerationMetadata] = "1"
+	next[sessionCircuitResetGenerationMetadata] = "2"
+	if sessionCircuitMetadataEqual(existing, next) {
+		t.Fatalf("metadata equality ignored %s", sessionCircuitResetGenerationMetadata)
+	}
+	if hasSessionCircuitMetadata(next) {
+		t.Fatalf("generation-only metadata should not restore a breaker entry")
+	}
+}
+
+func TestPersistSessionCircuitBreakerMetadataWritesAutoResetClosedState(t *testing.T) {
+	t0 := time.Date(2026, 4, 1, 12, 0, 0, 0, time.UTC)
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title: "session-a",
+		Type:  sessionBeadType,
+		Metadata: map[string]string{
+			namedSessionIdentityMetadata: "rig-a/session-a",
+			sessionCircuitStateMetadata:  circuitOpen.String(),
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	cb := breakerAt(30*time.Minute, 5)
+	const id = "rig-a/session-a"
+	reset, err := cb.restoreFromMetadata(id, map[string]string{
+		sessionCircuitStateMetadata:            circuitOpen.String(),
+		sessionCircuitRestartsMetadata:         `["2026-04-01T12:00:00Z"]`,
+		sessionCircuitLastRestartMetadata:      t0.Format(time.RFC3339Nano),
+		sessionCircuitOpenedAtMetadata:         t0.Format(time.RFC3339Nano),
+		sessionCircuitOpenRestartCountMetadata: "6",
+	}, t0.Add(2*time.Hour))
+	if err != nil {
+		t.Fatalf("restoreFromMetadata: %v", err)
+	}
+	if !reset {
+		t.Fatal("restoreFromMetadata reset = false, want true")
+	}
+	if err := persistSessionCircuitBreakerMetadata(store, &session, cb, id, t0.Add(2*time.Hour)); err != nil {
+		t.Fatalf("persist: %v", err)
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("get updated session: %v", err)
+	}
+	if got := updated.Metadata[sessionCircuitStateMetadata]; got != circuitClosed.String() {
+		t.Fatalf("persisted state = %q, want %q", got, circuitClosed.String())
+	}
+	if got := updated.Metadata[sessionCircuitOpenedAtMetadata]; got != "" {
+		t.Fatalf("persisted opened_at = %q, want cleared", got)
+	}
+}
+
+type metadataCountingStore struct {
+	beads.Store
+	writes int
+}
+
+func (s *metadataCountingStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	s.writes++
+	return s.Store.SetMetadataBatch(id, kvs)
+}
+
+func mapWith(in map[string]string, key, value string) map[string]string {
+	out := make(map[string]string, len(in))
+	for k, v := range in {
+		out[k] = v
+	}
+	out[key] = value
+	return out
+}
+
+func TestComputeNamedSessionProgressSignatures(t *testing.T) {
+	sessionBeads := []beads.Bead{
+		{
+			ID: "sb-1",
+			Metadata: map[string]string{
+				"session_name":               "session-a",
+				namedSessionIdentityMetadata: "rig-a/session-a",
+			},
+		},
+		{
+			ID: "sb-2",
+			Metadata: map[string]string{
+				"session_name": "worker-1",
+				// not a named session — no identity
+			},
+		},
+	}
+	work := []beads.Bead{
+		{ID: "wb-1", Assignee: "rig-a/session-a", Status: "open"},
+		{ID: "wb-2", Assignee: "session-a", Status: "in_progress"},
+		{ID: "wb-3", Assignee: "worker-1", Status: "open"}, // ignored: not named
+	}
+	got := computeNamedSessionProgressSignatures(sessionBeads, work)
+	if _, ok := got["rig-a/session-a"]; !ok {
+		t.Fatalf("expected signature for session-a, got keys=%v", got)
+	}
+	if _, ok := got["worker-1"]; ok {
+		t.Fatalf("worker-1 is not a named session, should not be in signatures")
+	}
+
+	// Changing a work bead's status should change the signature.
+	work2 := []beads.Bead{
+		{ID: "wb-1", Assignee: "rig-a/session-a", Status: "closed"},
+		{ID: "wb-2", Assignee: "session-a", Status: "in_progress"},
+	}
+	got2 := computeNamedSessionProgressSignatures(sessionBeads, work2)
+	if got["rig-a/session-a"] == got2["rig-a/session-a"] {
+		t.Fatalf("signature should change when assignee bead status changes")
+	}
+}
+
+func TestComputeNamedSessionProgressSignaturesSkipsAmbiguousBareKeys(t *testing.T) {
+	sessionBeads := []beads.Bead{
+		{
+			ID: "sb-a",
+			Metadata: map[string]string{
+				"session_name":               "shared",
+				"alias":                      "shared-alias",
+				namedSessionIdentityMetadata: "rig-a/session",
+			},
+		},
+		{
+			ID: "sb-b",
+			Metadata: map[string]string{
+				"session_name":               "shared",
+				"alias":                      "shared-alias",
+				namedSessionIdentityMetadata: "rig-b/session",
+			},
+		},
+	}
+	work := []beads.Bead{
+		{ID: "wb-name", Assignee: "shared", Status: "open"},
+		{ID: "wb-alias", Assignee: "shared-alias", Status: "in_progress"},
+	}
+
+	got := computeNamedSessionProgressSignatures(sessionBeads, work)
+	if got["rig-a/session"] != "" {
+		t.Fatalf("rig-a signature = %q, want empty for ambiguous bare keys", got["rig-a/session"])
+	}
+	if got["rig-b/session"] != "" {
+		t.Fatalf("rig-b signature = %q, want empty for ambiguous bare keys", got["rig-b/session"])
+	}
+
+	work = append(work, beads.Bead{ID: "wb-exact", Assignee: "rig-a/session", Status: "closed"})
+	got = computeNamedSessionProgressSignatures(sessionBeads, work)
+	if got["rig-a/session"] == "" {
+		t.Fatal("exact identity assignment should still contribute a signature")
+	}
+	if got["rig-b/session"] != "" {
+		t.Fatalf("rig-b signature = %q, want empty", got["rig-b/session"])
+	}
+}
+
+func intPtrCircuit(n int) *int { return &n }
+
+func configureAlwaysNamedSession(env *reconcilerTestEnv) {
+	env.cfg = &config.City{
+		Daemon: config.DaemonConfig{
+			SessionCircuitBreaker:            true,
+			SessionCircuitBreakerMaxRestarts: intPtrCircuit(5),
+			SessionCircuitBreakerWindow:      "30m",
+		},
+		Agents: []config.Agent{{Name: "template-a", Dir: "rig-a"}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "session-a",
+			Template: "template-a",
+			Dir:      "rig-a",
+			Mode:     "always",
+		}},
+	}
+}
+
+func configureAlwaysNamedSessionWithoutCircuit(env *reconcilerTestEnv) {
+	env.cfg = &config.City{
+		Agents: []config.Agent{{Name: "template-a", Dir: "rig-a"}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "session-a",
+			Template: "template-a",
+			Dir:      "rig-a",
+			Mode:     "always",
+		}},
+	}
+}
+
+func createCircuitTestNamedSession(t *testing.T, env *reconcilerTestEnv, state string) beads.Bead {
+	t.Helper()
+	return createCircuitTestNamedSessionWithIdentity(t, env, "session-a", "template-a", "rig-a/session-a", state)
+}
+
+func createCircuitTestNamedSessionWithIdentity(
+	t *testing.T,
+	env *reconcilerTestEnv,
+	name string,
+	template string,
+	identity string,
+	state string,
+) beads.Bead {
+	t.Helper()
+	b, err := env.store.Create(beads.Bead{
+		Title:  name,
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               name,
+			"agent_name":                 name,
+			"template":                   template,
+			"state":                      state,
+			"live_hash":                  runtime.LiveFingerprint(runtime.Config{Command: "test-cmd"}),
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: identity,
+			namedSessionModeMetadata:     "always",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create bead: %v", err)
+	}
+	return b
+}
+
+func TestReconciler_CircuitDisabledByDefaultAllowsRepeatedWakeAttempts(t *testing.T) {
+	env := newReconcilerTestEnv()
+	configureAlwaysNamedSessionWithoutCircuit(env)
+	env.addDesired("session-a", "template-a", false)
+
+	b := createCircuitTestNamedSession(t, env, "asleep")
+	for i := 0; i < 6; i++ {
+		current, err := env.store.Get(b.ID)
+		if err != nil {
+			t.Fatalf("get bead attempt %d: %v", i+1, err)
+		}
+		if woken := env.reconcile([]beads.Bead{current}); woken != 1 {
+			t.Fatalf("attempt %d: woken = %d, want 1 with circuit disabled; stderr=%s", i+1, woken, env.stderr.String())
+		}
+		if err := env.sp.Stop("session-a"); err != nil {
+			t.Fatalf("attempt %d: stop session-a: %v", i+1, err)
+		}
+		env.clk.Advance(6 * time.Minute)
+	}
+	if strings.Contains(env.stderr.String(), "CIRCUIT_OPEN") {
+		t.Fatalf("circuit breaker should be disabled by default, stderr=%q", env.stderr.String())
+	}
+}
+
+func TestReconciler_CircuitUsesConfiguredDaemonThresholds(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Daemon: config.DaemonConfig{
+			SessionCircuitBreaker:            true,
+			SessionCircuitBreakerMaxRestarts: intPtrCircuit(2),
+			SessionCircuitBreakerWindow:      "30m",
+		},
+		Agents: []config.Agent{{Name: "template-a", Dir: "rig-a"}},
+		NamedSessions: []config.NamedSession{{
+			Name:     "session-a",
+			Template: "template-a",
+			Dir:      "rig-a",
+			Mode:     "always",
+		}},
+	}
+	env.addDesired("session-a", "template-a", false)
+	b := createCircuitTestNamedSession(t, env, "asleep")
+
+	for i := 0; i < 2; i++ {
+		current, err := env.store.Get(b.ID)
+		if err != nil {
+			t.Fatalf("get bead attempt %d: %v", i+1, err)
+		}
+		if woken := env.reconcile([]beads.Bead{current}); woken != 1 {
+			t.Fatalf("attempt %d: woken = %d, want 1 before configured threshold; stderr=%s", i+1, woken, env.stderr.String())
+		}
+		if err := env.sp.Stop("session-a"); err != nil {
+			t.Fatalf("attempt %d: stop session-a: %v", i+1, err)
+		}
+		env.clk.Advance(6 * time.Minute)
+	}
+
+	current, err := env.store.Get(b.ID)
+	if err != nil {
+		t.Fatalf("get bead before trip: %v", err)
+	}
+	if woken := env.reconcile([]beads.Bead{current}); woken != 0 {
+		t.Fatalf("third wake = %d, want 0 because configured max_restarts=2", woken)
+	}
+	if !strings.Contains(env.stderr.String(), "CIRCUIT_OPEN") {
+		t.Fatalf("expected CIRCUIT_OPEN log with configured threshold, got %q", env.stderr.String())
+	}
+}
+
+func TestReconciler_CircuitOpenStatePersistsAcrossControllerRestart(t *testing.T) {
+	env := newReconcilerTestEnv()
+	configureAlwaysNamedSession(env)
+	env.addDesired("session-a", "template-a", false)
+
+	const identity = "rig-a/session-a"
+	b := createCircuitTestNamedSession(t, env, "asleep")
+	for i := 0; i < 6; i++ {
+		current, err := env.store.Get(b.ID)
+		if err != nil {
+			t.Fatalf("get bead attempt %d: %v", i+1, err)
+		}
+		_ = env.reconcile([]beads.Bead{current})
+		_ = env.sp.Stop("session-a")
+		env.clk.Advance(6 * time.Minute)
+	}
+
+	persisted, err := env.store.Get(b.ID)
+	if err != nil {
+		t.Fatalf("get persisted session: %v", err)
+	}
+	if got := persisted.Metadata[sessionCircuitStateMetadata]; got != circuitOpen.String() {
+		t.Fatalf("persisted circuit state = %q, want %q", got, circuitOpen.String())
+	}
+	if got := persisted.Metadata[sessionCircuitRestartsMetadata]; got == "" {
+		t.Fatal("persisted circuit restart history is empty")
+	}
+
+	sessionCircuitBreakerMu.Lock()
+	sessionCircuitBreakerSingleton = newSessionCircuitBreaker(sessionCircuitBreakerConfig{})
+	sessionCircuitBreakerMu.Unlock()
+
+	env.stderr.Reset()
+	env.clk.Advance(time.Minute)
+	if woken := env.reconcile([]beads.Bead{persisted}); woken != 0 {
+		t.Fatalf("woken after singleton reset = %d, want 0 from persisted OPEN state", woken)
+	}
+	if env.sp.IsRunning("session-a") {
+		t.Fatal("session-a should not be running after persisted CIRCUIT_OPEN restore")
+	}
+	if snap := sessionCircuitBreakerSnapshot(env.clk.Now().UTC()); len(snap) != 1 || snap[0].Identity != identity || snap[0].State != circuitOpen.String() {
+		t.Fatalf("restored snapshot = %+v, want one OPEN entry for %s", snap, identity)
+	}
+}
+
+// TestReconciler_CircuitOpenBlocksSpawn verifies that a named session with
+// an OPEN breaker is NOT added to startCandidates and is NOT spawned.
+func TestReconciler_CircuitOpenBlocksSpawn(t *testing.T) {
+	env := newReconcilerTestEnv()
+	configureAlwaysNamedSession(env)
+
+	// Inject a breaker with aggressive thresholds and pre-trip it.
+	cb := breakerAt(30*time.Minute, 5)
+	const identity = "rig-a/session-a"
+	base := env.clk.Now().UTC()
+	for i := 0; i < 6; i++ {
+		cb.RecordRestart(identity, base.Add(-time.Duration(6-i)*time.Minute))
+	}
+	if !cb.IsOpen(identity, base) {
+		t.Fatalf("precondition: breaker should be OPEN")
+	}
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+
+	// Register the named session as desired (and NOT running).
+	env.addDesired("session-a", "template-a", false)
+
+	b := createCircuitTestNamedSession(t, env, "creating")
+
+	// Run the reconciler. With the breaker OPEN the session must not be started.
+	_ = env.reconcile([]beads.Bead{b})
+
+	if env.sp.IsRunning("session-a") {
+		t.Fatalf("session-a should NOT be running: circuit breaker is OPEN")
+	}
+	if !strings.Contains(env.stderr.String(), "CIRCUIT_OPEN") {
+		t.Fatalf("expected CIRCUIT_OPEN log in stderr, got: %q", env.stderr.String())
+	}
+	if !strings.Contains(env.stderr.String(), "gc session reset") {
+		t.Fatalf("expected reset instructions in stderr, got: %q", env.stderr.String())
+	}
+}
+
+// TestReconciler_CircuitClosedAllowsSpawn is the control case: without any
+// prior restart history the breaker is CLOSED and the reconciler spawns the
+// named session normally.
+func TestReconciler_CircuitClosedAllowsSpawn(t *testing.T) {
+	env := newReconcilerTestEnv()
+	configureAlwaysNamedSession(env)
+
+	cb := breakerAt(30*time.Minute, 5)
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+
+	env.addDesired("session-a", "template-a", false)
+
+	b := createCircuitTestNamedSession(t, env, "creating")
+
+	_ = env.reconcile([]beads.Bead{b})
+
+	if strings.Contains(env.stderr.String(), "CIRCUIT_OPEN") {
+		t.Fatalf("did not expect CIRCUIT_OPEN log, got: %q", env.stderr.String())
+	}
+	// Breaker should now have exactly one restart recorded.
+	snap := cb.Snapshot(env.clk.Now().UTC())
+	var found bool
+	for _, s := range snap {
+		if s.Identity == "rig-a/session-a" {
+			found = true
+			if s.RestartCount != 1 {
+				t.Fatalf("expected 1 recorded restart, got %d", s.RestartCount)
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("expected session-a in snapshot, got %+v", snap)
+	}
+}
+
+func TestReconciler_CircuitDoesNotRecordRestartForDependencyBlockedNamedSession(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Daemon: config.DaemonConfig{
+			SessionCircuitBreaker:            true,
+			SessionCircuitBreakerMaxRestarts: intPtrCircuit(5),
+			SessionCircuitBreakerWindow:      "30m",
+		},
+		Agents: []config.Agent{
+			{Name: "template-a", DependsOn: []string{"db"}},
+			{Name: "db"},
+		},
+		NamedSessions: []config.NamedSession{{
+			Name:     "session-a",
+			Template: "template-a",
+			Mode:     "always",
+		}},
+	}
+	cb := breakerAt(30*time.Minute, 5)
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+	env.addDesired("session-a", "template-a", false)
+	b := createCircuitTestNamedSession(t, env, "asleep")
+
+	if woken := env.reconcile([]beads.Bead{b}); woken != 0 {
+		t.Fatalf("woken = %d, want 0 while dependency is blocked", woken)
+	}
+	if env.sp.IsRunning("session-a") {
+		t.Fatal("session-a should not start while dependency is blocked")
+	}
+	for _, snap := range cb.Snapshot(env.clk.Now().UTC()) {
+		if snap.Identity == "rig-a/session-a" && snap.RestartCount != 0 {
+			t.Fatalf("restart count for dependency-blocked session = %d, want 0", snap.RestartCount)
+		}
+	}
+}
+
+func TestReconciler_CircuitDoesNotRecordRestartForWakeBudgetDeferredNamedSession(t *testing.T) {
+	env := newReconcilerTestEnv()
+	maxWakes := 1
+	env.cfg = &config.City{
+		Daemon: config.DaemonConfig{
+			MaxWakesPerTick:                  &maxWakes,
+			SessionCircuitBreaker:            true,
+			SessionCircuitBreakerMaxRestarts: intPtrCircuit(5),
+			SessionCircuitBreakerWindow:      "30m",
+		},
+		Agents: []config.Agent{
+			{Name: "template-a", Dir: "rig-a"},
+			{Name: "template-b", Dir: "rig-a"},
+		},
+		NamedSessions: []config.NamedSession{
+			{Name: "session-a", Template: "template-a", Dir: "rig-a", Mode: "always"},
+			{Name: "session-b", Template: "template-b", Dir: "rig-a", Mode: "always"},
+		},
+	}
+	cb := breakerAt(30*time.Minute, 5)
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+	env.addDesired("session-a", "template-a", false)
+	env.addDesired("session-b", "template-b", false)
+	sessionA := createCircuitTestNamedSession(t, env, "asleep")
+	sessionB := createCircuitTestNamedSessionWithIdentity(t, env, "session-b", "template-b", "rig-a/session-b", "asleep")
+
+	if woken := env.reconcile([]beads.Bead{sessionA, sessionB}); woken != 1 {
+		t.Fatalf("woken = %d, want 1 under wake budget", woken)
+	}
+	if !env.sp.IsRunning("session-a") {
+		t.Fatal("session-a should start before the wake budget is exhausted")
+	}
+	if env.sp.IsRunning("session-b") {
+		t.Fatal("session-b should be deferred by wake budget")
+	}
+	counts := make(map[string]int)
+	for _, snap := range cb.Snapshot(env.clk.Now().UTC()) {
+		counts[snap.Identity] = snap.RestartCount
+	}
+	if got := counts["rig-a/session-a"]; got != 1 {
+		t.Fatalf("restart count for started session = %d, want 1", got)
+	}
+	if got := counts["rig-a/session-b"]; got != 0 {
+		t.Fatalf("restart count for wake-budget-deferred session = %d, want 0", got)
+	}
+}
+
+func TestReconciler_CircuitTripsThroughRepeatedWakeAttempts(t *testing.T) {
+	env := newReconcilerTestEnv()
+	configureAlwaysNamedSession(env)
+	env.addDesired("session-a", "template-a", false)
+
+	cb := breakerAt(30*time.Minute, 5)
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+
+	const identity = "rig-a/session-a"
+	b := createCircuitTestNamedSession(t, env, "asleep")
+
+	for i := 0; i < 5; i++ {
+		current, err := env.store.Get(b.ID)
+		if err != nil {
+			t.Fatalf("get bead attempt %d: %v", i+1, err)
+		}
+		if woken := env.reconcile([]beads.Bead{current}); woken != 1 {
+			t.Fatalf("attempt %d: woken = %d, want 1; stderr=%s", i+1, woken, env.stderr.String())
+		}
+		if !env.sp.IsRunning("session-a") {
+			t.Fatalf("attempt %d: session-a should be running after CLOSED breaker wake", i+1)
+		}
+		if err := env.sp.Stop("session-a"); err != nil {
+			t.Fatalf("attempt %d: stop session-a: %v", i+1, err)
+		}
+		env.clk.Advance(6 * time.Minute)
+	}
+
+	current, err := env.store.Get(b.ID)
+	if err != nil {
+		t.Fatalf("get bead before trip: %v", err)
+	}
+	if woken := env.reconcile([]beads.Bead{current}); woken != 0 {
+		t.Fatalf("trip attempt: woken = %d, want 0", woken)
+	}
+	if env.sp.IsRunning("session-a") {
+		t.Fatal("session-a should not be running after circuit trips")
+	}
+	if !strings.Contains(env.stderr.String(), "CIRCUIT_OPEN") {
+		t.Fatalf("expected CIRCUIT_OPEN log in stderr, got: %q", env.stderr.String())
+	}
+	snap := cb.Snapshot(env.clk.Now().UTC())
+	if len(snap) != 1 || snap[0].Identity != identity || snap[0].State != "CIRCUIT_OPEN" || snap[0].RestartCount != 6 {
+		t.Fatalf("snapshot after trip = %+v, want one OPEN entry with 6 restarts", snap)
+	}
+}
+
+func TestReconciler_CircuitStaysClosedWhenAssignedWorkStatusProgresses(t *testing.T) {
+	env := newReconcilerTestEnv()
+	configureAlwaysNamedSession(env)
+	env.addDesired("session-a", "template-a", false)
+
+	cb := breakerAt(30*time.Minute, 5)
+	restore := setSessionCircuitBreakerForTest(cb)
+	defer restore()
+
+	const identity = "rig-a/session-a"
+	b := createCircuitTestNamedSession(t, env, "asleep")
+	statuses := []string{"open", "in_progress", "blocked", "open", "in_progress", "closed"}
+
+	for i, status := range statuses {
+		current, err := env.store.Get(b.ID)
+		if err != nil {
+			t.Fatalf("get bead attempt %d: %v", i+1, err)
+		}
+		poolDesired := map[string]int{"template-a": 1}
+		woken := reconcileSessionBeads(
+			context.Background(), []beads.Bead{current}, env.desiredState,
+			configuredSessionNames(env.cfg, "", env.store), env.cfg, env.sp,
+			env.store, nil,
+			[]beads.Bead{{ID: "work-1", Assignee: identity, Status: status}},
+			nil, env.dt, poolDesired, false, nil, "", nil, env.clk, env.rec,
+			0, 0, &env.stdout, &env.stderr,
+		)
+		if woken != 1 {
+			t.Fatalf("attempt %d (%s): woken = %d, want 1; stderr=%s", i+1, status, woken, env.stderr.String())
+		}
+		if cb.IsOpen(identity, env.clk.Now().UTC()) {
+			t.Fatalf("attempt %d (%s): breaker should stay CLOSED after assigned work progress", i+1, status)
+		}
+		if !env.sp.IsRunning("session-a") {
+			t.Fatalf("attempt %d (%s): session-a should be running after CLOSED breaker wake", i+1, status)
+		}
+		if err := env.sp.Stop("session-a"); err != nil {
+			t.Fatalf("attempt %d (%s): stop session-a: %v", i+1, status, err)
+		}
+		if err := env.store.SetMetadata(b.ID, "state", "asleep"); err != nil {
+			t.Fatalf("attempt %d (%s): set state asleep: %v", i+1, status, err)
+		}
+		if i < len(statuses)-1 {
+			env.clk.Advance(6 * time.Minute)
+		}
+	}
+
+	snap := cb.Snapshot(env.clk.Now().UTC())
+	if len(snap) != 1 || snap[0].Identity != identity || snap[0].State != circuitClosed.String() || snap[0].RestartCount != len(statuses) {
+		t.Fatalf("snapshot after progressing work = %+v, want one CLOSED entry with %d restarts", snap, len(statuses))
+	}
+	if strings.Contains(env.stderr.String(), "CIRCUIT_OPEN") {
+		t.Fatalf("did not expect CIRCUIT_OPEN log, got: %q", env.stderr.String())
+	}
+}
diff --git a/cmd/gc/session_lifecycle_parallel.go b/cmd/gc/session_lifecycle_parallel.go
index 6ae7405544..953ec9b4ba 100644
--- a/cmd/gc/session_lifecycle_parallel.go
+++ b/cmd/gc/session_lifecycle_parallel.go
@@ -10,6 +10,7 @@ import (
 	"runtime/debug"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -19,12 +20,18 @@ import (
 	"github.com/gastownhall/gascity/internal/runtime"
 	sessionpkg "github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/shellquote"
+	"github.com/gastownhall/gascity/internal/worker"
 )
 
 const (
-	defaultMaxParallelStartsPerWave = 3
-	defaultMaxParallelStopsPerWave  = 3
-	defaultMaxParallelInterrupts    = 16
+	// Starts spend the configurable MaxWakesPerTick budget across ticks, but
+	// preparation stays chunked so flapping dependencies are observed between batches.
+	defaultStartDependencyRecheckBatchSize = 3
+
+	// Stops and interrupts are teardown paths, so their parallelism is not
+	// derived from the wake budget used for starts.
+	defaultMaxParallelStopsPerWave = 3
+	defaultMaxParallelInterrupts   = 16
 
 	// staleKeyDetectDelay is how long to wait after starting a session
 	// before checking if it died immediately (stale resume key detection).
@@ -32,6 +39,88 @@ const (
 	staleKeyDetectDelay = 2 * time.Second
 )
 
+type asyncStartLimiter struct {
+	mu       sync.Mutex
+	limit    int
+	inFlight int
+}
+
+func newAsyncStartLimiter(capacity int) *asyncStartLimiter {
+	if capacity <= 0 {
+		capacity = 1
+	}
+	return &asyncStartLimiter{limit: capacity}
+}
+
+func (l *asyncStartLimiter) resize(capacity int) {
+	if l == nil {
+		return
+	}
+	if capacity <= 0 {
+		capacity = 1
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.limit = capacity
+}
+
+func (l *asyncStartLimiter) capacity() int {
+	if l == nil {
+		return 0
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.limit
+}
+
+func (l *asyncStartLimiter) reserve(ctx context.Context) (func(), bool, string) {
+	if l == nil {
+		return func() {}, true, ""
+	}
+	if ctx != nil {
+		select {
+		case <-ctx.Done():
+			return nil, false, "context_canceled"
+		default:
+		}
+	}
+	l.mu.Lock()
+	if l.inFlight >= l.limit {
+		l.mu.Unlock()
+		return nil, false, "deferred_by_async_start_limit"
+	}
+	l.inFlight++
+	l.mu.Unlock()
+	return func() {
+		l.mu.Lock()
+		defer l.mu.Unlock()
+		if l.inFlight > 0 {
+			l.inFlight--
+		}
+	}, true, ""
+}
+
+func maxParallelStartsPerTick(cfg *config.City) int {
+	if cfg == nil {
+		return config.DefaultMaxWakesPerTick
+	}
+	return cfg.Daemon.MaxWakesPerTickOrDefault()
+}
+
+func startCandidateHasTemplateDependencies(candidate startCandidate, cfg *config.City) bool {
+	cfgAgent := findAgentByTemplate(cfg, candidate.logicalTemplate(cfg))
+	return cfgAgent != nil && len(cfgAgent.DependsOn) > 0
+}
+
+func asyncStartBatchNeedsFollowUp(candidates []startCandidate, cfg *config.City) bool {
+	for _, candidate := range candidates {
+		if startCandidateHasTemplateDependencies(candidate, cfg) {
+			return true
+		}
+	}
+	return false
+}
+
 type startCandidate struct {
 	session *beads.Bead
 	tp      TemplateParams
@@ -64,6 +153,97 @@ type startResult struct {
 	started         time.Time
 	finished        time.Time
 	rollbackPending bool
+	rateLimitScreen bool
+}
+
+type startExecutionOptions struct {
+	async         bool
+	asyncFollowUp func()
+	asyncLimiter  *asyncStartLimiter
+	asyncTracker  *asyncStartTracker
+}
+
+type startExecutionOption func(*startExecutionOptions)
+
+func withAsyncStartExecution() startExecutionOption {
+	return func(opts *startExecutionOptions) {
+		opts.async = true
+	}
+}
+
+func withAsyncStartFollowUp(fn func()) startExecutionOption {
+	return func(opts *startExecutionOptions) {
+		opts.asyncFollowUp = fn
+	}
+}
+
+func withAsyncStartLimiter(limiter *asyncStartLimiter) startExecutionOption {
+	return func(opts *startExecutionOptions) {
+		opts.asyncLimiter = limiter
+	}
+}
+
+func withAsyncStartTracker(tracker *asyncStartTracker) startExecutionOption {
+	return func(opts *startExecutionOptions) {
+		opts.asyncTracker = tracker
+	}
+}
+
+type asyncStartTracker struct {
+	mu       sync.Mutex
+	wg       sync.WaitGroup
+	stopping bool
+}
+
+func (t *asyncStartTracker) start() (func(), bool) {
+	if t == nil {
+		return func() {}, true
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if t.stopping {
+		return nil, false
+	}
+	t.wg.Add(1)
+	return t.wg.Done, true
+}
+
+func (t *asyncStartTracker) wait(timeout time.Duration) bool {
+	if t == nil {
+		return true
+	}
+	t.mu.Lock()
+	t.stopping = true
+	t.mu.Unlock()
+	if timeout < 0 {
+		t.wg.Wait()
+		return true
+	}
+	done := make(chan struct{})
+	go func() {
+		t.wg.Wait()
+		close(done)
+	}()
+	if timeout == 0 {
+		select {
+		case <-done:
+			return true
+		default:
+			return false
+		}
+	}
+	select {
+	case <-done:
+		return true
+	case <-time.After(timeout):
+		return false
+	}
+}
+
+type asyncPreparedStart struct {
+	item    preparedStart
+	release func()
+	done    func()
 }
 
 type stopTarget struct {
@@ -185,6 +365,7 @@ func dependencyTemplateAlive(
 	sp runtime.Provider,
 	cityName string,
 	store beads.Store,
+	clk clock.Clock,
 ) bool {
 	if cfg == nil || template == "" {
 		return false
@@ -198,17 +379,62 @@ func dependencyTemplateAlive(
 			if tp.TemplateName != template {
 				continue
 			}
+			if dependencySessionStartInFlight(store, name, cfg, clk) {
+				continue
+			}
 			if alive, err := workerSessionTargetAliveWithConfig(store, sp, cfg, name, tp.Hints.ProcessNames); err == nil && alive {
 				return true
 			}
 		}
 	}
 	sessionName := lookupSessionNameOrLegacy(store, cityName, template, cfg.Workspace.SessionTemplate)
+	if dependencySessionStartInFlight(store, sessionName, cfg, clk) {
+		return false
+	}
 	depTP := desiredState[sessionName]
 	alive, err := workerSessionTargetAliveWithConfig(store, sp, cfg, sessionName, depTP.Hints.ProcessNames)
 	return err == nil && alive
 }
 
+func dependencySessionStartInFlight(store beads.Store, sessionName string, cfg *config.City, clk clock.Clock) bool {
+	sessionName = strings.TrimSpace(sessionName)
+	if store == nil || sessionName == "" {
+		return false
+	}
+	matches, err := store.ListByMetadata(map[string]string{"session_name": sessionName}, 0)
+	if err != nil {
+		return true
+	}
+	for _, session := range matches {
+		if session.Status == "closed" {
+			continue
+		}
+		if !isSessionBead(session) {
+			continue
+		}
+		var startupTimeout time.Duration
+		if cfg != nil {
+			startupTimeout = cfg.Session.StartupTimeoutDuration()
+		}
+		if pendingCreateStartInFlight(session, clk, startupTimeout) {
+			return true
+		}
+	}
+	return false
+}
+
+func isSessionBead(session beads.Bead) bool {
+	if session.Type == sessionBeadType {
+		return true
+	}
+	for _, label := range session.Labels {
+		if label == sessionBeadLabel {
+			return true
+		}
+	}
+	return false
+}
+
 func candidateWaveOrder(
 	candidates []startCandidate,
 	cfg *config.City,
@@ -216,6 +442,7 @@ func candidateWaveOrder(
 	sp runtime.Provider,
 	cityName string,
 	store beads.Store,
+	clk clock.Clock,
 ) (map[int]int, bool) {
 	if len(candidates) == 0 {
 		return map[int]int{}, true
@@ -240,7 +467,7 @@ func candidateWaveOrder(
 			continue
 		}
 		for _, dep := range cfgAgent.DependsOn {
-			if dependencyTemplateAlive(dep, cfg, desiredState, sp, cityName, store) {
+			if dependencyTemplateAlive(dep, cfg, desiredState, sp, cityName, store, clk) {
 				continue
 			}
 			if candidateTemplates[dep] {
@@ -268,14 +495,62 @@ func prepareStartCandidate(
 	cfg *config.City,
 	store beads.Store,
 	clk clock.Clock,
+) (*preparedStart, error) {
+	return prepareStartCandidateForCity(candidate, "", "", cfg, nil, store, clk, io.Discard)
+}
+
+func prepareStartCandidateForCity(
+	candidate startCandidate,
+	cityPath string,
+	cityName string,
+	cfg *config.City,
+	sp runtime.Provider,
+	store beads.Store,
+	clk clock.Clock,
+	stderr io.Writer,
 ) (*preparedStart, error) {
 	session := candidate.session
 	if _, _, err := preWakeCommit(session, store, clk); err != nil {
 		return nil, err
 	}
+	candidate = refreshConfiguredNamedStartCandidate(candidate, cityPath, cityName, cfg, sp, store, clk, stderr)
 	return buildPreparedStart(candidate, cfg, store)
 }
 
+func refreshConfiguredNamedStartCandidate(
+	candidate startCandidate,
+	cityPath string,
+	cityName string,
+	cfg *config.City,
+	sp runtime.Provider,
+	store beads.Store,
+	clk clock.Clock,
+	stderr io.Writer,
+) startCandidate {
+	if candidate.session == nil || cfg == nil || store == nil || !isNamedSessionBead(*candidate.session) {
+		return candidate
+	}
+	if cityName == "" {
+		cityName = config.EffectiveCityName(cfg, "")
+	}
+	snapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		if stderr != nil {
+			fmt.Fprintf(stderr, "session reconciler: refreshing named session start %s: listing sessions: %v\n", candidate.name(), err) //nolint:errcheck
+		}
+		return candidate
+	}
+	refreshed, err := resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, snapshot.Open(), *candidate.session, clk, stderr)
+	if err != nil {
+		if stderr != nil {
+			fmt.Fprintf(stderr, "session reconciler: refreshing named session start %s: %v\n", candidate.name(), err) //nolint:errcheck
+		}
+		return candidate
+	}
+	candidate.tp = refreshed
+	return candidate
+}
+
 func buildPreparedStart(
 	candidate startCandidate,
 	cfg *config.City,
@@ -340,14 +615,15 @@ func buildPreparedStart(
 		}
 		session.Metadata["session_key"] = sessionKey
 	}
-	if sk := session.Metadata["session_key"]; sk != "" && tp.ResolvedProvider != nil {
+	if sk := session.Metadata["session_key"]; sk != "" && tp.ResolvedProvider != nil && !tp.IsACP {
 		firstStart := session.Metadata["started_config_hash"] == ""
 		forceFresh := session.Metadata["wake_mode"] == "fresh"
 		agentCfg.Command = resolveSessionCommand(agentCfg.Command, sk, tp.ResolvedProvider, firstStart, forceFresh)
 	}
 	firstStart := session.Metadata["started_config_hash"] == ""
 	forceFresh := session.Metadata["wake_mode"] == "fresh"
-	if !firstStart && !forceFresh {
+	hasResumeKey := strings.TrimSpace(session.Metadata["session_key"]) != ""
+	if !firstStart && !forceFresh && hasResumeKey {
 		agentCfg.PromptSuffix = ""
 		agentCfg.PromptFlag = ""
 		agentCfg.Nudge = tp.Hints.Nudge
@@ -444,6 +720,17 @@ func executePreparedStartWave(
 	prepared []preparedStart,
 	sp runtime.Provider,
 	store beads.Store,
+	startupTimeout time.Duration,
+) []startResult {
+	return executePreparedStartWaveForCity(ctx, prepared, "", sp, store, nil, startupTimeout, 1)
+}
+
+func executePreparedStartWaveForCity(
+	ctx context.Context,
+	prepared []preparedStart,
+	cityPath string,
+	sp runtime.Provider,
+	store beads.Store,
 	cfg *config.City,
 	startupTimeout time.Duration,
 	maxParallel int,
@@ -451,7 +738,6 @@ func executePreparedStartWave(
 	if len(prepared) == 0 {
 		return nil
 	}
-	cityPath := ""
 	if maxParallel <= 0 {
 		maxParallel = 1
 	}
@@ -462,98 +748,11 @@ func executePreparedStartWave(
 		i, item := i, item
 		sem <- struct{}{}
 		go func() {
-			started := time.Now()
 			defer func() {
-				if recovered := recover(); recovered != nil {
-					stack := debug.Stack()
-					results[i] = startResult{
-						prepared: item,
-						err:      fmt.Errorf("panic during start: %v\n%s", recovered, stack),
-						outcome:  "panic_recovered",
-						started:  started,
-						finished: time.Now(),
-					}
-				}
 				<-sem
 				done <- i
 			}()
-			startCtx := ctx
-			cancel := func() {}
-			if startupTimeout > 0 {
-				startCtx, cancel = context.WithTimeout(ctx, startupTimeout)
-			}
-			defer cancel()
-			_, err := startPreparedStartCandidate(startCtx, item, cityPath, store, sp, cfg)
-			if err != nil && errors.Is(err, sessionpkg.ErrStateSync) {
-				running, runningErr := workerSessionTargetRunningWithConfig(cityPath, store, sp, cfg, item.candidate.name())
-				if runningErr == nil && running {
-					err = nil
-				}
-			}
-			// Stale session key detection: if the session was started
-			// with a resume flag but dies immediately, the session key
-			// likely references a conversation that no longer exists
-			// (e.g., "No conversation found"). Report as a failure so
-			// recordWakeFailure clears the key for the next attempt.
-			if err == nil && item.candidate.session != nil && item.candidate.session.Metadata["session_key"] != "" {
-				time.Sleep(staleKeyDetectDelay)
-				running := false
-				if store == nil || strings.TrimSpace(item.candidate.session.ID) == "" {
-					running = sp != nil && sp.IsRunning(item.candidate.name())
-				} else {
-					running, err = workerSessionTargetRunningWithConfig(cityPath, store, sp, cfg, item.candidate.name())
-				}
-				if err != nil || !running {
-					err = fmt.Errorf("session %q died during startup", item.candidate.name())
-				}
-			}
-			finished := time.Now()
-			rollbackPending := err != nil && shouldRollbackPendingCreate(item.candidate.session)
-			if err != nil && rollbackPending && runningSessionMatchesPendingCreate(item.candidate.session, item.candidate.name(), sp) {
-				results[i] = startResult{
-					prepared:        item,
-					err:             nil,
-					outcome:         "start_error_converged",
-					started:         started,
-					finished:        finished,
-					rollbackPending: false,
-				}
-				return
-			}
-			var outcome string
-			switch {
-			case err == nil:
-				outcome = "success"
-			case startCtx.Err() == context.DeadlineExceeded:
-				outcome = "deadline_exceeded"
-			case startCtx.Err() == context.Canceled:
-				outcome = "canceled"
-			case errors.Is(err, runtime.ErrSessionInitializing):
-				outcome = "session_initializing"
-				err = nil
-			case errors.Is(err, runtime.ErrSessionExists):
-				running, runningErr := workerSessionTargetRunningWithConfig(cityPath, store, sp, cfg, item.candidate.name())
-				switch {
-				case runningErr != nil || !running:
-					outcome = "provider_error"
-				case rollbackPending && runningSessionMatchesPendingCreate(item.candidate.session, item.candidate.name(), sp):
-					outcome = "session_exists_converged"
-					err = nil
-					rollbackPending = false
-				default:
-					outcome = "session_exists"
-				}
-			default:
-				outcome = "provider_error"
-			}
-			results[i] = startResult{
-				prepared:        item,
-				err:             err,
-				outcome:         outcome,
-				started:         started,
-				finished:        finished,
-				rollbackPending: rollbackPending,
-			}
+			results[i] = runPreparedStartCandidate(ctx, item, cityPath, sp, store, cfg, startupTimeout)
 		}()
 	}
 	for range prepared {
@@ -562,6 +761,419 @@ func executePreparedStartWave(
 	return results
 }
 
+func runPreparedStartCandidate(
+	ctx context.Context,
+	item preparedStart,
+	cityPath string,
+	sp runtime.Provider,
+	store beads.Store,
+	cfg *config.City,
+	startupTimeout time.Duration,
+) (result startResult) {
+	started := time.Now()
+	result = startResult{
+		prepared: item,
+		started:  started,
+		finished: started,
+	}
+	defer func() {
+		if recovered := recover(); recovered != nil {
+			stack := debug.Stack()
+			result = startResult{
+				prepared: item,
+				err:      fmt.Errorf("panic during start: %v\n%s", recovered, stack),
+				outcome:  "panic_recovered",
+				started:  started,
+				finished: time.Now(),
+			}
+		}
+	}()
+
+	startCtx := ctx
+	cancel := func() {}
+	if startupTimeout > 0 {
+		startCtx, cancel = context.WithTimeout(ctx, startupTimeout)
+	}
+	defer cancel()
+	_, err := startPreparedStartCandidate(startCtx, item, cityPath, store, sp, cfg)
+	startCtxErr := startCtx.Err()
+	if err != nil && errors.Is(err, sessionpkg.ErrStateSync) {
+		running, runningErr := workerSessionTargetRunningWithConfig(cityPath, store, sp, cfg, item.candidate.name())
+		if runningErr == nil && running {
+			err = nil
+		}
+	}
+	// Stale session key detection: if the session was started
+	// with a resume flag but dies immediately, the session key
+	// likely references a conversation that no longer exists
+	// (e.g., "No conversation found"). Report as a failure so
+	// recordWakeFailure clears the key for the next attempt.
+	if err == nil && item.candidate.session != nil && item.candidate.session.Metadata["session_key"] != "" {
+		time.Sleep(staleKeyDetectDelay)
+		running := false
+		alive := false
+		if store == nil || strings.TrimSpace(item.candidate.session.ID) == "" {
+			running = sp != nil && sp.IsRunning(item.candidate.name())
+			alive = running && (sp == nil || sp.ProcessAlive(item.candidate.name(), item.cfg.ProcessNames))
+		} else {
+			var obs worker.LiveObservation
+			obs, err = workerObserveSessionTargetWithRuntimeHintsWithConfig(cityPath, store, sp, cfg, item.candidate.name(), item.cfg.ProcessNames)
+			running = obs.Running
+			alive = obs.Alive
+		}
+		if err != nil || !running || !alive {
+			err = fmt.Errorf("session %q died during startup", item.candidate.name())
+		}
+	}
+	finished := time.Now()
+	rollbackPending := err != nil && shouldRollbackPendingCreate(item.candidate.session)
+	rateLimitScreen := err != nil && startupRateLimitScreenDetected(item, cityPath, sp, store, cfg)
+	if err != nil && rollbackPending && !rateLimitScreen && runningSessionMatchesPendingCreate(item.candidate.session, item.candidate.name(), sp) {
+		return startResult{
+			prepared:        item,
+			err:             nil,
+			outcome:         "start_error_converged",
+			started:         started,
+			finished:        finished,
+			rollbackPending: false,
+		}
+	}
+	var outcome string
+	switch {
+	case errors.Is(err, runtime.ErrSessionInitializing):
+		outcome = "session_initializing"
+		err = nil
+	case startCtxErr == context.DeadlineExceeded:
+		outcome = "deadline_exceeded"
+		if err == nil {
+			err = fmt.Errorf("session %q startup: %w", item.candidate.name(), context.DeadlineExceeded)
+		}
+	case startCtxErr == context.Canceled:
+		outcome = "canceled"
+		if err == nil {
+			err = fmt.Errorf("session %q startup: %w", item.candidate.name(), context.Canceled)
+		}
+	case err == nil:
+		outcome = "success"
+	case errors.Is(err, runtime.ErrSessionExists):
+		running, runningErr := workerSessionTargetRunningWithConfig(cityPath, store, sp, cfg, item.candidate.name())
+		switch {
+		case runningErr != nil || !running:
+			outcome = "provider_error"
+		case rollbackPending && !rateLimitScreen && runningSessionMatchesPendingCreate(item.candidate.session, item.candidate.name(), sp):
+			outcome = "session_exists_converged"
+			err = nil
+			rollbackPending = false
+		default:
+			outcome = "session_exists"
+		}
+	default:
+		outcome = "provider_error"
+	}
+	if err == nil {
+		rateLimitScreen = false
+	}
+	return startResult{
+		prepared:        item,
+		err:             err,
+		outcome:         outcome,
+		started:         started,
+		finished:        finished,
+		rollbackPending: rollbackPending,
+		rateLimitScreen: rateLimitScreen,
+	}
+}
+
+func startupRateLimitScreenDetected(
+	item preparedStart,
+	cityPath string,
+	sp runtime.Provider,
+	store beads.Store,
+	cfg *config.City,
+) bool {
+	if item.candidate.session == nil {
+		return false
+	}
+	if cfg != nil && cfg.Session.Provider == "subprocess" {
+		return false
+	}
+	lastWoke := item.candidate.session.Metadata["last_woke_at"]
+	if lastWoke == "" {
+		return false
+	}
+	if _, err := time.Parse(time.RFC3339, lastWoke); err != nil {
+		return false
+	}
+	content, err := workerSessionTargetPeekWithConfig(
+		cityPath,
+		store,
+		sp,
+		cfg,
+		item.candidate.name(),
+		rateLimitPeekLines,
+		item.cfg.ProcessNames,
+	)
+	return err == nil && runtime.ContainsProviderRateLimitScreen(content)
+}
+
+func enqueuePreparedStartWaveForCity(
+	ctx context.Context,
+	prepared []asyncPreparedStart,
+	cityPath string,
+	sp runtime.Provider,
+	store beads.Store,
+	cfg *config.City,
+	clk clock.Clock,
+	rec events.Recorder,
+	startupTimeout time.Duration,
+	wave int,
+	stdout, stderr io.Writer,
+	trace *sessionReconcilerTraceCycle,
+	asyncFollowUp func(),
+) []startResult {
+	if len(prepared) == 0 {
+		return nil
+	}
+	results := make([]startResult, len(prepared))
+	for i, reserved := range prepared {
+		item := clonePreparedStartForAsync(reserved.item)
+		release := reserved.release
+		now := time.Now()
+		results[i] = startResult{
+			prepared: item,
+			outcome:  "start_enqueued",
+			started:  now,
+			finished: now,
+		}
+		done := reserved.done
+		go func(item preparedStart, release func(), done func()) {
+			if done != nil {
+				defer done()
+			}
+			if release != nil {
+				defer release()
+			}
+			result := runPreparedStartCandidate(ctx, item, cityPath, sp, store, cfg, startupTimeout)
+			commitAsyncStartResultWithContext(ctx, result, sp, store, clk, rec, wave, stdout, stderr, trace)
+			if asyncFollowUp != nil {
+				asyncFollowUp()
+			}
+		}(item, release, done)
+	}
+	return results
+}
+
+func reserveAsyncStartSlot(ctx context.Context, limiter *asyncStartLimiter) (func(), bool, string) {
+	return limiter.reserve(ctx)
+}
+
+func commitAsyncStartResultWithContext(
+	ctx context.Context,
+	result startResult,
+	sp runtime.Provider,
+	store beads.Store,
+	clk clock.Clock,
+	rec events.Recorder,
+	wave int,
+	stdout, stderr io.Writer,
+	trace *sessionReconcilerTraceCycle,
+) (committed bool) {
+	name := result.prepared.candidate.name()
+	template := result.prepared.candidate.tp.TemplateName
+	defer func() {
+		if trace != nil {
+			_ = trace.flushCurrentBatch(TraceDurabilityDurable)
+		}
+	}()
+	defer func() {
+		if recovered := recover(); recovered != nil {
+			err := fmt.Errorf("panic during async start commit: %v\n%s", recovered, debug.Stack())
+			clearPendingStartInFlightLease(result.prepared.candidate.session, store, stderr)
+			fmt.Fprintf(stderr, "session reconciler: committing async start %s: %s\n", name, formatLifecycleError(err)) //nolint:errcheck
+			logLifecycleOutcome(stderr, "start", wave, name, template, "panic_recovered", result.started, time.Now(), err)
+			committed = false
+		}
+	}()
+
+	refreshed, ok, cleanupRuntime, releaseInFlight := refreshAsyncStartResult(result, store, stderr)
+	if !ok {
+		if cleanupRuntime {
+			stopStaleAsyncStartRuntime(result, sp, stderr)
+		}
+		outcome := "stale_async_start"
+		if releaseInFlight {
+			clearPendingStartInFlightLease(result.prepared.candidate.session, store, stderr)
+			outcome = "async_start_refresh_failed"
+		}
+		logLifecycleOutcome(stderr, "start", wave, name, template, outcome, result.started, time.Now(), nil)
+		return false
+	}
+	if refreshed.err != nil && refreshed.rollbackPending && runningSessionMatchesPendingCreate(refreshed.prepared.candidate.session, refreshed.prepared.candidate.name(), sp) {
+		refreshed.err = nil
+		refreshed.outcome = "session_exists_converged"
+		refreshed.rollbackPending = false
+	}
+	if ctx != nil && ctx.Err() != nil {
+		if refreshed.err != nil && refreshed.rollbackPending {
+			return commitStartResultTraced(refreshed, store, clk, rec, wave, stdout, stderr, trace)
+		}
+		if refreshed.err == nil && shouldRollbackPendingCreate(refreshed.prepared.candidate.session) {
+			stopStaleAsyncStartRuntime(refreshed, sp, stderr)
+			clearPendingStartInFlightLease(refreshed.prepared.candidate.session, store, stderr)
+		}
+		logLifecycleOutcome(stderr, "start", wave, name, template, "context_canceled", refreshed.started, time.Now(), ctx.Err())
+		return false
+	}
+	if sp != nil && refreshed.err == nil && refreshed.outcome != "session_initializing" {
+		clearReconcilerDrainAckMetadata(sp, refreshed.prepared.candidate.name())
+	}
+	return commitStartResultTraced(refreshed, store, clk, rec, wave, stdout, stderr, trace)
+}
+
+func refreshAsyncStartResult(result startResult, store beads.Store, stderr io.Writer) (startResult, bool, bool, bool) {
+	session := result.prepared.candidate.session
+	if store == nil || session == nil || strings.TrimSpace(session.ID) == "" {
+		return result, true, false, false
+	}
+	current, err := store.Get(session.ID)
+	if err != nil {
+		fmt.Fprintf(stderr, "session reconciler: refreshing async start %s: %v\n", result.prepared.candidate.name(), err) //nolint:errcheck
+		return result, false, false, true
+	}
+	if asyncStartPreparedCommandStale(result.prepared, current) {
+		fmt.Fprintf(stderr, "session reconciler: ignoring stale async start result for %s: desired command changed during startup\n", result.prepared.candidate.name()) //nolint:errcheck
+		return result, false, true, true
+	}
+	if !asyncStartSessionStillCurrent(*session, current) {
+		fmt.Fprintf(stderr, "session reconciler: ignoring stale async start result for %s\n", result.prepared.candidate.name()) //nolint:errcheck
+		return result, false, asyncStartStaleRuntimeCleanupAllowed(*session, current), false
+	}
+	result.prepared.candidate.session = &current
+	return result, true, false, false
+}
+
+func asyncStartPreparedCommandStale(prepared preparedStart, current beads.Bead) bool {
+	preparedCommand := strings.TrimSpace(prepared.candidate.tp.Command)
+	currentCommand := strings.TrimSpace(current.Metadata["command"])
+	return preparedCommand != "" && currentCommand != "" && preparedCommand != currentCommand
+}
+
+func clearPendingStartInFlightLease(session *beads.Bead, store beads.Store, stderr io.Writer) {
+	if session == nil || store == nil {
+		return
+	}
+	if setMeta(store, session.ID, "last_woke_at", "", stderr) == nil {
+		if session.Metadata == nil {
+			session.Metadata = make(map[string]string)
+		}
+		session.Metadata["last_woke_at"] = ""
+	}
+}
+
+func stopStaleAsyncStartRuntime(result startResult, sp runtime.Provider, stderr io.Writer) {
+	if sp == nil || result.prepared.candidate.session == nil {
+		return
+	}
+	name := result.prepared.candidate.name()
+	if !runningSessionMatchesPendingCreate(result.prepared.candidate.session, name, sp) {
+		return
+	}
+	if err := sp.Stop(name); err != nil && !runtime.IsSessionGone(err) {
+		fmt.Fprintf(stderr, "session reconciler: stopping stale async start runtime %s: %v\n", name, err) //nolint:errcheck
+	}
+}
+
+// asyncStartSessionStillCurrent decides whether an async start result should
+// commit against the current bead. Identity is established by instance_token:
+// when the prepared and current tokens both exist and match, the bead is the
+// same session we spawned for, even if the generation has been bumped by a
+// concurrent reconciler phase (which is normal when a wave runs long enough
+// for other phases to write metadata between enqueue and result completion).
+//
+// Rejecting on generation drift alone caused stuck-creating zombies: the
+// process spawned successfully, but the result was discarded as "stale", so
+// pending_create_claim never cleared and the session never advanced past
+// state=creating. Falling back to generation only when the token is absent
+// preserves the prior behavior for callers that pre-date instance_token.
+func asyncStartSessionStillCurrent(prepared, current beads.Bead) bool {
+	if strings.TrimSpace(current.Status) == "closed" {
+		return false
+	}
+	if !asyncStartIdentityMatches(prepared, current) {
+		return false
+	}
+	currentState := sessionpkg.State(strings.TrimSpace(current.Metadata["state"]))
+	// If the bead has progressed to a live state (active or awake), the spawn
+	// already succeeded and another phase (typically ensureRunning via attach)
+	// has cleared pending_create_claim. The async result still carries useful
+	// metadata (creation_complete_at, runtime_epoch, etc.) — commit it instead
+	// of discarding as "stale", which leaves the bead missing fields the rest
+	// of the system relies on.
+	if currentState == sessionpkg.StateAwake || currentState == sessionpkg.StateActive {
+		return true
+	}
+	// For sessions still mid-flight (creating/asleep/drained/empty), reject if
+	// pending_create_claim was cleared from under us — that means a different
+	// reconciler phase already rolled the create back, and our result would
+	// stomp on its decision.
+	if shouldRollbackPendingCreate(&prepared) && !shouldRollbackPendingCreate(&current) {
+		return false
+	}
+	return confirmPendingStart(string(currentState))
+}
+
+func asyncStartStaleRuntimeCleanupAllowed(prepared, current beads.Bead) bool {
+	if strings.TrimSpace(current.Status) == "closed" {
+		return true
+	}
+	if !asyncStartIdentityMatches(prepared, current) {
+		return true
+	}
+	currentState := sessionpkg.State(strings.TrimSpace(current.Metadata["state"]))
+	if shouldRollbackPendingCreate(&prepared) && !shouldRollbackPendingCreate(&current) {
+		return currentState != sessionpkg.StateAwake && currentState != sessionpkg.StateActive
+	}
+	return !confirmPendingStart(string(currentState)) &&
+		currentState != sessionpkg.StateAwake &&
+		currentState != sessionpkg.StateActive
+}
+
+// asyncStartIdentityMatches reports whether prepared and current describe the
+// same session bead. instance_token is authoritative when both sides have one;
+// only fall back to generation when the prepared bead has no token (legacy
+// pre-instance_token snapshots). Generation drift with a matching token is a
+// normal consequence of concurrent reconciler phases and must not invalidate
+// an in-flight start result.
+func asyncStartIdentityMatches(prepared, current beads.Bead) bool {
+	preparedToken := strings.TrimSpace(prepared.Metadata["instance_token"])
+	if preparedToken != "" {
+		return strings.TrimSpace(current.Metadata["instance_token"]) == preparedToken
+	}
+	preparedGeneration := strings.TrimSpace(prepared.Metadata["generation"])
+	if preparedGeneration == "" {
+		return true
+	}
+	return strings.TrimSpace(current.Metadata["generation"]) == preparedGeneration
+}
+
+func clonePreparedStartForAsync(item preparedStart) preparedStart {
+	if item.candidate.session == nil {
+		return item
+	}
+	sessionCopy := *item.candidate.session
+	if item.candidate.session.Labels != nil {
+		sessionCopy.Labels = append([]string(nil), item.candidate.session.Labels...)
+	}
+	if item.candidate.session.Metadata != nil {
+		sessionCopy.Metadata = make(map[string]string, len(item.candidate.session.Metadata))
+		for key, value := range item.candidate.session.Metadata {
+			sessionCopy.Metadata[key] = value
+		}
+	}
+	item.candidate.session = &sessionCopy
+	return item
+}
+
 func startPreparedStartCandidate(
 	ctx context.Context,
 	item preparedStart,
@@ -634,12 +1246,33 @@ func commitStartResultTraced(
 	// Session still starting up — back off silently without recording failure.
 	// The reconciler will retry on the next patrol tick.
 	if result.outcome == "session_initializing" {
+		clearPendingStartInFlightLease(session, store, stderr)
 		logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, nil)
 		return false
 	}
 	if result.err != nil {
+		fmt.Fprintf(stderr, "session reconciler: starting %s: %s\n", name, formatLifecycleError(result.err)) //nolint:errcheck
+		if result.rateLimitScreen {
+			if err := recordRateLimitQuarantine(session, store, clk); err != nil {
+				fmt.Fprintf(stderr, "session reconciler: recording startup rate-limit hold for %s: %v\n", name, err) //nolint:errcheck
+				if trace != nil {
+					trace.recordOperation("reconciler.start.rate_limit_hold", tp.TemplateName, name, "", "start", "hold_deferred", traceRecordPayload{
+						"error": formatLifecycleError(result.err),
+						"cause": err.Error(),
+					}, "")
+				}
+				logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err)
+				return false
+			}
+			if trace != nil {
+				trace.recordOperation("reconciler.start.rate_limit_hold", tp.TemplateName, name, "", "start", "held", traceRecordPayload{
+					"error": formatLifecycleError(result.err),
+				}, "")
+			}
+			logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err)
+			return false
+		}
 		if result.rollbackPending {
-			fmt.Fprintf(stderr, "session reconciler: starting %s: %s\n", name, formatLifecycleError(result.err)) //nolint:errcheck
 			if trace != nil {
 				trace.recordOperation("reconciler.start.rollback_pending", tp.TemplateName, name, "", "start", result.outcome, traceRecordPayload{
 					"error": formatLifecycleError(result.err),
@@ -649,7 +1282,6 @@ func commitStartResultTraced(
 			logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, result.outcome, result.started, result.finished, result.err)
 			return false
 		}
-		fmt.Fprintf(stderr, "session reconciler: starting %s: %s\n", name, formatLifecycleError(result.err)) //nolint:errcheck
 		if err := store.SetMetadata(session.ID, "last_woke_at", ""); err != nil {
 			fmt.Fprintf(stderr, "session reconciler: clearing last_woke_at for %s: %v\n", name, err) //nolint:errcheck
 		} else {
@@ -692,6 +1324,7 @@ func commitStartResultTraced(
 	})
 	storedMCPSnapshot, err := sessionpkg.EncodeMCPServersSnapshot(result.prepared.cfg.MCPServers)
 	if err != nil {
+		clearPendingStartInFlightLease(session, store, stderr)
 		fmt.Fprintf(stderr, "session reconciler: encoding MCP snapshot for %s: %v\n", name, err) //nolint:errcheck
 		logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, "metadata_encode_failed", result.started, result.finished, err)
 		return false
@@ -700,6 +1333,7 @@ func commitStartResultTraced(
 		metadata[sessionpkg.MCPServersSnapshotMetadataKey] = storedMCPSnapshot
 	}
 	if err := sessionpkg.PersistRuntimeMCPServersSnapshot(result.prepared.cfg.Env["GC_CITY_PATH"], session.ID, result.prepared.cfg.MCPServers); err != nil {
+		clearPendingStartInFlightLease(session, store, stderr)
 		fmt.Fprintf(stderr, "session reconciler: storing runtime MCP snapshot for %s: %v\n", name, err) //nolint:errcheck
 		logLifecycleOutcome(stderr, "start", wave, name, tp.TemplateName, "runtime_mcp_snapshot_failed", result.started, result.finished, err)
 		return false
@@ -717,6 +1351,7 @@ func commitStartResultTraced(
 		}
 	}
 	if err := store.SetMetadataBatch(session.ID, metadata); err != nil {
+		clearPendingStartInFlightLease(session, store, stderr)
 		fmt.Fprintf(stderr, "session reconciler: storing hashes for %s: %v\n", name, err) //nolint:errcheck
 		if trace != nil {
 			trace.recordMutation("bead_metadata", tp.TemplateName, name, "metadata_batch", session.ID, "started_config_hash", "", result.prepared.coreHash, "failed", traceRecordPayload{
@@ -824,27 +1459,43 @@ func runningSessionMatchesPendingCreate(session *beads.Bead, sessionName string,
 	if session == nil || sp == nil {
 		return false
 	}
-	if liveID, err := sp.GetMeta(sessionName, "GC_SESSION_ID"); err == nil {
-		liveID = strings.TrimSpace(liveID)
-		if liveID != "" {
-			return liveID == session.ID
+	liveID := ""
+	if value, err := sp.GetMeta(sessionName, "GC_SESSION_ID"); err == nil {
+		liveID = strings.TrimSpace(value)
+		if liveID != "" && liveID != session.ID {
+			return false
 		}
 	}
 	expectedToken := strings.TrimSpace(session.Metadata["instance_token"])
-	if expectedToken == "" {
-		return false
+	liveToken := ""
+	if value, err := sp.GetMeta(sessionName, "GC_INSTANCE_TOKEN"); err == nil {
+		liveToken = value
+		liveToken = strings.TrimSpace(liveToken)
+		if liveToken != "" && liveToken != expectedToken {
+			liveGeneration, _ := sp.GetMeta(sessionName, "GC_RUNTIME_EPOCH")
+			expectedGeneration := strings.TrimSpace(session.Metadata["generation"])
+			if strings.TrimSpace(liveGeneration) != "" && expectedGeneration != "" && strings.TrimSpace(liveGeneration) != expectedGeneration {
+				return false
+			}
+			if liveID == "" {
+				return false
+			}
+		}
 	}
-	liveToken, err := sp.GetMeta(sessionName, "GC_INSTANCE_TOKEN")
-	if err != nil {
+	if liveID != "" {
+		return liveID == session.ID
+	}
+	if expectedToken == "" {
 		return false
 	}
-	return strings.TrimSpace(liveToken) == expectedToken
+	return expectedToken != "" && liveToken == expectedToken
 }
 
 func rollbackPendingCreate(session *beads.Bead, store beads.Store, now time.Time, stderr io.Writer) {
 	if session == nil || store == nil {
 		return
 	}
+	clearPendingStartInFlightLease(session, store, stderr)
 	if strings.TrimSpace(session.Metadata["session_name_explicit"]) == "true" {
 		if setMeta(store, session.ID, "session_name", "", stderr) == nil {
 			if session.Metadata == nil {
@@ -869,7 +1520,7 @@ func executePlannedStarts(
 	startupTimeout time.Duration,
 	stdout, stderr io.Writer,
 ) int {
-	return executePlannedStartsTraced(ctx, candidates, cfg, desiredState, sp, store, cityName, clk, rec, startupTimeout, stdout, stderr, nil)
+	return executePlannedStartsTraced(ctx, candidates, cfg, desiredState, sp, store, cityName, "", clk, rec, startupTimeout, stdout, stderr, nil)
 }
 
 func executePlannedStartsTraced(
@@ -880,17 +1531,38 @@ func executePlannedStartsTraced(
 	sp runtime.Provider,
 	store beads.Store,
 	cityName string,
+	cityPath string,
 	clk clock.Clock,
 	rec events.Recorder,
 	startupTimeout time.Duration,
 	stdout, stderr io.Writer,
 	trace *sessionReconcilerTraceCycle,
+	options ...startExecutionOption,
 ) int {
 	if len(candidates) == 0 {
 		return 0
 	}
-	maxWakes := cfg.Daemon.MaxWakesPerTickOrDefault()
-	waveByCandidate, ok := candidateWaveOrder(candidates, cfg, desiredState, sp, cityName, store)
+	if ctx != nil && ctx.Err() != nil {
+		return 0
+	}
+	startOpts := startExecutionOptions{}
+	for _, apply := range options {
+		if apply != nil {
+			apply(&startOpts)
+		}
+	}
+	cbCfg, cbEnabled := sessionCircuitBreakerConfigFromCity(cfg)
+	var cb *sessionCircuitBreaker
+	if cbEnabled {
+		cb = defaultSessionCircuitBreaker()
+		cb.configure(cbCfg)
+	}
+	asyncLimiter := startOpts.asyncLimiter
+	maxWakes := maxParallelStartsPerTick(cfg)
+	if startOpts.async && asyncLimiter == nil {
+		asyncLimiter = newAsyncStartLimiter(maxWakes)
+	}
+	waveByCandidate, ok := candidateWaveOrder(candidates, cfg, desiredState, sp, cityName, store, clk)
 	if !ok {
 		fmt.Fprintln(stderr, "session reconciler: dependency graph fallback to serial start order") //nolint:errcheck
 	}
@@ -902,7 +1574,11 @@ func executePlannedStartsTraced(
 	}
 	wakeCount := 0
 	for wave := 0; wave <= maxWave; wave++ {
+		if ctx != nil && ctx.Err() != nil {
+			return wakeCount
+		}
 		waveStarted := time.Now()
+		asyncFollowUpRequired := false
 		var waveCandidates []startCandidate
 		for idx, candidate := range candidates {
 			if waveByCandidate[idx] == wave {
@@ -920,7 +1596,10 @@ func executePlannedStartsTraced(
 		}
 		var ready []startCandidate
 		for _, candidate := range waveCandidates {
-			if !allDependenciesAliveForTemplate(candidate.logicalTemplate(cfg), cfg, desiredState, sp, cityName, store) {
+			if ctx != nil && ctx.Err() != nil {
+				return wakeCount
+			}
+			if !allDependenciesAliveForTemplateWithClock(candidate.logicalTemplate(cfg), cfg, desiredState, sp, cityName, store, clk) {
 				logLifecycleOutcome(stderr, "start", wave, candidate.name(), candidate.logicalTemplate(cfg), "blocked_on_dependencies", time.Time{}, time.Time{}, nil)
 				continue
 			}
@@ -933,24 +1612,123 @@ func executePlannedStartsTraced(
 				}
 				break
 			}
-			batchSize := min(defaultMaxParallelStartsPerWave, maxWakes-wakeCount)
+			batchSize := min(defaultStartDependencyRecheckBatchSize, maxWakes-wakeCount)
 			end := min(offset+batchSize, len(ready))
+			batchCandidates := ready[offset:end]
 			var prepared []preparedStart
-			for _, candidate := range ready[offset:end] {
-				if !allDependenciesAliveForTemplate(candidate.logicalTemplate(cfg), cfg, desiredState, sp, cityName, store) {
+			var asyncPrepared []asyncPreparedStart
+			for _, candidate := range batchCandidates {
+				if ctx != nil && ctx.Err() != nil {
+					return wakeCount
+				}
+				if !allDependenciesAliveForTemplateWithClock(candidate.logicalTemplate(cfg), cfg, desiredState, sp, cityName, store, clk) {
 					logLifecycleOutcome(stderr, "start", wave, candidate.name(), candidate.logicalTemplate(cfg), "blocked_on_dependencies", time.Time{}, time.Time{}, nil)
 					continue
 				}
-				item, err := prepareStartCandidate(candidate, cfg, store, clk)
+				var release func()
+				var done func()
+				if startOpts.async {
+					var tracking bool
+					done, tracking = startOpts.asyncTracker.start()
+					if !tracking {
+						logLifecycleOutcome(stderr, "start", wave, candidate.name(), candidate.logicalTemplate(cfg), "context_canceled", time.Time{}, time.Time{}, nil)
+						continue
+					}
+					var reserved bool
+					var outcome string
+					release, reserved, outcome = reserveAsyncStartSlot(ctx, asyncLimiter)
+					if !reserved {
+						done()
+						logLifecycleOutcome(stderr, "start", wave, candidate.name(), candidate.logicalTemplate(cfg), outcome, time.Time{}, time.Time{}, nil)
+						continue
+					}
+				}
+				if cbEnabled {
+					identity := ""
+					if candidate.session != nil {
+						identity = namedSessionIdentity(*candidate.session)
+					}
+					if identity != "" {
+						cbNow := clk.Now().UTC()
+						if cb.IsOpen(identity, cbNow) {
+							if release != nil {
+								release()
+							}
+							if done != nil {
+								done()
+							}
+							if err := persistSessionCircuitBreakerMetadata(store, candidate.session, cb, identity, cbNow); err != nil {
+								fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
+							}
+							cb.LogOpenOnce(identity, stderr)
+							if trace != nil {
+								trace.recordDecision("reconciler.session.circuit_open", candidate.tp.TemplateName, candidate.name(), "circuit_open", "skipped", traceRecordPayload{
+									"identity": identity,
+								}, nil, "")
+							}
+							continue
+						}
+						state, err := recordSessionCircuitBreakerRestart(store, candidate.session, cb, identity, cbNow)
+						if err != nil {
+							if release != nil {
+								release()
+							}
+							if done != nil {
+								done()
+							}
+							fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
+							logLifecycleOutcome(stderr, "start", wave, candidate.name(), candidate.logicalTemplate(cfg), "circuit_metadata_failed", time.Time{}, time.Time{}, err)
+							continue
+						}
+						if state == circuitOpen {
+							if release != nil {
+								release()
+							}
+							if done != nil {
+								done()
+							}
+							cb.LogOpenOnce(identity, stderr)
+							if trace != nil {
+								trace.recordDecision("reconciler.session.circuit_trip", candidate.tp.TemplateName, candidate.name(), "circuit_trip", "skipped", traceRecordPayload{
+									"identity": identity,
+								}, nil, "")
+							}
+							continue
+						}
+					}
+				}
+				item, err := prepareStartCandidateForCity(candidate, cityPath, cityName, cfg, sp, store, clk, stderr)
 				if err != nil {
+					clearPendingStartInFlightLease(candidate.session, store, stderr)
+					if release != nil {
+						release()
+					}
+					if done != nil {
+						done()
+					}
 					fmt.Fprintf(stderr, "session reconciler: pre-wake %s: %s\n", candidate.name(), formatLifecycleError(err)) //nolint:errcheck
 					logLifecycleOutcome(stderr, "start", wave, candidate.name(), candidate.logicalTemplate(cfg), "failed", time.Time{}, time.Time{}, err)
 					continue
 				}
-				prepared = append(prepared, *item)
+				if startOpts.async {
+					asyncPrepared = append(asyncPrepared, asyncPreparedStart{item: *item, release: release, done: done})
+				} else {
+					prepared = append(prepared, *item)
+				}
 			}
 			offset = end
-			results := executePreparedStartWave(ctx, prepared, sp, store, cfg, startupTimeout, defaultMaxParallelStartsPerWave)
+			var results []startResult
+			if ctx != nil && ctx.Err() != nil {
+				return wakeCount
+			}
+			if startOpts.async {
+				results = enqueuePreparedStartWaveForCity(ctx, asyncPrepared, cityPath, sp, store, cfg, clk, rec, startupTimeout, wave, stdout, stderr, trace, startOpts.asyncFollowUp)
+				if len(results) > 0 && asyncStartBatchNeedsFollowUp(batchCandidates, cfg) {
+					asyncFollowUpRequired = true
+				}
+			} else {
+				results = executePreparedStartWaveForCity(ctx, prepared, cityPath, sp, store, cfg, startupTimeout, batchSize)
+			}
 			for _, result := range results {
 				if trace != nil {
 					trace.recordOperation("reconciler.start.execute", result.prepared.candidate.tp.TemplateName, result.prepared.candidate.name(), "", "start", result.outcome, traceRecordPayload{
@@ -958,6 +1736,11 @@ func executePlannedStartsTraced(
 						"duration_ms":      result.finished.Sub(result.started).Milliseconds(),
 					}, "")
 				}
+				if result.outcome == "start_enqueued" {
+					logLifecycleOutcome(stderr, "start", wave, result.prepared.candidate.name(), result.prepared.candidate.logicalTemplate(cfg), result.outcome, result.started, result.finished, nil)
+					wakeCount++
+					continue
+				}
 				if result.err == nil && result.outcome != "session_initializing" {
 					clearReconcilerDrainAckMetadata(sp, result.prepared.candidate.name())
 				}
@@ -965,8 +1748,16 @@ func executePlannedStartsTraced(
 					wakeCount++
 				}
 			}
+			if startOpts.async && asyncFollowUpRequired {
+				break
+			}
 		}
 		logLifecycleWave(stderr, "start", wave, waveStarted, len(waveCandidates))
+		if startOpts.async && asyncFollowUpRequired {
+			// Dependency-sensitive async batches yield after enqueueing so the
+			// next batch observes committed dependency and pending-create state.
+			return wakeCount
+		}
 	}
 	return wakeCount
 }
@@ -1231,9 +2022,37 @@ func stopTargetThroughWorkerBoundary(target stopTarget, store beads.Store, sp ru
 	if targetID == "" {
 		targetID = strings.TrimSpace(target.name)
 	}
+	if cityStopSessionMarked(store, target.sessionID) {
+		if err := workerKillSessionTargetWithConfig("", store, sp, cfg, targetID); err != nil {
+			return err
+		}
+		markCityStopSessionAsAsleep(store, target.sessionID, nil)
+		return nil
+	}
 	return workerStopSessionTargetWithConfig("", store, sp, cfg, targetID)
 }
 
+func cityStopSessionMarked(store beads.Store, sessionID string) bool {
+	if store == nil || strings.TrimSpace(sessionID) == "" {
+		return false
+	}
+	b, err := store.Get(sessionID)
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(b.Metadata["sleep_reason"]) == sleepReasonCityStop
+}
+
+func markCityStopSessionAsAsleep(store beads.Store, sessionID string, stderr io.Writer) {
+	if store == nil || strings.TrimSpace(sessionID) == "" {
+		return
+	}
+	batch := sessionpkg.SleepPatch(time.Now().UTC(), sleepReasonCityStop)
+	if err := store.SetMetadataBatch(sessionID, batch); err != nil && stderr != nil {
+		fmt.Fprintf(stderr, "gc stop: marking session %s asleep: %v\n", sessionID, err) //nolint:errcheck
+	}
+}
+
 func interruptTargetsBounded(targets []stopTarget, cfg *config.City, store beads.Store, sp runtime.Provider, stderr io.Writer) int {
 	targets = hydrateStopTargets(targets, cfg, store, stderr)
 	// Pool-managed sessions have no human user, so Claude Code's
diff --git a/cmd/gc/session_lifecycle_parallel_phase2_test.go b/cmd/gc/session_lifecycle_parallel_phase2_test.go
index 40f9ac8d48..91b6a7a617 100644
--- a/cmd/gc/session_lifecycle_parallel_phase2_test.go
+++ b/cmd/gc/session_lifecycle_parallel_phase2_test.go
@@ -133,16 +133,20 @@ func preparePhase2Start(t *testing.T, tc phase2ProviderCase, startedConfigHash s
 	}
 
 	store := beads.NewMemStore()
+	metadata := map[string]string{
+		"session_name":        "phase2-" + tc.family,
+		"template":            "worker",
+		"template_overrides":  string(rawOverrides),
+		"started_config_hash": startedConfigHash,
+	}
+	if startedConfigHash != "" {
+		metadata["session_key"] = "phase2-resume-key"
+	}
 	session, err := store.Create(beads.Bead{
-		Title:  "phase2-" + tc.family,
-		Type:   sessionBeadType,
-		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name":        "phase2-" + tc.family,
-			"template":            "worker",
-			"template_overrides":  string(rawOverrides),
-			"started_config_hash": startedConfigHash,
-		},
+		Title:    "phase2-" + tc.family,
+		Type:     sessionBeadType,
+		Labels:   []string{sessionBeadLabel},
+		Metadata: metadata,
 	})
 	if err != nil {
 		t.Fatalf("Create session bead: %v", err)
diff --git a/cmd/gc/session_lifecycle_parallel_test.go b/cmd/gc/session_lifecycle_parallel_test.go
index 1c8eedeeb0..7b5c98d980 100644
--- a/cmd/gc/session_lifecycle_parallel_test.go
+++ b/cmd/gc/session_lifecycle_parallel_test.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"reflect"
 	"strconv"
 	"strings"
@@ -50,6 +51,64 @@ func (s *failNthMetadataBatchStore) SetMetadataBatch(id string, kvs map[string]s
 	return s.MemStore.SetMetadataBatch(id, kvs)
 }
 
+type failSetMetadataStore struct {
+	*beads.MemStore
+	failKey string
+}
+
+func (s *failSetMetadataStore) SetMetadata(id, key, value string) error {
+	if key == s.failKey {
+		return fmt.Errorf("set metadata %s failed", key)
+	}
+	return s.MemStore.SetMetadata(id, key, value)
+}
+
+type panicMetadataBatchStore struct {
+	*beads.MemStore
+}
+
+func (s *panicMetadataBatchStore) SetMetadataBatch(string, map[string]string) error {
+	panic("metadata batch panic")
+}
+
+type getErrorStore struct {
+	*beads.MemStore
+}
+
+func (s *getErrorStore) Get(string) (beads.Bead, error) {
+	return beads.Bead{}, fmt.Errorf("get failed")
+}
+
+type closedMetadataMatchStore struct {
+	*beads.MemStore
+	matches []beads.Bead
+}
+
+func (s *closedMetadataMatchStore) ListByMetadata(filters map[string]string, _ int, _ ...beads.QueryOpt) ([]beads.Bead, error) {
+	var out []beads.Bead
+	for _, match := range s.matches {
+		ok := true
+		for key, value := range filters {
+			if match.Metadata[key] != value {
+				ok = false
+				break
+			}
+		}
+		if ok {
+			out = append(out, match)
+		}
+	}
+	return out, nil
+}
+
+type listMetadataErrorStore struct {
+	*beads.MemStore
+}
+
+func (s *listMetadataErrorStore) ListByMetadata(map[string]string, int, ...beads.QueryOpt) ([]beads.Bead, error) {
+	return nil, errors.New("list failed")
+}
+
 type gatedStartProvider struct {
 	*runtime.Fake
 	mu            sync.Mutex
@@ -137,6 +196,24 @@ func (p *gatedStartProvider) ensureNoFurtherStart(t *testing.T, wait time.Durati
 	}
 }
 
+type shutdownWaitProvider struct {
+	*gatedStartProvider
+	listCalled chan struct{}
+	listOnce   sync.Once
+}
+
+func newShutdownWaitProvider() *shutdownWaitProvider {
+	return &shutdownWaitProvider{
+		gatedStartProvider: newGatedStartProvider(),
+		listCalled:         make(chan struct{}),
+	}
+}
+
+func (p *shutdownWaitProvider) ListRunning(prefix string) ([]string, error) {
+	p.listOnce.Do(func() { close(p.listCalled) })
+	return p.Fake.ListRunning(prefix)
+}
+
 func creatingMeta(meta map[string]string) map[string]string {
 	cp := make(map[string]string, len(meta)+1)
 	for key, value := range meta {
@@ -318,6 +395,77 @@ func (p *staleIsRunningAfterInterruptProvider) IsRunning(name string) bool {
 	return p.Fake.IsRunning(name)
 }
 
+type exitedArtifactAfterInterruptProvider struct {
+	*runtime.Fake
+	mu                     sync.Mutex
+	exited                 map[string]bool
+	stopCalls              map[string]int
+	keepRunningOnInterrupt map[string]bool
+	listExited             bool
+	listErr                error
+}
+
+func newExitedArtifactAfterInterruptProvider() *exitedArtifactAfterInterruptProvider {
+	return &exitedArtifactAfterInterruptProvider{
+		Fake:                   runtime.NewFake(),
+		exited:                 make(map[string]bool),
+		stopCalls:              make(map[string]int),
+		keepRunningOnInterrupt: make(map[string]bool),
+	}
+}
+
+func (p *exitedArtifactAfterInterruptProvider) markExited(name string) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.exited[name] = true
+}
+
+func (p *exitedArtifactAfterInterruptProvider) Interrupt(name string) error {
+	if err := p.Fake.Interrupt(name); err != nil {
+		return err
+	}
+	p.mu.Lock()
+	keepRunning := p.keepRunningOnInterrupt[name]
+	p.mu.Unlock()
+	if keepRunning {
+		return nil
+	}
+	p.markExited(name)
+	return nil
+}
+
+func (p *exitedArtifactAfterInterruptProvider) IsRunning(name string) bool {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.exited[name] {
+		return false
+	}
+	return p.Fake.IsRunning(name)
+}
+
+func (p *exitedArtifactAfterInterruptProvider) ListRunning(prefix string) ([]string, error) {
+	names, err := p.Fake.ListRunning(prefix)
+	if err != nil {
+		return nil, err
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	filtered := names[:0]
+	for _, name := range names {
+		if p.listExited || !p.exited[name] {
+			filtered = append(filtered, name)
+		}
+	}
+	return filtered, p.listErr
+}
+
+func (p *exitedArtifactAfterInterruptProvider) Stop(name string) error {
+	p.mu.Lock()
+	p.stopCalls[name]++
+	p.mu.Unlock()
+	return p.Fake.Stop(name)
+}
+
 type dropDependencyAfterNStartsProvider struct {
 	*runtime.Fake
 	mu        sync.Mutex
@@ -340,6 +488,24 @@ func (p *dropDependencyAfterNStartsProvider) Start(ctx context.Context, name str
 	return nil
 }
 
+func (p *dropDependencyAfterNStartsProvider) waitForStarts(t *testing.T, want int) {
+	t.Helper()
+	deadline := time.After(3 * time.Second)
+	for {
+		p.mu.Lock()
+		got := p.starts
+		p.mu.Unlock()
+		if got >= want {
+			return
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("timed out waiting for %d starts, got %d", want, got)
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
+
 type panicStartProvider struct {
 	*runtime.Fake
 }
@@ -708,6 +874,100 @@ func TestPrepareStartCandidate_GeneratesMissingSessionKeyBeforeWake(t *testing.T
 	}
 }
 
+func TestPrepareStartCandidate_ResumeCapableWithoutSessionKeyKeepsStartupPrompt(t *testing.T) {
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title:  "codex-worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:codex-worker"},
+		Metadata: map[string]string{
+			"template":            "codex-worker",
+			"session_name":        "codex-worker",
+			"started_config_hash": "previous-start",
+			"session_key":         "",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	prepared, err := prepareStartCandidate(startCandidate{
+		session: &session,
+		tp: TemplateParams{
+			TemplateName: "codex-worker",
+			SessionName:  "codex-worker",
+			Command:      "aimux run codex -- --dangerously-bypass-approvals-and-sandbox",
+			Prompt:       "You are a routed workflow lane. Run gc hook first.",
+			ResolvedProvider: &config.ResolvedProvider{
+				Name:          "codex",
+				PromptMode:    "arg",
+				ResumeFlag:    "resume",
+				ResumeStyle:   "subcommand",
+				ResumeCommand: "aimux run codex -- resume {{.SessionKey}}",
+			},
+		},
+		order: 0,
+	}, &config.City{}, store, &clock.Fake{Time: time.Date(2026, 5, 5, 4, 20, 0, 0, time.UTC)})
+	if err != nil {
+		t.Fatalf("prepareStartCandidate: %v", err)
+	}
+
+	if prepared.cfg.PromptSuffix == "" {
+		t.Fatal("PromptSuffix should be retained when there is no session_key to resume")
+	}
+	parts := shellquote.Split(prepared.cfg.PromptSuffix)
+	if len(parts) != 1 {
+		t.Fatalf("PromptSuffix parsed parts = %#v, want single prompt payload", parts)
+	}
+	if !strings.Contains(parts[0], "Run gc hook first") {
+		t.Fatalf("prompt payload = %q, want startup workflow prompt", parts[0])
+	}
+	if strings.Contains(prepared.cfg.Command, "resume") {
+		t.Fatalf("prepared.cfg.Command = %q, should not use resume without a session_key", prepared.cfg.Command)
+	}
+}
+
+func TestPrepareStartCandidate_DoesNotAppendCLIResumeFlagForACP(t *testing.T) {
+	store := beads.NewMemStore()
+	session, err := store.Create(beads.Bead{
+		Title:  "mayor",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "agent:mayor"},
+		Metadata: map[string]string{
+			"template":            "mayor",
+			"session_name":        "mayor",
+			"session_key":         "opencode-provider-session",
+			"started_config_hash": "previous-start",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	prepared, err := prepareStartCandidate(startCandidate{
+		session: &session,
+		tp: TemplateParams{
+			TemplateName: "mayor",
+			SessionName:  "mayor",
+			Command:      "opencode acp",
+			IsACP:        true,
+			ResolvedProvider: &config.ResolvedProvider{
+				Name:        "opencode",
+				ResumeFlag:  "--session",
+				ResumeStyle: "flag",
+			},
+		},
+		order: 0,
+	}, &config.City{}, store, &clock.Fake{Time: time.Date(2026, 5, 3, 10, 0, 0, 0, time.UTC)})
+	if err != nil {
+		t.Fatalf("prepareStartCandidate: %v", err)
+	}
+
+	if prepared.cfg.Command != "opencode acp" {
+		t.Fatalf("prepared.cfg.Command = %q, want ACP command without CLI resume flag", prepared.cfg.Command)
+	}
+}
+
 func TestReconcileSessionBeads_BlockedCandidatesDoNotConsumeWakeBudget(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
@@ -871,15 +1131,18 @@ func TestPrepareStartCandidate_NoneModeInitialMessageStaysInNudge(t *testing.T)
 }
 
 func TestExecutePlannedStarts_RevalidatesDependenciesBetweenWaveBatches(t *testing.T) {
+	maxWakes := 8
+	dropAfter := 3
 	sp := &dropDependencyAfterNStartsProvider{
 		Fake:      runtime.NewFake(),
-		dropAfter: defaultMaxParallelStartsPerWave,
+		dropAfter: dropAfter,
 		depName:   "db",
 	}
 	if err := sp.Start(context.Background(), "db", runtime.Config{}); err != nil {
 		t.Fatal(err)
 	}
 	cfg := &config.City{
+		Daemon: config.DaemonConfig{MaxWakesPerTick: &maxWakes},
 		Agents: []config.Agent{
 			{Name: "app-1", DependsOn: []string{"db"}},
 			{Name: "app-2", DependsOn: []string{"db"}},
@@ -914,14 +1177,15 @@ func TestExecutePlannedStarts_RevalidatesDependenciesBetweenWaveBatches(t *testi
 	}
 
 	poolDesired := map[string]int{"app-1": 1, "app-2": 1, "app-3": 1, "app-4": 1}
+	var stderr bytes.Buffer
 	woken := reconcileSessionBeads(
 		context.Background(), sessions, desired, configuredSessionNames(cfg, "", store),
 		cfg, sp, store, nil, nil, nil, newDrainTracker(), poolDesired, false, nil, "",
-		nil, clk, events.Discard, 5*time.Second, 0, ioDiscard{}, ioDiscard{},
+		nil, clk, events.Discard, 5*time.Second, 0, ioDiscard{}, &stderr,
 	)
 
-	if woken != defaultMaxParallelStartsPerWave {
-		t.Fatalf("woken = %d, want %d", woken, defaultMaxParallelStartsPerWave)
+	if woken != dropAfter {
+		t.Fatalf("woken = %d, want %d", woken, dropAfter)
 	}
 	for _, name := range []string{"app-1", "app-2", "app-3"} {
 		if !sp.IsRunning(name) {
@@ -931,65 +1195,2277 @@ func TestExecutePlannedStarts_RevalidatesDependenciesBetweenWaveBatches(t *testi
 	if sp.IsRunning("app-4") {
 		t.Fatal("app-4 should be blocked after db dies between wave batches")
 	}
+	gotLog := stderr.String()
+	if !strings.Contains(gotLog, "session=app-4") || !strings.Contains(gotLog, "outcome=blocked_on_dependencies") {
+		t.Fatalf("app-4 log = %q, want blocked_on_dependencies", gotLog)
+	}
+	if strings.Contains(gotLog, "session=app-4 template=app-4 outcome=deferred_by_wake_budget") {
+		t.Fatalf("app-4 was deferred by wake budget instead of dependency recheck: %q", gotLog)
+	}
 }
 
-// When the atomic start batch fails, NO state change lands: state stays
-// "creating", pending_create_claim stays "true", and the post-create marker
-// is absent. The reconciler's next tick retries via recoverRunningPendingCreate.
-// This is the intentional consequence of folding the claim clear into the
-// same SetMetadataBatch as the state/state_reason/creation_complete_at
-// transition so the sweep never observes a transient state without either
-// the claim or the marker.
-func TestCommitStartResult_AtomicBatchFailureLeavesClaimIntact(t *testing.T) {
-	store := &failingMetadataBatchStore{MemStore: beads.NewMemStore(), failBatch: true}
-	bead, err := store.Create(beads.Bead{
-		Title:  "helper",
+func TestExecutePlannedStartsTraced_AsyncRevalidatesDependenciesBetweenBatches(t *testing.T) {
+	maxWakes := 8
+	dropAfter := 3
+	sp := &dropDependencyAfterNStartsProvider{
+		Fake:      runtime.NewFake(),
+		dropAfter: dropAfter,
+		depName:   "db",
+	}
+	if err := sp.Start(context.Background(), "db", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Daemon: config.DaemonConfig{MaxWakesPerTick: &maxWakes},
+		Agents: []config.Agent{
+			{Name: "app-1", DependsOn: []string{"db"}},
+			{Name: "app-2", DependsOn: []string{"db"}},
+			{Name: "app-3", DependsOn: []string{"db"}},
+			{Name: "app-4", DependsOn: []string{"db"}},
+			{Name: "db", MaxActiveSessions: intPtr(1)},
+		},
+	}
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 18, 12, 0, 0, 0, time.UTC)}
+	desired := map[string]TemplateParams{}
+	candidates := make([]startCandidate, 0, 4)
+	for _, name := range []string{"app-1", "app-2", "app-3", "app-4"} {
+		tp := TemplateParams{Command: name, SessionName: name, TemplateName: name}
+		desired[name] = tp
+		created, err := store.Create(beads.Bead{
+			ID:     name + "-id",
+			Title:  name,
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: creatingMeta(map[string]string{
+				"session_name":         name,
+				"template":             name,
+				"generation":           "1",
+				"continuation_epoch":   "1",
+				"instance_token":       "tok-" + name,
+				"pending_create_claim": "true",
+			}),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		candidate := created
+		candidates = append(candidates, startCandidate{session: &candidate, tp: tp})
+	}
+
+	woken := executePlannedStartsTraced(
+		context.Background(),
+		candidates,
+		cfg,
+		desired,
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		5*time.Second,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+	)
+	if woken != defaultStartDependencyRecheckBatchSize {
+		t.Fatalf("first async woken = %d, want dependency-recheck batch size %d", woken, defaultStartDependencyRecheckBatchSize)
+	}
+	sp.waitForStarts(t, 1+defaultStartDependencyRecheckBatchSize)
+	for _, name := range []string{"app-1", "app-2", "app-3"} {
+		if !sp.IsRunning(name) {
+			t.Fatalf("%s should have started before dependency loss was observed", name)
+		}
+	}
+	if sp.IsRunning("db") {
+		t.Fatal("db should have stopped after the dependency provider drop point")
+	}
+	if sp.IsRunning("app-4") {
+		t.Fatal("app-4 should not be enqueued in the async batch after db dies")
+	}
+
+	var secondStderr bytes.Buffer
+	woken = executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{candidates[3]},
+		cfg,
+		desired,
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		5*time.Second,
+		ioDiscard{},
+		&secondStderr,
+		nil,
+		withAsyncStartExecution(),
+	)
+	if woken != 0 {
+		t.Fatalf("second async woken = %d, want 0 after dependency loss", woken)
+	}
+	if sp.IsRunning("app-4") {
+		t.Fatal("app-4 should remain blocked after dependency loss")
+	}
+	gotLog := secondStderr.String()
+	if !strings.Contains(gotLog, "session=app-4") || !strings.Contains(gotLog, "outcome=blocked_on_dependencies") {
+		t.Fatalf("app-4 log = %q, want blocked_on_dependencies", gotLog)
+	}
+}
+
+func TestExecutePlannedStartsTraced_AsyncReturnsBeforeProviderStartCompletes(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 0, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
 		Type:   sessionBeadType,
 		Labels: []string{sessionBeadLabel},
-		Metadata: map[string]string{
-			"session_name":          "sky",
-			"session_name_explicit": "true",
-			"pending_create_claim":  "true",
-			"state":                 "creating",
-		},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
-	result := startResult{
-		prepared: preparedStart{
-			candidate: startCandidate{
-				session: &bead,
-				tp: TemplateParams{
-					SessionName:  "sky",
-					TemplateName: "helper",
-				},
-			},
-			coreHash: "core",
-			liveHash: "live",
-		},
-		outcome:  "success",
-		started:  time.Date(2026, 3, 18, 12, 0, 0, 0, time.UTC),
+	sp := newGatedStartProvider()
+	t.Cleanup(func() { sp.release("worker") })
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker"}},
+	}
+	tp := TemplateParams{
+		Command:      "worker",
+		SessionName:  "worker",
+		TemplateName: "worker",
+	}
+	desired := map[string]TemplateParams{"worker": tp}
+
+	done := make(chan int, 1)
+	go func() {
+		done <- executePlannedStartsTraced(
+			context.Background(),
+			[]startCandidate{{session: &session, tp: tp}},
+			cfg,
+			desired,
+			sp,
+			store,
+			"test-city",
+			"",
+			clk,
+			events.Discard,
+			time.Minute,
+			ioDiscard{},
+			ioDiscard{},
+			nil,
+			withAsyncStartExecution(),
+		)
+	}()
+
+	select {
+	case woken := <-done:
+		if woken != 1 {
+			t.Fatalf("woken = %d, want 1", woken)
+		}
+	case <-time.After(250 * time.Millisecond):
+		t.Fatal("async planned start blocked waiting for provider Start to finish")
+	}
+	sp.waitForStarts(t, 1)
+
+	inFlight, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if inFlight.Metadata["pending_create_claim"] != "true" {
+		t.Fatalf("pending_create_claim = %q, want true until async start commits", inFlight.Metadata["pending_create_claim"])
+	}
+	if inFlight.Metadata["last_woke_at"] == "" {
+		t.Fatal("last_woke_at was not stamped before async start")
+	}
+
+	sp.release("worker")
+	deadline := time.After(2 * time.Second)
+	for {
+		updated, err := store.Get(session.ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if updated.Metadata["state"] == "active" && updated.Metadata["pending_create_claim"] == "" {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("async start did not commit active state; metadata=%v", updated.Metadata)
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
+
+func TestExecutePlannedStartsTraced_AsyncLimitsEnqueuedStartsPerTick(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 0, 0, time.UTC)}
+	sp := newGatedStartProvider()
+	maxWakes := 4
+	cfg := &config.City{Daemon: config.DaemonConfig{MaxWakesPerTick: &maxWakes}}
+	desired := map[string]TemplateParams{}
+	var candidates []startCandidate
+	for _, name := range []string{"worker-1", "worker-2", "worker-3", "worker-4", "worker-5"} {
+		session, err := store.Create(beads.Bead{
+			ID:     "gc-" + name,
+			Title:  name,
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: creatingMeta(map[string]string{
+				"session_name":         name,
+				"template":             name,
+				"generation":           "1",
+				"continuation_epoch":   "1",
+				"instance_token":       "tok-" + name,
+				"pending_create_claim": "true",
+			}),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { sp.release(name) })
+		cfg.Agents = append(cfg.Agents, config.Agent{Name: name})
+		tp := TemplateParams{Command: name, SessionName: name, TemplateName: name}
+		desired[name] = tp
+		candidates = append(candidates, startCandidate{session: &session, tp: tp})
+	}
+
+	woken := executePlannedStartsTraced(
+		context.Background(),
+		candidates,
+		cfg,
+		desired,
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+	)
+	wantWoken := maxWakes
+	if woken != wantWoken {
+		t.Fatalf("woken = %d, want configured wake budget %d", woken, wantWoken)
+	}
+	sp.waitForStarts(t, wantWoken)
+	sp.ensureNoFurtherStart(t, 100*time.Millisecond)
+	if sp.maxInFlight > wantWoken {
+		t.Fatalf("max in-flight starts = %d, want <= %d", sp.maxInFlight, wantWoken)
+	}
+}
+
+func TestExecutePlannedStartsTraced_AsyncLimiterSharedAcrossTicks(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 15, 0, time.UTC)}
+	sp := newGatedStartProvider()
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker-1"}, {Name: "worker-2"}},
+	}
+	desired := map[string]TemplateParams{}
+	makeCandidate := func(name string) startCandidate {
+		session, err := store.Create(beads.Bead{
+			ID:     "gc-" + name,
+			Title:  name,
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: creatingMeta(map[string]string{
+				"session_name":         name,
+				"template":             name,
+				"generation":           "1",
+				"continuation_epoch":   "1",
+				"instance_token":       "tok-" + name,
+				"pending_create_claim": "true",
+			}),
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { sp.release(name) })
+		tp := TemplateParams{Command: name, SessionName: name, TemplateName: name}
+		desired[name] = tp
+		return startCandidate{session: &session, tp: tp}
+	}
+	limiter := newAsyncStartLimiter(1)
+	first := makeCandidate("worker-1")
+	second := makeCandidate("worker-2")
+
+	if got := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{first},
+		cfg,
+		desired,
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartLimiter(limiter),
+	); got != 1 {
+		t.Fatalf("first woken = %d, want 1", got)
+	}
+	sp.waitForStarts(t, 1)
+	if got := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{second},
+		cfg,
+		desired,
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartLimiter(limiter),
+	); got != 0 {
+		t.Fatalf("second woken = %d, want 0 while shared limiter is full", got)
+	}
+	sp.ensureNoFurtherStart(t, 100*time.Millisecond)
+	deferred, err := store.Get(second.session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := deferred.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("deferred last_woke_at = %q, want empty until limiter slot is reserved", got)
+	}
+	sp.release("worker-1")
+	deadline := time.After(2 * time.Second)
+	for {
+		updated, err := store.Get(first.session.ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if updated.Metadata["state"] == "active" {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatalf("first async start did not commit active state; metadata=%v", updated.Metadata)
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	if got := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{second},
+		cfg,
+		desired,
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartLimiter(limiter),
+	); got != 1 {
+		t.Fatalf("second woken after release = %d, want 1", got)
+	}
+	started := sp.waitForStarts(t, 1)
+	if len(started) != 1 || started[0] != "worker-2" {
+		t.Fatalf("second start = %v, want [worker-2]", started)
+	}
+}
+
+func TestExecutePlannedStartsTraced_AsyncLimiterDeferredStartDoesNotRunAfterCancel(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 20, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := newGatedStartProvider()
+	t.Cleanup(func() { sp.release("worker") })
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+	limiter := newAsyncStartLimiter(1)
+	releaseLimiter, reserved, outcome := reserveAsyncStartSlot(context.Background(), limiter)
+	if !reserved {
+		t.Fatalf("reserve limiter = %s, want success", outcome)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+
+	if got := executePlannedStartsTraced(
+		ctx,
+		[]startCandidate{{session: &session, tp: tp}},
+		cfg,
+		map[string]TemplateParams{"worker": tp},
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartLimiter(limiter),
+	); got != 0 {
+		t.Fatalf("woken = %d, want 0 while async limiter is full", got)
+	}
+	cancel()
+	releaseLimiter()
+	sp.ensureNoFurtherStart(t, 100*time.Millisecond)
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want empty because no async start was queued", got)
+	}
+}
+
+func TestAsyncStartLimiterNilReceiverMethodsAreNoops(t *testing.T) {
+	var limiter *asyncStartLimiter
+	limiter.resize(5)
+	if got := limiter.capacity(); got != 0 {
+		t.Fatalf("nil limiter capacity = %d, want 0", got)
+	}
+	release, reserved, outcome := reserveAsyncStartSlot(context.Background(), limiter)
+	if !reserved || outcome != "" {
+		t.Fatalf("nil limiter reserve = reserved %v outcome %q, want success", reserved, outcome)
+	}
+	release()
+}
+
+func TestExecutePlannedStartsTracedCanceledContextDoesNotStart(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 5, 5, 12, 0, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":       "worker",
+			"template":           "worker",
+			"state":              "asleep",
+			"sleep_reason":       "idle",
+			"wake_mode":          "fresh",
+			"generation":         "1",
+			"continuation_epoch": "1",
+			"instance_token":     "tok-worker",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	sp := runtime.NewFake()
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	woken := executePlannedStartsTraced(
+		ctx,
+		[]startCandidate{{session: &session, tp: tp}},
+		cfg,
+		map[string]TemplateParams{"worker": tp},
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		5*time.Second,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartTracker(&asyncStartTracker{}),
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 after cancellation", woken)
+	}
+	for _, call := range sp.Calls {
+		if call.Method == "Start" {
+			t.Fatalf("unexpected Start after cancellation: calls=%+v", sp.Calls)
+		}
+	}
+}
+
+func TestReconcileSessionBeadsTracedCanceledContextDoesNotTouchProvider(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 5, 5, 12, 1, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":        "worker",
+			"template":            "worker",
+			"state":               "active",
+			"started_config_hash": "hash",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	sp := runtime.NewFake()
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	woken := reconcileSessionBeadsTraced(
+		ctx,
+		"",
+		[]beads.Bead{session},
+		map[string]TemplateParams{"worker": tp},
+		map[string]bool{"worker": true},
+		cfg,
+		sp,
+		store,
+		nil,
+		nil,
+		nil,
+		nil,
+		newDrainTracker(),
+		map[string]int{"worker": 1},
+		false,
+		nil,
+		"test-city",
+		nil,
+		clk,
+		events.Discard,
+		5*time.Second,
+		time.Second,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 after cancellation", woken)
+	}
+	if len(sp.Calls) != 0 {
+		t.Fatalf("provider calls after cancellation: %+v", sp.Calls)
+	}
+}
+
+func TestCityRuntimeShutdownWaitsForTrackedAsyncStartsBeforeStopSnapshot(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 25, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := newShutdownWaitProvider()
+	t.Cleanup(func() { sp.release("worker") })
+	cfg := &config.City{
+		Daemon: config.DaemonConfig{ShutdownTimeout: "500ms"},
+		Agents: []config.Agent{{Name: "worker"}},
+	}
+	cr := &CityRuntime{
+		cfg:                 cfg,
+		sp:                  sp,
+		rec:                 events.Discard,
+		standaloneCityStore: store,
+		asyncStartLimiter:   newAsyncStartLimiter(maxParallelStartsPerTick(cfg)),
+		logPrefix:           "gc test",
+		stdout:              ioDiscard{},
+		stderr:              ioDiscard{},
+	}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+	if got := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{{session: &session, tp: tp}},
+		cfg,
+		map[string]TemplateParams{"worker": tp},
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartLimiter(cr.ensureAsyncStartLimiter()),
+		withAsyncStartTracker(&cr.asyncStarts),
+	); got != 1 {
+		t.Fatalf("woken = %d, want 1", got)
+	}
+	sp.waitForStarts(t, 1)
+
+	shutdownDone := make(chan struct{})
+	go func() {
+		cr.shutdown()
+		close(shutdownDone)
+	}()
+	select {
+	case <-sp.listCalled:
+		t.Fatal("shutdown listed running sessions before the async start completed")
+	case <-shutdownDone:
+		t.Fatal("shutdown returned before the async start completed")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	sp.release("worker")
+	select {
+	case <-shutdownDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("shutdown did not finish after the async start completed")
+	}
+	select {
+	case <-sp.listCalled:
+	default:
+		t.Fatal("shutdown did not list running sessions after waiting for async starts")
+	}
+	if sp.IsRunning("worker") {
+		t.Fatal("shutdown should stop the runtime that the async start created")
+	}
+}
+
+func TestExecutePlannedStartsTraced_AsyncPrepareFailureClearsPreWakeLease(t *testing.T) {
+	store := &failSetMetadataStore{MemStore: beads.NewMemStore(), failKey: "session_key"}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 27, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := newGatedStartProvider()
+	t.Cleanup(func() { sp.release("worker") })
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	tp := TemplateParams{
+		Command:          "worker",
+		SessionName:      "worker",
+		TemplateName:     "worker",
+		ResolvedProvider: &config.ResolvedProvider{SessionIDFlag: "--session-id"},
+	}
+	if got := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{{session: &session, tp: tp}},
+		cfg,
+		map[string]TemplateParams{"worker": tp},
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+	); got != 0 {
+		t.Fatalf("woken = %d, want 0 when async preparation fails after preWake", got)
+	}
+	sp.ensureNoFurtherStart(t, 100*time.Millisecond)
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared after async preparation failure", got)
+	}
+}
+
+func TestExecutePlannedStartsTraced_CircuitTripDoesNotCommitPreWakeMetadata(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 28, 0, time.UTC)}
+	const identity = "test-city/worker"
+	originalLastWokeAt := clk.Now().Add(-time.Hour).UTC().Format(time.RFC3339)
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":               "worker",
+			"template":                   "worker",
+			"generation":                 "7",
+			"continuation_epoch":         "3",
+			"continuation_reset_pending": "true",
+			"instance_token":             "tok-worker",
+			"last_woke_at":               originalLastWokeAt,
+			"pending_create_claim":       "true",
+			"wake_mode":                  "fresh",
+			"session_key":                "fresh-key-123",
+			"started_config_hash":        "started-config-before-reset",
+			"started_live_hash":          "started-live-before-reset",
+			"live_hash":                  "live-before-reset",
+			"startup_dialog_verified":    "true",
+			namedSessionIdentityMetadata: identity,
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	cb := newSessionCircuitBreaker(sessionCircuitBreakerConfig{
+		Window:      10 * time.Minute,
+		MaxRestarts: 1,
+		ResetAfter:  20 * time.Minute,
+	})
+	defer setSessionCircuitBreakerForTest(cb)()
+	cb.RecordRestart(identity, clk.Now().Add(-time.Minute))
+	sp := newGatedStartProvider()
+	t.Cleanup(func() { sp.release("worker") })
+	maxRestarts := 1
+	cfg := &config.City{
+		Daemon: config.DaemonConfig{
+			SessionCircuitBreaker:            true,
+			SessionCircuitBreakerMaxRestarts: &maxRestarts,
+			SessionCircuitBreakerWindow:      "10m",
+			SessionCircuitBreakerResetAfter:  "20m",
+		},
+		Agents: []config.Agent{{Name: "worker"}},
+	}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+
+	if got := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{{session: &session, tp: tp}},
+		cfg,
+		map[string]TemplateParams{"worker": tp},
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+	); got != 0 {
+		t.Fatalf("woken = %d, want 0 when circuit trip suppresses start", got)
+	}
+	sp.ensureNoFurtherStart(t, 100*time.Millisecond)
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["generation"]; got != "7" {
+		t.Fatalf("generation = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["instance_token"]; got != "tok-worker" {
+		t.Fatalf("instance_token = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["continuation_epoch"]; got != "3" {
+		t.Fatalf("continuation_epoch = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["continuation_reset_pending"]; got != "true" {
+		t.Fatalf("continuation_reset_pending = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["wake_mode"]; got != "fresh" {
+		t.Fatalf("wake_mode = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != originalLastWokeAt {
+		t.Fatalf("last_woke_at = %q, want unchanged %q", got, originalLastWokeAt)
+	}
+	if got := updated.Metadata["session_key"]; got != "fresh-key-123" {
+		t.Fatalf("session_key = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["started_config_hash"]; got != "started-config-before-reset" {
+		t.Fatalf("started_config_hash = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["started_live_hash"]; got != "started-live-before-reset" {
+		t.Fatalf("started_live_hash = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["live_hash"]; got != "live-before-reset" {
+		t.Fatalf("live_hash = %q, want unchanged", got)
+	}
+	if got := updated.Metadata["startup_dialog_verified"]; got != "true" {
+		t.Fatalf("startup_dialog_verified = %q, want unchanged", got)
+	}
+}
+
+func TestExecutePlannedStartsTraced_AsyncRequestsFollowUpAfterCommit(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 30, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := newGatedStartProvider()
+	t.Cleanup(func() { sp.release("worker") })
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+	followUp := make(chan struct{}, 1)
+
+	woken := executePlannedStartsTraced(
+		context.Background(),
+		[]startCandidate{{session: &session, tp: tp}},
+		cfg,
+		map[string]TemplateParams{"worker": tp},
+		sp,
+		store,
+		"test-city",
+		"",
+		clk,
+		events.Discard,
+		time.Minute,
+		ioDiscard{},
+		ioDiscard{},
+		nil,
+		withAsyncStartExecution(),
+		withAsyncStartFollowUp(func() {
+			select {
+			case followUp <- struct{}{}:
+			default:
+			}
+		}),
+	)
+	if woken != 1 {
+		t.Fatalf("woken = %d, want 1", woken)
+	}
+	sp.waitForStarts(t, 1)
+	select {
+	case <-followUp:
+		t.Fatal("follow-up requested before async provider start finished")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	sp.release("worker")
+	select {
+	case <-followUp:
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for async completion follow-up")
+	}
+}
+
+func TestAllDependenciesAliveForTemplate_TreatsPendingCreateDependencyAsNotAlive(t *testing.T) {
+	store := beads.NewMemStore()
+	now := time.Now().UTC()
+	dep, err := store.Create(beads.Bead{
+		ID:     "gc-db",
+		Title:  "db",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "db",
+			"template":             "db",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-db",
+			"pending_create_claim": "true",
+			"last_woke_at":         now.Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "db", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", DependsOn: []string{"db"}},
+			{Name: "db"},
+		},
+	}
+	desired := map[string]TemplateParams{
+		"worker": {Command: "worker", SessionName: "worker", TemplateName: "worker"},
+		"db":     {Command: "db", SessionName: "db", TemplateName: "db"},
+	}
+
+	if allDependenciesAliveForTemplate("worker", cfg, desired, sp, "test-city", store) {
+		t.Fatal("worker dependency should stay blocked while db start is still in flight")
+	}
+	if err := store.SetMetadataBatch(dep.ID, map[string]string{
+		"state":                string(sessionpkg.StateActive),
+		"pending_create_claim": "",
+		"creation_complete_at": now.Add(time.Second).Format(time.RFC3339),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if !allDependenciesAliveForTemplate("worker", cfg, desired, sp, "test-city", store) {
+		t.Fatal("worker dependency should be alive after db start is committed")
+	}
+}
+
+func TestDependencySessionStartInFlightIgnoresClosedMetadataMatches(t *testing.T) {
+	now := time.Now().UTC()
+	store := &closedMetadataMatchStore{
+		MemStore: beads.NewMemStore(),
+		matches: []beads.Bead{{
+			ID:     "gc-db-old",
+			Title:  "db",
+			Status: "closed",
+			Type:   sessionBeadType,
+			Labels: []string{sessionBeadLabel},
+			Metadata: creatingMeta(map[string]string{
+				"session_name":         "db",
+				"template":             "db",
+				"pending_create_claim": "true",
+				"last_woke_at":         now.Format(time.RFC3339),
+			}),
+		}},
+	}
+
+	if dependencySessionStartInFlight(store, "db", &config.City{}, clock.Real{}) {
+		t.Fatal("closed failed-create bead should not count as an in-flight dependency start")
+	}
+}
+
+func TestDependencySessionStartInFlightFailsClosedOnMetadataListError(t *testing.T) {
+	store := &listMetadataErrorStore{MemStore: beads.NewMemStore()}
+	if !dependencySessionStartInFlight(store, "db", &config.City{}, clock.Real{}) {
+		t.Fatal("metadata query errors should block dependent starts until the store recovers")
+	}
+}
+
+func TestPendingCreateStartInFlight_ZeroStartupTimeoutUsesRecoveryLease(t *testing.T) {
+	now := time.Date(2026, 4, 26, 12, 1, 40, 0, time.UTC)
+	recent := beads.Bead{
+		Metadata: map[string]string{
+			"pending_create_claim": "true",
+			"last_woke_at":         now.Add(-10 * time.Second).Format(time.RFC3339),
+		},
+	}
+	if !pendingCreateStartInFlight(recent, &clock.Fake{Time: now}, 0) {
+		t.Fatal("explicit zero startup timeout should still use a finite recovery lease while recent")
+	}
+	stale := beads.Bead{
+		Metadata: map[string]string{
+			"pending_create_claim": "true",
+			"last_woke_at":         now.Add(-24 * time.Hour).Format(time.RFC3339),
+		},
+	}
+	if pendingCreateStartInFlight(stale, &clock.Fake{Time: now}, 0) {
+		t.Fatal("explicit zero startup timeout should not suppress recovery forever")
+	}
+}
+
+func TestAsyncStartTrackerWaitZeroDoesNotBlock(t *testing.T) {
+	var tracker asyncStartTracker
+	done, ok := tracker.start()
+	if !ok {
+		t.Fatal("tracker should accept work before shutdown")
+	}
+	if tracker.wait(0) {
+		t.Fatal("zero-timeout wait should not report completion while async work is still running")
+	}
+	done()
+	if !tracker.wait(time.Second) {
+		t.Fatal("tracker should report completion after async work finishes")
+	}
+}
+
+func TestReconcileSessionBeads_RollsBackPendingCreateWhenRuntimeTokenMismatches(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 1, 45, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-new",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_INSTANCE_TOKEN", "tok-old"); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_RUNTIME_EPOCH", "1"); err != nil {
+		t.Fatal(err)
+	}
+	cfg := &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	tp := TemplateParams{Command: "worker", SessionName: "worker", TemplateName: "worker"}
+
+	woken := reconcileSessionBeads(
+		context.Background(),
+		[]beads.Bead{session},
+		map[string]TemplateParams{"worker": tp},
+		configuredSessionNames(cfg, "test-city", store),
+		cfg,
+		sp,
+		store,
+		nil,
+		nil,
+		nil,
+		newDrainTracker(),
+		map[string]int{"worker": 1},
+		false,
+		map[string]bool{"worker": true},
+		"test-city",
+		nil,
+		clk,
+		events.Discard,
+		time.Minute,
+		0,
+		ioDiscard{},
+		ioDiscard{},
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status != "closed" {
+		t.Fatalf("status = %q, want closed so stale runtime is not recovered", updated.Status)
+	}
+}
+
+func TestRunningSessionMatchesPendingCreateAcceptsTokenOnlyRuntime(t *testing.T) {
+	session := &beads.Bead{
+		ID: "gc-worker",
+		Metadata: map[string]string{
+			"session_name":   "worker",
+			"generation":     "2",
+			"instance_token": "tok-worker",
+		},
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_INSTANCE_TOKEN", "tok-worker"); err != nil {
+		t.Fatal(err)
+	}
+
+	if !runningSessionMatchesPendingCreate(session, "worker", sp) {
+		t.Fatal("runtime with matching token and no session id should match pending create")
+	}
+}
+
+func TestRunningSessionMatchesPendingCreateAcceptsIDOnlyRuntime(t *testing.T) {
+	session := &beads.Bead{
+		ID: "gc-worker",
+		Metadata: map[string]string{
+			"session_name": "worker",
+			"generation":   "2",
+		},
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+
+	if !runningSessionMatchesPendingCreate(session, "worker", sp) {
+		t.Fatal("runtime with matching session id and no token should match pending create")
+	}
+}
+
+func TestReconcileSessionBeads_SkipsPendingCreateStartAlreadyInFlight(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 0, 30, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := newGatedStartProvider()
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker"}},
+	}
+	tp := TemplateParams{
+		Command:      "worker",
+		SessionName:  "worker",
+		TemplateName: "worker",
+	}
+	woken := reconcileSessionBeads(
+		context.Background(),
+		[]beads.Bead{session},
+		map[string]TemplateParams{"worker": tp},
+		configuredSessionNames(cfg, "", store),
+		cfg,
+		sp,
+		store,
+		nil,
+		nil,
+		nil,
+		newDrainTracker(),
+		map[string]int{"worker": 1},
+		false,
+		map[string]bool{"worker": true},
+		"test-city",
+		nil,
+		clk,
+		events.Discard,
+		time.Minute,
+		0,
+		ioDiscard{},
+		ioDiscard{},
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 while start is already in flight", woken)
+	}
+	sp.ensureNoFurtherStart(t, 100*time.Millisecond)
+}
+
+func TestCommitAsyncStartResult_IgnoresStaleSessionSnapshot(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 2, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-old",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.SetMetadataBatch(session.ID, map[string]string{
+		"generation":     "3",
+		"instance_token": "tok-new",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if commitAsyncStartResultWithContext(context.Background(), result, nil, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("stale async start result should not commit")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["state"]; got != "creating" {
+		t.Fatalf("state = %q, want creating", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+	if got := updated.Metadata["instance_token"]; got != "tok-new" {
+		t.Fatalf("instance_token = %q, want tok-new", got)
+	}
+}
+
+func TestCommitAsyncStartResult_IgnoresClosedSessionSnapshot(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 2, 30, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.Close(session.ID); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if commitAsyncStartResultWithContext(context.Background(), result, nil, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("closed async start result should not commit")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status != "closed" {
+		t.Fatalf("status = %q, want closed", updated.Status)
+	}
+	if got := updated.Metadata["state"]; got != "creating" {
+		t.Fatalf("state = %q, want creating", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+}
+
+func TestCommitAsyncStartResult_StopsMatchingRuntimeForStaleSnapshot(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 2, 45, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-old",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.SetMetadataBatch(session.ID, map[string]string{
+		"generation":     "3",
+		"instance_token": "tok-new",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_INSTANCE_TOKEN", "tok-old"); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_RUNTIME_EPOCH", "2"); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if commitAsyncStartResultWithContext(context.Background(), result, sp, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("stale async start result should not commit")
+	}
+	if sp.IsRunning("worker") {
+		t.Fatal("stale runtime with matching old session metadata should be stopped")
+	}
+}
+
+func TestAsyncStartIdentityMatches(t *testing.T) {
+	cases := []struct {
+		name     string
+		prepared map[string]string
+		current  map[string]string
+		want     bool
+	}{
+		{
+			name:     "matching token wins over generation drift",
+			prepared: map[string]string{"generation": "2", "instance_token": "tok-X"},
+			current:  map[string]string{"generation": "5", "instance_token": "tok-X"},
+			want:     true,
+		},
+		{
+			name:     "token mismatch is stale",
+			prepared: map[string]string{"generation": "2", "instance_token": "tok-old"},
+			current:  map[string]string{"generation": "2", "instance_token": "tok-new"},
+			want:     false,
+		},
+		{
+			name:     "matching tokens with no generation",
+			prepared: map[string]string{"instance_token": "tok-X"},
+			current:  map[string]string{"instance_token": "tok-X"},
+			want:     true,
+		},
+		{
+			name:     "missing current token with prepared token is stale",
+			prepared: map[string]string{"instance_token": "tok-X"},
+			current:  map[string]string{},
+			want:     false,
+		},
+		{
+			name:     "no prepared token falls back to generation match",
+			prepared: map[string]string{"generation": "2"},
+			current:  map[string]string{"generation": "2"},
+			want:     true,
+		},
+		{
+			name:     "no prepared token falls back to generation mismatch",
+			prepared: map[string]string{"generation": "2"},
+			current:  map[string]string{"generation": "3"},
+			want:     false,
+		},
+		{
+			name:     "no prepared metadata at all matches anything",
+			prepared: map[string]string{},
+			current:  map[string]string{"generation": "9", "instance_token": "tok-Z"},
+			want:     true,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			prepared := beads.Bead{Metadata: tc.prepared}
+			current := beads.Bead{Metadata: tc.current}
+			if got := asyncStartIdentityMatches(prepared, current); got != tc.want {
+				t.Fatalf("asyncStartIdentityMatches = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestAsyncStartSessionStillCurrent_GenerationDriftWithMatchingToken(t *testing.T) {
+	// Regression test: a wave that runs longer than concurrent reconciler
+	// phases will see the bead's generation bumped (e.g. healing writes)
+	// before the async result returns. Generation drift alone must not
+	// invalidate the result — the instance_token is the authoritative
+	// session identity. Without this guarantee, pool sessions stay stuck
+	// in state=creating with pending_create_claim=true forever.
+	prepared := beads.Bead{Metadata: map[string]string{
+		"generation":     "2",
+		"instance_token": "tok-X",
+		"state":          "creating",
+	}}
+	current := beads.Bead{Metadata: map[string]string{
+		"generation":     "7",
+		"instance_token": "tok-X",
+		"state":          "creating",
+	}}
+	if !asyncStartSessionStillCurrent(prepared, current) {
+		t.Fatal("generation drift with matching instance_token must not be considered stale")
+	}
+	if asyncStartStaleRuntimeCleanupAllowed(prepared, current) {
+		t.Fatal("matching instance_token must protect the runtime from cleanup despite generation drift")
+	}
+}
+
+func TestAsyncStartSessionStillCurrent_TokenMismatchIsStale(t *testing.T) {
+	prepared := beads.Bead{Metadata: map[string]string{
+		"generation":     "2",
+		"instance_token": "tok-old",
+		"state":          "creating",
+	}}
+	current := beads.Bead{Metadata: map[string]string{
+		"generation":     "3",
+		"instance_token": "tok-new",
+		"state":          "creating",
+	}}
+	if asyncStartSessionStillCurrent(prepared, current) {
+		t.Fatal("instance_token mismatch must be detected as stale")
+	}
+	if !asyncStartStaleRuntimeCleanupAllowed(prepared, current) {
+		t.Fatal("instance_token mismatch must allow runtime cleanup")
+	}
+}
+
+func TestAsyncStartSessionStillCurrent_PendingCreateClearedAfterAttachIsNotStale(t *testing.T) {
+	// Regression test: confirmLiveSessionState (called by ensureRunning when
+	// an attach finds the session already running) advances state to "active"
+	// and clears pending_create_claim. If that race wins against the async
+	// start result commit, the prepared bead still carries pcc="true" but
+	// current has pcc="" and state="active". The previous logic rejected the
+	// commit on the rollback drift check. The result was a stuck bead missing
+	// creation_complete_at and other start metadata, even though the spawn
+	// had succeeded.
+	//
+	// Fix: when current state has advanced to active or awake, the spawn
+	// already succeeded; commit the start result regardless of pcc drift.
+	prepared := beads.Bead{Metadata: map[string]string{
+		"instance_token":       "tok-Z",
+		"generation":           "2",
+		"state":                "creating",
+		"pending_create_claim": "true",
+	}}
+	current := beads.Bead{Metadata: map[string]string{
+		"instance_token": "tok-Z",
+		"generation":     "3",
+		"state":          "active",
+		// pending_create_claim cleared by confirmLiveSessionState
+		"pending_create_claim": "",
+	}}
+	if !asyncStartSessionStillCurrent(prepared, current) {
+		t.Fatal("session that advanced to active mid-flight must not be considered stale even when pcc was cleared")
+	}
+	if asyncStartStaleRuntimeCleanupAllowed(prepared, current) {
+		t.Fatal("session that advanced to active must not allow runtime cleanup")
+	}
+}
+
+func TestAsyncStartSessionStillCurrent_PendingCreateClearedAfterAwakeIsNotStale(t *testing.T) {
+	prepared := beads.Bead{Metadata: map[string]string{
+		"instance_token":       "tok-awake",
+		"generation":           "2",
+		"state":                "creating",
+		"pending_create_claim": "true",
+	}}
+	current := beads.Bead{Metadata: map[string]string{
+		"instance_token":       "tok-awake",
+		"generation":           "8",
+		"state":                "awake",
+		"pending_create_claim": "",
+	}}
+	if !asyncStartSessionStillCurrent(prepared, current) {
+		t.Fatal("session that advanced to awake mid-flight must not be considered stale even when pcc was cleared")
+	}
+	if asyncStartStaleRuntimeCleanupAllowed(prepared, current) {
+		t.Fatal("session that advanced to awake must not allow runtime cleanup")
+	}
+}
+
+func TestAsyncStartSessionStillCurrent_RollbackPendingCreateStillWorksWhenNotActive(t *testing.T) {
+	// Defensive: if pcc was cleared but state has NOT advanced to active/awake
+	// (still creating/asleep), the original rollback drift check still fires.
+	// This protects the prior intent: another phase decided to roll back the
+	// spawn, our result must not stomp on that decision.
+	prepared := beads.Bead{Metadata: map[string]string{
+		"instance_token":       "tok-Y",
+		"generation":           "2",
+		"state":                "creating",
+		"pending_create_claim": "true",
+	}}
+	current := beads.Bead{Metadata: map[string]string{
+		"instance_token":       "tok-Y",
+		"generation":           "3",
+		"state":                "creating",
+		"pending_create_claim": "",
+	}}
+	if asyncStartSessionStillCurrent(prepared, current) {
+		t.Fatal("pcc cleared while state still creating must be treated as rollback (stale)")
+	}
+}
+
+func TestCommitAsyncStartResult_GenerationDriftWithMatchingTokenCommits(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-X",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Concurrent reconciler phase bumps the generation while the async
+	// start is in flight. Token does not change.
+	if err := store.SetMetadata(session.ID, "generation", "5"); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+			coreHash: "core-abc",
+			liveHash: "live-xyz",
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if !commitAsyncStartResultWithContext(context.Background(), result, nil, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("generation drift with matching instance_token must commit; otherwise pool sessions stay stuck in creating")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["state"]; got != "active" {
+		t.Fatalf("state = %q, want active (creating→active transition)", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "" {
+		t.Fatalf("pending_create_claim = %q, want cleared after successful start", got)
+	}
+	if got := updated.Metadata["instance_token"]; got != "tok-X" {
+		t.Fatalf("instance_token = %q, want preserved", got)
+	}
+}
+
+func TestCommitAsyncStartResult_IgnoresCommandChangedDuringStartup(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 13, 6, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-drifter",
+		Title:  "drifter",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "drifter",
+			"template":             "drifter",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-drifter",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+			"command":              "CUSTOM_VERSION=v1 report",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.SetMetadata(session.ID, "command", "CUSTOM_VERSION=v2 report"); err != nil {
+		t.Fatal(err)
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "drifter", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("drifter", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("drifter", "GC_INSTANCE_TOKEN", "tok-drifter"); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("drifter", "GC_RUNTIME_EPOCH", "2"); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "CUSTOM_VERSION=v1 report",
+					SessionName:  "drifter",
+					TemplateName: "drifter",
+				},
+			},
+			coreHash: "core-v1",
+			liveHash: "live-v1",
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if commitAsyncStartResultWithContext(context.Background(), result, sp, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("async start with stale command should not commit")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sp.IsRunning("drifter") {
+		t.Fatal("stale runtime with old command should be stopped")
+	}
+	if got := updated.Metadata["started_config_hash"]; got != "" {
+		t.Fatalf("started_config_hash = %q, want empty until fresh command starts", got)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared so the new command can retry next tick", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true for pending-create retry", got)
+	}
+	if got := updated.Metadata["command"]; got != "CUSTOM_VERSION=v2 report" {
+		t.Fatalf("command = %q, want current config preserved", got)
+	}
+}
+
+func TestCommitAsyncStartResult_PreservesRuntimeWhenRefreshFails(t *testing.T) {
+	store := &getErrorStore{MemStore: beads.NewMemStore()}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 2, 50, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_INSTANCE_TOKEN", "tok-worker"); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if commitAsyncStartResultWithContext(context.Background(), result, sp, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("async result should not commit when refresh fails")
+	}
+	if !sp.IsRunning("worker") {
+		t.Fatal("refresh failure should not stop a runtime without proving staleness")
+	}
+	updated, err := store.MemStore.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared so the next tick can recover or retry", got)
+	}
+}
+
+func TestCommitAsyncStartResult_RecoversCommitPanic(t *testing.T) {
+	store := &panicMetadataBatchStore{MemStore: beads.NewMemStore()}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 3, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+
+	if commitAsyncStartResultWithContext(context.Background(), result, nil, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("async commit with panic should report not committed")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared after async commit panic", got)
+	}
+}
+
+func TestCommitAsyncStartResultWithContext_SkipsCanceledCommit(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 4, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	if commitAsyncStartResultWithContext(ctx, result, nil, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("canceled async commit should report not committed")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["state"]; got != "creating" {
+		t.Fatalf("state = %q, want creating", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+}
+
+func TestCommitAsyncStartResultWithContext_StopsCanceledSuccessfulPendingCreateRuntime(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 4, 15, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sp := runtime.NewFake()
+	if err := sp.Start(context.Background(), "worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_INSTANCE_TOKEN", "tok-worker"); err != nil {
+		t.Fatal(err)
+	}
+	if err := sp.SetMeta("worker", "GC_RUNTIME_EPOCH", "2"); err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:  "success",
+		started:  clk.Now(),
+		finished: clk.Now(),
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	if commitAsyncStartResultWithContext(ctx, result, sp, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("canceled async success should report not committed")
+	}
+	if sp.IsRunning("worker") {
+		t.Fatal("canceled async success should stop the runtime it started")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared so the next controller can retry", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true for next-tick retry", got)
+	}
+}
+
+func TestCommitAsyncStartResultWithContext_RollsBackCanceledPendingCreateError(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 4, 30, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		err:             context.Canceled,
+		outcome:         "canceled",
+		started:         clk.Now(),
+		finished:        clk.Now(),
+		rollbackPending: true,
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	if commitAsyncStartResultWithContext(ctx, result, nil, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}, nil) {
+		t.Fatal("canceled async error commit should report not committed")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status != "closed" {
+		t.Fatalf("status = %q, want closed so pending-create can be retried by replacement bead", updated.Status)
+	}
+}
+
+func TestCommitStartResult_SessionInitializingClearsInFlightLease(t *testing.T) {
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 26, 12, 5, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-worker",
+		Title:  "worker",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "worker",
+			"template":             "worker",
+			"generation":           "2",
+			"continuation_epoch":   "1",
+			"instance_token":       "tok-worker",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "worker",
+					SessionName:  "worker",
+					TemplateName: "worker",
+				},
+			},
+		},
+		outcome:         "session_initializing",
+		started:         clk.Now(),
+		finished:        clk.Now(),
+		rollbackPending: true,
+	}
+
+	if commitStartResult(result, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}) {
+		t.Fatal("session_initializing result should not count as committed")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status != "open" {
+		t.Fatalf("status = %q, want open", updated.Status)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared for next-tick retry", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+}
+
+func TestCommitStartResult_RollbackPendingErrorClearsInFlightLeaseWhenCloseFails(t *testing.T) {
+	store := &failingCloseStore{MemStore: beads.NewMemStore()}
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 13, 0, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-shortlived",
+		Title:  "shortlived",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "shortlived",
+			"template":             "shortlived",
+			"generation":           "2",
+			"instance_token":       "tok-shortlived",
+			"pending_create_claim": "true",
+			"last_woke_at":         clk.Now().Format(time.RFC3339),
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &session,
+				tp: TemplateParams{
+					Command:      "exit 0",
+					SessionName:  "shortlived",
+					TemplateName: "shortlived",
+				},
+			},
+		},
+		err:             errors.New("session died during startup"),
+		outcome:         "provider_error",
+		started:         clk.Now(),
+		finished:        clk.Now(),
+		rollbackPending: true,
+	}
+
+	if commitStartResult(result, store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}) {
+		t.Fatal("rollback-pending error should not count as committed")
+	}
+	updated, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if updated.Status != "open" {
+		t.Fatalf("status = %q, want open after injected close failure", updated.Status)
+	}
+	if got := updated.Metadata["last_woke_at"]; got != "" {
+		t.Fatalf("last_woke_at = %q, want cleared so the next reconciler tick can retry", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true for pending-create retry", got)
+	}
+	if pendingCreateStartInFlight(updated, clk, 0) {
+		t.Fatal("rollback-pending error left the pending-create bead leased")
+	}
+}
+
+// When the atomic start batch fails, NO state change lands: state stays
+// "creating", pending_create_claim stays "true", and the post-create marker
+// is absent. The reconciler's next tick retries via recoverRunningPendingCreate.
+// This is the intentional consequence of folding the claim clear into the
+// same SetMetadataBatch as the state/state_reason/creation_complete_at
+// transition so the sweep never observes a transient state without either
+// the claim or the marker.
+func TestCommitStartResult_AtomicBatchFailureLeavesClaimIntact(t *testing.T) {
+	store := &failingMetadataBatchStore{MemStore: beads.NewMemStore(), failBatch: true}
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":          "sky",
+			"session_name_explicit": "true",
+			"pending_create_claim":  "true",
+			"state":                 "creating",
+			"last_woke_at":          "2026-03-18T12:00:00Z",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	result := startResult{
+		prepared: preparedStart{
+			candidate: startCandidate{
+				session: &bead,
+				tp: TemplateParams{
+					SessionName:  "sky",
+					TemplateName: "helper",
+				},
+			},
+			coreHash: "core",
+			liveHash: "live",
+		},
+		outcome:  "success",
+		started:  time.Date(2026, 3, 18, 12, 0, 0, 0, time.UTC),
 		finished: time.Date(2026, 3, 18, 12, 0, 1, 0, time.UTC),
 	}
 
-	ok := commitStartResult(result, store, &clock.Fake{Time: time.Date(2026, 3, 18, 12, 0, 1, 0, time.UTC)}, events.Discard, 0, ioDiscard{}, ioDiscard{})
-	if ok {
-		t.Fatal("commitStartResult returned true, want false when metadata batch fails (state transition lost)")
-	}
+	ok := commitStartResult(result, store, &clock.Fake{Time: time.Date(2026, 3, 18, 12, 0, 1, 0, time.UTC)}, events.Discard, 0, ioDiscard{}, ioDiscard{})
+	if ok {
+		t.Fatal("commitStartResult returned true, want false when metadata batch fails (state transition lost)")
+	}
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Metadata["pending_create_claim"] != "true" {
+		t.Fatalf("pending_create_claim = %q, want preserved (atomic batch failed, state unchanged)", got.Metadata["pending_create_claim"])
+	}
+	if got.Metadata["state"] != "creating" {
+		t.Fatalf("state = %q, want creating (atomic batch failed)", got.Metadata["state"])
+	}
+	if got.Metadata["creation_complete_at"] != "" {
+		t.Fatalf("creation_complete_at = %q, want empty (atomic batch failed)", got.Metadata["creation_complete_at"])
+	}
+	if got.Metadata["last_woke_at"] != "" {
+		t.Fatalf("last_woke_at = %q, want cleared so a failed metadata commit can retry", got.Metadata["last_woke_at"])
+	}
+}
+
+func TestRefreshConfiguredNamedStartCandidateAddsCurrentSkillFingerprint(t *testing.T) {
+	resetSkillCatalogCache()
+	cityPath := t.TempDir()
+	writeTemplateResolveCityConfig(t, cityPath, "file")
+	if err := os.WriteFile(filepath.Join(cityPath, "pack.toml"),
+		[]byte("[pack]\nname = \"named-refresh-test\"\nversion = \"0.1.0\"\nschema = 2\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	skillDir := filepath.Join(cityPath, "skills", "plan")
+	if err := os.MkdirAll(skillDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(skillDir, "SKILL.md"),
+		[]byte("---\nname: plan\ndescription: test skill\n---\nbody\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := &config.City{
+		Workspace:     config.Workspace{Name: "test-city", Provider: "claude"},
+		Session:       config.SessionConfig{Provider: "tmux"},
+		PackSkillsDir: filepath.Join(cityPath, "skills"),
+		Providers: map[string]config.ProviderSpec{
+			"claude": {Command: "true", PromptMode: "none", SupportsACP: boolPtr(true)},
+		},
+		Agents: []config.Agent{{
+			Name:     "mayor",
+			Scope:    "city",
+			Provider: "claude",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+			Mode:     "always",
+		}},
+	}
+	store := beads.NewMemStore()
+	bead, err := store.Create(beads.Bead{
+		Title:  "mayor",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               "mayor",
+			"session_name_explicit":      boolMetadata(true),
+			"template":                   "mayor",
+			"agent_name":                 "mayor",
+			"state":                      string(sessionpkg.StateCreating),
+			"pending_create_claim":       "true",
+			namedSessionMetadataKey:      boolMetadata(true),
+			namedSessionIdentityMetadata: "mayor",
+			namedSessionModeMetadata:     "always",
+			"continuation_epoch":         "1",
+			"generation":                 "1",
+			"instance_token":             sessionpkg.NewInstanceToken(),
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	stale := TemplateParams{
+		TemplateName: "mayor",
+		SessionName:  "mayor",
+		InstanceName: "mayor",
+		Command:      "true",
+		WorkDir:      cityPath,
+	}
+	candidate := startCandidate{session: &bead, tp: stale}
+	refreshed := refreshConfiguredNamedStartCandidate(
+		candidate,
+		cityPath,
+		cfg.Workspace.Name,
+		cfg,
+		runtime.NewFake(),
+		store,
+		&clock.Fake{Time: time.Date(2026, 4, 26, 12, 0, 0, 0, time.UTC)},
+		ioDiscard{},
+	)
 
-	got, err := store.Get(bead.ID)
-	if err != nil {
-		t.Fatal(err)
+	if _, ok := stale.FPExtra["skills:plan"]; ok {
+		t.Fatal("test setup invalid: stale candidate already had skills fingerprint")
 	}
-	if got.Metadata["pending_create_claim"] != "true" {
-		t.Fatalf("pending_create_claim = %q, want preserved (atomic batch failed, state unchanged)", got.Metadata["pending_create_claim"])
+	if got := refreshed.tp.FPExtra["skills:plan"]; got == "" {
+		t.Fatalf("refreshed FPExtra missing skills:plan: %#v", refreshed.tp.FPExtra)
 	}
-	if got.Metadata["state"] != "creating" {
-		t.Fatalf("state = %q, want creating (atomic batch failed)", got.Metadata["state"])
+	if refreshed.tp.ConfiguredNamedIdentity != "mayor" {
+		t.Fatalf("ConfiguredNamedIdentity = %q, want mayor", refreshed.tp.ConfiguredNamedIdentity)
 	}
-	if got.Metadata["creation_complete_at"] != "" {
-		t.Fatalf("creation_complete_at = %q, want empty (atomic batch failed)", got.Metadata["creation_complete_at"])
+	if runtime.CoreFingerprint(templateParamsToConfig(refreshed.tp)) == runtime.CoreFingerprint(templateParamsToConfig(stale)) {
+		t.Fatal("refreshed candidate core fingerprint did not change after skill FPExtra refresh")
 	}
 }
 
@@ -1161,15 +3637,18 @@ func TestCommitStartResult_AtomicBatchLandsStateAndClaimClearTogether(t *testing
 }
 
 func TestExecutePlannedStarts_UsesLogicalTemplateForDependencyRechecks(t *testing.T) {
+	maxWakes := 8
+	dropAfter := 3
 	sp := &dropDependencyAfterNStartsProvider{
 		Fake:      runtime.NewFake(),
-		dropAfter: defaultMaxParallelStartsPerWave,
+		dropAfter: dropAfter,
 		depName:   "db",
 	}
 	if err := sp.Start(context.Background(), "db", runtime.Config{}); err != nil {
 		t.Fatal(err)
 	}
 	cfg := &config.City{
+		Daemon: config.DaemonConfig{MaxWakesPerTick: &maxWakes},
 		Agents: []config.Agent{
 			{Name: "app-1", DependsOn: []string{"db"}},
 			{Name: "app-2", DependsOn: []string{"db"}},
@@ -1210,13 +3689,14 @@ func TestExecutePlannedStarts_UsesLogicalTemplateForDependencyRechecks(t *testin
 		})
 	}
 
+	var stderr bytes.Buffer
 	woken := executePlannedStarts(
 		context.Background(), candidates, cfg, desired, sp, store, "",
-		clk, events.Discard, 5*time.Second, ioDiscard{}, ioDiscard{},
+		clk, events.Discard, 5*time.Second, ioDiscard{}, &stderr,
 	)
 
-	if woken != defaultMaxParallelStartsPerWave {
-		t.Fatalf("woken = %d, want %d", woken, defaultMaxParallelStartsPerWave)
+	if woken != dropAfter {
+		t.Fatalf("woken = %d, want %d", woken, dropAfter)
 	}
 	for _, name := range []string{"app-1", "app-2", "app-3"} {
 		if !sp.IsRunning(name) {
@@ -1226,6 +3706,13 @@ func TestExecutePlannedStarts_UsesLogicalTemplateForDependencyRechecks(t *testin
 	if sp.IsRunning("app-4") {
 		t.Fatal("app-4 should be blocked after db dies between batches even when bead template is stale")
 	}
+	gotLog := stderr.String()
+	if !strings.Contains(gotLog, "session=app-4") || !strings.Contains(gotLog, "template=app-4") || !strings.Contains(gotLog, "outcome=blocked_on_dependencies") {
+		t.Fatalf("app-4 log = %q, want logical template dependency block", gotLog)
+	}
+	if strings.Contains(gotLog, "session=app-4 template=app-4 outcome=deferred_by_wake_budget") {
+		t.Fatalf("app-4 was deferred by wake budget instead of dependency recheck: %q", gotLog)
+	}
 }
 
 func TestStopSessionsBounded_StopsDependentsBeforeDependencies(t *testing.T) {
@@ -1574,6 +4061,102 @@ func TestGracefulStopAll_UsesListRunningToStopLingeringSessions(t *testing.T) {
 	}
 }
 
+func TestGracefulStopAll_CleansExitedRuntimeArtifact(t *testing.T) {
+	sp := newExitedArtifactAfterInterruptProvider()
+	if err := sp.Start(context.Background(), "custom-worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := events.NewFake()
+	var stdout, stderr bytes.Buffer
+
+	gracefulStopAll([]string{"custom-worker"}, sp, 20*time.Millisecond, rec, nil, nil, &stdout, &stderr)
+
+	if sp.stopCalls["custom-worker"] == 0 {
+		t.Fatalf("expected gracefulStopAll to cleanup exited runtime artifact, calls=%+v", sp.Calls)
+	}
+	if !strings.Contains(stdout.String(), "Agent 'custom-worker' exited gracefully") {
+		t.Fatalf("stdout = %q, want graceful exit message", stdout.String())
+	}
+}
+
+func TestGracefulStopAll_CleansExitedRuntimeArtifactAlongsideLiveSurvivor(t *testing.T) {
+	sp := newExitedArtifactAfterInterruptProvider()
+	for _, name := range []string{"corpse-worker", "live-worker"} {
+		if err := sp.Start(context.Background(), name, runtime.Config{}); err != nil {
+			t.Fatalf("Start(%s): %v", name, err)
+		}
+	}
+	sp.keepRunningOnInterrupt["live-worker"] = true
+
+	rec := events.NewFake()
+	var stdout, stderr bytes.Buffer
+
+	gracefulStopAll([]string{"corpse-worker", "live-worker"}, sp, 20*time.Millisecond, rec, nil, nil, &stdout, &stderr)
+
+	if sp.stopCalls["corpse-worker"] == 0 {
+		t.Fatalf("expected cleanup Stop for exited runtime artifact, calls=%+v", sp.Calls)
+	}
+	if sp.stopCalls["live-worker"] == 0 {
+		t.Fatalf("expected forced Stop for live survivor, calls=%+v", sp.Calls)
+	}
+	if !strings.Contains(stdout.String(), "Agent 'corpse-worker' exited gracefully") {
+		t.Fatalf("stdout = %q, want corpse graceful-exit message", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), "Stopped agent 'live-worker'") {
+		t.Fatalf("stdout = %q, want live forced-stop message", stdout.String())
+	}
+}
+
+func TestDoStopCleansExitedRuntimeArtifact(t *testing.T) {
+	sp := newExitedArtifactAfterInterruptProvider()
+	if err := sp.Start(context.Background(), "custom-worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	sp.markExited("custom-worker")
+	sp.listExited = true
+
+	var stdout, stderr bytes.Buffer
+
+	doStop([]string{"custom-worker"}, sp, nil, nil, 20*time.Millisecond, events.Discard, &stdout, &stderr)
+
+	if sp.stopCalls["custom-worker"] == 0 {
+		t.Fatalf("expected doStop to cleanup exited runtime artifact, calls=%+v", sp.Calls)
+	}
+}
+
+func TestDoStopCleansVisibleExitedRuntimeArtifactWithPartialListError(t *testing.T) {
+	sp := newExitedArtifactAfterInterruptProvider()
+	if err := sp.Start(context.Background(), "custom-worker", runtime.Config{}); err != nil {
+		t.Fatal(err)
+	}
+	sp.markExited("custom-worker")
+	sp.listExited = true
+	sp.listErr = &runtime.PartialListError{Err: errors.New("remote backend down")}
+
+	var stdout, stderr bytes.Buffer
+
+	doStop([]string{"custom-worker"}, sp, nil, nil, 20*time.Millisecond, events.Discard, &stdout, &stderr)
+
+	if sp.stopCalls["custom-worker"] == 0 {
+		t.Fatalf("expected doStop to cleanup exited runtime artifact despite partial list error, calls=%+v", sp.Calls)
+	}
+	if !strings.Contains(stderr.String(), "listing sessions partially failed") {
+		t.Fatalf("stderr = %q, want partial-list warning", stderr.String())
+	}
+}
+
+func TestDoStopSkipsExplicitNameThatIsNeitherAliveNorVisible(t *testing.T) {
+	sp := newExitedArtifactAfterInterruptProvider()
+	var stdout, stderr bytes.Buffer
+
+	doStop([]string{"absent-worker"}, sp, nil, nil, 20*time.Millisecond, events.Discard, &stdout, &stderr)
+
+	if sp.stopCalls["absent-worker"] != 0 {
+		t.Fatalf("Stop calls for absent-worker = %d, want 0", sp.stopCalls["absent-worker"])
+	}
+}
+
 func TestStopWaveOrder_HandlesUnknownTemplateWithoutSerialFallback(t *testing.T) {
 	cfg := &config.City{
 		Agents: []config.Agent{
@@ -1911,9 +4494,7 @@ func TestExecutePreparedStartWave_PanicIncludesStackTrace(t *testing.T) {
 		}},
 		&panicStartProvider{Fake: runtime.NewFake()},
 		nil,
-		nil,
 		time.Second,
-		1,
 	)
 	if len(results) != 1 {
 		t.Fatalf("len(results) = %d, want 1", len(results))
@@ -2039,7 +4620,7 @@ func TestCandidateWaveOrder_FallsBackToSerialOnCycle(t *testing.T) {
 		},
 	}
 
-	waves, ok := candidateWaveOrder(candidates, cfg, map[string]TemplateParams{}, runtime.NewFake(), "city", nil)
+	waves, ok := candidateWaveOrder(candidates, cfg, map[string]TemplateParams{}, runtime.NewFake(), "city", nil, clock.Real{})
 	if ok {
 		t.Fatal("expected serial fallback for cycle")
 	}
@@ -2105,7 +4686,7 @@ func TestCandidateWaveOrder_UsesLegacyAgentLabelTemplate(t *testing.T) {
 		},
 	}
 
-	waves, ok := candidateWaveOrder(candidates, cfg, map[string]TemplateParams{}, runtime.NewFake(), "city", store)
+	waves, ok := candidateWaveOrder(candidates, cfg, map[string]TemplateParams{}, runtime.NewFake(), "city", store, clock.Real{})
 	if !ok {
 		t.Fatal("unexpected serial fallback")
 	}
@@ -2134,6 +4715,21 @@ func (p *dieAfterStartProvider) IsRunning(name string) bool {
 	return p.Fake.IsRunning(name)
 }
 
+// zombieAfterStartProvider leaves the runtime container/pane present but marks
+// the actual agent process dead. This matches wrappers that keep tmux alive
+// after the CLI exits with a stale resume-session error.
+type zombieAfterStartProvider struct {
+	*runtime.Fake
+}
+
+func (p *zombieAfterStartProvider) Start(ctx context.Context, name string, cfg runtime.Config) error {
+	if err := p.Fake.Start(ctx, name, cfg); err != nil {
+		return err
+	}
+	p.Zombies[name] = true
+	return nil
+}
+
 func TestExecutePreparedStartWave_StaleSessionKeyDetected(t *testing.T) {
 	skipSlowCmdGCTest(t, "waits through stale session-key detection; run make test-cmd-gc-process for full coverage")
 	sp := &dieAfterStartProvider{Fake: runtime.NewFake()}
@@ -2161,9 +4757,7 @@ func TestExecutePreparedStartWave_StaleSessionKeyDetected(t *testing.T) {
 		[]preparedStart{item},
 		sp,
 		nil,
-		nil,
 		10*time.Second,
-		1,
 	)
 
 	if len(results) != 1 {
@@ -2178,6 +4772,237 @@ func TestExecutePreparedStartWave_StaleSessionKeyDetected(t *testing.T) {
 	}
 }
 
+func TestExecutePreparedStartWave_StaleSessionKeyDetectedWhenPaneSurvives(t *testing.T) {
+	sp := &zombieAfterStartProvider{Fake: runtime.NewFake()}
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &beads.Bead{
+				ID: "gc-99",
+				Metadata: map[string]string{
+					"session_name": "test-agent",
+					"session_key":  "stale-key-abc",
+					"template":     "worker",
+				},
+			},
+			tp: TemplateParams{
+				Command:      "claude --resume stale-key-abc",
+				SessionName:  "test-agent",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{
+			Command:      "claude --resume stale-key-abc",
+			ProcessNames: []string{"claude"},
+		},
+	}
+
+	results := executePreparedStartWave(
+		context.Background(),
+		[]preparedStart{item},
+		sp,
+		nil,
+		10*time.Second,
+	)
+
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	r := results[0]
+	if r.err == nil {
+		t.Fatal("expected error for dead agent process left behind in a live pane")
+	}
+	if !strings.Contains(r.err.Error(), "died during startup") {
+		t.Fatalf("unexpected error: %v", r.err)
+	}
+}
+
+func TestExecutePreparedStartWave_RateLimitStartupDeathQuarantinesWithoutWakeFailure(t *testing.T) {
+	sp := &zombieAfterStartProvider{Fake: runtime.NewFake()}
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-99",
+		Title:  "test-agent",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":         "test-agent",
+			"session_key":          "stale-key-abc",
+			"template":             "worker",
+			"state":                "active",
+			"last_woke_at":         clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+			"wake_attempts":        "2",
+			"started_config_hash":  "keep-hash",
+			"continuation_command": "resume",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+	sp.SetPeekOutput("test-agent", "You've hit your limit, Pro plan\n\n/rate-limit-options")
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &session,
+			tp: TemplateParams{
+				Command:      "claude --resume stale-key-abc",
+				SessionName:  "test-agent",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{
+			Command:      "claude --resume stale-key-abc",
+			ProcessNames: []string{"claude"},
+		},
+	}
+
+	results := executePreparedStartWaveForCity(
+		context.Background(),
+		[]preparedStart{item},
+		"",
+		sp,
+		nil,
+		&config.City{},
+		10*time.Second,
+		1,
+	)
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	if results[0].err == nil {
+		t.Fatal("expected startup-death error")
+	}
+
+	if commitStartResult(results[0], store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}) {
+		t.Fatal("startup rate-limit hold should not count as a committed wake")
+	}
+	got, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["wake_attempts"] != "2" {
+		t.Fatalf("wake_attempts = %q, want 2", got.Metadata["wake_attempts"])
+	}
+	if got.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want rate_limit", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", got.Metadata["state"])
+	}
+	if got.Metadata["session_key"] != "stale-key-abc" {
+		t.Fatalf("session_key = %q, want preserved", got.Metadata["session_key"])
+	}
+	if got.Metadata["started_config_hash"] != "keep-hash" {
+		t.Fatalf("started_config_hash = %q, want preserved", got.Metadata["started_config_hash"])
+	}
+	if got.Metadata["continuation_reset_pending"] != "" {
+		t.Fatalf("continuation_reset_pending = %q, want empty", got.Metadata["continuation_reset_pending"])
+	}
+	if got.Metadata["last_woke_at"] != "" {
+		t.Fatalf("last_woke_at = %q, want cleared after rate-limit hold", got.Metadata["last_woke_at"])
+	}
+	qUntil, err := time.Parse(time.RFC3339, got.Metadata["quarantined_until"])
+	if err != nil {
+		t.Fatalf("quarantined_until parse: %v", err)
+	}
+	if want := clk.Now().Add(defaultRateLimitQuarantineDuration); !qUntil.Equal(want) {
+		t.Fatalf("quarantined_until = %s, want %s", qUntil.Format(time.RFC3339), want.Format(time.RFC3339))
+	}
+}
+
+func TestExecutePreparedStartWave_RateLimitPendingCreateDeathClearsClaim(t *testing.T) {
+	sp := &zombieAfterStartProvider{Fake: runtime.NewFake()}
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 28, 12, 30, 0, 0, time.UTC)}
+	session, err := store.Create(beads.Bead{
+		ID:     "gc-creating",
+		Title:  "creating-agent",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: creatingMeta(map[string]string{
+			"session_name":         "creating-agent",
+			"session_key":          "resume-key",
+			"template":             "worker",
+			"last_woke_at":         clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+			"wake_attempts":        "2",
+			"started_config_hash":  "keep-hash",
+			"pending_create_claim": "true",
+		}),
+	})
+	if err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+	sp.SetPeekOutput("creating-agent", "You've hit your limit, Pro plan\n\n/rate-limit-options")
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &session,
+			tp: TemplateParams{
+				Command:      "claude --resume resume-key",
+				SessionName:  "creating-agent",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{
+			Command:      "claude --resume resume-key",
+			ProcessNames: []string{"claude"},
+		},
+	}
+
+	results := executePreparedStartWaveForCity(
+		context.Background(),
+		[]preparedStart{item},
+		"",
+		sp,
+		nil,
+		&config.City{},
+		10*time.Second,
+		1,
+	)
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	if results[0].err == nil {
+		t.Fatal("expected startup-death error")
+	}
+	if !results[0].rateLimitScreen {
+		t.Fatal("pending-create startup death should still classify provider rate-limit screen")
+	}
+
+	if commitStartResult(results[0], store, clk, events.Discard, 0, ioDiscard{}, ioDiscard{}) {
+		t.Fatal("startup rate-limit hold should not count as a committed wake")
+	}
+	got, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("status = %q, want open", got.Status)
+	}
+	if got.Metadata["close_reason"] != "" {
+		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
+	}
+	if got.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", got.Metadata["state"])
+	}
+	if got.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want rate_limit", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["wake_attempts"] != "2" {
+		t.Fatalf("wake_attempts = %q, want 2", got.Metadata["wake_attempts"])
+	}
+	if got.Metadata["pending_create_claim"] != "" {
+		t.Fatalf("pending_create_claim = %q, want cleared by rate-limit hold", got.Metadata["pending_create_claim"])
+	}
+	if got.Metadata["session_key"] != "resume-key" {
+		t.Fatalf("session_key = %q, want preserved", got.Metadata["session_key"])
+	}
+	if got.Metadata["started_config_hash"] != "keep-hash" {
+		t.Fatalf("started_config_hash = %q, want preserved", got.Metadata["started_config_hash"])
+	}
+	if got.Metadata["last_woke_at"] != "" {
+		t.Fatalf("last_woke_at = %q, want cleared after rate-limit hold", got.Metadata["last_woke_at"])
+	}
+}
+
 func TestExecutePreparedStartWave_NoStaleCheckWithoutSessionKey(t *testing.T) {
 	// Session without a session_key should not trigger stale detection,
 	// even if the session dies after start.
@@ -2205,9 +5030,7 @@ func TestExecutePreparedStartWave_NoStaleCheckWithoutSessionKey(t *testing.T) {
 		[]preparedStart{item},
 		sp,
 		nil,
-		nil,
 		10*time.Second,
-		1,
 	)
 
 	if len(results) != 1 {
@@ -2650,3 +5473,48 @@ func TestCommitStartResult_PersistsMCPIdentityForACPStart(t *testing.T) {
 		t.Fatal("mcp_servers_snapshot = empty, want persisted snapshot")
 	}
 }
+
+func TestStopTargetThroughWorkerBoundary_CityStopLeavesSessionAsleep(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	session, err := store.Create(beads.Bead{
+		Title:  "control-dispatcher",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "control-dispatcher",
+			"template":     "control-dispatcher",
+			"state":        "active",
+			"sleep_reason": sleepReasonCityStop,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := sp.Start(context.Background(), "control-dispatcher", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+
+	err = stopTargetThroughWorkerBoundary(stopTarget{
+		sessionID: session.ID,
+		name:      "control-dispatcher",
+		resolved:  true,
+	}, store, sp, &config.City{})
+	if err != nil {
+		t.Fatalf("stopTargetThroughWorkerBoundary: %v", err)
+	}
+
+	got, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Metadata["state"] != string(sessionpkg.StateAsleep) {
+		t.Fatalf("state = %q, want %q", got.Metadata["state"], sessionpkg.StateAsleep)
+	}
+	if got.Metadata["sleep_reason"] != sleepReasonCityStop {
+		t.Fatalf("sleep_reason = %q, want %q", got.Metadata["sleep_reason"], sleepReasonCityStop)
+	}
+	if got.Metadata["suspended_at"] != "" {
+		t.Fatalf("suspended_at = %q, want empty", got.Metadata["suspended_at"])
+	}
+}
diff --git a/cmd/gc/session_lifecycle_start_boundary_test.go b/cmd/gc/session_lifecycle_start_boundary_test.go
index fb7031e6dd..5ea5dc3c4e 100644
--- a/cmd/gc/session_lifecycle_start_boundary_test.go
+++ b/cmd/gc/session_lifecycle_start_boundary_test.go
@@ -37,9 +37,7 @@ func TestExecutePreparedStartWaveUsesWorkerBoundaryForKnownSession(t *testing.T)
 		}},
 		sp,
 		store,
-		nil,
 		10*time.Second,
-		1,
 	)
 	if len(results) != 1 {
 		t.Fatalf("len(results) = %d, want 1", len(results))
diff --git a/cmd/gc/session_lifecycle_start_deadline_test.go b/cmd/gc/session_lifecycle_start_deadline_test.go
new file mode 100644
index 0000000000..ad24beaa0b
--- /dev/null
+++ b/cmd/gc/session_lifecycle_start_deadline_test.go
@@ -0,0 +1,262 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+// ctxIgnoringStartProvider blocks inside Start until either startDelay
+// elapses or ctx is canceled, then unconditionally marks the session as
+// running and returns nil. It mirrors a real-world failure shape: a provider
+// whose final stage (overlay copy, tmux handshake, ACP init) completes
+// "successfully" from its own point of view even though its caller's
+// deadline has already expired. The reconciler has no signal that anything
+// went wrong - no err, no outcome flag - so it records outcome=success
+// with a duration far larger than the configured startup timeout.
+type ctxIgnoringStartProvider struct {
+	*runtime.Fake
+	startDelay time.Duration
+}
+
+func (p *ctxIgnoringStartProvider) Start(ctx context.Context, name string, cfg runtime.Config) error {
+	select {
+	case <-time.After(p.startDelay):
+	case <-ctx.Done():
+	}
+	// Deliberately drop ctx.Err() and register the session anyway. This is
+	// the buggy provider behavior we want to expose at the executePreparedStartWave
+	// layer.
+	return p.Fake.Start(context.Background(), name, cfg)
+}
+
+// TestExecutePreparedStartWave_StartOutlivesDeadlineReportsDeadlineExceeded
+// verifies that a provider returning nil after the startup deadline cannot
+// mask the timeout as a successful wake.
+func TestExecutePreparedStartWave_StartOutlivesDeadlineReportsDeadlineExceeded(t *testing.T) {
+	sp := &ctxIgnoringStartProvider{
+		Fake:       runtime.NewFake(),
+		startDelay: 500 * time.Millisecond,
+	}
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &beads.Bead{
+				Metadata: map[string]string{
+					"session_name": "deadline-witness",
+					"template":     "worker",
+				},
+			},
+			tp: TemplateParams{
+				Command:      "claude",
+				SessionName:  "deadline-witness",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{Command: "claude"},
+	}
+
+	const startupTimeout = 50 * time.Millisecond
+	before := time.Now()
+	results := executePreparedStartWave(
+		context.Background(),
+		[]preparedStart{item},
+		sp,
+		nil, // store == nil uses RuntimeHandle path and skips bead-backed staleKey branch
+		startupTimeout,
+	)
+	elapsed := time.Since(before)
+
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	r := results[0]
+
+	// Sanity: the work really outran the startup timeout - this is the
+	// observable symptom. If this assertion fails the test itself is wrong.
+	if elapsed <= startupTimeout {
+		t.Fatalf("wave returned in %v, which is <= startupTimeout %v; provider did not hold ctx open as intended", elapsed, startupTimeout)
+	}
+	measured := r.finished.Sub(r.started)
+	if measured <= startupTimeout {
+		t.Fatalf("recorded duration = %v, want > startupTimeout %v", measured, startupTimeout)
+	}
+
+	// After the fix: outcome must reflect the deadline; err==nil must not
+	// override startCtx.Err().
+	if r.outcome == "success" {
+		t.Fatalf("outcome = %q with err=%v and recorded duration %v; "+
+			"startCtx deadline (%v) expired during Start but outcome masks it as success. "+
+			"See runPreparedStartCandidate - the `err == nil` case "+
+			"is evaluated before `startCtx.Err() == context.DeadlineExceeded`.",
+			r.outcome, r.err, measured, startupTimeout)
+	}
+	if r.outcome != "deadline_exceeded" {
+		t.Fatalf("outcome = %q, want %q", r.outcome, "deadline_exceeded")
+	}
+	if r.err == nil || !errors.Is(r.err, context.DeadlineExceeded) {
+		t.Fatalf("err = %v, want a wrapper around context.DeadlineExceeded", r.err)
+	}
+	if !strings.Contains(r.err.Error(), "deadline") {
+		t.Fatalf("err text = %q, want mention of deadline", r.err.Error())
+	}
+	if strings.Contains(r.err.Error(), "resuming session") {
+		t.Fatalf("err text = %q, want start/resume-neutral text", r.err.Error())
+	}
+}
+
+func TestExecutePreparedStartWave_ResumeSessionKeyStaleCheckAfterInTimeStartStaysSuccess(t *testing.T) {
+	sp := runtime.NewFake()
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &beads.Bead{
+				ID: "gc-resume",
+				Metadata: map[string]string{
+					"session_name": "resume-deadline-witness",
+					"session_key":  "resume-key",
+					"template":     "worker",
+				},
+			},
+			tp: TemplateParams{
+				Command:      "claude --resume resume-key",
+				SessionName:  "resume-deadline-witness",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{Command: "claude --resume resume-key"},
+	}
+
+	const startupTimeout = 50 * time.Millisecond
+	before := time.Now()
+	results := executePreparedStartWave(
+		context.Background(),
+		[]preparedStart{item},
+		sp,
+		nil,
+		startupTimeout,
+	)
+	elapsed := time.Since(before)
+
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	r := results[0]
+	if elapsed <= startupTimeout {
+		t.Fatalf("wave returned in %v, which is <= startupTimeout %v; stale-key detection did not cross the deadline", elapsed, startupTimeout)
+	}
+	if r.outcome != "success" {
+		t.Fatalf("outcome = %q, err = %v; want success because Start returned before the deadline and the session stayed alive", r.outcome, r.err)
+	}
+	if r.err != nil {
+		t.Fatalf("err = %v, want nil", r.err)
+	}
+}
+
+type ctxCancelingStartProvider struct {
+	*runtime.Fake
+	cancel func()
+}
+
+func (p *ctxCancelingStartProvider) Start(ctx context.Context, name string, cfg runtime.Config) error {
+	p.cancel()
+	<-ctx.Done()
+	return p.Fake.Start(context.Background(), name, cfg)
+}
+
+func TestExecutePreparedStartWave_CanceledContextReportsCanceled(t *testing.T) {
+	parentCtx, cancel := context.WithCancel(context.Background())
+	sp := &ctxCancelingStartProvider{
+		Fake:   runtime.NewFake(),
+		cancel: cancel,
+	}
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &beads.Bead{
+				Metadata: map[string]string{
+					"session_name": "cancel-witness",
+					"template":     "worker",
+				},
+			},
+			tp: TemplateParams{
+				Command:      "claude",
+				SessionName:  "cancel-witness",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{Command: "claude"},
+	}
+
+	results := executePreparedStartWave(
+		parentCtx,
+		[]preparedStart{item},
+		sp,
+		nil,
+		time.Second,
+	)
+
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	r := results[0]
+	if r.outcome != "canceled" {
+		t.Fatalf("outcome = %q, want %q", r.outcome, "canceled")
+	}
+	if r.err == nil || !errors.Is(r.err, context.Canceled) {
+		t.Fatalf("err = %v, want a wrapper around context.Canceled", r.err)
+	}
+	if strings.Contains(r.err.Error(), "resuming session") {
+		t.Fatalf("err text = %q, want start/resume-neutral text", r.err.Error())
+	}
+}
+
+type initializingAfterDeadlineProvider struct {
+	*runtime.Fake
+}
+
+func (p *initializingAfterDeadlineProvider) Start(ctx context.Context, _ string, _ runtime.Config) error {
+	<-ctx.Done()
+	return runtime.ErrSessionInitializing
+}
+
+func TestExecutePreparedStartWave_InitializingAfterDeadlineBacksOffSilently(t *testing.T) {
+	sp := &initializingAfterDeadlineProvider{Fake: runtime.NewFake()}
+	item := preparedStart{
+		candidate: startCandidate{
+			session: &beads.Bead{
+				Metadata: map[string]string{
+					"session_name": "initializing-witness",
+					"template":     "worker",
+				},
+			},
+			tp: TemplateParams{
+				Command:      "claude",
+				SessionName:  "initializing-witness",
+				TemplateName: "worker",
+			},
+		},
+		cfg: runtime.Config{Command: "claude"},
+	}
+
+	results := executePreparedStartWave(
+		context.Background(),
+		[]preparedStart{item},
+		sp,
+		nil,
+		50*time.Millisecond,
+	)
+
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	r := results[0]
+	if r.outcome != "session_initializing" {
+		t.Fatalf("outcome = %q, want %q", r.outcome, "session_initializing")
+	}
+	if r.err != nil {
+		t.Fatalf("err = %v, want nil for silent initializing backoff", r.err)
+	}
+}
diff --git a/cmd/gc/session_model_phase0_doctor_spec_test.go b/cmd/gc/session_model_phase0_doctor_spec_test.go
index c102d1102d..81f48f3af6 100644
--- a/cmd/gc/session_model_phase0_doctor_spec_test.go
+++ b/cmd/gc/session_model_phase0_doctor_spec_test.go
@@ -2,12 +2,15 @@ package main
 
 import (
 	"bytes"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/doctor"
 	"github.com/gastownhall/gascity/internal/fsys"
 	"github.com/gastownhall/gascity/internal/session"
 )
@@ -308,6 +311,62 @@ mode = "on_demand"
 	}
 }
 
+type sessionModelDoctorQuerySpyStore struct {
+	*beads.MemStore
+	queries []beads.ListQuery
+}
+
+func (s *sessionModelDoctorQuerySpyStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.queries = append(s.queries, query)
+	if query.AllowScan && query.IncludeClosed && query.Label == "" && query.Type == "" {
+		return nil, errors.New("unfiltered closed scan")
+	}
+	return s.MemStore.List(query)
+}
+
+func TestPhase0DoctorSessionModelAvoidsUnfilteredClosedScan(t *testing.T) {
+	store := &sessionModelDoctorQuerySpyStore{MemStore: beads.NewMemStore()}
+	closed, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": "s-gc-closed",
+			"template":     "worker",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session bead: %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("Close(%s): %v", closed.ID, err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:     "task",
+		Status:   "open",
+		Title:    "stale owner",
+		Assignee: closed.ID,
+	}); err != nil {
+		t.Fatalf("create work bead: %v", err)
+	}
+
+	check := &sessionModelDoctorCheck{
+		cfg:      &config.City{},
+		cityPath: "/city",
+		newStore: func(string) (beads.Store, error) {
+			return store, nil
+		},
+	}
+	result := check.Run(&doctor.CheckContext{Verbose: true})
+	if result.Status != doctor.StatusWarning || !strings.Contains(strings.Join(result.Details, "\n"), "closed-bead-owner") {
+		t.Fatalf("session-model result = %#v, want closed-bead-owner warning", result)
+	}
+	for _, query := range store.queries {
+		if query.AllowScan && query.IncludeClosed && query.Label == "" && query.Type == "" {
+			t.Fatalf("session-model used unfiltered closed scan: %#v", query)
+		}
+	}
+}
+
 func newPhase0DoctorCity(t *testing.T) (string, *beads.FileStore) {
 	t.Helper()
 
diff --git a/cmd/gc/session_model_phase0_hook_spec_test.go b/cmd/gc/session_model_phase0_hook_spec_test.go
index 49c8b5c5e7..2c77398ed1 100644
--- a/cmd/gc/session_model_phase0_hook_spec_test.go
+++ b/cmd/gc/session_model_phase0_hook_spec_test.go
@@ -49,7 +49,7 @@ work_query = "printf 'pwd=%s|agent=%s|template=%s|session=%s|origin=%s' \"$PWD\"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook(nil, false, &stdout, &stderr)
+	code := cmdHook(nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -107,7 +107,7 @@ work_query = "printf 'agent=%s|template=%s|session=%s|origin=%s' \"$GC_AGENT\" \
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook(nil, false, &stdout, &stderr)
+	code := cmdHook(nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
@@ -169,7 +169,7 @@ start_command = "true"
 	}
 
 	var stdout, stderr bytes.Buffer
-	code := cmdHook(nil, false, &stdout, &stderr)
+	code := cmdHook(nil, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("cmdHook() = %d, want 0; stderr=%s", code, stderr.String())
 	}
diff --git a/cmd/gc/session_model_phase0_rare_state_spec_test.go b/cmd/gc/session_model_phase0_rare_state_spec_test.go
index 7630b8eb07..0abed3e362 100644
--- a/cmd/gc/session_model_phase0_rare_state_spec_test.go
+++ b/cmd/gc/session_model_phase0_rare_state_spec_test.go
@@ -156,14 +156,14 @@ func TestPhase0ConfigDrift_IdleNamedSessionRestartsInPlaceWithoutCapVacancy(t *t
 	if all[0].Status != "open" {
 		t.Fatalf("status = %q, want open while live restart is in progress", all[0].Status)
 	}
-	if got := all[0].Metadata["state"]; got != "creating" {
-		t.Fatalf("state = %q, want creating for idle config-drift restart without cap vacancy", got)
+	if got := all[0].Metadata["state"]; got != "active" {
+		t.Fatalf("state = %q, want active after same-tick config-drift restart", got)
 	}
-	if got := all[0].Metadata["started_config_hash"]; got != "" {
-		t.Fatalf("started_config_hash = %q, want cleared so next start uses fresh config", got)
+	if got := all[0].Metadata["started_config_hash"]; got == "" || got == runtime.CoreFingerprint(oldRuntime) {
+		t.Fatalf("started_config_hash = %q, want non-empty fresh config hash", got)
 	}
-	if got := all[0].Metadata["continuation_reset_pending"]; got != "true" {
-		t.Fatalf("continuation_reset_pending = %q, want true for unified restart path", got)
+	if got := all[0].Metadata["continuation_reset_pending"]; got != "" {
+		t.Fatalf("continuation_reset_pending = %q, want cleared after same-tick wake", got)
 	}
 }
 
@@ -235,8 +235,8 @@ func TestPhase0ConfigDrift_NamedSessionBoundsRecentActivityDeferral(t *testing.T
 	if err != nil {
 		t.Fatalf("Get(%s) after deferral limit: %v", session.ID, err)
 	}
-	if got.Metadata["state"] != "creating" {
-		t.Fatalf("state = %q, want creating after bounded recent-activity deferral", got.Metadata["state"])
+	if got.Metadata["state"] != "active" {
+		t.Fatalf("state = %q, want active after bounded recent-activity restart", got.Metadata["state"])
 	}
 	if got.Metadata[namedSessionConfigDriftDeferredAtMetadata] != "" {
 		t.Fatalf("deferred timestamp = %q, want cleared after restart", got.Metadata[namedSessionConfigDriftDeferredAtMetadata])
@@ -293,8 +293,8 @@ func TestPhase0ConfigDrift_NamedSessionDrainsWhenStaleActivity(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Get(%s): %v", session.ID, err)
 	}
-	if got.Metadata["state"] != "creating" {
-		t.Fatalf("state = %q, want creating for stale-activity config-drift restart", got.Metadata["state"])
+	if got.Metadata["state"] != "active" {
+		t.Fatalf("state = %q, want active after stale-activity config-drift restart", got.Metadata["state"])
 	}
 }
 
@@ -437,8 +437,8 @@ func TestShouldDeferNamedSessionConfigDriftBoundsUnknownActivity(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Get session bead after new drift: %v", err)
 	}
-	if err := clearNamedSessionConfigDriftDeferral(session, store); err != nil {
-		t.Fatalf("clearNamedSessionConfigDriftDeferral: %v", err)
+	if err := clearSessionConfigDriftDeferral(session, store); err != nil {
+		t.Fatalf("clearSessionConfigDriftDeferral: %v", err)
 	}
 	session, err = store.Get(session.ID)
 	if err != nil {
@@ -570,6 +570,311 @@ func TestPhase0ConfigDrift_AsleepNamedSessionRepairsInPlaceWithoutWaking(t *test
 	}
 }
 
+func TestConfigDrift_AttachedSessionPersistsAcrossCycles(t *testing.T) {
+	// Config-drift deferral for attached sessions must persist across
+	// reconciler cycles — the session must never be killed while attached.
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "new-cmd",
+			MaxActiveSessions: intPtr(1),
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "worker",
+			Mode:     "always",
+		}},
+	}
+
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		TemplateName:            "worker",
+		InstanceName:            "worker",
+		Alias:                   "worker",
+		Command:                 "new-cmd",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+	}
+
+	oldRuntime := runtime.Config{Command: "old-cmd"}
+	if err := env.sp.Start(context.Background(), sessionName, oldRuntime); err != nil {
+		t.Fatalf("Start(old runtime): %v", err)
+	}
+	env.sp.SetAttached(sessionName, true)
+
+	session := env.createSessionBead(sessionName, "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"session_key":                "old-provider-conversation",
+		"started_config_hash":        runtime.CoreFingerprint(oldRuntime),
+		"started_live_hash":          runtime.LiveFingerprint(oldRuntime),
+	})
+
+	// Run multiple reconcile cycles — session must survive all of them.
+	for i := 0; i < 5; i++ {
+		env.clk.Time = env.clk.Now().Add(10 * time.Second)
+		got, err := env.store.Get(session.ID)
+		if err != nil {
+			t.Fatalf("cycle %d: Get(%s): %v", i, session.ID, err)
+		}
+		env.reconcile([]beads.Bead{got})
+
+		if !env.sp.IsRunning(sessionName) {
+			t.Fatalf("cycle %d: attached session was stopped during config-drift", i)
+		}
+		got, err = env.store.Get(session.ID)
+		if err != nil {
+			t.Fatalf("cycle %d: Get after reconcile: %v", i, err)
+		}
+		if got.Metadata["state"] == "creating" {
+			t.Fatalf("cycle %d: state = creating; want deferred", i)
+		}
+		if got.Metadata["started_config_hash"] == "" {
+			t.Fatalf("cycle %d: started_config_hash cleared; want preserved", i)
+		}
+	}
+}
+
+func TestConfigDrift_AttachedSessionSurvivesTransientFalseNegative(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "new-cmd",
+			MaxActiveSessions: intPtr(1),
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "worker",
+			Mode:     "always",
+		}},
+	}
+
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		TemplateName:            "worker",
+		InstanceName:            "worker",
+		Alias:                   "worker",
+		Command:                 "new-cmd",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+	}
+
+	oldRuntime := runtime.Config{Command: "old-cmd"}
+	oldStartedHash := runtime.CoreFingerprint(oldRuntime)
+	if err := env.sp.Start(context.Background(), sessionName, oldRuntime); err != nil {
+		t.Fatalf("Start(old runtime): %v", err)
+	}
+	env.sp.SetAttached(sessionName, true)
+
+	session := env.createSessionBead(sessionName, "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"session_key":                "old-provider-conversation",
+		"started_config_hash":        oldStartedHash,
+		"started_live_hash":          runtime.LiveFingerprint(oldRuntime),
+	})
+
+	env.reconcile([]beads.Bead{session})
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after attached deferral: %v", err)
+	}
+	if got.Metadata["started_config_hash"] == "" {
+		t.Fatal("started_config_hash cleared during attached deferral")
+	}
+	if got.Metadata[sessionAttachedConfigDriftDeferredAtMetadata] == "" {
+		t.Fatal("attached config-drift deferral timestamp was not recorded")
+	}
+
+	env.clk.Time = env.clk.Now().Add(10 * time.Second)
+	falseAttached := make([]bool, 100)
+	env.sp.SetAttachedSequence(sessionName, falseAttached...)
+	env.reconcile([]beads.Bead{got})
+
+	got, err = env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after false-negative cycle: %v", err)
+	}
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatal("attached session was stopped after one false-negative attachment cycle")
+	}
+	if got.Metadata["state"] == "creating" {
+		t.Fatalf("state = creating after false-negative cycle; want deferred")
+	}
+	if got.Metadata["started_config_hash"] != oldStartedHash {
+		t.Fatalf("started_config_hash = %q after false-negative cycle; want preserved old hash %q", got.Metadata["started_config_hash"], oldStartedHash)
+	}
+	if got.Metadata["session_key"] != "old-provider-conversation" {
+		t.Fatalf("session_key = %q after false-negative cycle; want old provider conversation preserved", got.Metadata["session_key"])
+	}
+}
+
+func TestConfigDrift_DetachAllowsDriftToResume(t *testing.T) {
+	// After an attached session detaches, config-drift should proceed
+	// with restart-in-place for named sessions.
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "new-cmd",
+			MaxActiveSessions: intPtr(1),
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "worker",
+			Mode:     "always",
+		}},
+	}
+
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		TemplateName:            "worker",
+		InstanceName:            "worker",
+		Alias:                   "worker",
+		Command:                 "new-cmd",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+	}
+
+	oldRuntime := runtime.Config{Command: "old-cmd"}
+	if err := env.sp.Start(context.Background(), sessionName, oldRuntime); err != nil {
+		t.Fatalf("Start(old runtime): %v", err)
+	}
+	env.sp.SetAttached(sessionName, true)
+
+	session := env.createSessionBead(sessionName, "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"session_key":                "old-provider-conversation",
+		"started_config_hash":        runtime.CoreFingerprint(oldRuntime),
+		"started_live_hash":          runtime.LiveFingerprint(oldRuntime),
+	})
+
+	// Cycle 1: Attached → deferred.
+	env.reconcile([]beads.Bead{session})
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatal("cycle 1: attached session was stopped; want deferred")
+	}
+
+	// Detach and ensure no recent activity.
+	env.sp.SetAttached(sessionName, false)
+	env.sp.SetActivity(sessionName, env.clk.Now().Add(-5*time.Minute))
+	env.clk.Time = env.clk.Now().Add(sessionAttachedConfigDriftFalseNegativeLimit + time.Second)
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after detach: %v", err)
+	}
+
+	// Cycle 2: Detached + stale activity means drift proceeds. Current
+	// reconciler behavior restarts the named session in place and wakes it
+	// in the same tick.
+	env.reconcile([]beads.Bead{got})
+
+	got, err = env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after drift: %v", err)
+	}
+	if got.Metadata["state"] != "active" {
+		t.Fatalf("state = %q after detach; want active after drift restart", got.Metadata["state"])
+	}
+	if got.Metadata["started_config_hash"] == runtime.CoreFingerprint(oldRuntime) {
+		t.Fatalf("started_config_hash still points at old runtime after drift restart")
+	}
+}
+
+func TestConfigDrift_AttachedPoolSessionDefersAcrossCycles(t *testing.T) {
+	// Non-named (pool) sessions that are attached should also defer
+	// config-drift across multiple reconciler cycles.
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Agents: []config.Agent{{Name: "worker", StartCommand: "new-cmd"}},
+	}
+	env.addRunningWorkerDesiredWithNewConfig()
+
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	startedHash := runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"})
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": startedHash,
+	})
+	env.sp.SetAttached("worker", true)
+
+	for i := 0; i < 3; i++ {
+		env.clk.Time = env.clk.Now().Add(10 * time.Second)
+		got, err := env.store.Get(session.ID)
+		if err != nil {
+			t.Fatalf("cycle %d: Get(%s): %v", i, session.ID, err)
+		}
+		env.reconcile([]beads.Bead{got})
+
+		ds := env.dt.get(session.ID)
+		if ds != nil {
+			t.Fatalf("cycle %d: attached pool session should not be drained, got: %+v", i, ds)
+		}
+	}
+}
+
+func TestConfigDrift_AttachedPoolSessionSurvivesTransientFalseNegative(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Agents: []config.Agent{{Name: "worker", StartCommand: "new-cmd"}},
+	}
+	env.addRunningWorkerDesiredWithNewConfig()
+
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	oldHash := runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"})
+	env.setSessionMetadata(&session, map[string]string{
+		"session_key":         "old-provider-conversation",
+		"started_config_hash": oldHash,
+	})
+	env.sp.SetAttached("worker", true)
+
+	env.reconcile([]beads.Bead{session})
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after attached deferral: %v", err)
+	}
+	if got.Metadata[sessionAttachedConfigDriftDeferredAtMetadata] == "" {
+		t.Fatal("attached config-drift deferral timestamp was not recorded")
+	}
+
+	env.clk.Time = env.clk.Now().Add(10 * time.Second)
+	falseAttached := make([]bool, 100)
+	env.sp.SetAttachedSequence("worker", falseAttached...)
+	env.reconcile([]beads.Bead{got})
+
+	got, err = env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after false-negative cycle: %v", err)
+	}
+	if !env.sp.IsRunning("worker") {
+		t.Fatal("attached pool session was stopped after one false-negative attachment cycle")
+	}
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("attached pool session should not be drained after false-negative cycle, got %+v", ds)
+	}
+	if got.Metadata["started_config_hash"] != oldHash {
+		t.Fatalf("started_config_hash = %q after false-negative cycle; want %q", got.Metadata["started_config_hash"], oldHash)
+	}
+	if got.Metadata["session_key"] != "old-provider-conversation" {
+		t.Fatalf("session_key = %q after false-negative cycle; want old provider conversation preserved", got.Metadata["session_key"])
+	}
+}
+
 func TestPhase0CanonicalRepair_DuplicateOpenNamedBeadsRetiresLosersNonTerminally(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
diff --git a/cmd/gc/session_model_phase0_workflow_spec_test.go b/cmd/gc/session_model_phase0_workflow_spec_test.go
index cb6ebef1de..87fd78e711 100644
--- a/cmd/gc/session_model_phase0_workflow_spec_test.go
+++ b/cmd/gc/session_model_phase0_workflow_spec_test.go
@@ -231,8 +231,11 @@ func TestPhase0WorkflowRouting_ControlStepPreservesExecutionConfigLane(t *testin
 	if check == nil {
 		t.Fatal("scope-check step missing after decorate")
 	}
-	if got := check.Metadata["gc.routed_to"]; got != "frontend/control-dispatcher" {
-		t.Fatalf("scope-check gc.routed_to = %q, want frontend/control-dispatcher", got)
+	if got := check.Assignee; got != "frontend--control-dispatcher" {
+		t.Fatalf("scope-check assignee = %q, want frontend--control-dispatcher", got)
+	}
+	if got := check.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("scope-check gc.routed_to = %q, want empty direct dispatcher assignee", got)
 	}
 	if got := check.Metadata[graphExecutionRouteMetaKey]; got != "frontend/codex" {
 		t.Fatalf("scope-check execution route = %q, want frontend/codex", got)
diff --git a/cmd/gc/session_name_lookup.go b/cmd/gc/session_name_lookup.go
index f071fc1c79..018abfc324 100644
--- a/cmd/gc/session_name_lookup.go
+++ b/cmd/gc/session_name_lookup.go
@@ -2,7 +2,10 @@ package main
 
 import (
 	"fmt"
+	"sort"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/agent"
 	"github.com/gastownhall/gascity/internal/beads"
@@ -22,24 +25,121 @@ func isPoolManagedSessionBead(bead beads.Bead) bool {
 	return strings.TrimSpace(bead.Metadata["pool_slot"]) != ""
 }
 
+func resolveLegacyPoolTemplate(cfg *config.City, storedTemplate string) string {
+	storedTemplate = strings.TrimSpace(storedTemplate)
+	if cfg == nil || storedTemplate == "" {
+		return ""
+	}
+	if findAgentByTemplate(cfg, storedTemplate) != nil {
+		return storedTemplate
+	}
+	match := ""
+	for i := range cfg.Agents {
+		agentCfg := &cfg.Agents[i]
+		if !agentCfg.SupportsInstanceExpansion() {
+			continue
+		}
+		_, localTemplate := config.ParseQualifiedName(agentCfg.QualifiedName())
+		if localTemplate != storedTemplate {
+			continue
+		}
+		if match != "" && match != agentCfg.QualifiedName() {
+			return ""
+		}
+		match = agentCfg.QualifiedName()
+	}
+	return match
+}
+
+func sessionBeadStoredTemplate(bead beads.Bead) string {
+	storedTemplate := strings.TrimSpace(bead.Metadata["template"])
+	if storedTemplate != "" {
+		return storedTemplate
+	}
+	return strings.TrimSpace(bead.Metadata["common_name"])
+}
+
+func resolvedTemplateForIdentity(identity string, cfg *config.City) string {
+	identity = strings.TrimSpace(identity)
+	if cfg == nil || identity == "" {
+		return ""
+	}
+	if findAgentByTemplate(cfg, identity) != nil {
+		return identity
+	}
+	if resolved := resolveLegacyPoolTemplate(cfg, identity); resolved != "" {
+		return resolved
+	}
+	match := ""
+	for i := range cfg.Agents {
+		agentCfg := &cfg.Agents[i]
+		if !agentCfg.SupportsInstanceExpansion() {
+			continue
+		}
+		slot := resolvePersistedPoolIdentitySlot(agentCfg, true, identity)
+		if slot <= 0 {
+			continue
+		}
+		if poolSlotHasConfiguredBound(agentCfg) && !inBoundsPoolSlot(agentCfg, slot) {
+			continue
+		}
+		if match != "" && match != agentCfg.QualifiedName() {
+			return ""
+		}
+		match = agentCfg.QualifiedName()
+	}
+	return match
+}
+
+func resolvedSessionTemplate(bead beads.Bead, cfg *config.City) string {
+	template := normalizedSessionTemplate(bead, cfg)
+	if template != "" && (cfg == nil || findAgentByTemplate(cfg, template) != nil) {
+		return template
+	}
+	storedTemplate := sessionBeadStoredTemplate(bead)
+	if storedTemplate == "" {
+		return ""
+	}
+	if resolved := resolveLegacyPoolTemplate(cfg, storedTemplate); resolved != "" {
+		return resolved
+	}
+	return storedTemplate
+}
+
+func storedTemplateMatchesPoolTemplate(storedTemplate, template string, cfg *config.City) bool {
+	storedTemplate = strings.TrimSpace(storedTemplate)
+	template = strings.TrimSpace(template)
+	if storedTemplate == "" || template == "" {
+		return false
+	}
+	if storedTemplate == template {
+		return true
+	}
+	return resolveLegacyPoolTemplate(cfg, storedTemplate) == template
+}
+
 func createPoolSessionBead(
 	store beads.Store,
 	template string,
 	sessionBeads *sessionBeadSnapshot,
+	now time.Time,
 ) (beads.Bead, error) {
 	if store == nil {
 		return beads.Bead{}, fmt.Errorf("session store unavailable for pool template %q", template)
 	}
+	instanceToken := sessionpkg.NewInstanceToken()
 	meta := map[string]string{
-		"template":             template,
-		"agent_name":           template,
-		"state":                "creating",
-		"pending_create_claim": "true",
-		"session_origin":       "ephemeral",
-		"generation":           "1",
-		"continuation_epoch":   "1",
-		"instance_token":       sessionpkg.NewInstanceToken(),
-		poolManagedMetadataKey: boolMetadata(true),
+		"template":                  template,
+		"agent_name":                template,
+		"state":                     "creating",
+		"pending_create_claim":      "true",
+		"pending_create_started_at": pendingCreateStartedAtNow(now),
+		"session_origin":            "ephemeral",
+		"generation":                "1",
+		"continuation_epoch":        "1",
+		"instance_token":            instanceToken,
+		"session_name":              pendingPoolSessionName(template, instanceToken),
+		poolManagedMetadataKey:      boolMetadata(true),
 	}
 	bead, err := store.Create(beads.Bead{
 		Title:    targetBasename(template),
@@ -127,10 +227,13 @@ func normalizedSessionTemplate(bead beads.Bead, cfg *config.City) string {
 	}
 	agentName := sessionBeadAgentName(bead)
 	if agentName != "" {
-		if resolved := resolveAgentTemplate(agentName, cfg); resolved != "" && findAgentByTemplate(cfg, resolved) != nil {
+		if resolved := resolvedTemplateForIdentity(agentName, cfg); resolved != "" {
 			return resolved
 		}
 	}
+	if resolved := resolvedTemplateForIdentity(strings.TrimSpace(bead.Metadata["alias"]), cfg); resolved != "" {
+		return resolved
+	}
 	return template
 }
 
@@ -144,11 +247,66 @@ func normalizedSessionTemplate(bead beads.Bead, cfg *config.City) string {
 // beads with an agent_name field matching the query. If no agent_name match
 // is found, falls back to template/common_name matching.
 func findSessionNameByTemplate(store beads.Store, template string) string {
-	snapshot, err := loadSessionBeadSnapshot(store)
+	template = strings.TrimSpace(template)
+	if store == nil || template == "" {
+		return ""
+	}
+	if sn := findSessionNameByMetadata(store, "agent_name", template, true); sn != "" {
+		return sn
+	}
+	if sn := findSessionNameByAgentLabel(store, template); sn != "" {
+		return sn
+	}
+	if sn := findSessionNameByMetadata(store, "template", template, false); sn != "" {
+		return sn
+	}
+	return findSessionNameByMetadata(store, "common_name", template, false)
+}
+
+func findSessionNameByAgentLabel(store beads.Store, template string) string {
+	items, err := store.List(beads.ListQuery{Label: "agent:" + template})
+	if err != nil {
+		return ""
+	}
+	return chooseSessionNameForTemplate(store, items, true, "", "")
+}
+
+func findSessionNameByMetadata(store beads.Store, key, value string, agentNameMatch bool) string {
+	items, err := sessionpkg.ExactMetadataSessionCandidates(store, false, map[string]string{key: value})
 	if err != nil {
 		return ""
 	}
-	return snapshot.FindSessionNameByTemplate(template)
+	return chooseSessionNameForTemplate(store, items, agentNameMatch, key, value)
+}
+
+func chooseSessionNameForTemplate(store beads.Store, items []beads.Bead, agentNameMatch bool, key, value string) string {
+	var fallback string
+	for _, b := range items {
+		if !sessionpkg.IsSessionBeadOrRepairable(b) || b.Status == "closed" {
+			continue
+		}
+		sessionpkg.RepairEmptyType(store, &b)
+		if key != "" && strings.TrimSpace(b.Metadata[key]) != value {
+			continue
+		}
+		if agentNameMatch && isPoolManagedSessionBead(b) && sessionBeadAgentName(b) == b.Metadata["template"] {
+			continue
+		}
+		if !agentNameMatch && isPoolManagedSessionBead(b) {
+			continue
+		}
+		sessionName := strings.TrimSpace(b.Metadata["session_name"])
+		if sessionName == "" {
+			continue
+		}
+		if strings.TrimSpace(b.Metadata["configured_named_identity"]) != "" {
+			return sessionName
+		}
+		if fallback == "" {
+			fallback = sessionName
+		}
+	}
+	return fallback
 }
 
 // lookupSessionName resolves a qualified agent name to its bead-derived
@@ -182,8 +340,32 @@ func lookupSessionNameOrLegacy(store beads.Store, cityName, qualifiedName, sessi
 // under the given template-qualified agent. The result maps the logical
 // instance qualified name (for example "frontend/worker-1") to the actual
 // runtime session name.
-func lookupPoolSessionNames(store beads.Store, template string) (map[string]string, error) {
-	result := make(map[string]string)
+type poolLookupCandidate struct {
+	sessionName         string
+	score               int
+	stateRank           int
+	ownsPoolSessionName bool
+}
+
+func poolLookupCandidateStateRank(b beads.Bead) int {
+	switch sessionMetadataState(b) {
+	case "active":
+		return 2
+	case "creating":
+		return 1
+	default:
+		return 0
+	}
+}
+
+func poolLookupCandidatesEquivalent(a, b poolLookupCandidate) bool {
+	return a.score == b.score &&
+		a.stateRank == b.stateRank &&
+		a.ownsPoolSessionName == b.ownsPoolSessionName
+}
+
+func lookupPoolSessionNameCandidates(store beads.Store, template string, cfg *config.City, cfgAgent *config.Agent) (map[string][]poolLookupCandidate, error) {
+	result := make(map[string][]poolLookupCandidate)
 	if store == nil {
 		return result, nil
 	}
@@ -197,23 +379,144 @@ func lookupPoolSessionNames(store beads.Store, template string) (map[string]stri
 		if !sessionpkg.IsSessionBeadOrRepairable(b) {
 			continue
 		}
-		if b.Status == "closed" || b.Metadata["pool_slot"] == "" {
+		if b.Status == "closed" {
 			continue
 		}
-		agentName := sessionBeadAgentName(b)
-		if b.Metadata["template"] != template && resolvePoolSlot(agentName, template) == 0 {
+		if isNamedSessionBead(b) || isManualSessionBeadForAgent(b, cfgAgent) {
+			continue
+		}
+		storedTemplateMatches := storedTemplateMatchesPoolTemplate(sessionBeadStoredTemplate(b), template, cfg)
+		resolveSlot := func(identity string) int {
+			if cfgAgent != nil {
+				return resolvePersistedPoolIdentitySlot(cfgAgent, storedTemplateMatches, identity)
+			}
+			return 0
+		}
+		qualifiedInstanceName := func(slot int) string {
+			if cfgAgent != nil {
+				return cfgAgent.QualifiedInstanceName(poolInstanceName(cfgAgent.Name, slot, cfgAgent))
+			}
+			return template + "-" + strconv.Itoa(slot)
+		}
+		agentSlot := resolveSlot(sessionBeadAgentName(b))
+		aliasSlot := resolveSlot(strings.TrimSpace(b.Metadata["alias"]))
+		sessionName := strings.TrimSpace(b.Metadata["session_name"])
+		sessionNameSlot := 0
+		if storedTemplateMatches && strings.TrimSpace(b.Metadata["alias"]) == "" && !beadOwnsPoolSessionName(b) {
+			sessionNameSlot = resolveSlot(sessionName)
+		}
+		if cfgAgent != nil && poolSlotHasConfiguredBound(cfgAgent) {
+			if agentSlot > 0 && !inBoundsPoolSlot(cfgAgent, agentSlot) {
+				agentSlot = 0
+			}
+			if aliasSlot > 0 && !inBoundsPoolSlot(cfgAgent, aliasSlot) {
+				aliasSlot = 0
+			}
+			if sessionNameSlot > 0 && !inBoundsPoolSlot(cfgAgent, sessionNameSlot) {
+				sessionNameSlot = 0
+			}
+		}
+		if !storedTemplateMatches && agentSlot == 0 && aliasSlot == 0 {
 			continue
 		}
-		sessionName := b.Metadata["session_name"]
 		if sessionName == "" {
 			continue
 		}
+		agentName := sessionBeadAgentName(b)
+		if storedTemplateMatches && (agentName == template || agentName == targetBasename(template)) {
+			agentName = ""
+		}
+		switch {
+		case agentSlot > 0:
+			agentName = qualifiedInstanceName(agentSlot)
+		case aliasSlot > 0:
+			agentName = qualifiedInstanceName(aliasSlot)
+		case sessionNameSlot > 0:
+			agentName = qualifiedInstanceName(sessionNameSlot)
+		case agentName == "" && storedTemplateMatches && strings.TrimSpace(b.Metadata["pool_slot"]) != "":
+			if slot, err := strconv.Atoi(strings.TrimSpace(b.Metadata["pool_slot"])); err == nil && slot > 0 {
+				if cfgAgent == nil || !poolSlotHasConfiguredBound(cfgAgent) || inBoundsPoolSlot(cfgAgent, slot) {
+					agentName = qualifiedInstanceName(slot)
+				}
+			}
+		}
 		if agentName == "" {
-			agentName = template + "-" + b.Metadata["pool_slot"]
+			continue
+		}
+		score := 0
+		if strings.TrimSpace(b.Metadata["pool_slot"]) != "" {
+			score += 2
+		}
+		if strings.TrimSpace(b.Metadata["template"]) == template {
+			score++
+		}
+		if agentSlot > 0 {
+			score += 2
+		}
+		if aliasSlot > 0 {
+			score++
+		}
+		candidate := poolLookupCandidate{
+			sessionName:         sessionName,
+			score:               score,
+			stateRank:           poolLookupCandidateStateRank(b),
+			ownsPoolSessionName: beadOwnsPoolSessionName(b),
 		}
-		if agentName != "" {
-			result[agentName] = sessionName
+		existing := result[agentName]
+		replaced := false
+		for idx := range existing {
+			if existing[idx].sessionName != sessionName {
+				continue
+			}
+			if candidate.score > existing[idx].score ||
+				(candidate.score == existing[idx].score && candidate.stateRank > existing[idx].stateRank) ||
+				(candidate.score == existing[idx].score && candidate.stateRank == existing[idx].stateRank && candidate.ownsPoolSessionName && !existing[idx].ownsPoolSessionName) {
+				existing[idx] = candidate
+			}
+			replaced = true
+			break
+		}
+		if !replaced {
+			existing = append(existing, candidate)
+		}
+		result[agentName] = existing
+	}
+	for agentName, candidates := range result {
+		sort.Slice(candidates, func(i, j int) bool {
+			if candidates[i].score != candidates[j].score {
+				return candidates[i].score > candidates[j].score
+			}
+			if candidates[i].stateRank != candidates[j].stateRank {
+				return candidates[i].stateRank > candidates[j].stateRank
+			}
+			if candidates[i].ownsPoolSessionName != candidates[j].ownsPoolSessionName {
+				return candidates[i].ownsPoolSessionName
+			}
+			return candidates[i].sessionName < candidates[j].sessionName
+		})
+		result[agentName] = candidates
+	}
+	return result, nil
+}
+
+func lookupPoolSessionNames(store beads.Store, cfg *config.City, cfgAgent *config.Agent) (map[string]string, error) {
+	template := ""
+	if cfgAgent != nil {
+		template = cfgAgent.QualifiedName()
+	}
+	candidates, err := lookupPoolSessionNameCandidates(store, template, cfg, cfgAgent)
+	if err != nil {
+		return nil, err
+	}
+	result := make(map[string]string, len(candidates))
+	for agentName, ranked := range candidates {
+		if len(ranked) == 0 {
+			continue
+		}
+		if len(ranked) > 1 && poolLookupCandidatesEquivalent(ranked[0], ranked[1]) && ranked[0].sessionName != ranked[1].sessionName {
+			continue
 		}
+		result[agentName] = ranked[0].sessionName
 	}
 	return result, nil
 }
diff --git a/cmd/gc/session_name_lookup_test.go b/cmd/gc/session_name_lookup_test.go
index f11973c2d6..0029f76984 100644
--- a/cmd/gc/session_name_lookup_test.go
+++ b/cmd/gc/session_name_lookup_test.go
@@ -2,14 +2,17 @@ package main
 
 import (
 	"testing"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
 )
 
 func TestCreatePoolSessionBead_SetsPendingCreateClaim(t *testing.T) {
 	store := beads.NewMemStore()
+	now := time.Date(2026, 5, 1, 9, 15, 0, 0, time.UTC)
 
-	bead, err := createPoolSessionBead(store, "gascity/claude", nil)
+	bead, err := createPoolSessionBead(store, "gascity/claude", nil, now)
 	if err != nil {
 		t.Fatalf("createPoolSessionBead: %v", err)
 	}
@@ -17,6 +20,9 @@ func TestCreatePoolSessionBead_SetsPendingCreateClaim(t *testing.T) {
 	if got := bead.Metadata["pending_create_claim"]; got != "true" {
 		t.Fatalf("pending_create_claim = %q, want true", got)
 	}
+	if got, want := bead.Metadata["pending_create_started_at"], pendingCreateStartedAtNow(now); got != want {
+		t.Fatalf("pending_create_started_at = %q, want %q", got, want)
+	}
 
 	stored, err := store.Get(bead.ID)
 	if err != nil {
@@ -25,4 +31,57 @@ func TestCreatePoolSessionBead_SetsPendingCreateClaim(t *testing.T) {
 	if got := stored.Metadata["pending_create_claim"]; got != "true" {
 		t.Fatalf("stored pending_create_claim = %q, want true", got)
 	}
+	if got, want := stored.Metadata["pending_create_started_at"], pendingCreateStartedAtNow(now); got != want {
+		t.Fatalf("stored pending_create_started_at = %q, want %q", got, want)
+	}
+}
+
+func TestResolvedTemplateForIdentity_ResolvesUniqueInBoundsLegacyLocalPoolIdentity(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(1)},
+		},
+	}
+
+	if got := resolvedTemplateForIdentity("worker-5", cfg); got != "frontend/worker" {
+		t.Fatalf("resolvedTemplateForIdentity(worker-5) = %q, want %q", got, "frontend/worker")
+	}
+}
+
+func TestResolvedTemplateForIdentity_DoesNotResolveAmbiguousLegacyLocalPoolIdentity(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+			{Name: "worker", Dir: "backend", MaxActiveSessions: intPtr(5)},
+		},
+	}
+
+	if got := resolvedTemplateForIdentity("worker-7", cfg); got != "" {
+		t.Fatalf("resolvedTemplateForIdentity(worker-7) = %q, want unresolved ambiguity", got)
+	}
+}
+
+func TestResolvedTemplateForIdentity_DoesNotResolveZeroCapacityLocalIdentity(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(0)},
+		},
+	}
+
+	if got := resolvedTemplateForIdentity("worker-1", cfg); got != "" {
+		t.Fatalf("resolvedTemplateForIdentity(worker-1) = %q, want zero-capacity template to stay unresolved", got)
+	}
+}
+
+func TestResolvedTemplateForIdentity_DoesNotResolveOutOfBoundsQualifiedPoolIdentity(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{
+			{Name: "worker", Dir: "frontend", MaxActiveSessions: intPtr(5)},
+		},
+	}
+
+	if got := resolvedTemplateForIdentity("frontend/worker-7", cfg); got != "" {
+		t.Fatalf("resolvedTemplateForIdentity(frontend/worker-7) = %q, want unresolved out-of-bounds identity", got)
+	}
 }
diff --git a/cmd/gc/session_reconcile.go b/cmd/gc/session_reconcile.go
index 53c84a8e5f..bc02497223 100644
--- a/cmd/gc/session_reconcile.go
+++ b/cmd/gc/session_reconcile.go
@@ -28,7 +28,10 @@ import (
 )
 
 type wakeEvaluation struct {
-	Reasons          []WakeReason
+	Reasons []WakeReason
+	// Reason mirrors AwakeDecision.Reason on the ComputeAwakeSet bridge path.
+	// It is only actionable when Reasons contains the matching effective wake.
+	Reason           string
 	Policy           resolvedSessionSleepPolicy
 	ConfigSuppressed bool
 }
@@ -173,6 +176,12 @@ func sessionStartRequested(session beads.Bead, clk clock.Clock) bool {
 	return !staleCreatingState(session, clk)
 }
 
+// staleCreatingStateTimeout bounds how long a state=creating bead may sit
+// before generic creating metadata and corrupt start leases roll back. It is
+// measured from the pending-create transition (see staleCreatingState below),
+// not from the bead row's CreatedAt, so configured named-session reopens get a
+// fresh window each time the bead is reopened. Pending creates that never
+// reached preWakeCommit use pendingCreateNeverStartedTimeout instead.
 const staleCreatingStateTimeout = time.Minute
 
 func sessionMetadataState(session beads.Bead) string {
@@ -482,13 +491,78 @@ func healExpiredTimers(session *beads.Bead, store beads.Store, clk clock.Clock)
 	}
 }
 
-// checkStability detects rapid exits. If a session was woken within
-// stabilityThreshold and is already dead, counts as a crash.
-// Returns true if a failure was recorded (caller should skip recordWakeFailure).
+// checkStability detects dead sessions that still have last_woke_at. Provider
+// rate-limit screens are retried until the hold metadata persists; ordinary
+// crash wake failures are counted only inside stabilityThreshold.
+//
+// Production callers must run checkRateLimitStability before healState and
+// pass nil here after healing. That ordering preserves continuation metadata
+// for provider rate-limit screens while still letting crash recovery clear
+// stale continuation identity after advisory state has been healed.
+// Returns true if a stability event was recorded.
 // Edge-triggered: clears last_woke_at after recording so the same crash
 // is counted exactly once.
 // Drain-aware: draining sessions died by request, not by crash.
-func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, store beads.Store, clk clock.Clock) bool {
+func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, store beads.Store, clk clock.Clock, peek func(lines int) (string, error)) bool {
+	if handled, err := checkRateLimitStability(session, cfg, alive, dt, store, clk, peek); handled || err != nil {
+		return true
+	}
+	if !rapidExitWithinStabilityThreshold(session, cfg, alive, dt, clk) {
+		return false
+	}
+	recordWakeFailure(session, store, clk)
+	clearLastWokeAt(session, store)
+	return true
+}
+
+func checkRateLimitStability(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, store beads.Store, clk clock.Clock, peek func(lines int) (string, error)) (bool, error) {
+	if !rateLimitStabilityCandidate(session, cfg, alive, dt, clk) {
+		return false, nil
+	}
+	if peek == nil {
+		return false, nil
+	}
+	content, err := peek(rateLimitPeekLines)
+	if err != nil {
+		return false, nil
+	}
+	if !runtime.ContainsProviderRateLimitScreen(content) {
+		return false, nil
+	}
+	if err := recordRateLimitQuarantine(session, store, clk); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func rateLimitStabilityCandidate(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, clk clock.Clock) bool {
+	if session == nil || alive {
+		return false
+	}
+	if cfg != nil && cfg.Session.Provider == "subprocess" {
+		return false
+	}
+	if dt != nil && dt.get(session.ID) != nil {
+		return false
+	}
+	lastWoke := session.Metadata["last_woke_at"]
+	if lastWoke == "" {
+		return false
+	}
+	var startupTimeout time.Duration
+	if cfg != nil {
+		startupTimeout = cfg.Session.StartupTimeoutDuration()
+	}
+	if pendingCreateStartInFlight(*session, clk, startupTimeout) {
+		return false
+	}
+	if _, err := time.Parse(time.RFC3339, lastWoke); err != nil {
+		return false
+	}
+	return true
+}
+
+func rapidExitWithinStabilityThreshold(session *beads.Bead, cfg *config.City, alive bool, dt *drainTracker, clk clock.Clock) bool {
 	if alive {
 		return false
 	}
@@ -506,18 +580,49 @@ func checkStability(session *beads.Bead, cfg *config.City, alive bool, dt *drain
 	if lastWoke == "" {
 		return false
 	}
+	var startupTimeout time.Duration
+	if cfg != nil {
+		startupTimeout = cfg.Session.StartupTimeoutDuration()
+	}
+	if pendingCreateStartInFlight(*session, clk, startupTimeout) {
+		return false
+	}
 	t, err := time.Parse(time.RFC3339, lastWoke)
 	if err != nil {
 		return false
 	}
-	if clk.Now().Sub(t) < stabilityThreshold {
-		recordWakeFailure(session, store, clk)
-		// Clear last_woke_at so this crash is not re-counted next tick.
-		_ = store.SetMetadata(session.ID, "last_woke_at", "")
-		session.Metadata["last_woke_at"] = ""
-		return true
+	return clk.Now().Sub(t) < stabilityThreshold
+}
+
+func clearLastWokeAt(session *beads.Bead, store beads.Store) {
+	_ = store.SetMetadata(session.ID, "last_woke_at", "")
+	session.Metadata["last_woke_at"] = ""
+}
+
+// recordRateLimitQuarantine backs off a session that exited into a provider
+// rate-limit screen without treating the exit as a crash or resetting its
+// conversation metadata.
+func recordRateLimitQuarantine(session *beads.Bead, store beads.Store, clk clock.Clock) error {
+	if session.Metadata == nil {
+		session.Metadata = make(map[string]string)
 	}
-	return false
+	qUntil := clk.Now().Add(defaultRateLimitQuarantineDuration).UTC().Format(time.RFC3339)
+	batch := map[string]string{
+		"state":                     string(sessionpkg.StateAsleep),
+		"quarantined_until":         qUntil,
+		"sleep_reason":              "rate_limit",
+		"last_woke_at":              "",
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
+	}
+	if err := store.SetMetadataBatch(session.ID, batch); err != nil {
+		fmt.Fprintf(os.Stderr, "recordRateLimitQuarantine: SetMetadataBatch %s: %v\n", session.ID, err) //nolint:errcheck
+		return err
+	}
+	for k, v := range batch {
+		session.Metadata[k] = v
+	}
+	return nil
 }
 
 // recordWakeFailure increments wake_attempts and quarantines if threshold exceeded.
@@ -569,9 +674,15 @@ func recordWakeFailure(session *beads.Bead, store beads.Store, clk clock.Clock)
 
 // clearWakeFailures resets crash counter and quarantine for a stable session.
 func clearWakeFailures(session *beads.Bead, store beads.Store) {
-	batch := map[string]string{
-		"wake_attempts":     "0",
-		"quarantined_until": "",
+	batch := make(map[string]string, 2)
+	if session.Metadata["wake_attempts"] != "" && session.Metadata["wake_attempts"] != "0" {
+		batch["wake_attempts"] = "0"
+	}
+	if session.Metadata["quarantined_until"] != "" {
+		batch["quarantined_until"] = ""
+	}
+	if len(batch) == 0 {
+		return
 	}
 	if err := store.SetMetadataBatch(session.ID, batch); err == nil {
 		if session.Metadata == nil {
@@ -638,7 +749,7 @@ func checkChurn(session *beads.Bead, cfg *config.City, alive bool, dt *drainTrac
 func isDeliberateSleepReason(reason string) bool {
 	switch strings.TrimSpace(reason) {
 	case "idle", "idle-timeout", "no-wake-reason", "config-drift", "drained",
-		sleepReasonCityStop, "user-hold", "wait-hold":
+		sleepReasonCityStop, "user-hold", "wait-hold", "rate_limit":
 		return true
 	default:
 		return false
@@ -837,14 +948,61 @@ func emptyNil(batch map[string]string) map[string]string {
 	return batch
 }
 
+// staleCreatingState returns true when a state=creating bead has been
+// stuck in that state longer than staleCreatingStateTimeout.
+//
+// "How long" is measured from the most recent transition into the
+// creating/pending-create state, NOT from the bead's original
+// CreatedAt. Configured-named-session beads (e.g. beads/planner) get
+// REOPENED on demand — the same bead row toggles closed→open with
+// state→creating — so its CreatedAt is from when the bead row was
+// first created (potentially hours/days/months ago) and is irrelevant
+// to whether the current spawn attempt is stuck.
+//
+// Order of preference:
+//  1. metadata["pending_create_started_at"] — set by createPoolSessionBead
+//     and reopenClosedConfiguredNamedSessionBead at the moment the bead
+//     enters state=creating with pending_create_claim=true.
+//  2. session.CreatedAt — fallback for fresh pool beads minted before
+//     this metadata key was introduced, and for any caller that creates
+//     a bead in state=creating without going through the helpers above.
 func staleCreatingState(session beads.Bead, clk clock.Clock) bool {
 	if clk == nil {
 		return false
 	}
+	if strings.TrimSpace(session.Metadata["state"]) != string(sessionpkg.StateCreating) {
+		return false
+	}
+	return pendingCreateAttemptStale(session, clk)
+}
+
+// pendingCreateAttemptStale reports whether the current pending-create attempt
+// has aged past staleCreatingStateTimeout, regardless of the bead's current
+// projected state. This lets the reconciler keep never-started pending-create
+// leases alive after healState has already rewritten state=creating to asleep.
+func pendingCreateAttemptStale(session beads.Bead, clk clock.Clock) bool {
+	if clk == nil {
+		return false
+	}
+	now := clk.Now()
+	if started, ok := parseRFC3339Metadata(session.Metadata["pending_create_started_at"]); ok {
+		return !now.Before(started.Add(staleCreatingStateTimeout))
+	}
 	if session.CreatedAt.IsZero() {
 		return true
 	}
-	return !clk.Now().Before(session.CreatedAt.Add(staleCreatingStateTimeout))
+	return !now.Before(session.CreatedAt.Add(staleCreatingStateTimeout))
+}
+
+// pendingCreateStartedAtNow returns the timestamp string to write into
+// metadata["pending_create_started_at"] when a bead transitions into
+// state=creating with pending_create_claim=true. Must match the format
+// staleCreatingState parses (RFC3339).
+func pendingCreateStartedAtNow(now time.Time) string {
+	if now.IsZero() {
+		now = time.Now()
+	}
+	return now.UTC().Format(time.RFC3339)
 }
 
 // topoOrder returns session beads in dependency order (dependencies first).
diff --git a/cmd/gc/session_reconcile_ratelimit_test.go b/cmd/gc/session_reconcile_ratelimit_test.go
new file mode 100644
index 0000000000..03feb360de
--- /dev/null
+++ b/cmd/gc/session_reconcile_ratelimit_test.go
@@ -0,0 +1,350 @@
+// This file pins the desired post-fix behavior for rate-limit-blind respawns.
+
+package main
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/clock"
+)
+
+// TestCheckStability_RateLimitScreen_DoesNotCountAsCrash pins the desired
+// post-fix behavior of checkStability when the agent's pane shows a
+// Claude/Gemini rate-limit screen.
+//
+// When an agent CLI exits at the rate-limit screen, the session reconciler
+// sees process_alive==false, calls checkStability, which sees last_woke_at
+// within stabilityThreshold and counts it as a crash via recordWakeFailure.
+// Five consecutive rate-limit exits within 30s trigger a 5-minute quarantine,
+// so the system burns 5 wake/prime/--resume cycles before backing off, even
+// though every wake will hit the same rate limit and produce zero useful work.
+//
+// Fix: extend checkStability to accept a peek callback (matching the shape
+// already used by AcceptStartupDialogs* in internal/runtime/dialog.go). When
+// peek returns high-confidence provider rate-limit screen content, the
+// function records a rate-limit quarantine (longer back-off, distinct
+// sleep_reason="rate_limit") instead of a crash, and does NOT increment
+// wake_attempts.
+func TestCheckStability_RateLimitScreen_DoesNotCountAsCrash(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+
+	session := makeBead("b1", map[string]string{
+		"last_woke_at":        now.Add(-10 * time.Second).Format(time.RFC3339),
+		"session_key":         "keep-session",
+		"started_config_hash": "keep-hash",
+		"wake_attempts":       "3", // a real crash would push us to 4
+	})
+
+	paneContent := "You've hit your limit, Pro plan\n\n/rate-limit-options"
+	var gotLines int
+	peek := func(lines int) (string, error) {
+		gotLines = lines
+		return paneContent, nil
+	}
+
+	if !checkStability(&session, nil, false, dt, store, clk, peek) {
+		t.Fatal("checkStability should return true when it records a rate-limit hold")
+	}
+
+	if got := session.Metadata["wake_attempts"]; got != "3" {
+		t.Errorf("wake_attempts = %q, want 3; rate-limit exit must not count as a crash", got)
+	}
+
+	if got := session.Metadata["sleep_reason"]; got != "rate_limit" {
+		t.Errorf("sleep_reason = %q, want %q", got, "rate_limit")
+	}
+	if got := session.Metadata["state"]; got != "asleep" {
+		t.Errorf("state = %q, want asleep", got)
+	}
+
+	qUntil, err := time.Parse(time.RFC3339, session.Metadata["quarantined_until"])
+	if err != nil {
+		t.Fatalf("quarantined_until parse: %v", err)
+	}
+	if want := now.Add(defaultRateLimitQuarantineDuration); !qUntil.Equal(want) {
+		t.Errorf("quarantined_until = %s, want %s", qUntil.Format(time.RFC3339), want.Format(time.RFC3339))
+	}
+
+	if gotLines != rateLimitPeekLines {
+		t.Errorf("peek lines = %d, want %d", gotLines, rateLimitPeekLines)
+	}
+
+	if got := session.Metadata["session_key"]; got != "keep-session" {
+		t.Errorf("session_key = %q, want preserved", got)
+	}
+	if got := session.Metadata["started_config_hash"]; got != "keep-hash" {
+		t.Errorf("started_config_hash = %q, want preserved", got)
+	}
+
+	// last_woke_at should be cleared (edge-triggered, mirroring the existing
+	// crash path) so the rate-limit detection isn't re-triggered next tick.
+	if session.Metadata["last_woke_at"] != "" {
+		t.Error("last_woke_at should be cleared after rate-limit detection")
+	}
+}
+
+func TestCheckStability_RateLimitPendingCreateClearsStartedAt(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+
+	session := makeBead("b1", map[string]string{
+		"last_woke_at":              now.Add(-2 * time.Minute).Format(time.RFC3339),
+		"session_key":               "keep-session",
+		"started_config_hash":       "keep-hash",
+		"wake_attempts":             "3",
+		"pending_create_claim":      "true",
+		"pending_create_started_at": now.Add(-20 * time.Second).Format(time.RFC3339),
+	})
+
+	peek := func(_ int) (string, error) {
+		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
+	}
+
+	if !checkStability(&session, nil, false, dt, store, clk, peek) {
+		t.Fatal("checkStability should return true when it records a rate-limit hold")
+	}
+	if session.Metadata["pending_create_claim"] != "" {
+		t.Error("pending_create_claim should be cleared after rate-limit detection")
+	}
+	if session.Metadata["pending_create_started_at"] != "" {
+		t.Error("pending_create_started_at should be cleared with pending_create_claim")
+	}
+}
+
+func TestCheckRateLimitStability_BeforeHealPreservesResumeMetadata(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+
+	session := makeBead("b1", map[string]string{
+		"state":               "active",
+		"last_woke_at":        now.Add(-10 * time.Second).Format(time.RFC3339),
+		"session_key":         "keep-session",
+		"started_config_hash": "keep-hash",
+	})
+
+	peek := func(_ int) (string, error) {
+		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
+	}
+
+	handled, err := checkRateLimitStability(&session, nil, false, dt, store, clk, peek)
+	if err != nil {
+		t.Fatalf("recording rate-limit rapid exit: %v", err)
+	}
+	if !handled {
+		t.Fatal("rate-limit rapid exit should be recorded before advisory state healing")
+	}
+
+	healState(&session, false, store, clk)
+
+	if got := session.Metadata["session_key"]; got != "keep-session" {
+		t.Errorf("session_key = %q, want preserved", got)
+	}
+	if got := session.Metadata["started_config_hash"]; got != "keep-hash" {
+		t.Errorf("started_config_hash = %q, want preserved", got)
+	}
+	if got := session.Metadata["continuation_reset_pending"]; got != "" {
+		t.Errorf("continuation_reset_pending = %q, want empty", got)
+	}
+	if got := session.Metadata["state"]; got != "asleep" {
+		t.Errorf("state = %q, want asleep", got)
+	}
+	if got := session.Metadata["sleep_reason"]; got != "rate_limit" {
+		t.Errorf("sleep_reason = %q, want rate_limit", got)
+	}
+}
+
+func TestCheckRateLimitStability_BatchFailureDoesNotClearLastWokeAt(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	store.metadataBatchErr = errors.New("batch failed")
+	dt := newDrainTracker()
+	lastWoke := now.Add(-10 * time.Second).Format(time.RFC3339)
+
+	session := makeBead("b1", map[string]string{
+		"state":               "active",
+		"last_woke_at":        lastWoke,
+		"session_key":         "keep-session",
+		"started_config_hash": "keep-hash",
+	})
+	peek := func(_ int) (string, error) {
+		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
+	}
+
+	handled, err := checkRateLimitStability(&session, nil, false, dt, store, clk, peek)
+	if err == nil {
+		t.Fatal("rate-limit batch failure should be returned")
+	}
+	if handled {
+		t.Fatal("rate-limit rapid exit should not be handled when persistence fails")
+	}
+	if got := session.Metadata["last_woke_at"]; got != lastWoke {
+		t.Fatalf("last_woke_at = %q, want preserved after failed batch", got)
+	}
+	if got := session.Metadata["sleep_reason"]; got != "" {
+		t.Fatalf("sleep_reason = %q, want unchanged after failed batch", got)
+	}
+	if got, ok := store.metadata["b1"]["last_woke_at"]; ok {
+		t.Fatalf("separate last_woke_at write = %q, want no standalone clear", got)
+	}
+	if len(store.metadataBatchPatches) != 1 {
+		t.Fatalf("metadata batch calls = %d, want 1", len(store.metadataBatchPatches))
+	}
+	if got, ok := store.metadataBatchPatches[0]["last_woke_at"]; !ok || got != "" {
+		t.Fatalf("rate-limit batch last_woke_at = %q, present=%v; want empty value in batch", got, ok)
+	}
+
+	store.metadataBatchErr = nil
+	handled, err = checkRateLimitStability(&session, nil, false, dt, store, clk, peek)
+	if err != nil {
+		t.Fatalf("retrying rate-limit detection: %v", err)
+	}
+	if !handled {
+		t.Fatal("rate-limit detection should retry on the next tick after a failed batch")
+	}
+	healState(&session, false, store, clk)
+
+	if got := session.Metadata["session_key"]; got != "keep-session" {
+		t.Errorf("session_key = %q, want preserved", got)
+	}
+	if got := session.Metadata["started_config_hash"]; got != "keep-hash" {
+		t.Errorf("started_config_hash = %q, want preserved", got)
+	}
+	if got := session.Metadata["continuation_reset_pending"]; got != "" {
+		t.Errorf("continuation_reset_pending = %q, want empty", got)
+	}
+	if got := session.Metadata["last_woke_at"]; got != "" {
+		t.Errorf("last_woke_at = %q, want cleared by successful quarantine batch", got)
+	}
+}
+
+func TestCheckRateLimitStability_BatchFailureRetriesAfterStabilityThreshold(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	store.metadataBatchErr = errors.New("batch failed")
+	dt := newDrainTracker()
+	lastWoke := now.Add(-10 * time.Second).Format(time.RFC3339)
+
+	session := makeBead("b1", map[string]string{
+		"state":               "active",
+		"last_woke_at":        lastWoke,
+		"session_key":         "keep-session",
+		"started_config_hash": "keep-hash",
+	})
+	peek := func(_ int) (string, error) {
+		return "You've hit your limit, Pro plan\n\n/rate-limit-options", nil
+	}
+
+	handled, err := checkRateLimitStability(&session, nil, false, dt, store, clk, peek)
+	if err == nil {
+		t.Fatal("initial failed batch should be returned")
+	}
+	if handled {
+		t.Fatal("initial failed batch should not be reported as handled")
+	}
+
+	clk.Time = now.Add(stabilityThreshold + time.Second)
+	store.metadataBatchErr = nil
+	handled, err = checkRateLimitStability(&session, nil, false, dt, store, clk, peek)
+	if err != nil {
+		t.Fatalf("retrying after stability threshold: %v", err)
+	}
+	if !handled {
+		t.Fatal("rate-limit detection should retry after the crash stability threshold")
+	}
+	healState(&session, false, store, clk)
+
+	if got := session.Metadata["session_key"]; got != "keep-session" {
+		t.Errorf("session_key = %q, want preserved", got)
+	}
+	if got := session.Metadata["started_config_hash"]; got != "keep-hash" {
+		t.Errorf("started_config_hash = %q, want preserved", got)
+	}
+	if got := session.Metadata["continuation_reset_pending"]; got != "" {
+		t.Errorf("continuation_reset_pending = %q, want empty", got)
+	}
+	if got := session.Metadata["sleep_reason"]; got != "rate_limit" {
+		t.Errorf("sleep_reason = %q, want rate_limit", got)
+	}
+}
+
+// TestCheckStability_RateLimitScreen_EmptyPaneStillCountsAsCrash ensures the
+// rate-limit detection requires positive evidence in the pane. If peek
+// returns nothing matching the rate-limit signature, behavior matches the
+// existing crash path: count as a crash, increment wake_attempts.
+func TestCheckStability_RateLimitScreen_EmptyPaneStillCountsAsCrash(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+
+	session := makeBead("b1", map[string]string{
+		"last_woke_at":  now.Add(-10 * time.Second).Format(time.RFC3339),
+		"wake_attempts": "0",
+	})
+
+	peek := func(_ int) (string, error) { return "", nil }
+
+	if !checkStability(&session, nil, false, dt, store, clk, peek) {
+		t.Error("rapid exit with no rate-limit signature should report stability failure")
+	}
+	if got := session.Metadata["wake_attempts"]; got != "1" {
+		t.Errorf("wake_attempts = %q, want 1", got)
+	}
+}
+
+// TestCheckStability_RateLimitScreen_NilPeekFallsBackToCrash ensures
+// backward compatibility for call sites that don't supply a peek (subprocess
+// providers, test paths). When peek is nil, behavior matches the legacy
+// crash-only path.
+func TestCheckStability_RateLimitScreen_NilPeekFallsBackToCrash(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+
+	session := makeBead("b1", map[string]string{
+		"last_woke_at":  now.Add(-10 * time.Second).Format(time.RFC3339),
+		"wake_attempts": "0",
+	})
+
+	if !checkStability(&session, nil, false, dt, store, clk, nil) {
+		t.Error("rapid exit with nil peek should fall back to crash-counting behavior")
+	}
+	if got := session.Metadata["wake_attempts"]; got != "1" {
+		t.Errorf("wake_attempts = %q, want 1", got)
+	}
+}
+
+func TestCheckStability_RateLimitScreen_PeekErrorFallsBackToCrash(t *testing.T) {
+	now := time.Date(2026, 4, 28, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+
+	session := makeBead("b1", map[string]string{
+		"last_woke_at":  now.Add(-10 * time.Second).Format(time.RFC3339),
+		"wake_attempts": "0",
+	})
+
+	peek := func(_ int) (string, error) {
+		return "", errors.New("peek failed")
+	}
+
+	if !checkStability(&session, nil, false, dt, store, clk, peek) {
+		t.Error("rapid exit with peek error should fall back to crash-counting behavior")
+	}
+	if got := session.Metadata["wake_attempts"]; got != "1" {
+		t.Errorf("wake_attempts = %q, want 1", got)
+	}
+}
diff --git a/cmd/gc/session_reconcile_test.go b/cmd/gc/session_reconcile_test.go
index 49f10ec2b6..88762773e4 100644
--- a/cmd/gc/session_reconcile_test.go
+++ b/cmd/gc/session_reconcile_test.go
@@ -21,7 +21,10 @@ import (
 // testStore wraps a bead slice for SetMetadata tracking in tests.
 type testStore struct {
 	beads.Store
-	metadata map[string]map[string]string // id -> key -> value
+	metadata             map[string]map[string]string // id -> key -> value
+	metadataBatchCalls   int
+	metadataBatchPatches []map[string]string
+	metadataBatchErr     error
 }
 
 func newTestStore() *testStore {
@@ -37,6 +40,15 @@ func (s *testStore) SetMetadata(id, key, value string) error {
 }
 
 func (s *testStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	s.metadataBatchCalls++
+	patch := make(map[string]string, len(kvs))
+	for k, v := range kvs {
+		patch[k] = v
+	}
+	s.metadataBatchPatches = append(s.metadataBatchPatches, patch)
+	if s.metadataBatchErr != nil {
+		return s.metadataBatchErr
+	}
 	for k, v := range kvs {
 		if err := s.SetMetadata(id, k, v); err != nil {
 			return err
@@ -237,6 +249,7 @@ func TestWakeReasons_StaleCreatingWithoutPendingClaimDoesNotWakeCreate(t *testin
 		"session_name": "worker-b1",
 		"state":        "creating",
 	})
+	// Past staleCreatingStateTimeout (60s).
 	session.CreatedAt = now.Add(-2 * time.Minute)
 
 	reasons := wakeReasons(session, &config.City{}, nil, nil, nil, nil, clk)
@@ -272,6 +285,7 @@ func TestWakeReasons_PendingCreateClaimKeepsWakeCreateAfterCreatingGoesStale(t *
 		"state":                "creating",
 		"pending_create_claim": "true",
 	})
+	// Past staleCreatingStateTimeout (60s).
 	session.CreatedAt = now.Add(-2 * time.Minute)
 
 	reasons := wakeReasons(session, &config.City{}, nil, nil, nil, nil, clk)
@@ -280,6 +294,67 @@ func TestWakeReasons_PendingCreateClaimKeepsWakeCreateAfterCreatingGoesStale(t *
 	}
 }
 
+func TestStaleCreatingStateUsesPendingCreateStartedAtWhenPresent(t *testing.T) {
+	now := time.Date(2026, 5, 1, 9, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+
+	tests := []struct {
+		name      string
+		createdAt time.Time
+		startedAt string
+		wantStale bool
+	}{
+		{
+			name:      "fresh pending create timestamp keeps old bead fresh",
+			createdAt: now.Add(-2 * time.Minute),
+			startedAt: pendingCreateStartedAtNow(now.Add(-30 * time.Second)),
+			wantStale: false,
+		},
+		{
+			name:      "stale pending create timestamp wins over fresh row creation",
+			createdAt: now.Add(-30 * time.Second),
+			startedAt: pendingCreateStartedAtNow(now.Add(-2 * time.Minute)),
+			wantStale: true,
+		},
+		{
+			name:      "invalid pending create timestamp falls back to row creation",
+			createdAt: now.Add(-30 * time.Second),
+			startedAt: "not-rfc3339",
+			wantStale: false,
+		},
+		{
+			name:      "zero pending create timestamp falls back to row creation",
+			createdAt: now.Add(-30 * time.Second),
+			startedAt: (time.Time{}).UTC().Format(time.RFC3339),
+			wantStale: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			session := makeBead("b1", map[string]string{
+				"state":                     "creating",
+				"pending_create_started_at": tt.startedAt,
+			})
+			session.CreatedAt = tt.createdAt
+
+			if got := staleCreatingState(session, clk); got != tt.wantStale {
+				t.Fatalf("staleCreatingState = %v, want %v", got, tt.wantStale)
+			}
+		})
+	}
+}
+
+func TestPendingCreateStartedAtNowSubstitutesCurrentTimeForZeroInput(t *testing.T) {
+	got := pendingCreateStartedAtNow(time.Time{})
+	if got == (time.Time{}).UTC().Format(time.RFC3339) {
+		t.Fatal("pendingCreateStartedAtNow wrote the zero timestamp")
+	}
+	if _, err := time.Parse(time.RFC3339, got); err != nil {
+		t.Fatalf("pendingCreateStartedAtNow returned invalid RFC3339 timestamp %q: %v", got, err)
+	}
+}
+
 func TestWakeReasons_DrainedSleepPoolSessionDoesNotGetWakeConfig(t *testing.T) {
 	now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
 	clk := &clock.Fake{Time: now}
@@ -693,7 +768,7 @@ func TestComputeWorkSet_ResolvesRigDir(t *testing.T) {
 	runner := func(_ string, dir string, _ map[string]string) (string, error) {
 		// The dir must be the resolved absolute path, not the relative "myrig".
 		if dir == rigDir {
-			return "MC-1\n", nil
+			return "real-world app-1\n", nil
 		}
 		return "", fmt.Errorf("unexpected dir %q, want %q", dir, rigDir)
 	}
@@ -717,7 +792,7 @@ func TestComputeWorkSet_UsesConfiguredRigRoot(t *testing.T) {
 
 	runner := func(_ string, dir string, _ map[string]string) (string, error) {
 		if dir == rigDir {
-			return "MC-1\n", nil
+			return "real-world app-1\n", nil
 		}
 		return "", fmt.Errorf("unexpected dir %q, want %q", dir, rigDir)
 	}
@@ -886,7 +961,7 @@ func TestCheckStability_AliveReturnsFalse(t *testing.T) {
 		"last_woke_at": clk.Now().Add(-10 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkStability(&session, nil, true, dt, store, clk) {
+	if checkStability(&session, nil, true, dt, store, clk, nil) {
 		t.Error("alive session should not report stability failure")
 	}
 }
@@ -902,7 +977,7 @@ func TestCheckStability_RapidExit(t *testing.T) {
 		"wake_attempts": "0",
 	})
 
-	if !checkStability(&session, nil, false, dt, store, clk) {
+	if !checkStability(&session, nil, false, dt, store, clk, nil) {
 		t.Error("rapid exit should report stability failure")
 	}
 
@@ -917,6 +992,28 @@ func TestCheckStability_RapidExit(t *testing.T) {
 	}
 }
 
+func TestCheckStability_PendingCreateInFlightNotCounted(t *testing.T) {
+	now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	store := newTestStore()
+	dt := newDrainTracker()
+	session := makeBead("b1", map[string]string{
+		"last_woke_at":         now.Add(-10 * time.Second).Format(time.RFC3339),
+		"pending_create_claim": "true",
+		"wake_attempts":        "0",
+	})
+
+	if checkStability(&session, nil, false, dt, store, clk, nil) {
+		t.Fatal("in-flight pending create should not be counted as a rapid exit")
+	}
+	if got := session.Metadata["wake_attempts"]; got != "0" {
+		t.Fatalf("wake_attempts = %q, want 0", got)
+	}
+	if got := session.Metadata["last_woke_at"]; got == "" {
+		t.Fatal("last_woke_at should remain while pending create is still in flight")
+	}
+}
+
 func TestCheckStability_DrainingNotCounted(t *testing.T) {
 	now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
 	clk := &clock.Fake{Time: now}
@@ -928,7 +1025,7 @@ func TestCheckStability_DrainingNotCounted(t *testing.T) {
 		"last_woke_at": now.Add(-10 * time.Second).Format(time.RFC3339),
 	})
 
-	if checkStability(&session, nil, false, dt, store, clk) {
+	if checkStability(&session, nil, false, dt, store, clk, nil) {
 		t.Error("draining session death should not count as stability failure")
 	}
 }
@@ -944,7 +1041,7 @@ func TestCheckStability_StableSession(t *testing.T) {
 		"last_woke_at": now.Add(-2 * time.Minute).Format(time.RFC3339),
 	})
 
-	if checkStability(&session, nil, false, dt, store, clk) {
+	if checkStability(&session, nil, false, dt, store, clk, nil) {
 		t.Error("session that lived past threshold should not be stability failure")
 	}
 }
@@ -963,7 +1060,7 @@ func TestCheckStability_SubprocessProviderSkipsCrashCounting(t *testing.T) {
 		"wake_attempts": "0",
 	})
 
-	if checkStability(&session, cfg, false, dt, store, clk) {
+	if checkStability(&session, cfg, false, dt, store, clk, nil) {
 		t.Fatal("subprocess rapid exit should not be counted as a crash")
 	}
 	if got := session.Metadata["wake_attempts"]; got != "0" {
@@ -1072,6 +1169,74 @@ func TestClearWakeFailures(t *testing.T) {
 	}
 }
 
+func TestClearWakeFailuresSkipsNoOpClear(t *testing.T) {
+	tests := []struct {
+		name     string
+		metadata map[string]string
+	}{
+		{name: "absent"},
+		{name: "already clear wake attempts", metadata: map[string]string{"wake_attempts": "0"}},
+		{name: "already clear quarantine", metadata: map[string]string{"quarantined_until": ""}},
+		{name: "already clear both", metadata: map[string]string{"wake_attempts": "0", "quarantined_until": ""}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := newTestStore()
+			session := makeBead("b1", tt.metadata)
+
+			clearWakeFailures(&session, store)
+
+			if store.metadataBatchCalls != 0 {
+				t.Fatalf("SetMetadataBatch called %d times with %v, want 0", store.metadataBatchCalls, store.metadataBatchPatches)
+			}
+			if len(store.metadata) != 0 {
+				t.Fatalf("metadata writes = %v, want none", store.metadata)
+			}
+		})
+	}
+}
+
+func TestClearWakeFailuresWritesOnlyChangedFields(t *testing.T) {
+	tests := []struct {
+		name      string
+		metadata  map[string]string
+		wantPatch map[string]string
+	}{
+		{
+			name:      "wake attempts only",
+			metadata:  map[string]string{"wake_attempts": "3", "quarantined_until": ""},
+			wantPatch: map[string]string{"wake_attempts": "0"},
+		},
+		{
+			name:      "quarantine only",
+			metadata:  map[string]string{"wake_attempts": "0", "quarantined_until": "2026-03-08T12:00:00Z"},
+			wantPatch: map[string]string{"quarantined_until": ""},
+		},
+		{
+			name:      "both fields",
+			metadata:  map[string]string{"wake_attempts": "3", "quarantined_until": "2026-03-08T12:00:00Z"},
+			wantPatch: map[string]string{"wake_attempts": "0", "quarantined_until": ""},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := newTestStore()
+			session := makeBead("b1", tt.metadata)
+
+			clearWakeFailures(&session, store)
+
+			if store.metadataBatchCalls != 1 {
+				t.Fatalf("SetMetadataBatch called %d times, want 1", store.metadataBatchCalls)
+			}
+			if !reflect.DeepEqual(store.metadataBatchPatches[0], tt.wantPatch) {
+				t.Fatalf("metadata patch = %v, want %v", store.metadataBatchPatches[0], tt.wantPatch)
+			}
+		})
+	}
+}
+
 func TestStableLongEnough(t *testing.T) {
 	now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
 	clk := &clock.Fake{Time: now}
@@ -1281,6 +1446,11 @@ func TestHealState_PreservesCreatingWhileStartRequested(t *testing.T) {
 		"state":                "creating",
 		"pending_create_claim": "true",
 	})
+	// #1460: pending_create_claim only short-circuits while the create
+	// lease is fresh. Pin CreatedAt to "now" so the bead is within the
+	// lease window — without this the zero CreatedAt is treated as stale
+	// and the bead correctly heals to asleep (covered by the test below).
+	session.CreatedAt = clk.Now().Add(-30 * time.Second)
 
 	healState(&session, false, store, clk)
 	if session.Metadata["state"] != "creating" {
@@ -1288,6 +1458,24 @@ func TestHealState_PreservesCreatingWhileStartRequested(t *testing.T) {
 	}
 }
 
+// #1460: stale-creating + pending_create_claim must heal to asleep so a
+// crashed creator does not strand the pool slot indefinitely.
+func TestHealState_StaleCreatingWithPendingClaimHealsToAsleep(t *testing.T) {
+	store := newTestStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 29, 4, 0, 0, 0, time.UTC)}
+
+	session := makeBead("b1", map[string]string{
+		"state":                "creating",
+		"pending_create_claim": "true",
+	})
+	session.CreatedAt = clk.Now().Add(-2 * time.Minute)
+
+	healState(&session, false, store, clk)
+	if session.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", session.Metadata["state"])
+	}
+}
+
 func TestHealState_PreservesFreshCreatingWithoutPendingClaim(t *testing.T) {
 	store := newTestStore()
 	clk := &clock.Fake{Time: time.Date(2026, 3, 29, 4, 0, 0, 0, time.UTC)}
@@ -1310,6 +1498,7 @@ func TestHealState_StaleCreatingWithoutPendingClaimHealsToAsleep(t *testing.T) {
 	session := makeBead("b1", map[string]string{
 		"state": "creating",
 	})
+	// Past staleCreatingStateTimeout (60s).
 	session.CreatedAt = clk.Now().Add(-2 * time.Minute)
 
 	healState(&session, false, store, clk)
@@ -1383,6 +1572,7 @@ func TestHealStatePatchProjectsRuntimeLiveness(t *testing.T) {
 					"session_key":         "old-key",
 					"started_config_hash": "old-hash",
 				})
+				// Past staleCreatingStateTimeout (60s).
 				b.CreatedAt = now.Add(-2 * time.Minute)
 				return b
 			}(),
@@ -1611,7 +1801,7 @@ func TestCheckStability_RapidExitAfterHealStateKeepsStartedConfigHashCleared(t *
 	if session.Metadata["started_config_hash"] != "" {
 		t.Fatalf("healState started_config_hash = %q, want empty", session.Metadata["started_config_hash"])
 	}
-	if !checkStability(&session, nil, false, nil, store, clk) {
+	if !checkStability(&session, nil, false, nil, store, clk, nil) {
 		t.Fatal("checkStability should record the rapid exit")
 	}
 	if session.Metadata["started_config_hash"] != "" {
diff --git a/cmd/gc/session_reconciler.go b/cmd/gc/session_reconciler.go
index 6bfa81e7c0..84b83f2df6 100644
--- a/cmd/gc/session_reconciler.go
+++ b/cmd/gc/session_reconciler.go
@@ -94,6 +94,18 @@ func allDependenciesAliveForTemplate(
 	sp runtime.Provider,
 	cityName string,
 	store beads.Store,
+) bool {
+	return allDependenciesAliveForTemplateWithClock(template, cfg, desiredState, sp, cityName, store, clock.Real{})
+}
+
+func allDependenciesAliveForTemplateWithClock(
+	template string,
+	cfg *config.City,
+	desiredState map[string]TemplateParams,
+	sp runtime.Provider,
+	cityName string,
+	store beads.Store,
+	clk clock.Clock,
 ) bool {
 	cfgAgent := findAgentByTemplate(cfg, template)
 	if cfgAgent == nil || len(cfgAgent.DependsOn) == 0 {
@@ -104,7 +116,7 @@ func allDependenciesAliveForTemplate(
 		if depCfg == nil {
 			continue // dependency not in config — skip
 		}
-		if !dependencyTemplateAlive(dep, cfg, desiredState, sp, cityName, store) {
+		if !dependencyTemplateAlive(dep, cfg, desiredState, sp, cityName, store, clk) {
 			return false
 		}
 	}
@@ -122,10 +134,28 @@ func allDependenciesAlive(
 	cityName string,
 	store beads.Store,
 ) bool {
-	return allDependenciesAliveForTemplate(normalizedSessionTemplate(session, cfg), cfg, desiredState, sp, cityName, store)
+	return allDependenciesAliveForTemplateWithClock(normalizedSessionTemplate(session, cfg), cfg, desiredState, sp, cityName, store, clock.Real{})
 }
 
 func pendingCreateSessionStillLeased(session beads.Bead, cfg *config.City, clk clock.Clock) bool {
+	var startupTimeout time.Duration
+	if cfg != nil {
+		startupTimeout = cfg.Session.StartupTimeoutDuration()
+	}
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) == "true" {
+		if !pendingCreateLeaseActive(session, clk, startupTimeout) {
+			return false
+		}
+		template := normalizedSessionTemplate(session, cfg)
+		if template == "" {
+			template = session.Metadata["template"]
+		}
+		agent := findAgentByTemplate(cfg, template)
+		if agent != nil {
+			return !agent.Suspended
+		}
+		return true
+	}
 	if !sessionStartRequested(session, clk) {
 		return false
 	}
@@ -134,7 +164,106 @@ func pendingCreateSessionStillLeased(session beads.Bead, cfg *config.City, clk c
 		template = session.Metadata["template"]
 	}
 	agent := findAgentByTemplate(cfg, template)
-	return agent != nil && !agent.Suspended
+	if agent != nil {
+		return !agent.Suspended
+	}
+	return false
+}
+
+func pendingCreateStartInFlight(session beads.Bead, clk clock.Clock, startupTimeout time.Duration) bool {
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
+		return false
+	}
+	lastWoke := strings.TrimSpace(session.Metadata["last_woke_at"])
+	if lastWoke == "" {
+		return false
+	}
+	started, err := time.Parse(time.RFC3339, lastWoke)
+	if err != nil {
+		return false
+	}
+	if startupTimeout <= 0 {
+		// Disabling the provider Start() deadline must not disable stuck-bead
+		// recovery forever. Use the default lease window for in-flight detection
+		// while leaving the actual Start() context unwrapped.
+		startupTimeout = time.Minute
+	}
+	now := time.Now()
+	if clk != nil {
+		now = clk.Now()
+	}
+	return now.Before(started.Add(startupTimeout + staleKeyDetectDelay + 5*time.Second))
+}
+
+func pendingCreateLeaseActive(session beads.Bead, clk clock.Clock, startupTimeout time.Duration) bool {
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
+		return false
+	}
+	if pendingCreateStartInFlight(session, clk, startupTimeout) {
+		return true
+	}
+	if strings.TrimSpace(session.Metadata["last_woke_at"]) == "" {
+		return !pendingCreateNeverStartedLeaseExpired(session, clk)
+	}
+	return !pendingCreateAttemptStale(session, clk)
+}
+
+// pendingCreateNeverStartedTimeout is the rollback floor for pending creates
+// with no last_woke_at start lease. Production-created pending beads record
+// pending_create_started_at when they enter state=creating; use that timestamp
+// as the lease anchor when present, with CreatedAt as the legacy fallback.
+//
+// It is intentionally longer than staleCreatingStateTimeout: that one-minute
+// window still handles corrupt/unparseable last_woke_at metadata and generic
+// creating-state cleanup, while never-started creates need enough time to sit
+// behind a busy pool start queue.
+const pendingCreateNeverStartedTimeout = 10 * time.Minute
+
+func pendingCreateNeverStartedExpired(session beads.Bead, clk clock.Clock) bool {
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
+		return false
+	}
+	if strings.TrimSpace(session.Metadata["state"]) != "creating" {
+		return false
+	}
+	return pendingCreateNeverStartedLeaseExpired(session, clk)
+}
+
+func pendingCreateNeverStartedLeaseExpired(session beads.Bead, clk clock.Clock) bool {
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
+		return false
+	}
+	if strings.TrimSpace(session.Metadata["last_woke_at"]) != "" {
+		return false
+	}
+	anchor := session.CreatedAt
+	if started, ok := parseRFC3339Metadata(session.Metadata["pending_create_started_at"]); ok {
+		anchor = started
+	}
+	if anchor.IsZero() {
+		return true
+	}
+	now := time.Now()
+	if clk != nil {
+		now = clk.Now()
+	}
+	return now.After(anchor.Add(pendingCreateNeverStartedTimeout))
+}
+
+func pendingCreateLeaseExpiredForRollback(session beads.Bead, clk clock.Clock, startupTimeout time.Duration) bool {
+	if strings.TrimSpace(session.Metadata["pending_create_claim"]) != "true" {
+		return false
+	}
+	if strings.TrimSpace(session.Metadata["state"]) != "creating" {
+		return false
+	}
+	if pendingCreateStartInFlight(session, clk, startupTimeout) {
+		return false
+	}
+	if strings.TrimSpace(session.Metadata["last_woke_at"]) == "" {
+		return pendingCreateNeverStartedExpired(session, clk)
+	}
+	return staleCreatingState(session, clk)
 }
 
 // reconcileSessionBeads performs bead-driven reconciliation using wake/sleep
@@ -155,7 +284,7 @@ func pendingCreateSessionStillLeased(session beads.Bead, cfg *config.City, clk c
 // suspended agents). Used to distinguish "orphaned" (removed from config)
 // from "suspended" (still in config, not runnable) when closing beads.
 //
-// Returns the number of sessions woken this tick.
+// Returns the number of start attempts issued or enqueued this tick.
 //
 //nolint:unparam // compatibility wrapper retains the full production signature.
 func reconcileSessionBeads(
@@ -193,6 +322,8 @@ func reconcileSessionBeads(
 // work that lives outside the primary store. Pass nil when no rig
 // stores are attached; the reconciler will fall back to primary-store-
 // only queries.
+//
+//nolint:unparam // compatibility wrapper keeps the established test/helper signature.
 func reconcileSessionBeadsAtPath(
 	ctx context.Context,
 	cityPath string,
@@ -218,9 +349,41 @@ func reconcileSessionBeadsAtPath(
 	driftDrainTimeout time.Duration,
 	stdout, stderr io.Writer,
 ) int {
-	return reconcileSessionBeadsTraced(
+	return reconcileSessionBeadsAtPathWithNamedDemand(
 		ctx, cityPath, sessions, desiredState, configuredNames, cfg, sp, store, dops, assignedWorkBeads, rigStores, readyWaitSet, dt,
-		poolDesired, storeQueryPartial, workSet, cityName, it, clk, rec, startupTimeout, driftDrainTimeout, stdout, stderr, nil,
+		poolDesired, nil, storeQueryPartial, workSet, cityName, it, clk, rec, startupTimeout, driftDrainTimeout, stdout, stderr,
+	)
+}
+
+func reconcileSessionBeadsAtPathWithNamedDemand(
+	ctx context.Context,
+	cityPath string,
+	sessions []beads.Bead,
+	desiredState map[string]TemplateParams,
+	configuredNames map[string]bool,
+	cfg *config.City,
+	sp runtime.Provider,
+	store beads.Store,
+	dops drainOps,
+	assignedWorkBeads []beads.Bead,
+	rigStores map[string]beads.Store,
+	readyWaitSet map[string]bool,
+	dt *drainTracker,
+	poolDesired map[string]int,
+	namedSessionDemand map[string]bool,
+	storeQueryPartial bool,
+	workSet map[string]bool,
+	cityName string,
+	it idleTracker,
+	clk clock.Clock,
+	rec events.Recorder,
+	startupTimeout time.Duration,
+	driftDrainTimeout time.Duration,
+	stdout, stderr io.Writer,
+) int {
+	return reconcileSessionBeadsTracedWithNamedDemand(
+		ctx, cityPath, sessions, desiredState, configuredNames, cfg, sp, store, dops, assignedWorkBeads, rigStores, readyWaitSet, dt,
+		poolDesired, namedSessionDemand, storeQueryPartial, workSet, cityName, it, clk, rec, startupTimeout, driftDrainTimeout, stdout, stderr, nil,
 	)
 }
 
@@ -249,7 +412,46 @@ func reconcileSessionBeadsTraced(
 	driftDrainTimeout time.Duration,
 	stdout, stderr io.Writer,
 	trace *sessionReconcilerTraceCycle,
+	startOptions ...startExecutionOption,
+) int {
+	return reconcileSessionBeadsTracedWithNamedDemand(
+		ctx, cityPath, sessions, desiredState, configuredNames, cfg, sp, store, dops, assignedWorkBeads, rigStores, readyWaitSet, dt,
+		poolDesired, nil, storeQueryPartial, workSet, cityName, it, clk, rec, startupTimeout, driftDrainTimeout, stdout, stderr, trace,
+		startOptions...,
+	)
+}
+
+func reconcileSessionBeadsTracedWithNamedDemand(
+	ctx context.Context,
+	cityPath string,
+	sessions []beads.Bead,
+	desiredState map[string]TemplateParams,
+	configuredNames map[string]bool,
+	cfg *config.City,
+	sp runtime.Provider,
+	store beads.Store,
+	dops drainOps,
+	assignedWorkBeads []beads.Bead,
+	rigStores map[string]beads.Store,
+	readyWaitSet map[string]bool,
+	dt *drainTracker,
+	poolDesired map[string]int,
+	namedSessionDemand map[string]bool,
+	storeQueryPartial bool,
+	workSet map[string]bool,
+	cityName string,
+	it idleTracker,
+	clk clock.Clock,
+	rec events.Recorder,
+	startupTimeout time.Duration,
+	driftDrainTimeout time.Duration,
+	stdout, stderr io.Writer,
+	trace *sessionReconcilerTraceCycle,
+	startOptions ...startExecutionOption,
 ) int {
+	if ctx != nil && ctx.Err() != nil {
+		return 0
+	}
 	deps := buildDepsMap(cfg)
 	if cityName == "" {
 		cityName = config.EffectiveCityName(cfg, "")
@@ -272,13 +474,61 @@ func reconcileSessionBeadsTraced(
 			}
 		}
 		sessions = retireDuplicateConfiguredNamedSessionBeads(
-			store, sp, cfg, cityName, sessions, bySessionName, indexBySessionName, clk.Now().UTC(), stderr,
+			store, rigStores, sp, cfg, cityName, sessions, bySessionName, indexBySessionName, clk.Now().UTC(), stderr,
 		)
 	}
 
 	// Topo-order sessions by template dependencies.
 	ordered := topoOrder(sessions, deps)
 
+	cbNow := clk.Now().UTC()
+	cbCfg, cbEnabled := sessionCircuitBreakerConfigFromCity(cfg)
+	var cb *sessionCircuitBreaker
+	var circuitSessionByIdentity map[string]*beads.Bead
+	if cbEnabled {
+		// Phase 0.5: Feed the respawn circuit breaker persisted state and the
+		// current progress signature for every named-session identity. A change
+		// in the aggregate status of an identity's assigned work beads is treated
+		// as an observable progress signal and keeps the breaker CLOSED even if
+		// restarts accumulate. See session_circuit_breaker.go.
+		cb = defaultSessionCircuitBreaker()
+		cb.configure(cbCfg)
+		circuitSessionByIdentity = make(map[string]*beads.Bead, len(ordered))
+		for i := range ordered {
+			identity := namedSessionIdentity(ordered[i])
+			if identity == "" {
+				continue
+			}
+			circuitSessionByIdentity[identity] = &ordered[i]
+			if err := cb.observeResetGenerationFromMetadata(identity, ordered[i].Metadata); err != nil {
+				fmt.Fprintf(stderr, "session reconciler: loading session circuit breaker reset generation for %s: %v\n", identity, err) //nolint:errcheck // best-effort stderr
+			}
+		}
+		for i := range ordered {
+			identity := namedSessionIdentity(ordered[i])
+			if identity == "" {
+				continue
+			}
+			if reset, err := cb.restoreFromMetadata(identity, ordered[i].Metadata, cbNow); err != nil {
+				fmt.Fprintf(stderr, "session reconciler: loading session circuit breaker state for %s: %v\n", identity, err) //nolint:errcheck // best-effort stderr
+			} else if reset {
+				if err := persistSessionCircuitBreakerMetadata(store, &ordered[i], cb, identity, cbNow); err != nil {
+					fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
+				}
+			}
+		}
+		for identity, sig := range computeNamedSessionProgressSignatures(ordered, assignedWorkBeads) {
+			if cb.ObserveProgressSignature(identity, sig, cbNow) {
+				if session := circuitSessionByIdentity[identity]; session != nil {
+					if err := persistSessionCircuitBreakerMetadata(store, session, cb, identity, cbNow); err != nil {
+						fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
+					}
+				}
+			}
+		}
+		cb.pruneIdle(cbNow)
+	}
+
 	// Build session ID -> *beads.Bead lookup for advanceSessionDrains.
 	// These pointers intentionally alias into the ordered slice so that
 	// mutations in Phase 1 (healState, clearWakeFailures, etc.) are
@@ -291,7 +541,37 @@ func reconcileSessionBeadsTraced(
 	// Phase 1: Forward pass (topo order) — wake sessions, handle alive state.
 	var startCandidates []startCandidate
 	var wakeTargets []wakeTarget
+	// Rate-limit rollbacks per tick. Each rollbackPendingCreate fires three
+	// bd subprocess calls (~2s each at the bd dolt-commit cost), so an
+	// unbounded rollback storm easily blows the tick past
+	// staleCreatingStateTimeout (60s) and starves executePlannedStartsTraced
+	// — fresh pending-create beads age out before op=start fires. Capping
+	// rollbacks per tick lets the rest of the tick make forward progress;
+	// remaining stale beads roll back on subsequent ticks.
+	const maxRollbacksPerTick = 5
+	rollbacksThisTick := 0
+	attemptRollbackPendingCreate := func(session *beads.Bead, templateName, name, action, detail string) {
+		if rollbacksThisTick >= maxRollbacksPerTick {
+			fmt.Fprintf(stderr, "session reconciler: deferring rollback of %s (%s): rollback budget exhausted this tick\n", name, detail) //nolint:errcheck
+			if trace != nil {
+				trace.recordDecision("reconciler.session.pending_create", templateName, name, action, "rollback_deferred", traceRecordPayload{
+					"rollbacks_this_tick":    rollbacksThisTick,
+					"max_rollbacks_per_tick": maxRollbacksPerTick,
+				}, nil, "")
+			}
+			return
+		}
+		rollbacksThisTick++
+		fmt.Fprintf(stderr, "session reconciler: rolling back pending create %s: %s\n", name, detail) //nolint:errcheck
+		if trace != nil {
+			trace.recordDecision("reconciler.session.pending_create", templateName, name, action, "rollback", nil, nil, "")
+		}
+		rollbackPendingCreate(session, store, clk.Now().UTC(), stderr)
+	}
 	for i := range ordered {
+		if ctx != nil && ctx.Err() != nil {
+			return 0
+		}
 		session := &ordered[i]
 
 		// Skip beads with unrecognized states. This enables forward-compatible
@@ -319,18 +599,49 @@ func reconcileSessionBeadsTraced(
 			if err != nil {
 				providerAlive = false
 			}
+			preserveNamed := preserveConfiguredNamedSessionBead(*session, cfg, cityName)
+			var (
+				preservedTP  TemplateParams
+				preserveErr  error
+				rateLimitHit bool
+				rateLimitErr error
+			)
+			if preserveNamed {
+				preservedTP, preserveErr = resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, ordered, *session, clk, stderr)
+				if preserveErr == nil {
+					obs, obsErr := workerObserveSessionTargetWithRuntimeHintsWithConfig(cityPath, store, sp, cfg, session.ID, preservedTP.Hints.ProcessNames)
+					rateLimitAlive := rateLimitAliveFromObservation(obs.Alive, obsErr)
+					peek := cachedSessionPeek(cityPath, store, sp, cfg, session.ID, preservedTP.Hints.ProcessNames)
+					rateLimitHit, rateLimitErr = checkRateLimitStability(session, cfg, rateLimitAlive, dt, store, clk, peek)
+				}
+			}
+			if rateLimitHit || rateLimitErr != nil {
+				if trace != nil {
+					template := normalizedSessionTemplate(*session, cfg)
+					if template == "" {
+						template = session.Metadata["template"]
+					}
+					result := "held"
+					if rateLimitErr != nil {
+						result = "hold_deferred"
+					}
+					trace.recordDecision("reconciler.session.preserve_configured_named", template, name, "rate_limit", result, traceRecordPayload{
+						"provider_alive": providerAlive,
+					}, nil, "")
+				}
+				continue
+			}
 			// Heal state using provider liveness, not agent membership.
 			healState(session, providerAlive, store, clk)
 			switch {
-			case preserveConfiguredNamedSessionBead(*session, cfg, cityName):
+			case preserveNamed:
 				template := normalizedSessionTemplate(*session, cfg)
 				if template == "" {
 					template = session.Metadata["template"]
 				}
-				preservedTP, err := resolvePreservedConfiguredNamedSessionTemplate(cityPath, cityName, cfg, sp, store, ordered, *session, clk, stderr)
 				switch {
-				case err != nil:
-					fmt.Fprintf(stderr, "session reconciler: resolve preserved named session %s: %v\n", name, err) //nolint:errcheck
+				case preserveErr != nil:
+					fmt.Fprintf(stderr, "session reconciler: resolve preserved named session %s: %v\n", name, preserveErr) //nolint:errcheck
 				default:
 					tp = preservedTP
 					desired = true
@@ -341,7 +652,7 @@ func reconcileSessionBeadsTraced(
 						false: "resolution_failed",
 					}[desired], traceRecordPayload{
 						"provider_alive": providerAlive,
-						"degraded":       err != nil,
+						"degraded":       preserveErr != nil,
 					}, nil, "")
 				}
 			case pendingCreateSessionStillLeased(*session, cfg, clk):
@@ -358,6 +669,76 @@ func reconcileSessionBeadsTraced(
 				}
 				continue
 			default:
+				if dops != nil {
+					if acked, _ := dops.isDrainAcked(name); acked {
+						hasAssignedWork, assignedErr := sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, store, rigStores, *session)
+						if assignedErr != nil {
+							fmt.Fprintf(stderr, "session reconciler: checking assigned work for drain-acked %s: %v\n", name, assignedErr) //nolint:errcheck
+							hasAssignedWork = true
+						}
+						if providerAlive && hasAssignedWork {
+							if cancelOrphanedSessionDrainForAssignedWork(*session, sp, dt) ||
+								cancelRecoveredOrphanedDrainForAssignedWork(*session, sp, name) {
+								_ = dops.clearDrain(name)
+								template := normalizedSessionTemplate(*session, cfg)
+								if template == "" {
+									template = session.Metadata["template"]
+								}
+								fmt.Fprintf(stdout, "Canceled drain-acked session '%s' (assigned work)\n", name) //nolint:errcheck
+								if trace != nil {
+									trace.recordDecision("reconciler.drain.cancel", template, name, "orphaned", "cancel_assigned_work", nil, nil, "")
+								}
+								continue
+							}
+						}
+						stopped := !providerAlive
+						if providerAlive {
+							if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
+								fmt.Fprintf(stderr, "session reconciler: stopping drain-acked %s: %v\n", name, err) //nolint:errcheck
+							} else {
+								stopped = true
+								fmt.Fprintf(stdout, "Stopped drain-acked session '%s'\n", name) //nolint:errcheck
+							}
+						}
+						if stopped {
+							template := normalizedSessionTemplate(*session, cfg)
+							if template == "" {
+								template = session.Metadata["template"]
+							}
+							rec.Record(events.Event{
+								Type:    events.SessionStopped,
+								Actor:   "gc",
+								Subject: template,
+								Message: "drain acknowledged by agent",
+							})
+							if hasAssignedWork {
+								batch := sessionpkg.CompleteDrainPatch(clk.Now().UTC(), "idle", session.Metadata["wake_mode"] == "fresh")
+								_ = store.SetMetadataBatch(session.ID, batch)
+								if session.Metadata == nil {
+									session.Metadata = make(map[string]string, len(batch))
+								}
+								for key, value := range batch {
+									session.Metadata[key] = value
+								}
+								_ = dops.clearDrain(name)
+								if dt != nil {
+									dt.clearIdleProbe(session.ID)
+									dt.remove(session.ID)
+								}
+								continue
+							}
+							_ = dops.clearDrain(name)
+							if dt != nil {
+								dt.clearIdleProbe(session.ID)
+								dt.remove(session.ID)
+							}
+							if closeSessionBeadIfReachableStoreUnassigned(cityPath, cfg, store, rigStores, *session, "drained", clk.Now().UTC(), stderr) {
+								session.Status = "closed"
+							}
+						}
+						continue
+					}
+				}
 				if providerAlive {
 					// When a store query failed (partial results),
 					// skip drain — the session may have work that we
@@ -401,7 +782,9 @@ func reconcileSessionBeadsTraced(
 					if storeQueryPartial {
 						continue
 					}
-					closeSessionBeadIfUnassigned(store, rigStores, *session, reason, clk.Now().UTC(), stderr)
+					if closeSessionBeadIfReachableStoreUnassigned(cityPath, cfg, store, rigStores, *session, reason, clk.Now().UTC(), stderr) {
+						session.Status = "closed"
+					}
 				}
 				continue
 			}
@@ -415,27 +798,47 @@ func reconcileSessionBeadsTraced(
 		}
 		running := obs.Running
 		alive := obs.Alive
+		peek := cachedSessionPeek(cityPath, store, sp, cfg, session.ID, tp.Hints.ProcessNames)
 
 		// Zombie capture: session exists but process dead — grab scrollback for forensics.
 		if running && !alive {
-			if output, err := workerSessionTargetPeekWithConfig(cityPath, store, sp, cfg, session.ID, 50, tp.Hints.ProcessNames); err == nil && output != "" {
-				rec.Record(events.Event{
-					Type:    events.SessionCrashed,
-					Actor:   "gc",
-					Subject: tp.DisplayName(),
-					Message: output,
-				})
-				telemetry.RecordAgentCrash(context.Background(), tp.DisplayName(), output)
+			if output, err := peek(rateLimitPeekLines); err == nil && output != "" {
+				if !runtime.ContainsProviderRateLimitScreen(output) {
+					rec.Record(events.Event{
+						Type:    events.SessionCrashed,
+						Actor:   "gc",
+						Subject: tp.DisplayName(),
+						Message: output,
+					})
+					telemetry.RecordAgentCrash(context.Background(), tp.DisplayName(), output)
+				}
 			}
 		}
 		if alive && shouldRollbackPendingCreate(session) && !runningSessionMatchesPendingCreate(session, name, sp) {
-			fmt.Fprintf(stderr, "session reconciler: rolling back pending create %s: live runtime belongs to another session\n", name) //nolint:errcheck
-			if trace != nil {
-				trace.recordDecision("reconciler.session.pending_create", tp.TemplateName, name, "pending_create_rollback", "rollback", nil, nil, "")
-			}
-			rollbackPendingCreate(session, store, clk.Now().UTC(), stderr)
+			attemptRollbackPendingCreate(session, tp.TemplateName, name, "pending_create_rollback", "live runtime belongs to another session")
 			continue
 		}
+		// Desired-branch counterpart to pendingCreateSessionStillLeased: a
+		// session bead in the desired set with pending_create_claim=true but
+		// no live runtime AND no active lease is stuck. Without this rollback,
+		// the bead lives forever holding its alias, blocking new spawn
+		// attempts ("alias already belongs to gm-XXXX") for any session whose
+		// template still has demand. Rolling back closes the dead bead so the
+		// next reconciler tick can allocate a fresh slot under the same alias.
+		if !alive && shouldRollbackPendingCreate(session) {
+			var startupTimeout time.Duration
+			if cfg != nil {
+				startupTimeout = cfg.Session.StartupTimeoutDuration()
+			}
+			if pendingCreateLeaseExpiredForRollback(*session, clk, startupTimeout) {
+				rateLimitHit, rateLimitErr := checkRateLimitStability(session, cfg, alive, dt, store, clk, peek)
+				if rateLimitHit || rateLimitErr != nil {
+					continue
+				}
+				attemptRollbackPendingCreate(session, tp.TemplateName, name, "pending_create_lease_expired", "lease expired and no live runtime")
+				continue
+			}
+		}
 
 		// Drain-ack: agent signaled it's done (gc runtime drain-ack).
 		// Honor the ack even if the agent exited before this tick; otherwise
@@ -453,7 +856,43 @@ func reconcileSessionBeadsTraced(
 						}
 						continue
 					}
-					_, reconcilerOwnedAck := reconcilerDrainAckMatchesSession(*session, sp, name)
+					ackReason, reconcilerOwnedAck := reconcilerDrainAckMatchesSession(*session, sp, name)
+					if reconcilerOwnedAck && ackReason == "config-drift" {
+						driftKey := sessionConfigDriftKey(*session, cfg, tp)
+						attached, attachErr := sessionAttachedForConfigDrift(*session, sp, cityPath, store, cfg, name)
+						if attachErr != nil {
+							fmt.Fprintf(stderr, "session reconciler: observing config-drift attachment for %s: %v\n", name, attachErr) //nolint:errcheck
+						}
+						if attached {
+							if driftKey != "" {
+								if err := recordSessionAttachedConfigDriftDeferral(*session, store, clk, driftKey); err != nil {
+									fmt.Fprintf(stderr, "session reconciler: recording attached config-drift deferral for %s: %v\n", name, err) //nolint:errcheck
+								}
+							}
+							drainCancelled := cancelSessionConfigDriftDrain(*session, sp, dt)
+							if !drainCancelled {
+								clearReconcilerDrainAckMetadata(sp, name)
+							}
+							if trace != nil {
+								trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "config_drift_attached", "cancel_reconciler_ack", traceRecordPayload{
+									"drain_canceled": drainCancelled,
+								}, nil, "")
+							}
+							continue
+						}
+						if driftKey != "" && recentlyDeferredSessionAttachedConfigDrift(*session, clk, driftKey) {
+							drainCancelled := cancelSessionConfigDriftDrain(*session, sp, dt)
+							if !drainCancelled {
+								clearReconcilerDrainAckMetadata(sp, name)
+							}
+							if trace != nil {
+								trace.recordDecision("reconciler.session.drain_ack", tp.TemplateName, name, "config_drift_recently_attached", "cancel_reconciler_ack", traceRecordPayload{
+									"drain_canceled": drainCancelled,
+								}, nil, "")
+							}
+							continue
+						}
+					}
 					if pendingInteractionKeepsAwake(*session, sp, name, clk) &&
 						(cancelReconcilerAckedDrain(*session, sp, dt) || cancelRecoveredReconcilerAckedDrain(*session, sp, name)) {
 						if trace != nil {
@@ -493,7 +932,7 @@ func reconcileSessionBeadsTraced(
 						// the bead from the close gate and stranded new
 						// queue work on a ghost slot. Re-query the store
 						// so the decision reflects reality.
-						hasAssignedWork, assignedErr := sessionHasOpenAssignedWork(store, rigStores, *session)
+						hasAssignedWork, assignedErr := sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, store, rigStores, *session)
 						sleepReason := "idle"
 						if assignedErr != nil {
 							fmt.Fprintf(stderr, "session reconciler: checking assigned work for drain-acked %s: %v\n", name, assignedErr) //nolint:errcheck
@@ -522,16 +961,23 @@ func reconcileSessionBeadsTraced(
 
 		policy := resolveSessionSleepPolicy(*session, cfg, sp)
 
+		rateLimitHit, rateLimitErr := checkRateLimitStability(session, cfg, alive, dt, store, clk, peek)
+		if rateLimitHit || rateLimitErr != nil {
+			continue // rate-limit hold recorded before state healing resets continuity metadata
+		}
+
 		// Heal advisory state metadata.
+		stateBeforeHeal := sessionpkg.State(strings.TrimSpace(session.Metadata["state"]))
 		healState(session, alive, store, clk)
 		if recoverPendingIdleSleep(session, store, running, clk) {
 			alive = false
 		}
 		reconcileDetachedAt(session, store, policy, alive, sp, clk)
 
-		// Stability check: detect rapid exit (crash).
-		if checkStability(session, cfg, alive, dt, store, clk) {
-			continue // crash recorded, skip further processing
+		// Stability check: detect rapid crash after state healing. Rate-limit
+		// detection intentionally ran above before healState.
+		if checkStability(session, cfg, alive, dt, store, clk, nil) {
+			continue // rapid exit recorded, skip further processing
 		}
 
 		// Churn check: detect context exhaustion death spiral.
@@ -551,6 +997,12 @@ func reconcileSessionBeadsTraced(
 			clearChurn(session, store)
 		}
 		if alive && shouldRollbackPendingCreate(session) {
+			if stateBeforeHeal == sessionpkg.StateCreating && pendingCreateStartInFlight(*session, clk, startupTimeout) {
+				if trace != nil {
+					trace.recordDecision("reconciler.session.pending_create", tp.TemplateName, name, "pending_create_recovery_in_flight", "deferred", nil, nil, "")
+				}
+				continue
+			}
 			if !recoverRunningPendingCreate(session, tp, cfg, store, clk, trace) {
 				fmt.Fprintf(stderr, "session reconciler: recovering pending create %s: metadata repair incomplete\n", name) //nolint:errcheck
 			}
@@ -574,8 +1026,11 @@ func reconcileSessionBeadsTraced(
 			}
 			beadRequested := session.Metadata["restart_requested"] == "true"
 			if tmuxRequested || beadRequested {
-				if tmuxRequested && dops != nil {
-					_ = dops.clearRestartRequested(name)
+				if alive {
+					if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
+						fmt.Fprintf(stderr, "session reconciler: stopping restart-requested %s: %v\n", name, err) //nolint:errcheck
+						continue
+					}
 				}
 				// Providers that can inject a fresh session ID get a
 				// rotated key here so the next wake starts a brand-new
@@ -590,7 +1045,10 @@ func reconcileSessionBeadsTraced(
 				if hasCapability && newSessionKey == "" {
 					batch["session_key"] = ""
 				}
-				_ = store.SetMetadataBatch(session.ID, batch)
+				if err := store.SetMetadataBatch(session.ID, batch); err != nil {
+					fmt.Fprintf(stderr, "session reconciler: recording restart handoff for %s: %v\n", name, err) //nolint:errcheck
+					continue
+				}
 				if session.Metadata == nil {
 					session.Metadata = make(map[string]string, len(batch))
 				}
@@ -598,11 +1056,10 @@ func reconcileSessionBeadsTraced(
 					session.Metadata[key] = value
 				}
 				if alive {
-					if err := workerKillSessionTargetWithConfig("", store, sp, cfg, name); err != nil {
-						fmt.Fprintf(stderr, "session reconciler: stopping restart-requested %s: %v\n", name, err) //nolint:errcheck
-					} else {
-						fmt.Fprintf(stdout, "Stopped restart-requested session '%s'\n", name) //nolint:errcheck
+					if tmuxRequested && dops != nil {
+						_ = dops.clearRestartRequested(name)
 					}
+					fmt.Fprintf(stdout, "Stopped restart-requested session '%s'\n", name) //nolint:errcheck
 				}
 				continue
 			}
@@ -627,26 +1084,7 @@ func reconcileSessionBeadsTraced(
 					// Apply template_overrides using the same resolution as
 					// prepareSessionStart: merge defaults + overrides, then
 					// replaceSchemaFlags to strip and re-add all schema flags.
-					if rawOvr := session.Metadata["template_overrides"]; rawOvr != "" {
-						if tp.ResolvedProvider != nil && len(tp.ResolvedProvider.OptionsSchema) > 0 {
-							var ovr map[string]string
-							if err := json.Unmarshal([]byte(rawOvr), &ovr); err == nil && len(ovr) > 0 {
-								fullOptions := make(map[string]string)
-								for k, v := range tp.ResolvedProvider.EffectiveDefaults {
-									fullOptions[k] = v
-								}
-								for k, v := range ovr {
-									if k == "initial_message" {
-										continue
-									}
-									fullOptions[k] = v
-								}
-								if extra, rErr := config.ResolveExplicitOptions(tp.ResolvedProvider.OptionsSchema, fullOptions); rErr == nil && len(extra) > 0 {
-									agentCfg.Command = replaceSchemaFlags(agentCfg.Command, tp.ResolvedProvider.OptionsSchema, extra)
-								}
-							}
-						}
-					}
+					applyTemplateOverridesToConfig(&agentCfg, *session, tp)
 					currentHash := runtime.CoreFingerprint(agentCfg)
 					if storedHash != currentHash {
 						fmt.Fprintf(stderr, "config-drift %s: stored=%s current=%s cmd=%q\n", name, storedHash[:12], currentHash[:12], agentCfg.Command) //nolint:errcheck
@@ -655,33 +1093,62 @@ func reconcileSessionBeadsTraced(
 						if raw := session.Metadata["core_hash_breakdown"]; raw != "" {
 							_ = json.Unmarshal([]byte(raw), &storedBreakdown)
 						}
+						driftedFields := runtime.CoreFingerprintDriftFields(storedBreakdown, agentCfg)
 						runtime.LogCoreFingerprintDrift(stderr, name, storedBreakdown, agentCfg)
+						restartedInPlace := false
+						// Attached sessions never get config-drift restarts.
+						// The human will restart when ready; drift applies
+						// after detach. Checked before named/non-named paths
+						// because named session config drift is an immediate
+						// kill; a single transient IsAttached false negative
+						// would destroy conversation context irreversibly.
+						driftKey := storedHash + ":" + currentHash
+						attached, attachErr := sessionAttachedForConfigDrift(*session, sp, cityPath, store, cfg, name)
+						if attachErr != nil {
+							fmt.Fprintf(stderr, "session reconciler: observing config-drift attachment for %s: %v\n", name, attachErr) //nolint:errcheck
+						}
+						if attached {
+							if err := recordSessionAttachedConfigDriftDeferral(*session, store, clk, driftKey); err != nil {
+								fmt.Fprintf(stderr, "session reconciler: recording attached config-drift deferral for %s: %v\n", name, err) //nolint:errcheck
+							}
+							drainCancelled := cancelSessionConfigDriftDrain(*session, sp, dt)
+							if trace != nil {
+								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredAttached), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+									"active_reason":  "attached",
+									"drain_canceled": drainCancelled,
+								}), nil, "")
+							}
+							continue
+						}
+						if recentlyDeferredSessionAttachedConfigDrift(*session, clk, driftKey) {
+							if trace != nil {
+								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredAttached), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+									"active_reason": "attached_recently",
+								}), nil, "")
+							}
+							continue
+						}
 						if isNamedSessionBead(*session) {
 							// Defer config-drift restart for named sessions
 							// that are actively in use (pending interaction,
 							// tmux-attached, or recent activity). This prevents
 							// draining a working agent mid-task without graceful
 							// handoff. See gastownhall/gascity#119.
-							activeReason, active, deferErr := shouldDeferNamedSessionConfigDrift(*session, store, sp, name, clk, storedHash+":"+currentHash)
+							activeReason, active, deferErr := shouldDeferNamedSessionConfigDrift(*session, store, sp, name, clk, driftKey)
 							if deferErr != nil {
 								fmt.Fprintf(stderr, "session reconciler: recording config-drift deferral for %s: %v\n", name, deferErr) //nolint:errcheck
 							}
 							if active {
 								if trace != nil {
-									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredActive), traceRecordPayload{
-										"stored_hash":   storedHash,
-										"current_hash":  currentHash,
+									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", string(TraceOutcomeDeferredActive), configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
 										"active_reason": activeReason,
-									}, nil, "")
+									}), nil, "")
 								}
 								continue
 							}
-							resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, alive, "creating", stderr)
+							resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, alive, "creating", clk.Now().UTC(), stderr)
 							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "restart_in_place", traceRecordPayload{
-									"stored_hash":  storedHash,
-									"current_hash": currentHash,
-								}, nil, "")
+								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "restart_in_place", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
 							}
 							rec.Record(events.Event{
 								Type:    events.SessionDraining,
@@ -689,89 +1156,47 @@ func reconcileSessionBeadsTraced(
 								Subject: tp.DisplayName(),
 								Message: "config drift detected",
 							})
-							continue
-						}
-						// Defer ordinary-session config-drift drain while a
-						// user is attached. Named-session config drift is
-						// deferred when actively in use (see above).
-						if pendingInteractionKeepsAwake(*session, sp, name, clk) {
-							drainCancelled := false
-							if dt != nil {
-								drainCancelled = cancelSessionDrainForPending(*session, sp, dt)
-							}
-							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "pending", "deferred_pending", traceRecordPayload{
-									"stored_hash":    storedHash,
-									"current_hash":   currentHash,
-									"drain_canceled": drainCancelled,
-								}, nil, "")
-							}
-							continue
+							alive = false
+							restartedInPlace = true
 						}
-						attached, err := workerSessionTargetAttachedWithConfig(cityPath, store, sp, cfg, session.ID)
-						if err == nil && attached {
-							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "deferred_attached", traceRecordPayload{
-									"stored_hash":  storedHash,
-									"current_hash": currentHash,
-								}, nil, "")
+						if !restartedInPlace {
+							// Defer ordinary-session config-drift drain while a
+							// user is attached. Named-session config drift is
+							// deferred when actively in use (see above).
+							if pendingInteractionKeepsAwake(*session, sp, name, clk) {
+								drainCancelled := false
+								if dt != nil {
+									drainCancelled = cancelSessionDrainForPending(*session, sp, dt)
+								}
+								if trace != nil {
+									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "pending", "deferred_pending", configDriftTracePayload(storedHash, currentHash, driftedFields, traceRecordPayload{
+										"drain_canceled": drainCancelled,
+									}), nil, "")
+								}
+								continue
 							}
-							continue
-						}
-						if isNamedSessionBead(*session) {
-							resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, alive, "creating", stderr)
-							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "restart_in_place", traceRecordPayload{
-									"stored_hash":  storedHash,
-									"current_hash": currentHash,
-								}, nil, "")
+							ddt := driftDrainTimeout
+							if ddt <= 0 {
+								ddt = defaultDrainTimeout
 							}
-							rec.Record(events.Event{
-								Type:    events.SessionDraining,
-								Actor:   "gc",
-								Subject: tp.DisplayName(),
-								Message: "config drift detected",
-							})
-							continue
-						}
-						// Defer ordinary-session config-drift drain while a
-						// user is attached. Named-session config drift is
-						// non-deferrable and is handled above.
-						if sp.IsAttached(name) {
-							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "deferred_attached", traceRecordPayload{
-									"stored_hash":  storedHash,
-									"current_hash": currentHash,
-								}, nil, "")
+							if beginSessionDrain(*session, sp, dt, "config-drift", clk, ddt) {
+								fmt.Fprintf(stdout, "Draining session '%s': config-drift\n", name) //nolint:errcheck
+								if trace != nil {
+									trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "drain", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
+								}
+								rec.Record(events.Event{
+									Type:    events.SessionDraining,
+									Actor:   "gc",
+									Subject: tp.DisplayName(),
+									Message: "config drift detected",
+								})
 							}
 							continue
 						}
-						ddt := driftDrainTimeout
-						if ddt <= 0 {
-							ddt = defaultDrainTimeout
-						}
-						if beginSessionDrain(*session, sp, dt, "config-drift", clk, ddt) {
-							fmt.Fprintf(stdout, "Draining session '%s': config-drift\n", name) //nolint:errcheck
-							if trace != nil {
-								trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "drain", traceRecordPayload{
-									"stored_hash":  storedHash,
-									"current_hash": currentHash,
-								}, nil, "")
-							}
-							rec.Record(events.Event{
-								Type:    events.SessionDraining,
-								Actor:   "gc",
-								Subject: tp.DisplayName(),
-								Message: "config drift detected",
-							})
-						}
-						continue
 					}
 
-					if isNamedSessionBead(*session) {
-						if err := clearNamedSessionConfigDriftDeferral(*session, store); err != nil {
-							fmt.Fprintf(stderr, "session reconciler: clearing config-drift deferral for %s: %v\n", name, err) //nolint:errcheck
-						}
+					if err := clearSessionConfigDriftDeferral(*session, store); err != nil {
+						fmt.Fprintf(stderr, "session reconciler: clearing config-drift deferral for %s: %v\n", name, err) //nolint:errcheck
 					}
 
 					// Core config matches — check live-only drift.
@@ -820,12 +1245,14 @@ func reconcileSessionBeadsTraced(
 					agentCfg := templateParamsToConfig(tp)
 					currentHash := runtime.CoreFingerprint(agentCfg)
 					if storedHash != currentHash {
-						resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, false, "asleep", stderr)
+						var storedBreakdown map[string]string
+						if raw := session.Metadata["core_hash_breakdown"]; raw != "" {
+							_ = json.Unmarshal([]byte(raw), &storedBreakdown)
+						}
+						driftedFields := runtime.CoreFingerprintDriftFields(storedBreakdown, agentCfg)
+						resetConfiguredNamedSessionForConfigDrift(session, store, sp, name, false, "asleep", clk.Now().UTC(), stderr)
 						if trace != nil {
-							trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "repair_in_place", traceRecordPayload{
-								"stored_hash":  storedHash,
-								"current_hash": currentHash,
-							}, nil, "")
+							trace.recordDecision("reconciler.session.config_drift", tp.TemplateName, name, "config_drift", "repair_in_place", configDriftTracePayload(storedHash, currentHash, driftedFields, nil), nil, "")
 						}
 						continue
 					}
@@ -880,9 +1307,13 @@ func reconcileSessionBeadsTraced(
 		wakeTargets = append(wakeTargets, wakeTarget{session: session, tp: tp, alive: alive})
 	}
 
+	if ctx != nil && ctx.Err() != nil {
+		return 0
+	}
+
 	// Use ComputeAwakeSet for the wake/sleep decision.
 	awakeInput := buildAwakeInputFromReconciler(
-		cfg, ordered, poolDesired, workSet, readyWaitSet,
+		cfg, ordered, poolDesired, namedSessionDemand, workSet, readyWaitSet,
 		assignedWorkBeads, wakeTargets, sp, clk.Now(),
 	)
 	awakeDecisions := ComputeAwakeSet(awakeInput)
@@ -914,6 +1345,7 @@ func reconcileSessionBeadsTraced(
 			if !demandOverrides {
 				eval.ConfigSuppressed = true
 				eval.Reasons = nil // Clear reasons so Phase 2 does not cancel the drain.
+				eval.Reason = ""
 			}
 		}
 		wakeEvals[target.session.ID] = eval
@@ -923,6 +1355,9 @@ func reconcileSessionBeadsTraced(
 	launchIdleProbes(ctx, idleProbeTargets, wakeTargets, dt, sp, clk)
 
 	for _, target := range wakeTargets {
+		if ctx != nil && ctx.Err() != nil {
+			return 0
+		}
 		name := target.session.Metadata["session_name"]
 		decision, hasDec := awakeDecisions[name]
 		shouldWake := hasDec && decision.ShouldWake
@@ -938,6 +1373,36 @@ func reconcileSessionBeadsTraced(
 			if sessionIsQuarantined(*target.session, clk) {
 				continue // crash-loop protection
 			}
+			if pendingCreateStartInFlight(*target.session, clk, startupTimeout) {
+				if trace != nil {
+					trace.recordDecision("reconciler.session.wake", target.tp.TemplateName, name, "wake", "start_in_flight", traceRecordPayload{
+						"pending_create_claim": strings.TrimSpace(target.session.Metadata["pending_create_claim"]),
+						"last_woke_at":         target.session.Metadata["last_woke_at"],
+					}, nil, "")
+				}
+				continue
+			}
+			// Respawn circuit breaker: for named sessions the supervisor
+			// will otherwise retry indefinitely. This phase only blocks
+			// already-OPEN breakers; restart accounting happens at the
+			// prepared-start boundary after dependency and wake-budget gates.
+			if cbEnabled {
+				identity := namedSessionIdentity(*target.session)
+				if identity != "" {
+					if cb.IsOpen(identity, cbNow) {
+						if err := persistSessionCircuitBreakerMetadata(store, target.session, cb, identity, cbNow); err != nil {
+							fmt.Fprintf(stderr, "session reconciler: %v\n", err) //nolint:errcheck // best-effort stderr
+						}
+						cb.LogOpenOnce(identity, stderr)
+						if trace != nil {
+							trace.recordDecision("reconciler.session.circuit_open", target.tp.TemplateName, name, "circuit_open", "skipped", traceRecordPayload{
+								"identity": identity,
+							}, nil, "")
+						}
+						continue
+					}
+				}
+			}
 			if trace != nil {
 				trace.recordDecision("reconciler.session.wake", target.tp.TemplateName, name, "wake", "start_candidate", traceRecordPayload{
 					"should_wake": shouldWake,
@@ -1016,7 +1481,7 @@ func reconcileSessionBeadsTraced(
 		poolFreeable := !shouldWake && !target.alive && isPoolSessionSlotFreeable(*target.session) && isPoolManagedSessionBead(*target.session)
 		if poolFreeable {
 			var assignedErr error
-			hasAssignedWork, assignedErr = sessionHasOpenAssignedWork(store, rigStores, *target.session)
+			hasAssignedWork, assignedErr = sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, store, rigStores, *target.session)
 			if assignedErr != nil {
 				fmt.Fprintf(stderr, "session reconciler: checking assigned work for drained %s: %v\n", target.session.Metadata["session_name"], assignedErr) //nolint:errcheck
 				hasAssignedWork = true
@@ -1041,11 +1506,21 @@ func reconcileSessionBeadsTraced(
 		}
 	}
 
+	if ctx != nil && ctx.Err() != nil {
+		return 0
+	}
+
 	plannedWakes := executePlannedStartsTraced(
 		ctx, startCandidates, cfg, desiredState, sp, store, cityName,
+		cityPath,
 		clk, rec, startupTimeout, stdout, stderr, trace,
+		startOptions...,
 	)
 
+	if ctx != nil && ctx.Err() != nil {
+		return plannedWakes
+	}
+
 	// Phase 2: Advance all in-flight drains.
 	sessionLookup := func(id string) *beads.Bead {
 		return beadByID[id]
@@ -1056,6 +1531,36 @@ func reconcileSessionBeadsTraced(
 	return plannedWakes
 }
 
+func cachedSessionPeek(cityPath string, store beads.Store, sp runtime.Provider, cfg *config.City, target string, processNames []string) func(lines int) (string, error) {
+	var (
+		cached      bool
+		cachedLines int
+		content     string
+	)
+	return func(lines int) (string, error) {
+		if cached && cachedLines >= lines {
+			return content, nil
+		}
+		nextContent, nextErr := workerSessionTargetPeekWithConfig(cityPath, store, sp, cfg, target, lines, processNames)
+		if nextErr != nil {
+			return nextContent, nextErr
+		}
+		// Cache only successful peeks; transient capture errors must not
+		// suppress a later rate-limit classifier in the same reconcile tick.
+		content = nextContent
+		cachedLines = lines
+		cached = true
+		return content, nil
+	}
+}
+
+func rateLimitAliveFromObservation(alive bool, err error) bool {
+	if err != nil {
+		return false
+	}
+	return alive
+}
+
 func resolvePreservedConfiguredNamedSessionTemplate(
 	cityPath, cityName string,
 	cfg *config.City,
@@ -1100,17 +1605,13 @@ func resolvePreservedConfiguredNamedSessionTemplate(
 	return tp, nil
 }
 
-// sessionHasOpenAssignedWork reports whether any open or in-progress
-// work bead is assigned to the given session across the primary store
-// AND any attached rig stores. This preserves cross-store ownership
-// coverage that used to come from the retired ownership snapshot.
-//
-// A session's work bead can live in a rig store (e.g., a city-stored
-// session whose work was routed to a rig), so the close gate and
-// drain-ack must check every store the bead could live in before
-// recycling the session's slot. Live queries are used throughout:
-// any individual store failure fails the whole check closed so
-// transient errors cannot cause premature close.
+// sessionHasOpenAssignedWork reports whether any open or in-progress work bead
+// is assigned to the given session across all known stores. Use this
+// cross-store query for cleanup-of-record paths that must not orphan work in
+// any attached store; callers preserve fail-closed behavior by refusing close
+// decisions on query errors. Reconciler close paths that should honor the
+// session's configured store reachability must use
+// sessionHasOpenAssignedWorkForReachableStore instead.
 func sessionHasOpenAssignedWork(store beads.Store, rigStores map[string]beads.Store, session beads.Bead) (bool, error) {
 	if has, err := sessionHasOpenAssignedWorkInStore(store, session); err != nil || has {
 		return has, err
@@ -1123,15 +1624,56 @@ func sessionHasOpenAssignedWork(store beads.Store, rigStores map[string]beads.St
 	return false, nil
 }
 
+// sessionHasOpenAssignedWorkForReachableStore reports whether any open or
+// in-progress work bead is assigned to the given session in the store its
+// configured agent can query and claim from.
+func sessionHasOpenAssignedWorkForReachableStore(
+	cityPath string,
+	cfg *config.City,
+	store beads.Store,
+	rigStores map[string]beads.Store,
+	session beads.Bead,
+) (bool, error) {
+	storeRef, ok := assignedWorkStoreRefForSession(cityPath, cfg, session)
+	if !ok {
+		return sessionHasOpenAssignedWork(store, rigStores, session)
+	}
+	if storeRef == "" {
+		return sessionHasOpenAssignedWorkInStore(store, session)
+	}
+	rigStore, ok := rigStores[storeRef]
+	if !ok || rigStore == nil {
+		return false, fmt.Errorf("rig store %q unavailable for session %q", storeRef, session.Metadata["session_name"])
+	}
+	return sessionHasOpenAssignedWorkInStore(rigStore, session)
+}
+
+func assignedWorkStoreRefForSession(cityPath string, cfg *config.City, session beads.Bead) (string, bool) {
+	if cfg == nil {
+		return "", false
+	}
+	template := normalizedSessionTemplate(session, cfg)
+	if template == "" {
+		template = strings.TrimSpace(session.Metadata["template"])
+	}
+	if template == "" {
+		template = strings.TrimSpace(session.Metadata["common_name"])
+	}
+	if template == "" {
+		return "", false
+	}
+	agentCfg := findAgentByTemplate(cfg, template)
+	if agentCfg == nil {
+		return "", false
+	}
+	return assignedWorkStoreRefForAgent(cityPath, cfg, agentCfg), true
+}
+
 func sessionHasOpenAssignedWorkInStore(store beads.Store, session beads.Bead) (bool, error) {
 	if store == nil {
 		return false, nil
 	}
-	identifiers := []string{
-		strings.TrimSpace(session.ID),
-		strings.TrimSpace(session.Metadata["session_name"]),
-		strings.TrimSpace(session.Metadata[namedSessionIdentityMetadata]),
-	}
+	identifiers := sessionAssignmentIdentifiers(session)
 	seen := make(map[string]struct{}, len(identifiers))
 	for _, status := range []string{"open", "in_progress"} {
 		for _, assignee := range identifiers {
@@ -1168,8 +1710,11 @@ func sessionHasOpenAssignedWorkInStore(store beads.Store, session beads.Bead) (b
 const (
 	namedSessionActivityThreshold                      = 2 * time.Minute
 	namedSessionRecentActivityConfigDriftDeferralLimit = 30 * time.Second
+	sessionAttachedConfigDriftFalseNegativeLimit       = 30 * time.Second
 	namedSessionConfigDriftDeferredAtMetadata          = "config_drift_deferred_at"
 	namedSessionConfigDriftDeferredKeyMetadata         = "config_drift_deferred_key"
+	sessionAttachedConfigDriftDeferredAtMetadata       = "attached_config_drift_deferred_at"
+	sessionAttachedConfigDriftDeferredKeyMetadata      = "attached_config_drift_deferred_key"
 )
 
 // namedSessionActivelyInUse returns true if a named session is currently
@@ -1249,20 +1794,145 @@ func recordNamedSessionConfigDriftDeferredAt(session beads.Bead, store beads.Sto
 	})
 }
 
-func clearNamedSessionConfigDriftDeferral(session beads.Bead, store beads.Store) error {
+func clearSessionConfigDriftDeferral(session beads.Bead, store beads.Store) error {
 	if store == nil || session.ID == "" {
 		return nil
 	}
 	if session.Metadata[namedSessionConfigDriftDeferredAtMetadata] == "" &&
-		session.Metadata[namedSessionConfigDriftDeferredKeyMetadata] == "" {
+		session.Metadata[namedSessionConfigDriftDeferredKeyMetadata] == "" &&
+		session.Metadata[sessionAttachedConfigDriftDeferredAtMetadata] == "" &&
+		session.Metadata[sessionAttachedConfigDriftDeferredKeyMetadata] == "" {
 		return nil
 	}
 	return store.SetMetadataBatch(session.ID, map[string]string{
-		namedSessionConfigDriftDeferredAtMetadata:  "",
-		namedSessionConfigDriftDeferredKeyMetadata: "",
+		namedSessionConfigDriftDeferredAtMetadata:     "",
+		namedSessionConfigDriftDeferredKeyMetadata:    "",
+		sessionAttachedConfigDriftDeferredAtMetadata:  "",
+		sessionAttachedConfigDriftDeferredKeyMetadata: "",
 	})
 }
 
+func recordSessionAttachedConfigDriftDeferral(session beads.Bead, store beads.Store, clk clock.Clock, driftKey string) error {
+	if store == nil || session.ID == "" {
+		return nil
+	}
+	now := time.Now().UTC()
+	if clk != nil {
+		now = clk.Now().UTC()
+	}
+	return store.SetMetadataBatch(session.ID, map[string]string{
+		sessionAttachedConfigDriftDeferredAtMetadata:  now.Format(time.RFC3339),
+		sessionAttachedConfigDriftDeferredKeyMetadata: driftKey,
+	})
+}
+
+func recentlyDeferredSessionAttachedConfigDrift(session beads.Bead, clk clock.Clock, driftKey string) bool {
+	if driftKey == "" || session.Metadata[sessionAttachedConfigDriftDeferredKeyMetadata] != driftKey {
+		return false
+	}
+	raw := session.Metadata[sessionAttachedConfigDriftDeferredAtMetadata]
+	if raw == "" {
+		return false
+	}
+	deferredAt, err := time.Parse(time.RFC3339, raw)
+	if err != nil {
+		return false
+	}
+	now := time.Now().UTC()
+	if clk != nil {
+		now = clk.Now().UTC()
+	}
+	if now.Before(deferredAt) {
+		return true
+	}
+	return now.Sub(deferredAt) < sessionAttachedConfigDriftFalseNegativeLimit
+}
+
+// sessionAttachedForConfigDrift reports whether a session is currently
+// attached (a user terminal is connected) and should skip config-drift
+// handling. It checks worker-handle observation first and falls back to the
+// provider's direct attachment probe.
+func sessionAttachedForConfigDrift(session beads.Bead, sp runtime.Provider, cityPath string, store beads.Store, cfg *config.City, name string) (bool, error) {
+	if sp == nil {
+		return false, nil
+	}
+	var observeErr error
+	if attached, err := workerSessionTargetAttachedWithConfig(cityPath, store, sp, cfg, session.ID); err != nil {
+		observeErr = err
+	} else if attached {
+		return true, nil
+	}
+	if sp.IsAttached(name) {
+		return true, observeErr
+	}
+	return false, observeErr
+}
+
+func sessionConfigDriftKey(session beads.Bead, cfg *config.City, tp TemplateParams) string {
+	template := tp.TemplateName
+	if template == "" {
+		template = normalizedSessionTemplate(session, cfg)
+	}
+	storedHash := session.Metadata["started_config_hash"]
+	if template == "" || storedHash == "" {
+		return ""
+	}
+	if findAgentByTemplate(cfg, template) == nil {
+		return ""
+	}
+	agentCfg := templateParamsToConfig(tp)
+	applyTemplateOverridesToConfig(&agentCfg, session, tp)
+	currentHash := runtime.CoreFingerprint(agentCfg)
+	if storedHash == currentHash {
+		return ""
+	}
+	return storedHash + ":" + currentHash
+}
+
+func configDriftTracePayload(storedHash, currentHash string, driftedFields []string, extra traceRecordPayload) traceRecordPayload {
+	fields := append([]string(nil), driftedFields...)
+	if fields == nil {
+		fields = []string{}
+	}
+	payload := traceRecordPayload{}
+	for k, v := range extra {
+		payload[k] = v
+	}
+	payload["stored_hash"] = storedHash
+	payload["current_hash"] = currentHash
+	payload["drifted_fields"] = fields
+	return payload
+}
+
+func applyTemplateOverridesToConfig(agentCfg *runtime.Config, session beads.Bead, tp TemplateParams) {
+	if agentCfg == nil {
+		return
+	}
+	rawOvr := session.Metadata["template_overrides"]
+	if rawOvr == "" || tp.ResolvedProvider == nil || len(tp.ResolvedProvider.OptionsSchema) == 0 {
+		return
+	}
+	var ovr map[string]string
+	if err := json.Unmarshal([]byte(rawOvr), &ovr); err != nil || len(ovr) == 0 {
+		return
+	}
+	fullOptions := make(map[string]string)
+	for k, v := range tp.ResolvedProvider.EffectiveDefaults {
+		fullOptions[k] = v
+	}
+	for k, v := range ovr {
+		if k == "initial_message" {
+			continue
+		}
+		fullOptions[k] = v
+	}
+	extra, err := config.ResolveExplicitOptions(tp.ResolvedProvider.OptionsSchema, fullOptions)
+	if err != nil || len(extra) == 0 {
+		return
+	}
+	agentCfg.Command = replaceSchemaFlags(agentCfg.Command, tp.ResolvedProvider.OptionsSchema, extra)
+}
+
 func namedSessionActiveUseReason(session beads.Bead, sp runtime.Provider, name string, clk clock.Clock) (string, bool) {
 	if sp == nil || name == "" {
 		return "", false
@@ -1299,6 +1969,7 @@ func resetConfiguredNamedSessionForConfigDrift(
 	sessionName string,
 	alive bool,
 	nextState string,
+	now time.Time,
 	stderr io.Writer,
 ) {
 	if session == nil || store == nil {
@@ -1316,9 +1987,11 @@ func resetConfiguredNamedSessionForConfigDrift(
 	if newKey, err := sessionpkg.GenerateSessionKey(); err == nil {
 		newSessionKey = newKey
 	}
-	batch := sessionpkg.ConfigDriftResetPatch(sessionpkg.State(nextState), newSessionKey)
+	batch := sessionpkg.ConfigDriftResetPatch(sessionpkg.State(nextState), newSessionKey, now)
 	batch[namedSessionConfigDriftDeferredAtMetadata] = ""
 	batch[namedSessionConfigDriftDeferredKeyMetadata] = ""
+	batch[sessionAttachedConfigDriftDeferredAtMetadata] = ""
+	batch[sessionAttachedConfigDriftDeferredKeyMetadata] = ""
 	if err := store.SetMetadataBatch(session.ID, batch); err != nil {
 		fmt.Fprintf(stderr, "session reconciler: recording config-drift repair for %s: %v\n", sessionName, err) //nolint:errcheck
 		return
diff --git a/cmd/gc/session_reconciler_restart_request_test.go b/cmd/gc/session_reconciler_restart_request_test.go
index 0cb73c3f52..990b0710bd 100644
--- a/cmd/gc/session_reconciler_restart_request_test.go
+++ b/cmd/gc/session_reconciler_restart_request_test.go
@@ -3,6 +3,8 @@ package main
 import (
 	"bytes"
 	"context"
+	"errors"
+	"strings"
 	"testing"
 	"time"
 
@@ -37,7 +39,7 @@ func newRestartRequestTestEnv() *restartRequestTestEnv {
 	}
 }
 
-func (e *restartRequestTestEnv) createSessionBead(name, template string) beads.Bead {
+func (e *restartRequestTestEnv) createSessionBead(name string) beads.Bead {
 	b, err := e.store.Create(beads.Bead{
 		Title:  name,
 		Type:   sessionBeadType,
@@ -45,7 +47,7 @@ func (e *restartRequestTestEnv) createSessionBead(name, template string) beads.B
 		Metadata: map[string]string{
 			"session_name":   name,
 			"agent_name":     name,
-			"template":       template,
+			"template":       "worker",
 			"generation":     "1",
 			"instance_token": "test-token",
 			"state":          "asleep",
@@ -115,7 +117,7 @@ func TestReconcileSessionBeads_RestartRequestRotatesKeyForSessionIDProviders(t *
 		},
 	}
 
-	session := env.createSessionBead(sessionName, "worker")
+	session := env.createSessionBead(sessionName)
 	env.setSessionMetadata(&session, map[string]string{
 		namedSessionMetadataKey:      "true",
 		namedSessionIdentityMetadata: "worker",
@@ -160,7 +162,7 @@ func TestReconcileSessionBeads_RestartRequestClearsKeyForResumeOnlyProviders(t *
 		},
 	}
 
-	session := env.createSessionBead(sessionName, "worker")
+	session := env.createSessionBead(sessionName)
 	env.setSessionMetadata(&session, map[string]string{
 		namedSessionMetadataKey:      "true",
 		namedSessionIdentityMetadata: "worker",
@@ -201,7 +203,7 @@ func TestReconcileSessionBeads_RestartRequestPreservesLiveHashesDuringHandoff(t
 		},
 	}
 
-	session := env.createSessionBead(sessionName, "worker")
+	session := env.createSessionBead(sessionName)
 	env.setSessionMetadata(&session, map[string]string{
 		namedSessionMetadataKey:      "true",
 		namedSessionIdentityMetadata: "worker",
@@ -244,4 +246,62 @@ func TestReconcileSessionBeads_RestartRequestPreservesLiveHashesDuringHandoff(t
 	}
 }
 
+func TestReconcileSessionBeads_RestartRequestPreservesIntentWhenKillFails(t *testing.T) {
+	env := newRestartRequestTestEnv()
+	env.cfg = &config.City{
+		Workspace:     config.Workspace{Name: "test-city"},
+		Agents:        []config.Agent{{Name: "worker", StartCommand: "true", MaxActiveSessions: restartRequestTestIntPtr(1)}},
+		NamedSessions: []config.NamedSession{{Template: "worker", Mode: "on_demand"}},
+	}
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		Command:      "true",
+		SessionName:  sessionName,
+		TemplateName: "worker",
+		ResolvedProvider: &config.ResolvedProvider{
+			SessionIDFlag: "--session-id",
+		},
+	}
+
+	session := env.createSessionBead(sessionName)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "on_demand",
+		"state":                      "active",
+		"restart_requested":          "true",
+		"session_key":                "original-key",
+		"started_config_hash":        "hash-before-restart",
+	})
+	if err := env.sp.Start(context.Background(), sessionName, runtime.Config{Command: "true"}); err != nil {
+		t.Fatalf("start session: %v", err)
+	}
+	if err := env.sp.SetMeta(sessionName, "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatalf("SetMeta(GC_SESSION_ID): %v", err)
+	}
+	env.sp.StopErrors[sessionName] = errors.New("kill denied")
+
+	env.reconcile([]beads.Bead{session})
+
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatal("session should remain running when kill fails")
+	}
+	got, _ := env.store.Get(session.ID)
+	if got.Metadata["restart_requested"] != "true" {
+		t.Fatalf("restart_requested = %q, want preserved", got.Metadata["restart_requested"])
+	}
+	if got.Metadata["session_key"] != "original-key" {
+		t.Fatalf("session_key = %q, want original-key", got.Metadata["session_key"])
+	}
+	if got.Metadata["started_config_hash"] != "hash-before-restart" {
+		t.Fatalf("started_config_hash = %q, want preserved", got.Metadata["started_config_hash"])
+	}
+	if got.Metadata["continuation_reset_pending"] != "" {
+		t.Fatalf("continuation_reset_pending = %q, want empty until kill succeeds", got.Metadata["continuation_reset_pending"])
+	}
+	if got := env.stderr.String(); !strings.Contains(got, "stopping restart-requested") || !strings.Contains(got, "kill denied") {
+		t.Fatalf("stderr = %q, want kill failure diagnostic", got)
+	}
+}
+
 func restartRequestTestIntPtr(n int) *int { return &n }
diff --git a/cmd/gc/session_reconciler_test.go b/cmd/gc/session_reconciler_test.go
index e964eb5791..45a4b7ec74 100644
--- a/cmd/gc/session_reconciler_test.go
+++ b/cmd/gc/session_reconciler_test.go
@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"path/filepath"
@@ -34,6 +35,37 @@ func (f *fakeIdleTracker) checkIdle(sessionName string, _ runtime.Provider, _ ti
 
 func (f *fakeIdleTracker) setTimeout(_ string, _ time.Duration) {}
 
+type lineLimitedPeekProvider struct {
+	*runtime.Fake
+	peekLines []int
+}
+
+func (p *lineLimitedPeekProvider) Peek(name string, lines int) (string, error) {
+	p.peekLines = append(p.peekLines, lines)
+	output, err := p.Fake.Peek(name, lines)
+	if err != nil || lines <= 0 {
+		return output, err
+	}
+	parts := strings.Split(output, "\n")
+	if len(parts) <= lines {
+		return output, nil
+	}
+	return strings.Join(parts[len(parts)-lines:], "\n"), nil
+}
+
+type transientPeekErrorProvider struct {
+	*runtime.Fake
+	calls int
+}
+
+func (p *transientPeekErrorProvider) Peek(name string, lines int) (string, error) {
+	p.calls++
+	if p.calls == 1 {
+		return "", errors.New("peek failed")
+	}
+	return p.Fake.Peek(name, lines)
+}
+
 type delayedSessionExistsProvider struct {
 	*runtime.Fake
 	pendingConflict map[string]bool
@@ -41,6 +73,22 @@ type delayedSessionExistsProvider struct {
 	hiddenMeta      map[string]map[string]string
 }
 
+type failRateLimitHoldStore struct {
+	*beads.MemStore
+	failRateLimitHold  bool
+	rateLimitHoldCalls int
+}
+
+func (s *failRateLimitHoldStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if kvs["sleep_reason"] == "rate_limit" {
+		s.rateLimitHoldCalls++
+		if s.failRateLimitHold {
+			return errors.New("rate-limit hold batch failed")
+		}
+	}
+	return s.MemStore.SetMetadataBatch(id, kvs)
+}
+
 func newDelayedSessionExistsProvider() *delayedSessionExistsProvider {
 	return &delayedSessionExistsProvider{
 		Fake:            runtime.NewFake(),
@@ -115,6 +163,9 @@ type reconcilerTestEnv struct {
 }
 
 func newReconcilerTestEnv() *reconcilerTestEnv {
+	sessionCircuitBreakerMu.Lock()
+	sessionCircuitBreakerSingleton = newSessionCircuitBreaker(sessionCircuitBreakerConfig{})
+	sessionCircuitBreakerMu.Unlock()
 	return &reconcilerTestEnv{
 		store:        beads.NewMemStore(),
 		sp:           runtime.NewFake(),
@@ -220,10 +271,14 @@ func (e *reconcilerTestEnv) reconcile(sessions []beads.Bead) int {
 }
 
 func (e *reconcilerTestEnv) reconcileWithPoolDesired(sessions []beads.Bead, poolDesired map[string]int) int {
+	return e.reconcileWithPoolDesiredAndDrainOps(sessions, poolDesired, nil)
+}
+
+func (e *reconcilerTestEnv) reconcileWithPoolDesiredAndDrainOps(sessions []beads.Bead, poolDesired map[string]int, dops drainOps) int {
 	cfgNames := configuredSessionNames(e.cfg, "", e.store)
 	return reconcileSessionBeads(
 		context.Background(), sessions, e.desiredState, cfgNames, e.cfg, e.sp,
-		e.store, nil, nil, nil, e.dt, poolDesired, false, nil, "",
+		e.store, dops, nil, nil, e.dt, poolDesired, false, nil, "",
 		nil, e.clk, e.rec, 0, 0, &e.stdout, &e.stderr,
 	)
 }
@@ -365,6 +420,132 @@ func TestReconcileSessionBeads_DrainAckWithAssignedOpenWorkSleepsInsteadOfDraini
 	}
 }
 
+func TestReconcileSessionBeads_UndesiredDrainAckStopsAndCloses(t *testing.T) {
+	env := newReconcilerTestEnv()
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd"}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck("worker"); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+
+	woken := reconcileSessionBeads(
+		context.Background(),
+		[]beads.Bead{session},
+		env.desiredState,
+		nil,
+		env.cfg,
+		env.sp,
+		env.store,
+		dops,
+		nil,
+		nil,
+		env.dt,
+		nil,
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+	if env.sp.IsRunning("worker") {
+		t.Fatal("worker should be stopped after drain-ack even after leaving desired state")
+	}
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed; metadata=%v", got.Status, got.Metadata)
+	}
+	if got.Metadata["close_reason"] != "drained" {
+		t.Fatalf("close_reason = %q, want drained", got.Metadata["close_reason"])
+	}
+}
+
+func TestReconcileSessionBeads_UndesiredDrainAckWithAssignedOpenWorkSleepsInsteadOfClosing(t *testing.T) {
+	env := newReconcilerTestEnv()
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd"}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+	if _, err := env.store.Create(beads.Bead{
+		Title:    "future work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	}); err != nil {
+		t.Fatalf("Create(future work): %v", err)
+	}
+
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck("worker"); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+
+	woken := reconcileSessionBeads(
+		context.Background(),
+		[]beads.Bead{session},
+		env.desiredState,
+		nil,
+		env.cfg,
+		env.sp,
+		env.store,
+		dops,
+		nil,
+		nil,
+		env.dt,
+		nil,
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+	if env.sp.IsRunning("worker") {
+		t.Fatal("worker should be stopped after drain-ack even after leaving desired state")
+	}
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("session bead closed unexpectedly: metadata=%v", got.Metadata)
+	}
+	if got.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", got.Metadata["state"])
+	}
+	if got.Metadata["sleep_reason"] != "idle" {
+		t.Fatalf("sleep_reason = %q, want idle", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["pending_create_claim"] != "" {
+		t.Fatalf("pending_create_claim = %q, want cleared after drain-ack", got.Metadata["pending_create_claim"])
+	}
+}
+
 // TestReconcileSessionBeads_DrainAckUsesLiveStoreQuery is the regression
 // guard for the stuck-pool-worker bug on ga-ttn5z. Pool workers close
 // their own work bead with `bd close` BEFORE calling `gc runtime
@@ -625,12 +806,12 @@ func TestReconcileSessionBeads_CloseGateLiveStoreErrorKeepsSlot(t *testing.T) {
 	}
 }
 
-// TestReconcileSessionBeads_CloseGateRespectsCrossStoreAssignedWork
-// verifies that the close gate's live ownership check looks across the
-// primary store AND any attached rig stores. A city-stored asleep+idle
-// pool session with work assigned to it in a rig store must NOT get
-// its slot freed — the rig-stored work would be orphaned.
-func TestReconcileSessionBeads_CloseGateRespectsCrossStoreAssignedWork(t *testing.T) {
+// TestReconcileSessionBeads_CloseGateIgnoresUnreachableRigAssignedWork
+// verifies that the close gate's live ownership check only considers the
+// store scope the session's configured agent can query and claim from. A
+// city-scoped pool session must not be retained by unrelated rig-store work
+// that happens to share one of its assignment identifiers.
+func TestReconcileSessionBeads_CloseGateIgnoresUnreachableRigAssignedWork(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
 		Agents: []config.Agent{{Name: "worker"}},
@@ -643,11 +824,11 @@ func TestReconcileSessionBeads_CloseGateRespectsCrossStoreAssignedWork(t *testin
 		poolManagedMetadataKey: boolMetadata(true),
 	})
 
-	// Work assigned to the session lives in a rig store, not the city
-	// store. The live cross-store query must find it and veto the close.
+	// Work assigned to the session lives in a rig store, not the city store.
+	// This city-scoped session cannot claim it, so it must not veto close.
 	rigStore := beads.NewMemStore()
 	if _, err := rigStore.Create(beads.Bead{
-		Title:    "cross-store work",
+		Title:    "unreachable rig work",
 		Type:     "task",
 		Status:   "open",
 		Assignee: session.ID,
@@ -687,8 +868,120 @@ func TestReconcileSessionBeads_CloseGateRespectsCrossStoreAssignedWork(t *testin
 	if err != nil {
 		t.Fatalf("Get(%s): %v", session.ID, err)
 	}
-	if got.Status == "closed" {
-		t.Fatalf("status = %q, want open — close gate must honor cross-store assigned work and leave the pool slot for the rig-stored work to drain", got.Status)
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed — unreachable rig-store assigned work must not retain a city-scoped pool slot", got.Status)
+	}
+}
+
+func TestReconcileSessionBeads_DrainAckedOrphanCloseIgnoresUnreachableRigAssignedWork(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Agents: []config.Agent{{Name: "worker"}},
+	}
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+
+	rigStore := beads.NewMemStore()
+	if _, err := rigStore.Create(beads.Bead{
+		Title:    "unreachable rig work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	}); err != nil {
+		t.Fatalf("Create rig work bead: %v", err)
+	}
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck("worker"); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+
+	reconcileSessionBeadsAtPath(
+		context.Background(),
+		"",
+		[]beads.Bead{session},
+		env.desiredState,
+		nil,
+		env.cfg,
+		env.sp,
+		env.store,
+		dops,
+		nil,
+		map[string]beads.Store{"some-rig": rigStore},
+		nil,
+		env.dt,
+		nil,
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed — drain-acked close must ignore work in stores the session cannot reach", got.Status)
+	}
+}
+
+func TestReconcileSessionBeads_SuspendedCloseIgnoresUnreachableRigAssignedWork(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Agents: []config.Agent{{Name: "worker"}},
+	}
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+
+	rigStore := beads.NewMemStore()
+	if _, err := rigStore.Create(beads.Bead{
+		Title:    "unreachable rig work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	}); err != nil {
+		t.Fatalf("Create rig work bead: %v", err)
+	}
+
+	reconcileSessionBeadsAtPath(
+		context.Background(),
+		"",
+		[]beads.Bead{session},
+		env.desiredState,
+		map[string]bool{"worker": true},
+		env.cfg,
+		env.sp,
+		env.store,
+		newFakeDrainOps(),
+		nil,
+		map[string]beads.Store{"some-rig": rigStore},
+		nil,
+		env.dt,
+		nil,
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed — suspended close must ignore work in stores the session cannot reach", got.Status)
 	}
 }
 
@@ -1379,18 +1672,130 @@ func TestReconcileSessionBeads_AlwaysNamedSessionWakesFromDrainedCompatibilitySt
 	}
 }
 
-func TestReconcileSessionBeads_OrdinaryDesiredStateDoesNotWakeDrainedCompatibilityState(t *testing.T) {
+// TestReconcileSessionBeads_AlwaysNamedSessionWakesAfterLiveChurnSequence
+// pins the expected post-churn contract by driving the full crash-then-recover
+// sequence instead of pre-staging post-churn metadata. This covers the contract
+// needed for issue #1493, but it is not proof that the reported production
+// trigger was reproduced or fixed; keep #1493 open until reporter confirmation
+// or a production-shaped integration shard reproduces the original symptom.
+func TestReconcileSessionBeads_AlwaysNamedSessionWakesAfterLiveChurnSequence(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
-		Agents: []config.Agent{{Name: "worker", StartCommand: "true", MaxActiveSessions: intPtr(1)}},
-	}
-	env.desiredState["worker"] = TemplateParams{
-		Command:      "true",
-		SessionName:  "worker",
-		TemplateName: "worker",
+		Workspace:     config.Workspace{Name: "test-city"},
+		Agents:        []config.Agent{{Name: "worker", StartCommand: "true"}},
+		NamedSessions: []config.NamedSession{{Template: "worker", Mode: "always"}},
 	}
-	session := env.createSessionBead("worker", "worker")
-	env.setSessionMetadata(&session, map[string]string{
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		Command:                 "true",
+		SessionName:             sessionName,
+		TemplateName:            "worker",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+	}
+	session := env.createSessionBead(sessionName, "worker")
+	// Mark the bead as having woken 90 seconds ago: past stabilityThreshold
+	// (30s) and before churnProductivityThreshold (5min). This is the churn
+	// band that recordChurn fires for. The session is NOT running in the
+	// fake provider, so the reconciler will see alive=false.
+	wokeAt := env.clk.Now().Add(-90 * time.Second).UTC().Format(time.RFC3339)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"state":                      "active",
+		"last_woke_at":               wokeAt,
+		"session_key":                "old-key",
+	})
+
+	// First tick: detect non-productive death, recordChurn fires, session
+	// transitions through to asleep state.
+	env.reconcile([]beads.Bead{session})
+
+	// Reload the bead from the store to capture every metadata change made
+	// by the reconciler tick (healState, checkChurn, recordChurn).
+	reloaded, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if reloaded.Metadata["churn_count"] != "1" {
+		t.Fatalf("after tick 1 churn_count = %q, want 1 (recordChurn must fire)", reloaded.Metadata["churn_count"])
+	}
+	if reloaded.Metadata["last_woke_at"] != "" {
+		t.Fatalf("after tick 1 last_woke_at = %q, want empty (checkChurn clears it)", reloaded.Metadata["last_woke_at"])
+	}
+
+	// Second tick: the post-churn shape is now in the store. The
+	// named-always session must be re-woken on this tick.
+	env.clk.Time = env.clk.Time.Add(30 * time.Second)
+	env.reconcile([]beads.Bead{reloaded})
+
+	if !env.sp.IsRunning(sessionName) {
+		final, _ := env.store.Get(session.ID)
+		t.Fatalf(
+			"always named session %q must restart on the tick after churn (#1493); state=%q sleep_reason=%q churn_count=%q wake_attempts=%q quarantined_until=%q",
+			sessionName,
+			final.Metadata["state"],
+			final.Metadata["sleep_reason"],
+			final.Metadata["churn_count"],
+			final.Metadata["wake_attempts"],
+			final.Metadata["quarantined_until"],
+		)
+	}
+}
+
+// TestReconcileSessionBeads_QuarantinedNamedSessionStaysAsleepAfterChurn pins
+// the negative half of the post-churn invariant: when churn pushes the
+// session into quarantine, the session must stay asleep until the
+// quarantine elapses, even for mode=always.
+func TestReconcileSessionBeads_QuarantinedNamedSessionStaysAsleepAfterChurn(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Workspace:     config.Workspace{Name: "test-city"},
+		Agents:        []config.Agent{{Name: "worker", StartCommand: "true"}},
+		NamedSessions: []config.NamedSession{{Template: "worker", Mode: "always"}},
+	}
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		Command:                 "true",
+		SessionName:             sessionName,
+		TemplateName:            "worker",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+	}
+	session := env.createSessionBead(sessionName, "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"state":                      "asleep",
+		"sleep_reason":               "context-churn",
+		"churn_count":                "3",
+		"quarantined_until":          env.clk.Now().Add(15 * time.Minute).UTC().Format(time.RFC3339),
+	})
+
+	woken := env.reconcile([]beads.Bead{session})
+
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 (quarantined session must not wake during the quarantine window)", woken)
+	}
+	if env.sp.IsRunning(sessionName) {
+		t.Fatalf("quarantined named session %q must stay asleep until the quarantine elapses", sessionName)
+	}
+}
+
+func TestReconcileSessionBeads_OrdinaryDesiredStateDoesNotWakeDrainedCompatibilityState(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Agents: []config.Agent{{Name: "worker", StartCommand: "true", MaxActiveSessions: intPtr(1)}},
+	}
+	env.desiredState["worker"] = TemplateParams{
+		Command:      "true",
+		SessionName:  "worker",
+		TemplateName: "worker",
+	}
+	session := env.createSessionBead("worker", "worker")
+	env.setSessionMetadata(&session, map[string]string{
 		"state":                      "asleep",
 		"sleep_reason":               "drained",
 		"continuation_reset_pending": "true",
@@ -1441,6 +1846,111 @@ func TestReconcileSessionBeads_OnDemandNamedSessionDoesNotWakeFromDesiredStatePr
 	}
 }
 
+func TestReconcileSessionBeads_OnDemandNamedSessionWakesFromRoutedIdentityDemand(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "mayor",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{Template: "mayor", Mode: "on_demand"}},
+	}
+	sessionName := config.NamedSessionRuntimeName(cfg.EffectiveCityName(), cfg.Workspace, "mayor")
+
+	woken, running := reconcileExistingAsleepNamedSessionWithRoutedWork(t, cfg, sessionName, "mayor", "mayor")
+	if woken != 1 {
+		t.Fatalf("woken = %d, want 1", woken)
+	}
+	if !running {
+		t.Fatalf("on-demand named session %q was not started from routed identity demand", sessionName)
+	}
+}
+
+func TestReconcileSessionBeads_OnDemandNamedSessionWakesFromRoutedSingletonTemplateDemand(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "true",
+			MaxActiveSessions: intPtr(1),
+			WorkQuery:         "printf ''",
+		}},
+		NamedSessions: []config.NamedSession{{Name: "primary", Template: "worker", Mode: "on_demand"}},
+	}
+
+	woken, running := reconcileExistingAsleepNamedSessionWithRoutedWork(t, cfg, "primary", "primary", "worker")
+	if woken != 1 {
+		t.Fatalf("woken = %d, want 1", woken)
+	}
+	if !running {
+		t.Fatal("on-demand named session primary was not started from routed singleton-template demand")
+	}
+}
+
+func reconcileExistingAsleepNamedSessionWithRoutedWork(t *testing.T, cfg *config.City, sessionName, identity, routedTo string) (int, bool) {
+	t.Helper()
+
+	cityPath := t.TempDir()
+	store := beads.NewMemStore()
+	clk := &clock.Fake{Time: time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)}
+	sp := runtime.NewFake()
+	if _, err := store.Create(beads.Bead{
+		Title:  "queued named work",
+		Type:   "task",
+		Status: "open",
+		Metadata: map[string]string{
+			"gc.routed_to": routedTo,
+		},
+	}); err != nil {
+		t.Fatalf("Create(work): %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Title:  sessionName,
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name":               sessionName,
+			"alias":                      identity,
+			"template":                   cfg.NamedSessions[0].Template,
+			"state":                      "asleep",
+			"generation":                 "1",
+			"instance_token":             "canonical-token",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: identity,
+			namedSessionModeMetadata:     "on_demand",
+		},
+	}); err != nil {
+		t.Fatalf("Create(session): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	dsResult := buildDesiredState(cfg.EffectiveCityName(), cityPath, clk.Now().UTC(), cfg, sp, store, &stderr)
+	if !dsResult.NamedSessionDemand[identity] {
+		t.Fatalf("NamedSessionDemand[%s] = false for routed_to=%s; stderr:\n%s", identity, routedTo, stderr.String())
+	}
+	cfgNames := configuredSessionNames(cfg, cfg.EffectiveCityName(), store)
+	syncSessionBeads(cityPath, store, dsResult.State, sp, cfgNames, cfg, clk, &stderr, true)
+	sessions, err := loadSessionBeads(store)
+	if err != nil {
+		t.Fatalf("loadSessionBeads: %v", err)
+	}
+	poolDesired := PoolDesiredCounts(ComputePoolDesiredStates(cfg, dsResult.AssignedWorkBeads, sessions, dsResult.ScaleCheckCounts))
+	if poolDesired == nil {
+		poolDesired = make(map[string]int)
+	}
+	mergeNamedSessionDemand(poolDesired, dsResult.NamedSessionDemand, cfg)
+
+	woken := reconcileSessionBeadsAtPathWithNamedDemand(
+		context.Background(), cityPath, sessions, dsResult.State, cfgNames, cfg, sp,
+		store, nil, dsResult.AssignedWorkBeads, nil, nil, newDrainTracker(), poolDesired,
+		dsResult.NamedSessionDemand, dsResult.StoreQueryPartial, nil, cfg.EffectiveCityName(),
+		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
+	)
+	return woken, sp.IsRunning(sessionName)
+}
+
 func TestReconcileSessionBeads_SyncsGCDirWithWorkDirOverride(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
@@ -1496,77 +2006,393 @@ func TestReconcileSessionBeads_SkipsAliveSession(t *testing.T) {
 	}
 }
 
-func TestReconcileSessionBeads_SkipsQuarantinedSession(t *testing.T) {
+func TestReconcileSessionBeads_RateLimitScreenQuarantinesBeforeHeal(t *testing.T) {
 	env := newReconcilerTestEnv()
+	rec := events.NewFake()
+	env.rec = rec
 	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
-	env.addDesired("worker", "worker", false)
+	env.desiredState["worker"] = TemplateParams{
+		Command:      "test-cmd",
+		SessionName:  "worker",
+		TemplateName: "worker",
+		Hints:        agent.StartupHints{ProcessNames: []string{"agent-cli"}},
+	}
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd", ProcessNames: []string{"agent-cli"}}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+	env.sp.Zombies["worker"] = true
+	env.sp.SetPeekOutput("worker", "You've hit your limit, Pro plan\n\n/rate-limit-options")
 	session := env.createSessionBead("worker", "worker")
-	// Set quarantine in the future.
-	_ = env.store.SetMetadata(session.ID, "quarantined_until",
-		env.clk.Now().Add(10*time.Minute).UTC().Format(time.RFC3339))
-	session.Metadata["quarantined_until"] = env.clk.Now().Add(10 * time.Minute).UTC().Format(time.RFC3339)
+	env.setSessionMetadata(&session, map[string]string{
+		"state":               "active",
+		"last_woke_at":        env.clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+		"session_key":         "keep-session",
+		"started_config_hash": "keep-hash",
+		"wake_attempts":       "2",
+	})
 
 	woken := env.reconcile([]beads.Bead{session})
 
 	if woken != 0 {
-		t.Errorf("expected 0 woken (quarantined), got %d", woken)
+		t.Fatalf("woken = %d, want 0", woken)
 	}
-}
-
-func TestReconcileSessionBeads_RespectsWakeBudget(t *testing.T) {
-	env := newReconcilerTestEnv()
-	var cfgAgents []config.Agent
-	var sessions []beads.Bead
-	for i := 0; i < defaultMaxWakesPerTick+3; i++ {
-		name := fmt.Sprintf("worker-%d", i)
-		cfgAgents = append(cfgAgents, config.Agent{Name: name})
-		env.addDesired(name, name, false)
-		session := env.createSessionBead(name, name)
-		env.markSessionCreating(&session)
-		sessions = append(sessions, session)
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
 	}
-	env.cfg = &config.City{Agents: cfgAgents}
-
-	woken := env.reconcile(sessions)
-
-	if woken != defaultMaxWakesPerTick {
-		t.Errorf("expected %d woken (budget), got %d", defaultMaxWakesPerTick, woken)
+	if got.Metadata["wake_attempts"] != "2" {
+		t.Fatalf("wake_attempts = %q, want 2", got.Metadata["wake_attempts"])
+	}
+	if got.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want rate_limit", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", got.Metadata["state"])
+	}
+	qUntil, err := time.Parse(time.RFC3339, got.Metadata["quarantined_until"])
+	if err != nil {
+		t.Fatalf("quarantined_until parse: %v", err)
+	}
+	if want := env.clk.Now().Add(defaultRateLimitQuarantineDuration); !qUntil.Equal(want) {
+		t.Fatalf("quarantined_until = %s, want %s", qUntil.Format(time.RFC3339), want.Format(time.RFC3339))
+	}
+	if got.Metadata["session_key"] != "keep-session" {
+		t.Fatalf("session_key = %q, want preserved", got.Metadata["session_key"])
+	}
+	if got.Metadata["started_config_hash"] != "keep-hash" {
+		t.Fatalf("started_config_hash = %q, want preserved", got.Metadata["started_config_hash"])
+	}
+	if got.Metadata["continuation_reset_pending"] != "" {
+		t.Fatalf("continuation_reset_pending = %q, want empty", got.Metadata["continuation_reset_pending"])
+	}
+	if got.Metadata["last_woke_at"] != "" {
+		t.Fatalf("last_woke_at = %q, want cleared", got.Metadata["last_woke_at"])
+	}
+	for _, e := range rec.Events {
+		if e.Type == events.SessionCrashed {
+			t.Fatalf("recorded %s for rate-limit screen; want crash telemetry suppressed", e.Type)
+		}
 	}
 }
 
-func TestReconcileSessionBeads_ConfigDriftInitiatesDrain(t *testing.T) {
+func TestReconcileSessionBeads_RateLimitScreenBeyondCrashCaptureSuppressesTelemetry(t *testing.T) {
 	env := newReconcilerTestEnv()
+	sp := &lineLimitedPeekProvider{Fake: runtime.NewFake()}
+	rec := events.NewFake()
+	env.rec = rec
 	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
-	// Desired state has a DIFFERENT config than what's in the bead.
-	env.addRunningWorkerDesiredWithNewConfig()
+	env.desiredState["worker"] = TemplateParams{
+		Command:      "test-cmd",
+		SessionName:  "worker",
+		TemplateName: "worker",
+		Hints:        agent.StartupHints{ProcessNames: []string{"agent-cli"}},
+	}
+	if err := sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd", ProcessNames: []string{"agent-cli"}}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+	sp.Zombies["worker"] = true
+	var paneLines []string
+	paneLines = append(paneLines, "You've hit your limit, Pro plan", "", "/rate-limit-options")
+	for i := 0; i < 60; i++ {
+		paneLines = append(paneLines, fmt.Sprintf("trailing line %02d", i))
+	}
+	sp.SetPeekOutput("worker", strings.Join(paneLines, "\n"))
 	session := env.createSessionBead("worker", "worker")
-	// Session has fully started — started_config_hash records what it launched with.
-	startedHash := runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"})
 	env.setSessionMetadata(&session, map[string]string{
-		"started_config_hash": startedHash,
+		"state":               "active",
+		"last_woke_at":        env.clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+		"session_key":         "keep-session",
+		"started_config_hash": "keep-hash",
+		"wake_attempts":       "2",
 	})
 
-	// Verify hashes differ.
-	currentHash := runtime.CoreFingerprint(runtime.Config{Command: "new-cmd"})
-	if startedHash == currentHash {
-		t.Fatalf("test setup error: stored hash %q should differ from current %q", startedHash, currentHash)
+	cfgNames := configuredSessionNames(env.cfg, "", env.store)
+	woken := reconcileSessionBeads(
+		context.Background(), []beads.Bead{session}, env.desiredState, cfgNames,
+		env.cfg, sp, env.store, nil, nil, nil, env.dt, map[string]int{"worker": 1}, false, nil, "",
+		nil, env.clk, rec, 0, 0, &env.stdout, &env.stderr,
+	)
+
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+	if len(sp.peekLines) != 1 || sp.peekLines[0] != rateLimitPeekLines {
+		t.Fatalf("peek lines = %v, want single %d-line read", sp.peekLines, rateLimitPeekLines)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
 	}
+	if got.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want rate_limit", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["wake_attempts"] != "2" {
+		t.Fatalf("wake_attempts = %q, want 2", got.Metadata["wake_attempts"])
+	}
+	for _, e := range rec.Events {
+		if e.Type == events.SessionCrashed {
+			t.Fatalf("recorded %s for rate-limit marker outside old 50-line capture", e.Type)
+		}
+	}
+}
 
-	env.reconcile([]beads.Bead{session})
+func TestCachedSessionPeekRetriesAfterError(t *testing.T) {
+	sp := &transientPeekErrorProvider{Fake: runtime.NewFake()}
+	if err := sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd"}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+	sp.SetPeekOutput("worker", "You've hit your limit, Pro plan\n\n/rate-limit-options")
+	peek := cachedSessionPeek("", nil, sp, &config.City{}, "worker", nil)
 
-	ds := env.dt.get(session.ID)
-	if ds == nil {
-		t.Fatalf("expected drain to be initiated for config drift (session.ID=%q, stderr=%s)", session.ID, env.stderr.String())
+	if output, err := peek(rateLimitPeekLines); err == nil {
+		t.Fatalf("first peek err = nil, output = %q; want transient error", output)
 	}
-	if ds.reason != "config-drift" {
-		t.Errorf("drain reason = %q, want %q", ds.reason, "config-drift")
+	output, err := peek(rateLimitPeekLines)
+	if err != nil {
+		t.Fatalf("second peek should retry after transient error: %v", err)
+	}
+	if !runtime.ContainsProviderRateLimitScreen(output) {
+		t.Fatalf("second peek output = %q, want provider rate-limit screen", output)
+	}
+	if sp.calls != 2 {
+		t.Fatalf("peek calls = %d, want 2", sp.calls)
 	}
 }
 
-func TestReconcileSessionBeads_NoDriftWhenHashMatches(t *testing.T) {
+func TestRateLimitAliveFromObservationDoesNotTreatObservationErrorAsAlive(t *testing.T) {
+	if rateLimitAliveFromObservation(true, errors.New("observe failed")) {
+		t.Fatal("observation errors must not reuse runtime-running state as process-alive")
+	}
+	if !rateLimitAliveFromObservation(true, nil) {
+		t.Fatal("successful live observation should report alive")
+	}
+	if rateLimitAliveFromObservation(false, nil) {
+		t.Fatal("successful dead observation should report dead")
+	}
+}
+
+func TestReconcileSessionBeads_RateLimitScreenReholdsAfterQuarantineExpiry(t *testing.T) {
 	env := newReconcilerTestEnv()
-	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
-	env.addDesired("worker", "worker", true) // same config as bead
+	rec := events.NewFake()
+	env.rec = rec
+	env.cfg = &config.City{
+		Workspace:     config.Workspace{Name: "test-city"},
+		Providers:     map[string]config.ProviderSpec{"test-provider": {Command: "test-cmd", ProcessNames: []string{"agent-cli"}}},
+		Agents:        []config.Agent{{Name: "worker", Provider: "test-provider", StartCommand: "test-cmd"}},
+		NamedSessions: []config.NamedSession{{Template: "worker", Mode: "always"}},
+	}
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		Command:                 "test-cmd",
+		SessionName:             sessionName,
+		TemplateName:            "worker",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+		Hints:                   agent.StartupHints{ProcessNames: []string{"agent-cli"}},
+	}
+	env.sp.SetPeekOutput(sessionName, "You've hit your limit, Pro plan\n\n/rate-limit-options")
+	session := env.createSessionBead(sessionName, "worker")
+	startedHash := runtime.CoreFingerprint(runtime.Config{Command: "test-cmd", ProcessNames: []string{"agent-cli"}})
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"state":                      "active",
+		"last_woke_at":               env.clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+		"session_key":                "keep-session",
+		"started_config_hash":        startedHash,
+		"wake_attempts":              "2",
+	})
+
+	env.reconcile([]beads.Bead{session})
+	held, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get held session: %v", err)
+	}
+	if held.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("initial sleep_reason = %q, want rate_limit", held.Metadata["sleep_reason"])
+	}
+	qUntil, err := time.Parse(time.RFC3339, held.Metadata["quarantined_until"])
+	if err != nil {
+		t.Fatalf("quarantined_until parse: %v", err)
+	}
+
+	env.clk.Time = qUntil.Add(time.Second)
+	woken := env.reconcile([]beads.Bead{held})
+	if woken != 1 {
+		t.Fatalf("woken after quarantine expiry = %d, want 1", woken)
+	}
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatal("worker should be restarted after rate-limit quarantine expiry")
+	}
+	afterWake, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after wake: %v", err)
+	}
+	if got := afterWake.Metadata["session_key"]; got != "keep-session" {
+		t.Fatalf("session_key after wake = %q, want preserved", got)
+	}
+	afterWakeHash := afterWake.Metadata["started_config_hash"]
+	if afterWakeHash == "" {
+		t.Fatal("started_config_hash should be set after wake")
+	}
+
+	if err := env.sp.Stop(sessionName); err != nil {
+		t.Fatalf("Stop(%s) after wake: %v", sessionName, err)
+	}
+	env.reconcile([]beads.Bead{afterWake})
+	reheld, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get reheld session: %v", err)
+	}
+	if got := reheld.Metadata["sleep_reason"]; got != "rate_limit" {
+		t.Fatalf("sleep_reason after re-detection = %q, want rate_limit", got)
+	}
+	if got := reheld.Metadata["session_key"]; got != "keep-session" {
+		t.Fatalf("session_key after re-detection = %q, want preserved", got)
+	}
+	if got := reheld.Metadata["started_config_hash"]; got != afterWakeHash {
+		t.Fatalf("started_config_hash after re-detection = %q, want %q", got, afterWakeHash)
+	}
+	if got := reheld.Metadata["continuation_reset_pending"]; got != "" {
+		t.Fatalf("continuation_reset_pending after re-detection = %q, want empty", got)
+	}
+	for _, e := range rec.Events {
+		if e.Type == events.SessionCrashed {
+			t.Fatalf("recorded %s during rate-limit expiry/re-hold cycle", e.Type)
+		}
+	}
+}
+
+func TestReconcileSessionBeads_GenericRateLimitCrashRecordsTelemetry(t *testing.T) {
+	env := newReconcilerTestEnv()
+	rec := events.NewFake()
+	env.rec = rec
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.desiredState["worker"] = TemplateParams{
+		Command:      "test-cmd",
+		SessionName:  "worker",
+		TemplateName: "worker",
+		Hints:        agent.StartupHints{ProcessNames: []string{"agent-cli"}},
+	}
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd", ProcessNames: []string{"agent-cli"}}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+	env.sp.Zombies["worker"] = true
+	env.sp.SetPeekOutput("worker", "worker failed while parsing rate limit config")
+	session := env.createSessionBead("worker", "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		"state":               "active",
+		"last_woke_at":        env.clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+		"session_key":         "reset-session",
+		"started_config_hash": "reset-hash",
+		"wake_attempts":       "2",
+	})
+
+	woken := env.reconcile([]beads.Bead{session})
+
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["sleep_reason"] == "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want normal crash path", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["wake_attempts"] != "3" {
+		t.Fatalf("wake_attempts = %q, want 3", got.Metadata["wake_attempts"])
+	}
+	if got.Metadata["session_key"] != "" {
+		t.Fatalf("session_key = %q, want cleared after normal crash", got.Metadata["session_key"])
+	}
+	if got.Metadata["started_config_hash"] != "" {
+		t.Fatalf("started_config_hash = %q, want cleared after normal crash", got.Metadata["started_config_hash"])
+	}
+	crashRecorded := false
+	for _, e := range rec.Events {
+		if e.Type == events.SessionCrashed && e.Message == "worker failed while parsing rate limit config" {
+			crashRecorded = true
+			break
+		}
+	}
+	if !crashRecorded {
+		t.Fatal("expected SessionCrashed event for generic crash output that mentions rate limit")
+	}
+}
+
+func TestReconcileSessionBeads_SkipsQuarantinedSession(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addDesired("worker", "worker", false)
+	session := env.createSessionBead("worker", "worker")
+	// Set quarantine in the future.
+	_ = env.store.SetMetadata(session.ID, "quarantined_until",
+		env.clk.Now().Add(10*time.Minute).UTC().Format(time.RFC3339))
+	session.Metadata["quarantined_until"] = env.clk.Now().Add(10 * time.Minute).UTC().Format(time.RFC3339)
+
+	woken := env.reconcile([]beads.Bead{session})
+
+	if woken != 0 {
+		t.Errorf("expected 0 woken (quarantined), got %d", woken)
+	}
+}
+
+func TestReconcileSessionBeads_RespectsWakeBudget(t *testing.T) {
+	env := newReconcilerTestEnv()
+	var cfgAgents []config.Agent
+	var sessions []beads.Bead
+	for i := 0; i < defaultMaxWakesPerTick+3; i++ {
+		name := fmt.Sprintf("worker-%d", i)
+		cfgAgents = append(cfgAgents, config.Agent{Name: name})
+		env.addDesired(name, name, false)
+		session := env.createSessionBead(name, name)
+		env.markSessionCreating(&session)
+		sessions = append(sessions, session)
+	}
+	env.cfg = &config.City{Agents: cfgAgents}
+
+	woken := env.reconcile(sessions)
+
+	if woken != defaultMaxWakesPerTick {
+		t.Errorf("expected %d woken (budget), got %d", defaultMaxWakesPerTick, woken)
+	}
+}
+
+func TestReconcileSessionBeads_ConfigDriftInitiatesDrain(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	// Desired state has a DIFFERENT config than what's in the bead.
+	env.addRunningWorkerDesiredWithNewConfig()
+	session := env.createSessionBead("worker", "worker")
+	// Session has fully started — started_config_hash records what it launched with.
+	startedHash := runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"})
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": startedHash,
+	})
+
+	// Verify hashes differ.
+	currentHash := runtime.CoreFingerprint(runtime.Config{Command: "new-cmd"})
+	if startedHash == currentHash {
+		t.Fatalf("test setup error: stored hash %q should differ from current %q", startedHash, currentHash)
+	}
+
+	env.reconcile([]beads.Bead{session})
+
+	ds := env.dt.get(session.ID)
+	if ds == nil {
+		t.Fatalf("expected drain to be initiated for config drift (session.ID=%q, stderr=%s)", session.ID, env.stderr.String())
+	}
+	if ds.reason != "config-drift" {
+		t.Errorf("drain reason = %q, want %q", ds.reason, "config-drift")
+	}
+}
+
+func TestReconcileSessionBeads_NoDriftWhenHashMatches(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addDesired("worker", "worker", true) // same config as bead
 	session := env.createSessionBead("worker", "worker")
 	env.markSessionActive(&session)
 	env.setSessionMetadata(&session, map[string]string{
@@ -1600,6 +2426,52 @@ func TestReconcileSessionBeads_NoDriftBeforeStartedHashWritten(t *testing.T) {
 	}
 }
 
+func TestReconcileSessionBeads_DefersPendingCreateRecoveryWhileStartInFlight(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.desiredState["worker"] = TemplateParams{
+		Command:      "new-cmd",
+		SessionName:  "worker",
+		TemplateName: "worker",
+	}
+	session := env.createSessionBead("worker", "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		"command":              "old-cmd",
+		"state":                "creating",
+		"pending_create_claim": "true",
+		"last_woke_at":         env.clk.Now().UTC().Format(time.RFC3339),
+	})
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "old-cmd"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := env.sp.SetMeta("worker", "GC_SESSION_ID", session.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := env.sp.SetMeta("worker", "GC_INSTANCE_TOKEN", session.Metadata["instance_token"]); err != nil {
+		t.Fatal(err)
+	}
+
+	woken := env.reconcile([]beads.Bead{session})
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 while pending create start is still in flight", woken)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Metadata["started_config_hash"] != "" {
+		t.Fatalf("started_config_hash = %q, want empty until async start commits", got.Metadata["started_config_hash"])
+	}
+	if got.Metadata["pending_create_claim"] != "true" {
+		t.Fatalf("pending_create_claim = %q, want preserved while async start is in flight", got.Metadata["pending_create_claim"])
+	}
+	switch got.Metadata["state"] {
+	case "creating", "awake":
+	default:
+		t.Fatalf("state = %q, want creating or awake while async start is in flight", got.Metadata["state"])
+	}
+}
+
 func TestReconcileSessionBeads_PendingCreateLeasePreventsOrphanClose(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
@@ -1609,6 +2481,7 @@ func TestReconcileSessionBeads_PendingCreateLeasePreventsOrphanClose(t *testing.
 		"manual_session":       "true",
 		"pending_create_claim": "true",
 	})
+	session.CreatedAt = env.clk.Now().Add(-30 * time.Second)
 
 	woken := env.reconcile([]beads.Bead{session})
 	if woken != 0 {
@@ -1626,6 +2499,106 @@ func TestReconcileSessionBeads_PendingCreateLeasePreventsOrphanClose(t *testing.
 	}
 }
 
+func TestReconcileSessionBeads_FreshPendingCreateSurvivesStaleConfigSnapshot(t *testing.T) {
+	env := newReconcilerTestEnv()
+	session := env.createSessionBead("s-gc-late", "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		"state":                "creating",
+		"pending_create_claim": "true",
+	})
+
+	woken := env.reconcile([]beads.Bead{session})
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 without desired-state membership", woken)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get session: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("fresh pending-create session was closed as orphan: %+v", got)
+	}
+	if got.Metadata["state"] == "orphaned" || got.Metadata["close_reason"] == "orphaned" {
+		t.Fatalf("fresh pending-create session was marked orphaned: %+v", got.Metadata)
+	}
+}
+
+func TestReconcileSessionBeads_PendingCreateWithoutDesiredStateUsesNeverStartedLease(t *testing.T) {
+	env := newReconcilerTestEnv()
+	session := env.createSessionBead("s-gc-late", "worker")
+	startedAt := env.clk.Now().Add(-(pendingCreateNeverStartedTimeout - time.Minute))
+	env.setSessionMetadata(&session, map[string]string{
+		"state":                     "creating",
+		"pending_create_claim":      "true",
+		"pending_create_started_at": pendingCreateStartedAtNow(startedAt),
+		// last_woke_at deliberately empty: preWakeCommit never fired before
+		// this pending create left desired state.
+	})
+	session.CreatedAt = env.clk.Now().Add(-24 * time.Hour)
+
+	woken := env.reconcile([]beads.Bead{session})
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0 without desired-state membership", woken)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get session: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("pending-create session was closed before never-started lease expired: %+v", got)
+	}
+	if got.Metadata["state"] == "orphaned" || got.Metadata["close_reason"] == "orphaned" {
+		t.Fatalf("pending-create session was marked orphaned before never-started lease expired: %+v", got.Metadata)
+	}
+}
+
+func TestReconcileSessionBeads_ConfiguredPendingCreateWithoutDemandUsesNeverStartedLease(t *testing.T) {
+	tests := []struct {
+		name       string
+		startedAt  time.Time
+		wantClosed bool
+	}{
+		{
+			name:       "before lease expires",
+			startedAt:  time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC).Add(-(pendingCreateNeverStartedTimeout - time.Minute)),
+			wantClosed: false,
+		},
+		{
+			name:       "after lease expires",
+			startedAt:  time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC).Add(-(pendingCreateNeverStartedTimeout + time.Second)),
+			wantClosed: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			env := newReconcilerTestEnv()
+			env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+			session := env.createSessionBead("s-gc-late", "worker")
+			env.setSessionMetadata(&session, map[string]string{
+				"state":                     "creating",
+				"pending_create_claim":      "true",
+				"pending_create_started_at": pendingCreateStartedAtNow(tt.startedAt),
+				// last_woke_at deliberately empty: preWakeCommit never fired before
+				// this configured template lost pool demand.
+			})
+			session.CreatedAt = env.clk.Now().Add(-24 * time.Hour)
+
+			woken := env.reconcile([]beads.Bead{session})
+			if woken != 0 {
+				t.Fatalf("woken = %d, want 0 without desired-state membership", woken)
+			}
+			got, err := env.store.Get(session.ID)
+			if err != nil {
+				t.Fatalf("Get session: %v", err)
+			}
+			if got.Status == "closed" != tt.wantClosed {
+				t.Fatalf("status = %q, want closed=%v; metadata=%v", got.Status, tt.wantClosed, got.Metadata)
+			}
+		})
+	}
+}
+
 func TestReconcileSessionBeads_DependencyOrdering_DepDeadBlocksWake(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
@@ -1766,10 +2739,214 @@ func TestReconcileSessionBeads_OrphanDrainLogThrottled(t *testing.T) {
 	}
 }
 
-func TestReconcileSessionBeads_OrphanNotRunningClosed(t *testing.T) {
+func TestReconcileSessionBeads_DrainAckedOrphanCanceledForAssignedWork(t *testing.T) {
 	env := newReconcilerTestEnv()
-	env.cfg = &config.City{Agents: []config.Agent{{Name: "other"}}}
-	session := env.createSessionBead("orphan", "orphan")
+	env.cfg = &config.City{}
+	if err := env.sp.Start(context.Background(), "orphan", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := env.sp.SetMeta("orphan", "GC_DRAIN_ACK", "1"); err != nil {
+		t.Fatalf("SetMeta(GC_DRAIN_ACK): %v", err)
+	}
+	session := env.createSessionBead("orphan", "worker")
+	env.markSessionActive(&session)
+	work, err := env.store.Create(beads.Bead{
+		Title:    "assigned work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck("orphan"); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+	env.dt.set(session.ID, &drainState{
+		startedAt:  env.clk.Now().Add(-defaultDrainTimeout),
+		deadline:   env.clk.Now().Add(-time.Second),
+		reason:     "orphaned",
+		generation: 1,
+		ackSet:     true,
+	})
+
+	reconcileSessionBeadsAtPath(
+		context.Background(),
+		"",
+		[]beads.Bead{session},
+		nil,
+		nil,
+		env.cfg,
+		env.sp,
+		env.store,
+		dops,
+		[]beads.Bead{work},
+		nil,
+		nil,
+		env.dt,
+		map[string]int{},
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+
+	if !env.sp.IsRunning("orphan") {
+		t.Fatal("assigned-work orphan drain should be canceled before stopping the running session")
+	}
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("drain = %+v, want canceled", ds)
+	}
+	if ack, _ := env.sp.GetMeta("orphan", "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK = %q, want cleared", ack)
+	}
+}
+
+func TestReconcileSessionBeads_RecoveredDrainAckedOrphanCanceledForAssignedWork(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{}
+	if err := env.sp.Start(context.Background(), "orphan", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	session := env.createSessionBead("orphan", "worker")
+	env.markSessionActive(&session)
+	work, err := env.store.Create(beads.Bead{
+		Title:    "assigned work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	if err := setReconcilerDrainAckMetadata(env.sp, "orphan", &drainState{
+		reason:     "orphaned",
+		generation: 1,
+		ackSet:     true,
+	}); err != nil {
+		t.Fatalf("setReconcilerDrainAckMetadata: %v", err)
+	}
+
+	reconcileSessionBeadsAtPath(
+		context.Background(),
+		"",
+		[]beads.Bead{session},
+		nil,
+		nil,
+		env.cfg,
+		env.sp,
+		env.store,
+		newDrainOps(env.sp),
+		[]beads.Bead{work},
+		nil,
+		nil,
+		env.dt,
+		map[string]int{},
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+
+	if !env.sp.IsRunning("orphan") {
+		t.Fatal("recovered assigned-work orphan drain should be canceled before stopping the running session")
+	}
+	if ack, _ := env.sp.GetMeta("orphan", "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK = %q, want cleared", ack)
+	}
+	if source, _ := env.sp.GetMeta("orphan", reconcilerDrainAckSourceKey); source != "" {
+		t.Fatalf("%s = %q, want cleared", reconcilerDrainAckSourceKey, source)
+	}
+}
+
+func TestReconcileSessionBeads_DeadDrainAckedOrphanWithAssignedWorkCompletesDrain(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{}
+	session := env.createSessionBead("orphan", "worker")
+	env.markSessionActive(&session)
+	work, err := env.store.Create(beads.Bead{
+		Title:    "assigned work",
+		Type:     "task",
+		Status:   "open",
+		Assignee: session.ID,
+	})
+	if err != nil {
+		t.Fatalf("Create work bead: %v", err)
+	}
+	dops := newFakeDrainOps()
+	if err := dops.setDrainAck("orphan"); err != nil {
+		t.Fatalf("setDrainAck: %v", err)
+	}
+	env.dt.set(session.ID, &drainState{
+		startedAt:  env.clk.Now().Add(-defaultDrainTimeout),
+		deadline:   env.clk.Now().Add(-time.Second),
+		reason:     "orphaned",
+		generation: 1,
+		ackSet:     true,
+	})
+
+	reconcileSessionBeadsAtPath(
+		context.Background(),
+		"",
+		[]beads.Bead{session},
+		nil,
+		nil,
+		env.cfg,
+		env.sp,
+		env.store,
+		dops,
+		[]beads.Bead{work},
+		nil,
+		nil,
+		env.dt,
+		map[string]int{},
+		false,
+		nil,
+		"",
+		nil,
+		env.clk,
+		env.rec,
+		0,
+		0,
+		&env.stdout,
+		&env.stderr,
+	)
+
+	if env.sp.IsRunning("orphan") {
+		t.Fatal("dead provider should not be treated as recovered")
+	}
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("drain = %+v, want completed", ds)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", got.Metadata["state"])
+	}
+	if got.Metadata["sleep_reason"] != "idle" {
+		t.Fatalf("sleep_reason = %q, want idle", got.Metadata["sleep_reason"])
+	}
+}
+
+func TestReconcileSessionBeads_OrphanNotRunningClosed(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "other"}}}
+	session := env.createSessionBead("orphan", "orphan")
 
 	env.reconcile([]beads.Bead{session})
 
@@ -1851,6 +3028,55 @@ func TestReconcileSessionBeads_PreservesConfiguredNamedSessionOutsideDesiredStat
 	}
 }
 
+func TestReconcileSessionBeads_PreservedConfiguredNamedRateLimitRunsBeforeHeal(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Workspace:     config.Workspace{Name: "test-city"},
+		Agents:        []config.Agent{{Name: "worker", StartCommand: "true", MaxActiveSessions: intPtr(2)}},
+		NamedSessions: []config.NamedSession{{Template: "worker", Mode: "on_demand"}},
+	}
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	session := env.createSessionBead(sessionName, "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "on_demand",
+		"state":                      "active",
+		"last_woke_at":               env.clk.Now().Add(-10 * time.Second).UTC().Format(time.RFC3339),
+		"session_key":                "keep-session",
+		"started_config_hash":        "keep-hash",
+	})
+	env.sp.SetPeekOutput(sessionName, "You've hit your limit, Pro plan\n\n/rate-limit-options")
+
+	woken := env.reconcile([]beads.Bead{session})
+
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	if got.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want rate_limit", got.Metadata["sleep_reason"])
+	}
+	if got.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep", got.Metadata["state"])
+	}
+	if got.Metadata["session_key"] != "keep-session" {
+		t.Fatalf("session_key = %q, want preserved", got.Metadata["session_key"])
+	}
+	if got.Metadata["started_config_hash"] != "keep-hash" {
+		t.Fatalf("started_config_hash = %q, want preserved", got.Metadata["started_config_hash"])
+	}
+	if got.Metadata["continuation_reset_pending"] != "" {
+		t.Fatalf("continuation_reset_pending = %q, want empty", got.Metadata["continuation_reset_pending"])
+	}
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("unexpected drain for rate-limited configured named session: %+v", ds)
+	}
+}
+
 func TestReconcileSessionBeads_PreservedRunningNamedSessionStillIdleDrains(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{
@@ -2175,6 +3401,44 @@ func TestReconcileSessionBeads_StableClearsFailures(t *testing.T) {
 	}
 }
 
+func TestReconcileSessionBeads_StableAlreadyClearDoesNotWriteMetadata(t *testing.T) {
+	env := newReconcilerTestEnv()
+	countingStore := newCountingMetadataStore()
+	env.store = countingStore
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addDesired("worker", "worker", true)
+	session := env.createSessionBead("worker", "worker")
+	stableWake := env.clk.Now().Add(-2 * time.Minute).UTC().Format(time.RFC3339)
+	env.setSessionMetadata(&session, map[string]string{
+		"state":             "active",
+		"wake_attempts":     "3",
+		"last_woke_at":      stableWake,
+		"quarantined_until": "",
+	})
+
+	countingStore.singleCalls = 0
+	countingStore.batchCalls = 0
+	env.reconcile([]beads.Bead{session})
+	if countingStore.batchCalls == 0 {
+		t.Fatal("first stable tick should write metadata to clear wake failures")
+	}
+
+	cleared, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("getting session bead: %v", err)
+	}
+	if cleared.Metadata["wake_attempts"] != "0" {
+		t.Fatalf("wake_attempts after first tick = %q, want 0", cleared.Metadata["wake_attempts"])
+	}
+
+	countingStore.singleCalls = 0
+	countingStore.batchCalls = 0
+	env.reconcile([]beads.Bead{cleared})
+	if got := countingStore.singleCalls + countingStore.batchCalls; got != 0 {
+		t.Fatalf("second stable tick performed %d metadata write(s), want 0", got)
+	}
+}
+
 func TestReconcileSessionBeads_NoAgentNotWoken(t *testing.T) {
 	env := newReconcilerTestEnv()
 	env.cfg = &config.City{}
@@ -2412,6 +3676,405 @@ func TestReconcileSessionBeads_ConvergesPendingCreateWhenRuntimeMatchesBead(t *t
 	}
 }
 
+func TestReconcileSessionBeads_PreservesNeverStartedPendingCreateBeforeLeaseExpires(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	cfg := &config.City{Agents: []config.Agent{{Name: "helper"}}}
+	desired := map[string]TemplateParams{
+		"helper": {
+			Command:      "test-cmd",
+			SessionName:  "helper",
+			TemplateName: "helper",
+		},
+	}
+
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"session_name":              "helper",
+			"session_name_explicit":     "true",
+			"pending_create_claim":      "true",
+			"pending_create_started_at": pendingCreateStartedAtNow(clk.Now().Add(-(pendingCreateNeverStartedTimeout - time.Minute))),
+			"template":                  "helper",
+			"state":                     "creating",
+			"generation":                "1",
+			"continuation_epoch":        "1",
+			"instance_token":            "test-token",
+			// last_woke_at deliberately empty — preWakeCommit never fired.
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(bead): %v", err)
+	}
+	bead.CreatedAt = clk.Now().Add(-24 * time.Hour)
+
+	var stdout, stderr bytes.Buffer
+	cfgNames := configuredSessionNames(cfg, "", store)
+	_ = reconcileSessionBeads(
+		context.Background(), []beads.Bead{bead}, desired, cfgNames,
+		cfg, sp, store, nil, nil, nil, newDrainTracker(), map[string]int{"helper": 1}, false, nil, "",
+		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
+	)
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get(bead): %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("status = closed, want never-started pending create preserved until never-started lease expires; metadata=%v", got.Metadata)
+	}
+	if got.Metadata["close_reason"] != "" {
+		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
+	}
+}
+
+func TestReconcileSessionBeads_RollsBackPendingCreateWhenLeaseExpiredAndNoRuntime(t *testing.T) {
+	// Regression test: a session bead in the desired set with
+	// pending_create_claim=true but no live runtime AND no active lease
+	// (last_woke_at empty AND CreatedAt past the never-started pending-create
+	// window) is stuck. Without this rollback, the bead lives forever holding
+	// its alias, blocking new spawn attempts ("alias already belongs to
+	// gm-XXXX") for any session whose template still has demand.
+	store := beads.NewMemStore()
+	sp := runtime.NewFake() // no runtime started
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	cfg := &config.City{Agents: []config.Agent{{Name: "helper"}}}
+	desired := map[string]TemplateParams{
+		"helper": {
+			Command:      "test-cmd",
+			SessionName:  "helper",
+			TemplateName: "helper",
+		},
+	}
+
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"session_name":              "helper",
+			"session_name_explicit":     "true",
+			"pending_create_claim":      "true",
+			"pending_create_started_at": pendingCreateStartedAtNow(clk.Now().Add(-(pendingCreateNeverStartedTimeout + time.Second))),
+			"template":                  "helper",
+			"state":                     "creating",
+			"generation":                "1",
+			"continuation_epoch":        "1",
+			"instance_token":            "test-token",
+			// last_woke_at deliberately empty — preWakeCommit never fired.
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(bead): %v", err)
+	}
+	// Keep CreatedAt fresh to prove production pending_create_started_at anchors
+	// the never-started pending-create lease for desired sessions.
+	bead.CreatedAt = clk.Now().Add(-time.Minute)
+
+	var stdout, stderr bytes.Buffer
+	cfgNames := configuredSessionNames(cfg, "", store)
+	_ = reconcileSessionBeads(
+		context.Background(), []beads.Bead{bead}, desired, cfgNames,
+		cfg, sp, store, nil, nil, nil, newDrainTracker(), map[string]int{}, false, nil, "",
+		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
+	)
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get(bead): %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed (stale lease + no runtime should rollback)", got.Status)
+	}
+	if got.Metadata["close_reason"] != "failed-create" {
+		t.Fatalf("close_reason = %q, want failed-create", got.Metadata["close_reason"])
+	}
+}
+
+func TestReconcileSessionBeads_DoesNotRollbackStoppedPendingCreateAsExpiredLease(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	cfg := &config.City{Agents: []config.Agent{{Name: "helper"}}}
+	desired := map[string]TemplateParams{
+		"helper": {
+			Command:      "test-cmd",
+			SessionName:  "helper",
+			TemplateName: "helper",
+		},
+	}
+
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"session_name":         "helper",
+			"pending_create_claim": "true",
+			"template":             "helper",
+			"state":                "stopped",
+			"generation":           "1",
+			"continuation_epoch":   "1",
+			"instance_token":       "test-token",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(bead): %v", err)
+	}
+	bead.CreatedAt = clk.Now().Add(-24 * time.Hour)
+
+	var stdout, stderr bytes.Buffer
+	cfgNames := configuredSessionNames(cfg, "", store)
+	_ = reconcileSessionBeads(
+		context.Background(), []beads.Bead{bead}, desired, cfgNames,
+		cfg, sp, store, nil, nil, nil, newDrainTracker(), map[string]int{"helper": 1}, false, nil, "",
+		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
+	)
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get(bead): %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("status = closed, want stopped pending-create bead preserved for start retry; metadata=%v", got.Metadata)
+	}
+	if got.Metadata["close_reason"] != "" {
+		t.Fatalf("close_reason = %q, want empty", got.Metadata["close_reason"])
+	}
+}
+
+func TestReconcileSessionBeads_RateLimitPendingCreateBatchFailureRetriesBeforeRollback(t *testing.T) {
+	env := newReconcilerTestEnv()
+	store := &failRateLimitHoldStore{
+		MemStore:          beads.NewMemStore(),
+		failRateLimitHold: true,
+	}
+	env.store = store
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.desiredState["worker"] = TemplateParams{
+		Command:      "test-cmd",
+		SessionName:  "worker",
+		TemplateName: "worker",
+		Hints:        agent.StartupHints{ProcessNames: []string{"agent-cli"}},
+	}
+	if err := env.sp.Start(context.Background(), "worker", runtime.Config{Command: "test-cmd", ProcessNames: []string{"agent-cli"}}); err != nil {
+		t.Fatalf("Start(worker): %v", err)
+	}
+	env.sp.Zombies["worker"] = true
+	env.sp.SetPeekOutput("worker", "You've hit your limit, Pro plan\n\n/rate-limit-options")
+	lastWoke := env.clk.Now().Add(-2 * time.Minute).UTC().Format(time.RFC3339)
+	session := env.createSessionBead("worker", "worker")
+	session.CreatedAt = env.clk.Now().Add(-5 * time.Minute)
+	env.setSessionMetadata(&session, map[string]string{
+		"state":                 "creating",
+		"pending_create_claim":  "true",
+		"last_woke_at":          lastWoke,
+		"session_key":           "keep-session",
+		"started_config_hash":   "keep-hash",
+		"wake_attempts":         "2",
+		"continuation_epoch":    "1",
+		"session_name_explicit": "true",
+	})
+
+	if woken := env.reconcile([]beads.Bead{session}); woken != 0 {
+		t.Fatalf("woken after failed hold write = %d, want 0", woken)
+	}
+	if store.rateLimitHoldCalls != 1 {
+		t.Fatalf("rate-limit hold attempts = %d, want 1", store.rateLimitHoldCalls)
+	}
+	got, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after failed hold write: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("status = closed with close_reason=%q, want retryable pending-create hold", got.Metadata["close_reason"])
+	}
+	if got.Metadata["pending_create_claim"] != "true" {
+		t.Fatalf("pending_create_claim = %q, want preserved after failed hold write", got.Metadata["pending_create_claim"])
+	}
+	if got.Metadata["last_woke_at"] != lastWoke {
+		t.Fatalf("last_woke_at = %q, want preserved after failed hold write", got.Metadata["last_woke_at"])
+	}
+	if got.Metadata["state"] != "creating" {
+		t.Fatalf("state = %q, want unchanged creating after failed hold write", got.Metadata["state"])
+	}
+
+	store.failRateLimitHold = false
+	got.CreatedAt = session.CreatedAt
+	if woken := env.reconcile([]beads.Bead{got}); woken != 0 {
+		t.Fatalf("woken after retry = %d, want 0", woken)
+	}
+	retried, err := store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after retry: %v", err)
+	}
+	if retried.Status == "closed" {
+		t.Fatalf("status = closed after successful retry, want rate-limit hold")
+	}
+	if retried.Metadata["sleep_reason"] != "rate_limit" {
+		t.Fatalf("sleep_reason = %q, want rate_limit after retry", retried.Metadata["sleep_reason"])
+	}
+	if retried.Metadata["state"] != "asleep" {
+		t.Fatalf("state = %q, want asleep after retry", retried.Metadata["state"])
+	}
+	if retried.Metadata["pending_create_claim"] != "" {
+		t.Fatalf("pending_create_claim = %q, want cleared after durable hold", retried.Metadata["pending_create_claim"])
+	}
+	if retried.Metadata["last_woke_at"] != "" {
+		t.Fatalf("last_woke_at = %q, want cleared after durable hold", retried.Metadata["last_woke_at"])
+	}
+}
+
+func TestReconcileSessionBeads_PreservesPendingCreateWhenLeaseRecentNoRuntime(t *testing.T) {
+	// Defensive: a session bead with pending_create_claim=true and no live
+	// runtime but a *fresh* last_woke_at lease (or recently CreatedAt) must
+	// NOT be rolled back — the spawn is genuinely in flight, just not yet
+	// observable. Rolling back here would race with the async start pipeline.
+	store := beads.NewMemStore()
+	sp := runtime.NewFake() // no runtime
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	cfg := &config.City{Agents: []config.Agent{{Name: "helper"}}}
+	desired := map[string]TemplateParams{
+		"helper": {
+			Command:      "test-cmd",
+			SessionName:  "helper",
+			TemplateName: "helper",
+		},
+	}
+
+	bead, err := store.Create(beads.Bead{
+		Title:  "helper",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel, "template:helper"},
+		Metadata: map[string]string{
+			"session_name":          "helper",
+			"session_name_explicit": "true",
+			"pending_create_claim":  "true",
+			"template":              "helper",
+			"state":                 "creating",
+			"generation":            "1",
+			"continuation_epoch":    "1",
+			"instance_token":        "test-token",
+			"last_woke_at":          clk.Now().Add(-10 * time.Second).Format(time.RFC3339),
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(bead): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	cfgNames := configuredSessionNames(cfg, "", store)
+	_ = reconcileSessionBeads(
+		context.Background(), []beads.Bead{bead}, desired, cfgNames,
+		cfg, sp, store, nil, nil, nil, newDrainTracker(), map[string]int{}, false, nil, "",
+		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
+	)
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get(bead): %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("status = closed, want preserved (lease still fresh)")
+	}
+	if strings.TrimSpace(got.Metadata["pending_create_claim"]) != "true" {
+		t.Fatalf("pending_create_claim = %q, want still 'true'", got.Metadata["pending_create_claim"])
+	}
+}
+
+func TestPendingCreateNeverStartedExpiredEdges(t *testing.T) {
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	base := beads.Bead{
+		Metadata: map[string]string{
+			"pending_create_claim": "true",
+			"state":                "creating",
+		},
+	}
+
+	tests := []struct {
+		name      string
+		createdAt time.Time
+		startedAt string
+		want      bool
+	}{
+		{
+			name:      "before boundary",
+			createdAt: clk.Now().Add(-(pendingCreateNeverStartedTimeout - time.Second)),
+			want:      false,
+		},
+		{
+			name:      "exact boundary",
+			createdAt: clk.Now().Add(-pendingCreateNeverStartedTimeout),
+			want:      false,
+		},
+		{
+			name:      "after boundary",
+			createdAt: clk.Now().Add(-(pendingCreateNeverStartedTimeout + time.Second)),
+			want:      true,
+		},
+		{
+			name:      "zero created at",
+			createdAt: time.Time{},
+			want:      true,
+		},
+		{
+			name:      "started at overrides older created at before boundary",
+			createdAt: clk.Now().Add(-24 * time.Hour),
+			startedAt: pendingCreateStartedAtNow(clk.Now().Add(-(pendingCreateNeverStartedTimeout - time.Second))),
+			want:      false,
+		},
+		{
+			name:      "started at overrides fresh created at after boundary",
+			createdAt: clk.Now().Add(-time.Minute),
+			startedAt: pendingCreateStartedAtNow(clk.Now().Add(-(pendingCreateNeverStartedTimeout + time.Second))),
+			want:      true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			bead := base
+			if tt.startedAt != "" {
+				bead.Metadata = map[string]string{
+					"pending_create_claim":      "true",
+					"pending_create_started_at": tt.startedAt,
+					"state":                     "creating",
+				}
+			}
+			bead.CreatedAt = tt.createdAt
+			if got := pendingCreateNeverStartedExpired(bead, clk); got != tt.want {
+				t.Fatalf("pendingCreateNeverStartedExpired() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPendingCreateLeaseExpiredForRollbackFallsBackToStaleWindowForInvalidLastWokeAt(t *testing.T) {
+	clk := &clock.Fake{Time: time.Date(2026, 4, 30, 12, 0, 0, 0, time.UTC)}
+	base := beads.Bead{
+		Metadata: map[string]string{
+			"pending_create_claim": "true",
+			"state":                "creating",
+			"last_woke_at":         "not-a-timestamp",
+		},
+	}
+
+	recent := base
+	recent.CreatedAt = clk.Now().Add(-(staleCreatingStateTimeout - time.Second))
+	if pendingCreateLeaseExpiredForRollback(recent, clk, time.Minute) {
+		t.Fatal("invalid last_woke_at used never-started lease; want legacy stale window before rollback")
+	}
+
+	stale := base
+	stale.CreatedAt = clk.Now().Add(-(staleCreatingStateTimeout + time.Second))
+	if !pendingCreateLeaseExpiredForRollback(stale, clk, time.Minute) {
+		t.Fatal("invalid last_woke_at preserved after stale window; want rollback")
+	}
+}
+
 func TestReconcileSessionBeads_RollsBackPendingCreateWhenConflictingRuntimeAlreadyRunning(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -2443,39 +4106,185 @@ func TestReconcileSessionBeads_RollsBackPendingCreateWhenConflictingRuntimeAlrea
 	if err != nil {
 		t.Fatalf("Create(bead): %v", err)
 	}
-	if err := sp.Start(context.Background(), "sky", runtime.Config{Command: "test-cmd"}); err != nil {
-		t.Fatalf("Start(conflicting runtime): %v", err)
+	if err := sp.Start(context.Background(), "sky", runtime.Config{Command: "test-cmd"}); err != nil {
+		t.Fatalf("Start(conflicting runtime): %v", err)
+	}
+	if err := sp.SetMeta("sky", "GC_SESSION_ID", "different-bead"); err != nil {
+		t.Fatalf("SetMeta(GC_SESSION_ID): %v", err)
+	}
+	if err := sp.SetMeta("sky", "GC_INSTANCE_TOKEN", "different-token"); err != nil {
+		t.Fatalf("SetMeta(GC_INSTANCE_TOKEN): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	cfgNames := configuredSessionNames(cfg, "", store)
+	woken := reconcileSessionBeads(
+		context.Background(), []beads.Bead{bead}, desired, cfgNames,
+		cfg, sp, store, nil, nil, nil, newDrainTracker(), map[string]int{}, false, nil, "",
+		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
+	)
+	if woken != 0 {
+		t.Fatalf("woken = %d, want 0", woken)
+	}
+
+	got, err := store.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get(bead): %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed", got.Status)
+	}
+	if got.Metadata["session_name"] != "" {
+		t.Fatalf("session_name = %q, want empty after rollback", got.Metadata["session_name"])
+	}
+	if got.Metadata["close_reason"] != "failed-create" {
+		t.Fatalf("close_reason = %q, want failed-create", got.Metadata["close_reason"])
+	}
+}
+
+func TestReconcileSessionBeads_RollbackBudgetDefersExcessMismatchesAndStillStarts(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "helper"}}}
+
+	var sessions []beads.Bead
+	for i := 0; i < 6; i++ {
+		name := fmt.Sprintf("sky-%d", i)
+		env.addDesired(name, "helper", false)
+		session := env.createSessionBead(name, "helper")
+		env.markSessionCreating(&session)
+		env.setSessionMetadata(&session, map[string]string{
+			"pending_create_claim":  "true",
+			"session_name_explicit": "true",
+			"instance_token":        fmt.Sprintf("token-%d", i),
+		})
+		if err := env.sp.Start(context.Background(), name, runtime.Config{Command: "test-cmd"}); err != nil {
+			t.Fatalf("Start(%s): %v", name, err)
+		}
+		if err := env.sp.SetMeta(name, "GC_SESSION_ID", "different-"+session.ID); err != nil {
+			t.Fatalf("SetMeta(%s, GC_SESSION_ID): %v", name, err)
+		}
+		if err := env.sp.SetMeta(name, "GC_INSTANCE_TOKEN", "different-token"); err != nil {
+			t.Fatalf("SetMeta(%s, GC_INSTANCE_TOKEN): %v", name, err)
+		}
+		sessions = append(sessions, session)
+	}
+
+	env.addDesired("starter", "helper", false)
+	starter := env.createSessionBead("starter", "helper")
+	env.markSessionCreating(&starter)
+	sessions = append(sessions, starter)
+
+	if woken := env.reconcile(sessions); woken != 1 {
+		t.Fatalf("woken = %d, want 1 planned start after rollback budget is exhausted", woken)
+	}
+	if got := strings.Count(env.stderr.String(), "deferring rollback of sky-"); got != 1 {
+		t.Fatalf("deferred rollback messages = %d, want 1; stderr:\n%s", got, env.stderr.String())
 	}
-	if err := sp.SetMeta("sky", "GC_SESSION_ID", "different-bead"); err != nil {
-		t.Fatalf("SetMeta(GC_SESSION_ID): %v", err)
+	closedMismatches := 0
+	deferredMismatches := 0
+	for i := 0; i < 6; i++ {
+		name := fmt.Sprintf("sky-%d", i)
+		got, err := env.store.Get(sessions[i].ID)
+		if err != nil {
+			t.Fatalf("Get(%s): %v", sessions[i].ID, err)
+		}
+		if got.Status == "closed" {
+			if got.Metadata["close_reason"] != "failed-create" {
+				t.Fatalf("%s close_reason = %q, want failed-create", name, got.Metadata["close_reason"])
+			}
+			closedMismatches++
+			continue
+		}
+		if got.Metadata["pending_create_claim"] != "true" {
+			t.Fatalf("%s pending_create_claim = %q, want true on deferred mismatch", name, got.Metadata["pending_create_claim"])
+		}
+		deferredMismatches++
 	}
-	if err := sp.SetMeta("sky", "GC_INSTANCE_TOKEN", "different-token"); err != nil {
-		t.Fatalf("SetMeta(GC_INSTANCE_TOKEN): %v", err)
+	if closedMismatches != 5 {
+		t.Fatalf("closed mismatches = %d, want 5", closedMismatches)
+	}
+	if deferredMismatches != 1 {
+		t.Fatalf("deferred mismatches = %d, want 1", deferredMismatches)
+	}
+	started, err := env.store.Get(starter.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", starter.ID, err)
+	}
+	if started.Metadata["state"] != "active" {
+		t.Fatalf("starter state = %q, want active", started.Metadata["state"])
+	}
+	if !env.sp.IsRunning("starter") {
+		t.Fatal("starter runtime was not started after rollback budget was exhausted")
 	}
+}
 
-	var stdout, stderr bytes.Buffer
-	cfgNames := configuredSessionNames(cfg, "", store)
-	woken := reconcileSessionBeads(
-		context.Background(), []beads.Bead{bead}, desired, cfgNames,
-		cfg, sp, store, nil, nil, nil, newDrainTracker(), map[string]int{}, false, nil, "",
-		nil, clk, events.Discard, 0, 0, &stdout, &stderr,
-	)
-	if woken != 0 {
-		t.Fatalf("woken = %d, want 0", woken)
+func TestReconcileSessionBeads_RollbackBudgetDefersExcessStaleNoRuntimeCreatesAndStillStarts(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "helper"}}}
+
+	var sessions []beads.Bead
+	staleStartedAt := pendingCreateStartedAtNow(env.clk.Now().Add(-(pendingCreateNeverStartedTimeout + time.Second)))
+	for i := 0; i < 6; i++ {
+		name := fmt.Sprintf("sky-%d", i)
+		env.addDesired(name, "helper", false)
+		session := env.createSessionBead(name, "helper")
+		env.markSessionCreating(&session)
+		session.CreatedAt = env.clk.Now().Add(-24 * time.Hour)
+		env.setSessionMetadata(&session, map[string]string{
+			"pending_create_claim":      "true",
+			"pending_create_started_at": staleStartedAt,
+			"session_name_explicit":     "true",
+			"instance_token":            fmt.Sprintf("token-%d", i),
+		})
+		sessions = append(sessions, session)
 	}
 
-	got, err := store.Get(bead.ID)
-	if err != nil {
-		t.Fatalf("Get(bead): %v", err)
+	env.addDesired("starter", "helper", false)
+	starter := env.createSessionBead("starter", "helper")
+	env.markSessionCreating(&starter)
+	sessions = append(sessions, starter)
+
+	if woken := env.reconcile(sessions); woken != 1 {
+		t.Fatalf("woken = %d, want 1 planned start after rollback budget is exhausted", woken)
 	}
-	if got.Status != "closed" {
-		t.Fatalf("status = %q, want closed", got.Status)
+	if got := strings.Count(env.stderr.String(), "deferring rollback of sky-"); got != 1 {
+		t.Fatalf("deferred rollback messages = %d, want 1; stderr:\n%s", got, env.stderr.String())
 	}
-	if got.Metadata["session_name"] != "" {
-		t.Fatalf("session_name = %q, want empty after rollback", got.Metadata["session_name"])
+	closedCreates := 0
+	deferredCreates := 0
+	for i := 0; i < 6; i++ {
+		name := fmt.Sprintf("sky-%d", i)
+		got, err := env.store.Get(sessions[i].ID)
+		if err != nil {
+			t.Fatalf("Get(%s): %v", sessions[i].ID, err)
+		}
+		if got.Status == "closed" {
+			if got.Metadata["close_reason"] != "failed-create" {
+				t.Fatalf("%s close_reason = %q, want failed-create", name, got.Metadata["close_reason"])
+			}
+			closedCreates++
+			continue
+		}
+		if got.Metadata["pending_create_claim"] != "true" {
+			t.Fatalf("%s pending_create_claim = %q, want true on deferred stale create", name, got.Metadata["pending_create_claim"])
+		}
+		deferredCreates++
 	}
-	if got.Metadata["close_reason"] != "failed-create" {
-		t.Fatalf("close_reason = %q, want failed-create", got.Metadata["close_reason"])
+	if closedCreates != 5 {
+		t.Fatalf("closed stale creates = %d, want 5", closedCreates)
+	}
+	if deferredCreates != 1 {
+		t.Fatalf("deferred stale creates = %d, want 1", deferredCreates)
+	}
+	started, err := env.store.Get(starter.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", starter.ID, err)
+	}
+	if started.Metadata["state"] != "active" {
+		t.Fatalf("starter state = %q, want active", started.Metadata["state"])
+	}
+	if !env.sp.IsRunning("starter") {
+		t.Fatal("starter runtime was not started after rollback budget was exhausted")
 	}
 }
 
@@ -2842,6 +4651,331 @@ func TestReconcileSessionBeads_DriftDrainUsesConfigTimeout(t *testing.T) {
 	}
 }
 
+// --- attached-session config-drift suppression tests ---
+
+// An attached session must NEVER be restarted due to config drift.
+// The sessionAttachedForConfigDrift guard fires before any named/non-named
+// path, so the session stays running with no drain initiated.
+func TestReconcileSessionBeads_AttachedSessionNeverRestartedOnConfigDrift(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addRunningWorkerDesiredWithNewConfig()
+	session := env.createSessionBead("worker", "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"}),
+	})
+	// Mark the session as attached — a user terminal is connected.
+	env.sp.SetAttached("worker", true)
+
+	env.reconcile([]beads.Bead{session})
+
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Errorf("attached session should never be drained for config drift, got reason=%q", ds.reason)
+	}
+	if !env.sp.IsRunning("worker") {
+		t.Error("attached session should still be running after config-drift check")
+	}
+}
+
+// The deferred_attached outcome must persist across reconciler cycles:
+// as long as the session stays attached, each cycle skips config-drift restart.
+func TestReconcileSessionBeads_AttachedDeferralPersistsAcrossCycles(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addRunningWorkerDesiredWithNewConfig()
+	session := env.createSessionBead("worker", "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"}),
+	})
+	env.sp.SetAttached("worker", true)
+
+	// Run multiple reconciler cycles while attached.
+	for i := 0; i < 3; i++ {
+		env.reconcile([]beads.Bead{session})
+		if ds := env.dt.get(session.ID); ds != nil {
+			t.Fatalf("cycle %d: attached session should not be drained, got reason=%q", i, ds.reason)
+		}
+	}
+	if !env.sp.IsRunning("worker") {
+		t.Error("worker should still be running after 3 attached reconciler cycles")
+	}
+}
+
+// After detach, normal config-drift restart logic applies:
+// the session should be drained when it is no longer attached.
+func TestReconcileSessionBeads_ConfigDriftAppliesAfterDetach(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addRunningWorkerDesiredWithNewConfig()
+	session := env.createSessionBead("worker", "worker")
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"}),
+	})
+
+	// Cycle 1: attached — no drain.
+	env.sp.SetAttached("worker", true)
+	env.reconcile([]beads.Bead{session})
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("while attached: expected no drain, got reason=%q", ds.reason)
+	}
+
+	// Cycle 2: detached — drift should trigger drain.
+	env.sp.SetAttached("worker", false)
+	env.reconcile([]beads.Bead{session})
+	ds := env.dt.get(session.ID)
+	if ds == nil {
+		t.Fatal("after detach: expected drain for config drift")
+	}
+	if ds.reason != "config-drift" {
+		t.Errorf("drain reason = %q, want %q", ds.reason, "config-drift")
+	}
+}
+
+func TestReconcileSessionBeads_AttachedSessionCancelsQueuedConfigDriftDrain(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addRunningWorkerDesiredWithNewConfig()
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"}),
+	})
+
+	env.reconcile([]beads.Bead{session})
+	if ds := env.dt.get(session.ID); ds == nil || ds.reason != "config-drift" {
+		t.Fatalf("detached config drift should queue a config-drift drain, got %+v", ds)
+	}
+	if ack, _ := env.sp.GetMeta("worker", "GC_DRAIN_ACK"); ack != "1" {
+		t.Fatalf("GC_DRAIN_ACK after queued drain = %q, want 1", ack)
+	}
+
+	env.sp.SetAttached("worker", true)
+	env.clk.Time = env.clk.Now().Add(defaultDrainTimeout + time.Second)
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	env.reconcile([]beads.Bead{got})
+
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("attached session should cancel queued config-drift drain, got %+v", ds)
+	}
+	if ack, _ := env.sp.GetMeta("worker", "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK after attach cancellation = %q, want empty", ack)
+	}
+	if !env.sp.IsRunning("worker") {
+		t.Fatal("attached session should remain running after queued drain advances")
+	}
+}
+
+func TestReconcileSessionBeads_AttachedSessionCancelsQueuedConfigDriftDrainBeforeDrainAckStop(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{Agents: []config.Agent{{Name: "worker"}}}
+	env.addRunningWorkerDesiredWithNewConfig()
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		"started_config_hash": runtime.CoreFingerprint(runtime.Config{Command: "test-cmd"}),
+	})
+	dops := newDrainOps(env.sp)
+
+	env.reconcileWithPoolDesiredAndDrainOps([]beads.Bead{session}, map[string]int{"worker": 1}, dops)
+	if ds := env.dt.get(session.ID); ds == nil || ds.reason != "config-drift" {
+		t.Fatalf("detached config drift should queue a config-drift drain, got %+v", ds)
+	}
+	if ack, _ := env.sp.GetMeta("worker", "GC_DRAIN_ACK"); ack != "1" {
+		t.Fatalf("GC_DRAIN_ACK after queued drain = %q, want 1", ack)
+	}
+
+	env.sp.SetAttached("worker", true)
+	env.clk.Time = env.clk.Now().Add(defaultDrainTimeout + time.Second)
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	env.reconcileWithPoolDesiredAndDrainOps([]beads.Bead{got}, map[string]int{"worker": 1}, dops)
+
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("attached session should cancel queued config-drift drain before drain-ack stop, got %+v", ds)
+	}
+	if ack, _ := env.sp.GetMeta("worker", "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK after attach cancellation = %q, want empty", ack)
+	}
+	if !env.sp.IsRunning("worker") {
+		t.Fatal("attached session should remain running after reconciler-owned drain ack is canceled")
+	}
+}
+
+func TestReconcileSessionBeads_ConfigDriftDrainAckUsesRecentAttachedDeferral(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "new-cmd",
+			MaxActiveSessions: intPtr(1),
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "worker",
+			Mode:     "always",
+		}},
+	}
+
+	sessionName := config.NamedSessionRuntimeName(env.cfg.Workspace.Name, env.cfg.Workspace, "worker")
+	env.desiredState[sessionName] = TemplateParams{
+		TemplateName:            "worker",
+		InstanceName:            "worker",
+		Alias:                   "worker",
+		Command:                 "new-cmd",
+		ConfiguredNamedIdentity: "worker",
+		ConfiguredNamedMode:     "always",
+	}
+	oldRuntime := runtime.Config{Command: "old-cmd"}
+	oldHash := runtime.CoreFingerprint(oldRuntime)
+	if err := env.sp.Start(context.Background(), sessionName, oldRuntime); err != nil {
+		t.Fatalf("Start(old runtime): %v", err)
+	}
+
+	session := env.createSessionBead(sessionName, "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		namedSessionMetadataKey:      "true",
+		namedSessionIdentityMetadata: "worker",
+		namedSessionModeMetadata:     "always",
+		"session_key":                "old-provider-conversation",
+		"started_config_hash":        oldHash,
+		"started_live_hash":          runtime.LiveFingerprint(oldRuntime),
+	})
+	driftKey := sessionConfigDriftKey(session, env.cfg, env.desiredState[sessionName])
+	if driftKey == "" {
+		t.Fatal("expected config drift key")
+	}
+	env.setSessionMetadata(&session, map[string]string{
+		sessionAttachedConfigDriftDeferredAtMetadata:  env.clk.Now().UTC().Format(time.RFC3339),
+		sessionAttachedConfigDriftDeferredKeyMetadata: driftKey,
+	})
+
+	ds := &drainState{
+		startedAt:  env.clk.Now().UTC(),
+		deadline:   env.clk.Now().UTC().Add(defaultDrainTimeout),
+		reason:     "config-drift",
+		generation: 1,
+		ackSet:     true,
+	}
+	env.dt.set(session.ID, ds)
+	if err := setReconcilerDrainAckMetadata(env.sp, sessionName, ds); err != nil {
+		t.Fatalf("setReconcilerDrainAckMetadata: %v", err)
+	}
+	falseAttached := make([]bool, 100)
+	env.sp.SetAttachedSequence(sessionName, falseAttached...)
+
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", session.ID, err)
+	}
+	env.reconcileWithPoolDesiredAndDrainOps([]beads.Bead{got}, map[string]int{"worker": 1}, newDrainOps(env.sp))
+
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("recent attached deferral should cancel config-drift drain ack, got %+v", ds)
+	}
+	if ack, _ := env.sp.GetMeta(sessionName, "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK after recent-deferral cancellation = %q, want empty", ack)
+	}
+	if !env.sp.IsRunning(sessionName) {
+		t.Fatal("recent attached deferral should keep session running through drain-ack false negative")
+	}
+	got, err = env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after reconcile: %v", err)
+	}
+	if got.Metadata["started_config_hash"] != oldHash {
+		t.Fatalf("started_config_hash = %q, want %q", got.Metadata["started_config_hash"], oldHash)
+	}
+	if got.Metadata["session_key"] != "old-provider-conversation" {
+		t.Fatalf("session_key = %q, want old provider conversation preserved", got.Metadata["session_key"])
+	}
+}
+
+func TestReconcileSessionBeads_ConfigDriftDrainAckUsesRecentAttachedDeferralForPoolSession(t *testing.T) {
+	env := newReconcilerTestEnv()
+	env.cfg = &config.City{
+		Agents: []config.Agent{{
+			Name:              "worker",
+			StartCommand:      "new-cmd",
+			MaxActiveSessions: intPtr(1),
+		}},
+	}
+	env.desiredState["worker"] = TemplateParams{
+		TemplateName: "worker",
+		InstanceName: "worker",
+		Alias:        "worker",
+		Command:      "new-cmd",
+	}
+	oldRuntime := runtime.Config{Command: "old-cmd"}
+	oldHash := runtime.CoreFingerprint(oldRuntime)
+	if err := env.sp.Start(context.Background(), "worker", oldRuntime); err != nil {
+		t.Fatalf("Start(old runtime): %v", err)
+	}
+
+	session := env.createSessionBead("worker", "worker")
+	env.markSessionActive(&session)
+	env.setSessionMetadata(&session, map[string]string{
+		"session_key":         "old-provider-conversation",
+		"started_config_hash": oldHash,
+		"started_live_hash":   runtime.LiveFingerprint(oldRuntime),
+	})
+
+	env.sp.SetAttached("worker", true)
+	env.reconcileWithPoolDesiredAndDrainOps([]beads.Bead{session}, map[string]int{"worker": 1}, newDrainOps(env.sp))
+	got, err := env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after attached deferral: %v", err)
+	}
+	driftKey := sessionConfigDriftKey(got, env.cfg, env.desiredState["worker"])
+	if driftKey == "" {
+		t.Fatal("expected config drift key")
+	}
+	if got.Metadata[sessionAttachedConfigDriftDeferredKeyMetadata] != driftKey {
+		t.Fatalf("attached deferral key = %q, want %q", got.Metadata[sessionAttachedConfigDriftDeferredKeyMetadata], driftKey)
+	}
+
+	ds := &drainState{
+		startedAt:  env.clk.Now().UTC(),
+		deadline:   env.clk.Now().UTC().Add(defaultDrainTimeout),
+		reason:     "config-drift",
+		generation: 1,
+		ackSet:     true,
+	}
+	env.dt.set(session.ID, ds)
+	if err := setReconcilerDrainAckMetadata(env.sp, "worker", ds); err != nil {
+		t.Fatalf("setReconcilerDrainAckMetadata: %v", err)
+	}
+	falseAttached := make([]bool, 100)
+	env.sp.SetAttachedSequence("worker", falseAttached...)
+
+	env.reconcileWithPoolDesiredAndDrainOps([]beads.Bead{got}, map[string]int{"worker": 1}, newDrainOps(env.sp))
+
+	if ds := env.dt.get(session.ID); ds != nil {
+		t.Fatalf("recent attached deferral should cancel config-drift drain ack, got %+v", ds)
+	}
+	if ack, _ := env.sp.GetMeta("worker", "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK after recent-deferral cancellation = %q, want empty", ack)
+	}
+	if !env.sp.IsRunning("worker") {
+		t.Fatal("recent attached deferral should keep pool session running through drain-ack false negative")
+	}
+	got, err = env.store.Get(session.ID)
+	if err != nil {
+		t.Fatalf("Get after reconcile: %v", err)
+	}
+	if got.Metadata["started_config_hash"] != oldHash {
+		t.Fatalf("started_config_hash = %q, want %q", got.Metadata["started_config_hash"], oldHash)
+	}
+	if got.Metadata["session_key"] != "old-provider-conversation" {
+		t.Fatalf("session_key = %q, want old provider conversation preserved", got.Metadata["session_key"])
+	}
+}
+
 // --- idle timeout in bead reconciler tests ---
 
 func TestReconcileSessionBeads_IdleTimeoutStopsAndStaysAsleep(t *testing.T) {
@@ -3557,6 +5691,21 @@ func TestReconcileSessionBeads_PoolRecoveryAfterClosedBead(t *testing.T) {
 		t.Fatalf("closed bead status = %q, want closed", got.Status)
 	}
 
+	latestSnapshot, err := loadSessionBeadSnapshot(store)
+	if err != nil {
+		t.Fatalf("load latest snapshot: %v", err)
+	}
+	result := DesiredStateResult{State: ds, BaseState: ds, BeaconTime: clk.Now().UTC()}
+	refreshed := refreshDesiredStateWithSessionBeads(result, "test-city", cityPath, cfg, sp, store, latestSnapshot, &stderr)
+	ds = refreshed.State
+	newSessionName := newBead.Metadata["session_name"]
+	if newSessionName == "" {
+		t.Fatal("fresh pool bead has empty session_name")
+	}
+	if _, ok := ds[newSessionName]; !ok {
+		t.Fatalf("refreshed desired state missing fresh pool session %q; keys=%v", newSessionName, mapKeys(ds))
+	}
+
 	// Now run the reconciler with the fresh bead — it should remain open
 	// (not be closed as orphan) since the pool slot is in the desired state.
 	// The session is not running, so the reconciler should wake it.
@@ -3583,8 +5732,8 @@ func TestReconcileSessionBeads_PoolRecoveryAfterClosedBead(t *testing.T) {
 	if woken != 1 {
 		t.Fatalf("woken = %d, want 1 (recovered pool session should be started)", woken)
 	}
-	if !sp.IsRunning(sessionName) {
-		t.Fatalf("session %q not running after reconcile — pool recovery did not trigger start", sessionName)
+	if !sp.IsRunning(newSessionName) {
+		t.Fatalf("session %q not running after reconcile — pool recovery did not trigger start", newSessionName)
 	}
 }
 
@@ -3684,6 +5833,23 @@ func TestResolvePoolSlot_NamepoolThemedName(t *testing.T) {
 }
 
 func TestResolveResumeCommand(t *testing.T) {
+	codexBase := "builtin:codex"
+	codexMini, err := config.ResolveProvider(&config.Agent{Name: "codex-mini", Provider: "codex-mini"}, nil, map[string]config.ProviderSpec{
+		"codex-mini": {
+			Base:    &codexBase,
+			Command: "aimux",
+			Args: []string{
+				"run", "codex", "--",
+				"--dangerously-bypass-approvals-and-sandbox",
+				"-m", "gpt-5.3-codex-spark",
+				"-c", "model_reasoning_effort=\"medium\"",
+			},
+			ResumeCommand: "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume {{.SessionKey}}",
+		},
+	}, func(name string) (string, error) { return "/usr/bin/" + name, nil })
+	if err != nil {
+		t.Fatalf("ResolveProvider(codex-mini): %v", err)
+	}
 	tests := []struct {
 		name       string
 		command    string
@@ -3738,6 +5904,13 @@ func TestResolveResumeCommand(t *testing.T) {
 			},
 			want: "my-agent --continue",
 		},
+		{
+			name:       "explicit wrapped codex resume command includes inferred defaults",
+			command:    "aimux run codex -- --dangerously-bypass-approvals-and-sandbox --model gpt-5.3-codex-spark -c model_reasoning_effort=medium",
+			sessionKey: "def-456",
+			provider:   codexMini,
+			want:       "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume -c model_reasoning_effort=medium def-456",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/cmd/gc/session_reconciler_trace_collector.go b/cmd/gc/session_reconciler_trace_collector.go
index 4f5346b3cc..40aa9cdcfc 100644
--- a/cmd/gc/session_reconciler_trace_collector.go
+++ b/cmd/gc/session_reconciler_trace_collector.go
@@ -73,6 +73,7 @@ type SessionReconcilerTraceCycle struct {
 	recordCount        int
 	droppedRecords     int
 	droppedBatches     int
+	ended              bool
 	dropReasons        map[string]int
 	completionStatus   TraceCompletionStatus
 	traceMode          TraceMode
@@ -121,7 +122,7 @@ func newSessionReconcilerTracer(cityPath, cityName string, stderr io.Writer) *Se
 		flushDone: make(chan struct{}),
 		closeCh:   make(chan struct{}),
 	}
-	go tracer.runFlushLoop()
+	go tracer.runFlushLoop(tracer.flushCh)
 	return tracer
 }
 
@@ -161,9 +162,9 @@ func (t *SessionReconcilerTracer) Close() error {
 	return t.store.Close()
 }
 
-func (t *SessionReconcilerTracer) runFlushLoop() {
+func (t *SessionReconcilerTracer) runFlushLoop(flushCh <-chan sessionReconcilerTraceFlushRequest) {
 	defer close(t.flushDone)
-	for req := range t.flushCh {
+	for req := range flushCh {
 		err := t.store.AppendBatch(req.records, req.durability)
 		select {
 		case req.result <- err:
@@ -273,6 +274,13 @@ func (c *SessionReconcilerTraceCycle) addRecord(rec SessionReconcilerTraceRecord
 		c.dropReasons["record_budget_exceeded"]++
 		return
 	}
+	if c.ended {
+		rec.ensureFields()
+		rec.Fields["post_cycle_result"] = true
+		rec.Fields["rollup_excluded"] = true
+		c.records = append(c.records, rec)
+		return
+	}
 	c.accumulateRecordLocked(rec)
 	c.records = append(c.records, rec)
 	c.recordCount++
@@ -866,6 +874,10 @@ func (c *SessionReconcilerTraceCycle) RecordTraceControl(action string, scopeTyp
 	c.addRecord(rec)
 }
 
+// End flushes the cycle and writes a cycle-result trace record. Caller fields
+// are intentionally open-ended: known rollup keys are merged through
+// coalesceTraceField, so caller values keep priority there; additional non-nil
+// caller fields are preserved for site-specific trace context.
 func (c *SessionReconcilerTraceCycle) End(completion TraceCompletionStatus, fields map[string]any) error {
 	if c == nil || c.tracer == nil || !c.tracer.Enabled() {
 		return nil
@@ -874,6 +886,8 @@ func (c *SessionReconcilerTraceCycle) End(completion TraceCompletionStatus, fiel
 	dur := now.Sub(c.start)
 	c.mu.Lock()
 	batch := append([]SessionReconcilerTraceRecord(nil), c.records...)
+	c.records = nil
+	c.ended = true
 	droppedRecords := c.droppedRecords
 	droppedBatches := c.droppedBatches
 	dropReasons := make(map[string]int, len(c.dropReasons))
@@ -918,6 +932,11 @@ func (c *SessionReconcilerTraceCycle) End(completion TraceCompletionStatus, fiel
 		"dropped_batch_count":     droppedBatches,
 		"drop_reason_counts":      dropReasons,
 	}
+	for k, v := range fields {
+		if _, ok := rollup[k]; !ok {
+			rollup[k] = v
+		}
+	}
 	rec := newTraceRecord(TraceRecordCycleResult).withCycle(c, now)
 	rec.SiteCode = TraceSiteCycleFinish
 	rec.CompletionStatus = completion
diff --git a/cmd/gc/session_reconciler_trace_integration_test.go b/cmd/gc/session_reconciler_trace_integration_test.go
index 98fd0b0b8f..b0c055551d 100644
--- a/cmd/gc/session_reconciler_trace_integration_test.go
+++ b/cmd/gc/session_reconciler_trace_integration_test.go
@@ -345,6 +345,7 @@ func TestSessionReconcilerTraceStartAndDrainSubOps(t *testing.T) {
 		sp,
 		store,
 		"trace-town",
+		"",
 		clock.Real{},
 		events.NewFake(),
 		5*time.Second,
diff --git a/cmd/gc/session_reconciler_trace_test.go b/cmd/gc/session_reconciler_trace_test.go
index 53f1ca18b6..2d074823f5 100644
--- a/cmd/gc/session_reconciler_trace_test.go
+++ b/cmd/gc/session_reconciler_trace_test.go
@@ -52,6 +52,45 @@ func TestNormalizeTraceOutcomeCodeAcceptsDeferredActive(t *testing.T) {
 	}
 }
 
+func TestConfigDriftTracePayloadIncludesDriftedFields(t *testing.T) {
+	payload := configDriftTracePayload("stored", "current", []string{"CopyFiles"}, traceRecordPayload{
+		"active_reason": "attached",
+	})
+
+	fields, ok := payload["drifted_fields"].([]string)
+	if !ok {
+		t.Fatalf("drifted_fields type = %T, want []string", payload["drifted_fields"])
+	}
+	if len(fields) != 1 || fields[0] != "CopyFiles" {
+		t.Fatalf("drifted_fields = %v, want [CopyFiles]", fields)
+	}
+	if payload["stored_hash"] != "stored" || payload["current_hash"] != "current" {
+		t.Fatalf("hash fields missing from payload: %#v", payload)
+	}
+	if payload["active_reason"] != "attached" {
+		t.Fatalf("extra field not preserved: %#v", payload)
+	}
+}
+
+func TestConfigDriftTracePayloadReservedFieldsOverrideExtras(t *testing.T) {
+	payload := configDriftTracePayload("stored", "current", []string{"CopyFiles"}, traceRecordPayload{
+		"stored_hash":    "extra-stored",
+		"current_hash":   "extra-current",
+		"drifted_fields": []string{"Command"},
+	})
+
+	fields, ok := payload["drifted_fields"].([]string)
+	if !ok {
+		t.Fatalf("drifted_fields type = %T, want []string", payload["drifted_fields"])
+	}
+	if len(fields) != 1 || fields[0] != "CopyFiles" {
+		t.Fatalf("drifted_fields = %v, want [CopyFiles]", fields)
+	}
+	if payload["stored_hash"] != "stored" || payload["current_hash"] != "current" {
+		t.Fatalf("reserved hash fields should win over extras: %#v", payload)
+	}
+}
+
 func TestTraceArmStorePersistence(t *testing.T) {
 	cityDir := t.TempDir()
 	store := newSessionReconcilerTraceArmStore(cityDir)
@@ -458,6 +497,98 @@ func TestTraceCycleResultRollupIncludesFlushedRecords(t *testing.T) {
 	}
 }
 
+func TestTraceFlushAfterEndOnlyPersistsPostEndRecords(t *testing.T) {
+	cityDir := t.TempDir()
+	tracer := newSessionReconcilerTracer(cityDir, "trace-town", io.Discard)
+	if !tracer.Enabled() {
+		t.Fatal("tracer should be enabled")
+	}
+	now := time.Now().UTC()
+	if _, err := tracer.armStore.upsertArm(TraceArm{
+		ScopeType:      TraceArmScopeTemplate,
+		ScopeValue:     "worker",
+		Source:         TraceArmSourceManual,
+		Level:          TraceModeDetail,
+		ArmedAt:        now,
+		ExpiresAt:      now.Add(15 * time.Minute),
+		LastExtendedAt: now,
+		UpdatedAt:      now,
+	}); err != nil {
+		t.Fatalf("upsertArm: %v", err)
+	}
+	cycle := tracer.BeginCycle(TraceTickTriggerPatrol, "", time.Now().UTC(), &config.City{})
+	if cycle == nil {
+		t.Fatal("BeginCycle returned nil")
+	}
+	cycle.RecordOperation(
+		TraceSiteLifecycleStartExecute,
+		TraceReasonWake,
+		TraceOutcomeApplied,
+		"provider_start",
+		"worker",
+		"worker",
+		10*time.Millisecond,
+		map[string]any{"step": "before-end"},
+	)
+	if err := cycle.End(TraceCompletionCompleted, map[string]any{}); err != nil {
+		t.Fatalf("End: %v", err)
+	}
+	cycle.RecordOperation(
+		TraceSiteLifecycleStartExecute,
+		TraceReasonWake,
+		TraceOutcomeApplied,
+		"provider_start",
+		"worker",
+		"worker",
+		20*time.Millisecond,
+		map[string]any{"step": "after-end"},
+	)
+	if err := cycle.flushCurrentBatch(TraceDurabilityDurable); err != nil {
+		t.Fatalf("flushCurrentBatch: %v", err)
+	}
+	if err := tracer.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	records, err := ReadTraceRecords(traceCityRuntimeDir(cityDir), TraceFilter{})
+	if err != nil {
+		t.Fatalf("ReadTraceRecords: %v", err)
+	}
+	var beforeEnd, afterEnd int
+	var cycleResult *SessionReconcilerTraceRecord
+	for _, rec := range records {
+		if rec.RecordType == TraceRecordCycleResult {
+			recCopy := rec
+			cycleResult = &recCopy
+			continue
+		}
+		if rec.RecordType != TraceRecordOperation {
+			continue
+		}
+		switch rec.Fields["step"] {
+		case "before-end":
+			beforeEnd++
+		case "after-end":
+			if got := rec.Fields["post_cycle_result"]; got != true {
+				t.Fatalf("post_cycle_result = %#v, want true", got)
+			}
+			if got := rec.Fields["rollup_excluded"]; got != true {
+				t.Fatalf("rollup_excluded = %#v, want true", got)
+			}
+			afterEnd++
+		}
+	}
+	if cycleResult == nil {
+		t.Fatal("cycle_result missing")
+	}
+	if cycleResult.RecordCount >= len(records) {
+		t.Fatalf("cycle_result record_count = %d, want less than persisted records %d because post-End records are rollup-excluded", cycleResult.RecordCount, len(records))
+	}
+	if beforeEnd != 1 || afterEnd != 1 {
+		t.Fatalf("operation counts before-end=%d after-end=%d, want 1 each", beforeEnd, afterEnd)
+	}
+}
+
 func TestTraceFlushCurrentBatchQueueFullDegrades(t *testing.T) {
 	cityDir := t.TempDir()
 	store, err := newSessionReconcilerTraceStore(cityDir, io.Discard)
@@ -496,6 +627,30 @@ func TestTraceFlushCurrentBatchQueueFullDegrades(t *testing.T) {
 	}
 }
 
+func TestTraceCloseDoesNotDependOnMutableFlushChannelField(t *testing.T) {
+	cityDir := t.TempDir()
+	store, err := newSessionReconcilerTraceStore(cityDir, io.Discard)
+	if err != nil {
+		t.Fatalf("new store: %v", err)
+	}
+	defer store.Close() //nolint:errcheck
+
+	flushCh := make(chan sessionReconcilerTraceFlushRequest)
+	tracer := &SessionReconcilerTracer{
+		store:     store,
+		flushDone: make(chan struct{}),
+		flushCh:   nil,
+	}
+	go tracer.runFlushLoop(flushCh)
+	close(flushCh)
+
+	select {
+	case <-tracer.flushDone:
+	case <-time.After(time.Second):
+		t.Fatal("flush loop did not exit after the original channel closed")
+	}
+}
+
 func TestTraceFlushCurrentBatchWaitBudgetDegrades(t *testing.T) {
 	cityDir := t.TempDir()
 	store, err := newSessionReconcilerTraceStore(cityDir, io.Discard)
diff --git a/cmd/gc/session_reconciler_trace_types.go b/cmd/gc/session_reconciler_trace_types.go
index 00f7a4f5d3..94ec5058ae 100644
--- a/cmd/gc/session_reconciler_trace_types.go
+++ b/cmd/gc/session_reconciler_trace_types.go
@@ -69,6 +69,7 @@ const (
 	TraceSitePoolWorkspaceCap        TraceSiteCode = "reconciler.pool.workspace_cap"
 	TraceSitePoolAccept              TraceSiteCode = "reconciler.pool.accept"
 	TraceSitePoolMinFill             TraceSiteCode = "reconciler.pool.min_fill"
+	TraceSitePoolInFlightReuse       TraceSiteCode = "reconciler.pool.inflight_reuse"
 	TraceSiteReconcilerUnknownState  TraceSiteCode = "reconciler.session.skip_unknown_state"
 	TraceSiteReconcilerOrphaned      TraceSiteCode = "reconciler.session.orphan_or_suspended"
 	TraceSiteReconcilerCloseOrphan   TraceSiteCode = "reconciler.session.close_orphan"
@@ -119,6 +120,7 @@ const (
 	TraceReasonWorkspaceCap           TraceReasonCode = "workspace_cap"
 	TraceReasonCap                    TraceReasonCode = "cap"
 	TraceReasonMinFill                TraceReasonCode = "min_fill"
+	TraceReasonInFlightReuse          TraceReasonCode = "inflight_reuse"
 	TraceReasonWake                   TraceReasonCode = "wake"
 	TraceReasonIdleTimeout            TraceReasonCode = "idle_timeout"
 	TraceReasonStaleGeneration        TraceReasonCode = "stale_generation"
@@ -533,6 +535,7 @@ func normalizeTraceSiteCode(raw string) (TraceSiteCode, string) {
 		TraceSitePoolWorkspaceCap,
 		TraceSitePoolAccept,
 		TraceSitePoolMinFill,
+		TraceSitePoolInFlightReuse,
 		TraceSiteReconcilerUnknownState,
 		TraceSiteReconcilerOrphaned,
 		TraceSiteReconcilerCloseOrphan,
@@ -595,6 +598,7 @@ func normalizeTraceReasonCode(raw string) (TraceReasonCode, string) {
 		TraceReasonWorkspaceCap,
 		TraceReasonCap,
 		TraceReasonMinFill,
+		TraceReasonInFlightReuse,
 		TraceReasonWake,
 		TraceReasonIdleTimeout,
 		TraceReasonStaleGeneration,
diff --git a/cmd/gc/session_resolve.go b/cmd/gc/session_resolve.go
index c7d40e2381..101c3b401d 100644
--- a/cmd/gc/session_resolve.go
+++ b/cmd/gc/session_resolve.go
@@ -57,12 +57,12 @@ func resolveConfiguredNamedSessionID(
 	if !ok {
 		return "", false, fmt.Errorf("%w: %q", session.ErrSessionNotFound, identifier)
 	}
-	snapshot, err := loadSessionBeadSnapshot(store)
+	lookup, err := session.LookupConfiguredNamedSession(store, spec)
 	if err != nil {
-		return "", true, err
+		return "", true, fmt.Errorf("looking up configured named session: %w", err)
 	}
-	if bead, ok := findCanonicalNamedSessionBead(snapshot, spec); ok {
-		return bead.ID, true, nil
+	if lookup.HasCanonical {
+		return lookup.Canonical.ID, true, nil
 	}
 	// When materializing, check for a closed bead with this identity and
 	// reopen it (preserves bead ID for reference continuity).
@@ -73,8 +73,8 @@ func resolveConfiguredNamedSessionID(
 			return bead.ID, true, nil
 		}
 	}
-	if bead, conflict := findNamedSessionConflict(snapshot, spec); conflict {
-		return "", true, fmt.Errorf("%w: %q conflicts with configured named session %q via live bead %s", errNamedSessionConflict, identifier, spec.Identity, bead.ID)
+	if lookup.HasConflict {
+		return "", true, fmt.Errorf("%w: %q conflicts with configured named session %q via live bead %s", errNamedSessionConflict, identifier, spec.Identity, lookup.Conflict.ID)
 	}
 	if !opts.materialize {
 		return "", false, fmt.Errorf("%w: %q", session.ErrSessionNotFound, identifier)
diff --git a/cmd/gc/session_resolve_test.go b/cmd/gc/session_resolve_test.go
index 8e782054d1..c9d4a3e72a 100644
--- a/cmd/gc/session_resolve_test.go
+++ b/cmd/gc/session_resolve_test.go
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -13,6 +14,139 @@ import (
 	"github.com/gastownhall/gascity/internal/session"
 )
 
+type listQueryCaptureStore struct {
+	beads.Store
+	listCalls []beads.ListQuery
+}
+
+func (s *listQueryCaptureStore) List(q beads.ListQuery) ([]beads.Bead, error) {
+	s.listCalls = append(s.listCalls, q)
+	return s.Store.List(q)
+}
+
+func TestResolveConfiguredNamedSessionID_BoundedListCalls(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city", SessionTemplate: "{{.City}}--{{.Agent}}"},
+		Agents: []config.Agent{{
+			Name:         "mayor",
+			StartCommand: "true",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+		}},
+	}
+	cityName := config.EffectiveCityName(cfg, filepath.Base(cityPath))
+	spec, ok := findNamedSessionSpec(cfg, cityName, "mayor")
+	if !ok {
+		t.Fatal("findNamedSessionSpec(mayor) = false")
+	}
+
+	inner := beads.NewMemStore()
+	for i := 0; i < 200; i++ {
+		_, _ = inner.Create(beads.Bead{
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"session_name": fmt.Sprintf("worker-%d", i),
+			},
+		})
+	}
+	target, err := inner.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name":               spec.SessionName,
+			"alias":                      "mayor",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+			namedSessionModeMetadata:     spec.Mode,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(canonical): %v", err)
+	}
+
+	store := &listQueryCaptureStore{Store: inner}
+	id, matched, err := resolveConfiguredNamedSessionID(cityPath, cfg, store, "mayor", namedSessionResolveOptions{})
+	if err != nil {
+		t.Fatalf("resolveConfiguredNamedSessionID: %v", err)
+	}
+	if !matched {
+		t.Fatalf("matched = false, want true")
+	}
+	if id != target.ID {
+		t.Fatalf("got %q, want canonical %q", id, target.ID)
+	}
+	if len(store.listCalls) == 0 {
+		t.Fatalf("expected at least one List call")
+	}
+	if len(store.listCalls) != 1 {
+		t.Fatalf("List calls = %d, want 1 canonical lookup", len(store.listCalls))
+	}
+	for i, q := range store.listCalls {
+		if len(q.Metadata) == 0 {
+			t.Fatalf("List call #%d has no metadata filter (would scan all beads): %+v", i, q)
+		}
+	}
+}
+
+func TestResolveConfiguredNamedSessionID_BoundedConflictListCalls(t *testing.T) {
+	cityPath := t.TempDir()
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city", SessionTemplate: "{{.City}}--{{.Agent}}"},
+		Agents: []config.Agent{{
+			Name:         "mayor",
+			StartCommand: "true",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+		}},
+	}
+	cityName := config.EffectiveCityName(cfg, filepath.Base(cityPath))
+	spec, ok := findNamedSessionSpec(cfg, cityName, "mayor")
+	if !ok {
+		t.Fatal("findNamedSessionSpec(mayor) = false")
+	}
+
+	inner := beads.NewMemStore()
+	_, err := inner.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": spec.SessionName,
+			"template":     "other",
+			"agent_name":   "other",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(conflict): %v", err)
+	}
+
+	store := &listQueryCaptureStore{Store: inner}
+	_, matched, err := resolveConfiguredNamedSessionID(cityPath, cfg, store, "mayor", namedSessionResolveOptions{})
+	if err == nil {
+		t.Fatal("resolveConfiguredNamedSessionID succeeded, want conflict")
+	}
+	if !matched {
+		t.Fatalf("matched = false, want true")
+	}
+	if !errors.Is(err, errNamedSessionConflict) {
+		t.Fatalf("error = %v, want errNamedSessionConflict", err)
+	}
+	if len(store.listCalls) == 0 {
+		t.Fatalf("expected at least one List call")
+	}
+	if len(store.listCalls) > 4 {
+		t.Fatalf("List calls = %d, want bounded small constant without duplicate session_name lookup", len(store.listCalls))
+	}
+	for i, q := range store.listCalls {
+		if len(q.Metadata) == 0 {
+			t.Fatalf("List call #%d has no metadata filter (would scan all beads): %+v", i, q)
+		}
+	}
+}
+
 func TestResolveSessionID_BeadID(t *testing.T) {
 	store := beads.NewMemStore()
 	// Create a real session bead so the direct lookup succeeds.
@@ -87,6 +221,64 @@ func TestResolveSessionID_QualifiedAliasBasename(t *testing.T) {
 	}
 }
 
+func TestResolveSessionIDWithConfig_UsesTargetedConfiguredNamedLookup(t *testing.T) {
+	// The configured-named-session lookup must stay bounded so wake/dispatch
+	// don't fan out under reconciler load. Pre-collapse this issued four
+	// metadata-field List calls per resolution; the fix for ga-pa57 folded
+	// them into one label-scoped scan with in-process filtering. The
+	// assertion has been relaxed from "no broad scan" to "≤2 List calls"
+	// because the fan-out budget — not the query shape — is what mattered.
+	store := &countingSessionListStore{MemStore: beads.NewMemStore()}
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:         "mayor",
+			StartCommand: "true",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+		}},
+	}
+	cityPath := t.TempDir()
+	sessionName := config.NamedSessionRuntimeName(cfg.EffectiveCityName(), cfg.Workspace, "mayor")
+	b, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name":               sessionName,
+			"alias":                      "mayor",
+			namedSessionMetadataKey:      "true",
+			namedSessionIdentityMetadata: "mayor",
+			namedSessionModeMetadata:     "on_demand",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(canonical): %v", err)
+	}
+
+	startCalls := store.calls
+	id, err := resolveSessionIDWithConfig(cityPath, cfg, store, "mayor")
+	if err != nil {
+		t.Fatalf("resolveSessionIDWithConfig(mayor): %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+	if delta := store.calls - startCalls; delta > 2 {
+		t.Fatalf("resolveSessionIDWithConfig issued %d List calls, want ≤2 (regression risk for ga-pa57 contention)", delta)
+	}
+}
+
+type countingSessionListStore struct {
+	*beads.MemStore
+	calls int
+}
+
+func (s *countingSessionListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.calls++
+	return s.MemStore.List(query)
+}
+
 func TestResolveSessionID_DoesNotResolveHistoricalAlias(t *testing.T) {
 	store := beads.NewMemStore()
 	_, _ = store.Create(beads.Bead{
@@ -569,6 +761,50 @@ func TestResolveSessionIDMaterializingNamed_AdoptsCanonicalRuntimeSessionNameBea
 	}
 }
 
+func TestResolveConfiguredNamedSessionID_AdoptsCanonicalRuntimeSessionNameBeadWithoutIdentityMetadata(t *testing.T) {
+	store := beads.NewMemStore()
+	cityPath := t.TempDir()
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test-city"},
+		Agents: []config.Agent{{
+			Name:         "mayor",
+			StartCommand: "true",
+		}},
+		NamedSessions: []config.NamedSession{{
+			Template: "mayor",
+		}},
+	}
+	spec, ok := findNamedSessionSpec(cfg, config.EffectiveCityName(cfg, filepath.Base(cityPath)), "mayor")
+	if !ok {
+		t.Fatal("findNamedSessionSpec(mayor) = false")
+	}
+	bead, err := store.Create(beads.Bead{
+		Title:  "mayor",
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": spec.SessionName,
+			"template":     "mayor",
+			"agent_name":   "mayor",
+			"state":        "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("store.Create(): %v", err)
+	}
+
+	id, matched, err := resolveConfiguredNamedSessionID(cityPath, cfg, store, "mayor", namedSessionResolveOptions{})
+	if err != nil {
+		t.Fatalf("resolveConfiguredNamedSessionID(mayor): %v", err)
+	}
+	if !matched {
+		t.Fatalf("matched = false, want true")
+	}
+	if id != bead.ID {
+		t.Fatalf("resolved ID = %q, want adopted bead %q", id, bead.ID)
+	}
+}
+
 func TestResolveSessionIDMaterializingNamed_DoesNotAdoptOrdinaryPoolSessionForSameTemplate(t *testing.T) {
 	t.Setenv("GC_SESSION", "fake")
 
diff --git a/cmd/gc/session_types.go b/cmd/gc/session_types.go
index af5fd06b25..f4ad9201dd 100644
--- a/cmd/gc/session_types.go
+++ b/cmd/gc/session_types.go
@@ -210,10 +210,23 @@ const (
 	// after exceeding max wake failures.
 	defaultQuarantineDuration = 5 * time.Minute
 
+	// defaultRateLimitQuarantineDuration is how long to hold a session when
+	// the pane shows a provider rate-limit screen. This is intentionally
+	// longer than crash-loop quarantine because immediate retries cannot help;
+	// 30m limits noisy respawn cycles for common minute-scale provider limits
+	// while still re-detecting and re-quarantining during longer windows.
+	defaultRateLimitQuarantineDuration = 30 * time.Minute
+
 	// defaultMaxWakeAttempts is how many consecutive wake failures before
 	// quarantine.
 	defaultMaxWakeAttempts = 5
 
+	// rateLimitPeekLines is the amount of pane scrollback inspected before a
+	// rapid dead process is classified as a crash. Known provider rate-limit
+	// screens are short, so 120 lines favors robust detection over shaving a
+	// cheap pane read.
+	rateLimitPeekLines = 120
+
 	// churnProductivityThreshold is how long a session must run to be
 	// considered productive. Sessions that survive past stabilityThreshold
 	// but die before this threshold are "churning" — alive long enough to
diff --git a/cmd/gc/session_wake.go b/cmd/gc/session_wake.go
index af0d6cc2d2..774290f4c7 100644
--- a/cmd/gc/session_wake.go
+++ b/cmd/gc/session_wake.go
@@ -232,6 +232,23 @@ func cancelSessionDrainForPending(session beads.Bead, sp runtime.Provider, dt *d
 	return cancelSessionDrainIf(session, sp, dt, pendingDrainReasonCancelable)
 }
 
+func cancelOrphanedSessionDrainForAssignedWork(session beads.Bead, sp runtime.Provider, dt *drainTracker) bool {
+	return cancelSessionDrainIf(session, sp, dt, func(reason string) bool {
+		// Only concrete assigned work overrides an orphan drain; generic
+		// work-query and named-demand wakeups intentionally do not.
+		return reason == "orphaned"
+	})
+}
+
+func cancelSessionConfigDriftDrain(session beads.Bead, sp runtime.Provider, dt *drainTracker) bool {
+	if dt == nil {
+		return false
+	}
+	return cancelSessionDrainIf(session, sp, dt, func(reason string) bool {
+		return reason == "config-drift"
+	})
+}
+
 func cancelSessionDrainIf(session beads.Bead, sp runtime.Provider, dt *drainTracker, canCancel func(string) bool) bool {
 	ds := dt.get(session.ID)
 	if ds == nil {
@@ -336,6 +353,16 @@ func cancelRecoveredReconcilerAckedDrain(session beads.Bead, sp runtime.Provider
 	return true
 }
 
+func cancelRecoveredOrphanedDrainForAssignedWork(session beads.Bead, sp runtime.Provider, name string) bool {
+	reason, ok := reconcilerDrainAckMatchesSession(session, sp, name)
+	if !ok || reason != "orphaned" {
+		return false
+	}
+	clearReconcilerDrainAckMetadata(sp, name)
+	telemetry.RecordDrainTransition(context.Background(), name, reason, "cancel")
+	return true
+}
+
 // advanceSessionDrains checks all in-progress drains. Called once per tick.
 //
 //nolint:unparam // workSet is nil in the drain path; WakeWork flows via ComputeAwakeSet instead
@@ -449,6 +476,18 @@ func advanceSessionDrainsWithSessionsTraced(
 			}
 		}
 
+		if eval, ok := wakeEvals[session.ID]; ok &&
+			eval.Reason == "assigned-work" &&
+			containsWakeReason(eval.Reasons, WakeWork) &&
+			ds.reason == "orphaned" {
+			if cancelOrphanedSessionDrainForAssignedWork(*session, sp, dt) {
+				if trace != nil {
+					trace.recordDecision("reconciler.drain.cancel", normalizedSessionTemplate(*session, cfg), name, ds.reason, "cancel_assigned_work", nil, nil, "")
+				}
+				continue
+			}
+		}
+
 		// Cancelation check: if wake reasons reappeared, cancel the in-memory
 		// drain. Orphaned, suspended, and ordinary config-drift drains are not
 		// canceled here.
diff --git a/cmd/gc/session_wake_test.go b/cmd/gc/session_wake_test.go
index 71687c8b48..789073de38 100644
--- a/cmd/gc/session_wake_test.go
+++ b/cmd/gc/session_wake_test.go
@@ -1022,6 +1022,81 @@ func TestAdvanceSessionDrains_DeferredInterrupt_CanceledBeforeSignal(t *testing.
 	}
 }
 
+func TestAdvanceSessionDrains_OrphanedDrainCanceledForAssignedWork(t *testing.T) {
+	now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
+	clk := &clock.Fake{Time: now}
+	sp := runtime.NewFake()
+	store := beads.NewMemStore()
+	dt := newDrainTracker()
+
+	if err := sp.Start(context.Background(), "test-session", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := sp.SetMeta("test-session", "GC_DRAIN_ACK", "1"); err != nil {
+		t.Fatalf("SetMeta(GC_DRAIN_ACK): %v", err)
+	}
+	b, err := store.Create(beads.Bead{
+		Title:  "test",
+		Type:   sessionBeadType,
+		Labels: []string{sessionBeadLabel},
+		Metadata: map[string]string{
+			"session_name": "test-session",
+			"template":     "worker",
+			"provider":     "claude",
+			"work_dir":     t.TempDir(),
+			"generation":   "3",
+			"state":        "active",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	dt.set(b.ID, &drainState{
+		startedAt:  now.Add(-10 * time.Second),
+		deadline:   now.Add(20 * time.Second),
+		reason:     "orphaned",
+		generation: 3,
+		ackSet:     true,
+	})
+	advanceSessionDrainsWithSessions(
+		dt,
+		sp,
+		store,
+		func(id string) *beads.Bead {
+			got, _ := store.Get(id)
+			return &got
+		},
+		[]beads.Bead{b},
+		map[string]wakeEvaluation{
+			b.ID: {
+				Reasons: []WakeReason{WakeWork},
+				Reason:  "assigned-work",
+			},
+		},
+		&config.City{Agents: []config.Agent{{Name: "worker"}}},
+		nil,
+		nil,
+		nil,
+		clk,
+	)
+
+	if ds := dt.get(b.ID); ds != nil {
+		t.Fatalf("drain = %+v, want canceled for assigned work", ds)
+	}
+	if ack, _ := sp.GetMeta("test-session", "GC_DRAIN_ACK"); ack != "" {
+		t.Fatalf("GC_DRAIN_ACK = %q, want cleared after assigned-work cancellation", ack)
+	}
+	if !sp.IsRunning("test-session") {
+		t.Fatal("session should stay running after assigned-work cancellation")
+	}
+	for _, call := range sp.Calls {
+		if call.Method == "Interrupt" || call.Method == "Stop" {
+			t.Fatalf("runtime call %s should not happen after assigned-work cancellation; calls=%#v", call.Method, sp.Calls)
+		}
+	}
+}
+
 func TestAdvanceSessionDrains_DeferredInterrupt_CancelableNoSignal(t *testing.T) {
 	// For cancelable drains (no-wake-reason, idle), verify the drain is
 	// canceled before the deferred interrupt fires.
diff --git a/cmd/gc/session_work_guard.go b/cmd/gc/session_work_guard.go
index 634585674f..0265376971 100644
--- a/cmd/gc/session_work_guard.go
+++ b/cmd/gc/session_work_guard.go
@@ -6,16 +6,21 @@ import (
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
 )
 
-// closeSessionBeadIfUnassigned closes a session bead only when the live
-// store confirms no open or in-progress work is assigned to it across
-// the primary store AND any attached rig stores. Callers must NOT pass
-// a pre-computed work snapshot — this helper queries the stores itself
-// so its decision cannot be poisoned by a stale snapshot taken earlier
-// in the tick (see the PR that retired the snapshot-based variant).
-// Live-query failures fail closed: the bead stays open until assignment
-// can be re-verified.
+// closeSessionBeadIfUnassigned closes a session bead only when the live store
+// confirms no open or in-progress work is assigned to it across the primary
+// store AND any attached rig stores. Use this cross-store guard for cleanup
+// paths that must not orphan work in any attached store. Reconciler paths that
+// close a session according to its configured agent reachability should use
+// closeSessionBeadIfReachableStoreUnassigned instead.
+//
+// Callers must NOT pass a pre-computed work snapshot — this helper queries the
+// stores itself so its decision cannot be poisoned by a stale snapshot taken
+// earlier in the tick (see the PR that retired the snapshot-based variant).
+// Live-query failures fail closed: the bead stays open until assignment can be
+// re-verified.
 func closeSessionBeadIfUnassigned(
 	store beads.Store,
 	rigStores map[string]beads.Store,
@@ -37,3 +42,31 @@ func closeSessionBeadIfUnassigned(
 	}
 	return closeBead(store, session.ID, reason, now, stderr)
 }
+
+// closeSessionBeadIfReachableStoreUnassigned closes a session bead only when
+// the live store scope its configured agent can query has no open or
+// in-progress work assigned to the session. It returns whether the close
+// succeeded, matching closeSessionBeadIfUnassigned's contract.
+func closeSessionBeadIfReachableStoreUnassigned(
+	cityPath string,
+	cfg *config.City,
+	store beads.Store,
+	rigStores map[string]beads.Store,
+	session beads.Bead,
+	reason string,
+	now time.Time,
+	stderr io.Writer,
+) bool {
+	if stderr == nil {
+		stderr = io.Discard
+	}
+	hasAssignedWork, err := sessionHasOpenAssignedWorkForReachableStore(cityPath, cfg, store, rigStores, session)
+	if err != nil {
+		fmt.Fprintf(stderr, "session work guard: checking reachable assigned work for %s: %v\n", session.ID, err) //nolint:errcheck
+		return false
+	}
+	if hasAssignedWork {
+		return false
+	}
+	return closeBead(store, session.ID, reason, now, stderr)
+}
diff --git a/cmd/gc/store_target_exec.go b/cmd/gc/store_target_exec.go
index 6dc2e4d116..9cc50ed568 100644
--- a/cmd/gc/store_target_exec.go
+++ b/cmd/gc/store_target_exec.go
@@ -7,7 +7,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 )
 
@@ -45,7 +44,7 @@ func copyExecProjectedDoltEnv(dst, src map[string]string) {
 }
 
 func gcExecStoreEnv(cityPath string, target execStoreTarget, provider string) map[string]string {
-	env := citylayout.CityRuntimeEnvMap(cityPath)
+	env := cityRuntimeEnvMapForCity(cityPath)
 	env["GC_PROVIDER"] = provider
 	env["GC_STORE_ROOT"] = target.ScopeRoot
 	env["GC_STORE_SCOPE"] = target.ScopeKind
diff --git a/cmd/gc/store_target_exec_test.go b/cmd/gc/store_target_exec_test.go
index b01f1445f2..83cd655779 100644
--- a/cmd/gc/store_target_exec_test.go
+++ b/cmd/gc/store_target_exec_test.go
@@ -143,6 +143,40 @@ func TestGcExecLifecycleInitProcessEnvDoesNotProjectCanonicalFilesOwnedFlagForGc
 	}
 }
 
+func TestGcExecLifecycleInitProcessEnvDoesNotLeakAmbientBEADS_DIRForGcBeadsK8s(t *testing.T) {
+	cityDir := t.TempDir()
+	rigDir := filepath.Join(cityDir, "rigs", "frontend")
+	if err := os.MkdirAll(rigDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeExecStoreCityConfig(t, cityDir, "metro-city", "ct", []config.Rig{{
+		Name:   "frontend",
+		Path:   "rigs/frontend",
+		Prefix: "fe",
+	}})
+
+	t.Setenv("BEADS_DIR", "/tmp/ambient-beads")
+	target := execStoreTarget{
+		ScopeRoot: rigDir,
+		ScopeKind: "rig",
+		Prefix:    "fe",
+		RigName:   "frontend",
+	}
+	env, err := gcExecLifecycleInitProcessEnv(cityDir, target, "exec:/tmp/gc-beads-k8s")
+	if err != nil {
+		t.Fatalf("gcExecLifecycleInitProcessEnv(gc-beads-k8s): %v", err)
+	}
+	if got := envSliceValue(env, "BEADS_DIR"); got != "" {
+		t.Fatalf("BEADS_DIR leaked as %q", got)
+	}
+	if got := envSliceValue(env, "GC_STORE_ROOT"); got != rigDir {
+		t.Fatalf("GC_STORE_ROOT = %q, want %q", got, rigDir)
+	}
+	if got := envSliceValue(env, "GC_RIG"); got != "frontend" {
+		t.Fatalf("GC_RIG = %q, want frontend", got)
+	}
+}
+
 func TestGcExecStoreEnvProjectsGCBinForGcBeadsBd(t *testing.T) {
 	cityDir := t.TempDir()
 	oldResolve := resolveProviderLifecycleGCBinary
@@ -469,7 +503,7 @@ func TestControllerStateOpenRigStoreExecProjectsRigTarget(t *testing.T) {
 	t.Setenv("GC_DOLT_HOST", "ambient-dolt")
 
 	cs := &controllerState{cityPath: cityDir}
-	store := cs.openRigStore(provider, "frontend", rigDir, "fe")
+	store := cs.openRigStore(provider, "frontend", rigDir, "fe", nil)
 	if _, err := store.Create(beads.Bead{Title: "rig"}); err != nil {
 		t.Fatalf("Create: %v", err)
 	}
diff --git a/cmd/gc/template_resolve.go b/cmd/gc/template_resolve.go
index 836d7e0f47..640561e8d9 100644
--- a/cmd/gc/template_resolve.go
+++ b/cmd/gc/template_resolve.go
@@ -24,7 +24,6 @@ import (
 	"strings"
 
 	"github.com/gastownhall/gascity/internal/agent"
-	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/convergence"
@@ -76,7 +75,7 @@ type TemplateParams struct {
 	RigRoot string
 	// WakeMode controls whether the next wake resumes or starts fresh conversation state.
 	WakeMode string
-	// IsACP is true if session = "acp".
+	// IsACP is true when the resolved session transport is SessionTransportACP.
 	IsACP bool
 	// HookEnabled reports whether provider hooks are installed for this agent.
 	// Hooks complement startup delivery but do not replace the initial
@@ -132,8 +131,14 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 	}
 	sessionTransport := config.ResolveSessionCreateTransport(cfgAgent.Session, resolved)
 	// Step 2: Validate session vs provider compatibility.
-	if sessionTransport == "acp" && !resolved.SupportsACP {
-		return TemplateParams{}, fmt.Errorf("agent %q: session = \"acp\" but provider %q does not support ACP (set supports_acp = true on the provider)", qualifiedName, resolved.Name)
+	switch sessionTransport {
+	case config.SessionTransportACP:
+		if !resolved.SupportsACP {
+			return TemplateParams{}, fmt.Errorf("agent %q: session = \"acp\" but provider %q does not support ACP (set supports_acp = true on the provider)", qualifiedName, resolved.Name)
+		}
+	case "", config.SessionTransportTmux:
+	default:
+		return TemplateParams{}, fmt.Errorf("agent %q: unknown session transport %q", qualifiedName, sessionTransport)
 	}
 
 	// Step 3: Expand dir template.
@@ -152,10 +157,13 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 	// Step 5: Build copy_files and command with settings args + schema defaults.
 	var copyFiles []runtime.CopyEntry
 	var command string
-	if sessionTransport == "acp" {
+	switch sessionTransport {
+	case config.SessionTransportACP:
 		command = resolved.ACPCommandString()
-	} else {
+	case "", config.SessionTransportTmux:
 		command = resolved.CommandString()
+	default:
+		return TemplateParams{}, fmt.Errorf("agent %q: unknown session transport %q", qualifiedName, sessionTransport)
 	}
 	// Append schema-derived default args (e.g., --dangerously-skip-permissions
 	// from EffectiveDefaults["permission_mode"] = "unrestricted").
@@ -194,7 +202,7 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 
 	// Step 7: Resolve session bead ID for traceability.
 	// Look up the session bead by session_name to get the bead ID (e.g., mc-cnf).
-	// This is what MC uses to link beads → session logs.
+	// This is what real-world apps use to link beads to session logs.
 	sessionBeadID := ""
 	if p.sessionBeads != nil {
 		for _, b := range p.sessionBeads.Open() {
@@ -205,7 +213,7 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 		}
 	}
 	if sessionBeadID == "" && p.beadStore != nil {
-		if all, err := p.beadStore.List(beads.ListQuery{Label: "gc:session"}); err == nil {
+		if all, err := session.ExactMetadataSessionCandidates(p.beadStore, false, map[string]string{"session_name": sessName}); err == nil {
 			for _, b := range all {
 				if !session.IsSessionBeadOrRepairable(b) || b.Status == "closed" {
 					continue
@@ -244,7 +252,7 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 		// Rig-scoped agents override the rig-specific keys below.
 		"GT_ROOT": p.cityPath,
 	}
-	for key, value := range citylayout.CityRuntimeEnvMap(p.cityPath) {
+	for key, value := range cityRuntimeEnvMapForCity(p.cityPath) {
 		agentEnv[key] = value
 	}
 	agentEnv["GC_BEADS"] = rawBeadsProviderForScope(rigRoot, p.cityPath)
@@ -277,6 +285,8 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 		CityRoot:      p.cityPath,
 		AgentName:     qualifiedName,
 		TemplateName:  cfgAgent.Name,
+		BindingName:   cfgAgent.BindingName,
+		BindingPrefix: cfgAgent.BindingPrefix(),
 		RigName:       rigName,
 		RigRoot:       rigRoot,
 		WorkDir:       workDir,
@@ -343,7 +353,9 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 	}
 
 	// Step 10: Merge environment layers.
-	env := convergence.ScrubTokenEnv(mergeEnv(passthroughEnv(), expandEnvMap(resolved.Env), expandEnvMap(cfgAgent.Env), agentEnv))
+	env := mergeEnv(passthroughEnv(), expandEnvMap(resolved.Env), expandEnvMap(cfgAgent.Env), agentEnv)
+	prependGCBinDirToPATH(env, env["GC_BIN"])
+	env = convergence.ScrubTokenEnv(env)
 
 	// Step 11: Expand session setup templates.
 	configDir := p.cityPath
@@ -478,7 +490,7 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 		}
 	}
 	var mcpServers []runtime.MCPServerConfig
-	if sessionTransport == "acp" {
+	if sessionTransport == config.SessionTransportACP {
 		mcpServers = materialize.RuntimeMCPServers(mcpCatalog.Servers)
 	}
 
@@ -515,7 +527,7 @@ func resolveTemplate(p *agentBuildParams, cfgAgent *config.Agent, qualifiedName
 		RigName:          rigName,
 		RigRoot:          rigRoot,
 		WakeMode:         cfgAgent.WakeMode,
-		IsACP:            sessionTransport == "acp",
+		IsACP:            sessionTransport == config.SessionTransportACP,
 		HookEnabled:      hasHooks,
 		MCPServers:       mcpServers,
 	}, nil
@@ -562,14 +574,14 @@ func templateParamsToConfig(tp TemplateParams) runtime.Config {
 		// SessionStart hooks can enrich context, but the startup prompt still
 		// needs a first-turn delivery mechanism. Without argv/flag/nudge
 		// delivery, freshly spawned workers sit idle at the provider prompt.
-		if tp.ResolvedProvider != nil && tp.ResolvedProvider.PromptMode == "none" {
-			if nudge != "" {
-				nudge = tp.Prompt + "\n\n---\n\n" + nudge
-			} else {
-				nudge = tp.Prompt
-			}
+		switch {
+		case tp.IsACP:
+			nudge = prependStartupPromptToNudge(tp.Prompt, nudge)
+			startupPromptDelivered = true
+		case tp.ResolvedProvider != nil && tp.ResolvedProvider.PromptMode == "none":
+			nudge = prependStartupPromptToNudge(tp.Prompt, nudge)
 			startupPromptDelivered = true
-		} else {
+		default:
 			promptSuffix = shellquote.Quote(tp.Prompt)
 			startupPromptDelivered = promptSuffix != ""
 			if tp.ResolvedProvider != nil && tp.ResolvedProvider.PromptMode == "flag" {
@@ -616,3 +628,10 @@ func templateParamsToConfig(tp TemplateParams) runtime.Config {
 		FingerprintExtra:       tp.FPExtra,
 	}
 }
+
+func prependStartupPromptToNudge(prompt, nudge string) string {
+	if nudge != "" {
+		return prompt + "\n\n---\n\n" + nudge
+	}
+	return prompt
+}
diff --git a/cmd/gc/template_resolve_env_test.go b/cmd/gc/template_resolve_env_test.go
new file mode 100644
index 0000000000..2839210823
--- /dev/null
+++ b/cmd/gc/template_resolve_env_test.go
@@ -0,0 +1,136 @@
+package main
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestResolveTemplatePrependsGCBinDirToPATH(t *testing.T) {
+	cityPath := t.TempDir()
+	writeTemplateResolveCityConfig(t, cityPath, "file")
+	sep := string(os.PathListSeparator)
+	t.Setenv("PATH", "/opt/homebrew/bin"+sep+"/usr/bin")
+
+	params := &agentBuildParams{
+		cityName:   "city",
+		cityPath:   cityPath,
+		workspace:  &config.Workspace{Provider: "test"},
+		providers:  map[string]config.ProviderSpec{"test": {Command: "echo", PromptMode: "none"}},
+		lookPath:   func(string) (string, error) { return "/bin/echo", nil },
+		fs:         fsys.OSFS{},
+		beaconTime: time.Unix(0, 0),
+		beadNames:  make(map[string]string),
+		stderr:     io.Discard,
+	}
+
+	agent := &config.Agent{Name: "runner"}
+	tp, err := resolveTemplate(params, agent, agent.QualifiedName(), nil)
+	if err != nil {
+		t.Fatalf("resolveTemplate: %v", err)
+	}
+
+	gcBin := tp.Env["GC_BIN"]
+	if gcBin == "" {
+		t.Fatal("GC_BIN is empty")
+	}
+	wantDir := filepath.Dir(gcBin)
+	parts := strings.Split(tp.Env["PATH"], sep)
+	if len(parts) == 0 || parts[0] != wantDir {
+		t.Fatalf("PATH first entry = %q, want gc bin dir %q (PATH=%q)", parts[0], wantDir, tp.Env["PATH"])
+	}
+	count := 0
+	for _, part := range parts {
+		if part == wantDir {
+			count++
+		}
+	}
+	if count != 1 {
+		t.Fatalf("gc bin dir %q should appear exactly once, found %d in PATH=%q", wantDir, count, tp.Env["PATH"])
+	}
+}
+
+func TestResolveTemplatePrependsGCBinDirToConfiguredAgentPATH(t *testing.T) {
+	cityPath := t.TempDir()
+	writeTemplateResolveCityConfig(t, cityPath, "file")
+	sep := string(os.PathListSeparator)
+	t.Setenv("PATH", "/opt/homebrew/bin"+sep+"/usr/bin")
+
+	params := &agentBuildParams{
+		cityName:   "city",
+		cityPath:   cityPath,
+		workspace:  &config.Workspace{Provider: "test"},
+		providers:  map[string]config.ProviderSpec{"test": {Command: "echo", PromptMode: "none"}},
+		lookPath:   func(string) (string, error) { return "/bin/echo", nil },
+		fs:         fsys.OSFS{},
+		beaconTime: time.Unix(0, 0),
+		beadNames:  make(map[string]string),
+		stderr:     io.Discard,
+	}
+
+	configuredPATH := "/custom/tools" + sep + "/usr/local/bin"
+	agent := &config.Agent{
+		Name: "runner",
+		Env:  map[string]string{"PATH": configuredPATH},
+	}
+	tp, err := resolveTemplate(params, agent, agent.QualifiedName(), nil)
+	if err != nil {
+		t.Fatalf("resolveTemplate: %v", err)
+	}
+
+	gcBin := tp.Env["GC_BIN"]
+	if gcBin == "" {
+		t.Fatal("GC_BIN is empty")
+	}
+	wantDir := filepath.Dir(gcBin)
+	parts := strings.Split(tp.Env["PATH"], sep)
+	wantPrefix := []string{wantDir, "/custom/tools", "/usr/local/bin"}
+	if len(parts) < len(wantPrefix) {
+		t.Fatalf("PATH=%q has fewer entries than expected prefix %v", tp.Env["PATH"], wantPrefix)
+	}
+	for i, want := range wantPrefix {
+		if parts[i] != want {
+			t.Fatalf("PATH entry %d = %q, want %q (PATH=%q)", i, parts[i], want, tp.Env["PATH"])
+		}
+	}
+}
+
+func TestResolveTemplateUsesTrustedRuntimeRootForControlTraceDefault(t *testing.T) {
+	cityPath := t.TempDir()
+	writeTemplateResolveCityConfig(t, cityPath, "file")
+	customRuntimeDir := filepath.Join(t.TempDir(), "runtime-root")
+	t.Setenv("GC_CITY_PATH", cityPath)
+	t.Setenv("GC_CITY_RUNTIME_DIR", customRuntimeDir)
+
+	params := &agentBuildParams{
+		cityName:   "city",
+		cityPath:   cityPath,
+		workspace:  &config.Workspace{Provider: "test"},
+		providers:  map[string]config.ProviderSpec{"test": {Command: "echo", PromptMode: "none"}},
+		lookPath:   func(string) (string, error) { return "/bin/echo", nil },
+		fs:         fsys.OSFS{},
+		beaconTime: time.Unix(0, 0),
+		beadNames:  make(map[string]string),
+		stderr:     io.Discard,
+	}
+
+	agent := &config.Agent{Name: "runner"}
+	tp, err := resolveTemplate(params, agent, agent.QualifiedName(), nil)
+	if err != nil {
+		t.Fatalf("resolveTemplate: %v", err)
+	}
+
+	if got := tp.Env["GC_CITY_RUNTIME_DIR"]; got != customRuntimeDir {
+		t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q", got, customRuntimeDir)
+	}
+	wantTraceDefault := filepath.Join(customRuntimeDir, "control-dispatcher-trace.log")
+	if got := tp.Env["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"]; got != wantTraceDefault {
+		t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q", got, wantTraceDefault)
+	}
+}
diff --git a/cmd/gc/template_resolve_phase2_test.go b/cmd/gc/template_resolve_phase2_test.go
index a1145425d7..5e40f356b5 100644
--- a/cmd/gc/template_resolve_phase2_test.go
+++ b/cmd/gc/template_resolve_phase2_test.go
@@ -20,6 +20,8 @@ type phase2ProviderCase struct {
 	family                string
 	wantCommand           string
 	wantCommandPrefix     string
+	wantPromptMode        string
+	wantPromptFlag        string
 	wantSettingsArg       bool
 	wantReadyDelayMs      int
 	wantReadyPromptPrefix string
@@ -86,6 +88,15 @@ func selectedPhase2ProviderCases(t *testing.T) []phase2ProviderCase {
 			wantModelOverride:     "gemini-2.5-pro",
 			wantModelOverrideArgs: []string{"--model", "gemini-2.5-pro"},
 		},
+		{
+			profileID:        "opencode/tmux-cli",
+			family:           "opencode",
+			wantCommand:      "opencode",
+			wantPromptMode:   "flag",
+			wantPromptFlag:   "--prompt",
+			wantReadyDelayMs: 8000,
+			wantProcessNames: []string{"opencode", "node", "bun"},
+		},
 	}
 
 	filter := strings.TrimSpace(os.Getenv("PROFILE"))
@@ -146,6 +157,9 @@ func resolvePhase2Template(t *testing.T, tc phase2ProviderCase) TemplateParams {
 		SessionLive:        []string{"echo live-" + tc.family},
 		Env:                map[string]string{"WORKER_CORE_MARKER": tc.family},
 	}
+	if strings.HasSuffix(string(tc.profileID), "/tmux-cli") {
+		agentCfg.Session = "tmux"
+	}
 
 	tp, err := resolveTemplate(params, agentCfg, agentCfg.QualifiedName(), map[string]string{"phase": "phase2"})
 	if err != nil {
diff --git a/cmd/gc/template_resolve_prompt_test.go b/cmd/gc/template_resolve_prompt_test.go
index 12d441d946..70622d9412 100644
--- a/cmd/gc/template_resolve_prompt_test.go
+++ b/cmd/gc/template_resolve_prompt_test.go
@@ -90,6 +90,65 @@ func TestTemplateParamsToConfigFlagModePrependsFlag(t *testing.T) {
 	}
 }
 
+func TestTemplateParamsToConfigACPUsesProtocolNudgeForStartupPrompt(t *testing.T) {
+	tp := TemplateParams{
+		Command: "opencode acp",
+		Prompt:  "You are an agent.",
+		IsACP:   true,
+		ResolvedProvider: &config.ResolvedProvider{
+			Name:       "opencode",
+			Command:    "opencode",
+			PromptMode: "flag",
+			PromptFlag: "--prompt",
+		},
+	}
+
+	cfg := templateParamsToConfig(tp)
+
+	if cfg.Command != "opencode acp" {
+		t.Fatalf("Command = %q, want ACP server command unchanged", cfg.Command)
+	}
+	if cfg.PromptSuffix != "" {
+		t.Fatalf("PromptSuffix = %q, want empty for ACP startup prompt", cfg.PromptSuffix)
+	}
+	if cfg.PromptFlag != "" {
+		t.Fatalf("PromptFlag = %q, want empty for ACP startup prompt", cfg.PromptFlag)
+	}
+	if cfg.Nudge != "You are an agent." {
+		t.Fatalf("Nudge = %q, want startup prompt delivered over ACP", cfg.Nudge)
+	}
+	if cfg.Env[startupPromptDeliveredEnv] != "1" {
+		t.Fatalf("%s not marked for ACP startup prompt delivery", startupPromptDeliveredEnv)
+	}
+}
+
+func TestTemplateParamsToConfigACPCombinesStartupPromptWithExistingNudge(t *testing.T) {
+	tp := TemplateParams{
+		Command: "opencode acp",
+		Prompt:  "startup prompt",
+		IsACP:   true,
+		Hints: agent.StartupHints{
+			Nudge: "existing nudge",
+		},
+		ResolvedProvider: &config.ResolvedProvider{
+			Name:       "opencode",
+			Command:    "opencode",
+			PromptMode: "flag",
+			PromptFlag: "--prompt",
+		},
+	}
+
+	cfg := templateParamsToConfig(tp)
+
+	if cfg.PromptSuffix != "" {
+		t.Fatalf("PromptSuffix = %q, want empty for ACP startup prompt", cfg.PromptSuffix)
+	}
+	want := "startup prompt\n\n---\n\nexisting nudge"
+	if cfg.Nudge != want {
+		t.Fatalf("Nudge = %q, want %q", cfg.Nudge, want)
+	}
+}
+
 func TestTemplateParamsToConfigFlagModeMissingFlagDoesNotMarkPromptDelivered(t *testing.T) {
 	tp := TemplateParams{
 		Command: "myprovider",
@@ -310,7 +369,7 @@ func TestTemplateParamsToConfigNilResolvedProvider(t *testing.T) {
 	}
 }
 
-func TestResolveTemplateNoneModeRetainsPromptForDeferredDelivery(t *testing.T) {
+func TestResolveTemplateFlagModeRetainsPromptForStartupDelivery(t *testing.T) {
 	cityPath := t.TempDir()
 	fs := fsys.NewFake()
 	fs.Files[cityPath+"/prompts/pool-worker.md"] = []byte("pool prompt body")
@@ -338,7 +397,10 @@ func TestResolveTemplateNoneModeRetainsPromptForDeferredDelivery(t *testing.T) {
 		t.Fatalf("resolveTemplate: %v", err)
 	}
 	if tp.Prompt == "" {
-		t.Fatal("Prompt should be preserved for PromptMode=none providers so it can be delivered via nudge")
+		t.Fatal("Prompt should be preserved for flag-mode providers so it can be delivered at startup")
+	}
+	if tp.ResolvedProvider == nil || tp.ResolvedProvider.PromptMode != "flag" || tp.ResolvedProvider.PromptFlag != "--prompt" {
+		t.Fatalf("ResolvedProvider prompt delivery = %#v, want flag --prompt", tp.ResolvedProvider)
 	}
 	if !strings.Contains(tp.Prompt, "pool prompt body") {
 		t.Fatalf("Prompt missing rendered template body: %q", tp.Prompt)
@@ -348,6 +410,84 @@ func TestResolveTemplateNoneModeRetainsPromptForDeferredDelivery(t *testing.T) {
 	}
 }
 
+func TestResolveTemplateExplicitTmuxUsesProviderCommandForOpenCode(t *testing.T) {
+	cityPath := t.TempDir()
+	fs := fsys.NewFake()
+	fs.Files[cityPath+"/prompts/pool-worker.md"] = []byte("pool prompt body")
+
+	params := &agentBuildParams{
+		fs:        fs,
+		cityName:  "bright-lights",
+		cityPath:  cityPath,
+		workspace: &config.Workspace{Name: "bright-lights", Provider: "gemini"},
+		providers: map[string]config.ProviderSpec{
+			"gemini": {
+				Base:        stringPtr("builtin:opencode"),
+				Command:     "opencode",
+				PathCheck:   "opencode",
+				Args:        []string{"--model", "google/gemini-3.1-pro-preview"},
+				PromptMode:  "flag",
+				PromptFlag:  "--prompt",
+				SupportsACP: boolPtr(true),
+				ACPArgs:     []string{"acp"},
+			},
+		},
+		lookPath:        func(string) (string, error) { return "/usr/bin/opencode", nil },
+		beaconTime:      testBeaconTime,
+		sessionTemplate: "",
+		beadNames:       make(map[string]string),
+		stderr:          io.Discard,
+	}
+	agent := &config.Agent{
+		Name:           "gemini",
+		PromptTemplate: "prompts/pool-worker.md",
+		Provider:       "gemini",
+		Session:        "tmux",
+	}
+
+	tp, err := resolveTemplate(params, agent, agent.QualifiedName(), nil)
+	if err != nil {
+		t.Fatalf("resolveTemplate: %v", err)
+	}
+	if tp.IsACP {
+		t.Fatal("IsACP = true, want false for explicit tmux transport")
+	}
+	want := "opencode --model google/gemini-3.1-pro-preview"
+	if tp.Command != want {
+		t.Fatalf("Command = %q, want %q", tp.Command, want)
+	}
+}
+
+func TestResolveTemplateRejectsUnknownSessionTransport(t *testing.T) {
+	cityPath := t.TempDir()
+	fs := fsys.NewFake()
+	fs.Files[cityPath+"/prompts/pool-worker.md"] = []byte("pool prompt body")
+
+	params := &agentBuildParams{
+		fs:              fs,
+		cityName:        "bright-lights",
+		cityPath:        cityPath,
+		workspace:       &config.Workspace{Name: "bright-lights", Provider: "opencode"},
+		providers:       config.BuiltinProviders(),
+		lookPath:        func(string) (string, error) { return "/usr/bin/opencode", nil },
+		beaconTime:      testBeaconTime,
+		sessionTemplate: "",
+		beadNames:       make(map[string]string),
+		stderr:          io.Discard,
+	}
+	agent := &config.Agent{
+		Name:           "opencode",
+		PromptTemplate: "prompts/pool-worker.md",
+		Provider:       "opencode",
+		Session:        "stdio",
+	}
+
+	_, err := resolveTemplate(params, agent, agent.QualifiedName(), nil)
+	if err == nil || !strings.Contains(err.Error(), "unknown session transport") {
+		t.Fatalf("resolveTemplate() error = %v, want unknown session transport", err)
+	}
+}
+
 func TestResolveTemplateHookEnabledOpencodeOmitsPrimeInstruction(t *testing.T) {
 	cityPath := t.TempDir()
 	fs := fsys.NewFake()
diff --git a/cmd/gc/testdata/dolt-cleanup-external-rig.txtar b/cmd/gc/testdata/dolt-cleanup-external-rig.txtar
index 8c298a2c7b..e40ce89cd2 100644
--- a/cmd/gc/testdata/dolt-cleanup-external-rig.txtar
+++ b/cmd/gc/testdata/dolt-cleanup-external-rig.txtar
@@ -1,12 +1,21 @@
-# dolt cleanup + sync: external-rig discovery and allowlist guard (#706, #711)
+# dolt cleanup + sync: external-rig discovery and allowlist guard (#706, #711, #1549)
 #
-# Covers six scenarios:
+# Covers eight scenarios:
 #   1. External rig database is NOT listed as orphan (registry via gc rig list --json)
-#   2. --force removes genuine orphan at default data-dir (HQ-rooted; guard must not fire)
+#   2. --force removes genuine orphan at default data-dir (HQ-rooted; guard must not fire).
+#      Fixtures run without a live dolt server, so --server-down-ok is required to permit
+#      the filesystem rm fallback (#1549).
 #   3. Local rig database discovered via gc rig list --json (complements scenario 1)
-#   4. Allowlist refusal: orphan whose path overlaps a registered rig path is refused
+#   4. Allowlist refusal: orphan whose path overlaps a registered rig path is refused.
+#      Uses --server-down-ok so the server probe doesn't refuse first.
 #   5. Path-prefix boundary: rig at /a/b does NOT protect a database at /a/bc
 #   6. sync.sh external-rig route discovery (parallel registry path to cleanup.sh)
+#   7. Server-reachability gate (#1549): --force without --server-down-ok refuses when
+#      dolt is unreachable, instead of corrupting NBS state via rm -rf.
+#   8. Identifier safety (#1549): orphans whose name does not match the allowlist
+#      (first char [A-Za-z0-9_], subsequent chars [A-Za-z0-9_-]) are refused before
+#      any deletion attempt, so an attacker-controlled metadata.json cannot break
+#      out of the backtick-quoted SQL identifier.
 #
 # Each scenario uses a separate city initialized from a pre-written TOML template.
 # The pack's cleanup.sh and sync.sh are staged once under $WORK/shared/ and each
@@ -49,7 +58,9 @@ stdout 'orphan_db'
 # Tests that --force removes genuine orphan at default data-dir (HQ-rooted).
 # The allowlist guard must not fire for HQ-managed storage: select(.hq != true)
 # excludes HQ from the rig-path overlap check, so orphan_db is correctly removed.
-exec gc dolt cleanup --force
+# --server-down-ok acknowledges that the test environment has no live dolt server
+# and permits the filesystem rm fallback (#1549).
+exec gc dolt cleanup --force --server-down-ok
 stdout 'Removed orphan_db'
 ! exists $WORK/city1/.beads/dolt/orphan_db
 exists $WORK/city1/.beads/dolt/ext_db
@@ -100,7 +111,9 @@ env CITY3_RIG_PATH=$WORK/city3-rig
 
 cp $WORK/shared/cleanup.sh $WORK/city3/packs/dolt/commands/cleanup.sh
 chmod 755 $WORK/city3/packs/dolt/commands/cleanup.sh
-! exec gc dolt cleanup --force
+# --server-down-ok lets the script proceed past the server-reachability gate
+# so the allowlist-overlap refusal (the actual subject of this scenario) fires.
+! exec gc dolt cleanup --force --server-down-ok
 stderr 'refusing to remove'
 
 # ==========================================================================
@@ -158,6 +171,66 @@ stdout 'city5/\.beads/routes\.jsonl'
 stdout 'external-rig-5/\.beads/routes\.jsonl'
 stdout 'city5_db: skipped'
 
+# ==========================================================================
+# Scenario 7: Server-reachability gate (#1549)
+# ==========================================================================
+# city7 has one orphan_db. With no live dolt server and no --server-down-ok,
+# `gc dolt cleanup --force` MUST refuse rather than rm -rf — running rm
+# against per-database directories that the dolt server has open corrupts
+# NBS state and crash-loops the journal. The orphan must remain on disk.
+
+exec gc init --file $WORK/city7-cfg.toml $WORK/city7
+stdout 'Welcome to Gas City'
+
+cd $WORK/city7
+
+cp $WORK/shared/cleanup.sh $WORK/city7/packs/dolt/commands/cleanup.sh
+chmod 755 $WORK/city7/packs/dolt/commands/cleanup.sh
+
+! exec gc dolt cleanup --force
+stderr 'dolt server unreachable'
+stderr '--server-down-ok'
+exists $WORK/city7/.beads/dolt/orphan_db
+
+# ==========================================================================
+# Scenario 8: Identifier safety (#1549)
+# ==========================================================================
+# city8 has three orphans:
+#   safe_orphan         — pure [A-Za-z0-9_]; allowed
+#   ok-hyphen-orphan    — internal hyphen; allowed (matches health/gc-nudge)
+#   -leading-unsafe     — staged on disk under a non-conforming directory name
+#                         that fails the leading-charset check. Must be refused
+#                         before any deletion attempt and must remain on disk.
+# Because at least one orphan was refused as unsafe, the script must exit
+# non-zero even though the safe orphans were removed — identifier-safety
+# refusals signal "DB in an impossible state" (manual fs mucking, corrupted
+# metadata, attempted injection) and demand operator attention.
+#
+# The leading-unsafe orphan's directory name uses a leading hyphen, which the
+# new regex rejects via the `[A-Za-z0-9_]*` first-char gate. The directory is
+# staged inside the test environment via a separate metadata.json fragment.
+
+exec gc init --file $WORK/city8-cfg.toml $WORK/city8
+stdout 'Welcome to Gas City'
+
+cd $WORK/city8
+
+cp $WORK/shared/cleanup.sh $WORK/city8/packs/dolt/commands/cleanup.sh
+chmod 755 $WORK/city8/packs/dolt/commands/cleanup.sh
+
+# Stage the leading-hyphen orphan dir at runtime (txtar -- markers can't carry
+# leading-hyphen path segments without ambiguity).
+mkdir $WORK/city8/.beads/dolt/-leading-unsafe
+mkdir $WORK/city8/.beads/dolt/-leading-unsafe/.dolt
+
+! exec gc dolt cleanup --force --server-down-ok
+stdout 'Removed safe_orphan'
+stdout 'Removed ok-hyphen-orphan'
+stderr 'name must start with'
+! exists $WORK/city8/.beads/dolt/safe_orphan
+! exists $WORK/city8/.beads/dolt/ok-hyphen-orphan
+exists $WORK/city8/.beads/dolt/-leading-unsafe
+
 # ===========================================================================
 # Shared fixture: external-rig (used by city1 and city3)
 # ===========================================================================
@@ -382,6 +455,85 @@ GC_BEADS_BD_SCRIPT="${GC_BEADS_BD_SCRIPT:-/bin/true}"
 
 -- city5/packs/dolt/commands/.keep --
 
+# ===========================================================================
+# city7 fixtures (Scenario 7: server-reachability gate, #1549)
+# ===========================================================================
+
+-- city7-cfg.toml --
+[workspace]
+name = "city7"
+includes = ["packs/dolt"]
+
+-- city7/.beads/metadata.json --
+{"dolt_database": "city7_db", "issue_prefix": "c7"}
+
+-- city7/.beads/dolt/city7_db/.dolt/.keep --
+-- city7/.beads/dolt/orphan_db/.dolt/.keep --
+
+-- city7/packs/dolt/pack.toml --
+[pack]
+name = "dolt"
+schema = 1
+
+[[commands]]
+name = "cleanup"
+description = "Find and remove orphaned Dolt databases"
+script = "commands/cleanup.sh"
+
+-- city7/packs/dolt/scripts/runtime.sh --
+#!/bin/sh
+: "${GC_CITY_PATH:?GC_CITY_PATH must be set}"
+CITY_RUNTIME_DIR="${GC_CITY_RUNTIME_DIR:-$GC_CITY_PATH/.gc/runtime}"
+PACK_STATE_DIR="${GC_PACK_STATE_DIR:-$CITY_RUNTIME_DIR/packs/dolt}"
+DOLT_BEADS_DATA_DIR="$GC_CITY_PATH/.beads/dolt"
+if [ -d "$DOLT_BEADS_DATA_DIR" ]; then
+  DOLT_DATA_DIR="$DOLT_BEADS_DATA_DIR"
+else
+  DOLT_DATA_DIR="$PACK_STATE_DIR/dolt-data"
+fi
+
+-- city7/packs/dolt/commands/.keep --
+
+# ===========================================================================
+# city8 fixtures (Scenario 8: identifier safety, #1549)
+# ===========================================================================
+
+-- city8-cfg.toml --
+[workspace]
+name = "city8"
+includes = ["packs/dolt"]
+
+-- city8/.beads/metadata.json --
+{"dolt_database": "city8_db", "issue_prefix": "c8"}
+
+-- city8/.beads/dolt/city8_db/.dolt/.keep --
+-- city8/.beads/dolt/safe_orphan/.dolt/.keep --
+-- city8/.beads/dolt/ok-hyphen-orphan/.dolt/.keep --
+
+-- city8/packs/dolt/pack.toml --
+[pack]
+name = "dolt"
+schema = 1
+
+[[commands]]
+name = "cleanup"
+description = "Find and remove orphaned Dolt databases"
+script = "commands/cleanup.sh"
+
+-- city8/packs/dolt/scripts/runtime.sh --
+#!/bin/sh
+: "${GC_CITY_PATH:?GC_CITY_PATH must be set}"
+CITY_RUNTIME_DIR="${GC_CITY_RUNTIME_DIR:-$GC_CITY_PATH/.gc/runtime}"
+PACK_STATE_DIR="${GC_PACK_STATE_DIR:-$CITY_RUNTIME_DIR/packs/dolt}"
+DOLT_BEADS_DATA_DIR="$GC_CITY_PATH/.beads/dolt"
+if [ -d "$DOLT_BEADS_DATA_DIR" ]; then
+  DOLT_DATA_DIR="$DOLT_BEADS_DATA_DIR"
+else
+  DOLT_DATA_DIR="$PACK_STATE_DIR/dolt-data"
+fi
+
+-- city8/packs/dolt/commands/.keep --
+
 # ===========================================================================
 # Shared cleanup.sh fixture — staged into each city's packs/dolt/commands/
 # by the exec cp calls above. Mirrors the logic of
@@ -391,11 +543,13 @@ GC_BEADS_BD_SCRIPT="${GC_BEADS_BD_SCRIPT:-/bin/true}"
 
 -- shared/cleanup.sh --
 #!/bin/sh
-# gc dolt cleanup — test fixture mirroring examples/dolt/commands/cleanup/run.sh (#706, #711).
+# gc dolt cleanup — test fixture mirroring examples/dolt/commands/cleanup/run.sh
+# (#706, #711, #1549).
 set -e
 
 force=false
 max_orphans=50
+server_down_ok=false
 PACK_DIR="${GC_PACK_DIR:-$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)}"
 . "$PACK_DIR/scripts/runtime.sh"
 data_dir="$DOLT_DATA_DIR"
@@ -404,7 +558,8 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --force) force=true; shift ;;
     --max)   max_orphans="$2"; shift 2 ;;
-    -h|--help) echo "Usage: gc dolt cleanup [--force] [--max N]"; exit 0 ;;
+    --server-down-ok) server_down_ok=true; shift ;;
+    -h|--help) echo "Usage: gc dolt cleanup [--force] [--max N] [--server-down-ok]"; exit 0 ;;
     *) echo "gc dolt cleanup: unknown flag: $1" >&2; exit 1 ;;
   esac
 done
@@ -500,7 +655,7 @@ overlapping_rig_path() {
 }
 
 allowlist_file=$(mktemp)
-trap 'rm -f "$allowlist_file" "${refused_tmp:-}" "${removed_tmp:-}"' EXIT
+trap 'rm -f "$allowlist_file" "${refused_tmp:-}" "${removed_tmp:-}" "${unsafe_tmp:-}"' EXIT
 allowlist_ready=true
 if ! compute_allowlist_file "$allowlist_file"; then
   allowlist_ready=false
@@ -533,8 +688,70 @@ if [ "$force" != true ]; then
   exit 0
 fi
 
+# Mirrors the production server-reachability check (#1549). The fixture's
+# stub runtime.sh does not export GC_DOLT_PORT or the helper functions, so
+# probe_available is determined by host nc/python3, and tcp_reachable stays
+# false. With nc OR python3 present + --server-down-ok the rm path runs;
+# without either, the script refuses regardless of --server-down-ok.
+host="${GC_DOLT_HOST:-127.0.0.1}"
+: "${GC_DOLT_USER:=root}"
+export DOLT_CLI_PASSWORD="${GC_DOLT_PASSWORD:-}"
+
+dolt_sql_q() {
+  _dolt_sql_q_timeout="$1"; shift
+  run_bounded "$_dolt_sql_q_timeout" \
+    dolt --host "$host" --port "$GC_DOLT_PORT" --user "$GC_DOLT_USER" --no-tls \
+    sql -q "$1"
+}
+
+probe_available=false
+if command -v nc >/dev/null 2>&1 || command -v python3 >/dev/null 2>&1; then
+  probe_available=true
+fi
+
+tcp_reachable=false
+if [ "$probe_available" = true ] \
+  && [ -n "$GC_DOLT_PORT" ] \
+  && command -v managed_runtime_tcp_reachable >/dev/null 2>&1 \
+  && managed_runtime_tcp_reachable "$GC_DOLT_PORT"; then
+  tcp_reachable=true
+fi
+
+sql_works=false
+if [ "$tcp_reachable" = true ] \
+  && command -v dolt >/dev/null 2>&1 \
+  && command -v run_bounded >/dev/null 2>&1 \
+  && dolt_sql_q 5 "SELECT 1" >/dev/null 2>&1; then
+  sql_works=true
+fi
+
+unset delete_via
+if [ "$sql_works" = true ]; then
+  delete_via=sql
+elif [ "$tcp_reachable" = true ]; then
+  echo "gc dolt cleanup: dolt is listening on port $GC_DOLT_PORT but 'SELECT 1' failed;" >&2
+  echo "  refusing to rm against a potentially-live server (#1549). Fix SQL access or stop dolt and retry." >&2
+  exit 1
+elif [ "$probe_available" = false ]; then
+  echo "gc dolt cleanup: cannot probe TCP reachability (neither nc nor python3 available);" >&2
+  echo "  refusing rm fallback regardless of --server-down-ok — cannot establish 'server is stopped' (#1549)." >&2
+  exit 1
+elif [ "$server_down_ok" = true ]; then
+  delete_via=rm
+else
+  echo "gc dolt cleanup: dolt server unreachable on port ${GC_DOLT_PORT:-unset};" >&2
+  echo "  rm -rf against per-database dirs while the server is up corrupts NBS state (#1549)." >&2
+  echo "  Either start dolt and re-run, or pass --server-down-ok if the server is intentionally stopped." >&2
+  exit 1
+fi
+case "${delete_via:-}" in
+  sql|rm) ;;
+  *) echo "gc dolt cleanup: internal error — delete_via not set" >&2; exit 1 ;;
+esac
+
 refused_tmp=$(mktemp)
 removed_tmp=$(mktemp)
+unsafe_tmp=$(mktemp)
 echo "$orphans" | while IFS='|' read -r db_name size path; do
   [ -z "$db_name" ] && continue
   overlap=$(overlapping_rig_path "$path")
@@ -543,20 +760,47 @@ echo "$orphans" | while IFS='|' read -r db_name size path; do
     echo "refused" >> "$refused_tmp"
     continue
   fi
-  if rm -rf "$path"; then
-    echo "removed" >> "$removed_tmp"
-    echo "  Removed $db_name"
+  case "$db_name" in
+    [A-Za-z0-9_]*)
+      case "$db_name" in
+        *[!A-Za-z0-9_-]*)
+          echo "refusing to remove '$db_name': name contains forbidden characters (allowed: A-Z, a-z, 0-9, _, -)" >&2
+          echo "unsafe" >> "$unsafe_tmp"
+          continue
+          ;;
+      esac
+      ;;
+    *)
+      echo "refusing to remove '$db_name': name must start with [A-Za-z0-9_]" >&2
+      echo "unsafe" >> "$unsafe_tmp"
+      continue
+      ;;
+  esac
+  if [ "$delete_via" = sql ]; then
+    if drop_output=$(dolt_sql_q 30 "DROP DATABASE IF EXISTS \`$db_name\`" 2>&1); then
+      echo "removed" >> "$removed_tmp"
+      echo "  Dropped $db_name"
+    else
+      echo "  Failed to drop $db_name via SQL: ${drop_output:-(no output)}" >&2
+    fi
   else
-    echo "  Failed to remove $db_name" >&2
+    if rm -rf "$path"; then
+      echo "removed" >> "$removed_tmp"
+      echo "  Removed $db_name"
+    else
+      echo "  Failed to remove $db_name" >&2
+    fi
   fi
 done
 
 removed=$(wc -l < "$removed_tmp" | tr -d ' ')
 refused_count=$(wc -l < "$refused_tmp" | tr -d ' ')
+unsafe_count=$(wc -l < "$unsafe_tmp" | tr -d ' ')
 echo ""
 echo "Removed $removed of $orphan_count orphaned database(s)."
 
-if [ "$removed" -lt "$((orphan_count - refused_count))" ] \
+if [ "$unsafe_count" -gt 0 ] \
+  || [ "$removed" -lt "$((orphan_count - refused_count - unsafe_count))" ] \
   || { [ "$refused_count" -gt 0 ] && [ "$removed" -eq 0 ]; }; then
   exit 1
 fi
diff --git a/cmd/gc/testenv_test.go b/cmd/gc/testenv_test.go
index 134c27acce..bace0ec8c5 100644
--- a/cmd/gc/testenv_test.go
+++ b/cmd/gc/testenv_test.go
@@ -2,7 +2,9 @@ package main
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -59,10 +61,30 @@ func installTestProviderStubs() (string, error) {
 
 func writeTestGitIdentity(homeDir string) error {
 	gitConfig := filepath.Join(homeDir, ".gitconfig")
-	data := []byte("[user]\n\tname = gc-test\n\temail = gc-test@test.local\n")
+	data := []byte("[user]\n\tname = gc-test\n\temail = gc-test@test.local\n[beads]\n\trole = maintainer\n")
 	return os.WriteFile(gitConfig, data, 0o644)
 }
 
+// gcBeadsBdTestHomeEnv creates a temp HOME with a .gitconfig containing user
+// identity and beads.role = maintainer, then returns extra env entries suitable
+// for appending to sanitizedBaseEnv. Use this for any test that runs the real
+// gc-beads-bd.sh op_init, which calls ensure_beads_role and requires a writable
+// global git config.
+func gcBeadsBdTestHomeEnv(t *testing.T) []string {
+	t.Helper()
+	homeDir := filepath.Join(t.TempDir(), "home")
+	if err := os.MkdirAll(homeDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(beads-bd test home): %v", err)
+	}
+	if err := writeTestGitIdentity(homeDir); err != nil {
+		t.Fatalf("write test git identity for beads-bd: %v", err)
+	}
+	return []string{
+		"HOME=" + homeDir,
+		"GIT_CONFIG_GLOBAL=" + filepath.Join(homeDir, ".gitconfig"),
+	}
+}
+
 func writeTestDoltIdentity(homeDir string) error {
 	doltDir := filepath.Join(homeDir, ".dolt")
 	if err := os.MkdirAll(doltDir, 0o755); err != nil {
@@ -89,3 +111,18 @@ func configureTestDoltIdentityEnv(t *testing.T) {
 	t.Setenv("GIT_CONFIG_GLOBAL", filepath.Join(homeDir, ".gitconfig"))
 	t.Setenv("DOLT_ROOT_PATH", homeDir)
 }
+
+func configureRealBdAndDoltPath(t *testing.T) {
+	t.Helper()
+
+	bdPath := waitTestRealBDPath(t)
+	doltPath, err := exec.LookPath("dolt")
+	if err != nil {
+		t.Skip("dolt not installed")
+	}
+	t.Setenv("PATH", strings.Join([]string{
+		filepath.Dir(bdPath),
+		filepath.Dir(doltPath),
+		os.Getenv("PATH"),
+	}, string(os.PathListSeparator)))
+}
diff --git a/cmd/gc/wisp_gc.go b/cmd/gc/wisp_gc.go
index b7e6c82188..93a1708f98 100644
--- a/cmd/gc/wisp_gc.go
+++ b/cmd/gc/wisp_gc.go
@@ -51,9 +51,9 @@ func (m *memoryWispGC) runGC(store beads.Store, now time.Time) (int, error) {
 		return 0, fmt.Errorf("listing closed molecules: bead store unavailable")
 	}
 
-	entries, err := store.List(beads.ListQuery{Status: "closed", Type: "molecule"})
+	entries, err := closedWispGCEntries(store)
 	if err != nil {
-		return 0, fmt.Errorf("listing closed molecules: %w", err)
+		return 0, err
 	}
 
 	cutoff := now.Add(-m.ttl)
@@ -71,6 +71,34 @@ func (m *memoryWispGC) runGC(store beads.Store, now time.Time) (int, error) {
 	return purged, deleteErr
 }
 
+func closedWispGCEntries(store beads.Store) ([]beads.Bead, error) {
+	entries := make([]beads.Bead, 0)
+	seen := make(map[string]struct{})
+	appendUnique := func(items []beads.Bead) {
+		for _, item := range items {
+			if item.ID == "" {
+				continue
+			}
+			if _, ok := seen[item.ID]; ok {
+				continue
+			}
+			seen[item.ID] = struct{}{}
+			entries = append(entries, item)
+		}
+	}
+	molecules, err := store.List(beads.ListQuery{Status: "closed", Type: "molecule"})
+	if err != nil {
+		return nil, fmt.Errorf("listing closed molecule roots: %w", err)
+	}
+	appendUnique(molecules)
+	wisps, err := store.List(beads.ListQuery{Status: "closed", Metadata: map[string]string{"gc.kind": "wisp"}})
+	if err != nil {
+		return nil, fmt.Errorf("listing closed wisp roots: %w", err)
+	}
+	appendUnique(wisps)
+	return entries, nil
+}
+
 func purgeExpiredBeadClosures(store beads.Store, entries []beads.Bead, cutoff time.Time) (int, error) {
 	return purgeExpiredBeads(store, entries, cutoff, deleteExpiredBeadClosure)
 }
diff --git a/cmd/gc/wisp_gc_test.go b/cmd/gc/wisp_gc_test.go
index edaff22973..fce5a17cf7 100644
--- a/cmd/gc/wisp_gc_test.go
+++ b/cmd/gc/wisp_gc_test.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"fmt"
+	"sort"
 	"strings"
 	"testing"
 	"time"
@@ -50,6 +51,7 @@ func TestWispGC_PurgesExpiredMolecules(t *testing.T) {
 	now := time.Now()
 	store := newGCStore([]beads.Bead{
 		makeGCBead("mol-1", now.Add(-2*time.Hour), "closed", "molecule"),
+		makeGCBeadWithMetadata("wisp-1", now.Add(-2*time.Hour), "closed", "task", map[string]string{"gc.kind": "wisp"}),
 		makeGCBead("mol-2", now.Add(-30*time.Minute), "closed", "molecule"),
 		makeGCBead("mol-3", now.Add(-3*time.Hour), "closed", "molecule"),
 	})
@@ -59,10 +61,10 @@ func TestWispGC_PurgesExpiredMolecules(t *testing.T) {
 	if err != nil {
 		t.Fatalf("runGC: %v", err)
 	}
-	if purged != 2 {
-		t.Fatalf("purged = %d, want 2", purged)
+	if purged != 3 {
+		t.Fatalf("purged = %d, want 3", purged)
 	}
-	assertDeletedIDs(t, store.deletedIDs, "mol-1", "mol-3")
+	assertDeletedIDs(t, store.deletedIDs, "mol-1", "wisp-1", "mol-3")
 }
 
 func TestWispGC_NothingExpired(t *testing.T) {
@@ -427,9 +429,10 @@ func TestWispGC_ListErrorFailsRun(t *testing.T) {
 }
 
 type gcQueryKey struct {
-	Status string
-	Type   string
-	Label  string
+	Status   string
+	Type     string
+	Label    string
+	Metadata string
 }
 
 type gcTestStore struct {
@@ -448,7 +451,7 @@ func newGCStore(existing []beads.Bead) *gcTestStore {
 }
 
 func (s *gcTestStore) List(query beads.ListQuery) ([]beads.Bead, error) {
-	if err := s.listErrors[gcQueryKey{Status: query.Status, Type: query.Type, Label: query.Label}]; err != nil {
+	if err := s.listErrors[gcQueryKey{Status: query.Status, Type: query.Type, Label: query.Label, Metadata: metadataQueryKey(query.Metadata)}]; err != nil {
 		return nil, err
 	}
 	return s.MemStore.List(query)
@@ -480,6 +483,28 @@ func makeGCBeadWithLabels(id string, createdAt time.Time, status, beadType strin
 	}
 }
 
+func makeGCBeadWithMetadata(id string, createdAt time.Time, status, beadType string, metadata map[string]string) beads.Bead {
+	bead := makeGCBead(id, createdAt, status, beadType)
+	bead.Metadata = metadata
+	return bead
+}
+
+func metadataQueryKey(metadata map[string]string) string {
+	if len(metadata) == 0 {
+		return ""
+	}
+	keys := make([]string, 0, len(metadata))
+	for key := range metadata {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	parts := make([]string, 0, len(keys))
+	for _, key := range keys {
+		parts = append(parts, key+"="+metadata[key])
+	}
+	return strings.Join(parts, "\x00")
+}
+
 func assertDeletedIDs(t *testing.T, deleted []string, want ...string) {
 	t.Helper()
 	if len(deleted) != len(want) {
diff --git a/cmd/gc/work_query_probe.go b/cmd/gc/work_query_probe.go
index ec66e702b4..78ce864dab 100644
--- a/cmd/gc/work_query_probe.go
+++ b/cmd/gc/work_query_probe.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/gastownhall/gascity/internal/agent"
 	"github.com/gastownhall/gascity/internal/beads"
-	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/shellquote"
 )
@@ -49,7 +48,7 @@ func controllerWorkQueryEnv(cityPath string, cfg *config.City, agentCfg *config.
 	if strings.TrimSpace(cityPath) == "" || cfg == nil || agentCfg == nil {
 		return nil
 	}
-	env := citylayout.CityRuntimeEnvMap(cityPath)
+	env := cityRuntimeEnvMapForCity(cityPath)
 	env["GC_STORE_ROOT"] = cityPath
 	env["GC_STORE_SCOPE"] = "city"
 	env["GC_BEADS_PREFIX"] = config.EffectiveHQPrefix(cfg)
diff --git a/cmd/gc/worker_handle.go b/cmd/gc/worker_handle.go
index 400062926a..a4aec0a21d 100644
--- a/cmd/gc/worker_handle.go
+++ b/cmd/gc/worker_handle.go
@@ -320,8 +320,8 @@ func workerHandleForSessionTargetWithRuntimeHintsWithConfig(cityPath string, sto
 		return nil, err
 	}
 	if store != nil {
-		if id, err := session.ResolveSessionIDByExactID(store, target); err == nil {
-			return factory.SessionByID(id)
+		if bead, _, err := session.ResolveSessionBeadByExactID(store, target); err == nil {
+			return factory.SessionByLoadedBead(bead)
 		}
 		if id, err := session.ResolveSessionID(store, target); err == nil {
 			return factory.SessionByID(id)
diff --git a/cmd/gc/worker_handle_test.go b/cmd/gc/worker_handle_test.go
index 79b916c5e5..a59fed0614 100644
--- a/cmd/gc/worker_handle_test.go
+++ b/cmd/gc/worker_handle_test.go
@@ -838,6 +838,65 @@ session_id_flag = "--session-id"
 	}
 }
 
+// TestWorkerObserveSessionTargetWithConfigDoesNotFetchSessionBeadMoreThanTwice
+// guards the dedup invariant. The Observe path used to load the same session
+// bead five times per call (resolve, factory.Get, factory metadata Get,
+// LiveObservation Get, ObserveRuntime Get); this PR collapses that to two:
+// once for ResolveSessionBeadByExactID and once for LiveObservation's
+// freshness re-load. Each redundant fetch is a `bd show` CLI fork on real
+// (non-mem) stores, so the supervisor's nudge poll loop pays for every Get
+// directly in idle-city CPU.
+func TestWorkerObserveSessionTargetWithConfigDoesNotFetchSessionBeadMoreThanTwice(t *testing.T) {
+	cityDir := t.TempDir()
+	writePhase0InterfaceCity(t, cityDir, `[workspace]
+name = "test-city"
+
+[beads]
+provider = "file"
+
+[[agent]]
+name = "worker"
+provider = "stub"
+
+[providers.stub]
+command = "/bin/echo"
+`)
+
+	cfg, err := loadCityConfig(cityDir)
+	if err != nil {
+		t.Fatalf("loadCityConfig: %v", err)
+	}
+	backing, err := openCityStoreAt(cityDir)
+	if err != nil {
+		t.Fatalf("openCityStoreAt: %v", err)
+	}
+	sp := runtime.NewFake()
+	mgr := newSessionManagerWithConfig(cityDir, backing, sp, cfg)
+	info, err := mgr.Create(context.Background(), "worker", "Probe", "/bin/echo", t.TempDir(), "stub", nil, session.ProviderResume{}, runtime.Config{Command: "/bin/echo"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	store := &sessionGetSpyStore{Store: backing}
+	obs, err := workerObserveSessionTargetWithConfig(cityDir, store, sp, cfg, info.ID)
+	if err != nil {
+		t.Fatalf("workerObserveSessionTargetWithConfig: %v", err)
+	}
+	if !obs.Running {
+		t.Fatalf("obs.Running = false, want true after Create started runtime")
+	}
+
+	var hits int
+	for _, id := range store.getIDs {
+		if id == info.ID {
+			hits++
+		}
+	}
+	if hits > 2 {
+		t.Fatalf("store.Get(%q) called %d times, want at most 2; all Get IDs: %v", info.ID, hits, store.getIDs)
+	}
+}
+
 func TestWorkerObserveSessionTargetWithConfigFallsBackToRunningRuntimeHandle(t *testing.T) {
 	sp := runtime.NewFake()
 	if err := sp.Start(context.Background(), "mayor", runtime.Config{Command: "echo"}); err != nil {
diff --git a/cmd/genspec/main.go b/cmd/genspec/main.go
index 44a02782e7..7e461e053b 100644
--- a/cmd/genspec/main.go
+++ b/cmd/genspec/main.go
@@ -100,15 +100,15 @@ func eventsSpec() ([]byte, error) {
 			"The referenced DTO schemas live in the supervisor OpenAPI document; the API remains the source of truth. " +
 			"`gc events --seq` emits a plain-text cursor and is documented in /reference/events.",
 		"anyOf": []any{
-			map[string]any{"$ref": "openapi.json#/components/schemas/WireEvent"},
-			map[string]any{"$ref": "openapi.json#/components/schemas/WireTaggedEvent"},
+			map[string]any{"$ref": "openapi.json#/components/schemas/TypedEventStreamEnvelope"},
+			map[string]any{"$ref": "openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope"},
 			map[string]any{"$ref": "openapi.json#/components/schemas/EventStreamEnvelope"},
 			map[string]any{"$ref": "openapi.json#/components/schemas/TaggedEventStreamEnvelope"},
 		},
 		"$defs": map[string]any{
 			"cityListLine": map[string]any{
 				"description": "A JSONL line from `gc events` when a city is in scope.",
-				"$ref":        "openapi.json#/components/schemas/WireEvent",
+				"$ref":        "openapi.json#/components/schemas/TypedEventStreamEnvelope",
 			},
 			"cityStreamLine": map[string]any{
 				"description": "A JSONL line from `gc events --watch` or `gc events --follow` when a city is in scope.",
@@ -116,7 +116,7 @@ func eventsSpec() ([]byte, error) {
 			},
 			"supervisorListLine": map[string]any{
 				"description": "A JSONL line from `gc events` when no city is in scope.",
-				"$ref":        "openapi.json#/components/schemas/WireTaggedEvent",
+				"$ref":        "openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope",
 			},
 			"supervisorStreamLine": map[string]any{
 				"description": "A JSONL line from `gc events --watch` or `gc events --follow` when no city is in scope.",
@@ -125,7 +125,7 @@ func eventsSpec() ([]byte, error) {
 		},
 		"x-gc-events": map[string]any{
 			"sourceOfTruth":        "openapi.json",
-			"listMode":             []string{"WireEvent", "WireTaggedEvent"},
+			"listMode":             []string{"TypedEventStreamEnvelope", "TypedTaggedEventStreamEnvelope"},
 			"streamMode":           []string{"EventStreamEnvelope", "TaggedEventStreamEnvelope"},
 			"heartbeatSuppression": "HeartbeatEvent SSE frames are consumed internally and are not written to stdout.",
 			"cursorMode":           "`gc events --seq` is not JSONL; it writes the current city index or supervisor composite cursor as text.",
diff --git a/codecov.yml b/codecov.yml
index 6f1471cefe..ecb62634d4 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -1,3 +1,7 @@
+ignore:
+  # Generated from internal/api/openapi.json and verified by TestGeneratedClientInSync.
+  - "internal/api/genclient/client_gen.go"
+
 coverage:
   status:
     default_rules:
diff --git a/contrib/beads-scripts/gc-beads-k8s b/contrib/beads-scripts/gc-beads-k8s
index 58f28aabeb..e9be6dbe95 100755
--- a/contrib/beads-scripts/gc-beads-k8s
+++ b/contrib/beads-scripts/gc-beads-k8s
@@ -102,34 +102,22 @@ runner_workdir_for_scope() {
 }
 
 # run_bd executes bd inside the beads runner pod for the projected store root.
-# When GC_BEADS_PREFIX is set, the prefix switch and bd command run in a
-# single kubectl exec to avoid interleave from concurrent invocations.
+#
+# BEADS_DIR is exported for every in-pod bd invocation so the runner always
+# targets the scope-local .beads store, including the post-init config-set
+# follow-ups in the init flow. The init branch itself must not run
+# `bd config set issue_prefix` before `bd init`, because a fresh scope has no
+# database for config writes yet.
 run_bd() {
-  local scope_root workdir want
+  local scope_root workdir
   scope_root=$(scope_root_arg_or_env "")
   workdir=$(runner_workdir_for_scope "$scope_root") || return 1
-  want="${GC_BEADS_PREFIX:-}"
-  if [ -n "$want" ]; then
+  if [ "${1:-}" = "init" ]; then
     "${KUBECTL[@]}" exec "$POD_NAME" -- sh -c \
-      'workdir="$1"; prefix="$2"; shift 2; mkdir -p "$workdir" && cd "$workdir" && bd config set issue_prefix "$prefix" >/dev/null 2>&1 && bd "$@"' -- "$workdir" "$want" "$@"
+      'workdir="$1"; shift; mkdir -p "$workdir" && cd "$workdir" && export BEADS_DIR="$workdir/.beads" && if ! git config --global beads.role >/dev/null 2>&1; then git config --global beads.role maintainer >/dev/null 2>&1 || exit 1; fi && bd "$@"' -- "$workdir" "$@"
   else
     "${KUBECTL[@]}" exec "$POD_NAME" -- sh -c \
-      'workdir="$1"; shift; mkdir -p "$workdir" && cd "$workdir" && bd "$@"' -- "$workdir" "$@"
-  fi
-}
-
-# run_bd_stdin executes bd inside the beads runner pod with stdin piped through.
-run_bd_stdin() {
-  local scope_root workdir want
-  scope_root=$(scope_root_arg_or_env "")
-  workdir=$(runner_workdir_for_scope "$scope_root") || return 1
-  want="${GC_BEADS_PREFIX:-}"
-  if [ -n "$want" ]; then
-    "${KUBECTL[@]}" exec -i "$POD_NAME" -- sh -c \
-      'workdir="$1"; prefix="$2"; shift 2; mkdir -p "$workdir" && cd "$workdir" && bd config set issue_prefix "$prefix" >/dev/null 2>&1 && bd "$@"' -- "$workdir" "$want" "$@"
-  else
-    "${KUBECTL[@]}" exec -i "$POD_NAME" -- sh -c \
-      'workdir="$1"; shift; mkdir -p "$workdir" && cd "$workdir" && bd "$@"' -- "$workdir" "$@"
+      'workdir="$1"; shift; mkdir -p "$workdir" && cd "$workdir" && export BEADS_DIR="$workdir/.beads" && if ! git config --global beads.role >/dev/null 2>&1; then git config --global beads.role maintainer >/dev/null 2>&1 || exit 1; fi && bd "$@"' -- "$workdir" "$@"
   fi
 }
 
@@ -293,7 +281,6 @@ case "$op" in
     # for the scope-local workspace root.
     GC_STORE_ROOT="$scope_root" run_bd init --server --server-host "$DOLT_HOST" --server-port "$DOLT_PORT" \
       -p "$prefix" --skip-hooks >/dev/null 2>&1 || true
-    GC_STORE_ROOT="$scope_root" run_bd config set issue_prefix "$prefix" >/dev/null 2>&1 || true
     # Register custom bead types required by Gas City (mirrors gc-beads-bd
     # and doctor.RequiredCustomTypes). Without this, bd rejects creates for
     # types like "session" that aren't in the default set. "convergence" is
diff --git a/contrib/k8s/Dockerfile.agent b/contrib/k8s/Dockerfile.agent
index 01f1a9a60d..08c5611c75 100644
--- a/contrib/k8s/Dockerfile.agent
+++ b/contrib/k8s/Dockerfile.agent
@@ -14,9 +14,14 @@
 # The gc binary should be built first and placed in the build context root:
 #   go build -o gc ./cmd/gc
 
+# Local build-layer image produced by Dockerfile.base, not a registry pull.
 ARG BASE_IMAGE=gc-agent-base:latest
 FROM ${BASE_IMAGE}
 
+# Build-time copies and ownership fixes require root; the final image drops
+# back to gcagent below.
+USER root
+
 # bd (beads) CLI — copied from build context.
 # Build with: cp $(which bd) . && docker build ...
 COPY bd /usr/local/bin/bd
diff --git a/contrib/k8s/Dockerfile.base b/contrib/k8s/Dockerfile.base
index 01533f6f23..598c90cd90 100644
--- a/contrib/k8s/Dockerfile.base
+++ b/contrib/k8s/Dockerfile.base
@@ -1,16 +1,18 @@
 # Gas City agent base image — system dependencies.
 #
 # Contains everything an agent needs EXCEPT gc/bd/br binaries: OS packages,
-# Node.js, Claude Code CLI, Dolt. Rebuild only when system dependencies
-# change (~2.5 min). Agent image rebuilds on top take ~5s.
+# Claude Code CLI, Dolt. Rebuild only when system dependencies change
+# (~2.5 min). Agent image rebuilds on top take ~5s.
 #
 # Build:
 #   make docker-base
 #   # or: docker build -f contrib/k8s/Dockerfile.base -t gc-agent-base:latest .
 
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b
 
 ENV DEBIAN_FRONTEND=noninteractive
+ARG CLAUDE_CODE_VERSION=2.1.123
+ARG DOLT_VERSION=1.88.0
 
 # System packages.
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -25,13 +27,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     tmux \
     && rm -rf /var/lib/apt/lists/*
 
-# Node.js (for Claude Code CLI).
-RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
-    && apt-get install -y --no-install-recommends nodejs \
-    && rm -rf /var/lib/apt/lists/*
-
-# Claude Code CLI.
-RUN npm install -g @anthropic-ai/claude-code
+COPY .github/scripts/install-claude-native.sh /tmp/install-claude-native.sh
+RUN /tmp/install-claude-native.sh "${CLAUDE_CODE_VERSION}" \
+    && rm -f /tmp/install-claude-native.sh
 
 # GitHub CLI (for git credential helper in containers).
 RUN mkdir -p -m 755 /etc/apt/keyrings \
@@ -44,8 +42,9 @@ RUN mkdir -p -m 755 /etc/apt/keyrings \
     && rm -rf /var/lib/apt/lists/*
 
 # Dolt CLI — pinned version (keep in sync with deps.env).
-ARG DOLT_VERSION=1.85.0
-RUN curl -fsSL https://github.com/dolthub/dolt/releases/download/v${DOLT_VERSION}/install.sh | bash
+COPY .github/scripts/install-dolt-archive.sh /tmp/install-dolt-archive.sh
+RUN /tmp/install-dolt-archive.sh "${DOLT_VERSION}" \
+    && rm -f /tmp/install-dolt-archive.sh
 
 # Default non-root user for Claude Code (--dangerously-skip-permissions rejects root).
 # When LINUX_USERNAME is set at runtime, the pod entrypoint creates a dynamic
@@ -54,3 +53,5 @@ RUN useradd -m -s /bin/bash gcagent \
     && echo "gcagent ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/gcagent \
     && chmod 0440 /etc/sudoers.d/gcagent
 ENV HOME=/home/gcagent
+
+USER gcagent
diff --git a/contrib/k8s/Dockerfile.controller b/contrib/k8s/Dockerfile.controller
index 3c23182d0b..24f4b02da1 100644
--- a/contrib/k8s/Dockerfile.controller
+++ b/contrib/k8s/Dockerfile.controller
@@ -10,6 +10,7 @@
 # The gc-agent image must be built first:
 #   docker build -f contrib/k8s/Dockerfile.agent -t gc-agent:latest .
 
+# Local build-layer image produced by Dockerfile.agent, not a registry pull.
 ARG BASE=gc-agent:latest
 FROM ${BASE}
 
@@ -17,9 +18,16 @@ FROM ${BASE}
 USER root
 
 # kubectl for agent attach and beads/events exec providers.
-RUN curl -fsSL "https://dl.k8s.io/release/$(curl -Ls \
-    https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
-    -o /usr/local/bin/kubectl && chmod +x /usr/local/bin/kubectl
+ARG KUBECTL_VERSION=v1.36.0
+RUN curl -fsSL \
+    "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+    -o /tmp/kubectl \
+    && curl -fsSL \
+       "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
+       -o /tmp/kubectl.sha256 \
+    && echo "$(cat /tmp/kubectl.sha256)  /tmp/kubectl" | sha256sum -c - \
+    && install -m 0755 /tmp/kubectl /usr/local/bin/kubectl \
+    && rm -f /tmp/kubectl /tmp/kubectl.sha256
 
 # K8s provider scripts (beads, events). Session provider is now native
 # (compiled into gc binary as GC_SESSION=k8s).
@@ -32,6 +40,7 @@ COPY contrib/events-scripts/gc-events-k8s /usr/local/bin/gc-events-k8s
 # COPY --from=dashboard dist/ /opt/dashboard/dist/
 
 WORKDIR /city
+USER gcagent
 
 # Wait for city directory to be copied in (via gc-controller-k8s deploy),
 # then init from it and wait for the deploy script to finish setup (bd init
diff --git a/contrib/k8s/Dockerfile.mail b/contrib/k8s/Dockerfile.mail
index ecc21a9f62..1477b31d04 100644
--- a/contrib/k8s/Dockerfile.mail
+++ b/contrib/k8s/Dockerfile.mail
@@ -8,16 +8,29 @@
 #
 # The server exposes JSON-RPC on port 8765 and stores messages in SQLite.
 
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:46cb7cc2877e60fbd5e21a9ae6115c30ace7a077b9f8772da879e4590c18c2e3
 
-RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
-RUN pip install --no-cache-dir "mcp_agent_mail @ git+https://github.com/Dicklesworthstone/mcp_agent_mail.git"
+ENV DEBIAN_FRONTEND=noninteractive \
+    PYTHONDONTWRITEBYTECODE=1 \
+    TMPDIR=/tmp
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY .github/requirements/mcp-agent-mail.txt /tmp/requirements-mcp-agent-mail.txt
+RUN python -m pip install --no-cache-dir --require-hashes \
+    -r /tmp/requirements-mcp-agent-mail.txt \
+    && rm -f /tmp/requirements-mcp-agent-mail.txt
 
 EXPOSE 8765
 
 # mcp_agent_mail uses SQLite internally — data dir for persistence.
-RUN mkdir -p /var/lib/mcp-mail
+RUN useradd -r -m -d /var/lib/mcp-mail -s /usr/sbin/nologin mcp-mail \
+    && mkdir -p /var/lib/mcp-mail \
+    && chown -R mcp-mail:mcp-mail /var/lib/mcp-mail
 WORKDIR /var/lib/mcp-mail
+USER mcp-mail
 
 # Health endpoint: GET /health/liveness
 HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
diff --git a/contrib/k8s/controller-rbac.yaml b/contrib/k8s/controller-rbac.yaml
index 63eff2376a..533902570f 100644
--- a/contrib/k8s/controller-rbac.yaml
+++ b/contrib/k8s/controller-rbac.yaml
@@ -24,6 +24,8 @@ rules:
     resources: ["pods"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   # Pod exec — run commands inside agent containers (nudge, peek, meta).
+  # Gas City requires pods/exec to implement the k8s session protocol; the
+  # Trivy exception for this namespace-local Role lives in .trivyignore-config.
   - apiGroups: [""]
     resources: ["pods/exec"]
     verbs: ["create"]
diff --git a/contrib/k8s/dolt-statefulset.yaml b/contrib/k8s/dolt-statefulset.yaml
index 312114caec..dcf3ce3fef 100644
--- a/contrib/k8s/dolt-statefulset.yaml
+++ b/contrib/k8s/dolt-statefulset.yaml
@@ -17,9 +17,24 @@ spec:
       labels:
         app: dolt
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
       initContainers:
       - name: init-user
-        image: dolthub/dolt:1.85.0
+        image: dolthub/dolt:1.88.0
+        env:
+        - name: HOME
+          value: /tmp
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+          readOnlyRootFilesystem: true
         command:
         - sh
         - -c
@@ -37,9 +52,19 @@ spec:
         volumeMounts:
         - name: dolt-data
           mountPath: /var/lib/dolt
+        - name: tmp
+          mountPath: /tmp
       containers:
       - name: dolt
-        image: dolthub/dolt:1.85.0
+        image: dolthub/dolt:1.88.0
+        env:
+        - name: HOME
+          value: /tmp
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+          readOnlyRootFilesystem: true
         command:
         - dolt
         - sql-server
@@ -56,6 +81,8 @@ spec:
         volumeMounts:
         - name: dolt-data
           mountPath: /var/lib/dolt
+        - name: tmp
+          mountPath: /tmp
         livenessProbe:
           tcpSocket:
             port: mysql
@@ -76,6 +103,9 @@ spec:
           limits:
             cpu: "2"
             memory: 4Gi
+      volumes:
+      - name: tmp
+        emptyDir: {}
   volumeClaimTemplates:
   - metadata:
       name: dolt-data
diff --git a/contrib/k8s/event-cleanup-cronjob.yaml b/contrib/k8s/event-cleanup-cronjob.yaml
index e9dd11eb1e..21a441b2fb 100644
--- a/contrib/k8s/event-cleanup-cronjob.yaml
+++ b/contrib/k8s/event-cleanup-cronjob.yaml
@@ -28,9 +28,24 @@ spec:
         spec:
           serviceAccountName: gc-controller
           restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1001
+            runAsGroup: 1001
+            fsGroup: 1001
+            seccompProfile:
+              type: RuntimeDefault
           containers:
           - name: cleanup
-            image: bitnami/kubectl:latest
+            image: bitnami/kubectl:1.36.0
+            env:
+            - name: HOME
+              value: /tmp
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop: ["ALL"]
+              readOnlyRootFilesystem: true
             command:
             - sh
             - -c
@@ -53,3 +68,9 @@ spec:
               limits:
                 cpu: 200m
                 memory: 128Mi
+            volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          volumes:
+          - name: tmp
+            emptyDir: {}
diff --git a/contrib/k8s/mcp-mail-deployment.yaml b/contrib/k8s/mcp-mail-deployment.yaml
index 8d009f0471..006a1a7af2 100644
--- a/contrib/k8s/mcp-mail-deployment.yaml
+++ b/contrib/k8s/mcp-mail-deployment.yaml
@@ -28,10 +28,19 @@ spec:
       labels:
         app: mcp-mail
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: mcp-mail
         image: gc-mcp-mail:latest
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+          readOnlyRootFilesystem: true
         ports:
         - containerPort: 8765
           name: http
@@ -59,3 +68,13 @@ spec:
           limits:
             cpu: "1"
             memory: 1Gi
+        volumeMounts:
+        - name: mail-data
+          mountPath: /var/lib/mcp-mail
+        - name: tmp
+          mountPath: /tmp
+      volumes:
+      - name: mail-data
+        emptyDir: {}
+      - name: tmp
+        emptyDir: {}
diff --git a/contrib/mail-scripts/gc-mail-mcp-agent-mail b/contrib/mail-scripts/gc-mail-mcp-agent-mail
index b1670ae378..44fd4b3efb 100755
--- a/contrib/mail-scripts/gc-mail-mcp-agent-mail
+++ b/contrib/mail-scripts/gc-mail-mcp-agent-mail
@@ -24,21 +24,24 @@
 # main(); wrappers may call it explicitly if they need cache paths before
 # invoking main().
 
-# Cache directories for name mappings and message state.
+# Cache directories for name mappings, agent tokens, and message state.
 #
 # Layout:
 #   name-map/     gc-name → mcp-name (Adjective+Noun) mapping
+#   agent-token/  gc-name → mcp registration token
 #   msg-agent/    msg-id → recipient gc-name (repopulated on inbox/check)
 #   msg-read/     msg-id → local "read" / "archived" filter state
 #   msg-thread/   msg-id → locally-generated thread id
 #   msg-reply-to/ msg-id → parent msg-id (set on reply)
 #
-# Only name-map is shared across K8s pods. When GC_CITY is set (the
-# controller passes it via the city volume mount), name-map lives under
-# the city directory so every pod sharing that volume sees the same
-# gc → mcp mapping. This is what enables cross-pod name resolution:
+# name-map and agent-token are shared across K8s pods. When GC_CITY is
+# set (the controller passes it via the city volume mount), they live
+# under the city directory so every pod sharing that volume sees the
+# same gc → mcp mapping and the matching registration token. This is
+# what enables cross-pod name resolution and authenticated reads/sends:
 # a receiving pod can reverse-map an mcp sender name back to its gc
-# name without calling mcp_agent_mail's whois API.
+# name without calling mcp_agent_mail's whois API, and can authenticate
+# as its deterministic mcp identity.
 #
 # Message state (msg-agent, msg-read, msg-thread, msg-reply-to) stays
 # pod-local in /tmp even when GC_CITY is set. Each pod repopulates these
@@ -63,10 +66,12 @@ _init_config() {
   CACHE_DIR="/tmp/gc-mcp-mail-cache/${PROJECT_HASH}"
   if [ -n "${GC_CITY:-}" ]; then
     NAME_MAP_DIR="${GC_CITY}/.gc/mail-cache/${PROJECT_HASH}/name-map"
+    AGENT_TOKEN_DIR="${GC_CITY}/.gc/mail-cache/${PROJECT_HASH}/agent-token"
   else
     NAME_MAP_DIR="${CACHE_DIR}/name-map"
+    AGENT_TOKEN_DIR="${CACHE_DIR}/agent-token"
   fi
-  mkdir -p "$NAME_MAP_DIR" "$CACHE_DIR/msg-agent" "$CACHE_DIR/msg-read" "$CACHE_DIR/msg-thread"
+  mkdir -p "$NAME_MAP_DIR" "$AGENT_TOKEN_DIR" "$CACHE_DIR/msg-agent" "$CACHE_DIR/msg-read" "$CACHE_DIR/msg-thread"
 }
 
 # --- Name mapping ---
@@ -150,6 +155,64 @@ build_name_map_json() {
   echo "$map"
 }
 
+# cache_agent_token stores the mcp_agent_mail registration token for a
+# gc identity. Agent names may contain slashes, so the token path mirrors
+# the name-map path structure.
+cache_agent_token() {
+  local gc_name="$1" token="$2"
+  [ -n "$token" ] || return 0
+  mkdir -p "$(dirname "$AGENT_TOKEN_DIR/$gc_name")"
+  ( umask 077; printf '%s' "$token" > "$AGENT_TOKEN_DIR/$gc_name" )
+}
+
+# get_agent_token retrieves the cached registration token for a gc identity.
+get_agent_token() {
+  local gc_name="$1"
+  cat "$AGENT_TOKEN_DIR/$gc_name" 2>/dev/null || true
+}
+
+# require_agent_token prints the cached token or fails with a clear error.
+require_agent_token() {
+  local gc_name="$1"
+  local token
+  token=$(get_agent_token "$gc_name")
+  if [ -z "$token" ]; then
+    echo "missing mcp_agent_mail registration token for $gc_name" >&2
+    return 1
+  fi
+  echo "$token"
+}
+
+# ensure_contact approves a sender->recipient contact link before delivery.
+# mcp_agent_mail's default contact policy can reject first-contact sends, so
+# the bridge uses both cached registration tokens to perform the same
+# explicit handshake a human-facing MCP session would perform.
+ensure_contact() {
+  local from_gc="$1" to_gc="$2"
+  [ "$from_gc" != "$to_gc" ] || return 0
+
+  local mcp_from mcp_to requester_token target_token
+  mcp_from=$(gc_to_mcp_name "$from_gc")
+  mcp_to=$(gc_to_mcp_name "$to_gc")
+  requester_token=$(require_agent_token "$from_gc")
+  target_token=$(require_agent_token "$to_gc")
+
+  mcp_call "macro_contact_handshake" "$(jq -n \
+    --arg project "$PROJECT" \
+    --arg requester "$mcp_from" \
+    --arg target "$mcp_to" \
+    --arg requester_token "$requester_token" \
+    --arg target_token "$target_token" \
+    '{
+      project_key: $project,
+      requester: $requester,
+      target: $target,
+      auto_accept: true,
+      requester_registration_token: $requester_token,
+      target_registration_token: $target_token
+    }')" > /dev/null
+}
+
 # --- Helpers ---
 
 # mcp_call invokes an MCP tool via JSON-RPC and returns the text content.
@@ -196,10 +259,21 @@ ensure_agent() {
   local gc_name="$1"
   local mcp_name
   mcp_name=$(gc_to_mcp_name "$gc_name")
-  mcp_call "register_agent" "$(jq -n \
+  local token args result new_token
+  token=$(get_agent_token "$gc_name")
+  args=$(jq -n \
     --arg project "$PROJECT" \
     --arg name "$mcp_name" \
-    '{project_key: $project, name: $name, program: "gc", model: "agent"}')" > /dev/null 2>&1 || true
+    --arg token "$token" \
+    '{
+      project_key: $project,
+      name: $name,
+      program: "gc",
+      model: "agent"
+    } + (if $token != "" then {registration_token: $token} else {} end)')
+  result=$(mcp_call "register_agent" "$args")
+  new_token=$(echo "$result" | jq -r '.registration_token // empty' 2>/dev/null || true)
+  cache_agent_token "$gc_name" "$new_token"
 }
 
 # cache_recipient stores a message→recipient mapping for later read/archive.
@@ -278,6 +352,8 @@ case "$op" in
     ensure_agent "$to"
     mcp_from=$(gc_to_mcp_name "$from")
     mcp_to=$(gc_to_mcp_name "$to")
+    ensure_contact "$from" "$to"
+    sender_token=$(require_agent_token "$from")
 
     # Use subject for mcp subject, body for body_md.
     # If no subject, use body as subject (mcp_agent_mail requires subject).
@@ -289,12 +365,14 @@ case "$op" in
       --arg to "$mcp_to" \
       --arg subject "$mcp_subject" \
       --arg body_md "$body" \
+      --arg sender_token "$sender_token" \
       '{
         project_key: $project,
         sender_name: $from,
         to: [$to],
         subject: $subject,
-        body_md: $body_md
+        body_md: $body_md,
+        sender_token: $sender_token
       }')")
 
     # Extract message from deliveries response.
@@ -322,11 +400,13 @@ case "$op" in
     recipient="${1:?usage: gc-mail-mcp-agent-mail inbox <recipient>}"
     ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     result=$(mcp_call "fetch_inbox" "$(jq -n \
       --arg project "$PROJECT" \
       --arg name "$mcp_recipient" \
-      '{project_key: $project, agent_name: $name, include_bodies: true}')")
+      --arg registration_token "$registration_token" \
+      '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
 
     if [ -z "$result" ] || [ "$result" = "null" ] || [ "$result" = "[]" ]; then
       echo ""
@@ -382,11 +462,13 @@ case "$op" in
     recipient="${1:?usage: gc-mail-mcp-agent-mail check <recipient>}"
     ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     result=$(mcp_call "fetch_inbox" "$(jq -n \
       --arg project "$PROJECT" \
       --arg name "$mcp_recipient" \
-      '{project_key: $project, agent_name: $name, include_bodies: true}')")
+      --arg registration_token "$registration_token" \
+      '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
 
     if [ -z "$result" ] || [ "$result" = "null" ] || [ "$result" = "[]" ]; then
       echo ""
@@ -449,13 +531,16 @@ case "$op" in
       echo "no cached recipient for message $id" >&2
       exit 1
     fi
+    ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     # Fetch message content before acknowledging (may leave inbox after).
     result=$(mcp_call "fetch_inbox" "$(jq -n \
       --arg project "$PROJECT" \
       --arg name "$mcp_recipient" \
-      '{project_key: $project, agent_name: $name, include_bodies: true}')")
+      --arg registration_token "$registration_token" \
+      '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
 
     # Find the specific message by ID.
     msg=""
@@ -475,8 +560,9 @@ case "$op" in
     mcp_call "acknowledge_message" "$(jq -n \
       --arg project "$PROJECT" \
       --arg agent "$mcp_recipient" \
+      --arg registration_token "$registration_token" \
       --argjson id "$id" \
-      '{project_key: $project, agent_name: $agent, message_id: $id}')" > /dev/null 2>&1 || true
+      '{project_key: $project, agent_name: $agent, message_id: $id, registration_token: $registration_token}')" > /dev/null 2>&1 || true
 
     # Convert to gc Message format.
     # Map mcp sender name back to gc name.
@@ -510,12 +596,15 @@ case "$op" in
       echo "no cached recipient for message $id" >&2
       exit 1
     fi
+    ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     result=$(mcp_call "fetch_inbox" "$(jq -n \
       --arg project "$PROJECT" \
       --arg name "$mcp_recipient" \
-      '{project_key: $project, agent_name: $name, include_bodies: true}')")
+      --arg registration_token "$registration_token" \
+      '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
 
     msg=""
     if [ -n "$result" ] && [ "$result" != "null" ] && [ "$result" != "[]" ]; then
@@ -555,12 +644,15 @@ case "$op" in
     # Also acknowledge server-side.
     recipient=$(get_cached_recipient "$id")
     if [ -n "$recipient" ]; then
+      ensure_agent "$recipient"
       mcp_recipient=$(gc_to_mcp_name "$recipient")
+      registration_token=$(require_agent_token "$recipient")
       mcp_call "acknowledge_message" "$(jq -n \
         --arg project "$PROJECT" \
         --arg agent "$mcp_recipient" \
+        --arg registration_token "$registration_token" \
         --argjson id "$id" \
-        '{project_key: $project, agent_name: $agent, message_id: $id}')" > /dev/null 2>&1 || true
+        '{project_key: $project, agent_name: $agent, message_id: $id, registration_token: $registration_token}')" > /dev/null 2>&1 || true
     fi
     ;;
 
@@ -589,11 +681,14 @@ case "$op" in
     fi
 
     # Fetch original to determine who sent it (that's our reply target).
+    ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
     result=$(mcp_call "fetch_inbox" "$(jq -n \
       --arg project "$PROJECT" \
       --arg name "$mcp_recipient" \
-      '{project_key: $project, agent_name: $name, include_bodies: true}')")
+      --arg registration_token "$registration_token" \
+      '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
 
     reply_to=""
     if [ -n "$result" ] && [ "$result" != "null" ] && [ "$result" != "[]" ]; then
@@ -608,6 +703,8 @@ case "$op" in
     ensure_agent "$gc_reply_to"
     mcp_from=$(gc_to_mcp_name "$from")
     mcp_to=$(gc_to_mcp_name "$gc_reply_to")
+    ensure_contact "$from" "$gc_reply_to"
+    sender_token=$(require_agent_token "$from")
 
     mcp_subject="${subject:-$body}"
     reply_result=$(mcp_call "send_message" "$(jq -n \
@@ -616,12 +713,14 @@ case "$op" in
       --arg to "$mcp_to" \
       --arg subject "$mcp_subject" \
       --arg body_md "$body" \
+      --arg sender_token "$sender_token" \
       '{
         project_key: $project,
         sender_name: $from,
         to: [$to],
         subject: $subject,
-        body_md: $body_md
+        body_md: $body_md,
+        sender_token: $sender_token
       }')")
 
     msg_id=$(echo "$reply_result" | jq -r '.deliveries[0].payload.id')
@@ -650,7 +749,11 @@ case "$op" in
     ;;
 
   thread)
-    thread_id="${1:?usage: gc-mail-mcp-agent-mail thread <thread-id>}"
+    id="${1:?usage: gc-mail-mcp-agent-mail thread <id>}"
+    thread_id="$(get_cached_thread_id "$id")"
+    if [ -z "$thread_id" ]; then
+      thread_id="$id"
+    fi
     # mcp_agent_mail doesn't have a native thread query.
     # Search local cache for messages with matching thread ID.
     result="[]"
@@ -662,12 +765,15 @@ case "$op" in
       # Look up recipient to fetch message details.
       recipient=$(get_cached_recipient "$mid")
       [ -n "$recipient" ] || continue
+      ensure_agent "$recipient"
       mcp_recipient=$(gc_to_mcp_name "$recipient")
+      registration_token=$(require_agent_token "$recipient")
       # Fetch inbox to find the message.
       inbox_result=$(mcp_call "fetch_inbox" "$(jq -n \
         --arg project "$PROJECT" \
         --arg name "$mcp_recipient" \
-        '{project_key: $project, agent_name: $name, include_bodies: true}')")
+        --arg registration_token "$registration_token" \
+        '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
       msg=""
       if [ -n "$inbox_result" ] && [ "$inbox_result" != "null" ] && [ "$inbox_result" != "[]" ]; then
         # Message IDs may be numeric or string; try both.
@@ -701,11 +807,13 @@ case "$op" in
     recipient="${1:?usage: gc-mail-mcp-agent-mail count <recipient>}"
     ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     result=$(mcp_call "fetch_inbox" "$(jq -n \
       --arg project "$PROJECT" \
       --arg name "$mcp_recipient" \
-      '{project_key: $project, agent_name: $name, include_bodies: true}')")
+      --arg registration_token "$registration_token" \
+      '{project_key: $project, agent_name: $name, include_bodies: true, registration_token: $registration_token}')")
 
     total=0
     unread=0
@@ -738,7 +846,9 @@ case "$op" in
       echo "no cached recipient for message $id" >&2
       exit 1
     fi
+    ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     local_st=$(msg_status "$id")
     if [ "$local_st" = "archived" ]; then
@@ -751,8 +861,9 @@ case "$op" in
     mcp_call "acknowledge_message" "$(jq -n \
       --arg project "$PROJECT" \
       --arg agent "$mcp_recipient" \
+      --arg registration_token "$registration_token" \
       --argjson id "$id" \
-      '{project_key: $project, agent_name: $agent, message_id: $id}')" > /dev/null
+      '{project_key: $project, agent_name: $agent, message_id: $id, registration_token: $registration_token}')" > /dev/null
     ;;
 
   archive)
@@ -768,7 +879,9 @@ case "$op" in
       echo "no cached recipient for message $id" >&2
       exit 1
     fi
+    ensure_agent "$recipient"
     mcp_recipient=$(gc_to_mcp_name "$recipient")
+    registration_token=$(require_agent_token "$recipient")
 
     # Check local status for double-archive detection.
     # mcp_agent_mail's acknowledge is idempotent (no error on re-ack),
@@ -784,8 +897,9 @@ case "$op" in
     mcp_call "acknowledge_message" "$(jq -n \
       --arg project "$PROJECT" \
       --arg agent "$mcp_recipient" \
+      --arg registration_token "$registration_token" \
       --argjson id "$id" \
-      '{project_key: $project, agent_name: $agent, message_id: $id}')" > /dev/null
+      '{project_key: $project, agent_name: $agent, message_id: $id, registration_token: $registration_token}')" > /dev/null
     ;;
 
   *)
diff --git a/contrib/session-scripts/gc-controller-k8s b/contrib/session-scripts/gc-controller-k8s
index 8870809651..a5a8f4086d 100755
--- a/contrib/session-scripts/gc-controller-k8s
+++ b/contrib/session-scripts/gc-controller-k8s
@@ -122,6 +122,18 @@ derive_prefix() {
   fi
 }
 
+strip_leading_space() {
+  local value="$1"
+  printf '%s\n' "${value#"${value%%[![:space:]]*}"}"
+}
+
+extract_quoted_value() {
+  local value="${1#*=}"
+  value="$(strip_leading_space "$value")"
+  value="${value#\"}"
+  printf '%s\n' "${value%%\"*}"
+}
+
 bootstrap_controller_scope() {
   local label="$1"
   local command="$2"
@@ -184,7 +196,7 @@ init_controller_beads() {
   }
 
   while IFS= read -r line; do
-    line=$(echo "$line" | sed 's/^[[:space:]]*//')
+    line="$(strip_leading_space "$line")"
     if [ "$line" = "[[rigs]]" ]; then
       flush_rig
       in_rig=true
@@ -197,9 +209,9 @@ init_controller_beads() {
     esac
     if $in_rig; then
       case "$line" in
-        name\ =*|name=*) rig_name=$(echo "$line" | sed 's/.*= *"\([^"]*\)".*/\1/') ;;
-        prefix\ =*|prefix=*) rig_prefix=$(echo "$line" | sed 's/.*= *"\([^"]*\)".*/\1/') ;;
-        beads_prefix\ =*|beads_prefix=*) rig_prefix=$(echo "$line" | sed 's/.*= *"\([^"]*\)".*/\1/') ;;
+        name\ =*|name=*) rig_name="$(extract_quoted_value "$line")" ;;
+        prefix\ =*|prefix=*) rig_prefix="$(extract_quoted_value "$line")" ;;
+        beads_prefix\ =*|beads_prefix=*) rig_prefix="$(extract_quoted_value "$line")" ;;
       esac
     fi
   done <<< "$resolved_config"
@@ -259,6 +271,13 @@ case "$op" in
         spec: {
           serviceAccountName: $sa,
           restartPolicy: "Never",
+          securityContext: {
+            runAsNonRoot: true,
+            runAsUser: 1000,
+            runAsGroup: 1000,
+            fsGroup: 1000,
+            seccompProfile: {type: "RuntimeDefault"}
+          },
           containers: [{
             name: "controller",
             image: $image,
@@ -282,16 +301,30 @@ case "$op" in
               + (if $dolt_host != "" then [{name: "GC_DOLT_HOST", value: $dolt_host}] else [] end)
               + (if $dolt_port != "" then [{name: "GC_DOLT_PORT", value: $dolt_port}] else [] end)
             ),
+            securityContext: {
+              allowPrivilegeEscalation: false,
+              capabilities: {drop: ["ALL"]},
+              readOnlyRootFilesystem: true
+            },
             resources: {
               requests: {cpu: $cpu_req, memory: $mem_req},
               limits: {cpu: $cpu_lim, memory: $mem_lim}
             },
-            volumeMounts: [{name: "city", mountPath: "/city"}]
+            volumeMounts: [
+              {name: "city", mountPath: "/city"},
+              {name: "tmp", mountPath: "/tmp"}
+            ]
           }],
-          volumes: [{
-            name: "city",
-            emptyDir: {}
-          }]
+          volumes: [
+            {
+              name: "city",
+              emptyDir: {}
+            },
+            {
+              name: "tmp",
+              emptyDir: {}
+            }
+          ]
         }
       }')
 
diff --git a/deps.env b/deps.env
index bfad2f5ff4..4e6357f57a 100644
--- a/deps.env
+++ b/deps.env
@@ -4,7 +4,7 @@
 # Update these when bumping minimum versions. The internal/deps package
 # defines the minimum compatible versions (may lag behind these pins).
 
-DOLT_VERSION=1.86.1
+DOLT_VERSION=1.88.0
 BD_REPO=gastownhall/beads
-BD_VERSION=v1.0.0
+BD_VERSION=v1.0.3
 BR_VERSION=0.1.20
diff --git a/docs/docs.json b/docs/docs.json
index b2fbb6d5bd..d197370bd7 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -111,6 +111,7 @@
           "reference/cli",
           "reference/config",
           "reference/formula",
+          "reference/trust-boundaries",
           "reference/api",
           "reference/events",
           "schema/index",
diff --git a/docs/getting-started/coming-from-gastown.md b/docs/getting-started/coming-from-gastown.md
index 89f6e7a48f..e2a9e53a88 100644
--- a/docs/getting-started/coming-from-gastown.md
+++ b/docs/getting-started/coming-from-gastown.md
@@ -457,7 +457,7 @@ Two rules help a lot:
 | `gt` | Closest in Gas City | Notes |
 |---|---|---|
 | `gt mail` | `gc mail` | Near-direct mapping. |
-| `gt nudge` | `gc session nudge` or `gc nudge` | Use `gc session nudge` for a specific live session, `gc nudge` for deferred delivery controls. |
+| `gt nudge` | `gc session nudge` | Use `gc session nudge <target> "msg"` to send messages to a live session. The `gc nudge` subcommand only exposes deferred-delivery controls (`drain`, `status`, `poll`); it does not accept a positional `<target> "msg"` form. |
 | `gt peek` | `gc session peek` | Near-direct mapping. |
 | `gt broadcast` | no single direct equivalent | Usually modeled as `gc mail send` to a group or multiple explicit targets. |
 | `gt notify` | no direct equivalent | Notification policy is not a top-level SDK command family. |
diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md
index 044c2413e6..db6c3276a9 100644
--- a/docs/getting-started/installation.md
+++ b/docs/getting-started/installation.md
@@ -26,12 +26,17 @@ for you; the other methods require manual installation.
 | tmux | Yes | — | `brew install tmux` | `apt install tmux` | Session management |
 | jq | Yes | — | `brew install jq` | `apt install jq` | JSON processing |
 | git | Yes | — | (built-in) | (built-in) | Version control |
-| dolt | Yes | 1.86.1 | `brew install dolt` | [releases](https://github.com/dolthub/dolt/releases) | Beads data plane |
+| dolt | Yes | 1.86.2 or newer | `brew install dolt` | [releases](https://github.com/dolthub/dolt/releases) | Beads data plane |
 | bd (Beads CLI) | Yes | 1.0.0 | `brew install beads` | [releases](https://github.com/gastownhall/beads/releases) | Issue tracking |
 | flock | Yes | — | `brew install flock` | (built-in via util-linux) | File locking |
 | Go 1.25+ | Source only | 1.25 | `brew install go` | [golang.org](https://go.dev/dl/) | Compiler |
 | make | Source only | — | (built-in) | `apt install make` (or `build-essential`) | Drives `make install` |
 
+Use a final Dolt 1.86.2 or newer. Gas City's managed Dolt checks reject older
+and pre-release builds because they can miss the upstream GC/writer deadlock
+fix in dolthub/dolt commit `ccf7bde206`, which can hang `dolt_backup sync`
+under heavy write load.
+
 The exact versions CI pins are in [`deps.env`](https://github.com/gastownhall/gascity/blob/main/deps.env).
 
 ## Homebrew (recommended)
@@ -103,7 +108,7 @@ Release tarballs are published for every tagged version. Supported platforms:
 
 ```bash
 # Set the version you want (check https://github.com/gastownhall/gascity/releases)
-VERSION=0.13.3
+VERSION=1.1.0
 
 # Detect platform
 OS=$(uname -s | tr '[:upper:]' '[:lower:]')
@@ -124,6 +129,39 @@ sudo install -m 755 gc /usr/local/bin/gc
 gc version
 ```
 
+### Verify release artifacts
+
+Homebrew verifies release checksums from the formula automatically. For direct
+downloads, verify the archive before installing it:
+
+```bash
+ARCHIVE="gascity_${VERSION}_${OS}_${ARCH}.tar.gz"
+CHECKSUMS="gascity_${VERSION}_checksums.txt"
+
+curl -fsSLO "https://github.com/gastownhall/gascity/releases/download/v${VERSION}/${CHECKSUMS}"
+grep "  ${ARCHIVE}$" "${CHECKSUMS}" > "${ARCHIVE}.sha256"
+
+if command -v sha256sum >/dev/null 2>&1; then
+  sha256sum -c "${ARCHIVE}.sha256"
+else
+  shasum -a 256 -c "${ARCHIVE}.sha256"
+fi
+```
+
+Release archives are also published with GitHub artifact attestations. If you
+have the GitHub CLI installed, verify the downloaded archive against the
+`gastownhall/gascity` repository:
+
+```bash
+gh attestation verify "${ARCHIVE}" --repo gastownhall/gascity
+```
+
+Each release also includes an SPDX SBOM asset:
+
+```bash
+curl -fsSLO "https://github.com/gastownhall/gascity/releases/download/v${VERSION}/gascity-v${VERSION}.spdx.json"
+```
+
 ### Upgrading a direct-download install
 
 Repeat the download steps above with the new version number. The `gc` binary is
diff --git a/docs/getting-started/troubleshooting.md b/docs/getting-started/troubleshooting.md
index ff805859fb..0dc9854382 100644
--- a/docs/getting-started/troubleshooting.md
+++ b/docs/getting-started/troubleshooting.md
@@ -96,7 +96,7 @@ check.
 
 | Tool | Min version | macOS | Linux |
 |------|-------------|-------|-------|
-| dolt | 1.86.1 | `brew install dolt` | [releases](https://github.com/dolthub/dolt/releases) |
+| dolt | 1.86.2 or newer | `brew install dolt` | [releases](https://github.com/dolthub/dolt/releases) |
 | bd | 1.0.0 | [releases](https://github.com/gastownhall/beads/releases) | [releases](https://github.com/gastownhall/beads/releases) |
 | flock | -- | `brew install flock` | `apt install util-linux` |
 
@@ -119,7 +119,10 @@ durable versioned storage and is recommended for real work.
 
 ## Dolt Version Too Old
 
-Gas City requires dolt 1.86.1 or newer. Check your version:
+Gas City requires a final Dolt 1.86.2 or newer. Older and pre-release builds
+can miss the upstream GC/writer deadlock fix in dolthub/dolt commit
+`ccf7bde206`, which can hang `dolt_backup sync` under heavy write load. Check
+your version:
 
 ```bash
 dolt version
diff --git a/docs/guides/migrating-to-pack-vnext.md b/docs/guides/migrating-to-pack-vnext.md
index 587a8da274..4720dfd98c 100644
--- a/docs/guides/migrating-to-pack-vnext.md
+++ b/docs/guides/migrating-to-pack-vnext.md
@@ -481,14 +481,20 @@ each prompt file:
 append_fragments = ["operational-awareness", "command-glossary"]
 ```
 
+Per-agent `append_fragments` is also supported, declared on an
+`[[agent]]` block or in `agents/<name>/agent.toml`, and layers in front
+of the `[agent_defaults]` list:
+
+```toml
+[[agent]]
+name = "mayor"
+prompt_template = "agents/mayor/prompt.template.md"
+append_fragments = ["mayor-footer"]
+```
+
 Plain `.md` prompts are inert — no fragments attach, no template engine
 runs.
 
-> **As of release v0.15.0:** `[agent_defaults].append_fragments` is the
-> proven migration bridge in the current release. Agent-local
-> `append_fragments` is still tracked as a spec/runtime parity gap in
-> [#671](https://github.com/gastownhall/gascity/issues/671).
-
 ## Assets and paths
 
 This is the positive rule that replaces a lot of 0.14.0 ad hoc path
diff --git a/docs/packv2/doc-agent-v2.md b/docs/packv2/doc-agent-v2.md
index 4582e20263..5909284b2f 100644
--- a/docs/packv2/doc-agent-v2.md
+++ b/docs/packv2/doc-agent-v2.md
@@ -408,9 +408,23 @@ auto-append fragments via `[agent_defaults].append_fragments`:
 append_fragments = ["operational-awareness", "command-glossary"]
 ```
 
-Agent-local `append_fragments` remains a follow-up tracked in
-[#671](https://github.com/gastownhall/gascity/issues/671); it is not part
-of the supported migration contract as of release v0.15.0.
+Agent-local `append_fragments` is also supported on a per-agent basis,
+declared directly on an `[[agent]]` block or in an
+`agents/<name>/agent.toml`:
+
+```toml
+[[agent]]
+name = "mayor"
+prompt_template = "agents/mayor/prompt.template.md"
+append_fragments = ["mayor-footer"]
+```
+
+Among the `append_fragments` sources, the layering order is per-agent
+first, then imported-pack `[agent_defaults].append_fragments`, then
+city-level `[agent_defaults].append_fragments`. Duplicates across
+layers are de-duplicated. Legacy `global_fragments` (workspace) and
+`inject_fragments` (per-agent) still prepend to this list during
+migration.
 
 `append_fragments` only works on `.template.md` prompts. Plain `.md` prompts are inert — nothing is injected, no template engine runs.
 
diff --git a/docs/reference/api.md b/docs/reference/api.md
index 14fa31b8f2..13455fc3bf 100644
--- a/docs/reference/api.md
+++ b/docs/reference/api.md
@@ -100,6 +100,11 @@ the per-operation `responses.200.content.text/event-stream` entry.
 Clients should follow the standard SSE reconnection protocol
 (`Last-Event-ID` header) where the server supports it; the event bus
 stream (`/v0/events/stream`) replays from the last received index.
+When no cursor is supplied, event streams start at the current event
+head and deliver future events only. Async `202 Accepted` responses
+include an `event_cursor` captured before the operation starts; pass
+that value as `after_cursor` or `after_seq` to wait for the operation's
+request-result event without replaying unrelated historical backlog.
 
 Fatal setup errors are returned as normal Problem Details responses
 *before* the stream's 200 headers commit, never as a 200 stream that
@@ -121,46 +126,39 @@ is nothing to poll.
 
 ```json
 {
-  "ok": true,
-  "name": "my-city",
-  "path": "/abs/path/to/my-city"
+  "request_id": "req-...",
+  "event_cursor": "__supervisor__:42,my-city:17"
 }
 ```
 
-The `name` field is the city's resolved runtime identity
-(`workspace.name` from `city.toml`, or the directory basename).
-Use it to filter the event stream for completion.
+Use `request_id` to correlate the completion event. Use `event_cursor`
+as the `after_cursor` value on the supervisor event stream.
 
 ### Completion events
 
-On the same `/v0/events/stream` the client will see (in order):
+On the same `/v0/events/stream` the client will see:
 
-- `city.created` (`CityCreatedPayload`) — emitted by the scaffold
+- `city.created` (`CityLifecyclePayload`) — emitted by the scaffold
   step before `POST` returns. `subject` and payload `name` equal
-  the response's `name`.
-- `city.ready` (`CityReadyPayload`) — the reconciler finished
-  `prepareCityForSupervisor` successfully. Matching event:
-  `subject == name` and `type == "city.ready"`.
-- `city.init_failed` (`CityInitFailedPayload`) — the reconciler
-  gave up. The payload's `error` field describes why, including
-  deferred dependency or provider-readiness blockers that the async
-  API does not fail synchronously.
-
-Exactly one of `city.ready` or `city.init_failed` lands per
-successful `POST`. Clients wait for either; no polling of
-`GET /v0/cities` or `GET /v0/city/{cityName}/readiness` is
-required.
+  the resolved city name.
+- `request.result.city.create` (`CityCreateSucceededPayload`) — the
+  reconciler finished `prepareCityForSupervisor` successfully.
+- `request.failed` (`RequestFailedPayload`) — the reconciler failed
+  the async operation. Match `payload.request_id` to the 202 response.
+
+Exactly one terminal event (`request.result.city.create` or
+`request.failed`) lands per successful `POST`. Clients wait for the
+returned `request_id`; no polling of `GET /v0/cities` or
+`GET /v0/city/{cityName}/readiness` is required.
 
 ### Subscribe before or after POST
 
 Either order works. The recommended flow is:
 
-1. `POST /v0/city` and wait for `202`.
-2. `GET /v0/events/stream?after_cursor=0` — request replay from
-   the start so `city.created` (and possibly `city.ready`) are
-   delivered even if they fired before subscribe.
-3. Read frames until `subject == response.name` and
-   `type ∈ {"city.ready", "city.init_failed"}`.
+1. `POST /v0/city` and wait for `202 {request_id, event_cursor}`.
+2. `GET /v0/events/stream?after_cursor=<event_cursor>`.
+3. Read frames until `payload.request_id == response.request_id` and
+   `type ∈ {"request.result.city.create", "request.failed"}`.
 
 **Empty supervisor is fine.** The event stream works even when
 no cities existed before the `POST`. `POST` writes the city to
@@ -199,28 +197,30 @@ simple `gc register`.
 
 ```json
 {
-  "ok": true,
-  "name": "my-city",
-  "path": "/abs/path/to/my-city"
+  "request_id": "req-...",
+  "event_cursor": "__supervisor__:43,my-city:21"
 }
 ```
 
+Pass `event_cursor` as `after_cursor` on `/v0/events/stream` and wait
+for the terminal event whose payload contains the returned `request_id`.
+
 ### Completion events
 
 On `/v0/events/stream` the client will see (in order):
 
 - `city.unregister_requested`
-  (`CityUnregisterRequestedPayload`) — emitted by the handler
+  (`CityLifecyclePayload`) — emitted by the handler
   before the registry write so subscribers see the teardown start.
-- `city.unregistered` (`CityUnregisteredPayload`) — emitted by the
-  reconciler once the city's controller has stopped. Matching
-  event: `subject == name` and `type == "city.unregistered"`.
-- `city.unregister_failed` (`CityUnregisterFailedPayload`) — emitted
-  by the reconciler if the controller did not stop cleanly. The
-  payload's `error` field describes the failure.
+- `request.result.city.unregister`
+  (`CityUnregisterSucceededPayload`) — emitted by the reconciler once
+  the city's controller has stopped.
+- `request.failed` (`RequestFailedPayload`) — emitted by the
+  reconciler if the controller did not stop cleanly. Match
+  `payload.request_id`.
 
-Exactly one of `city.unregistered` or `city.unregister_failed`
-lands per successful unregister. Clients wait for either.
+Exactly one terminal event lands per successful unregister. Clients
+wait for the returned `request_id`.
 
 ### Errors
 
@@ -241,15 +241,32 @@ behavior, heartbeat suppression, and the `--seq` plain-text cursor format, see
 
 ### City Scope
 
+Per-city routes are available only after the supervisor marks the city
+`running=true` in `GET /v0/cities`. During startup reconciliation, a city can
+appear in the city list with `running=false` and `status=starting_agents`; in
+that window typed `/v0/city/{cityName}/...` routes return `404` with
+`not_found: city not found or not running: <cityName>`. The raw
+`/v0/city/{cityName}/svc/*` workspace-service proxy is outside the Huma-typed
+API surface and returns the static readiness detail
+`not_found: city not found or not running`. Clients should use the supervisor
+city list or lifecycle events as the readiness boundary before issuing per-city
+requests.
+
 - `GET /v0/city/{cityName}/events`
   returns `ListBodyWireEvent` and includes `X-GC-Index`.
 - `GET /v0/city/{cityName}/events/stream`
   emits:
   - `event: event` with `EventStreamEnvelope`
   - `event: heartbeat` with `HeartbeatEvent`
+- Async session mutations in that city (`session.create`,
+  `session.message`, `session.submit`) complete on this stream. Match
+  terminal `request.result.session.*` or `request.failed` events by
+  `payload.request_id`.
 - Resume:
-  - `Last-Event-ID` or `after_seq`
-- `gc events` in city scope outputs one `WireEvent` JSON object per line.
+  - `Last-Event-ID` or `after_seq`; omit both to start from the
+    current city event head.
+- `gc events` in city scope outputs one `TypedEventStreamEnvelope` JSON
+  object per line.
 - `gc events --watch` and `gc events --follow` in city scope output one
   `EventStreamEnvelope` JSON object per line.
 - `gc events --seq` in city scope prints the API's `X-GC-Index` value.
@@ -262,10 +279,14 @@ behavior, heartbeat suppression, and the `--seq` plain-text cursor format, see
   emits:
   - `event: tagged_event` with `TaggedEventStreamEnvelope`
   - `event: heartbeat` with `HeartbeatEvent`
+- Async supervisor mutations (`city.create`, `city.unregister`) complete
+  on this stream. Match terminal `request.result.city.*` or
+  `request.failed` events by `payload.request_id`.
 - Resume:
-  - `Last-Event-ID` or `after_cursor`
-- `gc events` in supervisor scope outputs one `WireTaggedEvent` JSON object
-  per line.
+  - `Last-Event-ID` or `after_cursor`; omit both to start from the
+    current supervisor event head.
+- `gc events` in supervisor scope outputs one `TypedTaggedEventStreamEnvelope`
+  JSON object per line.
 - `gc events --watch` and `gc events --follow` in supervisor scope
   output one `TaggedEventStreamEnvelope` JSON object per line.
 - `gc events --seq` in supervisor scope prints the current composite
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 32f37161f2..7919e0088a 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -30,13 +30,14 @@ gc [flags]
 | [gc convoy](#gc-convoy) | Manage convoys — graphs of related work |
 | [gc dashboard](#gc-dashboard) | Web dashboard for monitoring the supervisor and managed cities |
 | [gc doctor](#gc-doctor) | Check workspace health |
+| [gc dolt-cleanup](#gc-dolt-cleanup) | Find and remove orphaned Dolt databases (Go-side core) |
 | [gc event](#gc-event) | Event operations |
 | [gc events](#gc-events) | Show events from the GC API |
 | [gc formula](#gc-formula) | Manage and inspect formulas |
 | [gc graph](#gc-graph) | Show dependency graph for beads |
 | [gc handoff](#gc-handoff) | Send handoff mail and restart controller-managed sessions |
 | [gc help](#gc-help) | Help about any command |
-| [gc hook](#gc-hook) | Check for available work (use --inject for Stop hook output) |
+| [gc hook](#gc-hook) | Check for available work |
 | [gc import](#gc-import) | Manage pack imports |
 | [gc init](#gc-init) | Initialize a new city |
 | [gc mail](#gc-mail) | Send and receive messages between agents and humans |
@@ -149,6 +150,10 @@ in the arguments.
 
 All arguments after "gc bd" are forwarded to bd unchanged.
 
+gc bd forces BD_EXPORT_AUTO=false to prevent bd's git auto-export hook
+from wedging the wrapper after printing command output. If you need
+auto-export behavior, invoke bd directly.
+
 ```
 gc bd [bd-args...]
 ```
@@ -643,7 +648,7 @@ gc convoy
 | [gc convoy close](#gc-convoy-close) | Close a convoy |
 | [gc convoy control](#gc-convoy-control) | Execute control beads or run the control-dispatcher loop |
 | [gc convoy create](#gc-convoy-create) | Create a convoy and optionally track issues |
-| [gc convoy delete](#gc-convoy-delete) | Close and optionally delete a convoy and all its beads |
+| [gc convoy delete](#gc-convoy-delete) | Close or delete a convoy and all its beads |
 | [gc convoy delete-source](#gc-convoy-delete-source) | Close workflows sourced from a bead |
 | [gc convoy land](#gc-convoy-land) | Land an owned convoy (terminate + cleanup) |
 | [gc convoy list](#gc-convoy-list) | List open convoys with progress |
@@ -730,13 +735,13 @@ gc convoy create sprint-42
 
 ## gc convoy delete
 
-Close all open beads in a convoy, then optionally delete them.
+Close all open beads in a convoy, or delete them.
 
 Searches all stores (city + rigs) for the convoy root and all beads
 with matching gc.root_bead_id. Without --force, shows a preview.
 
 By default, beads are closed with gc.outcome=skipped. Use --delete to
-also remove them from the store after closing.
+remove them from the store via bd delete --cascade --force.
 
 ```
 gc convoy delete <convoy-id> [flags]
@@ -744,7 +749,7 @@ gc convoy delete <convoy-id> [flags]
 
 | Flag | Type | Default | Description |
 |------|------|---------|-------------|
-| `--delete` | bool |  | Also delete beads from the store after closing |
+| `--delete` | bool |  | Delete beads from the store instead of closing |
 | `-f`, `--force` | bool |  | Actually close/delete (without this, shows preview) |
 
 ## gc convoy delete-source
@@ -910,6 +915,57 @@ gc doctor
 | `--fix` | bool |  | attempt to fix issues automatically |
 | `-v`, `--verbose` | bool |  | show extra diagnostic details |
 
+## gc dolt-cleanup
+
+gc dolt-cleanup is the Go-side implementation of the operational Dolt
+cleanup tool. It resolves the Dolt server port via the AD-04 chain
+(--port &gt; city dolt.port &gt; &lt;rigRoot&gt;/.beads/dolt-server.port &gt; 3307),
+drops stale test/agent databases, calls DOLT_PURGE_DROPPED_DATABASES
+to reclaim disk, and reaps orphaned dolt sql-server processes left
+over from leaked test harnesses. Invalid explicit ports and unreadable
+or invalid city/rig port settings fail closed before cleanup stages run;
+only absent rig port files can reach the legacy default. The legacy
+default is a connection fallback only; it does not protect port 3307
+from orphan-process reaping.
+
+Dry-run by default. Pass --force to actually drop, purge, and kill.
+Pass --max-orphan-dbs with --force to refuse all destructive cleanup
+stages if the live apply-time stale database count exceeds the
+scan-time threshold. The default 0 disables this guard; negative values
+are rejected before any city lookup or cleanup stage runs.
+Active rig dolt servers, registered rig databases, active test temp roots,
+and processes outside the test-config-path allowlist (/tmp/Test*,
+os.TempDir()/Test*, known Gas City test prefixes, ~/.gotmp/Test*) are always
+protected — see the PROTECTED section of the
+report. Destructive drops are limited to known stale test database name
+shapes and conservative SQL identifier characters; skipped stale matches
+are reported in dropped.skipped. Rig dolt_database names used for purge
+must use the same identifier shape: ASCII letters, digits, underscores,
+and non-leading hyphens. Missing or silent rig metadata disables forced
+drop/purge because the live database name cannot be proven safe.
+
+JSON envelope schema is stable: gc.dolt.cleanup.v1. Automation that
+uses --json must inspect summary.errors_total and errors, and must also
+refuse to invoke --force when dry-run force_blockers is non-empty.
+force_blockers reports conditions that would block forced cleanup without
+incrementing errors_total. The rig-protection blocker is intentionally
+global: missing or silent rig metadata prevents forced drop/purge because
+the command cannot prove all registered rig databases are protected.
+Cleanup stage errors are reported in the envelope even when the command
+can still return successfully after emitting the report.
+
+```
+gc dolt-cleanup [flags]
+```
+
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--force` | bool |  | actually drop, purge, and kill orphaned resources (default: dry-run) |
+| `--json` | bool |  | emit JSON envelope (gc.dolt.cleanup.v1) |
+| `--max-orphan-dbs` | int |  | with --force, refuse cleanup when live stale database count exceeds this limit |
+| `--port` | string |  | override the resolved Dolt port |
+| `--probe` | bool |  | TCP-probe the resolved port; fail if unreachable |
+
 ## gc event
 
 Event operations
@@ -1092,6 +1148,10 @@ For controller-restartable sessions, equivalent to:
   gc mail send $GC_ALIAS &lt;subject&gt; [message]
   gc runtime request-restart
 
+Auto handoff (--auto): sends mail to self and returns without requesting a
+restart. This is for PreCompact hooks, where the provider is already managing
+the context compaction lifecycle.
+
 Remote handoff (--target): sends mail to a target session. If the target is
 controller-restartable, kills it so the reconciler restarts it with the handoff
 mail waiting. For on-demand configured named targets, sends mail and returns
@@ -1103,14 +1163,16 @@ For controller-restartable targets, equivalent to:
   gc session kill &lt;target&gt;
 
 Self-handoff requires session context (GC_ALIAS or GC_SESSION_ID, plus
-GC_SESSION_NAME and city context env). Remote handoff accepts a session alias or ID.
+GC_SESSION_NAME and city context env). Remote handoff accepts a session alias
+or ID. Subject is required unless --auto is set.
 
 ```
-gc handoff <subject> [message] [flags]
+gc handoff [subject] [message] [flags]
 ```
 
 | Flag | Type | Default | Description |
 |------|------|---------|-------------|
+| `--auto` | bool |  | Send handoff mail without requesting restart (for PreCompact hooks) |
 | `--target` | string |  | Remote session alias or ID to handoff (kills only controller-restartable sessions) |
 
 ## gc help
@@ -1127,7 +1189,7 @@ gc help [command]
 Checks for available work using the agent's work_query config.
 
 Without --inject: prints raw output, exits 0 if work exists, 1 if empty.
-With --inject: wraps output in &lt;system-reminder&gt; for hook injection, always exits 0.
+With --inject: silent legacy Stop-hook compatibility; skips the work query and always exits 0.
 
 		The agent is determined from $GC_AGENT or a positional argument.
 
@@ -1137,8 +1199,7 @@ gc hook [agent] [flags]
 
 | Flag | Type | Default | Description |
 |------|------|---------|-------------|
-| `--hook-format` | string |  | format hook output for a provider |
-| `--inject` | bool |  | output &lt;system-reminder&gt; block for hook injection |
+| `--inject` | bool |  | silent legacy Stop-hook compatibility; skip work query and exit 0 |
 
 ## gc import
 
@@ -1289,10 +1350,10 @@ gc mail
 
 | Subcommand | Description |
 |------------|-------------|
-| [gc mail archive](#gc-mail-archive) | Archive a message without reading it |
+| [gc mail archive](#gc-mail-archive) | Archive one or more messages without reading them |
 | [gc mail check](#gc-mail-check) | Check for unread mail (use --inject for hook output) |
 | [gc mail count](#gc-mail-count) | Show total/unread message count |
-| [gc mail delete](#gc-mail-delete) | Delete a message (closes the bead) |
+| [gc mail delete](#gc-mail-delete) | Delete one or more messages (closes the beads) |
 | [gc mail inbox](#gc-mail-inbox) | List unread messages (defaults to your inbox) |
 | [gc mail mark-read](#gc-mail-mark-read) | Mark a message as read |
 | [gc mail mark-unread](#gc-mail-mark-unread) | Mark a message as unread |
@@ -1304,13 +1365,14 @@ gc mail
 
 ## gc mail archive
 
-Close a message bead without displaying its contents.
+Close one or more message beads without displaying their contents.
 
-Use this to dismiss a message without reading it. The message is marked
-as closed and will no longer appear in mail check or inbox results.
+Use this to dismiss messages without reading them. Each message is marked
+as closed and will no longer appear in mail check or inbox results. When
+multiple IDs are passed, they are archived in a single batch round-trip.
 
 ```
-gc mail archive <id>
+gc mail archive <id>...
 ```
 
 ## gc mail check
@@ -1350,10 +1412,12 @@ gc mail count [session]
 
 ## gc mail delete
 
-Delete a message by closing the bead. Same effect as archive but with different user intent.
+Delete one or more messages by closing the beads. Same effect as archive
+but with different user intent. When multiple IDs are passed, they are
+deleted in a single batch round-trip.
 
 ```
-gc mail delete <id>
+gc mail delete <id>...
 ```
 
 ## gc mail inbox
@@ -1410,6 +1474,7 @@ gc mail read <id>
 Reply to a message. The reply is addressed to the original sender.
 
 Inherits the thread ID from the original message for conversation tracking.
+Use --notify to nudge the recipient after replying.
 Use -s/--subject for the reply subject and -m/--message for the reply body.
 
 ```
@@ -1460,10 +1525,10 @@ gc mail send mayor "Build is green"
 
 ## gc mail thread
 
-Show all messages sharing a thread ID, ordered by time.
+Show all messages sharing a thread ID or message ID, ordered by time.
 
 ```
-gc mail thread <thread-id>
+gc mail thread <id>
 ```
 
 ## gc mcp
@@ -1540,6 +1605,7 @@ gc order
 | [gc order list](#gc-order-list) | List available orders |
 | [gc order run](#gc-order-run) | Execute an order manually |
 | [gc order show](#gc-order-show) | Show details of an order |
+| [gc order sweep-tracking](#gc-order-sweep-tracking) | Close stale order-tracking beads |
 
 ## gc order check
 
@@ -1611,6 +1677,22 @@ gc order show <name> [flags]
 |------|------|---------|-------------|
 | `--rig` | string |  | rig name to disambiguate same-name orders |
 
+## gc order sweep-tracking
+
+Close stale open order-tracking beads.
+
+This is intended for maintenance exec orders. It only closes tracking beads
+older than --stale-after so a fresh in-flight order is not interrupted.
+
+```
+gc order sweep-tracking [flags]
+```
+
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--quiet` | bool |  | suppress success output |
+| `--stale-after` | duration | `10m0s` | minimum age for an open tracking bead to be closed |
+
 ## gc pack
 
 Manage remote pack sources that provide agent configurations.
@@ -1940,7 +2022,7 @@ gc runtime
 | [gc runtime drain](#gc-runtime-drain) | Signal a session to drain (wind down gracefully) |
 | [gc runtime drain-ack](#gc-runtime-drain-ack) | Acknowledge drain — signal the controller to stop this session |
 | [gc runtime drain-check](#gc-runtime-drain-check) | Check if a session is draining (exit 0 = draining) |
-| [gc runtime request-restart](#gc-runtime-request-restart) | Request controller restart this session (blocks until killed) |
+| [gc runtime request-restart](#gc-runtime-request-restart) | Request controller restart this session (waits to be killed) |
 | [gc runtime undrain](#gc-runtime-undrain) | Cancel drain on a session |
 
 ## gc runtime drain
@@ -1984,18 +2066,25 @@ gc runtime drain-check [name]
 
 Signal the controller to stop and restart this session.
 
-Sets GC_RESTART_REQUESTED metadata on the session, then blocks forever.
-The controller will stop the session on its next reconcile tick and
-restart it fresh. The blocking prevents the agent from consuming more
-context while waiting.
+Sets GC_RESTART_REQUESTED metadata on the session, then waits while the
+controller stops the session on its next reconcile tick and restarts it
+fresh. The wait keeps the agent idle so it does not consume more context
+in the interim.
 
-For on-demand configured named sessions, the controller cannot restart the
-user-attended process. In that case this command reports that restart was
-skipped and returns without blocking. No session.draining event is emitted
-when restart is skipped.
+Under normal operation the controller SIGKILLs the process tree before
+this command returns. If the controller accepts the stop handoff, the
+runtime is already gone, or a SIGINT/SIGTERM is received, the command
+exits 0 cleanly. If the controller has not acted within a bounded
+timeout (max(5*PatrolInterval, 5min), capped at 30min) the command exits
+1 with a diagnostic pointing at controller health.
+
+For on-demand configured named sessions, the controller cannot restart
+the user-attended process. In that case this command reports that
+restart was skipped and returns immediately. No session.draining event
+is emitted when restart is skipped.
 
 This command is designed to be called from within a session context.
-It emits a session.draining event before blocking.
+It emits a session.draining event before waiting.
 
 ```
 gc runtime request-restart
@@ -2283,7 +2372,9 @@ Request a fresh restart for an existing session without closing its bead.
 
 The controller stops the current runtime and starts the same session again with
 fresh provider conversation state. Session identity, alias, mail, and queued
-work remain attached to the existing session bead.
+work remain attached to the existing session bead. For named sessions, reset
+also clears any tripped named-session respawn circuit breaker before requesting
+the fresh restart.
 
 Accepts a session ID (e.g., gc-42) or session alias (e.g., mayor).
 
@@ -2661,6 +2752,10 @@ gc supervisor stop [flags]
 
 Remove the platform service and stop the machine-wide supervisor.
 
+On systemd, uninstall refuses to remove an active unit when the supervisor
+control socket is unavailable. Start the supervisor first so it can re-adopt
+preserved sessions, then retry uninstall.
+
 ```
 gc supervisor uninstall
 ```
diff --git a/docs/reference/config.md b/docs/reference/config.md
index f4b92800a6..10f87e770e 100644
--- a/docs/reference/config.md
+++ b/docs/reference/config.md
@@ -31,6 +31,7 @@ City is the top-level configuration for a Gas City instance.
 | `chat_sessions` | ChatSessionsConfig |  |  | ChatSessions configures chat session behavior (auto-suspend). |
 | `session_sleep` | SessionSleepConfig |  |  | SessionSleep configures idle sleep policy defaults for managed sessions. |
 | `convergence` | ConvergenceConfig |  |  | Convergence configures convergence loop limits. |
+| `doctor` | DoctorConfig |  |  | Doctor configures gc doctor thresholds and policy toggles (worktree size warnings, nested-worktree auto-prune). |
 | `service` | []Service |  |  | Services declares workspace-owned HTTP services mounted on the controller edge under /svc/&#123;name&#125;. |
 | `agent_defaults` | AgentDefaults |  |  | AgentDefaults provides city-level defaults for agents that don't override them (canonical TOML key: agent_defaults). The runtime currently applies default_sling_formula and append_fragments; the attachment-list fields remain tombstones, and the other fields are parsed/composed but not yet inherited automatically. |
 
@@ -61,7 +62,7 @@ Agent defines a configured agent in the city.
 | Field | Type | Required | Default | Description |
 |-------|------|----------|---------|-------------|
 | `name` | string | **yes** |  | Name is the unique identifier for this agent. |
-| `description` | string |  |  | Description is a human-readable description shown in MC's session creation UI. |
+| `description` | string |  |  | Description is a human-readable description shown in a real-world app's session creation UI. |
 | `dir` | string |  |  | Dir is the identity prefix for rig-scoped agents and the default working directory when WorkDir is not set. |
 | `work_dir` | string |  |  | WorkDir overrides the session working directory without changing the agent's qualified identity. Relative paths resolve against city root and may use the same template placeholders as session_setup. |
 | `scope` | string |  |  | Scope defines where this agent is instantiated: "city" (one per city) or "rig" (one per rig, the default). Only meaningful for pack-defined agents; inline agents in city.toml use Dir directly. Enum: `city`, `rig` |
@@ -69,7 +70,7 @@ Agent defines a configured agent in the city.
 | `pre_start` | []string |  |  | PreStart is a list of shell commands run before session creation. Commands run on the target filesystem: locally for tmux, inside the pod/container for exec providers. Template variables same as session_setup. |
 | `prompt_template` | string |  |  | PromptTemplate is the path to this agent's prompt template file. Relative paths resolve against the city directory. |
 | `nudge` | string |  |  | Nudge is text typed into the agent's tmux session after startup. Used for CLI agents that don't accept command-line prompts. |
-| `session` | string |  |  | Session overrides the session transport for this agent. "" (default) uses the city-level session provider (typically tmux). "acp" uses the Agent Client Protocol (JSON-RPC over stdio). The agent's resolved provider must have supports_acp = true. Enum: `acp` |
+| `session` | string |  |  | Session overrides the session transport for this agent. "" (default) uses the provider default. "tmux" uses the tmux-backed CLI path even when the provider supports ACP. "acp" uses the Agent Client Protocol (JSON-RPC over stdio); the agent's resolved provider must have supports_acp = true. Enum: `acp`, `tmux` |
 | `provider` | string |  |  | Provider names the provider preset to use for this agent. |
 | `start_command` | string |  |  | StartCommand overrides the provider's command for this agent. |
 | `args` | []string |  |  | Args overrides the provider's default arguments. |
@@ -83,7 +84,7 @@ Agent defines a configured agent in the city.
 | `option_defaults` | map[string]string |  |  | OptionDefaults overrides the provider's effective schema defaults for this agent. Keys are option keys, values are choice values. Applied on top of the provider's OptionDefaults (agent keys win). Example: option_defaults = &#123; permission_mode = "plan", model = "sonnet" &#125; |
 | `max_active_sessions` | integer |  |  | MaxActiveSessions is the agent-level cap on concurrent sessions. Nil means inherit from rig, then workspace, then unlimited. Replaces pool.max. |
 | `min_active_sessions` | integer |  |  | MinActiveSessions is the minimum number of sessions to keep alive. Agent-level only. Counts against rig/workspace caps. Replaces pool.min. |
-| `scale_check` | string |  |  | ScaleCheck is a shell command template whose output determines desired session count. Optional override — when set, its output is the desired count (still clamped by all cap levels). If it contains Go template placeholders, gc expands them using the same PathContext fields as work_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName) before running the command. |
+| `scale_check` | string |  |  | ScaleCheck is a shell command template whose output reports new unassigned session demand. In bead-backed reconciliation this is additive: assigned work is resumed separately, and ScaleCheck reports only how many new generic sessions to start, still bounded by all cap levels. Legacy no-store evaluation continues to treat the output as the desired session count. If it contains Go template placeholders, gc expands them using the same PathContext fields as work_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName) before running the command. |
 | `drain_timeout` | string |  | `5m` | DrainTimeout is the maximum time to wait for a session to finish its current work before force-killing it during scale-down. Duration string (e.g., "5m", "30m", "1h"). Defaults to "5m". |
 | `on_boot` | string |  |  | OnBoot is a shell command template run once at controller startup for this agent. If it contains Go template placeholders, gc expands them using the same PathContext fields as work_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName) before running the command. |
 | `on_death` | string |  |  | OnDeath is a shell command template run when a session dies unexpectedly. If it contains Go template placeholders, gc expands them using the same PathContext fields as work_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName) before running the command. |
@@ -141,7 +142,7 @@ AgentOverride modifies a pack-stamped agent for a specific rig.
 | `env_remove` | []string |  |  | EnvRemove lists env var keys to remove. |
 | `pre_start` | []string |  |  | PreStart overrides the agent's pre_start commands. |
 | `prompt_template` | string |  |  | PromptTemplate overrides the prompt template path. Relative paths resolve against the city directory. |
-| `session` | string |  |  | Session overrides the session transport ("acp"). |
+| `session` | string |  |  | Session overrides the session transport ("acp" or "tmux"). |
 | `provider` | string |  |  | Provider overrides the provider name. |
 | `start_command` | string |  |  | StartCommand overrides the start command. |
 | `nudge` | string |  |  | Nudge overrides the nudge text. |
@@ -172,7 +173,7 @@ AgentOverride modifies a pack-stamped agent for a specific rig.
 | `inject_fragments_append` | []string |  |  | InjectFragmentsAppend appends to the agent's inject_fragments list. |
 | `max_active_sessions` | integer |  |  | MaxActiveSessions overrides the agent-level cap on concurrent sessions. |
 | `min_active_sessions` | integer |  |  | MinActiveSessions overrides the minimum number of sessions to keep alive. |
-| `scale_check` | string |  |  | ScaleCheck overrides the shell command whose output determines desired session count. |
+| `scale_check` | string |  |  | ScaleCheck overrides the shell command whose output reports new unassigned session demand for bead-backed reconciliation. |
 | `option_defaults` | map[string]string |  |  | OptionDefaults adds or overrides provider option defaults for this agent. Keys are option keys, values are choice values. Merges additively (override keys win over existing agent keys). Example: option_defaults = &#123; model = "sonnet" &#125; |
 
 ## AgentPatch
@@ -191,7 +192,7 @@ AgentPatch modifies an existing agent identified by (Dir, Name).
 | `env_remove` | []string |  |  | EnvRemove lists env var keys to remove after merging. |
 | `pre_start` | []string |  |  | PreStart overrides the agent's pre_start commands. |
 | `prompt_template` | string |  |  | PromptTemplate overrides the prompt template path. Relative paths resolve against the city directory. |
-| `session` | string |  |  | Session overrides the session transport ("acp"). |
+| `session` | string |  |  | Session overrides the session transport ("acp" or "tmux"). |
 | `provider` | string |  |  | Provider overrides the provider name. |
 | `start_command` | string |  |  | StartCommand overrides the start command. |
 | `nudge` | string |  |  | Nudge overrides the nudge text. |
@@ -222,7 +223,7 @@ AgentPatch modifies an existing agent identified by (Dir, Name).
 | `inject_fragments_append` | []string |  |  | InjectFragmentsAppend appends to the agent's inject_fragments list. |
 | `max_active_sessions` | integer |  |  | MaxActiveSessions overrides the agent-level cap on concurrent sessions. |
 | `min_active_sessions` | integer |  |  | MinActiveSessions overrides the minimum number of sessions to keep alive. |
-| `scale_check` | string |  |  | ScaleCheck overrides the command template whose output determines desired session count. Supports the same Go template placeholders as Agent.scale_check. |
+| `scale_check` | string |  |  | ScaleCheck overrides the command template whose output reports new unassigned session demand for bead-backed reconciliation. Supports the same Go template placeholders as Agent.scale_check. |
 | `option_defaults` | map[string]string |  |  | OptionDefaults adds or overrides provider option defaults for this agent. Keys are option keys, values are choice values. Merges additively (patch keys win over existing agent keys). Example: option_defaults = &#123; model = "sonnet" &#125; |
 
 ## BeadsConfig
@@ -261,6 +262,10 @@ DaemonConfig holds controller daemon settings.
 | `patrol_interval` | string |  | `30s` | PatrolInterval is the health patrol interval. Duration string (e.g., "30s", "5m", "1h"). Defaults to "30s". |
 | `max_restarts` | integer |  | `5` | MaxRestarts is the maximum number of agent restarts within RestartWindow before the agent is quarantined. 0 means unlimited (no crash loop detection). Defaults to 5. |
 | `restart_window` | string |  | `1h` | RestartWindow is the sliding time window for counting restarts. Duration string (e.g., "30s", "5m", "1h"). Defaults to "1h". |
+| `session_circuit_breaker` | boolean |  |  | SessionCircuitBreaker enables the named-session respawn circuit breaker. When enabled, the controller suppresses no-progress named-session respawns after the configured restart threshold is exceeded. |
+| `session_circuit_breaker_max_restarts` | integer |  | `5` | SessionCircuitBreakerMaxRestarts overrides MaxRestarts for the named-session respawn circuit breaker. Nil reuses MaxRestartsOrDefault. 0 disables the circuit breaker even when SessionCircuitBreaker is true. |
+| `session_circuit_breaker_window` | string |  | `1h` | SessionCircuitBreakerWindow overrides RestartWindow for the named-session respawn circuit breaker. Empty reuses RestartWindowDuration. |
+| `session_circuit_breaker_reset_after` | string |  |  | SessionCircuitBreakerResetAfter is the cooldown before an open named-session breaker resets automatically. Empty defaults to 2 * SessionCircuitBreakerWindowDuration. |
 | `shutdown_timeout` | string |  | `5s` | ShutdownTimeout is the time to wait after sending Ctrl-C before force-killing agents during shutdown. Duration string (e.g., "5s", "30s"). Set to "0s" for immediate kill. Defaults to "5s". |
 | `wisp_gc_interval` | string |  |  | WispGCInterval is how often wisp GC runs. Duration string (e.g., "5m", "1h"). Wisp GC is disabled unless both WispGCInterval and WispTTL are set. |
 | `wisp_ttl` | string |  |  | WispTTL is how long a closed molecule survives before being purged. Duration string (e.g., "24h", "7d"). Wisp GC is disabled unless both WispGCInterval and WispTTL are set. |
@@ -269,6 +274,16 @@ DaemonConfig holds controller daemon settings.
 | `probe_concurrency` | integer |  | `8` | ProbeConcurrency bounds the number of concurrent bd subprocess probes issued by the pool scale_check and work_query paths. bd serializes on a shared dolt sql-server, so unbounded parallelism causes contention. Nil (unset) defaults to 8. Set higher for workspaces with a fast dedicated dolt server, or lower to reduce contention on slow storage. |
 | `max_wakes_per_tick` | integer |  | `5` | MaxWakesPerTick caps how many sessions the reconciler may start in a single tick. Nil (unset) defaults to 5. Values &lt;= 0 are treated as the default — set a positive integer to override. |
 
+## DoctorConfig
+
+DoctorConfig holds settings for the gc doctor surface.
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `worktree_rig_warn_size` | string |  | `10GB` | WorktreeRigWarnSize is the per-rig warning threshold for the total disk footprint under .gc/worktrees/&lt;rig&gt;/. Reported by the worktree-disk-size check. Go-style human size string ("10GB", "500MB"). Empty or unparseable falls back to the default (10 GB). |
+| `worktree_rig_error_size` | string |  | `50GB` | WorktreeRigErrorSize is the per-rig error threshold. When any rig exceeds this, the worktree-disk-size check reports an error rather than a warning. Empty or unparseable falls back to the default (50 GB). |
+| `nested_worktree_prune` | boolean |  | `false` | NestedWorktreePrune escalates the nested-worktree-prune check from warning to error severity when safely-prunable nested worktrees are present, so CI / scripted doctor runs fail until the operator runs `gc doctor --fix`. Actual removal still requires --fix; this flag does not auto-prune. Safety is enforced by mechanical checks (no uncommitted changes, no unpushed commits, no stashes) — never by role identity. |
+
 ## DoltConfig
 
 DoltConfig holds optional dolt server overrides.
@@ -277,6 +292,7 @@ DoltConfig holds optional dolt server overrides.
 |-------|------|----------|---------|-------------|
 | `port` | integer |  | `0` | Port is the dolt server port. 0 means use ephemeral port allocation (hashed from city path). Set explicitly to override. |
 | `host` | string |  | `localhost` | Host is the dolt server hostname. Defaults to localhost. |
+| `archive_level` | integer |  | `0` | ArchiveLevel controls Dolt's auto_gc archive aggressiveness. 0 disables archive compaction (lower CPU on startup). 1 enables archive compaction (higher CPU on startup). nil (omitted) defaults to 0. |
 
 ## EventsConfig
 
@@ -350,6 +366,7 @@ OptionChoice is one allowed value for a "select" option.
 | `value` | string | **yes** |  |  |
 | `label` | string | **yes** |  |  |
 | `flag_args` | []string | **yes** |  | FlagArgs are the CLI arguments injected when this choice is selected. json:"-" is intentional: FlagArgs must never appear in the public API DTO (security boundary — prevents clients from seeing internal CLI flags). |
+| `flag_aliases` | []array |  |  | FlagAliases are equivalent CLI argument sequences stripped from legacy provider args. Like FlagArgs, they stay server-side only. |
 
 ## OrderOverride
 
@@ -358,7 +375,7 @@ OrderOverride modifies a scanned order's scheduling fields.
 | Field | Type | Required | Default | Description |
 |-------|------|----------|---------|-------------|
 | `name` | string | **yes** |  | Name is the order name to target (required). |
-| `rig` | string |  |  | Rig scopes the override to a specific rig's order. Empty matches city-level orders. |
+| `rig` | string |  |  | Rig scopes the override to a specific rig's order. Empty matches ONLY city-level orders (those with no rig); it does NOT match per-rig instances of the same name — those expand at scan time and require an explicit rig. Use rig = "*" as a wildcard to match every instance of the named order (city-level + every rig-scoped copy). The literal "*" is reserved and rejected as a real rig name by config validation. |
 | `enabled` | boolean |  |  | Enabled overrides whether the order is active. |
 | `trigger` | string |  |  | Trigger overrides the trigger type. |
 | `gate` | string |  |  | Gate is a deprecated alias for Trigger accepted during the gate-&gt;trigger migration. Parsed inputs are normalized to Trigger. |
@@ -471,9 +488,9 @@ ProviderSpec defines a named provider's startup parameters.
 | `instructions_file` | string |  |  | InstructionsFile is the filename the provider reads for project instructions (e.g., "CLAUDE.md", "AGENTS.md"). Empty defaults to "AGENTS.md". |
 | `resume_flag` | string |  |  | ResumeFlag is the CLI flag for resuming a session by ID. Empty means the provider does not support resume. Examples: "--resume" (claude), "resume" (codex) |
 | `resume_style` | string |  |  | ResumeStyle controls how ResumeFlag is applied:   "flag"       → command --resume &lt;key&gt;              (default)   "subcommand" → command resume &lt;key&gt; |
-| `resume_command` | string |  |  | ResumeCommand is the full shell command to run when resuming a session. Supports &#123;&#123;.SessionKey&#125;&#125; template variable. When set, takes precedence over ResumeFlag/ResumeStyle. Example:   "claude --resume &#123;&#123;.SessionKey&#125;&#125; --dangerously-skip-permissions" |
+| `resume_command` | string |  |  | ResumeCommand is the full shell command to run when resuming a session. Supports only the &#123;&#123;.SessionKey&#125;&#125; template variable. When set, takes precedence over ResumeFlag/ResumeStyle. When schema-managed defaults are inserted, the resolver tokenizes and re-emits the command; for subcommand-style resume it inserts after the ResumeFlag token that precedes &#123;&#123;.SessionKey&#125;&#125;. Example:   "claude --resume &#123;&#123;.SessionKey&#125;&#125; --dangerously-skip-permissions" Schema-managed defaults missing from a subcommand-style resume command are inserted before &#123;&#123;.SessionKey&#125;&#125; during provider resolution. |
 | `session_id_flag` | string |  |  | SessionIDFlag is the CLI flag for creating a session with a specific ID. Enables the Generate & Pass strategy for session key management. Example: "--session-id" (claude) |
-| `permission_modes` | map[string]string |  |  | PermissionModes maps permission mode names to CLI flags. Example: &#123;"unrestricted": "--dangerously-skip-permissions", "plan": "--permission-mode plan"&#125; This is a config-only lookup table consumed by external clients (e.g., Mission Control) to populate permission mode dropdowns. Launch-time flag substitution is planned for a follow-up PR — currently no runtime code reads this field. |
+| `permission_modes` | map[string]string |  |  | PermissionModes maps permission mode names to CLI flags. Example: &#123;"unrestricted": "--dangerously-skip-permissions", "plan": "--permission-mode plan"&#125; This is a config-only lookup table consumed by external clients (e.g., real-world app) to populate permission mode dropdowns. Launch-time flag substitution is planned for a follow-up PR — currently no runtime code reads this field. |
 | `option_defaults` | map[string]string |  |  | OptionDefaults overrides the Default value in OptionsSchema entries without redefining the schema itself. Keys are option keys (e.g., "permission_mode"), values are choice values (e.g., "unrestricted"). city.toml users set this to customize provider behavior without touching Args or OptionsSchema. |
 | `options_schema` | []ProviderOption |  |  | OptionsSchema declares the configurable options this provider supports. Each option maps to CLI args via its Choices[].FlagArgs field. Serialized via a dedicated DTO (not directly to JSON) so FlagArgs stays server-side. |
 | `print_args` | []string |  |  | PrintArgs are CLI arguments that enable one-shot non-interactive mode. The provider prints its response to stdout and exits. When empty, the provider does not support one-shot invocation. Examples: ["-p"] (claude, gemini), ["exec"] (codex) |
diff --git a/docs/reference/events.md b/docs/reference/events.md
index c26c9e8b8c..aac634516c 100644
--- a/docs/reference/events.md
+++ b/docs/reference/events.md
@@ -21,6 +21,8 @@ The underlying DTOs come from the published OpenAPI document:
 
 - `WireEvent`
 - `WireTaggedEvent`
+- `TypedEventStreamEnvelope`
+- `TypedTaggedEventStreamEnvelope`
 - `EventStreamEnvelope`
 - `TaggedEventStreamEnvelope`
 - `HeartbeatEvent`
@@ -50,8 +52,8 @@ There is one exception:
 
 #### City Scope
 
-When a city is in scope, each output line is one `WireEvent` object from
-`GET /v0/city/{cityName}/events`.
+When a city is in scope, each output line is one `TypedEventStreamEnvelope`
+object from `GET /v0/city/{cityName}/events`.
 
 Example:
 
@@ -62,7 +64,7 @@ Example:
 #### Supervisor Scope
 
 When no city is in scope and the supervisor API is being used, each output line
-is one `WireTaggedEvent` object from `GET /v0/events`.
+is one `TypedTaggedEventStreamEnvelope` object from `GET /v0/events`.
 
 Example:
 
@@ -84,6 +86,9 @@ stdout, but the line schema is different from list mode.
   stdout.
 - If `--watch` times out without a match, stdout is empty and the command exits
   successfully.
+- API streams without `after_seq`, `after_cursor`, or `Last-Event-ID` start
+  at the current event head. Pass the `event_cursor` returned by async POST
+  responses when waiting for request-result events after the POST returns.
 
 #### City Scope
 
@@ -151,8 +156,8 @@ The downloadable <a href="/schema/events.txt" download="events.json">events.json
 schema validates one JSON object line from list, watch, or follow mode. It
 contains only framing metadata and `$ref`s into `openapi.json`:
 
-- City list lines use `WireEvent`.
-- Supervisor list lines use `WireTaggedEvent`.
+- City list lines use `TypedEventStreamEnvelope`.
+- Supervisor list lines use `TypedTaggedEventStreamEnvelope`.
 - City stream lines use `EventStreamEnvelope`.
 - Supervisor stream lines use `TaggedEventStreamEnvelope`.
 
@@ -186,8 +191,9 @@ non-zero exit status. Examples include:
 
 The CLI does not define independent event DTOs. Its stability contract is:
 
-- the published supervisor OpenAPI schemas for `WireEvent`,
-  `WireTaggedEvent`, `EventStreamEnvelope`, and `TaggedEventStreamEnvelope`
+- the published supervisor OpenAPI schemas for `TypedEventStreamEnvelope`,
+  `TypedTaggedEventStreamEnvelope`, `EventStreamEnvelope`, and
+  `TaggedEventStreamEnvelope`
 - the explicit CLI framing rules on this page:
   JSONL for list and stream modes, plain text for `--seq`, empty stdout for
   no-match list queries, and heartbeat suppression in stream mode
diff --git a/docs/reference/trust-boundaries.md b/docs/reference/trust-boundaries.md
new file mode 100644
index 0000000000..e9da0e6783
--- /dev/null
+++ b/docs/reference/trust-boundaries.md
@@ -0,0 +1,62 @@
+---
+title: "Command Execution Trust Boundaries"
+---
+
+Gas City intentionally runs operator-configured commands. Those commands are a
+feature, not a sandbox. Treat city config, imported packs, exec provider
+scripts, and agent startup commands as trusted code with the same review
+expectations as shell scripts committed to the repository.
+
+## Trust Model
+
+| Input | Trust level | Rule |
+|-------|-------------|------|
+| Maintainer-authored city config and local site config | Trusted operator code | May define shell commands and explicit env. Review before use. |
+| Imported packs and rig configs | Trusted dependency code | Pin/review packs before importing into a privileged city. |
+| Bead titles, descriptions, mail, formula vars, PR text, and API request fields | Untrusted data | Do not concatenate into shell commands. Pass as env, JSON, stdin, or argv. |
+| GitHub Actions `pull_request_target` payloads | Untrusted data in a privileged workflow | Do not checkout or execute contributor code. Use metadata-only operations. |
+| Ambient process environment | Untrusted for secret propagation | Controller-side shell helpers strip inherited secret-looking env keys by default. |
+
+## Execution Surfaces
+
+| Surface | Command source | Actor | Working directory | Env behavior | Log behavior |
+|---------|----------------|-------|-------------------|--------------|--------------|
+| `work_query` via `gc hook` and controller probes | Agent config | Trusted operator or pack | Agent's canonical city or rig repo | Inherited secrets are stripped; Gas City projects explicit store/session env. | Errors are diagnostic only. Avoid placing secrets in command literals. |
+| `scale_check` | Agent config | Trusted operator or pack | Agent's canonical city or rig repo | Inherited secrets are stripped; Gas City projects explicit store env. | Parse failures include command context; command literals must not contain secrets. |
+| `on_boot` and `on_death` | Agent pool config | Trusted operator or pack | City or rig repo | Inherited secrets are stripped; explicit store env may be provided when needed. | Hook failures are logged; output should not include secrets. |
+| Order `check` triggers | Order config | Trusted operator or pack | Order target scope | Inherited secrets are stripped; explicit condition env may be provided. | Failure reason records exit status, not command output. |
+| Order `exec` | Order config | Trusted operator or pack | Order target scope | Inherited secrets are stripped; explicit order env may be provided. | Failure errors and output are redacted before logs/events. |
+| `gc sling` and `/sling` command runner | Sling target config | Trusted operator or pack | City or rig repo | Inherited secrets are stripped; explicit routing/store env may be provided. | Returned command output is caller-visible. Do not route untrusted text into shell. |
+| Agent `command` | Agent config | Trusted operator or pack | Session work directory | Session env is explicit runtime env plus configured env. Secrets may be passed only by intentional config. | Agent stdout/stderr is session output and may be visible to operators. |
+| `pre_start` | Agent config | Trusted operator or pack | Session work directory | Provider-specific runtime env; intended for setup before session start. | Provider warnings should avoid secrets. |
+| `session_setup`, `session_setup_script`, `session_live` | Agent config | Trusted operator or pack | Running session environment | Provider-specific runtime env; remote providers run inside the target container or pod. | Provider warnings should avoid secrets. |
+| `exec:` session provider | User-supplied provider script | Trusted operator code | Provider-defined | Direct exec, not `sh -c`; start config is JSON on stdin. | Provider stderr may be surfaced in errors. Do not print secrets. |
+| `exec:` beads, mail, and events providers | User-supplied provider script | Trusted operator code | Provider-defined | Direct exec, not `sh -c`; request data is stdin/argv. | Provider stderr may be surfaced in errors. Do not print secrets. |
+| Pack fetch/include, Git probes, Docker, Dolt, tmux, kubectl, `bd` helpers | Gas City code plus configured paths/URLs | Maintainer-reviewed code paths | Command-specific | Direct exec with argv except provider setup scripts where documented. | Errors are surfaced for diagnosis; avoid embedding credentials in URLs. |
+
+## Secret Propagation
+
+Controller-side shell helpers remove inherited environment variables whose keys
+look secret-bearing, including names containing `TOKEN`, `PASSWORD`, `SECRET`,
+`PRIVATE_KEY`, `API_KEY`, `ACCESS_KEY`, `CREDENTIAL`, `OAUTH`, or `AUTH_JSON`.
+This prevents ambient CI or maintainer shell secrets from reaching `work_query`,
+`scale_check`, hooks, order checks, order exec commands, and sling helpers by
+accident.
+
+If a command truly needs a secret, pass it explicitly through the relevant city,
+rig, provider, or workflow configuration. Explicit values are preserved because
+they represent an operator decision, and failure logs redact known secret values
+before writing order exec errors or events.
+
+## Rules For Authors
+
+- Do not put secrets directly in command strings. Use env variables or provider
+  credential files.
+- Do not interpolate bead content, PR text, mail, formula vars, branch names, or
+  other user-controlled values into `sh -c` commands.
+- When showing a command for a human to copy, build it from argv and quote each
+  argument with Gas City's shell quoting helper.
+- Keep `pull_request_target` workflows metadata-only. They may label or comment
+  but must not checkout or run contributor code with privileged tokens.
+- Prefer direct `exec.Command(..., args...)` style boundaries for new provider
+  contracts. Use `sh -c` only for explicitly operator-authored shell snippets.
diff --git a/docs/schema/city-schema.json b/docs/schema/city-schema.json
index cdb08ca4a9..e46c488b15 100644
--- a/docs/schema/city-schema.json
+++ b/docs/schema/city-schema.json
@@ -52,7 +52,7 @@
         },
         "description": {
           "type": "string",
-          "description": "Description is a human-readable description shown in MC's session creation UI."
+          "description": "Description is a human-readable description shown in a real-world app's session creation UI."
         },
         "dir": {
           "type": "string",
@@ -92,9 +92,10 @@
         "session": {
           "type": "string",
           "enum": [
-            "acp"
+            "acp",
+            "tmux"
           ],
-          "description": "Session overrides the session transport for this agent.\n\"\" (default) uses the city-level session provider (typically tmux).\n\"acp\" uses the Agent Client Protocol (JSON-RPC over stdio).\nThe agent's resolved provider must have supports_acp = true."
+          "description": "Session overrides the session transport for this agent.\n\"\" (default) uses the provider default.\n\"tmux\" uses the tmux-backed CLI path even when the provider supports ACP.\n\"acp\" uses the Agent Client Protocol (JSON-RPC over stdio); the agent's\nresolved provider must have supports_acp = true."
         },
         "provider": {
           "type": "string",
@@ -169,7 +170,7 @@
         },
         "scale_check": {
           "type": "string",
-          "description": "ScaleCheck is a shell command template whose output determines desired\nsession count. Optional override — when set, its output is the desired\ncount (still clamped by all cap levels). If it contains Go template\nplaceholders, gc expands them using the same PathContext fields as\nwork_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot,\nCityName) before running the command."
+          "description": "ScaleCheck is a shell command template whose output reports new\nunassigned session demand. In bead-backed reconciliation this is\nadditive: assigned work is resumed separately, and ScaleCheck reports\nonly how many new generic sessions to start, still bounded by all cap\nlevels. Legacy no-store evaluation continues to treat the output as\nthe desired session count. If it contains Go template placeholders, gc\nexpands them using the same PathContext fields as work_dir and\nsession_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName)\nbefore running the command."
         },
         "drain_timeout": {
           "type": "string",
@@ -419,7 +420,7 @@
         },
         "session": {
           "type": "string",
-          "description": "Session overrides the session transport (\"acp\")."
+          "description": "Session overrides the session transport (\"acp\" or \"tmux\")."
         },
         "provider": {
           "type": "string",
@@ -592,7 +593,7 @@
         },
         "scale_check": {
           "type": "string",
-          "description": "ScaleCheck overrides the shell command whose output determines desired session count."
+          "description": "ScaleCheck overrides the shell command whose output reports new\nunassigned session demand for bead-backed reconciliation."
         },
         "option_defaults": {
           "additionalProperties": {
@@ -662,7 +663,7 @@
         },
         "session": {
           "type": "string",
-          "description": "Session overrides the session transport (\"acp\")."
+          "description": "Session overrides the session transport (\"acp\" or \"tmux\")."
         },
         "provider": {
           "type": "string",
@@ -835,7 +836,7 @@
         },
         "scale_check": {
           "type": "string",
-          "description": "ScaleCheck overrides the command template whose output determines desired\nsession count. Supports the same Go template placeholders as\nAgent.scale_check."
+          "description": "ScaleCheck overrides the command template whose output reports new\nunassigned session demand for bead-backed reconciliation. Supports the\nsame Go template placeholders as Agent.scale_check."
         },
         "option_defaults": {
           "additionalProperties": {
@@ -983,6 +984,10 @@
           "$ref": "#/$defs/ConvergenceConfig",
           "description": "Convergence configures convergence loop limits."
         },
+        "doctor": {
+          "$ref": "#/$defs/DoctorConfig",
+          "description": "Doctor configures gc doctor thresholds and policy toggles\n(worktree size warnings, nested-worktree auto-prune)."
+        },
         "service": {
           "items": {
             "$ref": "#/$defs/Service"
@@ -1045,6 +1050,24 @@
           "description": "RestartWindow is the sliding time window for counting restarts.\nDuration string (e.g., \"30s\", \"5m\", \"1h\"). Defaults to \"1h\".",
           "default": "1h"
         },
+        "session_circuit_breaker": {
+          "type": "boolean",
+          "description": "SessionCircuitBreaker enables the named-session respawn circuit breaker.\nWhen enabled, the controller suppresses no-progress named-session respawns\nafter the configured restart threshold is exceeded."
+        },
+        "session_circuit_breaker_max_restarts": {
+          "type": "integer",
+          "description": "SessionCircuitBreakerMaxRestarts overrides MaxRestarts for the\nnamed-session respawn circuit breaker. Nil reuses MaxRestartsOrDefault.\n0 disables the circuit breaker even when SessionCircuitBreaker is true.",
+          "default": 5
+        },
+        "session_circuit_breaker_window": {
+          "type": "string",
+          "description": "SessionCircuitBreakerWindow overrides RestartWindow for the named-session\nrespawn circuit breaker. Empty reuses RestartWindowDuration.",
+          "default": "1h"
+        },
+        "session_circuit_breaker_reset_after": {
+          "type": "string",
+          "description": "SessionCircuitBreakerResetAfter is the cooldown before an open named-session\nbreaker resets automatically. Empty defaults to 2 * SessionCircuitBreakerWindowDuration."
+        },
         "shutdown_timeout": {
           "type": "string",
           "description": "ShutdownTimeout is the time to wait after sending Ctrl-C before force-killing\nagents during shutdown. Duration string (e.g., \"5s\", \"30s\"). Set to \"0s\"\nfor immediate kill. Defaults to \"5s\".",
@@ -1085,6 +1108,28 @@
       "type": "object",
       "description": "DaemonConfig holds controller daemon settings."
     },
+    "DoctorConfig": {
+      "properties": {
+        "worktree_rig_warn_size": {
+          "type": "string",
+          "description": "WorktreeRigWarnSize is the per-rig warning threshold for the total\ndisk footprint under .gc/worktrees/\u003crig\u003e/. Reported by the\nworktree-disk-size check. Go-style human size string (\"10GB\", \"500MB\").\nEmpty or unparseable falls back to the default (10 GB).",
+          "default": "10GB"
+        },
+        "worktree_rig_error_size": {
+          "type": "string",
+          "description": "WorktreeRigErrorSize is the per-rig error threshold. When any rig\nexceeds this, the worktree-disk-size check reports an error rather\nthan a warning. Empty or unparseable falls back to the default\n(50 GB).",
+          "default": "50GB"
+        },
+        "nested_worktree_prune": {
+          "type": "boolean",
+          "description": "NestedWorktreePrune escalates the nested-worktree-prune check\nfrom warning to error severity when safely-prunable nested\nworktrees are present, so CI / scripted doctor runs fail until\nthe operator runs `gc doctor --fix`. Actual removal still\nrequires --fix; this flag does not auto-prune. Safety is\nenforced by mechanical checks (no uncommitted changes, no\nunpushed commits, no stashes) — never by role identity.",
+          "default": false
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "DoctorConfig holds settings for the gc doctor surface."
+    },
     "DoltConfig": {
       "properties": {
         "port": {
@@ -1096,6 +1141,11 @@
           "type": "string",
           "description": "Host is the dolt server hostname. Defaults to localhost.",
           "default": "localhost"
+        },
+        "archive_level": {
+          "type": "integer",
+          "description": "ArchiveLevel controls Dolt's auto_gc archive aggressiveness.\n0 disables archive compaction (lower CPU on startup).\n1 enables archive compaction (higher CPU on startup).\nnil (omitted) defaults to 0.",
+          "default": 0
         }
       },
       "additionalProperties": false,
@@ -1266,6 +1316,16 @@
           },
           "type": "array",
           "description": "FlagArgs are the CLI arguments injected when this choice is selected.\njson:\"-\" is intentional: FlagArgs must never appear in the public API DTO\n(security boundary — prevents clients from seeing internal CLI flags)."
+        },
+        "flag_aliases": {
+          "items": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array",
+          "description": "FlagAliases are equivalent CLI argument sequences stripped from legacy\nprovider args. Like FlagArgs, they stay server-side only."
         }
       },
       "additionalProperties": false,
@@ -1285,7 +1345,7 @@
         },
         "rig": {
           "type": "string",
-          "description": "Rig scopes the override to a specific rig's order.\nEmpty matches city-level orders."
+          "description": "Rig scopes the override to a specific rig's order. Empty matches\nONLY city-level orders (those with no rig); it does NOT match\nper-rig instances of the same name — those expand at scan time\nand require an explicit rig. Use rig = \"*\" as a wildcard to match\nevery instance of the named order (city-level + every rig-scoped\ncopy). The literal \"*\" is reserved and rejected as a real rig\nname by config validation."
         },
         "enabled": {
           "type": "boolean",
@@ -1667,7 +1727,7 @@
         },
         "resume_command": {
           "type": "string",
-          "description": "ResumeCommand is the full shell command to run when resuming a session.\nSupports {{.SessionKey}} template variable. When set, takes precedence\nover ResumeFlag/ResumeStyle. Example:\n  \"claude --resume {{.SessionKey}} --dangerously-skip-permissions\""
+          "description": "ResumeCommand is the full shell command to run when resuming a session.\nSupports only the {{.SessionKey}} template variable. When set, takes precedence\nover ResumeFlag/ResumeStyle. When schema-managed defaults are inserted, the\nresolver tokenizes and re-emits the command; for subcommand-style resume it\ninserts after the ResumeFlag token that precedes {{.SessionKey}}. Example:\n  \"claude --resume {{.SessionKey}} --dangerously-skip-permissions\"\nSchema-managed defaults missing from a subcommand-style resume command\nare inserted before {{.SessionKey}} during provider resolution."
         },
         "session_id_flag": {
           "type": "string",
@@ -1678,7 +1738,7 @@
             "type": "string"
           },
           "type": "object",
-          "description": "PermissionModes maps permission mode names to CLI flags.\nExample: {\"unrestricted\": \"--dangerously-skip-permissions\", \"plan\": \"--permission-mode plan\"}\nThis is a config-only lookup table consumed by external clients\n(e.g., Mission Control) to populate permission mode dropdowns.\nLaunch-time flag substitution is planned for a follow-up PR —\ncurrently no runtime code reads this field."
+          "description": "PermissionModes maps permission mode names to CLI flags.\nExample: {\"unrestricted\": \"--dangerously-skip-permissions\", \"plan\": \"--permission-mode plan\"}\nThis is a config-only lookup table consumed by external clients\n(e.g., real-world app) to populate permission mode dropdowns.\nLaunch-time flag substitution is planned for a follow-up PR —\ncurrently no runtime code reads this field."
         },
         "option_defaults": {
           "additionalProperties": {
diff --git a/docs/schema/city-schema.txt b/docs/schema/city-schema.txt
index cdb08ca4a9..e46c488b15 100644
--- a/docs/schema/city-schema.txt
+++ b/docs/schema/city-schema.txt
@@ -52,7 +52,7 @@
         },
         "description": {
           "type": "string",
-          "description": "Description is a human-readable description shown in MC's session creation UI."
+          "description": "Description is a human-readable description shown in a real-world app's session creation UI."
         },
         "dir": {
           "type": "string",
@@ -92,9 +92,10 @@
         "session": {
           "type": "string",
           "enum": [
-            "acp"
+            "acp",
+            "tmux"
           ],
-          "description": "Session overrides the session transport for this agent.\n\"\" (default) uses the city-level session provider (typically tmux).\n\"acp\" uses the Agent Client Protocol (JSON-RPC over stdio).\nThe agent's resolved provider must have supports_acp = true."
+          "description": "Session overrides the session transport for this agent.\n\"\" (default) uses the provider default.\n\"tmux\" uses the tmux-backed CLI path even when the provider supports ACP.\n\"acp\" uses the Agent Client Protocol (JSON-RPC over stdio); the agent's\nresolved provider must have supports_acp = true."
         },
         "provider": {
           "type": "string",
@@ -169,7 +170,7 @@
         },
         "scale_check": {
           "type": "string",
-          "description": "ScaleCheck is a shell command template whose output determines desired\nsession count. Optional override — when set, its output is the desired\ncount (still clamped by all cap levels). If it contains Go template\nplaceholders, gc expands them using the same PathContext fields as\nwork_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot,\nCityName) before running the command."
+          "description": "ScaleCheck is a shell command template whose output reports new\nunassigned session demand. In bead-backed reconciliation this is\nadditive: assigned work is resumed separately, and ScaleCheck reports\nonly how many new generic sessions to start, still bounded by all cap\nlevels. Legacy no-store evaluation continues to treat the output as\nthe desired session count. If it contains Go template placeholders, gc\nexpands them using the same PathContext fields as work_dir and\nsession_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName)\nbefore running the command."
         },
         "drain_timeout": {
           "type": "string",
@@ -419,7 +420,7 @@
         },
         "session": {
           "type": "string",
-          "description": "Session overrides the session transport (\"acp\")."
+          "description": "Session overrides the session transport (\"acp\" or \"tmux\")."
         },
         "provider": {
           "type": "string",
@@ -592,7 +593,7 @@
         },
         "scale_check": {
           "type": "string",
-          "description": "ScaleCheck overrides the shell command whose output determines desired session count."
+          "description": "ScaleCheck overrides the shell command whose output reports new\nunassigned session demand for bead-backed reconciliation."
         },
         "option_defaults": {
           "additionalProperties": {
@@ -662,7 +663,7 @@
         },
         "session": {
           "type": "string",
-          "description": "Session overrides the session transport (\"acp\")."
+          "description": "Session overrides the session transport (\"acp\" or \"tmux\")."
         },
         "provider": {
           "type": "string",
@@ -835,7 +836,7 @@
         },
         "scale_check": {
           "type": "string",
-          "description": "ScaleCheck overrides the command template whose output determines desired\nsession count. Supports the same Go template placeholders as\nAgent.scale_check."
+          "description": "ScaleCheck overrides the command template whose output reports new\nunassigned session demand for bead-backed reconciliation. Supports the\nsame Go template placeholders as Agent.scale_check."
         },
         "option_defaults": {
           "additionalProperties": {
@@ -983,6 +984,10 @@
           "$ref": "#/$defs/ConvergenceConfig",
           "description": "Convergence configures convergence loop limits."
         },
+        "doctor": {
+          "$ref": "#/$defs/DoctorConfig",
+          "description": "Doctor configures gc doctor thresholds and policy toggles\n(worktree size warnings, nested-worktree auto-prune)."
+        },
         "service": {
           "items": {
             "$ref": "#/$defs/Service"
@@ -1045,6 +1050,24 @@
           "description": "RestartWindow is the sliding time window for counting restarts.\nDuration string (e.g., \"30s\", \"5m\", \"1h\"). Defaults to \"1h\".",
           "default": "1h"
         },
+        "session_circuit_breaker": {
+          "type": "boolean",
+          "description": "SessionCircuitBreaker enables the named-session respawn circuit breaker.\nWhen enabled, the controller suppresses no-progress named-session respawns\nafter the configured restart threshold is exceeded."
+        },
+        "session_circuit_breaker_max_restarts": {
+          "type": "integer",
+          "description": "SessionCircuitBreakerMaxRestarts overrides MaxRestarts for the\nnamed-session respawn circuit breaker. Nil reuses MaxRestartsOrDefault.\n0 disables the circuit breaker even when SessionCircuitBreaker is true.",
+          "default": 5
+        },
+        "session_circuit_breaker_window": {
+          "type": "string",
+          "description": "SessionCircuitBreakerWindow overrides RestartWindow for the named-session\nrespawn circuit breaker. Empty reuses RestartWindowDuration.",
+          "default": "1h"
+        },
+        "session_circuit_breaker_reset_after": {
+          "type": "string",
+          "description": "SessionCircuitBreakerResetAfter is the cooldown before an open named-session\nbreaker resets automatically. Empty defaults to 2 * SessionCircuitBreakerWindowDuration."
+        },
         "shutdown_timeout": {
           "type": "string",
           "description": "ShutdownTimeout is the time to wait after sending Ctrl-C before force-killing\nagents during shutdown. Duration string (e.g., \"5s\", \"30s\"). Set to \"0s\"\nfor immediate kill. Defaults to \"5s\".",
@@ -1085,6 +1108,28 @@
       "type": "object",
       "description": "DaemonConfig holds controller daemon settings."
     },
+    "DoctorConfig": {
+      "properties": {
+        "worktree_rig_warn_size": {
+          "type": "string",
+          "description": "WorktreeRigWarnSize is the per-rig warning threshold for the total\ndisk footprint under .gc/worktrees/\u003crig\u003e/. Reported by the\nworktree-disk-size check. Go-style human size string (\"10GB\", \"500MB\").\nEmpty or unparseable falls back to the default (10 GB).",
+          "default": "10GB"
+        },
+        "worktree_rig_error_size": {
+          "type": "string",
+          "description": "WorktreeRigErrorSize is the per-rig error threshold. When any rig\nexceeds this, the worktree-disk-size check reports an error rather\nthan a warning. Empty or unparseable falls back to the default\n(50 GB).",
+          "default": "50GB"
+        },
+        "nested_worktree_prune": {
+          "type": "boolean",
+          "description": "NestedWorktreePrune escalates the nested-worktree-prune check\nfrom warning to error severity when safely-prunable nested\nworktrees are present, so CI / scripted doctor runs fail until\nthe operator runs `gc doctor --fix`. Actual removal still\nrequires --fix; this flag does not auto-prune. Safety is\nenforced by mechanical checks (no uncommitted changes, no\nunpushed commits, no stashes) — never by role identity.",
+          "default": false
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "description": "DoctorConfig holds settings for the gc doctor surface."
+    },
     "DoltConfig": {
       "properties": {
         "port": {
@@ -1096,6 +1141,11 @@
           "type": "string",
           "description": "Host is the dolt server hostname. Defaults to localhost.",
           "default": "localhost"
+        },
+        "archive_level": {
+          "type": "integer",
+          "description": "ArchiveLevel controls Dolt's auto_gc archive aggressiveness.\n0 disables archive compaction (lower CPU on startup).\n1 enables archive compaction (higher CPU on startup).\nnil (omitted) defaults to 0.",
+          "default": 0
         }
       },
       "additionalProperties": false,
@@ -1266,6 +1316,16 @@
           },
           "type": "array",
           "description": "FlagArgs are the CLI arguments injected when this choice is selected.\njson:\"-\" is intentional: FlagArgs must never appear in the public API DTO\n(security boundary — prevents clients from seeing internal CLI flags)."
+        },
+        "flag_aliases": {
+          "items": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array",
+          "description": "FlagAliases are equivalent CLI argument sequences stripped from legacy\nprovider args. Like FlagArgs, they stay server-side only."
         }
       },
       "additionalProperties": false,
@@ -1285,7 +1345,7 @@
         },
         "rig": {
           "type": "string",
-          "description": "Rig scopes the override to a specific rig's order.\nEmpty matches city-level orders."
+          "description": "Rig scopes the override to a specific rig's order. Empty matches\nONLY city-level orders (those with no rig); it does NOT match\nper-rig instances of the same name — those expand at scan time\nand require an explicit rig. Use rig = \"*\" as a wildcard to match\nevery instance of the named order (city-level + every rig-scoped\ncopy). The literal \"*\" is reserved and rejected as a real rig\nname by config validation."
         },
         "enabled": {
           "type": "boolean",
@@ -1667,7 +1727,7 @@
         },
         "resume_command": {
           "type": "string",
-          "description": "ResumeCommand is the full shell command to run when resuming a session.\nSupports {{.SessionKey}} template variable. When set, takes precedence\nover ResumeFlag/ResumeStyle. Example:\n  \"claude --resume {{.SessionKey}} --dangerously-skip-permissions\""
+          "description": "ResumeCommand is the full shell command to run when resuming a session.\nSupports only the {{.SessionKey}} template variable. When set, takes precedence\nover ResumeFlag/ResumeStyle. When schema-managed defaults are inserted, the\nresolver tokenizes and re-emits the command; for subcommand-style resume it\ninserts after the ResumeFlag token that precedes {{.SessionKey}}. Example:\n  \"claude --resume {{.SessionKey}} --dangerously-skip-permissions\"\nSchema-managed defaults missing from a subcommand-style resume command\nare inserted before {{.SessionKey}} during provider resolution."
         },
         "session_id_flag": {
           "type": "string",
@@ -1678,7 +1738,7 @@
             "type": "string"
           },
           "type": "object",
-          "description": "PermissionModes maps permission mode names to CLI flags.\nExample: {\"unrestricted\": \"--dangerously-skip-permissions\", \"plan\": \"--permission-mode plan\"}\nThis is a config-only lookup table consumed by external clients\n(e.g., Mission Control) to populate permission mode dropdowns.\nLaunch-time flag substitution is planned for a follow-up PR —\ncurrently no runtime code reads this field."
+          "description": "PermissionModes maps permission mode names to CLI flags.\nExample: {\"unrestricted\": \"--dangerously-skip-permissions\", \"plan\": \"--permission-mode plan\"}\nThis is a config-only lookup table consumed by external clients\n(e.g., real-world app) to populate permission mode dropdowns.\nLaunch-time flag substitution is planned for a follow-up PR —\ncurrently no runtime code reads this field."
         },
         "option_defaults": {
           "additionalProperties": {
diff --git a/docs/schema/events.json b/docs/schema/events.json
index a665c81444..1d34548b31 100644
--- a/docs/schema/events.json
+++ b/docs/schema/events.json
@@ -1,7 +1,7 @@
 {
   "$defs": {
     "cityListLine": {
-      "$ref": "openapi.json#/components/schemas/WireEvent",
+      "$ref": "openapi.json#/components/schemas/TypedEventStreamEnvelope",
       "description": "A JSONL line from `gc events` when a city is in scope."
     },
     "cityStreamLine": {
@@ -9,7 +9,7 @@
       "description": "A JSONL line from `gc events --watch` or `gc events --follow` when a city is in scope."
     },
     "supervisorListLine": {
-      "$ref": "openapi.json#/components/schemas/WireTaggedEvent",
+      "$ref": "openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope",
       "description": "A JSONL line from `gc events` when no city is in scope."
     },
     "supervisorStreamLine": {
@@ -21,10 +21,10 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "anyOf": [
     {
-      "$ref": "openapi.json#/components/schemas/WireEvent"
+      "$ref": "openapi.json#/components/schemas/TypedEventStreamEnvelope"
     },
     {
-      "$ref": "openapi.json#/components/schemas/WireTaggedEvent"
+      "$ref": "openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope"
     },
     {
       "$ref": "openapi.json#/components/schemas/EventStreamEnvelope"
@@ -39,8 +39,8 @@
     "cursorMode": "`gc events --seq` is not JSONL; it writes the current city index or supervisor composite cursor as text.",
     "heartbeatSuppression": "HeartbeatEvent SSE frames are consumed internally and are not written to stdout.",
     "listMode": [
-      "WireEvent",
-      "WireTaggedEvent"
+      "TypedEventStreamEnvelope",
+      "TypedTaggedEventStreamEnvelope"
     ],
     "sourceOfTruth": "openapi.json",
     "streamMode": [
diff --git a/docs/schema/events.txt b/docs/schema/events.txt
index a665c81444..1d34548b31 100644
--- a/docs/schema/events.txt
+++ b/docs/schema/events.txt
@@ -1,7 +1,7 @@
 {
   "$defs": {
     "cityListLine": {
-      "$ref": "openapi.json#/components/schemas/WireEvent",
+      "$ref": "openapi.json#/components/schemas/TypedEventStreamEnvelope",
       "description": "A JSONL line from `gc events` when a city is in scope."
     },
     "cityStreamLine": {
@@ -9,7 +9,7 @@
       "description": "A JSONL line from `gc events --watch` or `gc events --follow` when a city is in scope."
     },
     "supervisorListLine": {
-      "$ref": "openapi.json#/components/schemas/WireTaggedEvent",
+      "$ref": "openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope",
       "description": "A JSONL line from `gc events` when no city is in scope."
     },
     "supervisorStreamLine": {
@@ -21,10 +21,10 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "anyOf": [
     {
-      "$ref": "openapi.json#/components/schemas/WireEvent"
+      "$ref": "openapi.json#/components/schemas/TypedEventStreamEnvelope"
     },
     {
-      "$ref": "openapi.json#/components/schemas/WireTaggedEvent"
+      "$ref": "openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope"
     },
     {
       "$ref": "openapi.json#/components/schemas/EventStreamEnvelope"
@@ -39,8 +39,8 @@
     "cursorMode": "`gc events --seq` is not JSONL; it writes the current city index or supervisor composite cursor as text.",
     "heartbeatSuppression": "HeartbeatEvent SSE frames are consumed internally and are not written to stdout.",
     "listMode": [
-      "WireEvent",
-      "WireTaggedEvent"
+      "TypedEventStreamEnvelope",
+      "TypedTaggedEventStreamEnvelope"
     ],
     "sourceOfTruth": "openapi.json",
     "streamMode": [
diff --git a/docs/schema/openapi.json b/docs/schema/openapi.json
index dcac755149..422f30da13 100644
--- a/docs/schema/openapi.json
+++ b/docs/schema/openapi.json
@@ -724,6 +724,50 @@
         ],
         "type": "object"
       },
+      "AsyncAcceptedBody": {
+        "additionalProperties": false,
+        "properties": {
+          "event_cursor": {
+            "description": "City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id.",
+            "type": "string"
+          },
+          "status": {
+            "description": "Async request status.",
+            "examples": [
+              "accepted"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "status",
+          "request_id",
+          "event_cursor"
+        ],
+        "type": "object"
+      },
+      "AsyncAcceptedResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "event_cursor": {
+            "description": "Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "request_id",
+          "event_cursor"
+        ],
+        "type": "object"
+      },
       "Bead": {
         "additionalProperties": false,
         "properties": {
@@ -1045,35 +1089,38 @@
             "type": "string"
           },
           "provider": {
-            "description": "Provider name for the city's default session template.",
+            "description": "Provider name for the city's default session template. Mutually exclusive with start_command.",
             "minLength": 1,
             "type": "string"
+          },
+          "start_command": {
+            "description": "Custom workspace start command for the city's default session template. Mutually exclusive with provider.",
+            "type": "string"
           }
         },
         "required": [
-          "dir",
-          "provider"
+          "dir"
         ],
         "type": "object"
       },
-      "CityCreateResponse": {
+      "CityCreateSucceededPayload": {
         "additionalProperties": false,
         "properties": {
           "name": {
-            "description": "Resolved city name as persisted in city.toml. Use this to filter the event stream for completion.",
+            "description": "Resolved city name.",
             "type": "string"
           },
-          "ok": {
-            "description": "True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready.",
-            "type": "boolean"
-          },
           "path": {
-            "description": "Resolved absolute path of the created city directory.",
+            "description": "Resolved absolute city directory path.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           }
         },
         "required": [
-          "ok",
+          "request_id",
           "name",
           "path"
         ],
@@ -1161,23 +1208,11 @@
       "CityLifecyclePayload": {
         "additionalProperties": false,
         "properties": {
-          "error": {
-            "type": "string"
-          },
           "name": {
             "type": "string"
           },
           "path": {
             "type": "string"
-          },
-          "phases_completed": {
-            "items": {
-              "type": "string"
-            },
-            "type": [
-              "array",
-              "null"
-            ]
           }
         },
         "required": [
@@ -1196,24 +1231,24 @@
         },
         "type": "object"
       },
-      "CityUnregisterResponse": {
+      "CityUnregisterSucceededPayload": {
         "additionalProperties": false,
         "properties": {
           "name": {
-            "description": "Resolved registry name. Filter the event stream by this to observe completion.",
+            "description": "City name that was unregistered.",
             "type": "string"
           },
-          "ok": {
-            "description": "True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered.",
-            "type": "boolean"
-          },
           "path": {
-            "description": "Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry.",
+            "description": "Absolute city directory path.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           }
         },
         "required": [
-          "ok",
+          "request_id",
           "name",
           "path"
         ],
@@ -1957,9 +1992,15 @@
           {
             "$ref": "#/components/schemas/BoundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/CityLifecyclePayload"
           },
+          {
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
@@ -1975,6 +2016,18 @@
           {
             "$ref": "#/components/schemas/OutboundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/RequestFailedPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/UnboundEventPayload"
           },
@@ -2562,10 +2615,16 @@
           "partial": {
             "description": "Whether the list is partial.",
             "type": "boolean"
+          },
+          "total": {
+            "description": "Total number of formulas in the list.",
+            "format": "int64",
+            "type": "integer"
           }
         },
         "required": [
           "items",
+          "total",
           "partial"
         ],
         "type": "object"
@@ -3546,7 +3605,7 @@
           "items": {
             "description": "The list of items.",
             "items": {
-              "$ref": "#/components/schemas/WireEvent"
+              "$ref": "#/components/schemas/TypedEventStreamEnvelope"
             },
             "type": [
               "array",
@@ -5150,6 +5209,41 @@
         ],
         "type": "object"
       },
+      "RequestFailedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "error_code": {
+            "description": "Machine-readable error code.",
+            "type": "string"
+          },
+          "error_message": {
+            "description": "Human-readable error description.",
+            "type": "string"
+          },
+          "operation": {
+            "description": "Which operation failed.",
+            "enum": [
+              "city.create",
+              "city.unregister",
+              "session.create",
+              "session.message",
+              "session.submit"
+            ],
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "request_id",
+          "operation",
+          "error_code",
+          "error_message"
+        ],
+        "type": "object"
+      },
       "RigActionBody": {
         "additionalProperties": false,
         "properties": {
@@ -5539,6 +5633,24 @@
         },
         "type": "object"
       },
+      "SessionCreateSucceededPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          },
+          "session": {
+            "$ref": "#/components/schemas/SessionResponse",
+            "description": "Full session state as returned by GET /session/{id}. For session.create, this result is emitted only after the session has left creating and can accept normal metadata and lifecycle commands."
+          }
+        },
+        "required": [
+          "request_id",
+          "session"
+        ],
+        "type": "object"
+      },
       "SessionInfo": {
         "additionalProperties": false,
         "properties": {
@@ -5574,24 +5686,21 @@
         ],
         "type": "object"
       },
-      "SessionMessageOutputBody": {
+      "SessionMessageSucceededPayload": {
         "additionalProperties": false,
         "properties": {
-          "id": {
-            "description": "Session ID.",
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           },
-          "status": {
-            "description": "Operation result.",
-            "examples": [
-              "accepted"
-            ],
+          "session_id": {
+            "description": "Session ID that received the message.",
             "type": "string"
           }
         },
         "required": [
-          "status",
-          "id"
+          "request_id",
+          "session_id"
         ],
         "type": "object"
       },
@@ -5912,32 +6021,29 @@
         ],
         "type": "object"
       },
-      "SessionSubmitOutputBody": {
+      "SessionSubmitSucceededPayload": {
         "additionalProperties": false,
         "properties": {
-          "id": {
-            "description": "Session ID.",
-            "type": "string"
-          },
           "intent": {
-            "description": "Resolved submit intent.",
+            "description": "Resolved submit intent (default, follow_up, interrupt_now).",
             "type": "string"
           },
           "queued": {
-            "description": "Whether the message was queued.",
+            "description": "Whether the message was queued for later delivery.",
             "type": "boolean"
           },
-          "status": {
-            "description": "Operation result.",
-            "examples": [
-              "accepted"
-            ],
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          },
+          "session_id": {
+            "description": "Session ID that received the submission.",
             "type": "string"
           }
         },
         "required": [
-          "status",
-          "id",
+          "request_id",
+          "session_id",
           "queued",
           "intent"
         ],
@@ -6201,6 +6307,20 @@
             "description": "City name.",
             "type": "string"
           },
+          "partial": {
+            "description": "True when one or more status backing reads returned incomplete data.",
+            "type": "boolean"
+          },
+          "partial_errors": {
+            "description": "Human-readable errors from incomplete status backing reads.",
+            "items": {
+              "type": "string"
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          },
           "path": {
             "description": "City directory path.",
             "type": "string"
@@ -6371,9 +6491,13 @@
       "SupervisorEventListOutputBody": {
         "additionalProperties": false,
         "properties": {
+          "event_cursor": {
+            "description": "Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog.",
+            "type": "string"
+          },
           "items": {
             "items": {
-              "$ref": "#/components/schemas/WireTaggedEvent"
+              "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelope"
             },
             "type": [
               "array",
@@ -6386,6 +6510,7 @@
           }
         },
         "required": [
+          "event_cursor",
           "items",
           "total"
         ],
@@ -6525,13 +6650,9 @@
             "bead.created": "#/components/schemas/TypedEventStreamEnvelopeBeadCreated",
             "bead.updated": "#/components/schemas/TypedEventStreamEnvelopeBeadUpdated",
             "city.created": "#/components/schemas/TypedEventStreamEnvelopeCityCreated",
-            "city.init_failed": "#/components/schemas/TypedEventStreamEnvelopeCityInitFailed",
-            "city.ready": "#/components/schemas/TypedEventStreamEnvelopeCityReady",
             "city.resumed": "#/components/schemas/TypedEventStreamEnvelopeCityResumed",
             "city.suspended": "#/components/schemas/TypedEventStreamEnvelopeCitySuspended",
-            "city.unregister_failed": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterFailed",
             "city.unregister_requested": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterRequested",
-            "city.unregistered": "#/components/schemas/TypedEventStreamEnvelopeCityUnregistered",
             "controller.started": "#/components/schemas/TypedEventStreamEnvelopeControllerStarted",
             "controller.stopped": "#/components/schemas/TypedEventStreamEnvelopeControllerStopped",
             "convoy.closed": "#/components/schemas/TypedEventStreamEnvelopeConvoyClosed",
@@ -6554,6 +6675,12 @@
             "order.failed": "#/components/schemas/TypedEventStreamEnvelopeOrderFailed",
             "order.fired": "#/components/schemas/TypedEventStreamEnvelopeOrderFired",
             "provider.swapped": "#/components/schemas/TypedEventStreamEnvelopeProviderSwapped",
+            "request.failed": "#/components/schemas/TypedEventStreamEnvelopeRequestFailed",
+            "request.result.city.create": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityCreate",
+            "request.result.city.unregister": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityUnregister",
+            "request.result.session.create": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionCreate",
+            "request.result.session.message": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionMessage",
+            "request.result.session.submit": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionSubmit",
             "session.crashed": "#/components/schemas/TypedEventStreamEnvelopeSessionCrashed",
             "session.draining": "#/components/schemas/TypedEventStreamEnvelopeSessionDraining",
             "session.idle_killed": "#/components/schemas/TypedEventStreamEnvelopeSessionIdleKilled",
@@ -6580,27 +6707,15 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityCreated"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityInitFailed"
-          },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityReady"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityResumed"
           },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCitySuspended"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterFailed"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterRequested"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregistered"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeControllerStarted"
           },
@@ -6667,6 +6782,24 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeProviderSwapped"
           },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestFailed"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityUnregister"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionMessage"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionSubmit"
+          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeSessionCrashed"
           },
@@ -6696,6 +6829,9 @@
           },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCustom"
           }
         ],
         "title": "Typed city event stream envelope"
@@ -6868,7 +7004,7 @@
         "title": "TypedEventStreamEnvelope city.created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityInitFailed": {
+      "TypedEventStreamEnvelopeCityResumed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6878,7 +7014,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -6893,7 +7029,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.init_failed",
+            "const": "city.resumed",
             "type": "string"
           },
           "workflow": {
@@ -6907,10 +7043,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.init_failed",
+        "title": "TypedEventStreamEnvelope city.resumed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityReady": {
+      "TypedEventStreamEnvelopeCitySuspended": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6920,7 +7056,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -6935,7 +7071,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.ready",
+            "const": "city.suspended",
             "type": "string"
           },
           "workflow": {
@@ -6949,10 +7085,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.ready",
+        "title": "TypedEventStreamEnvelope city.suspended",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityResumed": {
+      "TypedEventStreamEnvelopeCityUnregisterRequested": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6962,7 +7098,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityLifecyclePayload"
           },
           "seq": {
             "format": "int64",
@@ -6977,7 +7113,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.resumed",
+            "const": "city.unregister_requested",
             "type": "string"
           },
           "workflow": {
@@ -6991,10 +7127,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.resumed",
+        "title": "TypedEventStreamEnvelope city.unregister_requested",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCitySuspended": {
+      "TypedEventStreamEnvelopeControllerStarted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7019,7 +7155,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.suspended",
+            "const": "controller.started",
             "type": "string"
           },
           "workflow": {
@@ -7033,10 +7169,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.suspended",
+        "title": "TypedEventStreamEnvelope controller.started",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregisterFailed": {
+      "TypedEventStreamEnvelopeControllerStopped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7046,7 +7182,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7061,7 +7197,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_failed",
+            "const": "controller.stopped",
             "type": "string"
           },
           "workflow": {
@@ -7075,10 +7211,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregister_failed",
+        "title": "TypedEventStreamEnvelope controller.stopped",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregisterRequested": {
+      "TypedEventStreamEnvelopeConvoyClosed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7088,7 +7224,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7103,7 +7239,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_requested",
+            "const": "convoy.closed",
             "type": "string"
           },
           "workflow": {
@@ -7117,10 +7253,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregister_requested",
+        "title": "TypedEventStreamEnvelope convoy.closed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregistered": {
+      "TypedEventStreamEnvelopeConvoyCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7130,7 +7266,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7145,7 +7281,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregistered",
+            "const": "convoy.created",
             "type": "string"
           },
           "workflow": {
@@ -7159,10 +7295,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregistered",
+        "title": "TypedEventStreamEnvelope convoy.created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeControllerStarted": {
+      "TypedEventStreamEnvelopeCustom": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7171,9 +7307,7 @@
           "message": {
             "type": "string"
           },
-          "payload": {
-            "$ref": "#/components/schemas/NoPayload"
-          },
+          "payload": {},
           "seq": {
             "format": "int64",
             "minimum": 0,
@@ -7187,7 +7321,55 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.started",
+            "not": {
+              "enum": [
+                "session.woke",
+                "session.stopped",
+                "session.crashed",
+                "session.draining",
+                "session.undrained",
+                "session.quarantined",
+                "session.idle_killed",
+                "session.suspended",
+                "session.updated",
+                "bead.created",
+                "bead.closed",
+                "bead.updated",
+                "mail.sent",
+                "mail.read",
+                "mail.archived",
+                "mail.marked_read",
+                "mail.marked_unread",
+                "mail.replied",
+                "mail.deleted",
+                "convoy.created",
+                "convoy.closed",
+                "controller.started",
+                "controller.stopped",
+                "city.suspended",
+                "city.resumed",
+                "request.result.city.create",
+                "request.result.city.unregister",
+                "request.result.session.create",
+                "request.result.session.message",
+                "request.result.session.submit",
+                "request.failed",
+                "city.created",
+                "city.unregister_requested",
+                "order.fired",
+                "order.completed",
+                "order.failed",
+                "provider.swapped",
+                "worker.operation",
+                "extmsg.bound",
+                "extmsg.unbound",
+                "extmsg.group_created",
+                "extmsg.adapter_added",
+                "extmsg.adapter_removed",
+                "extmsg.inbound",
+                "extmsg.outbound"
+              ]
+            },
             "type": "string"
           },
           "workflow": {
@@ -7201,10 +7383,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope controller.started",
+        "title": "TypedEventStreamEnvelope custom",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeControllerStopped": {
+      "TypedEventStreamEnvelopeExtmsgAdapterAdded": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7214,7 +7396,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7229,7 +7411,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.stopped",
+            "const": "extmsg.adapter_added",
             "type": "string"
           },
           "workflow": {
@@ -7243,10 +7425,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope controller.stopped",
+        "title": "TypedEventStreamEnvelope extmsg.adapter_added",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeConvoyClosed": {
+      "TypedEventStreamEnvelopeExtmsgAdapterRemoved": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7256,7 +7438,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7271,7 +7453,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.closed",
+            "const": "extmsg.adapter_removed",
             "type": "string"
           },
           "workflow": {
@@ -7285,10 +7467,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope convoy.closed",
+        "title": "TypedEventStreamEnvelope extmsg.adapter_removed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeConvoyCreated": {
+      "TypedEventStreamEnvelopeExtmsgBound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7298,7 +7480,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/BoundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7313,7 +7495,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.created",
+            "const": "extmsg.bound",
             "type": "string"
           },
           "workflow": {
@@ -7327,10 +7509,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope convoy.created",
+        "title": "TypedEventStreamEnvelope extmsg.bound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgAdapterAdded": {
+      "TypedEventStreamEnvelopeExtmsgGroupCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7340,7 +7522,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7355,7 +7537,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_added",
+            "const": "extmsg.group_created",
             "type": "string"
           },
           "workflow": {
@@ -7369,10 +7551,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.adapter_added",
+        "title": "TypedEventStreamEnvelope extmsg.group_created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgAdapterRemoved": {
+      "TypedEventStreamEnvelopeExtmsgInbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7382,7 +7564,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/InboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7397,7 +7579,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_removed",
+            "const": "extmsg.inbound",
             "type": "string"
           },
           "workflow": {
@@ -7411,10 +7593,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.adapter_removed",
+        "title": "TypedEventStreamEnvelope extmsg.inbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgBound": {
+      "TypedEventStreamEnvelopeExtmsgOutbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7424,7 +7606,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/BoundEventPayload"
+            "$ref": "#/components/schemas/OutboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7439,7 +7621,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.bound",
+            "const": "extmsg.outbound",
             "type": "string"
           },
           "workflow": {
@@ -7453,10 +7635,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.bound",
+        "title": "TypedEventStreamEnvelope extmsg.outbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgGroupCreated": {
+      "TypedEventStreamEnvelopeExtmsgUnbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7466,7 +7648,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/GroupCreatedEventPayload"
+            "$ref": "#/components/schemas/UnboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7481,7 +7663,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.group_created",
+            "const": "extmsg.unbound",
             "type": "string"
           },
           "workflow": {
@@ -7495,10 +7677,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.group_created",
+        "title": "TypedEventStreamEnvelope extmsg.unbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgInbound": {
+      "TypedEventStreamEnvelopeMailArchived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7508,7 +7690,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/InboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7523,7 +7705,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.inbound",
+            "const": "mail.archived",
             "type": "string"
           },
           "workflow": {
@@ -7537,10 +7719,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.inbound",
+        "title": "TypedEventStreamEnvelope mail.archived",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgOutbound": {
+      "TypedEventStreamEnvelopeMailDeleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7550,7 +7732,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/OutboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7565,7 +7747,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.outbound",
+            "const": "mail.deleted",
             "type": "string"
           },
           "workflow": {
@@ -7579,10 +7761,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.outbound",
+        "title": "TypedEventStreamEnvelope mail.deleted",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgUnbound": {
+      "TypedEventStreamEnvelopeMailMarkedRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7592,7 +7774,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/UnboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7607,7 +7789,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.unbound",
+            "const": "mail.marked_read",
             "type": "string"
           },
           "workflow": {
@@ -7621,10 +7803,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.unbound",
+        "title": "TypedEventStreamEnvelope mail.marked_read",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailArchived": {
+      "TypedEventStreamEnvelopeMailMarkedUnread": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7649,7 +7831,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.archived",
+            "const": "mail.marked_unread",
             "type": "string"
           },
           "workflow": {
@@ -7663,10 +7845,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.archived",
+        "title": "TypedEventStreamEnvelope mail.marked_unread",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailDeleted": {
+      "TypedEventStreamEnvelopeMailRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7691,7 +7873,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.deleted",
+            "const": "mail.read",
             "type": "string"
           },
           "workflow": {
@@ -7705,10 +7887,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.deleted",
+        "title": "TypedEventStreamEnvelope mail.read",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailMarkedRead": {
+      "TypedEventStreamEnvelopeMailReplied": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7733,7 +7915,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_read",
+            "const": "mail.replied",
             "type": "string"
           },
           "workflow": {
@@ -7747,10 +7929,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.marked_read",
+        "title": "TypedEventStreamEnvelope mail.replied",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailMarkedUnread": {
+      "TypedEventStreamEnvelopeMailSent": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7775,7 +7957,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_unread",
+            "const": "mail.sent",
             "type": "string"
           },
           "workflow": {
@@ -7789,10 +7971,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.marked_unread",
+        "title": "TypedEventStreamEnvelope mail.sent",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailRead": {
+      "TypedEventStreamEnvelopeOrderCompleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7802,7 +7984,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7817,7 +7999,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.read",
+            "const": "order.completed",
             "type": "string"
           },
           "workflow": {
@@ -7831,10 +8013,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.read",
+        "title": "TypedEventStreamEnvelope order.completed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailReplied": {
+      "TypedEventStreamEnvelopeOrderFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7844,7 +8026,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7859,7 +8041,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.replied",
+            "const": "order.failed",
             "type": "string"
           },
           "workflow": {
@@ -7873,10 +8055,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.replied",
+        "title": "TypedEventStreamEnvelope order.failed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailSent": {
+      "TypedEventStreamEnvelopeOrderFired": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7886,7 +8068,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7901,7 +8083,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.sent",
+            "const": "order.fired",
             "type": "string"
           },
           "workflow": {
@@ -7915,10 +8097,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.sent",
+        "title": "TypedEventStreamEnvelope order.fired",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderCompleted": {
+      "TypedEventStreamEnvelopeProviderSwapped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7943,7 +8125,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.completed",
+            "const": "provider.swapped",
             "type": "string"
           },
           "workflow": {
@@ -7957,10 +8139,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.completed",
+        "title": "TypedEventStreamEnvelope provider.swapped",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderFailed": {
+      "TypedEventStreamEnvelopeRequestFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7970,7 +8152,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/RequestFailedPayload"
           },
           "seq": {
             "format": "int64",
@@ -7985,7 +8167,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.failed",
+            "const": "request.failed",
             "type": "string"
           },
           "workflow": {
@@ -7999,10 +8181,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.failed",
+        "title": "TypedEventStreamEnvelope request.failed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderFired": {
+      "TypedEventStreamEnvelopeRequestResultCityCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8012,7 +8194,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -8027,7 +8209,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.fired",
+            "const": "request.result.city.create",
             "type": "string"
           },
           "workflow": {
@@ -8041,10 +8223,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.fired",
+        "title": "TypedEventStreamEnvelope request.result.city.create",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeProviderSwapped": {
+      "TypedEventStreamEnvelopeRequestResultCityUnregister": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8054,7 +8236,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -8069,7 +8251,7 @@
             "type": "string"
           },
           "type": {
-            "const": "provider.swapped",
+            "const": "request.result.city.unregister",
             "type": "string"
           },
           "workflow": {
@@ -8083,7 +8265,133 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope provider.swapped",
+        "title": "TypedEventStreamEnvelope request.result.city.unregister",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionCreate": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.create",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.create",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionMessage": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.message",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.message",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionSubmit": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.submit",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.submit",
         "type": "object"
       },
       "TypedEventStreamEnvelopeSessionCrashed": {
@@ -8514,13 +8822,9 @@
             "bead.created": "#/components/schemas/TypedTaggedEventStreamEnvelopeBeadCreated",
             "bead.updated": "#/components/schemas/TypedTaggedEventStreamEnvelopeBeadUpdated",
             "city.created": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityCreated",
-            "city.init_failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityInitFailed",
-            "city.ready": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityReady",
             "city.resumed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityResumed",
             "city.suspended": "#/components/schemas/TypedTaggedEventStreamEnvelopeCitySuspended",
-            "city.unregister_failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterFailed",
             "city.unregister_requested": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterRequested",
-            "city.unregistered": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregistered",
             "controller.started": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStarted",
             "controller.stopped": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStopped",
             "convoy.closed": "#/components/schemas/TypedTaggedEventStreamEnvelopeConvoyClosed",
@@ -8543,6 +8847,12 @@
             "order.failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeOrderFailed",
             "order.fired": "#/components/schemas/TypedTaggedEventStreamEnvelopeOrderFired",
             "provider.swapped": "#/components/schemas/TypedTaggedEventStreamEnvelopeProviderSwapped",
+            "request.failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestFailed",
+            "request.result.city.create": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityCreate",
+            "request.result.city.unregister": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityUnregister",
+            "request.result.session.create": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionCreate",
+            "request.result.session.message": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionMessage",
+            "request.result.session.submit": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit",
             "session.crashed": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionCrashed",
             "session.draining": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionDraining",
             "session.idle_killed": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionIdleKilled",
@@ -8569,27 +8879,15 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityCreated"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityInitFailed"
-          },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityReady"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityResumed"
           },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCitySuspended"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterFailed"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterRequested"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregistered"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStarted"
           },
@@ -8656,6 +8954,24 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeProviderSwapped"
           },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestFailed"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityUnregister"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionMessage"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit"
+          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionCrashed"
           },
@@ -8685,6 +9001,9 @@
           },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCustom"
           }
         ],
         "title": "Typed supervisor event stream envelope"
@@ -8873,7 +9192,7 @@
         "title": "TypedTaggedEventStreamEnvelope city.created",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityInitFailed": {
+      "TypedTaggedEventStreamEnvelopeCityResumed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8886,7 +9205,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -8901,7 +9220,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.init_failed",
+            "const": "city.resumed",
             "type": "string"
           },
           "workflow": {
@@ -8916,10 +9235,56 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.init_failed",
+        "title": "TypedTaggedEventStreamEnvelope city.resumed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityReady": {
+      "TypedTaggedEventStreamEnvelopeCitySuspended": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "city.suspended",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope city.suspended",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeCityUnregisterRequested": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8947,7 +9312,53 @@
             "type": "string"
           },
           "type": {
-            "const": "city.ready",
+            "const": "city.unregister_requested",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope city.unregister_requested",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeControllerStarted": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "controller.started",
             "type": "string"
           },
           "workflow": {
@@ -8962,10 +9373,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.ready",
+        "title": "TypedTaggedEventStreamEnvelope controller.started",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityResumed": {
+      "TypedTaggedEventStreamEnvelopeControllerStopped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8993,7 +9404,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.resumed",
+            "const": "controller.stopped",
             "type": "string"
           },
           "workflow": {
@@ -9008,10 +9419,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.resumed",
+        "title": "TypedTaggedEventStreamEnvelope controller.stopped",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCitySuspended": {
+      "TypedTaggedEventStreamEnvelopeConvoyClosed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9039,7 +9450,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.suspended",
+            "const": "convoy.closed",
             "type": "string"
           },
           "workflow": {
@@ -9054,10 +9465,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.suspended",
+        "title": "TypedTaggedEventStreamEnvelope convoy.closed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregisterFailed": {
+      "TypedTaggedEventStreamEnvelopeConvoyCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9070,8 +9481,52 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "convoy.created",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope convoy.created",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeCustom": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
           },
+          "payload": {},
           "seq": {
             "format": "int64",
             "minimum": 0,
@@ -9085,7 +9540,55 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_failed",
+            "not": {
+              "enum": [
+                "session.woke",
+                "session.stopped",
+                "session.crashed",
+                "session.draining",
+                "session.undrained",
+                "session.quarantined",
+                "session.idle_killed",
+                "session.suspended",
+                "session.updated",
+                "bead.created",
+                "bead.closed",
+                "bead.updated",
+                "mail.sent",
+                "mail.read",
+                "mail.archived",
+                "mail.marked_read",
+                "mail.marked_unread",
+                "mail.replied",
+                "mail.deleted",
+                "convoy.created",
+                "convoy.closed",
+                "controller.started",
+                "controller.stopped",
+                "city.suspended",
+                "city.resumed",
+                "request.result.city.create",
+                "request.result.city.unregister",
+                "request.result.session.create",
+                "request.result.session.message",
+                "request.result.session.submit",
+                "request.failed",
+                "city.created",
+                "city.unregister_requested",
+                "order.fired",
+                "order.completed",
+                "order.failed",
+                "provider.swapped",
+                "worker.operation",
+                "extmsg.bound",
+                "extmsg.unbound",
+                "extmsg.group_created",
+                "extmsg.adapter_added",
+                "extmsg.adapter_removed",
+                "extmsg.inbound",
+                "extmsg.outbound"
+              ]
+            },
             "type": "string"
           },
           "workflow": {
@@ -9100,10 +9603,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregister_failed",
+        "title": "TypedTaggedEventStreamEnvelope custom",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregisterRequested": {
+      "TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9116,7 +9619,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9131,7 +9634,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_requested",
+            "const": "extmsg.adapter_added",
             "type": "string"
           },
           "workflow": {
@@ -9146,10 +9649,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregister_requested",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_added",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregistered": {
+      "TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9162,7 +9665,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9177,7 +9680,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregistered",
+            "const": "extmsg.adapter_removed",
             "type": "string"
           },
           "workflow": {
@@ -9192,10 +9695,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregistered",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_removed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeControllerStarted": {
+      "TypedTaggedEventStreamEnvelopeExtmsgBound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9208,7 +9711,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/BoundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9223,7 +9726,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.started",
+            "const": "extmsg.bound",
             "type": "string"
           },
           "workflow": {
@@ -9238,10 +9741,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope controller.started",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.bound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeControllerStopped": {
+      "TypedTaggedEventStreamEnvelopeExtmsgGroupCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9254,7 +9757,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9269,7 +9772,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.stopped",
+            "const": "extmsg.group_created",
             "type": "string"
           },
           "workflow": {
@@ -9284,10 +9787,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope controller.stopped",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.group_created",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeConvoyClosed": {
+      "TypedTaggedEventStreamEnvelopeExtmsgInbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9300,7 +9803,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/InboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9315,7 +9818,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.closed",
+            "const": "extmsg.inbound",
             "type": "string"
           },
           "workflow": {
@@ -9330,10 +9833,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope convoy.closed",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.inbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeConvoyCreated": {
+      "TypedTaggedEventStreamEnvelopeExtmsgOutbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9346,7 +9849,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/OutboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9361,7 +9864,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.created",
+            "const": "extmsg.outbound",
             "type": "string"
           },
           "workflow": {
@@ -9376,10 +9879,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope convoy.created",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.outbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded": {
+      "TypedTaggedEventStreamEnvelopeExtmsgUnbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9392,7 +9895,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/UnboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9407,7 +9910,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_added",
+            "const": "extmsg.unbound",
             "type": "string"
           },
           "workflow": {
@@ -9422,10 +9925,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_added",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.unbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved": {
+      "TypedTaggedEventStreamEnvelopeMailArchived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9438,7 +9941,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9453,7 +9956,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_removed",
+            "const": "mail.archived",
             "type": "string"
           },
           "workflow": {
@@ -9468,10 +9971,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_removed",
+        "title": "TypedTaggedEventStreamEnvelope mail.archived",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgBound": {
+      "TypedTaggedEventStreamEnvelopeMailDeleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9484,7 +9987,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/BoundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9499,7 +10002,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.bound",
+            "const": "mail.deleted",
             "type": "string"
           },
           "workflow": {
@@ -9514,10 +10017,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.bound",
+        "title": "TypedTaggedEventStreamEnvelope mail.deleted",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgGroupCreated": {
+      "TypedTaggedEventStreamEnvelopeMailMarkedRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9530,7 +10033,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/GroupCreatedEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9545,7 +10048,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.group_created",
+            "const": "mail.marked_read",
             "type": "string"
           },
           "workflow": {
@@ -9560,10 +10063,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.group_created",
+        "title": "TypedTaggedEventStreamEnvelope mail.marked_read",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgInbound": {
+      "TypedTaggedEventStreamEnvelopeMailMarkedUnread": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9576,7 +10079,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/InboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9591,7 +10094,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.inbound",
+            "const": "mail.marked_unread",
             "type": "string"
           },
           "workflow": {
@@ -9606,10 +10109,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.inbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.marked_unread",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgOutbound": {
+      "TypedTaggedEventStreamEnvelopeMailRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9622,7 +10125,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/OutboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9637,7 +10140,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.outbound",
+            "const": "mail.read",
             "type": "string"
           },
           "workflow": {
@@ -9652,10 +10155,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.outbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.read",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgUnbound": {
+      "TypedTaggedEventStreamEnvelopeMailReplied": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9668,7 +10171,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/UnboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9683,7 +10186,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.unbound",
+            "const": "mail.replied",
             "type": "string"
           },
           "workflow": {
@@ -9698,10 +10201,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.unbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.replied",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailArchived": {
+      "TypedTaggedEventStreamEnvelopeMailSent": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9729,7 +10232,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.archived",
+            "const": "mail.sent",
             "type": "string"
           },
           "workflow": {
@@ -9744,10 +10247,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.archived",
+        "title": "TypedTaggedEventStreamEnvelope mail.sent",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailDeleted": {
+      "TypedTaggedEventStreamEnvelopeOrderCompleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9760,7 +10263,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9775,7 +10278,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.deleted",
+            "const": "order.completed",
             "type": "string"
           },
           "workflow": {
@@ -9790,10 +10293,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.deleted",
+        "title": "TypedTaggedEventStreamEnvelope order.completed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailMarkedRead": {
+      "TypedTaggedEventStreamEnvelopeOrderFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9806,7 +10309,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9821,7 +10324,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_read",
+            "const": "order.failed",
             "type": "string"
           },
           "workflow": {
@@ -9836,10 +10339,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.marked_read",
+        "title": "TypedTaggedEventStreamEnvelope order.failed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailMarkedUnread": {
+      "TypedTaggedEventStreamEnvelopeOrderFired": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9852,7 +10355,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9867,7 +10370,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_unread",
+            "const": "order.fired",
             "type": "string"
           },
           "workflow": {
@@ -9882,10 +10385,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.marked_unread",
+        "title": "TypedTaggedEventStreamEnvelope order.fired",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailRead": {
+      "TypedTaggedEventStreamEnvelopeProviderSwapped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9898,7 +10401,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9913,7 +10416,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.read",
+            "const": "provider.swapped",
             "type": "string"
           },
           "workflow": {
@@ -9928,10 +10431,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.read",
+        "title": "TypedTaggedEventStreamEnvelope provider.swapped",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailReplied": {
+      "TypedTaggedEventStreamEnvelopeRequestFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9944,7 +10447,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/RequestFailedPayload"
           },
           "seq": {
             "format": "int64",
@@ -9959,7 +10462,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.replied",
+            "const": "request.failed",
             "type": "string"
           },
           "workflow": {
@@ -9974,10 +10477,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.replied",
+        "title": "TypedTaggedEventStreamEnvelope request.failed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailSent": {
+      "TypedTaggedEventStreamEnvelopeRequestResultCityCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9990,7 +10493,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10005,7 +10508,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.sent",
+            "const": "request.result.city.create",
             "type": "string"
           },
           "workflow": {
@@ -10020,10 +10523,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.sent",
+        "title": "TypedTaggedEventStreamEnvelope request.result.city.create",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderCompleted": {
+      "TypedTaggedEventStreamEnvelopeRequestResultCityUnregister": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10036,7 +10539,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10051,7 +10554,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.completed",
+            "const": "request.result.city.unregister",
             "type": "string"
           },
           "workflow": {
@@ -10066,10 +10569,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.completed",
+        "title": "TypedTaggedEventStreamEnvelope request.result.city.unregister",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderFailed": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10082,7 +10585,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10097,7 +10600,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.failed",
+            "const": "request.result.session.create",
             "type": "string"
           },
           "workflow": {
@@ -10112,10 +10615,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.failed",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.create",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderFired": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionMessage": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10128,7 +10631,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10143,7 +10646,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.fired",
+            "const": "request.result.session.message",
             "type": "string"
           },
           "workflow": {
@@ -10158,10 +10661,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.fired",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.message",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeProviderSwapped": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10174,7 +10677,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10189,7 +10692,7 @@
             "type": "string"
           },
           "type": {
-            "const": "provider.swapped",
+            "const": "request.result.session.submit",
             "type": "string"
           },
           "workflow": {
@@ -10204,7 +10707,7 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope provider.swapped",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.submit",
         "type": "object"
       },
       "TypedTaggedEventStreamEnvelopeSessionCrashed": {
@@ -10684,82 +11187,6 @@
         ],
         "type": "object"
       },
-      "WireEvent": {
-        "additionalProperties": false,
-        "properties": {
-          "actor": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
-          },
-          "payload": {
-            "$ref": "#/components/schemas/EventPayload"
-          },
-          "seq": {
-            "format": "int64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "subject": {
-            "type": "string"
-          },
-          "ts": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "seq",
-          "type",
-          "ts",
-          "actor"
-        ],
-        "type": "object"
-      },
-      "WireTaggedEvent": {
-        "additionalProperties": false,
-        "properties": {
-          "actor": {
-            "type": "string"
-          },
-          "city": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
-          },
-          "payload": {
-            "$ref": "#/components/schemas/EventPayload"
-          },
-          "seq": {
-            "format": "int64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "subject": {
-            "type": "string"
-          },
-          "ts": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city",
-          "seq",
-          "type",
-          "ts",
-          "actor"
-        ],
-        "type": "object"
-      },
       "WorkerOperationEventPayload": {
         "additionalProperties": false,
         "properties": {
@@ -11279,7 +11706,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CityCreateResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedResponse"
                 }
               }
             },
@@ -12654,6 +13081,7 @@
         "summary": "Get v0 city by city name agents"
       },
       "post": {
+        "description": "Creates an agent and waits until it is visible to immediate follow-up operations. If the agent is durably created but visibility confirmation is canceled or times out, the retryable 503/504 response includes a Retry-After header.",
         "operationId": "create-agent",
         "parameters": [
           {
@@ -14738,7 +15166,7 @@
     },
     "/v0/city/{cityName}/events/stream": {
       "get": {
-        "description": "Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param.",
+        "description": "Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param; omitting both starts at the current city event head.",
         "operationId": "stream-events",
         "parameters": [
           {
@@ -14754,21 +15182,21 @@
             }
           },
           {
-            "description": "Reconnect position: only deliver events after this sequence number.",
+            "description": "Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.",
             "explode": false,
             "in": "query",
             "name": "after_seq",
             "schema": {
-              "description": "Reconnect position: only deliver events after this sequence number.",
+              "description": "Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.",
               "type": "string"
             }
           },
           {
-            "description": "SSE reconnect position from the last received event ID.",
+            "description": "SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.",
             "in": "header",
             "name": "Last-Event-ID",
             "schema": {
-              "description": "SSE reconnect position from the last received event ID.",
+              "description": "SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.",
               "type": "string"
             }
           }
@@ -16822,12 +17250,12 @@
             }
           },
           {
-            "description": "Thread ID.",
+            "description": "Thread ID, or any message ID in the thread.",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Thread ID.",
+              "description": "Thread ID, or any message ID in the thread.",
               "type": "string"
             }
           },
@@ -17743,6 +18171,16 @@
               "pattern": "\\S",
               "type": "string"
             }
+          },
+          {
+            "description": "Bypass cached order-check responses and cached order history.",
+            "explode": false,
+            "in": "query",
+            "name": "fresh",
+            "schema": {
+              "description": "Bypass cached order-check responses and cached order history.",
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -20743,7 +21181,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionMessageOutputBody"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -21365,7 +21803,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionSubmitOutputBody"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -21523,6 +21961,16 @@
               "description": "Pagination cursor: return entries before this UUID.",
               "type": "string"
             }
+          },
+          {
+            "description": "Pagination cursor: return entries after this UUID.",
+            "explode": false,
+            "in": "query",
+            "name": "after",
+            "schema": {
+              "description": "Pagination cursor: return entries after this UUID.",
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -21794,7 +22242,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -22008,7 +22456,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CityUnregisterResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedResponse"
                 }
               }
             },
@@ -22313,24 +22761,25 @@
     },
     "/v0/events/stream": {
       "get": {
+        "description": "Server-Sent Events stream of supervisor-tagged events. Supports reconnection via Last-Event-ID header or after_cursor query param; omitting both starts at the current supervisor event head.",
         "operationId": "stream-supervisor-events",
         "parameters": [
           {
-            "description": "Reconnect cursor (composite per-city cursor).",
+            "description": "Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.",
             "in": "header",
             "name": "Last-Event-ID",
             "schema": {
-              "description": "Reconnect cursor (composite per-city cursor).",
+              "description": "Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.",
               "type": "string"
             }
           },
           {
-            "description": "Alternative to Last-Event-ID for browsers that can't set custom headers.",
+            "description": "Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.",
             "explode": false,
             "in": "query",
             "name": "after_cursor",
             "schema": {
-              "description": "Alternative to Last-Event-ID for browsers that can't set custom headers.",
+              "description": "Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.",
               "type": "string"
             }
           }
diff --git a/docs/schema/openapi.txt b/docs/schema/openapi.txt
index dcac755149..422f30da13 100644
--- a/docs/schema/openapi.txt
+++ b/docs/schema/openapi.txt
@@ -724,6 +724,50 @@
         ],
         "type": "object"
       },
+      "AsyncAcceptedBody": {
+        "additionalProperties": false,
+        "properties": {
+          "event_cursor": {
+            "description": "City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id.",
+            "type": "string"
+          },
+          "status": {
+            "description": "Async request status.",
+            "examples": [
+              "accepted"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "status",
+          "request_id",
+          "event_cursor"
+        ],
+        "type": "object"
+      },
+      "AsyncAcceptedResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "event_cursor": {
+            "description": "Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "request_id",
+          "event_cursor"
+        ],
+        "type": "object"
+      },
       "Bead": {
         "additionalProperties": false,
         "properties": {
@@ -1045,35 +1089,38 @@
             "type": "string"
           },
           "provider": {
-            "description": "Provider name for the city's default session template.",
+            "description": "Provider name for the city's default session template. Mutually exclusive with start_command.",
             "minLength": 1,
             "type": "string"
+          },
+          "start_command": {
+            "description": "Custom workspace start command for the city's default session template. Mutually exclusive with provider.",
+            "type": "string"
           }
         },
         "required": [
-          "dir",
-          "provider"
+          "dir"
         ],
         "type": "object"
       },
-      "CityCreateResponse": {
+      "CityCreateSucceededPayload": {
         "additionalProperties": false,
         "properties": {
           "name": {
-            "description": "Resolved city name as persisted in city.toml. Use this to filter the event stream for completion.",
+            "description": "Resolved city name.",
             "type": "string"
           },
-          "ok": {
-            "description": "True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready.",
-            "type": "boolean"
-          },
           "path": {
-            "description": "Resolved absolute path of the created city directory.",
+            "description": "Resolved absolute city directory path.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           }
         },
         "required": [
-          "ok",
+          "request_id",
           "name",
           "path"
         ],
@@ -1161,23 +1208,11 @@
       "CityLifecyclePayload": {
         "additionalProperties": false,
         "properties": {
-          "error": {
-            "type": "string"
-          },
           "name": {
             "type": "string"
           },
           "path": {
             "type": "string"
-          },
-          "phases_completed": {
-            "items": {
-              "type": "string"
-            },
-            "type": [
-              "array",
-              "null"
-            ]
           }
         },
         "required": [
@@ -1196,24 +1231,24 @@
         },
         "type": "object"
       },
-      "CityUnregisterResponse": {
+      "CityUnregisterSucceededPayload": {
         "additionalProperties": false,
         "properties": {
           "name": {
-            "description": "Resolved registry name. Filter the event stream by this to observe completion.",
+            "description": "City name that was unregistered.",
             "type": "string"
           },
-          "ok": {
-            "description": "True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered.",
-            "type": "boolean"
-          },
           "path": {
-            "description": "Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry.",
+            "description": "Absolute city directory path.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           }
         },
         "required": [
-          "ok",
+          "request_id",
           "name",
           "path"
         ],
@@ -1957,9 +1992,15 @@
           {
             "$ref": "#/components/schemas/BoundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/CityLifecyclePayload"
           },
+          {
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
@@ -1975,6 +2016,18 @@
           {
             "$ref": "#/components/schemas/OutboundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/RequestFailedPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/UnboundEventPayload"
           },
@@ -2562,10 +2615,16 @@
           "partial": {
             "description": "Whether the list is partial.",
             "type": "boolean"
+          },
+          "total": {
+            "description": "Total number of formulas in the list.",
+            "format": "int64",
+            "type": "integer"
           }
         },
         "required": [
           "items",
+          "total",
           "partial"
         ],
         "type": "object"
@@ -3546,7 +3605,7 @@
           "items": {
             "description": "The list of items.",
             "items": {
-              "$ref": "#/components/schemas/WireEvent"
+              "$ref": "#/components/schemas/TypedEventStreamEnvelope"
             },
             "type": [
               "array",
@@ -5150,6 +5209,41 @@
         ],
         "type": "object"
       },
+      "RequestFailedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "error_code": {
+            "description": "Machine-readable error code.",
+            "type": "string"
+          },
+          "error_message": {
+            "description": "Human-readable error description.",
+            "type": "string"
+          },
+          "operation": {
+            "description": "Which operation failed.",
+            "enum": [
+              "city.create",
+              "city.unregister",
+              "session.create",
+              "session.message",
+              "session.submit"
+            ],
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "request_id",
+          "operation",
+          "error_code",
+          "error_message"
+        ],
+        "type": "object"
+      },
       "RigActionBody": {
         "additionalProperties": false,
         "properties": {
@@ -5539,6 +5633,24 @@
         },
         "type": "object"
       },
+      "SessionCreateSucceededPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          },
+          "session": {
+            "$ref": "#/components/schemas/SessionResponse",
+            "description": "Full session state as returned by GET /session/{id}. For session.create, this result is emitted only after the session has left creating and can accept normal metadata and lifecycle commands."
+          }
+        },
+        "required": [
+          "request_id",
+          "session"
+        ],
+        "type": "object"
+      },
       "SessionInfo": {
         "additionalProperties": false,
         "properties": {
@@ -5574,24 +5686,21 @@
         ],
         "type": "object"
       },
-      "SessionMessageOutputBody": {
+      "SessionMessageSucceededPayload": {
         "additionalProperties": false,
         "properties": {
-          "id": {
-            "description": "Session ID.",
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           },
-          "status": {
-            "description": "Operation result.",
-            "examples": [
-              "accepted"
-            ],
+          "session_id": {
+            "description": "Session ID that received the message.",
             "type": "string"
           }
         },
         "required": [
-          "status",
-          "id"
+          "request_id",
+          "session_id"
         ],
         "type": "object"
       },
@@ -5912,32 +6021,29 @@
         ],
         "type": "object"
       },
-      "SessionSubmitOutputBody": {
+      "SessionSubmitSucceededPayload": {
         "additionalProperties": false,
         "properties": {
-          "id": {
-            "description": "Session ID.",
-            "type": "string"
-          },
           "intent": {
-            "description": "Resolved submit intent.",
+            "description": "Resolved submit intent (default, follow_up, interrupt_now).",
             "type": "string"
           },
           "queued": {
-            "description": "Whether the message was queued.",
+            "description": "Whether the message was queued for later delivery.",
             "type": "boolean"
           },
-          "status": {
-            "description": "Operation result.",
-            "examples": [
-              "accepted"
-            ],
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          },
+          "session_id": {
+            "description": "Session ID that received the submission.",
             "type": "string"
           }
         },
         "required": [
-          "status",
-          "id",
+          "request_id",
+          "session_id",
           "queued",
           "intent"
         ],
@@ -6201,6 +6307,20 @@
             "description": "City name.",
             "type": "string"
           },
+          "partial": {
+            "description": "True when one or more status backing reads returned incomplete data.",
+            "type": "boolean"
+          },
+          "partial_errors": {
+            "description": "Human-readable errors from incomplete status backing reads.",
+            "items": {
+              "type": "string"
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          },
           "path": {
             "description": "City directory path.",
             "type": "string"
@@ -6371,9 +6491,13 @@
       "SupervisorEventListOutputBody": {
         "additionalProperties": false,
         "properties": {
+          "event_cursor": {
+            "description": "Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog.",
+            "type": "string"
+          },
           "items": {
             "items": {
-              "$ref": "#/components/schemas/WireTaggedEvent"
+              "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelope"
             },
             "type": [
               "array",
@@ -6386,6 +6510,7 @@
           }
         },
         "required": [
+          "event_cursor",
           "items",
           "total"
         ],
@@ -6525,13 +6650,9 @@
             "bead.created": "#/components/schemas/TypedEventStreamEnvelopeBeadCreated",
             "bead.updated": "#/components/schemas/TypedEventStreamEnvelopeBeadUpdated",
             "city.created": "#/components/schemas/TypedEventStreamEnvelopeCityCreated",
-            "city.init_failed": "#/components/schemas/TypedEventStreamEnvelopeCityInitFailed",
-            "city.ready": "#/components/schemas/TypedEventStreamEnvelopeCityReady",
             "city.resumed": "#/components/schemas/TypedEventStreamEnvelopeCityResumed",
             "city.suspended": "#/components/schemas/TypedEventStreamEnvelopeCitySuspended",
-            "city.unregister_failed": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterFailed",
             "city.unregister_requested": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterRequested",
-            "city.unregistered": "#/components/schemas/TypedEventStreamEnvelopeCityUnregistered",
             "controller.started": "#/components/schemas/TypedEventStreamEnvelopeControllerStarted",
             "controller.stopped": "#/components/schemas/TypedEventStreamEnvelopeControllerStopped",
             "convoy.closed": "#/components/schemas/TypedEventStreamEnvelopeConvoyClosed",
@@ -6554,6 +6675,12 @@
             "order.failed": "#/components/schemas/TypedEventStreamEnvelopeOrderFailed",
             "order.fired": "#/components/schemas/TypedEventStreamEnvelopeOrderFired",
             "provider.swapped": "#/components/schemas/TypedEventStreamEnvelopeProviderSwapped",
+            "request.failed": "#/components/schemas/TypedEventStreamEnvelopeRequestFailed",
+            "request.result.city.create": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityCreate",
+            "request.result.city.unregister": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityUnregister",
+            "request.result.session.create": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionCreate",
+            "request.result.session.message": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionMessage",
+            "request.result.session.submit": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionSubmit",
             "session.crashed": "#/components/schemas/TypedEventStreamEnvelopeSessionCrashed",
             "session.draining": "#/components/schemas/TypedEventStreamEnvelopeSessionDraining",
             "session.idle_killed": "#/components/schemas/TypedEventStreamEnvelopeSessionIdleKilled",
@@ -6580,27 +6707,15 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityCreated"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityInitFailed"
-          },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityReady"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityResumed"
           },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCitySuspended"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterFailed"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterRequested"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregistered"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeControllerStarted"
           },
@@ -6667,6 +6782,24 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeProviderSwapped"
           },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestFailed"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityUnregister"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionMessage"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionSubmit"
+          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeSessionCrashed"
           },
@@ -6696,6 +6829,9 @@
           },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCustom"
           }
         ],
         "title": "Typed city event stream envelope"
@@ -6868,7 +7004,7 @@
         "title": "TypedEventStreamEnvelope city.created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityInitFailed": {
+      "TypedEventStreamEnvelopeCityResumed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6878,7 +7014,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -6893,7 +7029,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.init_failed",
+            "const": "city.resumed",
             "type": "string"
           },
           "workflow": {
@@ -6907,10 +7043,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.init_failed",
+        "title": "TypedEventStreamEnvelope city.resumed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityReady": {
+      "TypedEventStreamEnvelopeCitySuspended": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6920,7 +7056,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -6935,7 +7071,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.ready",
+            "const": "city.suspended",
             "type": "string"
           },
           "workflow": {
@@ -6949,10 +7085,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.ready",
+        "title": "TypedEventStreamEnvelope city.suspended",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityResumed": {
+      "TypedEventStreamEnvelopeCityUnregisterRequested": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6962,7 +7098,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityLifecyclePayload"
           },
           "seq": {
             "format": "int64",
@@ -6977,7 +7113,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.resumed",
+            "const": "city.unregister_requested",
             "type": "string"
           },
           "workflow": {
@@ -6991,10 +7127,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.resumed",
+        "title": "TypedEventStreamEnvelope city.unregister_requested",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCitySuspended": {
+      "TypedEventStreamEnvelopeControllerStarted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7019,7 +7155,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.suspended",
+            "const": "controller.started",
             "type": "string"
           },
           "workflow": {
@@ -7033,10 +7169,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.suspended",
+        "title": "TypedEventStreamEnvelope controller.started",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregisterFailed": {
+      "TypedEventStreamEnvelopeControllerStopped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7046,7 +7182,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7061,7 +7197,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_failed",
+            "const": "controller.stopped",
             "type": "string"
           },
           "workflow": {
@@ -7075,10 +7211,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregister_failed",
+        "title": "TypedEventStreamEnvelope controller.stopped",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregisterRequested": {
+      "TypedEventStreamEnvelopeConvoyClosed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7088,7 +7224,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7103,7 +7239,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_requested",
+            "const": "convoy.closed",
             "type": "string"
           },
           "workflow": {
@@ -7117,10 +7253,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregister_requested",
+        "title": "TypedEventStreamEnvelope convoy.closed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregistered": {
+      "TypedEventStreamEnvelopeConvoyCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7130,7 +7266,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7145,7 +7281,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregistered",
+            "const": "convoy.created",
             "type": "string"
           },
           "workflow": {
@@ -7159,10 +7295,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregistered",
+        "title": "TypedEventStreamEnvelope convoy.created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeControllerStarted": {
+      "TypedEventStreamEnvelopeCustom": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7171,9 +7307,7 @@
           "message": {
             "type": "string"
           },
-          "payload": {
-            "$ref": "#/components/schemas/NoPayload"
-          },
+          "payload": {},
           "seq": {
             "format": "int64",
             "minimum": 0,
@@ -7187,7 +7321,55 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.started",
+            "not": {
+              "enum": [
+                "session.woke",
+                "session.stopped",
+                "session.crashed",
+                "session.draining",
+                "session.undrained",
+                "session.quarantined",
+                "session.idle_killed",
+                "session.suspended",
+                "session.updated",
+                "bead.created",
+                "bead.closed",
+                "bead.updated",
+                "mail.sent",
+                "mail.read",
+                "mail.archived",
+                "mail.marked_read",
+                "mail.marked_unread",
+                "mail.replied",
+                "mail.deleted",
+                "convoy.created",
+                "convoy.closed",
+                "controller.started",
+                "controller.stopped",
+                "city.suspended",
+                "city.resumed",
+                "request.result.city.create",
+                "request.result.city.unregister",
+                "request.result.session.create",
+                "request.result.session.message",
+                "request.result.session.submit",
+                "request.failed",
+                "city.created",
+                "city.unregister_requested",
+                "order.fired",
+                "order.completed",
+                "order.failed",
+                "provider.swapped",
+                "worker.operation",
+                "extmsg.bound",
+                "extmsg.unbound",
+                "extmsg.group_created",
+                "extmsg.adapter_added",
+                "extmsg.adapter_removed",
+                "extmsg.inbound",
+                "extmsg.outbound"
+              ]
+            },
             "type": "string"
           },
           "workflow": {
@@ -7201,10 +7383,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope controller.started",
+        "title": "TypedEventStreamEnvelope custom",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeControllerStopped": {
+      "TypedEventStreamEnvelopeExtmsgAdapterAdded": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7214,7 +7396,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7229,7 +7411,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.stopped",
+            "const": "extmsg.adapter_added",
             "type": "string"
           },
           "workflow": {
@@ -7243,10 +7425,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope controller.stopped",
+        "title": "TypedEventStreamEnvelope extmsg.adapter_added",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeConvoyClosed": {
+      "TypedEventStreamEnvelopeExtmsgAdapterRemoved": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7256,7 +7438,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7271,7 +7453,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.closed",
+            "const": "extmsg.adapter_removed",
             "type": "string"
           },
           "workflow": {
@@ -7285,10 +7467,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope convoy.closed",
+        "title": "TypedEventStreamEnvelope extmsg.adapter_removed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeConvoyCreated": {
+      "TypedEventStreamEnvelopeExtmsgBound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7298,7 +7480,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/BoundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7313,7 +7495,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.created",
+            "const": "extmsg.bound",
             "type": "string"
           },
           "workflow": {
@@ -7327,10 +7509,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope convoy.created",
+        "title": "TypedEventStreamEnvelope extmsg.bound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgAdapterAdded": {
+      "TypedEventStreamEnvelopeExtmsgGroupCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7340,7 +7522,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7355,7 +7537,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_added",
+            "const": "extmsg.group_created",
             "type": "string"
           },
           "workflow": {
@@ -7369,10 +7551,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.adapter_added",
+        "title": "TypedEventStreamEnvelope extmsg.group_created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgAdapterRemoved": {
+      "TypedEventStreamEnvelopeExtmsgInbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7382,7 +7564,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/InboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7397,7 +7579,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_removed",
+            "const": "extmsg.inbound",
             "type": "string"
           },
           "workflow": {
@@ -7411,10 +7593,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.adapter_removed",
+        "title": "TypedEventStreamEnvelope extmsg.inbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgBound": {
+      "TypedEventStreamEnvelopeExtmsgOutbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7424,7 +7606,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/BoundEventPayload"
+            "$ref": "#/components/schemas/OutboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7439,7 +7621,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.bound",
+            "const": "extmsg.outbound",
             "type": "string"
           },
           "workflow": {
@@ -7453,10 +7635,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.bound",
+        "title": "TypedEventStreamEnvelope extmsg.outbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgGroupCreated": {
+      "TypedEventStreamEnvelopeExtmsgUnbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7466,7 +7648,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/GroupCreatedEventPayload"
+            "$ref": "#/components/schemas/UnboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7481,7 +7663,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.group_created",
+            "const": "extmsg.unbound",
             "type": "string"
           },
           "workflow": {
@@ -7495,10 +7677,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.group_created",
+        "title": "TypedEventStreamEnvelope extmsg.unbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgInbound": {
+      "TypedEventStreamEnvelopeMailArchived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7508,7 +7690,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/InboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7523,7 +7705,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.inbound",
+            "const": "mail.archived",
             "type": "string"
           },
           "workflow": {
@@ -7537,10 +7719,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.inbound",
+        "title": "TypedEventStreamEnvelope mail.archived",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgOutbound": {
+      "TypedEventStreamEnvelopeMailDeleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7550,7 +7732,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/OutboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7565,7 +7747,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.outbound",
+            "const": "mail.deleted",
             "type": "string"
           },
           "workflow": {
@@ -7579,10 +7761,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.outbound",
+        "title": "TypedEventStreamEnvelope mail.deleted",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgUnbound": {
+      "TypedEventStreamEnvelopeMailMarkedRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7592,7 +7774,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/UnboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7607,7 +7789,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.unbound",
+            "const": "mail.marked_read",
             "type": "string"
           },
           "workflow": {
@@ -7621,10 +7803,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.unbound",
+        "title": "TypedEventStreamEnvelope mail.marked_read",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailArchived": {
+      "TypedEventStreamEnvelopeMailMarkedUnread": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7649,7 +7831,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.archived",
+            "const": "mail.marked_unread",
             "type": "string"
           },
           "workflow": {
@@ -7663,10 +7845,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.archived",
+        "title": "TypedEventStreamEnvelope mail.marked_unread",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailDeleted": {
+      "TypedEventStreamEnvelopeMailRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7691,7 +7873,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.deleted",
+            "const": "mail.read",
             "type": "string"
           },
           "workflow": {
@@ -7705,10 +7887,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.deleted",
+        "title": "TypedEventStreamEnvelope mail.read",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailMarkedRead": {
+      "TypedEventStreamEnvelopeMailReplied": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7733,7 +7915,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_read",
+            "const": "mail.replied",
             "type": "string"
           },
           "workflow": {
@@ -7747,10 +7929,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.marked_read",
+        "title": "TypedEventStreamEnvelope mail.replied",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailMarkedUnread": {
+      "TypedEventStreamEnvelopeMailSent": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7775,7 +7957,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_unread",
+            "const": "mail.sent",
             "type": "string"
           },
           "workflow": {
@@ -7789,10 +7971,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.marked_unread",
+        "title": "TypedEventStreamEnvelope mail.sent",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailRead": {
+      "TypedEventStreamEnvelopeOrderCompleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7802,7 +7984,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7817,7 +7999,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.read",
+            "const": "order.completed",
             "type": "string"
           },
           "workflow": {
@@ -7831,10 +8013,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.read",
+        "title": "TypedEventStreamEnvelope order.completed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailReplied": {
+      "TypedEventStreamEnvelopeOrderFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7844,7 +8026,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7859,7 +8041,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.replied",
+            "const": "order.failed",
             "type": "string"
           },
           "workflow": {
@@ -7873,10 +8055,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.replied",
+        "title": "TypedEventStreamEnvelope order.failed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailSent": {
+      "TypedEventStreamEnvelopeOrderFired": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7886,7 +8068,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7901,7 +8083,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.sent",
+            "const": "order.fired",
             "type": "string"
           },
           "workflow": {
@@ -7915,10 +8097,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.sent",
+        "title": "TypedEventStreamEnvelope order.fired",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderCompleted": {
+      "TypedEventStreamEnvelopeProviderSwapped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7943,7 +8125,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.completed",
+            "const": "provider.swapped",
             "type": "string"
           },
           "workflow": {
@@ -7957,10 +8139,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.completed",
+        "title": "TypedEventStreamEnvelope provider.swapped",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderFailed": {
+      "TypedEventStreamEnvelopeRequestFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7970,7 +8152,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/RequestFailedPayload"
           },
           "seq": {
             "format": "int64",
@@ -7985,7 +8167,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.failed",
+            "const": "request.failed",
             "type": "string"
           },
           "workflow": {
@@ -7999,10 +8181,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.failed",
+        "title": "TypedEventStreamEnvelope request.failed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderFired": {
+      "TypedEventStreamEnvelopeRequestResultCityCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8012,7 +8194,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -8027,7 +8209,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.fired",
+            "const": "request.result.city.create",
             "type": "string"
           },
           "workflow": {
@@ -8041,10 +8223,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.fired",
+        "title": "TypedEventStreamEnvelope request.result.city.create",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeProviderSwapped": {
+      "TypedEventStreamEnvelopeRequestResultCityUnregister": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8054,7 +8236,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -8069,7 +8251,7 @@
             "type": "string"
           },
           "type": {
-            "const": "provider.swapped",
+            "const": "request.result.city.unregister",
             "type": "string"
           },
           "workflow": {
@@ -8083,7 +8265,133 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope provider.swapped",
+        "title": "TypedEventStreamEnvelope request.result.city.unregister",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionCreate": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.create",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.create",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionMessage": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.message",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.message",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionSubmit": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.submit",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.submit",
         "type": "object"
       },
       "TypedEventStreamEnvelopeSessionCrashed": {
@@ -8514,13 +8822,9 @@
             "bead.created": "#/components/schemas/TypedTaggedEventStreamEnvelopeBeadCreated",
             "bead.updated": "#/components/schemas/TypedTaggedEventStreamEnvelopeBeadUpdated",
             "city.created": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityCreated",
-            "city.init_failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityInitFailed",
-            "city.ready": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityReady",
             "city.resumed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityResumed",
             "city.suspended": "#/components/schemas/TypedTaggedEventStreamEnvelopeCitySuspended",
-            "city.unregister_failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterFailed",
             "city.unregister_requested": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterRequested",
-            "city.unregistered": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregistered",
             "controller.started": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStarted",
             "controller.stopped": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStopped",
             "convoy.closed": "#/components/schemas/TypedTaggedEventStreamEnvelopeConvoyClosed",
@@ -8543,6 +8847,12 @@
             "order.failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeOrderFailed",
             "order.fired": "#/components/schemas/TypedTaggedEventStreamEnvelopeOrderFired",
             "provider.swapped": "#/components/schemas/TypedTaggedEventStreamEnvelopeProviderSwapped",
+            "request.failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestFailed",
+            "request.result.city.create": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityCreate",
+            "request.result.city.unregister": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityUnregister",
+            "request.result.session.create": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionCreate",
+            "request.result.session.message": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionMessage",
+            "request.result.session.submit": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit",
             "session.crashed": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionCrashed",
             "session.draining": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionDraining",
             "session.idle_killed": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionIdleKilled",
@@ -8569,27 +8879,15 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityCreated"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityInitFailed"
-          },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityReady"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityResumed"
           },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCitySuspended"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterFailed"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterRequested"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregistered"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStarted"
           },
@@ -8656,6 +8954,24 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeProviderSwapped"
           },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestFailed"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityUnregister"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionMessage"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit"
+          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionCrashed"
           },
@@ -8685,6 +9001,9 @@
           },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCustom"
           }
         ],
         "title": "Typed supervisor event stream envelope"
@@ -8873,7 +9192,7 @@
         "title": "TypedTaggedEventStreamEnvelope city.created",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityInitFailed": {
+      "TypedTaggedEventStreamEnvelopeCityResumed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8886,7 +9205,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -8901,7 +9220,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.init_failed",
+            "const": "city.resumed",
             "type": "string"
           },
           "workflow": {
@@ -8916,10 +9235,56 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.init_failed",
+        "title": "TypedTaggedEventStreamEnvelope city.resumed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityReady": {
+      "TypedTaggedEventStreamEnvelopeCitySuspended": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "city.suspended",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope city.suspended",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeCityUnregisterRequested": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8947,7 +9312,53 @@
             "type": "string"
           },
           "type": {
-            "const": "city.ready",
+            "const": "city.unregister_requested",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope city.unregister_requested",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeControllerStarted": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "controller.started",
             "type": "string"
           },
           "workflow": {
@@ -8962,10 +9373,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.ready",
+        "title": "TypedTaggedEventStreamEnvelope controller.started",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityResumed": {
+      "TypedTaggedEventStreamEnvelopeControllerStopped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8993,7 +9404,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.resumed",
+            "const": "controller.stopped",
             "type": "string"
           },
           "workflow": {
@@ -9008,10 +9419,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.resumed",
+        "title": "TypedTaggedEventStreamEnvelope controller.stopped",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCitySuspended": {
+      "TypedTaggedEventStreamEnvelopeConvoyClosed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9039,7 +9450,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.suspended",
+            "const": "convoy.closed",
             "type": "string"
           },
           "workflow": {
@@ -9054,10 +9465,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.suspended",
+        "title": "TypedTaggedEventStreamEnvelope convoy.closed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregisterFailed": {
+      "TypedTaggedEventStreamEnvelopeConvoyCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9070,8 +9481,52 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "convoy.created",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope convoy.created",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeCustom": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
           },
+          "payload": {},
           "seq": {
             "format": "int64",
             "minimum": 0,
@@ -9085,7 +9540,55 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_failed",
+            "not": {
+              "enum": [
+                "session.woke",
+                "session.stopped",
+                "session.crashed",
+                "session.draining",
+                "session.undrained",
+                "session.quarantined",
+                "session.idle_killed",
+                "session.suspended",
+                "session.updated",
+                "bead.created",
+                "bead.closed",
+                "bead.updated",
+                "mail.sent",
+                "mail.read",
+                "mail.archived",
+                "mail.marked_read",
+                "mail.marked_unread",
+                "mail.replied",
+                "mail.deleted",
+                "convoy.created",
+                "convoy.closed",
+                "controller.started",
+                "controller.stopped",
+                "city.suspended",
+                "city.resumed",
+                "request.result.city.create",
+                "request.result.city.unregister",
+                "request.result.session.create",
+                "request.result.session.message",
+                "request.result.session.submit",
+                "request.failed",
+                "city.created",
+                "city.unregister_requested",
+                "order.fired",
+                "order.completed",
+                "order.failed",
+                "provider.swapped",
+                "worker.operation",
+                "extmsg.bound",
+                "extmsg.unbound",
+                "extmsg.group_created",
+                "extmsg.adapter_added",
+                "extmsg.adapter_removed",
+                "extmsg.inbound",
+                "extmsg.outbound"
+              ]
+            },
             "type": "string"
           },
           "workflow": {
@@ -9100,10 +9603,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregister_failed",
+        "title": "TypedTaggedEventStreamEnvelope custom",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregisterRequested": {
+      "TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9116,7 +9619,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9131,7 +9634,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_requested",
+            "const": "extmsg.adapter_added",
             "type": "string"
           },
           "workflow": {
@@ -9146,10 +9649,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregister_requested",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_added",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregistered": {
+      "TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9162,7 +9665,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9177,7 +9680,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregistered",
+            "const": "extmsg.adapter_removed",
             "type": "string"
           },
           "workflow": {
@@ -9192,10 +9695,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregistered",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_removed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeControllerStarted": {
+      "TypedTaggedEventStreamEnvelopeExtmsgBound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9208,7 +9711,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/BoundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9223,7 +9726,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.started",
+            "const": "extmsg.bound",
             "type": "string"
           },
           "workflow": {
@@ -9238,10 +9741,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope controller.started",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.bound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeControllerStopped": {
+      "TypedTaggedEventStreamEnvelopeExtmsgGroupCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9254,7 +9757,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9269,7 +9772,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.stopped",
+            "const": "extmsg.group_created",
             "type": "string"
           },
           "workflow": {
@@ -9284,10 +9787,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope controller.stopped",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.group_created",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeConvoyClosed": {
+      "TypedTaggedEventStreamEnvelopeExtmsgInbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9300,7 +9803,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/InboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9315,7 +9818,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.closed",
+            "const": "extmsg.inbound",
             "type": "string"
           },
           "workflow": {
@@ -9330,10 +9833,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope convoy.closed",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.inbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeConvoyCreated": {
+      "TypedTaggedEventStreamEnvelopeExtmsgOutbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9346,7 +9849,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/OutboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9361,7 +9864,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.created",
+            "const": "extmsg.outbound",
             "type": "string"
           },
           "workflow": {
@@ -9376,10 +9879,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope convoy.created",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.outbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded": {
+      "TypedTaggedEventStreamEnvelopeExtmsgUnbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9392,7 +9895,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/UnboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9407,7 +9910,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_added",
+            "const": "extmsg.unbound",
             "type": "string"
           },
           "workflow": {
@@ -9422,10 +9925,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_added",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.unbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved": {
+      "TypedTaggedEventStreamEnvelopeMailArchived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9438,7 +9941,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9453,7 +9956,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_removed",
+            "const": "mail.archived",
             "type": "string"
           },
           "workflow": {
@@ -9468,10 +9971,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_removed",
+        "title": "TypedTaggedEventStreamEnvelope mail.archived",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgBound": {
+      "TypedTaggedEventStreamEnvelopeMailDeleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9484,7 +9987,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/BoundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9499,7 +10002,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.bound",
+            "const": "mail.deleted",
             "type": "string"
           },
           "workflow": {
@@ -9514,10 +10017,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.bound",
+        "title": "TypedTaggedEventStreamEnvelope mail.deleted",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgGroupCreated": {
+      "TypedTaggedEventStreamEnvelopeMailMarkedRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9530,7 +10033,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/GroupCreatedEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9545,7 +10048,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.group_created",
+            "const": "mail.marked_read",
             "type": "string"
           },
           "workflow": {
@@ -9560,10 +10063,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.group_created",
+        "title": "TypedTaggedEventStreamEnvelope mail.marked_read",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgInbound": {
+      "TypedTaggedEventStreamEnvelopeMailMarkedUnread": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9576,7 +10079,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/InboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9591,7 +10094,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.inbound",
+            "const": "mail.marked_unread",
             "type": "string"
           },
           "workflow": {
@@ -9606,10 +10109,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.inbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.marked_unread",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgOutbound": {
+      "TypedTaggedEventStreamEnvelopeMailRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9622,7 +10125,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/OutboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9637,7 +10140,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.outbound",
+            "const": "mail.read",
             "type": "string"
           },
           "workflow": {
@@ -9652,10 +10155,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.outbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.read",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgUnbound": {
+      "TypedTaggedEventStreamEnvelopeMailReplied": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9668,7 +10171,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/UnboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9683,7 +10186,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.unbound",
+            "const": "mail.replied",
             "type": "string"
           },
           "workflow": {
@@ -9698,10 +10201,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.unbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.replied",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailArchived": {
+      "TypedTaggedEventStreamEnvelopeMailSent": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9729,7 +10232,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.archived",
+            "const": "mail.sent",
             "type": "string"
           },
           "workflow": {
@@ -9744,10 +10247,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.archived",
+        "title": "TypedTaggedEventStreamEnvelope mail.sent",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailDeleted": {
+      "TypedTaggedEventStreamEnvelopeOrderCompleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9760,7 +10263,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9775,7 +10278,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.deleted",
+            "const": "order.completed",
             "type": "string"
           },
           "workflow": {
@@ -9790,10 +10293,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.deleted",
+        "title": "TypedTaggedEventStreamEnvelope order.completed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailMarkedRead": {
+      "TypedTaggedEventStreamEnvelopeOrderFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9806,7 +10309,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9821,7 +10324,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_read",
+            "const": "order.failed",
             "type": "string"
           },
           "workflow": {
@@ -9836,10 +10339,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.marked_read",
+        "title": "TypedTaggedEventStreamEnvelope order.failed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailMarkedUnread": {
+      "TypedTaggedEventStreamEnvelopeOrderFired": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9852,7 +10355,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9867,7 +10370,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_unread",
+            "const": "order.fired",
             "type": "string"
           },
           "workflow": {
@@ -9882,10 +10385,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.marked_unread",
+        "title": "TypedTaggedEventStreamEnvelope order.fired",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailRead": {
+      "TypedTaggedEventStreamEnvelopeProviderSwapped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9898,7 +10401,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9913,7 +10416,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.read",
+            "const": "provider.swapped",
             "type": "string"
           },
           "workflow": {
@@ -9928,10 +10431,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.read",
+        "title": "TypedTaggedEventStreamEnvelope provider.swapped",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailReplied": {
+      "TypedTaggedEventStreamEnvelopeRequestFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9944,7 +10447,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/RequestFailedPayload"
           },
           "seq": {
             "format": "int64",
@@ -9959,7 +10462,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.replied",
+            "const": "request.failed",
             "type": "string"
           },
           "workflow": {
@@ -9974,10 +10477,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.replied",
+        "title": "TypedTaggedEventStreamEnvelope request.failed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailSent": {
+      "TypedTaggedEventStreamEnvelopeRequestResultCityCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9990,7 +10493,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10005,7 +10508,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.sent",
+            "const": "request.result.city.create",
             "type": "string"
           },
           "workflow": {
@@ -10020,10 +10523,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.sent",
+        "title": "TypedTaggedEventStreamEnvelope request.result.city.create",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderCompleted": {
+      "TypedTaggedEventStreamEnvelopeRequestResultCityUnregister": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10036,7 +10539,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10051,7 +10554,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.completed",
+            "const": "request.result.city.unregister",
             "type": "string"
           },
           "workflow": {
@@ -10066,10 +10569,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.completed",
+        "title": "TypedTaggedEventStreamEnvelope request.result.city.unregister",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderFailed": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10082,7 +10585,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10097,7 +10600,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.failed",
+            "const": "request.result.session.create",
             "type": "string"
           },
           "workflow": {
@@ -10112,10 +10615,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.failed",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.create",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderFired": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionMessage": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10128,7 +10631,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10143,7 +10646,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.fired",
+            "const": "request.result.session.message",
             "type": "string"
           },
           "workflow": {
@@ -10158,10 +10661,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.fired",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.message",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeProviderSwapped": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10174,7 +10677,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10189,7 +10692,7 @@
             "type": "string"
           },
           "type": {
-            "const": "provider.swapped",
+            "const": "request.result.session.submit",
             "type": "string"
           },
           "workflow": {
@@ -10204,7 +10707,7 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope provider.swapped",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.submit",
         "type": "object"
       },
       "TypedTaggedEventStreamEnvelopeSessionCrashed": {
@@ -10684,82 +11187,6 @@
         ],
         "type": "object"
       },
-      "WireEvent": {
-        "additionalProperties": false,
-        "properties": {
-          "actor": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
-          },
-          "payload": {
-            "$ref": "#/components/schemas/EventPayload"
-          },
-          "seq": {
-            "format": "int64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "subject": {
-            "type": "string"
-          },
-          "ts": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "seq",
-          "type",
-          "ts",
-          "actor"
-        ],
-        "type": "object"
-      },
-      "WireTaggedEvent": {
-        "additionalProperties": false,
-        "properties": {
-          "actor": {
-            "type": "string"
-          },
-          "city": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
-          },
-          "payload": {
-            "$ref": "#/components/schemas/EventPayload"
-          },
-          "seq": {
-            "format": "int64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "subject": {
-            "type": "string"
-          },
-          "ts": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city",
-          "seq",
-          "type",
-          "ts",
-          "actor"
-        ],
-        "type": "object"
-      },
       "WorkerOperationEventPayload": {
         "additionalProperties": false,
         "properties": {
@@ -11279,7 +11706,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CityCreateResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedResponse"
                 }
               }
             },
@@ -12654,6 +13081,7 @@
         "summary": "Get v0 city by city name agents"
       },
       "post": {
+        "description": "Creates an agent and waits until it is visible to immediate follow-up operations. If the agent is durably created but visibility confirmation is canceled or times out, the retryable 503/504 response includes a Retry-After header.",
         "operationId": "create-agent",
         "parameters": [
           {
@@ -14738,7 +15166,7 @@
     },
     "/v0/city/{cityName}/events/stream": {
       "get": {
-        "description": "Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param.",
+        "description": "Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param; omitting both starts at the current city event head.",
         "operationId": "stream-events",
         "parameters": [
           {
@@ -14754,21 +15182,21 @@
             }
           },
           {
-            "description": "Reconnect position: only deliver events after this sequence number.",
+            "description": "Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.",
             "explode": false,
             "in": "query",
             "name": "after_seq",
             "schema": {
-              "description": "Reconnect position: only deliver events after this sequence number.",
+              "description": "Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.",
               "type": "string"
             }
           },
           {
-            "description": "SSE reconnect position from the last received event ID.",
+            "description": "SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.",
             "in": "header",
             "name": "Last-Event-ID",
             "schema": {
-              "description": "SSE reconnect position from the last received event ID.",
+              "description": "SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.",
               "type": "string"
             }
           }
@@ -16822,12 +17250,12 @@
             }
           },
           {
-            "description": "Thread ID.",
+            "description": "Thread ID, or any message ID in the thread.",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Thread ID.",
+              "description": "Thread ID, or any message ID in the thread.",
               "type": "string"
             }
           },
@@ -17743,6 +18171,16 @@
               "pattern": "\\S",
               "type": "string"
             }
+          },
+          {
+            "description": "Bypass cached order-check responses and cached order history.",
+            "explode": false,
+            "in": "query",
+            "name": "fresh",
+            "schema": {
+              "description": "Bypass cached order-check responses and cached order history.",
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -20743,7 +21181,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionMessageOutputBody"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -21365,7 +21803,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionSubmitOutputBody"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -21523,6 +21961,16 @@
               "description": "Pagination cursor: return entries before this UUID.",
               "type": "string"
             }
+          },
+          {
+            "description": "Pagination cursor: return entries after this UUID.",
+            "explode": false,
+            "in": "query",
+            "name": "after",
+            "schema": {
+              "description": "Pagination cursor: return entries after this UUID.",
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -21794,7 +22242,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -22008,7 +22456,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CityUnregisterResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedResponse"
                 }
               }
             },
@@ -22313,24 +22761,25 @@
     },
     "/v0/events/stream": {
       "get": {
+        "description": "Server-Sent Events stream of supervisor-tagged events. Supports reconnection via Last-Event-ID header or after_cursor query param; omitting both starts at the current supervisor event head.",
         "operationId": "stream-supervisor-events",
         "parameters": [
           {
-            "description": "Reconnect cursor (composite per-city cursor).",
+            "description": "Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.",
             "in": "header",
             "name": "Last-Event-ID",
             "schema": {
-              "description": "Reconnect cursor (composite per-city cursor).",
+              "description": "Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.",
               "type": "string"
             }
           },
           {
-            "description": "Alternative to Last-Event-ID for browsers that can't set custom headers.",
+            "description": "Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.",
             "explode": false,
             "in": "query",
             "name": "after_cursor",
             "schema": {
-              "description": "Alternative to Last-Event-ID for browsers that can't set custom headers.",
+              "description": "Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.",
               "type": "string"
             }
           }
diff --git a/docs/troubleshooting/dolt-bloat-recovery.md b/docs/troubleshooting/dolt-bloat-recovery.md
index 7589902215..e1abbcf0db 100644
--- a/docs/troubleshooting/dolt-bloat-recovery.md
+++ b/docs/troubleshooting/dolt-bloat-recovery.md
@@ -34,9 +34,10 @@ and verifying the result.
 - **Free disk space.** Dolt GC rewrites chunks into a new store before
   swapping; budget at least **2× the current `.dolt/` size** in free space
   on the same filesystem.
-- **Dolt 1.86.1 or newer.** This matches the floor enforced by Gas City's
-  managed Dolt tooling and ensures the listener/config knobs used by the
-  pack plus modern auto-GC behavior are available. Check with
+- **Final Dolt 1.86.2 or newer.** This matches the floor enforced by Gas
+  City's managed Dolt tooling and avoids the upstream GC/writer deadlock fixed
+  in dolthub/dolt commit `ccf7bde206`, which can hang `dolt_backup sync` under
+  heavy write load. Check with
   `dolt version`. If your binary rejects `--archive-level=1` (rare on
   modern releases), drop the flag and run plain
   `dolt gc` — archive compression is default-on in 1.75+ so the flag is
@@ -81,9 +82,9 @@ If GC finishes but the size barely moves, the chunks are nearly all live
 
 ## Prevention
 
-- **Keep Dolt at 1.86.1 or newer.** This matches Gas City's managed-Dolt
-  floor; newer releases ship improved auto-GC
-  heuristics and default archive compression.
+- **Keep Dolt at a final 1.86.2 or newer.** This matches Gas City's
+  managed-Dolt floor; newer releases ship improved auto-GC heuristics and
+  default archive compression.
 - **Let the dolt pack's `dolt-gc-nudge` order run continuously.** It
   ships embedded in the dolt pack and fires `CALL DOLT_GC()` every 1h
   by default, unconditionally. Gas City's managed-Dolt launch path now
diff --git a/docs/tutorials/06-beads.md b/docs/tutorials/06-beads.md
index d418ed79fa..ce4f5094d1 100644
--- a/docs/tutorials/06-beads.md
+++ b/docs/tutorials/06-beads.md
@@ -381,18 +381,20 @@ Set target of convoy mc-zk1 to develop
 
 ## How agents find work
 
-This is where beads connect to the runtime. Agents discover work through _hooks_
-— shell commands that run between turns and check for available beads.
+This is where beads connect to the runtime. Routed agents discover work through
+the claim protocol rendered into their session startup prompt. The protocol asks
+`gc hook` for eligible work, claims one bead with `bd update --claim`, and then
+the agent runs exactly that bead. The legacy Stop-hook form, `gc hook --inject`,
+is silent compatibility behavior and no longer injects work into the agent.
 
 The typical flow:
 
 1. Work is created (via `bd create`, `gc sling`, formula cook, etc.)
 2. Work is routed to an agent (via assignee or `gc.routed_to` metadata)
-3. Agent's hook runs a _work query_ and looks for matching ready beads
-4. If work is found, the hook injects it into the agent's context as a system
-   reminder
-5. The agent sees the work and acts on it (GUPP: "if you find work on your hook,
-   you run it")
+3. Session startup runs the agent's _work query_ through `gc hook`
+4. The claim protocol atomically claims one ready bead
+5. The agent sees the claimed work and acts on it (GUPP: "if you find work on
+   your hook, you run it")
 
 For routed pool work, the query checks metadata instead of assignee:
 
diff --git a/docs/tutorials/07-orders.md b/docs/tutorials/07-orders.md
index 312469e9ba..e2d47a70a4 100644
--- a/docs/tutorials/07-orders.md
+++ b/docs/tutorials/07-orders.md
@@ -327,8 +327,40 @@ schedule = "0 6 * * *"
 ```
 
 Overrides can change `enabled`, `trigger`, `interval`, `schedule`, `check`, `on`,
-`pool`, and `timeout`. The override matches by order name — if no order with
-that name exists, it's an error (fail-fast, not silent).
+`pool`, and `timeout`. The override matches by order name. An override that
+targets a nonexistent order produces an error rather than silently no-opping
+— `gc order` CLI commands fail; `gc start` logs the error and continues
+running with the unmatched override skipped.
+
+### Rig scoping
+
+Many orders expand at scan time into one instance per rig (anything in a
+rig's `orders/` directory or a pack imported into a rig). When the same
+order appears city-wide AND per-rig, an override must say which:
+
+```toml
+# Targets ONLY the city-level instance. Per-rig copies are unaffected.
+[[orders.overrides]]
+name = "patrol"
+enabled = false
+
+# Targets ONLY the demo-repo rig's copy.
+[[orders.overrides]]
+name = "patrol"
+rig = "demo-repo"
+enabled = false
+
+# Wildcard: targets every instance — city-level + all rig copies.
+[[orders.overrides]]
+name = "patrol"
+rig = "*"
+enabled = false
+```
+
+A rigless override against a name that exists ONLY as per-rig copies is an
+error; the message names the rigs so you know what to type. The literal
+`"*"` is reserved as the wildcard token and may not be used as a real rig
+name.
 
 ## Order history
 
diff --git a/engdocs/architecture/api-control-plane.md b/engdocs/architecture/api-control-plane.md
index e0dd0b69da..0b49140db1 100644
--- a/engdocs/architecture/api-control-plane.md
+++ b/engdocs/architecture/api-control-plane.md
@@ -32,18 +32,19 @@ invariants.
 
 City initialization is a worked example: the HTTP handler for
 `POST /v0/city` does **not** shell out to `gc init`; it calls
-`cityinit.Initializer.Scaffold` in-process, which is the same
-entry point the CLI drives. The scaffolded city registers with
+`cityinit.Service.Scaffold` in-process, and the CLI drives the same
+`cityinit.Service.Init` contract. The scaffolded city registers with
 the supervisor synchronously before `202 Accepted` returns; the
-reconciler runs the slow finalize later and publishes `city.ready`
-/ `city.init_failed` events. Both projections live on the same
-typed contract and error sentinels
-(`cityinit.ErrAlreadyInitialized`, `ErrInvalidProvider`,
-`ErrMissingDependency`, `ErrProviderNotReady`,
+reconciler runs the slow finalize later and publishes a
+`request.result` event. Both projections live on the same typed
+contract and error sentinels (`cityinit.ErrAlreadyInitialized`,
+`ErrInvalidProvider`, `ErrMissingDependency`, `ErrProviderNotReady`,
 `ErrInvalidBootstrapProfile`). Long-running mutations in general
-follow this shape: scaffold synchronously, return 202, publish
-completion events — subscribers watch the event stream instead of
-polling.
+follow this shape: validate and create intent synchronously, return
+202 with a `request_id`, run the expensive work in a background
+goroutine, publish a `request.result` event on completion or
+failure — subscribers watch the event stream instead of polling.
+See `engdocs/design/async-request-result.md` for the full pattern.
 
 ```
 cmd/gc/cmd_*.go               internal/api/handler_*.go
@@ -107,6 +108,14 @@ Every HTTP + SSE endpoint is registered through Huma against
 annotated Go types. Huma generates the OpenAPI 3.1 spec from those
 types; the spec drives everything downstream.
 
+Per-city routes are available only after the supervisor resolver
+returns a running `State` for that city. During supervisor startup a
+city may appear in `GET /v0/cities` with `running=false` and a startup
+status such as `starting_agents`; `/v0/city/{cityName}/...` requests in
+that window return `404` with the typed not-found problem detail. The
+city list and lifecycle events are the readiness boundary for clients
+that need to issue per-city requests.
+
 ### The generated Go client
 
 `internal/api/genclient/` has three in-tree consumer categories,
@@ -644,7 +653,7 @@ rename or remove a cited symbol (`events.KnownEventTypes`,
 `EventPayloadUnion`, `TestEveryKnownEventTypeHasRegisteredPayload`,
 `cmd/gc/apiroute.go:apiClient()`, `addMutationCSRFParam`,
 `registerFrameworkHeaders`, `sseResponseHeaders`,
-`OptionalParam`, `cityinit.Initializer`, `cityinit.InitRequest`,
+`OptionalParam`, `cityinit.Service`, `cityinit.InitRequest`,
 `cityinit.InitResult`, `cityinit.UnregisterRequest`,
 `cityinit.UnregisterResult`, `cityinit.ErrNotRegistered`,
 `TransientCityEventSource`, etc.), **update this document in the same
diff --git a/engdocs/architecture/controller.md b/engdocs/architecture/controller.md
index 887e902fec..2eebd9fcda 100644
--- a/engdocs/architecture/controller.md
+++ b/engdocs/architecture/controller.md
@@ -3,7 +3,7 @@ title: "Controller"
 ---
 
 
-> Last verified against code: 2026-03-01
+> Last verified against code: 2026-04-25
 
 ## Summary
 
@@ -53,7 +53,7 @@ automations, and garbage-collects expired wisps.
 
 The controller is implemented entirely in `cmd/gc/` as a set of
 collaborating functions and interfaces -- not as a standalone package.
-It composes primitives (Agent Protocol, Config, Event Bus, Beads, Prompts)
+It composes primitives (Session, Config, Event Bus, Beads, Prompts)
 into the runtime orchestration loop.
 
 ### Data Flow
@@ -83,11 +83,12 @@ gc start --foreground
   │           └─ ticker loop:
   │                 ├─ if dirty: tryReloadConfig() + rebuild trackers
   │                 ├─ buildAgents(cfg)  →  evaluate pools in parallel
-  │                 ├─ doReconcileAgents()
+  │                 ├─ reconcileSessionBeads()
   │                 ├─ wispGC.runGC()
   │                 └─ orderDispatcher.dispatch()
   │
   └─ shutdown:
+        ├─ orderDispatcher.drain(ctx) →  wait for in-flight order goroutines
         ├─ gracefulStopAll()         →  interrupt → wait → kill
         ├─ record controller.stopped event
         └─ release lock + remove socket + pid
@@ -110,8 +111,8 @@ Each tick of `controllerLoop()` (`cmd/gc/controller.go:268-320`) performs:
    individually. Each agent gets its environment, prompt, hooks, overlay,
    and session setup expanded.
 
-3. **Reconciliation** (`doReconcileAgents()`): Declarative convergence --
-   make running sessions match the desired list. See
+3. **Reconciliation** (`reconcileSessionBeads()`): Declarative convergence --
+   make session beads and running sessions match the desired list. See
    [Health Patrol](health-patrol.md) for the reconciliation state machine,
    crash loop quarantine, and idle tracking details.
 
@@ -178,7 +179,7 @@ indicate bugs.
   goroutines. Results are processed sequentially after `wg.Wait()`.
 
 - **Supervisor-managed and standalone runtimes share reconciliation code**:
-  `CityRuntime.run()` and `doReconcileAgents()` power both the
+  `CityRuntime.run()` and `reconcileSessionBeads()` power both the
   machine-wide supervisor path and the hidden standalone
   `gc start --foreground` path.
 
@@ -234,7 +235,8 @@ All controller implementation lives in `cmd/gc/`:
 | `cmd/gc/cmd_supervisor.go` | Machine-wide supervisor lifecycle, registry reconciliation, API hosting, and child `CityRuntime` management |
 | `cmd/gc/cmd_stop.go` | `cmdStop()`, `tryStopController()` (Unix socket IPC), `doStop()`, `gracefulStopAll()` |
 | `cmd/gc/cmd_suspend.go` | `doSuspendCity()` (sets `workspace.suspended` in TOML), `citySuspended()`, `isAgentEffectivelySuspended()` |
-| `cmd/gc/reconcile.go` | `reconcileOps` interface, `doReconcileAgents()` (4-state reconciliation + parallel starts + orphan cleanup) |
+| `cmd/gc/session_reconciler.go` | `reconcileSessionBeads()` bead-driven state machine for desired/live convergence, orphan/suspended drains, crash handling, idle drains, and config-drift repair |
+| `cmd/gc/session_lifecycle_parallel.go` | Dependency-aware bounded parallel session starts and force-stops |
 | `cmd/gc/pool.go` | `evaluatePool()`, `poolAgents()`, `expandSessionSetup()`, `expandDirTemplate()` |
 | `cmd/gc/providers.go` | `newSessionProvider()`, `beadsProvider()`, `newMailProvider()`, `newEventsProvider()` |
 | `cmd/gc/beads_provider_lifecycle.go` | `ensureBeadsProvider()`, `shutdownBeadsProvider()`, `initBeadsForDir()` |
@@ -304,7 +306,8 @@ Controller tests use in-memory fakes and require no external infrastructure:
 | Test file | Coverage |
 |---|---|
 | `cmd/gc/controller_test.go` | Controller loop tick behavior, config reload, dirty flag, fsnotify debounce, tracker rebuild on reload, order dispatch integration |
-| `cmd/gc/reconcile_test.go` | All reconciliation states, parallel starts, zombie capture, crash quarantine integration, idle restart, pool drain, suspended agent handling, orphan cleanup |
+| `cmd/gc/session_reconciler_test.go` | Session reconciliation states, zombie capture, crash quarantine integration, idle drains, pool drain, suspended session handling, orphan cleanup |
+| `cmd/gc/session_lifecycle_parallel_test.go` | Dependency-aware bounded parallel starts and force-stops |
 | `cmd/gc/pool_test.go` | `evaluatePool()` (clamping, error handling), `poolAgents()` (naming, deep-copy), `expandSessionSetup()`, `expandDirTemplate()` |
 | `cmd/gc/formula_resolve_test.go` | Layer priority, symlink creation/update/cleanup, idempotence, real file preservation |
 | `cmd/gc/wisp_gc_test.go` | TTL-based purging, `shouldRun()` interval, empty list handling |
diff --git a/engdocs/architecture/dispatch.md b/engdocs/architecture/dispatch.md
index c02fd4a7aa..3c7e4cfdb8 100644
--- a/engdocs/architecture/dispatch.md
+++ b/engdocs/architecture/dispatch.md
@@ -2,12 +2,12 @@
 title: "Dispatch (Sling)"
 ---
 
-> Last verified against code: 2026-03-01
+> Last verified against code: 2026-04-25
 
 ## Summary
 
 Dispatch is Gas City's work routing mechanism -- a Layer 2-4 derived
-mechanism that composes primitives (Agent Protocol, Bead Store, Event Bus,
+mechanism that composes primitives (Session, Bead Store, Event Bus,
 Config) to route work to agents. The `gc sling` command resolves a target
 agent or pool, optionally instantiates a formula as a wisp, executes the
 agent's sling query to route each bead, optionally wraps single beads in
@@ -183,7 +183,8 @@ CLI layer (cmd/gc/cmd_sling.go)
 | `internal/beads` (Store) | `MolCook` for wisp instantiation, `Create` for auto-convoy, `Get`/`Children` for container expansion, `Update` for ParentID linking, `SetMetadata` for merge strategy |
 | `internal/config` | Agent resolution, `EffectiveSlingQuery`, pool detection via `IsPool`, `PoolConfig` for sizing, `Suspended` flag |
 | `internal/runtime` | `Provider.IsRunning` and `Provider.Nudge` for agent nudging via `doSlingNudge` |
-| `internal/agent` | `SessionNameFor` to compute session names, `agent.New` + `Nudge` to deliver nudge text |
+| `internal/agent` | `SessionNameFor` to compute session names |
+| `internal/worker` | `Handle.Nudge` at the worker boundary for direct nudge delivery |
 | `internal/telemetry` | `RecordSling` for metrics and log events on every dispatch |
 | `cmd/gc/cmd_agent.go` | `resolveAgentIdentity` for 2-step target resolution (literal then contextual) |
 
diff --git a/engdocs/architecture/event-bus.md b/engdocs/architecture/event-bus.md
index 439baeb2d9..effa268a93 100644
--- a/engdocs/architecture/event-bus.md
+++ b/engdocs/architecture/event-bus.md
@@ -3,7 +3,7 @@ title: "Event Bus"
 ---
 
 
-> Last verified against code: 2026-03-01
+> Last verified against code: 2026-04-25
 
 ## Summary
 
@@ -223,13 +223,16 @@ are enforced by the conformance suite in
 | Depended on by | How |
 |---|---|
 | `cmd/gc/controller.go` | Records `controller.started` and `controller.stopped` events at lifecycle boundaries; passes `Recorder` to reconciliation and shutdown |
-| `cmd/gc/reconcile.go` | Records `agent.started`, `agent.stopped`, `agent.crashed`, `agent.idle_killed`, `agent.quarantined`, `agent.suspended` events during reconciliation |
+| `cmd/gc/session_lifecycle_parallel.go` | Records `session.woke` and parallel lifecycle `session.stopped` events (renamed from `agent.*` by `be8debd8`) |
+| `cmd/gc/session_reconciler.go` | Records `session.crashed`, `session.draining`, `session.idle_killed`, `session.stopped`, and `session.updated` while reconciling session beads |
+| `cmd/gc/cmd_runtime_drain.go` | Records manual `session.draining` and `session.undrained` events |
+| `cmd/gc/cmd_handoff.go` | Records handoff-related `session.draining` and `session.stopped` events |
 | `cmd/gc/order_dispatch.go` | Records `order.fired`, `order.completed`, `order.failed` events during order dispatch |
 | `cmd/gc/cmd_events.go` | CLI `gc events` command: reads and displays events with filtering (`--type`, `--since`), watch mode (`--watch`), and sequence query (`--seq`) |
 | `cmd/gc/cmd_event_emit.go` | CLI `gc event emit` command: records custom events from scripts and bd hooks (best-effort, always exits 0) |
-| `cmd/gc/cmd_agent.go` | Records agent lifecycle events during start/stop/restart operations |
+| `cmd/gc/cmd_agent.go` | Records session lifecycle events during start/stop/restart operations |
 | `cmd/gc/cmd_suspend.go` | Records `city.suspended` and `city.resumed` events |
-| `cmd/gc/cmd_mail.go` | Records `mail.sent` and `mail.read` events |
+| `cmd/gc/cmd_mail.go` | Records CLI `mail.*` events for send, read, archive, reply, mark-read/unread, and delete operations |
 | `cmd/gc/cmd_convoy.go` | Records `convoy.created` and `convoy.closed` events |
 | `internal/orders/triggers.go` | Event triggers query the Provider via `List(Filter{Type, AfterSeq})` to check if matching events exist since the last cursor position |
 
@@ -252,32 +255,57 @@ are enforced by the conformance suite in
 
 ### Event Type Constants
 
-All event type constants are defined in `internal/events/events.go`:
+All event type constants in `events.KnownEventTypes` are defined in
+`internal/events/events.go` and must have a registered payload for the
+API/SSE projection:
 
 | Constant | Value | Emitted by |
 |---|---|---|
-| `AgentStarted` | `agent.started` | Controller reconciliation on agent start |
-| `AgentStopped` | `agent.stopped` | Controller reconciliation on agent stop, shutdown, or drain completion |
-| `AgentCrashed` | `agent.crashed` | Controller reconciliation when a running agent's process is gone |
-| `AgentDraining` | `agent.draining` | Agent drain command |
-| `AgentUndrained` | `agent.undrained` | Agent undrain command |
-| `AgentQuarantined` | `agent.quarantined` | Controller when crash loop threshold exceeded |
-| `AgentIdleKilled` | `agent.idle_killed` | Controller when idle timeout exceeded |
-| `AgentSuspended` | `agent.suspended` | Controller when agent is suspended via config |
+| `SessionWoke` | `session.woke` | `cmd/gc/session_lifecycle_parallel.go` when a reconciler start succeeds |
+| `SessionStopped` | `session.stopped` | `cmd/gc/session_lifecycle_parallel.go`, `cmd/gc/session_reconciler.go`, `cmd/gc/controller.go`, `cmd/gc/cmd_handoff.go`, `cmd/gc/cmd_session.go` |
+| `SessionCrashed` | `session.crashed` | `cmd/gc/session_reconciler.go` when a runtime exists but the expected child process is gone |
+| `SessionDraining` | `session.draining` | `cmd/gc/session_reconciler.go`, `cmd/gc/cmd_runtime_drain.go`, `cmd/gc/cmd_handoff.go` |
+| `SessionUndrained` | `session.undrained` | `cmd/gc/cmd_runtime_drain.go` |
+| `SessionQuarantined` | `session.quarantined` | Registered/reserved; no production emitter today |
+| `SessionIdleKilled` | `session.idle_killed` | `cmd/gc/session_reconciler.go` when idle timeout handling stops a session |
+| `SessionSuspended` | `session.suspended` | Registered/reserved; no production emitter today |
+| `SessionUpdated` | `session.updated` | `cmd/gc/session_reconciler.go` on live-only config drift repair |
 | `BeadCreated` | `bead.created` | Bead creation hooks |
 | `BeadClosed` | `bead.closed` | Bead close hooks |
 | `BeadUpdated` | `bead.updated` | Bead update hooks |
-| `MailSent` | `mail.sent` | Mail send command |
+| `MailSent` | `mail.sent` | Mail send/API handlers and handoff command |
 | `MailRead` | `mail.read` | Mail read command |
+| `MailArchived` | `mail.archived` | Mail archive command and API handler |
+| `MailMarkedRead` | `mail.marked_read` | Mail mark-read command and API handler |
+| `MailMarkedUnread` | `mail.marked_unread` | Mail mark-unread command and API handler |
+| `MailReplied` | `mail.replied` | Mail reply command and API handler |
+| `MailDeleted` | `mail.deleted` | Mail delete command and API handler |
 | `ConvoyCreated` | `convoy.created` | Convoy creation |
 | `ConvoyClosed` | `convoy.closed` | Convoy close |
 | `ControllerStarted` | `controller.started` | Controller startup |
 | `ControllerStopped` | `controller.stopped` | Controller shutdown |
 | `CitySuspended` | `city.suspended` | City suspend command |
 | `CityResumed` | `city.resumed` | City resume command |
-| `AutomationFired` | `order.fired` | Order dispatch when a trigger is due |
-| `AutomationCompleted` | `order.completed` | Order dispatch on successful completion |
-| `AutomationFailed` | `order.failed` | Order dispatch on failure |
+| `RequestResultCityCreate` | `request.result.city.create` | Supervisor/API city create completion |
+| `RequestResultCityUnregister` | `request.result.city.unregister` | Supervisor city unregister completion |
+| `RequestResultSessionCreate` | `request.result.session.create` | API async session create completion |
+| `RequestResultSessionMessage` | `request.result.session.message` | API async session message completion |
+| `RequestResultSessionSubmit` | `request.result.session.submit` | API async session submit completion |
+| `RequestFailed` | `request.failed` | Supervisor/API async request failure handlers |
+| `CityCreated` | `city.created` | City init lifecycle diagnostics |
+| `CityUnregisterRequested` | `city.unregister_requested` | City unregister lifecycle diagnostics |
+| `OrderFired` | `order.fired` | Order dispatch when a trigger is due |
+| `OrderCompleted` | `order.completed` | Order dispatch on successful completion |
+| `OrderFailed` | `order.failed` | Order dispatch on failure |
+| `ProviderSwapped` | `provider.swapped` | Controller provider-swap reload path |
+| `WorkerOperation` | `worker.operation` | Worker session handle and runtime handle operation tracing |
+| `ExtMsgBound` | `extmsg.bound` | External messaging bind handler |
+| `ExtMsgUnbound` | `extmsg.unbound` | External messaging unbind handler |
+| `ExtMsgGroupCreated` | `extmsg.group_created` | External messaging group ensure handler |
+| `ExtMsgAdapterAdded` | `extmsg.adapter_added` | External messaging adapter registration handler |
+| `ExtMsgAdapterRemoved` | `extmsg.adapter_removed` | External messaging adapter unregister handler |
+| `ExtMsgInbound` | `extmsg.inbound` | External messaging inbound adapter pipeline |
+| `ExtMsgOutbound` | `extmsg.outbound` | External messaging outbound adapter pipeline |
 
 ## Configuration
 
@@ -303,7 +331,7 @@ is a complete, self-contained JSON object:
 
 ```json
 {"seq":1,"type":"controller.started","ts":"2026-03-01T10:00:00Z","actor":"gc"}
-{"seq":2,"type":"agent.started","ts":"2026-03-01T10:00:01Z","actor":"gc","subject":"worker-1","message":"agent started successfully"}
+{"seq":2,"type":"session.woke","ts":"2026-03-01T10:00:01Z","actor":"gc","subject":"worker-1","message":"session woke successfully"}
 {"seq":3,"type":"bead.created","ts":"2026-03-01T10:00:05Z","actor":"human","subject":"gc-42","payload":{"title":"Fix bug","labels":["urgent"]}}
 ```
 
@@ -393,19 +421,22 @@ suite against a stateful jq-based mock script.
   compaction. For long-running cities, manual truncation or external
   log rotation is needed.
 
-- **ReadFiltered scans the entire file.** Every `List` call reads all
-  events from disk and filters in memory. There are no indexes. This
-  is acceptable at current scale but will degrade with very large event
-  logs. `ReadFrom` with byte offsets provides incremental reading for
-  the Watch path.
+- **ReadFiltered streams without indexes.** `ReadFiltered` scans the
+  JSONL file once, applies `Filter` as it reads, and stops early when a
+  positive direct-provider `Limit` is reached. There are still no
+  indexes, so broad time/type/actor/subject queries remain linear in the
+  event log until their limit is satisfied. `ReadFrom` with byte offsets
+  provides incremental reading for the Watch path.
 
 - **No event schema validation.** Event types are string constants with
   no runtime validation. Recording an event with a misspelled type
   succeeds silently.
 
-- **Filter does not support Subject.** The Filter struct supports Type,
-  Actor, Since, and AfterSeq but not Subject. Filtering by subject
-  requires post-filtering in the caller.
+- **Multiplexer limits are global post-merge caps.** The multiplexer
+  clears per-provider `Filter.Limit`, merges and sorts provider results,
+  then applies the global limit so cross-city ordering stays correct.
+  This means a multiplexer `Limit` does not cap work inside each
+  provider.
 
 - **Exec provider Watch is subprocess-lifetime-bound.** The exec
   watcher reads from a long-running subprocess's stdout. If the
@@ -416,8 +447,11 @@ suite against a stateful jq-based mock script.
 
 - [Architecture glossary](glossary.md) -- authoritative definitions of
   event bus, order, trigger, and other terms used in this document
+- [Event query primitives](event-query.md) -- `Filter` fields,
+  streaming read semantics, multiplexer limit behavior, and aggregation
+  helpers
 - [Health Patrol architecture](health-patrol.md) -- how the controller
-  reconciliation loop records agent lifecycle events on every tick
+  reconciliation loop records session lifecycle events on every tick
 - [Bead Store architecture](beads.md) -- the other Layer 0-1 primitive;
   events and beads together provide persistence + observation
 - [Config architecture](config.md) -- how `[events].provider` is
diff --git a/engdocs/architecture/event-query.md b/engdocs/architecture/event-query.md
new file mode 100644
index 0000000000..1731f01a69
--- /dev/null
+++ b/engdocs/architecture/event-query.md
@@ -0,0 +1,105 @@
+# Event Query Primitives
+
+The `events` package provides a read-only query layer over the event bus.
+These primitives are pure functions — no I/O, no subscriptions — making them
+easy to compose and test.
+
+## Extended Filter
+
+`Filter` now supports six predicates plus a result cap:
+
+```go
+type Filter struct {
+    Type     string    // match events with this Type (e.g. "bead.created")
+    Actor    string    // match events with this Actor
+    Subject  string    // match events with this Subject (e.g. a bead ID)
+    Since    time.Time // match events at or after this time (inclusive)
+    Until    time.Time // match events at or before this time (inclusive)
+    AfterSeq uint64    // match events with Seq > AfterSeq
+    Limit    int       // cap results at this count (0 or negative = unlimited)
+}
+```
+
+Zero values are always ignored, so existing callers that set only `Type` or
+`Actor` continue to work without change.
+
+### Subject filter
+
+The most common diagnostic query: "what happened to bead gc-42?"
+
+```go
+evts, err := provider.List(events.Filter{Subject: "gc-42"})
+```
+
+### Until filter
+
+Pair `Since` and `Until` to query a time window:
+
+```go
+evts, err := provider.List(events.Filter{
+    Since: start,
+    Until: end,
+})
+```
+
+### Limit
+
+`Limit` caps the result slice to the first N matches in chronological scan
+order and stops scanning as soon as the cap is reached when the provider can do
+so locally. This is the earliest matching window, not the latest N events; use
+`ListTail` or caller-side tail slicing when a view needs the trailing window:
+
+```go
+firstCreated, err := provider.List(events.Filter{
+    Type:  events.BeadCreated,
+    Limit: 10,
+})
+```
+
+For `Multiplexer` calls, `Limit` is applied after provider results are merged
+and sorted by timestamp, city, then sequence. That preserves one deterministic
+global earliest-window ordering across cities, but it also means the cap does
+not bound each provider's local scan work.
+
+## Aggregation Helpers
+
+Three pure functions produce frequency maps over a `[]Event` slice:
+
+```go
+// CountByType returns type → count.
+func CountByType(evts []Event) map[string]int
+
+// CountByActor returns actor → count.
+func CountByActor(evts []Event) map[string]int
+
+// CountBySubject returns subject → count.
+func CountBySubject(evts []Event) map[string]int
+```
+
+These are intentionally simple. The caller drives composition:
+
+```go
+all, _ := provider.List(events.Filter{Since: yesterday})
+byType := events.CountByType(all)
+// byType["bead.created"] == 17
+// byType["session.woke"] == 5
+```
+
+## Implementation
+
+| Artifact | Purpose |
+|---|---|
+| `internal/events/reader.go` | `Filter` extended with `Subject`, `Until`, `Limit`; `matchesFilter` helper; `ReadFiltered` updated |
+| `internal/events/fake.go` | `Fake.List` updated to use `matchesFilter` and apply `Limit` |
+| `internal/events/exec/exec.go` | Exec provider keeps the legacy script filter JSON shape and applies SDK-side filtering after script output so old scripts cannot bypass new filter fields |
+| `internal/events/multiplexer.go` | Multiplexer applies `Limit` globally after deterministically merging and sorting provider results |
+| `internal/events/query.go` | `CountByType`, `CountByActor`, `CountBySubject` |
+| `internal/events/query_test.go` | Tests covering all new filter predicates and count helpers |
+
+`matchesFilter` is the predicate used by `ApplyFilter`, `ReadFiltered`, and the
+in-memory provider, ensuring code paths enforce the same predicate logic. The
+`exec` provider still passes the legacy `Type`/`Actor`/`Since`/`AfterSeq`
+filter shape to an external script as JSON for provider-side narrowing, but
+asks scripts for an unbounded result set and then applies the SDK filter
+locally. Scripts that don't recognize new fields can return unfiltered data;
+the in-process caller enforces `Subject`, `Until`, and `Limit` on its side.
diff --git a/engdocs/architecture/glossary.md b/engdocs/architecture/glossary.md
index ac3bada82b..6bbd2b52c8 100644
--- a/engdocs/architecture/glossary.md
+++ b/engdocs/architecture/glossary.md
@@ -6,15 +6,20 @@ Authoritative definitions of Gas City terms. If a term's usage
 elsewhere conflicts with this glossary, this glossary wins and the
 other source should be updated.
 
-> Last verified against code: 2026-03-01
+> Last verified against code: 2026-04-25
 
 ## Primitives
 
-- **Agent Protocol**: Start/stop/prompt/observe agents regardless of
-  session provider. Covers identity, pools, sandboxes, resume, and
-  crash adoption. Layer 0-1 primitive. See
-  [`internal/agent/`](https://github.com/gastownhall/gascity/tree/main/internal/agent/) and
+- **Session**: Start/stop/prompt/observe sessions regardless of
+  provider. Covers identity, pools, sandboxes, resume, and crash
+  adoption. Layer 0-1 primitive. Lifecycle lives in
+  [`internal/session/`](https://github.com/gastownhall/gascity/tree/main/internal/session/);
+  the runtime boundary is `runtime.Provider` in
   [`internal/runtime/`](https://github.com/gastownhall/gascity/tree/main/internal/runtime/).
+  Naming and startup hints live in
+  [`internal/agent/`](https://github.com/gastownhall/gascity/tree/main/internal/agent/).
+  Renamed from "Agent Protocol" by the session-first migration
+  (commit `dd90ac0a`, Mar 8 2026).
 
 - **Bead**: A single unit of work. Everything is a bead: tasks, mail,
   molecules, convoys, and epics. Defined in the `Bead` struct with ID,
@@ -70,7 +75,7 @@ other source should be updated.
   invocation only). See
   [`internal/orders/triggers.go`](https://github.com/gastownhall/gascity/blob/main/internal/orders/triggers.go).
 
-- **Health Patrol**: Ping agents (Agent Protocol), compare thresholds
+- **Health Patrol**: Probe sessions (Session), compare thresholds
   (Config), publish stalls (Event Bus), restart with backoff. The
   supervision model follows Erlang/OTP patterns.
 
@@ -87,8 +92,10 @@ other source should be updated.
   queryable by label via `ListByLabel`.
 
 - **Messaging**: Inter-agent communication composed from primitives.
-  Mail = `TaskStore.Create(bead{type:"message"})`. Nudge =
-  `AgentProtocol.SendPrompt()`. No new primitive needed.
+  Mail = `TaskStore.Create(bead{type:"message"})`. Nudge = a
+  session-layer operation implemented via `runtime.Provider.Nudge()`
+  (and exposed through `worker.Handle.Nudge()` at the worker
+  boundary). No new primitive needed.
 
 - **Molecule**: A formula instantiated at runtime: one root bead plus
   zero or more provider-managed step beads. Progress is tracked by closing
@@ -127,8 +134,8 @@ other source should be updated.
 - **Provider** (Session): Manages agent sessions. The `Provider`
   interface defines lifecycle (Start, Stop, Interrupt), querying
   (IsRunning, ProcessAlive), communication (Attach, Nudge, SendKeys),
-  and metadata (SetMeta, GetMeta). Implementations: tmux (production),
-  subprocess (remote), k8s (Kubernetes), Fake (test). See
+  and metadata (SetMeta, GetMeta). Implementations: tmux, subprocess,
+  exec, k8s, acp, auto, hybrid, and Fake (test). See
   [`internal/runtime/runtime.go`](https://github.com/gastownhall/gascity/blob/main/internal/runtime/runtime.go).
 
 - **Rig**: An external project directory registered in the city. Each
diff --git a/engdocs/architecture/health-patrol.md b/engdocs/architecture/health-patrol.md
index d7e7fb624f..72a17ea9ec 100644
--- a/engdocs/architecture/health-patrol.md
+++ b/engdocs/architecture/health-patrol.md
@@ -3,7 +3,7 @@ title: "Health Patrol"
 ---
 
 
-> Last verified against code: 2026-03-18
+> Last verified against code: 2026-04-25
 
 ## Summary
 
@@ -76,11 +76,11 @@ use):
                      │  └──────────────┬──────────────┘   │
                      │                 ▼                   │
                      │  ┌─────────────────────────────┐   │
-                     │  │ doReconcileAgents()          │   │
-                     │  │ (reconcile.go)               │   │
+                     │  │ reconcileSessionBeads()      │   │
+                     │  │ (session_reconciler.go)      │   │
                      │  │   ├─ crashTracker            │   │
                      │  │   ├─ idleTracker             │   │
-                     │  │   ├─ reconcileOps (drift)    │   │
+                     │  │   ├─ config drift repair     │   │
                      │  │   └─ drainOps (pool scaling) │   │
                      │  └──────────────┬──────────────┘   │
                      │                 ▼                   │
@@ -108,7 +108,7 @@ A single controller tick proceeds as follows:
 2. **Agent list build**. `buildFn(cfg)` re-evaluates the desired agent
    set, including pool `check` commands for elastic scaling.
 
-3. **Reconciliation** (`doReconcileAgents()`). The core state machine.
+3. **Reconciliation** (`reconcileSessionBeads()`). The core state machine.
    For each desired agent, determines the correct action. See the
    Reconciliation State Machine below.
 
@@ -121,18 +121,17 @@ A single controller tick proceeds as follows:
 
 ### Reconciliation State Machine
 
-`doReconcileAgents()` in `cmd/gc/reconcile.go` classifies each agent
-into one of four states and takes action:
+`reconcileSessionBeads()` in `cmd/gc/session_reconciler.go` reconciles
+session beads, runtime liveness, and desired config state:
 
 ```
 ┌──────────────────────────────────────────────────────────┐
 │ State              │ Condition         │ Action          │
 ├──────────────────────────────────────────────────────────┤
-│ Not running        │ !IsRunning()      │ Start           │
-│ Healthy            │ hash matches      │ Skip            │
-│ Orphan             │ running, not in   │ Stop            │
-│                    │ desired set       │                 │
-│ Drifted            │ hash differs      │ Stop + Start    │
+│ Not alive          │ should wake       │ Start           │
+│ Healthy            │ alive + desired   │ Skip            │
+│ Orphan/suspended   │ not desired       │ Drain or close  │
+│ Drifted            │ hash differs      │ Drain + restart │
 └──────────────────────────────────────────────────────────┘
 ```
 
@@ -141,18 +140,24 @@ Additional sub-states within "running" are checked in order:
 1. **Restart requested**: Agent self-requested restart (context
    exhaustion). Stop + start.
 2. **Idle timeout exceeded**: `idleTracker.checkIdle()` returns true.
-   Stop + start, emit `agent.idle_killed` event.
+   Stop the idle session and emit `session.idle_killed`.
 3. **Config drift**: Stored hash differs from current. Stop + start.
 
 Agents not running are subject to **crash loop quarantine**: if
 `crashTracker.isQuarantined()` returns true, the agent is skipped
-silently (the quarantine event was emitted when the threshold was first
-hit).
+silently. `session.quarantined` is a registered/reserved event type, but
+there is no production emitter today. Operators that need this signal
+must read the crash tracker quarantine state; subscribing to
+`session.quarantined` will not observe transitions yet.
 
 **Orphan cleanup** (Phase 2) handles sessions with the city prefix that
 are not in the desired set:
 - Pool excess members are drained gracefully via `drainOps`.
-- Suspended agents are stopped with an `agent.suspended` event.
+- Suspended agents are drained or closed as not desired; `session.suspended`
+  is a registered/reserved event type, but there is no production emitter
+  today. Suspension state is derived from `workspace.suspended`, rig
+  suspension, and agent suspension through `isAgentEffectivelySuspended()`,
+  not from `session.suspended` events.
 - True orphans are killed immediately.
 
 **Dependency-aware bounded parallel starts** (Phase 1b): The bead-driven
@@ -177,10 +182,9 @@ waves with bounded parallelism.
   `runtime.Provider.GetLastActivity()` and compares against per-agent
   timeout durations.
 
-- **`reconcileOps`** (`cmd/gc/reconcile.go`): Interface for
-  session-level operations needed by reconciliation: `listRunning()`,
-  `storeConfigHash()`, `configHash()`. Backed by
-  `runtime.Provider.SetMeta()`/`GetMeta()` for hash persistence.
+- **Session bead reconciler** (`cmd/gc/session_reconciler.go`):
+  Bead-driven convergence over desired config, session bead state, runtime
+  liveness, drain metadata, config hashes, and wake decisions.
 
 - **`orderDispatcher`** (`cmd/gc/order_dispatch.go`): Interface
   for order trigger evaluation and dispatch. Production impl
@@ -201,7 +205,7 @@ indicate bugs.
   by `flock(LOCK_EX|LOCK_NB)` on `.gc/controller.lock`. A second
   `gc start` fails immediately.
 
-- **Reconciliation is idempotent**: Running `doReconcileAgents()` with
+- **Reconciliation is idempotent**: Running `reconcileSessionBeads()` with
   the same config and same running set produces no side effects. A
   healthy running agent with a matching hash is always skipped.
 
@@ -251,7 +255,7 @@ Health Patrol follows Erlang/OTP patterns mapped to Gas City:
 | Erlang/OTP concept       | Gas City equivalent                       |
 |--------------------------|-------------------------------------------|
 | Supervisor               | Controller (`controllerLoop`)             |
-| Worker                   | Agent (any role)                          |
+| Worker                   | Session running an `[[agent]]` role       |
 | Child spec               | `[[agent]]` entry in `city.toml`         |
 | one_for_one restart      | Restart dead agent only (no cascade)      |
 | max_restarts/max_seconds | `max_restarts` / `restart_window`         |
@@ -267,10 +271,10 @@ Health Patrol follows Erlang/OTP patterns mapped to Gas City:
 |---|---|
 | `internal/config` | Parses `DaemonConfig` for patrol interval, max restarts, restart window, shutdown timeout. Provides `Revision()` for config reload detection. |
 | `internal/runtime` | `Provider` interface for Start/Stop/IsRunning/ListRunning/GetLastActivity/SetMeta/GetMeta. `ConfigFingerprint()` for drift detection. |
-| `internal/events` | `Recorder` interface for emitting lifecycle events (`agent.started`, `agent.stopped`, `agent.crashed`, `agent.quarantined`, `agent.idle_killed`, `agent.suspended`, `controller.started`, `controller.stopped`, `order.fired`, `order.completed`, `order.failed`). `Provider` interface for event trigger queries. |
+| `internal/events` | `Recorder` interface for emitted lifecycle events (`session.woke`, `session.stopped`, `session.crashed`, `session.draining`, `session.undrained`, `session.idle_killed`, `session.updated`, `controller.started`, `controller.stopped`, `order.fired`, `order.completed`, `order.failed`). `session.quarantined` and `session.suspended` are registered/reserved but currently un-emitted. `Provider` interface for event trigger queries. Event names were renamed from the `agent.*` prefix by commit `be8debd8`. |
 | `internal/beads` | `Store` interface for order tracking beads (create, update, list by label). `CommandRunner` for bd CLI invocation. |
 | `internal/orders` | `Scan()` to discover orders from formula layers. `CheckTrigger()` to evaluate trigger conditions. `Order` struct for dispatch metadata. |
-| `internal/agent` | `Agent` interface wrapping config + session provider for `Start()`/`Stop()`/`IsRunning()`/`SessionName()` operations. |
+| `internal/agent` | `SessionNameFor()` for session name computation and `StartupHints` for runtime config assembly (`internal/agent/` is now a small helper package; the former `Agent` / `Handle` interfaces were removed by `dd90ac0a`). |
 | `github.com/fsnotify/fsnotify` | File system watcher for config directory change detection. |
 
 | Depended on by | How |
@@ -285,7 +289,8 @@ All Health Patrol implementation lives in `cmd/gc/`:
 | File | Responsibility |
 |---|---|
 | `cmd/gc/controller.go` | Controller lock, Unix socket, fsnotify config watcher, `controllerLoop()`, `tryReloadConfig()`, `runController()`, `gracefulStopAll()` |
-| `cmd/gc/reconcile.go` | `reconcileOps` interface, `doReconcileAgents()` (4-state reconciliation + parallel starts + orphan cleanup), `doStopOrphans()` |
+| `cmd/gc/session_reconciler.go` | `reconcileSessionBeads()` bead-driven state machine for desired/live convergence, orphan/suspended drains, crash handling, idle drains, config-drift repair, and pool slot cleanup |
+| `cmd/gc/session_lifecycle_parallel.go` | Dependency-aware bounded parallel session starts and force-stops |
 | `cmd/gc/crash_tracker.go` | `crashTracker` interface, `memoryCrashTracker` (in-memory restart history with sliding window pruning) |
 | `cmd/gc/idle_tracker.go` | `idleTracker` interface, `memoryIdleTracker` (per-agent timeout + GetLastActivity query) |
 | `cmd/gc/order_dispatch.go` | `orderDispatcher` interface, `memoryOrderDispatcher` (trigger evaluation, exec dispatch, wisp dispatch, tracking bead lifecycle) |
@@ -329,7 +334,8 @@ Each Health Patrol component has dedicated unit tests:
 | Test file | Coverage |
 |---|---|
 | `cmd/gc/controller_test.go` | Controller loop tick behavior, config reload, dirty flag, fsnotify debounce, order dispatch integration |
-| `cmd/gc/reconcile_test.go` | All four reconciliation states (not running/healthy/orphan/drifted), parallel starts, zombie capture, crash loop quarantine integration, idle restart, pool drain, suspended agent handling |
+| `cmd/gc/session_reconciler_test.go` | Session reconciliation states, zombie capture, crash loop quarantine integration, idle drains, pool drain, suspended session handling |
+| `cmd/gc/session_lifecycle_parallel_test.go` | Dependency-aware bounded parallel starts and force-stops |
 | `cmd/gc/crash_tracker_test.go` | Sliding window pruning, quarantine threshold, clear history, nil-guard (disabled tracker) |
 | `cmd/gc/idle_tracker_test.go` | Timeout detection, zero time handling, per-agent timeout configuration, nil-guard |
 | `cmd/gc/order_dispatch_test.go` | Trigger evaluation (cooldown, cron, condition, event, manual), exec dispatch, wisp dispatch, tracking bead creation, timeout capping, rig-scoped orders |
@@ -355,10 +361,18 @@ stubbed `ExecRunner`) with no external infrastructure dependencies. See
   tracking. In that case, idle detection silently does nothing (no
   false positives, but also no idle kills).
 
-- **Order dispatch is fire-and-forget**: Once a goroutine is
-  launched for a due order, the controller does not track its
-  completion. Failed orders emit events but do not retry. The
-  tracking bead prevents re-fire within the same cooldown window.
+- **Order dispatch goroutines are drained on controller exit**:
+  Each due order launches a goroutine whose completion is tracked
+  by an in-flight counter and channel signal. Controller shutdown
+  and config reload call `orderDispatcher.drain(ctx)` with a bounded
+  timeout so tracking bead outcomes and event records are persisted
+  before the old dispatcher is discarded. If reload drain times out,
+  the runtime retains the old dispatcher and drains it again during
+  shutdown. If shutdown drain also times out, the compensating
+  startup sweep (`sweepOrphanedOrderTrackingRetry`) closes any
+  orphaned tracking beads on the next boot. Failed orders emit
+  events but do not retry; the tracking bead prevents re-fire within
+  the same cooldown window.
 
 - **No hot-reload for structural changes**: Changing `workspace.name`
   requires a full controller restart. `tryReloadConfig()` rejects name
diff --git a/engdocs/architecture/index.md b/engdocs/architecture/index.md
index 25fd3a19a8..f3cbcbc6ff 100644
--- a/engdocs/architecture/index.md
+++ b/engdocs/architecture/index.md
@@ -28,8 +28,8 @@ multi-agent orchestration system.
    activity
 5. **[Config System](./config.md)** — TOML loading, progressive activation,
    multi-layer override resolution
-6. **[Agent Protocol](./agent-protocol.md)** — agent lifecycle backed by
-   session providers (tmux, subprocess, k8s)
+6. **[Session](./session.md)** — session lifecycle backed by runtime
+   providers (tmux, subprocess, exec, k8s)
 7. **[Prompt Templates](./prompt-templates.md)** — Go `text/template` in
    Markdown defining role behavior
 
@@ -38,7 +38,7 @@ multi-agent orchestration system.
 Each is provably composable from the primitives.
 
 8. **[Messaging](./messaging.md)** — inter-agent mail via beads + nudge
-   via agent protocol
+   via the Session primitive
 9. **[Formulas & Molecules](./formulas.md)** — work definitions (TOML) and
    their runtime instances (bead trees)
 10. **[Dispatch](./dispatch.md)** — sling: agent selection + formula
diff --git a/engdocs/architecture/life-of-a-bead.md b/engdocs/architecture/life-of-a-bead.md
index d6cea8c4ec..a9ee116ce4 100644
--- a/engdocs/architecture/life-of-a-bead.md
+++ b/engdocs/architecture/life-of-a-bead.md
@@ -110,13 +110,15 @@ operation" (forward compatible).
 
 A bead exists, but no agent knows about it yet. Discovery is how agents
 find work. Gas City uses the **pull model**: agents poll for available
-work rather than being pushed assignments.
+work rather than being pushed assignments. Routed agents normally discover
+work through the claim protocol rendered into the session startup prompt:
+the protocol calls `gc hook`, claims exactly one returned bead with
+`bd update --claim`, and then the agent works that claimed bead.
 
 ### The hook mechanism (gc hook)
 
-Every agent has a `work_query` config field. When the agent's session
-provider fires a hook (e.g., Claude's Stop hook), it runs `gc hook`
-(`cmd/gc/cmd_hook.go`). The flow:
+Every agent has a `work_query` config field. `gc hook`
+(`cmd/gc/cmd_hook.go`) runs that query for plain hook discovery. The flow:
 
 1. `cmdHook()` resolves the agent from `$GC_AGENT` or a positional arg
 2. Loads city config, checks suspension status
@@ -134,9 +136,9 @@ the bd CLI filters by label server-side.
 
 ### The --inject mode
 
-With `--inject`, `gc hook` wraps output in a `<system-reminder>` XML block
-for LLM context injection. Hook-enabled agents discover work automatically
-between turns. If no work exists, `--inject` emits nothing and exits 0.
+`gc hook --inject` is legacy Stop-hook compatibility. It exits 0 without
+running the work query and emits no output. Routed discovery belongs in the
+session startup claim protocol or an explicit plain `gc hook` invocation.
 
 ### Ready() and GUPP
 
@@ -222,8 +224,9 @@ operations.
 
 ### Health patrol during execution
 
-While the agent works, the controller's reconciliation loop
-(`doReconcileAgents()` in `cmd/gc/reconcile.go`) monitors agent health.
+While the agent works, the controller's bead-driven session reconciler
+(`reconcileSessionBeads()` in `cmd/gc/session_reconciler.go`) monitors
+session health.
 If an agent crashes mid-execution, the bead persists in its current state
 (NDI -- Nondeterministic Idempotence). When the agent restarts, it
 rediscovers the in-progress bead through its hook and resumes. The bead
diff --git a/engdocs/architecture/messaging.md b/engdocs/architecture/messaging.md
index 248bb999ab..a99d4a3685 100644
--- a/engdocs/architecture/messaging.md
+++ b/engdocs/architecture/messaging.md
@@ -2,14 +2,14 @@
 title: "Messaging"
 ---
 
-> Last verified against code: 2026-03-04
+> Last verified against code: 2026-04-25
 
 ## Summary
 
 Messaging is a Layer 2-4 derived mechanism that provides inter-agent
 communication without introducing new primitives. Mail is composed
 from the Bead Store (`TaskStore.Create(bead{type:"message"})`), and
-nudge is composed from the Agent Protocol
+nudge is composed from the Session primitive
 (`runtime.Provider.Nudge()`). No new infrastructure is needed — messaging
 is a thin composition layer proving the primitives are sufficient.
 
@@ -193,6 +193,6 @@ Send → [unread, open]
 
 - [Bead Store](beads.md) — messages are stored as beads; understanding
   bead lifecycle explains mail lifecycle
-- [Agent Protocol](agent-protocol.md) — Nudge() delivery mechanism
+- [Session](session.md) — Nudge() delivery mechanism
 - [Glossary](glossary.md) — authoritative definitions of mail, nudge,
   and related terms
diff --git a/engdocs/architecture/nine-concepts.md b/engdocs/architecture/nine-concepts.md
index f6ecce72ee..63e5760301 100644
--- a/engdocs/architecture/nine-concepts.md
+++ b/engdocs/architecture/nine-concepts.md
@@ -2,7 +2,7 @@
 title: "Nine Concepts"
 ---
 
-> Last verified against code: 2026-03-01
+> Last verified against code: 2026-04-25
 
 ## Summary
 
@@ -28,19 +28,26 @@ Before adding a new primitive, apply three necessary conditions (see
 
 These are irreducible. Each has a dedicated architecture doc.
 
-### 1. Agent Protocol
+### 1. Session
 
-Start/stop/prompt/observe agents regardless of session provider.
-Covers identity, pools, sandboxes, resume, and crash adoption.
+Start/stop/prompt/observe sessions regardless of provider. Covers
+identity, pools, sandboxes, resume, and crash adoption.
 
-- **Interface**: `runtime.Provider` with naming and startup hints from
-  `internal/agent/`
+- **Interface**: `runtime.Provider` (low-level) plus
+  `internal/session/` for bead-backed lifecycle and naming/startup
+  hints from `internal/agent/`
 - **Implementations**: tmux (production), subprocess (remote),
-  k8s (Kubernetes), Fake (test)
-- **Key insight**: The SDK manages agent lifecycle. The prompt defines
-  agent behavior. These concerns never cross.
+  exec (script), k8s (Kubernetes), Fake (test); acp / auto / hybrid
+  routing layers compose these
+- **Key insight**: The SDK manages session lifecycle. The prompt
+  defines agent behavior. These concerns never cross.
 
-**Details**: [Agent Protocol](agent-protocol.md)
+**Details**: [Session](session.md)
+
+> **History.** This primitive was named "Agent Protocol" and exposed
+> a dedicated `agent.Agent` / `agent.Handle` interface until commit
+> `dd90ac0a` (Mar 8 2026). The interface was removed; responsibilities
+> live in `internal/session/` and `internal/runtime/`.
 
 ### 2. Task Store (Beads)
 
@@ -111,7 +118,7 @@ Mail + nudge. No new primitive needed.
 - **Nudge derivation**: `runtime.Provider.Nudge(text)` → text typed
   into the agent's session. Fire-and-forget.
 - **Proof**: Mail uses only Bead Store (primitive 2). Nudge uses only
-  Agent Protocol (primitive 1). No new infrastructure.
+  Session (primitive 1). No new infrastructure.
 
 **Details**: [Messaging](messaging.md)
 
@@ -139,8 +146,8 @@ formulas with trigger conditions on Event Bus.
 Find/spawn agent → select formula → create molecule → hook to agent →
 nudge → create convoy → log event.
 
-- **Derivation**: Agent Protocol (find/spawn) + Config (select formula)
-  + Bead Store (create molecule, convoy) + Agent Protocol (nudge) +
+- **Derivation**: Session (find/spawn) + Config (select formula)
+  + Bead Store (create molecule, convoy) + Session (nudge) +
   Event Bus (log event).
 - **Proof**: Pure composition of primitives 1-4. No new infrastructure.
 
@@ -148,15 +155,14 @@ nudge → create convoy → log event.
 
 ### 9. Health Patrol
 
-Ping agents (Agent Protocol), compare thresholds (Config), publish
-stalls (Event Bus), restart with backoff.
+Probe sessions (Session), compare thresholds (Config), publish stalls
+(Event Bus), restart with backoff.
 
-- **Derivation**: Agent Protocol (primitive 1) for liveness. Config
+- **Derivation**: Session (primitive 1) for liveness. Config
   (primitive 4) for thresholds and backoff parameters. Event Bus
   (primitive 3) for stall publication.
-- **Proof**: Uses Agent Protocol, Config, and Event Bus. The
-  controller drives all operations — no user-configured agent role
-  is required.
+- **Proof**: Uses Session, Config, and Event Bus. The controller
+  drives all operations — no user-configured agent role is required.
 
 **Details**: [Health Patrol](health-patrol.md)
 
@@ -178,7 +184,7 @@ Capabilities activate based on config section presence:
 
 | Level | Config Required | Adds |
 |---|---|---|
-| 0-1 | `[workspace]` + `[[agent]]` | Agent + tasks |
+| 0-1 | `[workspace]` + `[[agent]]` | Session + tasks |
 | 2 | `[daemon]` | Task loop (controller) |
 | 3 | `[[agent]]` with `[agent.pool]` | Multiple agents + pool |
 | 4 | `[mail]` | Messaging |
diff --git a/engdocs/architecture/orders.md b/engdocs/architecture/orders.md
index ed1dc4c5ea..80e89d82d8 100644
--- a/engdocs/architecture/orders.md
+++ b/engdocs/architecture/orders.md
@@ -247,13 +247,21 @@ Violations indicate bugs.
 
 - **Event trigger uses cursor-based deduplication**: Event orders track
   the highest processed event sequence number via `seq:<N>` labels on
-  wisp beads. Subsequent trigger checks use `AfterSeq` filtering to avoid
-  reprocessing already-handled events.
-
-- **Dispatch is fire-and-forget**: Once a goroutine is launched, the
-  controller does not track its completion. Failed orders emit
-  `order.failed` events but do not retry. The tracking bead
-  prevents re-fire within the same cooldown window.
+  order-run beads. Formula orders stamp the wisp root or failure tracking
+  bead; exec orders stamp the tracking bead before the command runs. Subsequent
+  trigger checks use `AfterSeq` filtering to avoid reprocessing
+  already-handled events.
+
+- **Dispatch goroutines are drained on controller exit**: Each due
+  order launches a goroutine whose completion is tracked by an
+  in-flight counter and channel signal on the dispatcher. Controller
+  shutdown and config reload call `orderDispatcher.drain(ctx)` with
+  a bounded timeout so tracking bead outcomes and `order.failed` /
+  `order.completed` events are persisted before the dispatcher is
+  discarded. Reload retains any dispatcher that does not drain before
+  its timeout and drains it again during controller shutdown. Failed
+  orders emit `order.failed` events but do not retry; the tracking
+  bead prevents re-fire within the same cooldown window.
 
 - **No role names in Go code**: The order subsystem operates on
   config-driven pool names and formula references. No line of Go
@@ -377,10 +385,14 @@ boundaries.
   `sh -c <check>` synchronously during trigger evaluation. A slow check
   command blocks evaluation of subsequent orders on that tick.
 
-- **Event trigger cursor is per-wisp, not per-dispatch**: The cursor
-  position is computed from `seq:<N>` labels on existing wisp beads via
-  `MaxSeqFromLabels()`. If wisp creation fails, the cursor is not
-  advanced, which may cause duplicate event processing on retry.
+- **Event trigger cursor is per-run, not per-dispatch**: The cursor
+  position is computed from `seq:<N>` labels on existing order-run beads via
+  `MaxSeqFromLabels()`. The controller and `gc order run` fail closed when the
+  current event head cannot be read. For side-effecting exec orders, the cursor
+  is persisted before the command runs so a crash after execution does not
+  replay the same event. Trade-off: a controller crash after the cursor stamp
+  and before exec start drops that event for idempotent exec orders; for
+  non-idempotent exec orders this is the safer failure mode.
 
 - **No hot-add of orders**: Order discovery runs on controller
   start and config reload (via fsnotify). Adding a new
diff --git a/engdocs/architecture/prompt-templates.md b/engdocs/architecture/prompt-templates.md
index ef2b13447c..4f3bdf6334 100644
--- a/engdocs/architecture/prompt-templates.md
+++ b/engdocs/architecture/prompt-templates.md
@@ -34,9 +34,13 @@ prompt dynamically customized to its deployment context.
   conventions like command glossaries and architecture context.
 
 - **Appended Fragments**: Named template fragments that are rendered and
-  appended after the main prompt body. These are configured through
-  `append_fragments` in `[agent_defaults]`. Per-agent appended fragments
-  still come from `inject_fragments` on the agent. Explicit
+  appended after the main prompt body. Configured through
+  `append_fragments` on either `[agent_defaults]` (city- and pack-wide)
+  or per-agent on an `[[agent]]` block / `agents/<name>/agent.toml`.
+  Per-agent `append_fragments` layers in front of imported-pack and
+  city-level `[agent_defaults].append_fragments`. `inject_fragments` on
+  an agent is the legacy per-agent spelling; it still appends, but new
+  configs should prefer `append_fragments`. Explicit
   `{{template "name" .}}` calls still control in-body placement;
   appended fragment settings do not.
 
@@ -188,7 +192,8 @@ prompt:
 |---|---|---|
 | `{{ template "name" . }}` | inside `prompt.template.md` | Places fragment content exactly where referenced |
 | `append_fragments = ["name"]` | `[agent_defaults]` | Appends fragment content after the rendered prompt body |
-| `inject_fragments = ["name"]` | per-agent settings | Appends fragment content after the rendered prompt body |
+| `append_fragments = ["name"]` | per-agent (`[[agent]]` or `agents/<name>/agent.toml`) | Appends fragment content after the rendered prompt body; layers in front of `[agent_defaults]` |
+| `inject_fragments = ["name"]` | per-agent settings (legacy) | Appends fragment content after the rendered prompt body; retained for migration, new configs should use `append_fragments` |
 
 ## Testing
 
@@ -209,7 +214,7 @@ prompt:
 
 ## See Also
 
-- [Agent Protocol](agent-protocol.md) — how rendered prompts are
+- [Session](session.md) — how rendered prompts are
   delivered to agents via runtime.Provider
 - [Config System](config.md) — how Agent.PromptTemplate and Agent.Env
   are resolved through override layers
diff --git a/engdocs/architecture/agent-protocol.md b/engdocs/architecture/session.md
similarity index 85%
rename from engdocs/architecture/agent-protocol.md
rename to engdocs/architecture/session.md
index 120e273bdc..4e47fc3a4e 100644
--- a/engdocs/architecture/agent-protocol.md
+++ b/engdocs/architecture/session.md
@@ -1,20 +1,25 @@
 ---
-title: "Agent Protocol"
+title: "Session"
 ---
 
 
-> Last verified against code: 2026-03-17
+> Last verified against code: 2026-04-25
 
 ## Summary
 
-Gas City's agent runtime boundary lives in `internal/runtime/`.
-`runtime.Provider` is the low-level contract for starting, stopping,
-attaching to, nudging, and observing agent sessions. The surrounding pieces
-that make that usable at the product level are:
+Session is Gas City's Layer 0-1 primitive for starting, stopping,
+prompting, and observing sessions regardless of provider. It covers
+identity, pools, sandboxes, resume, and crash adoption. The runtime
+boundary lives in `internal/runtime/`; `runtime.Provider` is the
+low-level contract that pluggable providers (tmux, subprocess, exec,
+k8s, acp/auto/hybrid routing) implement. The surrounding pieces that
+make the primitive usable at the product level are:
 
 - `internal/agent/` for session naming and startup hints
 - `cmd/gc/template_resolve.go` for building runtime start configs
-- `internal/session/` for session bead records, waits, and blocked-turn state
+- `internal/session/` for the bead-backed lifecycle projection
+  (`lifecycle_projection.go`), session bead records, waits, and
+  blocked-turn state
 
 The important current-state split is:
 
@@ -22,6 +27,14 @@ The important current-state split is:
 - **agent helpers** define naming and startup-hint data
 - **session helpers** manage higher-level session bookkeeping
 
+> **History.** Until commit `dd90ac0a` (Mar 8 2026, "session-first
+> migration"), this primitive was named "Agent Protocol" and exposed a
+> dedicated `agent.Agent` / `agent.Handle` interface. That interface
+> was removed; responsibilities now live in `internal/session/`
+> (lifecycle) and `internal/runtime/` (providers). `internal/agent/`
+> remains as a small helper package for session-name utilities and
+> startup hints — not a primitive.
+
 ## Key Concepts
 
 - **`runtime.Provider`**: The core runtime interface in
@@ -140,7 +153,7 @@ Optional provider extensions also live in `runtime/runtime.go`:
 | Depended on by | How |
 |---|---|
 | `cmd/gc/cmd_start.go` | Starts runtimes for configured agents |
-| `cmd/gc/reconcile.go` | Uses runtime liveness and drift signals |
+| `cmd/gc/session_reconciler.go` | Uses runtime liveness and drift signals for bead-driven session reconciliation |
 | `cmd/gc/cmd_session.go` | Attach, list, inspect, and session-level commands |
 | `cmd/gc/cmd_nudge.go` | Idle-aware and queued nudge delivery |
 | `internal/api/` | Session-aware API surfaces and status views |
diff --git a/engdocs/archive/analysis/api-enrichment-audit.md b/engdocs/archive/analysis/api-enrichment-audit.md
index 7d0175de81..7fd01711b1 100644
--- a/engdocs/archive/analysis/api-enrichment-audit.md
+++ b/engdocs/archive/analysis/api-enrichment-audit.md
@@ -168,7 +168,7 @@ type, and created_at from the same bead it already found.
 ### Gap 5: Last output / peek preview
 
 Dashboards want a quick preview of what the agent is doing without a
-separate peek call. MC uses this for question detection and status display.
+separate peek call. real-world app uses this for question detection and status display.
 
 **Add to `agentResponse`:**
 
@@ -405,18 +405,18 @@ endpoint (medium), wire summary fields into agent response (small).
 
 ## What this does NOT include (and why)
 
-- **AI-generated summaries.** This is a consumer-layer feature. MC
+- **AI-generated summaries.** This is a consumer-layer feature. real-world app
   generates summaries by calling Claude on session data. GC could store
   summaries as bead metadata, but generating them is not an SDK concern.
 
 - **Stale/orphan process detection.** Once GC owns process metadata (Gap
   3), a dashboard can compare GC's agent list against its own OS process
   scan. But GC shouldn't scan for orphans itself — it knows exactly which
-  agents it manages. "Stale" is an MC concept for processes outside any
+  agents it manages. "Stale" is a real-world app concept for processes outside any
   orchestrator's control.
 
 - **System stats (RAM, CPU, disk).** OS-level monitoring is not GC's job.
-  A separate system monitoring service/API is the right home for this. MC
+  A separate system monitoring service/API is the right home for this. real-world app
   gets this via `free`, `os.loadavg()`, `df` and should continue to.
 
 ---
diff --git a/engdocs/archive/analysis/non-claude-provider-parity-audit.md b/engdocs/archive/analysis/non-claude-provider-parity-audit.md
index 1a7d2d7561..0744e2facf 100644
--- a/engdocs/archive/analysis/non-claude-provider-parity-audit.md
+++ b/engdocs/archive/analysis/non-claude-provider-parity-audit.md
@@ -64,12 +64,12 @@ if (firstStart || forceFresh) && rp.SessionIDFlag != "" {
 }
 ```
 
-**Severity:** Show-stopper for providers that *do* have a session-id CLI
+**Severity:** Show-stopper for providers that _do_ have a session-id CLI
 (Codex does: `codex --session-id <uuid>`), friction for those that don't.
 
 Without `SessionIDFlag`, Gas City can't pre-assign a session key and has to
 discover it after the fact. This matters whenever the reconciler or external
-client (Mission Control) needs to address a session by a key it minted.
+client (real-world app) needs to address a session by a key it minted.
 
 **To fix:** add `SessionIDFlag` for Codex at minimum; document which
 providers genuinely lack this capability and use a fallback discovery
@@ -120,6 +120,7 @@ Claude's compiled-in assumption (hooks do the work) means Amp/Auggie users
 silently get a much worse product.
 
 **To fix options:**
+
 1. Investigate whether Amp/Auggie have any hook-like mechanism (lifecycle
    scripts, startup commands) we can piggy-back on.
 2. Add a runtime-side fallback that periodically polls for queued work
@@ -140,16 +141,16 @@ is the right model for Amp/Auggie too.
 
 Each provider's hook config uses a different event naming:
 
-| Provider | Session start | Per-prompt | Session end | Compact |
-|----------|---------------|------------|-------------|---------|
-| claude | `SessionStart` | `UserPromptSubmit` | `Stop` | `PreCompact` |
-| codex | `SessionStart` | `UserPromptSubmit` | `Stop` | *(missing)* |
-| gemini | `SessionStart` | `BeforeAgent` | `SessionEnd` | `PreCompress` |
-| cursor | `sessionStart` | `beforeSubmitPrompt` | `stop` | `preCompact` |
-| copilot | `sessionStart` | `userPromptSubmitted` | `sessionEnd` | *(missing)* |
+| Provider | Session start     | Per-prompt                           | Session end       | Compact             |
+| -------- | ----------------- | ------------------------------------ | ----------------- | ------------------- |
+| claude   | `SessionStart`    | `UserPromptSubmit`                   | `Stop`            | `PreCompact`        |
+| codex    | `SessionStart`    | `UserPromptSubmit`                   | `Stop`            | _(missing)_         |
+| gemini   | `SessionStart`    | `BeforeAgent`                        | `SessionEnd`      | `PreCompress`       |
+| cursor   | `sessionStart`    | `beforeSubmitPrompt`                 | `stop`            | `preCompact`        |
+| copilot  | `sessionStart`    | `userPromptSubmitted`                | `sessionEnd`      | _(missing)_         |
 | opencode | `session.created` | `experimental.chat.system.transform` | `session.deleted` | `session.compacted` |
-| pi | (plugin file) | (plugin file) | (plugin file) | (plugin file) |
-| omp | (plugin file) | (plugin file) | (plugin file) | (plugin file) |
+| pi       | (plugin file)     | (plugin file)                        | (plugin file)     | (plugin file)       |
+| omp      | (plugin file)     | (plugin file)                        | (plugin file)     | (plugin file)       |
 
 **Severity:** Polish (developer/maintenance friction)
 
@@ -194,7 +195,7 @@ reference) and in the `w-d4dba7b056` quality-gate fallback (PR #78).
 **Severity:** Friction
 
 `InstructionsFile` is a hint (`"CLAUDE.md"` vs `"AGENTS.md"`) used when
-*generating* quality-gate hints for agents. It is **not** used to copy or
+_generating_ quality-gate hints for agents. It is **not** used to copy or
 generate an actual instructions file in the agent's workdir — if a provider
 expects `AGENTS.md` and the repo only ships `CLAUDE.md` (gastown's
 convention), non-Claude agents start with no project instructions.
@@ -217,8 +218,9 @@ start.
 **Severity:** Friction
 
 `gc doctor` and `gc doctor --verbose` today check that required binaries
-exist, runtime deps are present, and city config resolves. It does *not*
+exist, runtime deps are present, and city config resolves. It does _not_
 flag:
+
 - `SupportsHooks: false` on a provider the user just added a rig for.
 - `ResumeFlag == ""` when the rig's provider would need it for the
   reconciler's resume path.
@@ -234,21 +236,21 @@ subcommand.
 
 ## Summary punch list (priority order)
 
-| # | Gap | Severity | Affected providers |
-|---|-----|----------|---------------------|
-| 1 | Session resume silent no-op | **Show-stopper** | All non-Claude |
-| 2 | `SessionIDFlag` missing | **Show-stopper** (Codex) / Friction | All non-Claude |
-| 4 | Amp / Auggie have no hook mechanism | **Show-stopper** | amp, auggie |
-| 3 | Missing PreCompact equivalent | Friction → Show-stopper long-session | codex, copilot |
-| 7 | `InstructionsFile` not materialized in workdir | Friction | All non-Claude |
-| 5 | Hook event vocabulary undocumented | Polish | All non-Claude (maint) |
-| 6 | `PrintArgs` unused | Polish | codex, gemini (claude) |
-| 8 | `gc doctor` misses provider capability gaps | Friction | All non-Claude |
+| #   | Gap                                            | Severity                             | Affected providers     |
+| --- | ---------------------------------------------- | ------------------------------------ | ---------------------- |
+| 1   | Session resume silent no-op                    | **Show-stopper**                     | All non-Claude         |
+| 2   | `SessionIDFlag` missing                        | **Show-stopper** (Codex) / Friction  | All non-Claude         |
+| 4   | Amp / Auggie have no hook mechanism            | **Show-stopper**                     | amp, auggie            |
+| 3   | Missing PreCompact equivalent                  | Friction → Show-stopper long-session | codex, copilot         |
+| 7   | `InstructionsFile` not materialized in workdir | Friction                             | All non-Claude         |
+| 5   | Hook event vocabulary undocumented             | Polish                               | All non-Claude (maint) |
+| 6   | `PrintArgs` unused                             | Polish                               | codex, gemini (claude) |
+| 8   | `gc doctor` misses provider capability gaps    | Friction                             | All non-Claude         |
 
 ## Not gaps (verified intentional)
 
 - **Claude having the most wiring** is by design; it was first and is the
-  reference. The audit is about bringing others *up*, not cutting Claude
+  reference. The audit is about bringing others _up_, not cutting Claude
   down.
 - **`SupportsACP` differing** across providers is correct — ACP genuinely
   isn't supported by most.
@@ -258,6 +260,7 @@ subcommand.
 ## Next steps for maintainers
 
 Ship in this order for biggest user-visible impact:
+
 1. Fix resume for Codex (has a documented `resume` subcommand) — closes
    the most-hit show-stopper.
 2. Decide Amp/Auggie strategy (polling fallback vs. first-class "no hooks"
diff --git a/engdocs/contributors/index.md b/engdocs/contributors/index.md
index a28236b841..40211eab9f 100644
--- a/engdocs/contributors/index.md
+++ b/engdocs/contributors/index.md
@@ -8,6 +8,7 @@ description: The shortest path for new contributors to get productive in Gas Cit
 - [Codebase Map](codebase-map.md)
 - [Architecture Overview](../architecture/index.md)
 - [Primitive Test](primitive-test.md)
+- [PR Review Handoff Notes](pr-review-handoff.md)
 - [Reconciler Debugging](reconciler-debugging.md)
 - [Huma Usage Notes](huma-usage.md) when touching `internal/api/`,
   OpenAPI generation, or SSE registration
diff --git a/engdocs/contributors/pr-review-handoff.md b/engdocs/contributors/pr-review-handoff.md
new file mode 100644
index 0000000000..63cd41698c
--- /dev/null
+++ b/engdocs/contributors/pr-review-handoff.md
@@ -0,0 +1,23 @@
+# PR Review Handoff Notes
+
+## Squash and Post-Merge Review Scope
+
+When finalizing an adopted PR, the squash title and body must name every
+substantive behavior change that lands in the commit. If a maintainer fixup
+extends beyond the original PR title, include a short bullet for each added
+scope in the squash body so post-merge reviewers, operators, and future bisects
+can see the full change.
+
+For PR #1513, the landed commit was titled for the polecat-to-refinery routing
+fix, but it also changed two additional runtime behaviors:
+
+- Supervisor-managed cities now keep per-city API routes unavailable until
+  startup reconciliation has completed and `CityRuntime.OnStarted` marks the
+  city running.
+- Session transcript streams now rely on the log watcher loop's immediate first
+  read after the caller's initial history load, so writes in that gap are
+  reloaded before the stream blocks for later file notifications.
+
+Future review finalization should record comparable bundled changes in the
+public review comment or maintainer handoff notes before applying
+`status/merge-ready`.
diff --git a/engdocs/contributors/reconciler-debugging.md b/engdocs/contributors/reconciler-debugging.md
index 5f554c3ec0..dc9efdaa25 100644
--- a/engdocs/contributors/reconciler-debugging.md
+++ b/engdocs/contributors/reconciler-debugging.md
@@ -14,6 +14,13 @@ Use this workflow when the session reconciler does something unexpected:
 
 The trace stream is persisted locally under `.gc/runtime/session-reconciler-trace/`.
 
+If you see `gc convoy control --serve` warning about a legacy control-dispatcher
+trace path at `${GC_CITY}/control-dispatcher-trace.log`, treat it as a rollout
+action item, not just a symptom: any long-lived control-dispatcher session that
+still carries that baked-in `GC_WORKFLOW_TRACE` must be restarted or recycled
+after the upgrade so it picks up the watcher-safe default under
+`.gc/runtime/control-dispatcher-trace.log`.
+
 ## Fast Incident Workflow
 
 From the city root, start detail tracing on the exact normalized template:
diff --git a/engdocs/design/async-request-result.md b/engdocs/design/async-request-result.md
new file mode 100644
index 0000000000..4d2d0500f6
--- /dev/null
+++ b/engdocs/design/async-request-result.md
@@ -0,0 +1,317 @@
+# Async Request/Result Pattern
+
+Every long-running API mutation follows the same async pattern.
+The handler returns 202 immediately; typed completion events on
+`/v0/events/stream` signal success or failure. Each operation has
+its own success event type with a fully typed payload matching the
+old synchronous response. A single shared `request.failed` event
+covers all failure cases.
+
+## Why async
+
+Clients can make async calls on their end regardless. The real value
+of the server-side async pattern is the **event stream as a progress
+channel**. Today it delivers terminal success/failure events. In the
+future, `request.progress.*` events will report intermediate steps
+as long operations proceed (city init phases, session startup stages,
+etc.), giving users real-time visibility into what's happening. The
+per-operation event type namespace is designed to support this
+progression.
+
+## The request_id
+
+A `request_id` is **just a unique correlation number**. It is not a
+session ID, not a bead ID, not a resource identifier. It exists
+solely to let clients match a 202 response to the corresponding
+completion event on the SSE stream. Generated by the handler with
+`newRequestID()` (crypto/rand hex with `req-` prefix).
+
+## The pattern
+
+```
+Client                        Handler                    Internal OM
+  |                             |                            |
+  |--- POST mutation ---------->|                            |
+  |                             | validate (sync, fast)      |
+  |                             | generate request_id        |
+  |<-- 202 { request_id } -----|                            |
+  |                             | go func() {               |
+  |                             |   result, err := om(...)  ->| (unchanged sync OM)
+  |                             |   emit typed event         |
+  |                             | }()                        |
+  |                             |                            |
+  |--- GET /v0/events/stream -->|                            |
+  |<-- request.result.session.create { request_id, session } |
+```
+
+## How it works
+
+Take any synchronous POST handler. The old implementation looked
+like this:
+
+```go
+func handler(ctx, input) (*Output, error) {
+    // validate
+    // call OM synchronously (may block 30-90s)
+    result, err := om.DoWork(ctx, ...)
+    if err != nil { return nil, mapError(err) }
+    // build response with resource data
+    return &Output{Body: result}, nil
+}
+```
+
+The async version wraps the OM call in a goroutine:
+
+```go
+func handler(ctx, input) (*Output, error) {
+    // validate (same as before — sync, fast)
+    reqID := newRequestID()
+    go func() {
+        defer recoverAndEmitFailure(reqID, "session.create")
+        // EXACT SAME OM call, unchanged
+        result, err := om.DoWork(context.Background(), ...)
+        if err != nil {
+            emitRequestFailed(reqID, "session.create", "create_failed", err)
+        } else {
+            emitSessionCreateSucceeded(reqID, sessionToResponse(result))
+        }
+    }()
+    return &Output{Body: {RequestID: reqID}}, nil
+}
+```
+
+The OM call is identical. The only change is WHERE it runs (in a
+goroutine instead of inline) and WHAT the handler returns (just
+the request_id instead of domain data). The completion event
+carries the full typed response the old sync handler returned.
+
+## The 202 response
+
+The 202 response body contains ONLY the `request_id`:
+
+```json
+{ "request_id": "req-a1b2c3d4e5f6a1b2c3d4e5f6" }
+```
+
+No resource IDs. No session data. No domain fields. The resource
+does not exist yet. Returning an ID for it invites the client to
+use it before it's ready, causing errors like "session not found"
+or "state creating does not accept command suspend."
+
+The client gets the full typed result from the success event
+AFTER the operation completes.
+
+## Event types
+
+5 typed success event types + 1 shared failure type. The event
+type encodes both the operation and the outcome — no string
+discriminator fields needed on success payloads.
+
+Clients discriminate result payloads by the event envelope's `type`
+field, not by payload shape. This matters because some success
+payloads intentionally have the same fields. For example,
+`request.result.city.create` and `request.result.city.unregister`
+both carry `{request_id, name, path}`; the envelope type is what
+makes them distinct.
+
+| Event type | Payload |
+|------------|---------|
+| `request.result.city.create` | `CityCreateSucceededPayload` |
+| `request.result.city.unregister` | `CityUnregisterSucceededPayload` |
+| `request.result.session.create` | `SessionCreateSucceededPayload` |
+| `request.result.session.message` | `SessionMessageSucceededPayload` |
+| `request.result.session.submit` | `SessionSubmitSucceededPayload` |
+| `request.failed` | `RequestFailedPayload` |
+
+### Success payloads
+
+Each success payload carries `request_id` for correlation plus the
+full typed data the old synchronous handler returned. No optional
+fields — every field is always present.
+
+**City create:**
+```json
+{
+  "type": "request.result.city.create",
+  "payload": {
+    "request_id": "req-...",
+    "name": "my-city",
+    "path": "/home/user/cities/my-city"
+  }
+}
+```
+
+**City unregister:**
+```json
+{
+  "type": "request.result.city.unregister",
+  "payload": {
+    "request_id": "req-...",
+    "name": "my-city",
+    "path": "/home/user/cities/my-city"
+  }
+}
+```
+
+**Session create:**
+```json
+{
+  "type": "request.result.session.create",
+  "payload": {
+    "request_id": "req-...",
+    "session": {
+      "id": "gc-42",
+      "kind": "agent",
+      "template": "worker",
+      "state": "active",
+      "title": "My Session",
+      "provider": "claude",
+      "..."
+    }
+  }
+}
+```
+
+**Session message:**
+```json
+{
+  "type": "request.result.session.message",
+  "payload": {
+    "request_id": "req-...",
+    "session_id": "gc-42"
+  }
+}
+```
+
+**Session submit:**
+```json
+{
+  "type": "request.result.session.submit",
+  "payload": {
+    "request_id": "req-...",
+    "session_id": "gc-42",
+    "queued": false,
+    "intent": "default"
+  }
+}
+```
+
+### Failure payload
+
+One shared type for all operation failures. The `operation` field
+is an enum identifying which operation failed.
+
+```json
+{
+  "type": "request.failed",
+  "payload": {
+    "request_id": "req-...",
+    "operation": "session.create",
+    "error_code": "create_failed",
+    "error_message": "provider startup failed"
+  }
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `request_id` | string | Correlation number from the 202 response |
+| `operation` | enum | `city.create`, `city.unregister`, `session.create`, `session.message`, `session.submit` |
+| `error_code` | string | Machine-readable error code |
+| `error_message` | string | Human-readable description |
+
+## Operations using this pattern
+
+| Endpoint | Success event type |
+|----------|--------------------|
+| `POST /v0/city` | `request.result.city.create` |
+| `POST /v0/city/{name}/unregister` | `request.result.city.unregister` |
+| `POST /v0/city/{city}/sessions` (all kinds) | `request.result.session.create` |
+| `POST /v0/city/{city}/session/{id}/messages` | `request.result.session.message` |
+| `POST /v0/city/{city}/session/{id}/submit` | `request.result.session.submit` |
+
+## Future: progress events
+
+The event type namespace is designed to grow. Future
+`request.progress.*` events will report intermediate steps during
+long operations:
+
+```
+request.progress.city.create      — city init phase completion
+request.progress.session.create   — session startup stages
+```
+
+These will carry typed payloads describing the current phase,
+giving clients real-time visibility into operation progress.
+
+## Client contract
+
+1. Subscribe to the event stream that carries the operation's terminal
+   event:
+   - city create/unregister: `/v0/events/stream`
+   - session create/message/submit: `/v0/city/{city}/events/stream`
+2. Send the mutation POST.
+3. Parse the 202 response; extract `request_id`.
+4. Wait for an event where the envelope `type` is the expected
+   success type or `request.failed`, and `payload.request_id`
+   matches:
+   - `request.result.*` for success (typed per operation)
+   - `request.failed` for failure (shared, `operation` enum)
+5. On success, the payload contains the full typed result.
+
+`session.message` uses the same four-minute timeout on both sides of
+the API adapter: the server emits `request.failed` with
+`error_code=timeout` at the same boundary the CLI client waits for on
+the SSE stream. If the provider path ignores cancellation and returns
+after that timeout, the API logs a late `session.message` result with
+the request ID instead of emitting a second terminal event.
+6. On failure, `error_code` + `error_message` describe the problem.
+7. Do NOT use the resource before the success event arrives.
+
+## Implementation rules
+
+1. **For ordinary async handlers, the goroutine runs the EXACT SAME OM code the old sync
+   handler ran.** No changes to the OM. No new queuing mechanisms.
+   Take the old synchronous handler body, put it in
+   `go func() { ... }()`, emit the typed event.
+
+2. **The request_id is just a correlation number.** Generated by
+   the handler, returned in the 202, included in the event payload.
+   The OM has no knowledge of it.
+
+3. **Use `context.Background()` in the goroutine.** The HTTP
+   request context is cancelled when the 202 is sent.
+
+4. **The 202 response contains ONLY `request_id`.** Nothing else.
+
+5. **Every goroutine has panic recovery.** Panics emit
+   `request.failed` with `error_code: "internal_error"`. The
+   goroutine must never silently complete without emitting.
+
+6. **Success events carry the full typed response.** The same data
+   the old synchronous handler returned, built from the same OM
+   result, using the same response-building functions (e.g.,
+   `sessionToResponse`).
+
+7. **City terminal request events are supervisor-visible.**
+   City create/unregister completion is reported as
+   `request.result.city.*` or `request.failed` on the supervisor
+   event stream because the city may not exist yet during create
+   and may be going away during unregister.
+
+   City create/unregister are the exception to the ordinary
+   goroutine-wrapper implementation rule. The handler accepts the
+   request, records durable `request_id` correlation for the city
+   path, and the supervisor reconciler emits the terminal request
+   event when infrastructure startup or teardown actually completes.
+   That exception does not weaken the client contract: every
+   successful 202 still has exactly one terminal request event matched
+   by `payload.request_id`.
+
+   Non-terminal lifecycle events such as `city.created` and
+   `city.unregister_requested` are diagnostic progress markers.
+   They do not replace the terminal request result events and
+   clients should not treat them as completion.
+
+8. **Session events go to the city event provider.**
+   The city exists when session operations run.
diff --git a/engdocs/design/formula-v2-transient-retries.md b/engdocs/design/formula-v2-transient-retries.md
index 56f879c12b..5f8e5c4243 100644
--- a/engdocs/design/formula-v2-transient-retries.md
+++ b/engdocs/design/formula-v2-transient-retries.md
@@ -232,12 +232,14 @@ Retry-managed attempt parsing is fail-closed:
 
 1. `gc.outcome` is authoritative for pass/fail
 2. `gc.failure_class` is consulted only when `gc.outcome=fail`
-3. Any invalid or contradictory tuple is treated as:
+3. Any invalid or contradictory tuple is treated as a transient contract
+   violation so the workflow gets a bounded retry instead of immediately
+   hard-failing:
 
 ```text
 gc.outcome=fail
-gc.failure_class=hard
-gc.failure_reason=invalid_worker_result_contract
+gc.failure_class=transient
+gc.failure_reason=<specific-contract-reason>
 ```
 
 Examples of invalid tuples:
@@ -246,6 +248,26 @@ Examples of invalid tuples:
 - `gc.outcome=pass` with any `gc.failure_class`
 - `gc.outcome=pass` with any `gc.failure_reason`
 - unknown `gc.failure_class`
+- unknown `gc.outcome` value
+
+Current reason tokens are:
+
+- `missing_outcome`
+- `pass_with_failure_metadata`
+- `unknown_failure_class`
+- `invalid_outcome_value`
+
+### Expansion fanout `scope_ref`
+
+Graph v2 expansion fanouts can provide `scope_ref` from two places:
+
+- live fanout control metadata (`gc.scope_ref`)
+- static fanout bond vars (`gc.bond_vars.scope_ref`)
+
+At runtime, the live fanout `gc.scope_ref` wins. The dispatcher injects the
+current fanout scope into expansion vars after materializing `gc.bond_vars`,
+so iteration-scoped fanouts always compile child fragments against the active
+scope even if `bond_vars.scope_ref` is stale or omitted.
 
 ### Reason taxonomy
 
@@ -257,7 +279,10 @@ V0 should standardize on short machine-readable reasons, for example:
 - `prompt_too_large`
 - `missing_input`
 - `invalid_repo_state`
-- `invalid_worker_result_contract`
+- `missing_outcome`
+- `pass_with_failure_metadata`
+- `unknown_failure_class`
+- `invalid_outcome_value`
 
 The runtime does not need to interpret these in v0; they are for
 observability and future policy. `gc.failure_reason` should be a short
@@ -599,8 +624,9 @@ Add store-driven tests similar to the existing Ralph and scope tests:
 2. transient fail to exhausted budget -> hard fail
 3. transient fail to exhausted budget with `on_exhausted=soft_fail`
 4. explicit hard failure -> logical fail
-5. malformed worker result contract -> hard fail with
-   `invalid_worker_result_contract`
+5. malformed worker result contract -> transient retry with one of
+   `missing_outcome`, `pass_with_failure_metadata`,
+   `unknown_failure_class`, or `invalid_outcome_value`
 6. stale `eval.n` cannot close a logical step already closed by attempt
    `n+1`
 7. pooled transient failure recycles the current session and leaves the
diff --git a/engdocs/design/index.md b/engdocs/design/index.md
index 6af78f445e..cc84d29c2a 100644
--- a/engdocs/design/index.md
+++ b/engdocs/design/index.md
@@ -28,3 +28,4 @@ lives in the [Architecture](../architecture/index.md) section.
 | `external-messaging-fabric` | Implemented | Provider-neutral external conversation bindings, delivery context, and group sessions |
 | `external-messaging-shared-threads` | Implemented | Transcript-backed shared-thread model with membership replay and speaker-only group routing |
 | `worker-conformance` | Proposed | Canonical WorkerCore/WorkerInference contract, transcript-first conformance, and migration toward `internal/worker` |
+| `two-minute-ci-blacksmith` | Proposed | Planner-driven Blacksmith CI architecture targeting two-minute required PR feedback |
diff --git a/engdocs/design/named-configured-sessions.md b/engdocs/design/named-configured-sessions.md
index 1862edc526..7562556c0e 100644
--- a/engdocs/design/named-configured-sessions.md
+++ b/engdocs/design/named-configured-sessions.md
@@ -2,13 +2,13 @@
 title: "Named Configured Sessions"
 ---
 
-| Field | Value |
-|---|---|
-| Status | Accepted |
-| Date | 2026-03-23 |
-| Author(s) | Codex |
-| Issue | N/A |
-| Supersedes | N/A |
+| Field         | Value                                 |
+| ------------- | ------------------------------------- |
+| Status        | Accepted                              |
+| Date          | 2026-03-23                            |
+| Author(s)     | Codex                                 |
+| Issue         | N/A                                   |
+| Supersedes    | N/A                                   |
 | Superseded by | session-model-unification (partially) |
 
 > Note
@@ -71,7 +71,7 @@ canonical sessions where they make sense.
   runtime singleton.
 - Add an explicit config object for canonical persistent sessions.
 - Give named sessions a stable alias so `gc sling`, `gc mail`, `gc
-  nudge`, attach, and workflow routing can target the same identity.
+nudge`, attach, and workflow routing can target the same identity.
 - Support both:
   - `always`: controller-kept sessions like `deacon`
   - `on_demand`: lazy sessions like `mayor` or `refinery`
@@ -423,6 +423,11 @@ Named sessions add a second desired-state source:
   - the template has pending work, or
   - dependency wake requires the named-session identity
 
+An `always` named session is visible on a fresh city as a canonical session
+bead in `creating` state before the runtime process is confirmed. This is the
+same controller-owned creation intent used for any desired session; it is not a
+separate operator action.
+
 Dependency wake is evaluated over the validated graph of fully qualified
 template identities after pack expansion, not over ambiguous bare
 template strings. Each configured named session maps 1:1 to one
@@ -596,7 +601,7 @@ CLI and API session targeting intentionally differ on ambient context:
 - API resolution has no ambient rig shortcut. Bare names only resolve
   when city-unique; otherwise callers must send the fully qualified
   identity or use `template:<qualified-name>`.
-- Mission Control and other API clients should normalize user-selected
+- real-world app and other API clients should normalize user-selected
   targets to fully qualified identities before calling GC so rig-scoped
   templates and aliases are always representable.
 
diff --git a/engdocs/design/provider-inheritance.md b/engdocs/design/provider-inheritance.md
index 0d226068c4..c4dcd2c103 100644
--- a/engdocs/design/provider-inheritance.md
+++ b/engdocs/design/provider-inheritance.md
@@ -266,6 +266,27 @@ loudly.
 | `OptionsSchema` | Merge mode per `options_schema_merge`: `"replace"` (default) = current slice-replace; `"by_key"` = merge by `Key` with `omit = true` removal. | **New opt-in** |
 | `ResumeCommand` | Non-zero child replaces. Inherited by default. | Unchanged (field semantic new) |
 
+Schema-managed flags in `args` or `args_append` are normalized at the
+provider layer that declares them before the layer is merged. For a single
+layer, explicit `args` / `args_append` choices override that same layer's
+`option_defaults`. Across inheritance, child `option_defaults` still beat
+parent defaults inferred from parent args. Effective precedence is:
+
+```
+agent option_defaults >
+child provider args / args_append >
+child provider option_defaults >
+parent provider args / args_append >
+parent provider option_defaults >
+schema defaults
+```
+
+Migration note: this intentionally changes redundant same-layer configs
+where `option_defaults` and schema-managed `args` set different values for
+the same key. The `args` value now wins inside that layer, so operators
+should remove the stale duplicate or update `option_defaults` before relying
+on the new precedence.
+
 #### `args` + `args_append` interaction
 
 Same-layer order: `args ++ args_append`. Per-layer accumulation across
@@ -365,11 +386,25 @@ For the aimux-codex case:
 [providers.codex-mini]
 base = "builtin:codex"
 command = "aimux"
-args = ["run", "codex", "--", ...]
-resume_command = "aimux run codex -- resume {{.SessionKey}}"
+args = ["run", "codex", "--",
+  "--dangerously-bypass-approvals-and-sandbox",
+  "-m", "gpt-5.3-codex-spark",
+  "-c", "model_reasoning_effort=\"medium\""]
+resume_command = "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume {{.SessionKey}}"
 process_names = ["aimux", "codex"]
 ```
 
+If a wrapper's explicit `resume_command` omits a schema-managed default that
+startup inferred from `args`, the resolver inserts the missing default into the
+subcommand resume invocation before `{{.SessionKey}}`. An explicit
+schema-managed flag already present in `resume_command` wins, so wrappers can
+intentionally use a different resume-time value.
+
+`resume_command` supports only the `{{.SessionKey}}` template variable. When
+the resolver inserts missing schema-managed defaults, it tokenizes and re-emits
+the command. For subcommand-style providers with repeated resume tokens, the
+insertion point is the resume token that precedes `{{.SessionKey}}`.
+
 End-to-end test required: spawn wrapped codex → kill → reconcile →
 assert actual executed resume command matches the declared template.
 
diff --git a/engdocs/design/two-minute-ci-blacksmith.md b/engdocs/design/two-minute-ci-blacksmith.md
new file mode 100644
index 0000000000..ad415272db
--- /dev/null
+++ b/engdocs/design/two-minute-ci-blacksmith.md
@@ -0,0 +1,1193 @@
+---
+title: "Two-Minute CI With Blacksmith"
+---
+
+| Field | Value |
+|---|---|
+| Status | Proposed |
+| Date | 2026-04-29 |
+| Author(s) | Codex |
+| Issue | ga-nakct |
+| Supersedes | N/A |
+
+## Summary
+
+Gas City's pull request CI currently returns its main signal in roughly
+22-24 minutes for production PR runs. The dominant bottleneck is not runner
+startup or dependency installation; it is coarse serial test grouping. The
+longest PR lanes are `Integration / review-formulas` and
+`Integration / rest`, each taking roughly 23 minutes in recent runs. `Check`,
+`cmd/gc process suite`, and `Integration / packages` are secondary lanes in
+the 8-10 minute range.
+
+The Blacksmith partnership should be used to redesign CI around critical-path
+latency rather than runner-minute efficiency. The target is a required PR
+answer in two minutes for deterministic gates, but that target is a measured
+Phase 4 SLO, not a Phase 1 promise. The design must first prove that runner
+pickup, image verification, shard execution, artifact upload, and summary
+fan-in can fit in a 120 second budget on real Blacksmith runners.
+
+This design proposes:
+
+1. A planner-driven CI graph that turns changed files and historical test
+   timing into a matrix of small, independently scheduled jobs.
+2. A trusted control-plane workflow for planner, manifest, and summary-gate
+   logic, sourced from protected branch state rather than PR-modifiable code.
+3. A prebuilt Gas City CI image so required jobs verify tool versions instead
+   of installing Go, Node, Dolt, bd, tmux, jq, Claude CLI, and lint tools on
+   every job.
+4. Test-level sharding for integration, process-backed, and unit coverage
+   lanes, with each shard sized for 45-75 seconds.
+5. Stable branch-protection checks that aggregate high-fanout workers into
+   a few human-readable required gates.
+6. A phased migration path that first removes duplicate serial work, then
+   introduces dynamic sharding, then hardens tests so the full deterministic
+   suite can run on every PR.
+
+## Context
+
+### Current PR CI Evidence
+
+Recent production PR CI runs show a stable critical path:
+
+| Lane | Recent average |
+|---|---:|
+| `Integration / review-formulas` | ~23.1m |
+| `Integration / rest` | ~22.6m |
+| `Integration / packages` | ~9.8m |
+| `cmd/gc process suite` | ~8.8m |
+| `Check` | ~8.4m |
+
+The last sampled real `ci.yml` PR runs clustered around a 23-24 minute wall
+clock. A representative run was
+<https://github.com/gastownhall/gascity/actions/runs/25097289892>.
+
+The `Check` job serializes several independent gates:
+
+| Step | Recent average |
+|---|---:|
+| `Lint` | ~3.35m |
+| `Test` / `make test-cover` | ~2.0-2.3m |
+| Tier A acceptance | ~1.7m |
+| `Vet` | ~0.25m |
+| dashboard drift check | ~0.25m |
+| docs/spec checks | less than 0.1m each |
+
+The repository already has useful shard boundaries:
+
+- `scripts/test-integration-shard` can run `packages`,
+  `review-formulas-basic`, `review-formulas-retries`,
+  `review-formulas-recovery`, `bdstore`, `rest-smoke`, and `rest-full`.
+- `.github/workflows/review-formulas.yml` already splits review-formulas into
+  three parallel matrix jobs, but `.github/workflows/ci.yml` still runs the
+  older sequential `make test-integration-review-formulas` lane.
+- `Makefile` separates fast unit tests, `cmd/gc` process-backed tests,
+  acceptance tiers, dashboard checks, OpenAPI generation, Docker, K8s, and
+  provider-specific gates.
+
+### External Platform Facts
+
+Blacksmith runners are documented as drop-in replacements for GitHub-hosted
+runner labels, with Linux x64 and ARM runners from 2 to 32 vCPU and no
+Blacksmith-imposed concurrency limit. The same documentation describes
+co-located cache behavior for official GitHub cache and setup actions.
+
+Relevant sources:
+
+- Blacksmith runner overview:
+  <https://docs.blacksmith.sh/blacksmith-runners/overview>
+- Blacksmith dependency cache:
+  <https://docs.blacksmith.sh/blacksmith-caching/dependencies-actions>
+- GitHub matrix job documentation:
+  <https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations>
+- GitHub reusable workflow documentation:
+  <https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows>
+
+### Current Workflow Inventory
+
+The migration must preserve the blocking intent of every current CI and RC
+lane. This is the starting classification:
+
+| Current lane | Current workflow | Target classification |
+|---|---|---|
+| `Check` | `ci.yml` | Required PR preflight, split into stable sublanes |
+| `Release config` | `ci.yml` | Required PR preflight |
+| `Dashboard SPA` | `ci.yml` | Required PR preflight |
+| `cmd/gc process suite` | `ci.yml` | Required PR integration when path-gated today; full on infra changes, main, and RC |
+| `Integration / packages` | `ci.yml` | Legacy lane may remain best-effort during overlap; replacement `CI / integration` lane is blocking with no `continue-on-error` |
+| `Integration / rest` | `ci.yml` | Legacy lane may remain best-effort during overlap; replacement `CI / integration` lane is blocking with no `continue-on-error` |
+| `Integration / bdstore` | `ci.yml` | Required provider integration when beads/Dolt paths change; full on main and RC |
+| `Integration / review-formulas` | `ci.yml` and `review-formulas.yml` | Required when review-formulas paths or label match; remove duplicate sequential lane |
+| `Worker core` and `Worker core phase 2` | `ci.yml` | Required when worker paths change |
+| `Worker inference phase 3` | `ci.yml` | Catalog/report lane until executable inference scenarios land |
+| `Pack compatibility gate` | `ci.yml` | Required when pack paths change |
+| `MCP mail conformance` | `ci.yml` | Optional until upstream API drift is under local control |
+| `Docker session` | `ci.yml` | Required when Docker-session paths change |
+| `K8s session` | `ci.yml` | Optional unless K8s CI is configured |
+| Tier B/C acceptance | `nightly.yml`, `rc-gate.yml` | RC-only and nightly, not two-minute PR path |
+| Tutorial goldens | `rc-gate.yml` | RC-only |
+| GoReleaser snapshot | `rc-gate.yml` | RC-only |
+| macOS parity | `mac-regression.yml`, `rc-gate.yml` | Separate macOS gate with separate SLO |
+
+### Two-Minute Latency Budget
+
+The two-minute target is only accepted after a pilot proves this budget can
+close. Phase 3 may target 2-4 minutes until these numbers are measured.
+
+| Segment | Phase 4 budget |
+|---|---:|
+| Trusted planner workflow starts and emits manifests | 10s |
+| Worker runner pickup plus checkout/image verification | 25s |
+| Required shard execution p95 | 60s |
+| Shard result and coverage artifact upload | 10s |
+| Summary runner pickup and artifact fan-in | 10s |
+| Summary validation and status publish | 5s |
+| **Total** | **120s** |
+
+Before Phase 3 replaces static sharding, run a Blacksmith pilot against
+`integration-rest` with at least 32 simultaneous workers. The pilot must
+publish:
+
+- runner pickup p50/p95/p99 by runner label
+- checkout and CI image verification time
+- cache hit rate for Go, Node, and dashboard dependencies
+- artifact upload and summary fan-in time at 32, 64, and 128 artifacts
+- slowest-shard p50/p95/p99
+- cost-per-PR estimate by runner label
+
+If the measured budget cannot close, the public Phase 4 SLO changes before
+the branch-protected graph changes.
+
+## Problem
+
+The current CI graph was built for scarce runner capacity. It keeps large
+amounts of work inside a handful of jobs and Make targets. That shape is easy
+to reason about, but it wastes the opportunity created by abundant compute:
+
+1. The critical path is the longest coarse test group, not the amount of work.
+2. Independent checks inside `Check` are serialized.
+3. Some review-formulas work is duplicated between the main CI workflow and
+   the dedicated review-formulas workflow.
+4. Integration tests are grouped by historical convenience rather than
+   measured runtime.
+5. CI setup repeats installation and dependency hydration in every job.
+6. There is no deterministic scheduler that can rebalance shards as the test
+   suite changes.
+7. Branch protection cannot require hundreds of volatile matrix job names
+   directly; it needs stable summary checks.
+
+The result is a ~23 minute PR loop. That latency is expensive even when runner
+minutes are cheap because it slows agent and human iteration. Reducing the
+required signal to two minutes would allow agents to run tighter fix loops,
+merge smaller batches, and surface regressions while the author still has the
+change in working memory.
+
+## Goals
+
+- Return the required deterministic PR signal in two minutes on warmed
+  Blacksmith infrastructure.
+- Keep branch protection stable as shard counts and names change.
+- Run more total deterministic coverage on PRs than today, not less.
+- Preserve full failure evidence from all shards instead of fail-fast hiding
+  later failures.
+- Make shard planning deterministic, inspectable, and reproducible locally.
+- Keep CI behavior source-controlled and provider-portable where practical.
+- Use Blacksmith's larger runners and concurrency without making all jobs
+  unnecessarily expensive.
+- Measure and continuously rebalance based on actual timing artifacts.
+
+## Non-Goals
+
+- Rewriting product logic or test semantics to make tests less meaningful.
+- Treating nondeterministic inference, chaos, race, or long soak tests as
+  required two-minute PR gates.
+- Making branch protection depend on dynamic matrix job names.
+- Adding hardcoded role or workflow behavior to Go production code.
+- Using `pull_request_target` for untrusted code execution.
+- Optimizing only for runner-minute cost. This design optimizes first for PR
+  feedback latency.
+
+## Design Principles
+
+1. **Critical path over total work.**
+   PR latency is the maximum lane duration after dependencies, not the sum of
+   all lanes.
+2. **Stable gates, dynamic workers.**
+   Branch protection should require stable summary jobs while the internal
+   shard graph can change as timing data changes.
+3. **Planner output is an artifact.**
+   Every run must publish the exact matrix the planner chose and why.
+4. **Shard by measured runtime.**
+   Historical Make targets are convenient entry points, but shard size should
+   be driven by observed test duration.
+5. **No hidden skips.**
+   Every skipped lane needs a typed reason in the summary.
+6. **Isolation before fanout.**
+   Tests that share global state, ports, tmux sockets, Dolt state, or
+   filesystem locations must be fixed before they enter high-concurrency
+   shards.
+7. **Provider abundance is not a correctness primitive.**
+   The graph should run faster on Blacksmith, but correctness must not depend
+   on proprietary CI behavior beyond documented runner labels and cache
+   compatibility.
+
+## Proposed Architecture
+
+### CI Graph
+
+The target PR graph has four layers:
+
+```text
+pull_request / push
+  |
+  |-- ci-plan
+  |     produces preflight matrix, integration matrix, metadata, skip reasons
+  |
+  |-- preflight workers
+  |     lint, fmt, vet, unit-cover shards, docs, spec, dashboard, acceptance-a
+  |
+  |-- integration workers
+  |     packages[N], cmd-gc[N], rest[N], review-formulas[N], bdstore, providers
+  |
+  |-- summary gates
+        CI / preflight
+        CI / integration
+        CI / required
+```
+
+`CI / required` is the branch-protected gate. It fails if any required
+preflight or required integration shard fails, if any expected shard artifact
+is missing, or if the planner itself fails.
+
+### Trusted CI Control Plane
+
+Planner, required-lane manifest, and summary-gate logic are control-plane
+code. They must not be trusted from an unreviewed PR checkout.
+
+The target layout is:
+
+- `ci-control.yml`: reusable workflow invoked through `workflow_call` using
+  the cross-repository form
+  `gastownhall/gascity/.github/workflows/ci-control.yml@<protected-sha>`.
+  PR workflows must not call `./.github/workflows/ci-control.yml`, because that
+  resolves to the PR head version of the workflow.
+- `ci-required-lanes.yaml`: minimum required-lane manifest protected by
+  CODEOWNERS and loaded from the base branch for PRs.
+- `scripts/ci-plan`: planner implementation used by the trusted workflow.
+- `scripts/ci-summary`: summary implementation used by the trusted workflow.
+- `scripts/ci-run-shard`: worker entry point. The worker command may execute
+  PR code because it is the thing under test, but it cannot decide which
+  required lanes exist or whether the run passed.
+
+PR-modifiable worker artifacts are evidence, not authority. The summary gate
+determines job conclusions from the GitHub Actions API and validates that each
+expected artifact exists. It never accepts a worker-uploaded JSON field as
+proof that a required check passed.
+
+Before fork PRs are accepted for this repository, `CI / required` and
+`RC / required` must be emitted by a workflow the PR cannot edit. Acceptable
+patterns are an org/ruleset-managed required workflow or a minimal
+`workflow_run` gate that consumes artifacts and GitHub Actions API state but
+does not execute PR code. This fork-PR trust hardening is a Phase 3 acceptance
+requirement, before dynamic planner output becomes authoritative for required
+checks.
+
+The required-lane manifest is a lower bound. The planner may add required
+shards, but it may not omit a base-branch required lane unless the summary can
+prove the lane is legitimately skipped by a typed policy rule.
+
+Timing database writes are allowed only on protected branch runs. PRs may read
+the latest protected timing snapshot and may write per-PR scratch timing
+artifacts, but those scratch artifacts do not update the shared planner
+database.
+
+`ci-control.yml` generates the planner nonce and records it in
+`expected_artifacts.json`. The same manifest records the verified
+`gascity-ci@sha256:...` image digest. Workers echo these values into their
+artifacts; the summary fails the run if they do not match.
+
+If `ci-required-lanes.yaml` cannot be loaded, cannot be parsed, or contains
+fewer than the minimum lane set, the trusted planner fails closed and
+`CI / required` reports failure. A separate workflow hygiene test validates
+the manifest syntax and minimum-lane set on every change to the manifest.
+
+### GitHub Actions Topology Limits
+
+The graph must stay inside GitHub Actions structural limits before the team
+increases shard counts:
+
+- Each matrix job must stay below 256 jobs.
+- Dynamic matrix JSON must fit within GitHub's expression and output limits.
+- Matrix job outputs are not used for shard accounting because reusable and
+  matrix outputs collapse by last writer.
+- Empty matrices are represented by one no-op row with `skip_reason`, or by a
+  skipped matrix plus an unconditional summary that verifies the skip reason.
+- Summary jobs run with `if: always()` and inspect `needs.*.result` plus the
+  GitHub Actions jobs API so infrastructure failures, cancellations, and
+  skipped matrices cannot pass silently.
+
+Initial matrix partition:
+
+| Matrix caller | Maximum Phase 4 rows | Notes |
+|---|---:|---|
+| `matrix-preflight` | 64 | lint, fmt, vet, docs, spec, dashboard, unit shards |
+| `matrix-acceptance-a` | 32 | Tier A deterministic acceptance |
+| `matrix-cmd-gc` | 64 | process-backed `cmd/gc` tests |
+| `matrix-integration-packages` | 64 | package/test shards outside `test/integration` |
+| `matrix-integration-rest` | 128 | `test/integration` rest shards |
+| `matrix-review-formulas` | 64 | formula scenario shards |
+| `matrix-provider` | 64 | bdstore, Docker, K8s, MCP mail, worker profiles |
+
+If a matrix would exceed its cap, the planner must either increase runner size
+and reduce shard count, split the suite into another matrix caller, or fail
+the plan before any worker starts.
+
+### Planner
+
+Add `scripts/ci-plan` to emit JSON for each dynamic matrix. The trusted
+workflow invokes the planner from protected branch code. Inputs:
+
+- GitHub event name, PR draft state, labels, and changed files.
+- Static lane definitions from protected `ci-required-lanes.yaml`.
+- Historical timing data from the protected timing snapshot.
+- Optional manual override inputs for RC and debugging workflows.
+- A per-run nonce generated by the trusted workflow.
+
+Outputs:
+
+- `preflight_matrix.json`
+- `integration_matrix.json`
+- `optional_matrix.json`
+- `planner_summary.md`
+- `planner_decisions.json`
+- `expected_artifacts.json`
+
+Each matrix row has this shape:
+
+```json
+{
+  "id": "integration-rest-07",
+  "suite": "rest",
+  "command": "scripts/ci-run-shard --suite rest --shard 7 --total 24",
+  "runner": "blacksmith-8vcpu-ubuntu-2404",
+  "timeout_minutes": 5,
+  "required": true,
+  "isolation_class": "process",
+  "variant": "default",
+  "coverage_required": true,
+  "coverage_flag": "integration-rest",
+  "expected_seconds_p75": 58,
+  "expected_seconds_p95": 84,
+  "skip_reason": "",
+  "planner_nonce": "generated-by-trusted-workflow",
+  "reason": "changed internal/session and cmd/gc paths"
+}
+```
+
+The planner must be deterministic for the same inputs and timing database.
+If timing data is missing, it falls back to conservative static shards checked
+into the repo.
+
+Allowed `isolation_class` values:
+
+| Class | Meaning |
+|---|---|
+| `command` | non-Go command with no shared runtime state |
+| `package` | Go package-level shard |
+| `process` | process-backed test with isolated tmux/Dolt/home state |
+| `subtest` | subtest-level shard proven safe by audit |
+| `serial` | cannot share a runner process with another unit |
+
+Allowed `skip_reason` values:
+
+| Reason | Meaning |
+|---|---|
+| `path-gated` | skipped by protected path policy |
+| `draft-pr` | skipped because the PR is draft |
+| `label-required` | skipped until a force label is present |
+| `oversized-deferred` | known non-required oversized unit deferred to nightly |
+| `variance-oversized-deferred` | high-variance unit deferred until split or stabilized |
+| `planner-fallback` | dynamic planning disabled and static fallback used |
+| `dependency-failed` | upstream required setup failed |
+| `not-configured` | provider lane lacks required repo secret/config |
+
+### Timing Database
+
+Every test-running shard writes timing data:
+
+- Go package and top-level test durations from `go test -json`.
+- Subtest durations where available.
+- Command-level wall time for non-Go steps.
+- Outcome, retry count, timeout, runner label, runner CPU count, runner CPU
+  model when available, pickup time, commit SHA, workflow name, run ID, and
+  run attempt.
+
+Artifacts are merged only on protected branches into a compact timing
+database. Phase 2 may collect timing into protected workflow artifacts and
+GitHub Actions cache entries, but Phase 3 authority is a protected
+`ci-metrics` branch in this repository. A post-main workflow merges successful
+protected-branch timing artifacts, commits the compact snapshot to
+`ci-metrics`, signs the commit with the CI GitHub App identity, and pushes only
+from the protected workflow. PR planners fetch the latest `ci-metrics` commit,
+record its SHA in `planner_decisions.json`, and treat it as read-only.
+
+Cache-only timing data is never authoritative for dynamic planning.
+
+Timing records include a stable identity:
+
+```json
+{
+  "schema": 1,
+  "unit_id": "test/integration:TestGraphWorkflowSuccessPath",
+  "package": "github.com/gastownhall/gascity/test/integration",
+  "test": "TestGraphWorkflowSuccessPath",
+  "subtest": "",
+  "variant": "default",
+  "identity_aliases": [],
+  "samples": 12,
+  "duration_seconds_p50": 42,
+  "duration_seconds_p75": 57,
+  "duration_seconds_p95": 88,
+  "last_success_sha": "abc1234"
+}
+```
+
+The planner uses greedy bin packing by historical duration and variance:
+
+1. Expand suite definitions to runnable units.
+2. Assign each unit an expected duration using p75 once there are at least
+   five successful samples; use static defaults before that.
+3. Track p95 and mark units as variance hazards if p95 exceeds 90 seconds.
+4. Sort longest first.
+5. Place each unit into the currently shortest shard for that suite.
+6. Repack only when predicted p95 improvement clears a configured hysteresis
+   threshold, so minor timing noise does not reshuffle every plan.
+7. Cap shards so expected p75 duration is 45-75 seconds for PR lanes, with a
+   p95 maximum of 90 seconds.
+
+Packing is tail-aware. A shard may accept a unit only if the sum of unit p95s
+stays below the shard's p95 cap. Before a unit has enough samples for empirical
+p95, the planner estimates p95 as `max(static_p95, 1.5 * p75)`. Empirical p75
+requires at least 5 successful protected-branch samples. Empirical p95
+requires at least 20 successful protected-branch samples. Retention pruning
+must preserve enough samples for these thresholds or the planner falls back to
+the conservative estimate.
+
+If one runnable unit exceeds 90 seconds, it is marked `oversized` in the
+summary and becomes required follow-up work to split the test itself.
+
+Test identity aliases live in CODEOWNERS-protected `.github/ci/test-aliases.yaml`.
+When a test is renamed, the implementation PR updates the alias file with
+`old_unit_id -> new_unit_id`. The trusted planner loads aliases from the base
+branch, resolves missing `unit_id` values through the alias map, and reports
+unresolved renamed or deleted units in the planner summary.
+
+### Runnable Units
+
+The long-term runnable unit is:
+
+- Go package for cheap packages.
+- Top-level Go test for integration and process-backed suites.
+- Subtest for any top-level test that exceeds 90 seconds and can be safely
+  targeted with `-run`.
+- Named non-Go command for dashboard, spec, lint, and release checks.
+
+Initial suite mapping:
+
+| Suite | Initial unit | Target |
+|---|---|---|
+| lint | command | one 32 vCPU lane |
+| fmt | command | one small lane |
+| vet | command or package shard | one or more lanes |
+| unit-cover | package shard | 8-16 shards |
+| docs | command | one small lane |
+| spec | command | one small lane |
+| dashboard | command group | one small lane |
+| acceptance-a | top-level test | 2-4 shards |
+| cmd-gc-process | top-level test | 8-16 shards |
+| integration-packages | package/top-level test | 8-16 shards |
+| integration-rest | top-level test/subtest | 16-32 shards |
+| review-formulas | scenario/subtest | 8-16 shards |
+| bdstore | top-level test | one lane until it grows |
+
+### Runner Selection
+
+Runner choice is part of the matrix row:
+
+| Lane type | Default runner |
+|---|---|
+| tiny summary/docs/spec/fmt | `blacksmith-4vcpu-ubuntu-2404` |
+| normal Go tests | `blacksmith-8vcpu-ubuntu-2404` |
+| initial lint and package shards | `blacksmith-8vcpu-ubuntu-2404` |
+| ARM parity lanes | `blacksmith-8vcpu-ubuntu-2404-arm` |
+| macOS parity lanes | `blacksmith-12vcpu-macos-15`, outside the two-minute gate |
+
+The gascity proof starts aggressively: tiny summaries can use 2-4 vCPU
+runners, while heavyweight Linux lanes can move directly to 16 or 32 vCPU
+runners. Later planner phases should record the speedup ratio in
+`planner_decisions.json` so runner sizing can be tuned from measured data.
+The timing artifact records requested runner label, `nproc`, CPU model,
+pickup time, checkout time, and execution time.
+
+The Phase 3 default hysteresis threshold is: repack only when the predicted
+suite p95 improvement is at least 10 percent or 5 seconds, whichever is
+larger. Implementation may tune this threshold only with a recorded
+`planner_decisions.json` reason.
+
+### Warm CI Image
+
+Create a `gascity-ci` image or equivalent runner bootstrap layer containing:
+
+- Go version from `go.mod` / workflow pin.
+- Node 22.
+- Dolt version from `deps.env`.
+- bd release version from workflow env.
+- `tmux`, `jq`, `curl`, `git`, `bash`, `python3`.
+- `golangci-lint` pinned to `Makefile`.
+- `oapi-codegen` pinned to `Makefile`.
+- Claude CLI where required by deterministic test lanes.
+- Dashboard dependency cache if compatible with the runner model.
+
+The image has one canonical version manifest, `deps.env`, extended as needed
+for Go, Node, `golangci-lint`, `oapi-codegen`, Dolt, bd, and Claude CLI pins.
+Workflow steps verify versions and fail with actionable errors if the image
+drifts.
+
+The image supply chain is part of the required-path contract:
+
+- Built by a dedicated protected workflow with `id-token: write`.
+- Published to a registry whose write permissions are restricted to that
+  workflow.
+- Signed with cosign keyless signing.
+- Consumed by digest (`gascity-ci@sha256:...`), never by mutable tag.
+- Shipped with an SBOM generated by syft or an equivalent tool.
+- Verified by signature and digest before required jobs run.
+- Rebuilt on changes to `deps.env`, the image Dockerfile, workflow pins, or
+  toolchain version files.
+- Stored in an immutable registry path with retention long enough for PR
+  reruns; image garbage collection may not delete a digest referenced by an
+  active branch-protection run.
+- Built and verified only with third-party actions pinned by commit SHA.
+
+The cross-repository `ci-control.yml@<protected-sha>` reference is bumped only
+by a CODEOWNERS-gated PR. That PR records the old SHA, new SHA, and workflow
+hygiene result.
+
+The tool-install fallback is restricted to `workflow_dispatch` on protected
+branches and scheduled degraded-mode validation. It is not reachable from PR
+triggers.
+
+### Summary Gates
+
+Dynamic worker names are not branch-protection API. Add stable summary jobs:
+
+- `CI / preflight`
+- `CI / integration`
+- `CI / optional`
+- `CI / required`
+
+End state: only `CI / required` is branch-protected. `CI / preflight` and
+`CI / integration` remain visible for diagnostics, but they are not protected
+contexts after the migration overlap window.
+
+`CI / required` runs unconditionally on every PR head SHA, with no path filter.
+It reads the trusted planner manifest, GitHub Actions job status, and worker
+artifacts. It verifies:
+
+- Every expected required shard completed.
+- Every required shard exited successfully.
+- Every required shard uploaded timing and log metadata.
+- Every expected coverage-producing shard uploaded coverage metadata.
+- Every skipped lane has an explicit planner reason.
+- No required lane is `continue-on-error`.
+- Optional or experimental lane failures are visible but do not block unless
+  configured as required.
+
+Artifact transport is explicit:
+
+- Each shard uploads exactly one result artifact named
+  `ci-result-${planner_id}`.
+- Each result artifact contains `result.json`, `timing.json`, and log excerpts.
+- Coverage-producing shards also upload `coverage-${planner_id}`.
+- Result artifacts include `GITHUB_RUN_ID`, `GITHUB_RUN_ATTEMPT`, planner ID,
+  and the trusted planner nonce.
+- The summary downloads artifacts with an explicit artifact pattern and
+  validates one-to-one presence and uniqueness against `expected_artifacts.json`.
+- Matrix outputs and reusable-workflow outputs are never used for shard
+  accounting.
+- Missing required artifacts fail the gate unless the run itself was
+  superseded and cancelled.
+
+The summary writes a first-failure-first table to `GITHUB_STEP_SUMMARY` and
+uploads a machine-readable JSON report for agents.
+
+### Failure Semantics
+
+Use `fail-fast: false` for test matrices so one early failure does not hide
+later failures. The summary job is responsible for failing the required gate.
+
+Shard jobs should:
+
+- Print the exact command being run.
+- Emit `go test -json` where practical.
+- Upload structured timing and result metadata.
+- Upload failing logs or test artifacts.
+- Avoid retries in the required path except for known external download/setup
+  flakiness. Test retries hide product flakiness and belong in a separate
+  flake-detection lane.
+
+Cancelled superseded runs are not considered passing or failing required CI.
+They produce a cancelled status. The newest uncancelled run for the PR head SHA
+is the one branch protection evaluates.
+
+### Failure UX
+
+The summary must be useful at fanout scale. The top of `GITHUB_STEP_SUMMARY`
+has this shape:
+
+```text
+CI / required: failed
+3 of 142 required shards failed.
+First failure: integration-rest-07 / TestGraphWorkflowSuccessPath
+Local rerun:
+  scripts/ci-run-shard --from-plan .ci/plan.json --id integration-rest-07
+Container-parity rerun:
+  docker run --rm -v "$PWD:/work" gascity-ci@sha256:<digest> \
+    scripts/ci-run-shard --from-plan .ci/plan.json --id integration-rest-07
+```
+
+For each failed shard, the summary includes:
+
+- suite, shard ID, runner label, actual duration, expected p75/p95
+- first failing package/test/subtest
+- last relevant log excerpt
+- exact local rerun command
+- link to full artifact
+
+The human summary shows the first three failed shards inline. Additional
+failures are collapsed behind `<details>` and fully represented in the JSON
+artifact.
+
+Each inline shard excerpt is capped at the last 50 relevant lines or 8 KiB,
+whichever is smaller. `rerun_commands[]` entries have a typed shape:
+`{"kind":"host"|"container","command":"..."}`.
+
+The per-run plan is uploaded as `.ci/plan.json` and linked from the summary.
+Agent consumers use the JSON summary rather than scraping GitHub UI. Phase 2
+defines the versioned JSON summary schema before any agent integration depends
+on it:
+
+```json
+{
+  "schema": 1,
+  "run_id": "github-run-id",
+  "run_attempt": "github-run-attempt",
+  "planner_mode": "static|dynamic|degraded",
+  "planner_sha": "trusted-control-plane-sha",
+  "timing_snapshot_sha": "ci-metrics-sha",
+  "failed_shards": [],
+  "skipped_shards": [],
+  "oversized_units": [],
+  "coverage_missing": [],
+  "coverage_carried_forward": [],
+  "rerun_commands": []
+}
+```
+
+`scripts/ci-run-shard --from-plan` runs the same sanitize and isolation-lint
+preconditions as CI when possible. The Docker command using
+`gascity-ci@sha256:...` is the parity path; the host command is a convenience
+path and is labeled as such in the summary.
+
+### Coverage Architecture
+
+Coverage is merged centrally. Individual shards never upload directly to
+Codecov in Phase 3+.
+
+Coverage flow:
+
+1. The planner marks `coverage_required` on shards expected to produce
+   coverage.
+2. Each coverage shard uploads a raw coverage artifact named by planner ID.
+3. `expected_artifacts.json` includes both raw shard coverage artifacts and
+   the per-suite merged coverage artifact.
+4. A per-suite coverage merge job validates the expected raw artifacts against
+   the trusted manifest.
+5. The merge job combines coverage deterministically. Binary coverage data
+   uses `go tool covdata merge`; legacy text `-coverprofile` files use
+   `scripts/merge-coverprofiles`, whose output is sorted by package/file/block
+   so merge order does not affect the result.
+6. `-race` coverage uses `variant: race` and uploads under a separate stable
+   Codecov flag unless the suite explicitly opts into merging race coverage
+   into the default baseline.
+7. The merge job performs one Codecov upload per stable suite identity.
+8. Missing required raw or merged coverage artifacts fail `CI / required`.
+
+Failed shards do not contribute coverage. If a required coverage-producing
+shard fails, the merge job records the missing contribution but does not merge
+partial output from that shard into a green-looking profile.
+
+Coverage baselines are separate:
+
+| Baseline | Meaning |
+|---|---|
+| `required_pr_coverage` | always-run PR coverage only |
+| `path_gated_pr_coverage` | PR coverage from lanes enabled by path policy |
+| `full_deterministic_coverage` | full main/RC deterministic suite |
+
+Carryforward is allowed only from protected branch coverage, only for
+path-gated lanes, and only with a staleness bound: carryforward expires after
+7 days or 50 protected-branch commits, whichever comes first. The summary must
+surface carryforward age in both human and JSON reports. A failed required
+shard may not carry forward stale coverage to appear green.
+
+For path-gated PRs, Codecov status for `required_pr_coverage` is blocking.
+`path_gated_pr_coverage` and `full_deterministic_coverage` are informational
+unless the PR forced full CI. Full deterministic coverage is compared against
+the latest protected `main` snapshot, with path-gated skipped suites shown as
+not-run rather than zero-covered.
+
+### Path Gating
+
+Path gating remains useful, but it must be conservative:
+
+- Always run preflight on every PR.
+- Always run deterministic unit coverage on every PR.
+- Run integration shards affected by changed paths.
+- Run full integration on `main`, release candidates, and PRs that touch
+  workflows, Makefile, test harnesses, provider boundaries, session lifecycle,
+  beads, event bus, API schema, or shared internal packages.
+- Allow labels such as `full-ci`, `needs-mac`, and `needs-review-formulas` to
+  force lanes.
+
+Every path-gated skip is reported in `planner_decisions.json`.
+
+The force-full allowlist is CODEOWNERS-protected. Any change under these paths
+disables PR path gating and runs the full deterministic Linux suite:
+
+- `.github/workflows/**`
+- `.github/actions/**`
+- `.githooks/**`
+- `Makefile`
+- `TESTING.md`
+- `deps.env`
+- `scripts/ci-*`
+- `scripts/test-integration-shard`
+- CI image build files
+- `internal/api/openapi.json`
+- `docs/schema/openapi.*`
+- `internal/api/genclient/**`
+- `cmd/gc/dashboard/**`
+- `internal/**`
+- `test/**`
+
+If a unit is `oversized-deferred` or `variance-oversized-deferred` for more
+than 50 protected-branch commits, the post-main timing workflow opens or
+updates a CI-debt bead with the unit identity and timing evidence.
+
+### Nightly And RC Gates
+
+With abundant compute, nightly should stop being the first place ordinary
+deterministic regressions appear. Nightly becomes:
+
+- repeated stress runs
+- race detector sweeps
+- chaos Dolt
+- acceptance B/C
+- synthetic inference
+- macOS parity
+- flake detection
+- slow tutorial goldens
+
+RC gate should reuse the planner and shard runner with a separate stable
+summary, `RC / required`. RC policy disables PR path gating and forces all
+deterministic lanes plus RC-only release checks:
+
+- Tier B acceptance
+- Tier C acceptance
+- tutorial goldens
+- GoReleaser snapshot
+- macOS make test or macOS parity workflow
+- release tag validation where applicable
+
+## Test Harness Changes
+
+### Isolation Requirements
+
+Before a suite can enter high-concurrency PR fanout, its tests must satisfy:
+
+- Unique temp directories via `t.TempDir()`.
+- Unique `GC_HOME`, `GC_CITY`, and city names.
+- Unique tmux sockets or guarded session prefixes.
+- Unique Dolt directories and ports.
+- No shared mutable global config without cleanup.
+- No dependence on test order.
+- No use of the default tmux server for cleanup.
+- No sleeps where an event, process probe, HTTP health check, or file
+  observation can provide a deterministic wait.
+
+### Isolation Audit Gate
+
+Phase 1 adds an isolation audit gate before high fanout. The first version can
+be a script, `scripts/ci-isolation-lint`; it may later become a `go vet`
+analyzer.
+
+The gate fails on:
+
+- `os.Setenv` in `_test.go` without `t.Setenv` or an audited process boundary.
+- Hardcoded localhost ports outside an explicit allowlist.
+- Tests that bind ports without requesting `127.0.0.1:0` or using the shared
+  test port helper.
+- `tmux` cleanup that does not specify an isolated `-L gc-test-<random>`
+  socket.
+- Any reference to the default tmux server in test cleanup.
+- Writes outside `t.TempDir()`, a test-specific `GC_HOME`, or a test-specific
+  repo temp root.
+- References to `~/.dolt`, `~/.config/gc`, or host-global Gas City state in
+  tests.
+- Shared package globals mutated by tests without reset in `t.Cleanup`.
+
+Every test shard runs `scripts/ci-runner-sanitize` before tests. It removes
+only test-owned temp roots and test-owned tmux sockets; it never runs bare
+`tmux kill-server` and never touches the default tmux server.
+
+Phase 1 also produces an unsafe-test inventory:
+
+| Field | Meaning |
+|---|---|
+| test identity | package/test/subtest |
+| isolation violation | port, tmux, env, filesystem, Dolt, global state |
+| current CI lane | where it runs today |
+| required fix | concrete harness or test change |
+| owner | responsible component/team |
+| target phase | phase before which it must be fixed |
+
+Tests not yet audited can still run in coarse static shards, but they cannot be
+subtest-sharded or marked `t.Parallel()` until the inventory marks them safe.
+
+### Parallelism In Go Tests
+
+Add `t.Parallel()` only after isolation is proven. The goal is not to blanket
+parallelize every test; it is to make each shard capable of consuming the
+larger runner it requests.
+
+Tests that cannot safely run concurrently must declare a serialized resource
+class. The planner can still run many serialized-resource tests in separate
+jobs if their resources are truly isolated per runner.
+
+### Oversized Test Policy
+
+Any required PR runnable unit with p50 over 90 seconds becomes a CI debt item.
+The owning test should be split by:
+
+- scenario table rows
+- top-level test names
+- subtest names
+- setup fixture precomputation
+- replacing fixed sleeps with event waits
+- moving nondeterministic external behavior to nightly
+
+The planner enforces p95, not only p50. A unit with p50 below 90 seconds but
+p95 above 90 seconds is marked `variance-oversized` and must either be split,
+made less variable, or excluded from the two-minute required path until fixed.
+
+At least one required shard per high-risk process/integration suite should run
+with `-race` once Phase 2 sharding makes that affordable. Race shards have a
+separate expected-duration budget because they can run 2-3x slower.
+
+## Workflow Changes
+
+### Protected Check Migration
+
+Branch protection changes are dual-published. No phase removes a currently
+protected context until the replacement context has reported successfully on
+the same PRs for an overlap window.
+
+| Phase | Current context | Replacement context | Overlap | Rollback |
+|---|---|---|---|---|
+| 1 | `Check` | `CI / preflight` and `CI / required` | 10 successful PR runs | Continue emitting `Check` as an alias summary until ruleset edit lands |
+| 1 | `Integration / review-formulas` sequential lane | split review-formulas plus `CI / integration` | 10 successful path-matched PR runs | Re-enable old Make target under the same summary name |
+| 1 | `Integration / rest` | `Integration / rest-smoke`, `Integration / rest-full`, `CI / integration` | 10 successful path-matched PR runs | Collapse to old `make test-integration-rest` row |
+| 2 | `cmd/gc process suite` | `cmd-gc[N]` plus `CI / integration` | 20 successful path-matched PR runs | Force one static shard running old target |
+| 2 | `Integration / packages` | `packages[N]` plus `CI / integration` | 20 successful path-matched PR runs | Force one static shard running old target |
+| 3 | static matrices | planner-generated matrices plus `CI / required` | 20 successful same-repo PR runs | Set `CI_PLANNER_MODE=static` and keep summary names |
+| 4 | multiple visible summaries | `CI / required` as sole protected check | 20 successful non-draft PR runs after cache warmup | Keep `CI / required` but switch implementation to static fallback |
+| RC | current `rc-gate.yml` job names | `RC / required` plus visible RC sub-summaries | 5 successful manual RC runs across two refs | Keep `RC / required` but switch implementation to current RC job graph |
+
+Ruleset edits are made only after the overlap window and are recorded in the
+implementation PR. Rollback must preserve the same protected check names; it
+may change their implementation, but it must not require manual emergency
+ruleset surgery to unblock merges.
+
+Overlap windows have both run-count and event-coverage requirements. Before a
+ruleset edit removes an old context, the overlap must include at least one
+path-gated skip, one draft PR, one force-label PR, and one superseded/cancelled
+run unless the context cannot observe that event type. The overlap window also
+has a calendar floor of five business days. The old and new contexts must be
+emitted by a single owning workflow on each SHA to avoid duplicate status
+sources; the migration PR records that owner for every alias context. Branch
+protection pins `CI / required` and `RC / required` to the GitHub Actions app
+as the expected source.
+
+### Phase 1: Remove Existing Waste
+
+- Remove sequential review-formulas from `.github/workflows/ci.yml` or replace
+  it with the split `review-formulas-basic`, `review-formulas-retries`, and
+  `review-formulas-recovery` matrix.
+- Split `Integration / rest` into `rest-smoke` and `rest-full`.
+- Split `Check` into independent jobs with a stable `CI / preflight` summary.
+- Add `concurrency` cancellation for superseded PR runs where missing.
+- Switch gascity Linux and macOS workflow labels directly to Blacksmith for the
+  proof window. No Windows lanes are in scope for gascity.
+- Add `scripts/ci-isolation-lint` in report-only mode and publish the
+  unsafe-test inventory.
+- Add `ci-required-lanes.yaml` with the current lane inventory and protected
+  skip policy.
+- During overlap, legacy contexts may retain their current `continue-on-error`
+  behavior, but the new `CI / preflight`, `CI / integration`, and
+  `CI / required` contexts contain no `continue-on-error` on required lanes.
+
+Expected PR critical path after Phase 1: 10-15 minutes.
+
+### Phase 2: Static High-Fanout Shards
+
+- Add static package sharding for `unit-cover`, `integration-packages`, and
+  `cmd-gc-process`.
+- Add one job per current review-formulas scenario.
+- Add one job per current rest top-level test group.
+- Add summary gates and artifact validation.
+- Start collecting timing artifacts.
+- Add coverage artifacts and suite-level merge jobs, but keep Codecov upload
+  volume conservative until the merge path is proven.
+- Run the Blacksmith pilot and publish the latency budget measurements.
+
+Expected PR critical path after Phase 2: 5-8 minutes if no individual test
+remains oversized.
+
+### Phase 3: Dynamic Planner
+
+- Implement `scripts/ci-plan`.
+- Implement `scripts/ci-run-shard`.
+- Replace static matrices with planner-generated matrices.
+- Store timing artifacts and rebalance shards automatically.
+- Add local reproduction command:
+
+```bash
+scripts/ci-run-shard --from-plan .ci/plan.json --id integration-rest-07
+```
+
+Phase 3 cannot become the default until the trust model, artifact contract,
+coverage merge, timing database authority, and branch-protection migration
+have all landed.
+
+Expected PR critical path after Phase 3: 2-4 minutes, bounded by the longest
+individual test and runner pickup time.
+
+### Phase 4: Two-Minute Hardening
+
+- Split or rewrite every oversized required test unit.
+- Add warmed CI image verification.
+- Tune runner sizes from measurements.
+- Move long nondeterministic lanes to nightly or optional required-on-label
+  workflows.
+- Make `CI / required` the sole branch-protected aggregate gate for CI.
+- Keep macOS and ARM parity outside the two-minute gate unless they have a
+  separately measured SLO.
+
+Expected PR critical path after Phase 4: approximately two minutes on warmed
+Blacksmith infrastructure.
+
+### Degraded Mode
+
+Blacksmith outage or severe queue degradation must not make CI structurally
+wrong. Degraded mode sets `CI_RUNNER_PROFILE=github-static`:
+
+- runner labels switch to `ubuntu-latest`
+- warm-image assumptions are disabled
+- planner collapses fanout to Phase 2 static shards
+- GitHub cache is used instead of Blacksmith colocated cache
+- `CI / required` and other protected summary names remain unchanged
+
+Expected degraded critical path is 8-15 minutes, not two minutes. The fallback
+workflow is validated on a schedule so it does not rot.
+
+During a Blacksmith incident, maintainers listed in CODEOWNERS for
+`.github/workflows/**` are authorized to flip `CI_PLANNER_MODE=static`.
+The incident PR or workflow dispatch must record the reason and the expected
+rollback trigger.
+
+## Observability
+
+Every run must expose:
+
+- Planner JSON and human summary.
+- Per-shard command, runner label, expected duration, actual duration, and
+  result.
+- Per-test timing data where available.
+- Coverage artifacts with stable flags.
+- Oversized-test report.
+- Skipped-lane report with reasons.
+- A trend summary comparing p50/p95 PR latency over the last 10, 50, and 100
+  runs.
+- First-failure-first summary with exact local and container-parity rerun
+  commands.
+- Coverage merge report listing expected, present, missing, and carried-forward
+  coverage artifacts.
+- Runner pickup, checkout, image verification, test execution, artifact upload,
+  and summary fan-in timings as separate fields.
+
+## Security
+
+The design keeps current PR trust boundaries:
+
+- No untrusted PR code runs under `pull_request_target`.
+- Secrets are not exposed to forked PR code.
+- Uploads from PRs are limited to artifacts and coverage paths already deemed
+  safe.
+- Planner, required-lane manifest, and summary logic execute from protected
+  branch state, not PR-modifiable code.
+- Summary jobs consume only artifacts from the same workflow run and validate
+  each artifact against the trusted manifest, run ID, run attempt, and planner
+  nonce.
+- Shared timing-database writes are restricted to protected branch runs.
+- The CI image is signed, digest-pinned, SBOM-backed, and verified in required
+  jobs.
+- All third-party actions in required workflows are pinned by commit SHA with
+  a version comment.
+
+If Blacksmith runner labels are configured at the organization level, the
+repository must ensure the Blacksmith GitHub App is installed for this repo
+before switching labels. Blacksmith documents that jobs can queue if runner
+labels are used in repositories not visible to the app.
+
+Add a required workflow hygiene check:
+
+- fail if third-party actions use mutable tags instead of SHAs
+- fail if required-path jobs use `continue-on-error`
+- fail if `pull_request_target` checks out or executes PR code
+- fail if CODEOWNERS does not cover `.github/workflows/**`, `.github/actions/**`,
+  `scripts/ci-*`, `deps.env`, and CI image build files
+
+## Rollback
+
+Each phase must be independently revertible:
+
+- Phase 1 can fall back to existing Make targets.
+- Phase 2 static shards can be disabled by forcing a single matrix row per
+  suite.
+- Phase 3 planner can fall back to a checked-in static plan.
+- Runner labels can revert from `blacksmith-*` to `ubuntu-latest` through a
+  single workflow env change.
+- Degraded mode can collapse fanout to static shards without changing
+  protected check names.
+
+The old Make targets remain during migration so developers and release
+operators have a known-good escape hatch.
+
+## Acceptance Criteria
+
+Phase 1 is accepted when:
+
+- Main PR CI no longer runs sequential review-formulas in both places.
+- `Check` is split into independent preflight jobs with a stable summary.
+- Rest smoke and rest full are separate lanes.
+- Branch protection dual-publishes old and new stable summary checks.
+- `ci-required-lanes.yaml` inventories current PR/RC lanes.
+- Isolation audit runs in report-only mode and publishes unsafe-test inventory.
+- `ci-required-lanes.yaml` has a fail-closed parser test and minimum-lane-set
+  test.
+- The trusted reusable-workflow invocation uses the SHA-pinned cross-repository
+  form, not a PR-local `./.github/workflows/...` reference.
+- The shared test port/Dolt helper exists before the isolation lint rejects
+  hardcoded ports.
+
+Phase 2 is accepted when:
+
+- `unit-cover`, `integration-packages`, and `cmd-gc-process` have static
+  shards.
+- Required test workers upload timing artifacts.
+- Summary gates validate expected artifacts.
+- Coverage-producing shards upload raw coverage artifacts and suite-level
+  merge jobs validate expected artifacts.
+- Blacksmith pilot measurements publish the latency budget table.
+- No required-path job uses `continue-on-error`.
+- The versioned JSON summary schema exists and includes failed shards, skipped
+  shards, oversized units, coverage missing, carryforward, and rerun commands.
+- Coverage merge artifacts are themselves included in `expected_artifacts.json`.
+
+Phase 3 is accepted when:
+
+- `scripts/ci-plan` produces deterministic matrix JSON.
+- `scripts/ci-run-shard` can reproduce any shard locally from a saved plan.
+- The planner uses historical timings and reports fallback behavior.
+- CI publishes oversized-test and skipped-lane reports.
+- Planner, manifest, and summary logic execute from trusted protected branch
+  state.
+- Shared timing writes are protected-branch-only.
+- Summary checks validate artifact nonce, run ID, run attempt, uniqueness, and
+  GitHub Actions API job conclusions.
+- Timing database authority is the protected `ci-metrics` branch, not
+  cache-only.
+- The protected `ci-metrics` branch exists and planner runs record the timing
+  snapshot SHA.
+- `.github/ci/test-aliases.yaml` exists and is loaded by the trusted planner.
+- Fork-PR trust hardening is implemented before dynamic planner output is
+  authoritative for required checks.
+
+Phase 4 is accepted when:
+
+- The p50 required PR signal is at or below two minutes for 20 consecutive
+  non-draft same-repo PR runs after cache warmup.
+- The p95 required PR signal is at or below four minutes over the same window.
+- No deterministic required suite is covered only by nightly.
+- All required shards have p50 under 90 seconds.
+- All required shards have p95 under 90 seconds or are explicitly split before
+  becoming required.
+- `CI / required` is the sole branch-protected CI summary after the overlap
+  window, with static fallback preserving the same context name.
+
+## Risks
+
+### Flaky Tests Hidden By Fanout
+
+Fanout can make flakes more visible and harder to ignore. Required shards
+should not auto-retry product tests. Instead, flake data should be collected
+and exposed so owners can fix the root cause.
+
+### Artifact Fan-In Complexity
+
+Hundreds of jobs create many artifacts. The summary gate must validate expected
+artifacts from the planner rather than globbing blindly.
+
+Mitigation: each shard uploads one result artifact and, if applicable, one
+coverage artifact named by trusted planner ID. The summary validates exact
+presence, uniqueness, nonce, run ID, and run attempt. Fan-in time is measured
+and included in the two-minute latency budget.
+
+### Cost Blowup
+
+Money is not the first constraint for this design, but runaway cost can still
+hide design mistakes. Every job records runner label and duration so cost per
+lane can be estimated even if it is not the primary optimization.
+
+### Warm Image Drift
+
+A prebuilt image can make failures surprising if it silently drifts. Version
+verification must be explicit and early in every job.
+
+Mitigation: digest pinning, cosign verification, SBOM publication, and a single
+version manifest make drift detectable before tests run.
+
+### Overfitting To Blacksmith
+
+The CI should benefit from Blacksmith but not require proprietary APIs for
+correctness. Runner labels and cache behavior are enough for the first
+implementation.
+
+## Settled Implementation Choices
+
+1. The initial gascity proof uses Blacksmith Linux labels from 2 to 32 vCPU.
+2. macOS parity moves to `blacksmith-12vcpu-macos-15` as part of the proof.
+3. gascity has no Windows CI scope for this proof.
+4. There is no cost ceiling during the proof window; size right after timing
+   data exists.
diff --git a/examples/bd/assets/scripts/gc-beads-bd.sh b/examples/bd/assets/scripts/gc-beads-bd.sh
index 56cb7b79df..b4f97c133e 100755
--- a/examples/bd/assets/scripts/gc-beads-bd.sh
+++ b/examples/bd/assets/scripts/gc-beads-bd.sh
@@ -79,13 +79,75 @@ connect_host() {
     fi
 }
 
+trim_space() {
+    printf '%s' "$1" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//'
+}
+
+lower_dolt_database_name() {
+    trim_space "$1" | tr '[:upper:]' '[:lower:]'
+}
+
+is_system_dolt_database_name() {
+    case "$(lower_dolt_database_name "$1")" in
+        information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+is_legacy_managed_probe_database_name() {
+    [ "$(lower_dolt_database_name "$1")" = "__gc_probe" ]
+}
+
+csv_unquote_single_field() {
+    local value
+    value="$1"
+    case "$value" in
+        \"*\")
+            case "$value" in
+                *\") ;;
+                *) return 1 ;;
+            esac
+            value=${value#\"}
+            value=${value%\"}
+            printf '%s\n' "$value" | sed 's/""/"/g'
+            ;;
+        *)
+            printf '%s\n' "$value"
+            ;;
+    esac
+}
+
+first_user_database_from_show_databases_csv() {
+    local line name
+    while IFS= read -r line || [ -n "$line" ]; do
+        name=$(csv_unquote_single_field "$line") || return 1
+        name=$(trim_space "$name")
+        [ -n "$name" ] || continue
+        [ "$(lower_dolt_database_name "$name")" = "database" ] && continue
+        if is_system_dolt_database_name "$name"; then
+            continue
+        fi
+        printf '%s\n' "$name"
+        return 0
+    done <<GC_SHOW_DATABASES_CSV
+$1
+GC_SHOW_DATABASES_CSV
+    return 0
+}
+
+quote_dolt_identifier() {
+    local escaped
+    escaped=$(printf '%s' "$1" | sed 's/`/``/g')
+    printf '`%s`' "$escaped"
+}
+
 # tcp_check_port returns 0 if the given port is reachable.
 tcp_check_port() {
     local port="$1"
     local host
     host=$(connect_host)
     if command -v nc >/dev/null 2>&1; then
-        nc -z -w2 "$host" "$port" 2>/dev/null
+        nc -z -w 2 "$host" "$port" 2>/dev/null
     elif command -v bash >/dev/null 2>&1; then
         bash -c "echo >/dev/tcp/$host/$port" 2>/dev/null
     else
@@ -131,6 +193,30 @@ lsof_reports_open() {
     esac
 }
 
+canonical_dir() {
+    local dir="$1"
+    (cd "$dir" 2>/dev/null && pwd -P) || printf '%s\n' "$dir"
+}
+
+same_dir_path() {
+    local left="$1" right="$2" abs_left abs_right
+    [ "$left" = "$right" ] && return 0
+    abs_left=$(canonical_dir "$left")
+    abs_right=$(canonical_dir "$right")
+    [ "$abs_left" = "$abs_right" ]
+}
+
+path_under_data_dir() {
+    local path="$1" abs_data
+    abs_data=$(canonical_dir "$DATA_DIR")
+    case "$path" in
+        "$DATA_DIR"|"$DATA_DIR"/*|"$abs_data"|"$abs_data"/*)
+            return 0
+            ;;
+    esac
+    return 1
+}
+
 # do_query_probe runs a SELECT active_branch() query against the dolt server.
 # active_branch() is lightweight and won't block behind queued queries,
 # unlike SELECT 1 which goes through the full query executor (per Tim Sehn, Dolt CEO).
@@ -170,6 +256,18 @@ is_retryable_error() {
     return 1
 }
 
+sleep_ms() {
+    local ms="$1"
+    local seconds remainder
+    seconds=$((ms / 1000))
+    remainder=$((ms % 1000))
+    if [ "$remainder" -eq 0 ]; then
+        sleep "$seconds"
+    else
+        sleep "$seconds.$(printf '%03d' "$remainder")"
+    fi
+}
+
 # server_sql_retry wraps server_sql with exponential backoff on transient errors.
 # 5 attempts, backoff 500ms→1s→2s→4s→8s (capped at 15s).
 server_sql_retry() {
@@ -189,7 +287,7 @@ server_sql_retry() {
         fi
 
         if [ "$attempt" -lt "$max_attempts" ]; then
-            sleep "$(awk "BEGIN{printf \"%.3f\", $backoff_ms/1000}")" 2>/dev/null || sleep 1
+            sleep_ms "$backoff_ms" 2>/dev/null || sleep 1
             backoff_ms=$((backoff_ms * 2))
             if [ "$backoff_ms" -gt "$max_backoff_ms" ]; then
                 backoff_ms=$max_backoff_ms
@@ -239,7 +337,7 @@ ensure_database_registered() {
         if server_sql "USE \`$db\`" >/dev/null 2>&1; then
             return 0
         fi
-        sleep "$(awk "BEGIN{printf \"%.3f\", $backoff_ms/1000}")" 2>/dev/null || sleep 1
+        sleep_ms "$backoff_ms" 2>/dev/null || sleep 1
         backoff_ms=$((backoff_ms * 2))
     done
 
@@ -259,6 +357,17 @@ database_exists() {
     server_sql "USE \`$db\`" >/dev/null 2>&1
 }
 
+database_has_beads_schema() {
+    local db="$1"
+    [ -n "$db" ] || return 1
+
+    if ! valid_sql_name "$db"; then
+        return 1
+    fi
+
+    server_sql "SELECT 1 FROM \`$db\`.issues LIMIT 1" >/dev/null 2>&1
+}
+
 read_existing_dolt_database() {
     local meta_file="$1"
     [ -f "$meta_file" ] || return 0
@@ -299,6 +408,109 @@ backfill_project_id_if_missing() {
     "$gc_bin" dolt-state ensure-project-id         --metadata "$meta_file"         --host "$host"         --port "$DOLT_PORT"         --user "$DOLT_USER"         --database "$dolt_database" >/dev/null || die "failed to ensure project identity for $dir"
 }
 
+ensure_bd_runtime_issue_prefix() {
+    local db="$1"
+    local prefix="$2"
+    ensure_bd_runtime_config_value "$db" "issue_prefix" "$prefix"
+}
+
+valid_custom_types_value() {
+    local types="$1" old_ifs typ
+    [ -n "$types" ] || return 1
+    old_ifs=$IFS
+    IFS=','
+    for typ in $types; do
+        [ -n "$typ" ] || { IFS=$old_ifs; return 1; }
+        valid_sql_name "$typ" || { IFS=$old_ifs; return 1; }
+    done
+    IFS=$old_ifs
+    return 0
+}
+
+ensure_bd_runtime_custom_types() {
+    local db="$1"
+    local types="$2"
+    ensure_bd_runtime_config_value "$db" "types.custom" "$types"
+}
+
+ensure_bd_runtime_config_value() {
+    local db="$1"
+    local key="$2"
+    local value="$3"
+    [ -n "$db" ] || return 0
+    [ -n "$value" ] || return 0
+    valid_sql_name "$db" || die "invalid dolt database name: $db"
+    case "$key" in
+        issue_prefix)
+            valid_sql_name "$value" || die "invalid beads prefix: $value"
+            ;;
+        types.custom)
+            valid_custom_types_value "$value" || die "invalid custom bead types: $value"
+            ;;
+        *)
+            die "unsupported bd runtime config key: $key"
+            ;;
+    esac
+
+    # bd v1.0.3 rejects `bd config set issue_prefix`; GC still needs raw
+    # bd commands to see GC's config in the DB-backed config table.
+    server_sql_retry "USE \`$db\`; INSERT INTO config (\`key\`, value) VALUES ('$key', '$value') ON DUPLICATE KEY UPDATE value = VALUES(value)" >/dev/null || die "failed to set bd runtime $key for $db"
+}
+
+bd_runtime_schema_ready() {
+    local db="$1"
+    [ -n "$db" ] || return 1
+    valid_sql_name "$db" || return 1
+    server_sql "USE \`$db\`; SELECT 1 FROM config LIMIT 1" >/dev/null 2>&1
+}
+
+wait_for_bd_runtime_schema() {
+    local db="$1"
+    local attempt backoff_ms
+    [ -n "$db" ] || return 1
+    valid_sql_name "$db" || return 1
+
+    backoff_ms=100
+    for attempt in 1 2 3 4 5 6 7 8; do
+        if bd_runtime_schema_ready "$db"; then
+            return 0
+        fi
+        if [ "$attempt" -lt 8 ]; then
+            sleep_ms "$backoff_ms" 2>/dev/null || sleep 1
+            if [ "$backoff_ms" -lt 1000 ]; then
+                backoff_ms=$((backoff_ms * 2))
+                if [ "$backoff_ms" -gt 1000 ]; then
+                    backoff_ms=1000
+                fi
+            fi
+        fi
+    done
+
+    return 1
+}
+
+# ensure_types_custom_in_yaml writes types.custom to .beads/config.yaml when
+# the key is absent. bd reads this YAML key as a fallback when the database
+# config table is unset (see beads internal/config: GetCustomTypesFromYAML),
+# so writing here registers the types without paying bd's per-command
+# auto-migrate cost (~50s on populated databases). Idempotent: re-running
+# never appends duplicates.
+ensure_types_custom_in_yaml() {
+    local dir="$1"
+    local types="$2"
+    local config_yaml="$dir/.beads/config.yaml"
+    [ -f "$config_yaml" ] || return 0
+    [ -n "$types" ] || return 0
+    if grep -q "^types\.custom:" "$config_yaml" 2>/dev/null; then
+        return 0
+    fi
+    local tmp
+    tmp=$(mktemp "$config_yaml.tmp.XXXXXX") || return 0
+    cat "$config_yaml" > "$tmp" 2>/dev/null || { rm -f "$tmp"; return 0; }
+    printf 'types.custom: %s\n' "$types" >> "$tmp"
+    mv -f "$tmp" "$config_yaml" || rm -f "$tmp"
+}
+
 # --- Robustness Helpers ---
 
 # save_state writes the private provider runtime state atomically (no jq dependency).
@@ -552,7 +764,7 @@ verify_our_server() {
     # Layer 1: State file data-dir comparison.
     local state_dir
     state_dir=$(load_state_field data_dir)
-    if [ -n "$state_dir" ] && [ "$state_dir" != "$DATA_DIR" ]; then
+    if [ -n "$state_dir" ] && ! same_dir_path "$state_dir" "$DATA_DIR"; then
         return 1
     fi
 
@@ -571,11 +783,7 @@ verify_our_server() {
             local proc_dir
             proc_dir=$(echo "$proc_args" | sed -n 's/.*--data-dir[= ]*\([^ ]*\).*/\1/p')
             if [ -n "$proc_dir" ]; then
-                # Resolve to absolute paths for comparison.
-                local abs_proc abs_ours
-                abs_proc=$(cd "$proc_dir" 2>/dev/null && pwd) || abs_proc="$proc_dir"
-                abs_ours=$(cd "$DATA_DIR" 2>/dev/null && pwd) || abs_ours="$DATA_DIR"
-                if [ "$abs_proc" = "$abs_ours" ]; then
+                if same_dir_path "$proc_dir" "$DATA_DIR"; then
                     return 0
                 fi
                 return 1
@@ -587,13 +795,13 @@ verify_our_server() {
     if [ -d "/proc/$pid" ]; then
         local cwd
         cwd=$(readlink "/proc/$pid/cwd" 2>/dev/null) || true
-        if [ -n "$cwd" ] && [ "$cwd" = "$DATA_DIR" ]; then
+        if [ -n "$cwd" ] && same_dir_path "$cwd" "$DATA_DIR"; then
             return 0
         fi
     fi
 
     # State file said it's ours (or no state file) and we couldn't disprove it.
-    if [ -n "$state_dir" ] && [ "$state_dir" = "$DATA_DIR" ]; then
+    if [ -n "$state_dir" ] && same_dir_path "$state_dir" "$DATA_DIR"; then
         return 0
     fi
 
@@ -625,11 +833,10 @@ has_deleted_data_inodes() {
             target=$(readlink "$fd" 2>/dev/null) || continue
             case "$target" in
                 *" (deleted)")
-                    case "$target" in
-                        "$DATA_DIR"/*|"$DATA_DIR"*)
-                            return 0
-                            ;;
-                    esac
+                    target=${target% (deleted)}
+                    if path_under_data_dir "$target"; then
+                        return 0
+                    fi
                     ;;
             esac
         done
@@ -640,7 +847,69 @@ has_deleted_data_inodes() {
     fi
 
     if command -v lsof >/dev/null 2>&1; then
-        if run_lsof -p "$pid" 2>/dev/null | grep ' (deleted)' | grep -F -- "$DATA_DIR" >/dev/null 2>&1; then
+        local abs_data
+        abs_data=$(canonical_dir "$DATA_DIR")
+        if run_lsof -a -p "$pid" +L1 -Fnk 2>/dev/null | awk -v data_dir="$DATA_DIR" -v abs_data="$abs_data" '
+            function normalize(path) {
+                gsub(/^[ \t\r\n]+|[ \t\r\n]+$/, "", path)
+                if (path == "/private/tmp") {
+                    return "/tmp"
+                }
+                if (substr(path, 1, 13) == "/private/tmp/") {
+                    return "/tmp/" substr(path, 14)
+                }
+                if (path == "/private/var") {
+                    return "/var"
+                }
+                if (substr(path, 1, 13) == "/private/var/") {
+                    return "/var/" substr(path, 14)
+                }
+                return path
+            }
+            function within(path, root) {
+                path = normalize(path)
+                root = normalize(root)
+                return path == root || substr(path, 1, length(root) + 1) == root "/"
+            }
+            function within_data(path) {
+                return within(path, data_dir) || within(path, abs_data)
+            }
+            function flush() {
+                if (name != "" && deleted && within_data(name)) {
+                    found = 1
+                }
+                name = ""
+                deleted = 0
+            }
+            substr($0, 1, 1) == "f" {
+                flush()
+                next
+            }
+            substr($0, 1, 1) == "k" {
+                if (substr($0, 2) == "0") {
+                    deleted = 1
+                }
+                next
+            }
+            substr($0, 1, 1) == "n" {
+                if (name != "") {
+                    flush()
+                }
+                name = substr($0, 2)
+                if (name ~ / \(deleted\)$/) {
+                    deleted = 1
+                    sub(/ \(deleted\)$/, "", name)
+                }
+                next
+            }
+            END {
+                flush()
+                exit(found ? 0 : 1)
+            }
+        '; then
+            return 0
+        fi
+        if run_lsof -p "$pid" 2>/dev/null | grep ' (deleted)' | grep -F -e "$DATA_DIR" -e "$abs_data" >/dev/null 2>&1; then
             return 0
         fi
     fi
@@ -683,23 +952,41 @@ kill_imposter() {
     sleep 1
 }
 
-# quarantine_phantom_dbs moves dirs with .dolt/ but missing noms/manifest
-# to a quarantine directory. A phantom database crashes the entire dolt
-# server on startup, so it must be removed from DATA_DIR. The data is
-# preserved in case recovery is possible.
+retired_replacement_db_name() {
+    case "$1" in
+        ?*.replaced-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z)
+            return 0
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
+# quarantine_phantom_dbs moves unservable database dirs to quarantine.
+# This includes missing-manifest phantom dirs and Dolt-retired replacement
+# dirs that still have manifests but are no longer the active database.
 quarantine_phantom_dbs() {
     [ -d "$DATA_DIR" ] || return 0
     local dir
     for dir in "$DATA_DIR"/*/; do
         [ -d "$dir" ] || continue
-        if [ -d "$dir/.dolt" ] && [ ! -f "$dir/.dolt/noms/manifest" ]; then
-            local name
-            name=$(basename "$dir")
-            local quarantine_dir="$DATA_DIR/.quarantine/$(date +%Y%m%dT%H%M%S)-$name"
-            mkdir -p "$DATA_DIR/.quarantine"
-            echo "quarantining phantom database: $name (missing noms/manifest) → $quarantine_dir" >&2
-            mv "$dir" "$quarantine_dir"
+        [ -d "$dir/.dolt" ] || continue
+
+        local name reason
+        name=$(basename "$dir")
+        if retired_replacement_db_name "$name"; then
+            reason="retired replacement"
+        elif [ ! -f "$dir/.dolt/noms/manifest" ]; then
+            reason="missing noms/manifest"
+        else
+            continue
         fi
+
+        local quarantine_dir="$DATA_DIR/.quarantine/$(date +%Y%m%dT%H%M%S)-$name"
+        mkdir -p "$DATA_DIR/.quarantine"
+        echo "quarantining unservable database: $name ($reason) -> $quarantine_dir" >&2
+        mv -f "$dir" "$quarantine_dir"
     done
 }
 
@@ -735,7 +1022,13 @@ cleanup_stale_locks() {
 # Overwritten on each server start. Without read/write timeouts, CLOSE_WAIT connections
 # accumulate and the server enters unrecoverable read-only mode.
 write_config_yaml() {
-    local gc_bin
+    local archive_level gc_bin
+    archive_level=${GC_DOLT_ARCHIVE_LEVEL:-0}
+    case "$archive_level" in
+        ''|*[!0-9]*)
+            archive_level=0
+            ;;
+    esac
     gc_bin=$(resolve_gc_helper_bin)
     if [ -n "$gc_bin" ]; then
         "$gc_bin" dolt-config write-managed \
@@ -743,7 +1036,8 @@ write_config_yaml() {
             --host "$DOLT_HOST" \
             --port "$DOLT_PORT" \
             --data-dir "$DATA_DIR" \
-            --log-level "$DOLT_LOGLEVEL" || die "failed to write managed dolt config via gc helper $gc_bin"
+            --log-level "$DOLT_LOGLEVEL" \
+            --archive-level "$archive_level" || die "failed to write managed dolt config via gc helper $gc_bin"
         return 0
     fi
     local tmp
@@ -770,7 +1064,7 @@ data_dir: "$DATA_DIR"
 behavior:
   auto_gc_behavior:
     enable: true
-    archive_level: 1
+    archive_level: $archive_level
 YAML
     mv "$tmp" "$CONFIG_FILE"
 }
@@ -787,28 +1081,62 @@ get_connection_count() {
 }
 
 # check_read_only tests if the dolt server is in read-only mode.
-# Returns 0 if read-only, 1 if writable.
+# Returns 0 if read-only, 1 if writable, 2 if the write probe is inconclusive.
 check_read_only() {
-    local host gc_bin
+    local host gc_bin db quoted_db probe_table sql output err_file err_text status
     host=$(connect_host)
     gc_bin=$(resolve_gc_helper_bin)
     if [ -n "$gc_bin" ]; then
-        "$gc_bin" dolt-state read-only-check --host "$host" --port "$DOLT_PORT" --user "$DOLT_USER" >/dev/null 2>&1
-        case $? in
-            0) return 0 ;;
-            *) return 1 ;;
+        err_file=$(mktemp "${TMPDIR:-/tmp}/gc-dolt-read-only-check.XXXXXX") || return 2
+        if "$gc_bin" dolt-state read-only-check --host "$host" --port "$DOLT_PORT" --user "$DOLT_USER" >/dev/null 2>"$err_file"; then
+            rm -f "$err_file"
+            return 0
+        fi
+        err_text=$(cat "$err_file" 2>/dev/null || true)
+        rm -f "$err_file"
+        if [ -n "$err_text" ]; then
+            echo "$err_text" >&2
+            return 2
+        fi
+        return 1
+    fi
+    err_file=$(mktemp "${TMPDIR:-/tmp}/gc-dolt-show-databases.XXXXXX") || return 2
+    if output=$(dolt --host "$host" --port "$DOLT_PORT" --user "$DOLT_USER" --password "${DOLT_PASSWORD:-}" --no-tls \
+        sql -r csv -q "SHOW DATABASES" 2>"$err_file"); then
+        status=0
+    else
+        status=$?
+    fi
+    err_text=$(cat "$err_file" 2>/dev/null || true)
+    rm -f "$err_file"
+    if [ "$status" -ne 0 ]; then
+        case "$err_text" in
+            *"read only"*|*"READ ONLY"*|*"Read-only"*)
+                return 0
+                ;;
         esac
+        [ -n "$err_text" ] && echo "dolt SHOW DATABASES failed: $err_text" >&2
+        return 2
+    fi
+    db=$(first_user_database_from_show_databases_csv "$output") || return 2
+    if [ -z "$db" ]; then
+        echo "dolt read-only probe inconclusive: no user database available" >&2
+        return 2
+    fi
+    quoted_db=$(quote_dolt_identifier "$db")
+    probe_table='`__gc_read_only_probe`'
+    sql="CREATE TABLE IF NOT EXISTS ${quoted_db}.${probe_table} (k INT PRIMARY KEY); REPLACE INTO ${quoted_db}.${probe_table} VALUES (1);"
+    if output=$(dolt --host "$host" --port "$DOLT_PORT" --user "$DOLT_USER" --password "${DOLT_PASSWORD:-}" --no-tls \
+        sql -q "$sql" 2>&1); then
+        return 1
     fi
-    local output
-    # Keep __gc_probe stable. Dropping Dolt databases leaves
-    # .dolt_dropped_databases backups behind.
-    output=$(dolt --host "$host" --port "$DOLT_PORT" --user "$DOLT_USER" --password "${DOLT_PASSWORD:-}" --no-tls         sql -q "CREATE DATABASE IF NOT EXISTS __gc_probe; CREATE TABLE IF NOT EXISTS __gc_probe.__probe (k INT PRIMARY KEY); REPLACE INTO __gc_probe.__probe VALUES (1);" 2>&1) || true
     case "$output" in
         *"read only"*|*"READ ONLY"*|*"Read-only"*)
             return 0  # Is read-only.
             ;;
     esac
-    return 1  # Writable.
+    [ -n "$output" ] && echo "dolt write probe failed: $output" >&2
+    return 2
 }
 
 load_health_check_from_gc() {
@@ -913,11 +1241,11 @@ wait_for_managed_pid_ready() {
         if ! kill -0 "$pid" 2>/dev/null; then
             return 1
         fi
-        if [ "$check_deleted" = "true" ] && wait_deleted_data_inodes "$pid"; then
+        if [ "$check_deleted" = "true" ] && has_deleted_data_inodes "$pid"; then
             return 1
         fi
         if tcp_check_port "$port" && do_query_probe; then
-            if [ "$check_deleted" = "true" ] && wait_deleted_data_inodes "$pid"; then
+            if [ "$check_deleted" = "true" ] && has_deleted_data_inodes "$pid"; then
                 return 1
             fi
             return 0
@@ -971,7 +1299,7 @@ EOF
 }
 
 wait_for_concurrent_start_ready() {
-    local existing_pid="" existing_port="" holder="" timeout_ms deadline_ms now_ms remaining_ms sleep_ms
+    local existing_pid="" existing_port="" holder="" timeout_ms deadline_ms now_ms remaining_ms wait_ms
     timeout_ms="$CONCURRENT_START_READY_TIMEOUT_MS"
     case "$timeout_ms" in
         ''|*[!0-9]*)
@@ -1027,18 +1355,14 @@ wait_for_concurrent_start_ready() {
         if [ "$remaining_ms" -le 0 ]; then
             return 1
         fi
-        sleep_ms=500
-        if [ "$remaining_ms" -lt "$sleep_ms" ]; then
-            sleep_ms="$remaining_ms"
+        wait_ms=500
+        if [ "$remaining_ms" -lt "$wait_ms" ]; then
+            wait_ms="$remaining_ms"
         fi
-        if [ "$sleep_ms" -le 0 ]; then
+        if [ "$wait_ms" -le 0 ]; then
             return 1
         fi
-        if [ "$sleep_ms" -lt 500 ]; then
-            sleep "0.$(printf '%03d' "$sleep_ms")" 2>/dev/null || sleep 1
-        else
-            sleep 0.5 2>/dev/null || sleep 1
-        fi
+        sleep_ms "$wait_ms" 2>/dev/null || sleep 1
     done
 }
 
@@ -1258,10 +1582,7 @@ valid_sql_name() {
 }
 
 is_reserved_dolt_database_name() {
-    case "$(printf '%s' "$1" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | tr '[:upper:]' '[:lower:]')" in
-        __gc_probe) return 0 ;;
-        *) return 1 ;;
-    esac
+    is_system_dolt_database_name "$1"
 }
 
 # clean_stale_sockets removes stale Unix domain sockets left by a crashed
@@ -1290,6 +1611,21 @@ clean_stale_sockets() {
     done
 }
 
+# ensure_beads_role ensures beads.role is set in global git config.
+# bd exits non-zero with "beads.role not configured" (gastownhall/beads#2950)
+# when this key is absent. That non-zero exit causes the `run_bd_pinned … ||
+# true` calls in op_init to fail silently, leaving issue_prefix and
+# types.custom unset in the Dolt database and making every subsequent
+# bd-create call fail with "database not initialized". Defaulting to
+# "maintainer" matches the role that gc-managed agents use to create beads.
+ensure_beads_role() {
+    if git config --global beads.role >/dev/null 2>&1; then
+        return 0
+    fi
+    echo "gc-beads-bd: setting git config --global beads.role maintainer" >&2
+    git config --global beads.role maintainer || die "failed to set git config beads.role"
+}
+
 # ensure_dolt_identity ensures dolt has user.name and user.email configured.
 ensure_dolt_identity() {
     # Check if already configured.
@@ -1637,6 +1973,22 @@ run_bd_pinned() {
     )
 }
 
+run_bd_init_pinned() {
+    local dir="$1"
+    local prefix="$2"
+    local dolt_database="$3"
+    local host="$4"
+    local force_init="${5:-false}"
+    if [ "$force_init" = "true" ]; then
+        run_bd_pinned "$dir" init --force --quiet --server -p "$prefix" --database "$dolt_database" --skip-hooks --skip-agents \
+            --server-host "$host" --server-port "$DOLT_PORT" "$dir" || die "bd init failed for $dir"
+        return 0
+    fi
+
+    run_bd_pinned "$dir" init --quiet --server -p "$prefix" --database "$dolt_database" --skip-hooks --skip-agents \
+        --server-host "$host" --server-port "$DOLT_PORT" "$dir" || die "bd init failed for $dir"
+}
+
 ensure_beads_dir_permissions() {
     local dir="$1"
     local beads_dir="$dir/.beads"
@@ -1670,13 +2022,14 @@ op_init() {
     local metadata_path="$dir/.beads/metadata.json"
     local existing_db=""
     local allow_reserved_existing=false
+    local bd_init_force=""
     if [ -z "$dir" ] || [ -z "$prefix" ]; then
         die "usage: gc-beads-bd init <dir> <prefix> [dolt_database]"
     fi
 
     if [ -f "$metadata_path" ]; then
         existing_db=$(read_existing_dolt_database "$metadata_path")
-        if [ -n "$existing_db" ] && is_reserved_dolt_database_name "$existing_db"; then
+        if [ -n "$existing_db" ] && is_legacy_managed_probe_database_name "$existing_db"; then
             allow_reserved_existing=true
         fi
     fi
@@ -1703,6 +2056,7 @@ op_init() {
     unset BEADS_DIR
     export BEADS_DIR="$beads_dir"
     ensure_beads_dir_permissions "$dir"
+    ensure_beads_role
 
     if [ -z "$dolt_database" ]; then
         # Compatibility fallback for direct gc-beads-bd invocations.
@@ -1736,23 +2090,30 @@ op_init() {
     # beads with that type — must match doctor.RequiredCustomTypes.
     local custom_types="${GC_BEADS_CUSTOM_TYPES:-molecule,convoy,message,event,gate,merge-request,agent,role,rig,session,spec,convergence}"
 
-    # If already initialized on disk, ensure the database is also registered
-    # with the running server. This covers the case where bd init created the
-    # directory but the server was restarted (or the database was quarantined).
+    # If already initialized on disk and the server has a bd schema, ensure the
+    # database is also registered with the running server. Local metadata can be
+    # written before bd init seeds tables, so require the server-side schema
+    # before taking the fast path.
     if [ -f "$dir/.beads/metadata.json" ]; then
         if ensure_database_registered "$dolt_database"; then
-            # GC owns canonical metadata/config normalization after this backend
-            # bridge returns. Keep the backend focused on database registration
-            # and bd-specific bootstrap only.
-            ensure_beads_dir_permissions "$dir"
-            normalize_scope_after_init "$dir" "$prefix" "$dolt_database"
-            run_bd_pinned "$dir" config set issue_prefix "$prefix" 2>/dev/null || true
-            run_bd_pinned "$dir" config set types.custom "$custom_types" 2>/dev/null || true
-            backfill_project_id_if_missing "$dir"
-            exit 0
+            if bd_runtime_schema_ready "$dolt_database"; then
+                # GC owns canonical metadata/config normalization after this backend
+                # bridge returns. Keep the backend focused on database registration
+                # and bd-specific bootstrap only.
+                ensure_beads_dir_permissions "$dir"
+                normalize_scope_after_init "$dir" "$prefix" "$dolt_database"
+                ensure_types_custom_in_yaml "$dir" "$custom_types"
+                ensure_bd_runtime_custom_types "$dolt_database" "$custom_types"
+                ensure_bd_runtime_issue_prefix "$dolt_database" "$prefix"
+                backfill_project_id_if_missing "$dir"
+                exit 0
+            fi
+            echo "warning: database '$dolt_database' missing bd schema; re-initializing" >&2
+            bd_init_force="--force"
+        else
+            echo "warning: database '$dolt_database' not registered; re-initializing" >&2
+            bd_init_force="--force"
         fi
-        # Database registration failed — fall through to full init.
-        echo "warning: database '$dolt_database' not registered; re-initializing" >&2
     fi
 
     local host
@@ -1764,43 +2125,59 @@ op_init() {
     # server is running, always go through SQL rather than dolt init on disk.
     ensure_database_registered "$dolt_database" || true
 
-    local init_prefix="$prefix"
-    if [ "$dolt_database" != "$prefix" ]; then
-        # When the pinned Dolt database differs from the routing prefix
-        # (for example city prefix gc -> database hq), initialize bd against
-        # the actual database name and then rewrite issue_prefix afterward.
-        # Otherwise bd seeds schema into <prefix> and leaves the pinned
-        # database empty.
-        init_prefix="$dolt_database"
-    fi
+    # Run bd init in server mode through the pinned wrapper so the fallback
+    # path uses the same authenticated Dolt target as the rest of init.
+    # Metadata-only scopes already look initialized to bd, so schema-repair
+    # fallback must force reinit to seed the missing tables into the pinned DB.
+    # Always pass the pinned server database explicitly; `-p` controls the
+    # visible issue prefix, while `--database` tells bd which existing Dolt
+    # database to initialize. Without `--database`, bd can seed beads_<prefix>
+    # and leave the pinned database schema-less.
+    run_bd_init_pinned "$dir" "$prefix" "$dolt_database" "$host" "${bd_init_force:+true}"
 
-    # Run bd init in server mode.
-    (cd "$dir" && bd init --quiet --server -p "$init_prefix" --skip-hooks --skip-agents         --server-host "$host" --server-port "$DOLT_PORT"         "$dir") || die "bd init failed for $dir"
-
-    # Drop orphan database created by bd init (upstream gt-sv1h).
-    # bd init --prefix creates beads_<prefix> on the Dolt server, but we
-    # use <prefix> as the database name. Without cleanup, orphans accumulate.
-    local orphan_db="beads_${init_prefix}"
-    if [ "$orphan_db" != "$init_prefix" ]; then
-        server_sql "DROP DATABASE IF EXISTS \`$orphan_db\`" >/dev/null 2>&1 || true
-    fi
+    ensure_database_registered "$dolt_database" || true
 
     # GC owns canonical metadata/config normalization after this backend
     # bridge returns. Keep bd-specific config/migration here only.
     ensure_beads_dir_permissions "$dir"
+    if ! wait_for_bd_runtime_schema "$dolt_database"; then
+        if [ "${GC_BD_INIT_RETRY:-0}" != "1" ]; then
+            if [ -n "$bd_init_force" ]; then
+                # Metadata-only scopes can still confuse bd's first forced server init.
+                # Drop the preseeded metadata and retry through a fresh top-level
+                # invocation, matching the successful manual recovery path.
+                rm -f "$dir/.beads/metadata.json"
+            fi
+            echo "warning: bd schema for '$dolt_database' not visible after init; retrying init" >&2
+            GC_BD_INIT_RETRY=1 exec "$0" init "$dir" "$prefix" "$dolt_database"
+            die "failed to re-exec init for $dir"
+        fi
+        die "bd schema not visible for $dolt_database after init"
+    fi
+
+    # Configure custom bead types without invoking `bd config set`, which can
+    # spend tens of seconds in auto-migrate on populated stores.
+    ensure_types_custom_in_yaml "$dir" "$custom_types"
+    ensure_bd_runtime_custom_types "$dolt_database" "$custom_types"
 
     # Keep bd's runtime config in sync with GC's canonical prefix. This is
     # compatibility state for raw bd operations, not a second GC authority.
-    run_bd_pinned "$dir" config set issue_prefix "$prefix" 2>/dev/null || true
-
-    # Configure custom bead types (required since beads v0.46.0).
-    run_bd_pinned "$dir" config set types.custom "$custom_types" 2>/dev/null || true
+    ensure_bd_runtime_issue_prefix "$dolt_database" "$prefix"
 
     # Ensure database has repository fingerprint (upstream GH #25).
     # Fresh bd init already writes project_id on current upstream; only pay the
     # migration cost when metadata still lacks it.
     backfill_project_id_if_missing "$dir"
 
+    # Drop orphan database created by bd init (upstream gt-sv1h) only after
+    # the pinned database schema is visible. Some bd builds appear to stage
+    # schema work before the pinned catalog entry is fully adopted; deleting
+    # beads_<prefix> too early can discard the only initialized schema.
+    local orphan_db="beads_${prefix}"
+    if [ "$orphan_db" != "$dolt_database" ]; then
+        server_sql "DROP DATABASE IF EXISTS \`$orphan_db\`" >/dev/null 2>&1 || true
+    fi
+
     normalize_scope_after_init "$dir" "$prefix" "$dolt_database"
 }
 
@@ -1827,7 +2204,7 @@ op_store_bridge() {
     return $?
 }
 op_health() {
-    local conn_count=""
+    local conn_count="" read_only_status
 
     # TCP check.
     if ! tcp_check; then
@@ -1841,6 +2218,9 @@ op_health() {
         if ! is_remote && [ "$GC_HEALTH_READ_ONLY" = "true" ]; then
             die "dolt server is in read-only mode"
         fi
+        if ! is_remote && [ "$GC_HEALTH_READ_ONLY" = "unknown" ]; then
+            echo "warning: dolt read-only probe inconclusive" >&2
+        fi
         conn_count="$GC_HEALTH_CONNECTION_COUNT"
     else
         # Query probe.
@@ -1855,9 +2235,15 @@ op_health() {
 
         # Read-only detection (local only).
         if ! is_remote; then
-            if check_read_only; then
-                die "dolt server is in read-only mode"
-            fi
+            set +e
+            check_read_only
+            read_only_status=$?
+            set -e
+            case "$read_only_status" in
+                0) die "dolt server is in read-only mode" ;;
+                1) ;;
+                *) echo "warning: dolt read-only probe inconclusive" >&2 ;;
+            esac
         fi
 
         # Connection capacity warning (non-fatal, single query).
@@ -1915,6 +2301,8 @@ op_probe() {
 
 # op_recover stops the dolt server, restarts it, and verifies health.
 op_recover() {
+    local read_only_status
+
     if is_remote; then
         die "recovery not supported for remote dolt servers"
     fi
@@ -1939,8 +2327,15 @@ op_recover() {
             if [ "$GC_HEALTH_READ_ONLY" = "true" ]; then
                 echo "detected read-only dolt server — restarting" >&2
             fi
-        elif check_read_only; then
-            echo "detected read-only dolt server — restarting" >&2
+        else
+            set +e
+            check_read_only
+            read_only_status=$?
+            set -e
+            case "$read_only_status" in
+                0) echo "detected read-only dolt server — restarting" >&2 ;;
+                2) echo "dolt read-only probe inconclusive before recovery" >&2 ;;
+            esac
         fi
     fi
 
@@ -2098,7 +2493,7 @@ case "$op" in
     start)        op_start ;;
     ensure-ready) op_ensure_ready ;;
     init)         op_init "$@" ;;
-    create|get|update|close|list|ready|children|list-by-label|set-metadata|delete|dep-add|dep-remove|dep-list)
+    create|get|update|close|reopen|list|ready|children|list-by-label|set-metadata|delete|dep-add|dep-remove|dep-list)
                   op_store_bridge "$op" "$@" ;;
     health)       op_health ;;
     probe)        op_probe ;;
diff --git a/examples/bd/embed.go b/examples/bd/embed.go
index d810ebf505..fccb70411e 100644
--- a/examples/bd/embed.go
+++ b/examples/bd/embed.go
@@ -3,7 +3,7 @@ package bd
 
 import "embed"
 
-// PackFS contains the bd pack files: pack.toml, doctor/, template-fragments/, and assets/.
+// PackFS contains the bd pack files, including assets/scripts/gc-beads-bd.sh.
 //
 //go:embed pack.toml doctor template-fragments all:assets
 var PackFS embed.FS
diff --git a/examples/dolt/commands/cleanup/run.sh b/examples/dolt/commands/cleanup/run.sh
index bf5bd4ef54..1aced1bdc8 100755
--- a/examples/dolt/commands/cleanup/run.sh
+++ b/examples/dolt/commands/cleanup/run.sh
@@ -6,11 +6,20 @@
 # databases (dry-run). Use --force to remove them.
 # Use --max to set a safety limit (refuses if more orphans than --max).
 #
-# Environment: GC_CITY_PATH
+# Removal strategy: when the dolt SQL server is reachable, --force issues
+# `DROP DATABASE IF EXISTS` through the running server (server-side NBS lock
+# serializes the close+remove safely). Falling back to filesystem `rm -rf`
+# while the server has the database open corrupts NBS state and crash-loops
+# the journal on next restart (#1549). The fallback is only taken when the
+# server is provably unreachable AND the operator passes --server-down-ok.
+#
+# Environment: GC_CITY_PATH (also GC_DOLT_PORT, GC_DOLT_HOST, GC_DOLT_USER,
+# GC_DOLT_PASSWORD when probing the running server)
 set -e
 
 force=false
 max_orphans=50
+server_down_ok=false
 PACK_DIR="${GC_PACK_DIR:-$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)}"
 . "$PACK_DIR/assets/scripts/runtime.sh"
 data_dir="$DOLT_DATA_DIR"
@@ -19,14 +28,20 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --force) force=true; shift ;;
     --max)   max_orphans="$2"; shift 2 ;;
+    --server-down-ok) server_down_ok=true; shift ;;
     -h|--help)
-      echo "Usage: gc dolt cleanup [--force] [--max N]"
+      echo "Usage: gc dolt cleanup [--force] [--max N] [--server-down-ok]"
       echo ""
       echo "Find Dolt databases not referenced by any registered rig."
       echo ""
       echo "Flags:"
-      echo "  --force    Actually remove orphaned databases"
-      echo "  --max N    Refuse if more than N orphans (default: 50)"
+      echo "  --force            Actually remove orphaned databases"
+      echo "  --max N            Refuse if more than N orphans (default: 50)"
+      echo "  --server-down-ok   Permit filesystem rm fallback when the dolt"
+      echo "                     server is provably stopped. Without this flag"
+      echo "                     --force refuses to run when dolt is unreachable,"
+      echo "                     because rm -rf against a live server's data"
+      echo "                     directory corrupts NBS state (#1549)."
       exit 0
       ;;
     *) echo "gc dolt cleanup: unknown flag: $1" >&2; exit 1 ;;
@@ -82,7 +97,7 @@ orphan_count=0
 for d in "$data_dir"/*/; do
   [ ! -d "$d/.dolt" ] && continue
   name="$(basename "$d")"
-  case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|__gc_probe) continue ;; esac
+  case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) continue ;; esac
   case "$referenced" in
     *" $name "*) continue ;; # referenced, not orphan
   esac
@@ -197,11 +212,94 @@ if [ "$force" != true ]; then
   exit 0
 fi
 
+# Choose deletion strategy. Four states the probe can land in (the
+# "cannot probe" state was missed initially — `managed_runtime_tcp_reachable`
+# returns false for both genuinely-unreachable AND no-probe-tool-available,
+# which would otherwise let --server-down-ok rm against a live server on
+# systems missing both nc and python3):
+#   * SELECT 1 succeeds → server is up and answering; SQL DROP is safe.
+#   * Port reachable but SELECT 1 fails → server may still hold open fds;
+#     refuse regardless of --server-down-ok (the flag advertises a STOPPED
+#     server, not an unhealthy one).
+#   * Cannot probe TCP (no nc, no python3) → cannot establish "stopped";
+#     refuse regardless of --server-down-ok.
+#   * Port unreachable → server is stopped; fall back to rm only when the
+#     operator has acknowledged via --server-down-ok.
+host="${GC_DOLT_HOST:-127.0.0.1}"
+: "${GC_DOLT_USER:=root}"
+export DOLT_CLI_PASSWORD="${GC_DOLT_PASSWORD:-}"
+
+# dolt_sql_q TIMEOUT QUERY  — invoke dolt CLI with each arg explicitly quoted
+# so neither host nor user (env-controlled) word-splits into adjacent flags
+# even on unexpected values. Stdout/stderr are captured by callers as needed.
+dolt_sql_q() {
+  _dolt_sql_q_timeout="$1"; shift
+  run_bounded "$_dolt_sql_q_timeout" \
+    dolt --host "$host" --port "$GC_DOLT_PORT" --user "$GC_DOLT_USER" --no-tls \
+    sql -q "$1"
+}
+
+probe_available=false
+if command -v nc >/dev/null 2>&1 || command -v python3 >/dev/null 2>&1; then
+  probe_available=true
+fi
+
+tcp_reachable=false
+if [ "$probe_available" = true ] \
+  && [ -n "$GC_DOLT_PORT" ] \
+  && command -v managed_runtime_tcp_reachable >/dev/null 2>&1 \
+  && managed_runtime_tcp_reachable "$GC_DOLT_PORT"; then
+  tcp_reachable=true
+fi
+
+sql_works=false
+if [ "$tcp_reachable" = true ] \
+  && command -v dolt >/dev/null 2>&1 \
+  && command -v run_bounded >/dev/null 2>&1 \
+  && dolt_sql_q 5 "SELECT 1" >/dev/null 2>&1; then
+  sql_works=true
+fi
+
+unset delete_via
+if [ "$sql_works" = true ]; then
+  delete_via=sql
+elif [ "$tcp_reachable" = true ]; then
+  echo "gc dolt cleanup: dolt is listening on port $GC_DOLT_PORT but 'SELECT 1' failed;" >&2
+  echo "  refusing to rm against a potentially-live server (#1549). Fix SQL access or stop dolt and retry." >&2
+  exit 1
+elif [ "$probe_available" = false ]; then
+  echo "gc dolt cleanup: cannot probe TCP reachability (neither nc nor python3 available);" >&2
+  echo "  refusing rm fallback regardless of --server-down-ok — cannot establish 'server is stopped' (#1549)." >&2
+  echo "  Install nc or python3, or stop dolt and use 'dolt sql -q \"DROP DATABASE\"' against another live instance." >&2
+  exit 1
+elif [ "$server_down_ok" = true ]; then
+  delete_via=rm
+else
+  echo "gc dolt cleanup: dolt server unreachable on port ${GC_DOLT_PORT:-unset};" >&2
+  echo "  rm -rf against per-database dirs while the server is up corrupts NBS state (#1549)." >&2
+  echo "  Either start dolt and re-run, or pass --server-down-ok if the server is intentionally stopped." >&2
+  exit 1
+fi
+# Belt-and-suspenders: a future edit that opens a fall-through path here would
+# silently route to the rm branch below, re-introducing the corruption #1549
+# fixes. Crash loudly instead.
+case "${delete_via:-}" in
+  sql|rm) ;;
+  *) echo "gc dolt cleanup: internal error — delete_via not set" >&2; exit 1 ;;
+esac
+
 # Remove each orphan. Track refusals and successful removals via tmpfiles so
-# the subshell's counters survive (the pipe creates a subshell).
+# the subshell's counters survive (the pipe creates a subshell). Identifier-
+# safety refusals are tracked separately because they signal "DB in an
+# impossible state" (manual fs mucking, corrupted metadata, attempted
+# injection) and must surface as a non-zero exit even when other orphans were
+# removed successfully — overlap-allowlist refusals stay on the existing
+# partial-progress semantics ("did the batch make as much progress as it
+# could").
 refused_tmp=$(mktemp)
 removed_tmp=$(mktemp)
-trap 'rm -f "$allowlist_file" "$refused_tmp" "$removed_tmp"' EXIT
+unsafe_tmp=$(mktemp)
+trap 'rm -f "$allowlist_file" "$refused_tmp" "$removed_tmp" "$unsafe_tmp"' EXIT
 echo "$orphans" | while IFS='|' read -r db_name size path; do
   [ -z "$db_name" ] && continue
 
@@ -216,23 +314,65 @@ echo "$orphans" | while IFS='|' read -r db_name size path; do
     continue
   fi
 
-  if rm -rf "$path"; then
-    echo "removed" >> "$removed_tmp"
-    echo "  Removed $db_name"
+  # Identifier safety: dolt_database flows from operator-controlled metadata.json
+  # straight into a backtick-quoted SQL identifier. Reject anything outside the
+  # safe charset before interpolating, so an embedded backtick or semicolon
+  # cannot break out of the quoted identifier into arbitrary SQL. Charset
+  # matches `valid_database_name` in commands/gc-nudge/run.sh so a name probed
+  # by `gc dolt health` or nudged by `gc dolt gc-nudge` is also reachable here.
+  case "$db_name" in
+    [A-Za-z0-9_]*)
+      case "$db_name" in
+        *[!A-Za-z0-9_-]*)
+          echo "refusing to remove '$db_name': name contains forbidden characters (allowed: A-Z, a-z, 0-9, _, -)" >&2
+          echo "unsafe" >> "$unsafe_tmp"
+          continue
+          ;;
+      esac
+      ;;
+    *)
+      echo "refusing to remove '$db_name': name must start with [A-Za-z0-9_]" >&2
+      echo "unsafe" >> "$unsafe_tmp"
+      continue
+      ;;
+  esac
+
+  if [ "$delete_via" = sql ]; then
+    # Capture stdout+stderr so a DROP failure (auth, TLS, unknown-db, etc.)
+    # surfaces actionable detail to the operator instead of a generic message.
+    if drop_output=$(dolt_sql_q 30 "DROP DATABASE IF EXISTS \`$db_name\`" 2>&1); then
+      echo "removed" >> "$removed_tmp"
+      echo "  Dropped $db_name"
+    else
+      echo "  Failed to drop $db_name via SQL: ${drop_output:-(no output)}" >&2
+    fi
   else
-    echo "  Failed to remove $db_name" >&2
+    if rm -rf "$path"; then
+      echo "removed" >> "$removed_tmp"
+      echo "  Removed $db_name"
+    else
+      echo "  Failed to remove $db_name" >&2
+    fi
   fi
 done
 
-# Count removed and refused (the removal loop runs in a subshell, so the
-# parent shell reads back through the tmpfiles).
+# Count removed, refused (allowlist), and unsafe (identifier-safety) (the
+# removal loop runs in a subshell, so the parent shell reads back through the
+# tmpfiles).
 removed=$(wc -l < "$removed_tmp" | tr -d ' ')
 refused_count=$(wc -l < "$refused_tmp" | tr -d ' ')
+unsafe_count=$(wc -l < "$unsafe_tmp" | tr -d ' ')
 echo ""
 echo "Removed $removed of $orphan_count orphaned database(s)."
 
-# Exit non-zero if any orphan was refused or failed to remove.
-if [ "$removed" -lt "$((orphan_count - refused_count))" ] \
+# Exit non-zero when:
+#   * any unsafe identifier was found — DB in an impossible state, demands
+#     operator attention even if other orphans were removed, OR
+#   * any orphan failed to remove (count math doesn't add up — silent failure
+#     in the loop), OR
+#   * the entire batch was refused (no progress made).
+if [ "$unsafe_count" -gt 0 ] \
+  || [ "$removed" -lt "$((orphan_count - refused_count - unsafe_count))" ] \
   || { [ "$refused_count" -gt 0 ] && [ "$removed" -eq 0 ]; }; then
   exit 1
 fi
diff --git a/examples/dolt/commands/gc-nudge/run.sh b/examples/dolt/commands/gc-nudge/run.sh
index 302c988d3e..135dc3bcbf 100755
--- a/examples/dolt/commands/gc-nudge/run.sh
+++ b/examples/dolt/commands/gc-nudge/run.sh
@@ -209,7 +209,7 @@ valid_database_name() {
 is_system_database() {
   name=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')
   case "$name" in
-    information_schema|mysql|dolt_cluster|__gc_probe) return 0 ;;
+    information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) return 0 ;;
     *) return 1 ;;
   esac
 }
diff --git a/examples/dolt/commands/health/run.sh b/examples/dolt/commands/health/run.sh
index 4490dffb44..1f6a2d4763 100755
--- a/examples/dolt/commands/health/run.sh
+++ b/examples/dolt/commands/health/run.sh
@@ -133,7 +133,7 @@ if [ -d "$data_dir" ] && [ "$server_reachable" = true ]; then
   for d in "$data_dir"/*/; do
     [ ! -d "$d/.dolt" ] && continue
     name="$(basename "$d")"
-    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|__gc_probe) continue ;; esac
+    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) continue ;; esac
     # Reject names with anything outside [A-Za-z0-9_-] before interpolating
     # into the SQL identifier. The first byte must still be alnum/underscore
     # so the command-side contract matches gc-nudge and avoids option-shaped
@@ -213,7 +213,7 @@ if [ -d "$data_dir" ]; then
   for d in "$data_dir"/*/; do
     [ ! -d "$d/.dolt" ] && continue
     name="$(basename "$d")"
-    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|__gc_probe) continue ;; esac
+    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) continue ;; esac
     case "$referenced" in *" $name "*) continue ;; esac
     size_bytes=$(du -sb "$d" 2>/dev/null | cut -f1 || echo 0)
     if [ "$size_bytes" -ge 1048576 ]; then
diff --git a/examples/dolt/commands/list/run.sh b/examples/dolt/commands/list/run.sh
index 8c38303b6d..40c1191c60 100755
--- a/examples/dolt/commands/list/run.sh
+++ b/examples/dolt/commands/list/run.sh
@@ -21,7 +21,7 @@ for d in "$data_dir"/*/; do
   name="$(basename "$d")"
   # Skip system databases.
   case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in
-    information_schema|mysql|dolt_cluster|__gc_probe) continue ;;
+    information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) continue ;;
   esac
   printf "%s\t%s\n" "$name" "$d"
   found=$((found + 1))
diff --git a/examples/dolt/commands/sql/run.sh b/examples/dolt/commands/sql/run.sh
index 3bf6bf7b4e..f1820b173c 100755
--- a/examples/dolt/commands/sql/run.sh
+++ b/examples/dolt/commands/sql/run.sh
@@ -1,8 +1,10 @@
 #!/bin/sh
-# gc dolt sql — Open an interactive Dolt SQL shell.
+# gc dolt sql — Open a Dolt SQL shell or run a one-shot query.
 #
 # Connects to the running Dolt server if available, otherwise opens
-# in embedded mode using the first database directory found.
+# in embedded mode using the first database directory found. Trailing
+# arguments are forwarded verbatim to `dolt sql`, so non-interactive
+# use is supported via `gc dolt sql -q "QUERY"`.
 #
 # Environment: GC_CITY_PATH, GC_DOLT_HOST, GC_DOLT_PORT, GC_DOLT_USER,
 #              GC_DOLT_PASSWORD (all optional except GC_CITY_PATH)
@@ -37,7 +39,7 @@ if is_running; then
   if [ -n "$GC_DOLT_PASSWORD" ]; then
     export DOLT_CLI_PASSWORD="$GC_DOLT_PASSWORD"
   fi
-  exec dolt $args sql
+  exec dolt $args sql "$@"
 else
   # Embedded mode — find first database directory.
   if [ ! -d "$data_dir" ]; then
@@ -52,5 +54,5 @@ else
     echo "gc dolt sql: no dolt server running and no databases found" >&2
     exit 1
   fi
-  exec dolt --data-dir "$data_dir" sql
+  exec dolt --data-dir "$data_dir" sql "$@"
 fi
diff --git a/examples/dolt/commands/sync/run.sh b/examples/dolt/commands/sync/run.sh
index 853eb08b7d..b0328f9862 100755
--- a/examples/dolt/commands/sync/run.sh
+++ b/examples/dolt/commands/sync/run.sh
@@ -41,10 +41,12 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-if [ "$(printf '%s' "$db_filter" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | tr '[:upper:]' '[:lower:]')" = "__gc_probe" ]; then
-  echo "gc dolt sync: reserved Dolt database name: __gc_probe (used internally by gc)" >&2
+case "$(printf '%s' "$db_filter" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | tr '[:upper:]' '[:lower:]')" in
+  information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe)
+  echo "gc dolt sync: reserved Dolt database name: $(printf '%s' "$db_filter" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') (used internally by Dolt or gc)" >&2
   exit 1
-fi
+  ;;
+esac
 
 # Check if server is running.
 is_running() {
@@ -82,7 +84,7 @@ if [ "$do_gc" = true ] && [ -d "$data_dir" ]; then
   for d in "$data_dir"/*/; do
     [ ! -d "$d/.dolt" ] && continue
     name="$(basename "$d")"
-    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|__gc_probe) continue ;; esac
+    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) continue ;; esac
     [ -n "$db_filter" ] && [ "$name" != "$db_filter" ] && continue
     beads_dir=""
     # Find the .beads directory for this database.
@@ -120,7 +122,7 @@ if [ -d "$data_dir" ]; then
   for d in "$data_dir"/*/; do
     [ ! -d "$d/.dolt" ] && continue
     name="$(basename "$d")"
-    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|__gc_probe) continue ;; esac
+    case "$(printf '%s' "$name" | tr '[:upper:]' '[:lower:]')" in information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe) continue ;; esac
     [ -n "$db_filter" ] && [ "$name" != "$db_filter" ] && continue
 
     # Check for remote.
diff --git a/examples/dolt/doctor/check-dolt/run.sh b/examples/dolt/doctor/check-dolt/run.sh
index bf3b16fb28..2519ee33e6 100755
--- a/examples/dolt/doctor/check-dolt/run.sh
+++ b/examples/dolt/doctor/check-dolt/run.sh
@@ -80,5 +80,70 @@ if [ -z "$version" ]; then
     exit 1
 fi
 
+# Require dolt >= 1.86.2 due to upstream GC/writer deadlock fix.
+# Older versions hang sql-server during dolt_backup('sync', ...) under
+# heavy concurrent write load; the watchdog then force-kills the server.
+# See dolthub/dolt commit ccf7bde206 (PR #10876).
+required="1.86.2"
+
+parse_dolt_version() {
+    local input="$1"
+    local token
+    local core
+    local version_core
+    token=$(printf '%s' "$input" | sed -E 's/^[Dd]olt[[:space:]]+[Vv]ersion[[:space:]]+//; s/[[:space:]].*$//; s/^v//')
+    version_core="${token%%+*}"
+    if [[ "$version_core" == *-* ]]; then
+        core="${version_core%%-*}"
+        if [[ ! "$core" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
+            return 1
+        fi
+        return 2
+    fi
+    token="$version_core"
+    if [[ ! "$token" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
+        return 1
+    fi
+    printf '%s\n' "$token"
+}
+
+version_lt() {
+    local a="$1"
+    local b="$2"
+    local IFS=.
+    local a_major a_minor a_patch b_major b_minor b_patch
+    read -r a_major a_minor a_patch <<<"$a"
+    read -r b_major b_minor b_patch <<<"$b"
+    if ((10#$a_major != 10#$b_major)); then
+        ((10#$a_major < 10#$b_major))
+        return $?
+    fi
+    if ((10#$a_minor != 10#$b_minor)); then
+        ((10#$a_minor < 10#$b_minor))
+        return $?
+    fi
+    ((10#$a_patch < 10#$b_patch))
+}
+
+parse_status=0
+ver_str=$(parse_dolt_version "$version") || parse_status=$?
+if [ "$parse_status" -eq 2 ]; then
+    echo "$version is a pre-release build (need final >= $required) — upgrade required"
+    echo "Reason: pre-release builds are not guaranteed to include dolthub/dolt commit ccf7bde206."
+    echo "Install: https://github.com/dolthub/dolt/releases"
+    exit 2
+fi
+if [ "$parse_status" -ne 0 ]; then
+    echo "unrecognized dolt version output: $version"
+    echo "install dolt: https://docs.dolthub.com/introduction/installation"
+    exit 1
+fi
+if version_lt "$ver_str" "$required"; then
+    echo "dolt $ver_str is too old (need >= $required) — upgrade required"
+    echo "Reason: <1.86.2 has a GC/writer deadlock that hangs sql-server during dolt_backup sync under heavy commit load. See dolthub/dolt commit ccf7bde206."
+    echo "Install: https://github.com/dolthub/dolt/releases"
+    exit 2
+fi
+
 echo "dolt available ($version), flock ok, lsof ok"
 exit 0
diff --git a/examples/dolt/doctor_test.go b/examples/dolt/doctor_test.go
new file mode 100644
index 0000000000..57058eb898
--- /dev/null
+++ b/examples/dolt/doctor_test.go
@@ -0,0 +1,364 @@
+package dolt_test
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// doctorCheckScript is the on-disk path to the dolt doctor check.
+// The dolt pack wraps each doctor check in its own directory with a
+// `run.sh` entry point (and a sibling `doctor.toml` descriptor).
+const doctorCheckScript = "doctor/check-dolt/run.sh"
+
+// shellQuote wraps s in single quotes, escaping any inner single
+// quotes. The result is safe to splice into a /bin/sh argument.
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, `'`, `'\''`) + "'"
+}
+
+// strPtr returns a pointer to a string literal — used so a nil
+// `dolt` field can express "no shim at all" distinctly from "shim
+// emits empty version".
+func strPtr(s string) *string { return &s }
+
+// lookPathInto looks up host on the host's PATH and, if found,
+// symlinks it into bin under the name linkName. Returns true on
+// success so callers can chain alternatives.
+func lookPathInto(t *testing.T, bin, host, linkName string) bool {
+	t.Helper()
+	hostPath, err := exec.LookPath(host)
+	if err != nil {
+		return false
+	}
+	if err := os.Symlink(hostPath, filepath.Join(bin, linkName)); err != nil {
+		t.Fatalf("symlink %q -> %q: %v", host, linkName, err)
+	}
+	return true
+}
+
+// doctorSandboxOpts configures the test sandbox for runDoctorCheck.
+//
+//	dolt == nil          → no dolt binary on PATH (simulates the
+//	                       missing-binary branch at the top of run.sh).
+//	dolt != nil          → install a shim whose `dolt version` first
+//	                       line is the pointed-to string.
+//	includeFlock / Lsof  → install (or omit) flock / lsof shims.
+type doctorSandboxOpts struct {
+	dolt         *string
+	includeFlock bool
+	includeLsof  bool
+}
+
+// doctorSandbox builds an isolated PATH directory for run.sh.
+//
+// The script invokes head, sed, and a timeout binary
+// (timeout/gtimeout) externally. Because the sandbox replaces PATH
+// wholesale (rather than prepending), we symlink real coreutils into
+// the sandbox so those calls still succeed; otherwise PATH isolation
+// would break the script before it reaches the logic under test.
+// dolt / flock / lsof are controlled per-test via opts so we can
+// toggle each missing-binary branch independently of the host's
+// installed tools.
+func doctorSandbox(t *testing.T, opts doctorSandboxOpts) string {
+	t.Helper()
+	bin := t.TempDir()
+	for _, tool := range []string{"head", "sed"} {
+		hostPath, err := exec.LookPath(tool)
+		if err != nil {
+			t.Fatalf("LookPath(%q): %v", tool, err)
+		}
+		if err := os.Symlink(hostPath, filepath.Join(bin, tool)); err != nil {
+			t.Fatalf("symlink %q: %v", tool, err)
+		}
+	}
+	// run.sh wraps `dolt version` in run_bounded, which prefers
+	// gtimeout, then timeout. Symlink whichever is on the host as
+	// `timeout` in the sandbox so the bounded path is exercised.
+	// macOS without coreutils ships neither binary; fall back to
+	// python3, which run_bounded handles last. Skip if none of the
+	// three are available — the script's behavior is unobservable.
+	switch {
+	case lookPathInto(t, bin, "timeout", "timeout"):
+	case lookPathInto(t, bin, "gtimeout", "timeout"):
+	case lookPathInto(t, bin, "python3", "python3"):
+	default:
+		t.Skip("neither timeout, gtimeout, nor python3 installed; cannot exercise run_bounded")
+	}
+	if opts.dolt != nil {
+		writeExecutable(t, filepath.Join(bin, "dolt"), fmt.Sprintf(
+			"#!/bin/sh\n[ \"$1\" = \"version\" ] && echo %s\nexit 0\n",
+			shellQuote(*opts.dolt),
+		))
+	}
+	if opts.includeFlock {
+		writeExecutable(t, filepath.Join(bin, "flock"), "#!/bin/sh\nexit 0\n")
+	}
+	if opts.includeLsof {
+		writeExecutable(t, filepath.Join(bin, "lsof"), "#!/bin/sh\nexit 0\n")
+	}
+	return bin
+}
+
+// runDoctorCheck invokes doctor/check-dolt/run.sh with PATH set to
+// the provided sandbox. Returns the exit code and the combined
+// stdout+stderr (the script writes its diagnostics to stdout, but
+// catching both is robust against a future refactor that splits
+// streams).
+func runDoctorCheck(t *testing.T, sandboxBin string) (int, string) {
+	t.Helper()
+	root := repoRoot(t)
+	cmd := exec.Command("bash", filepath.Join(root, doctorCheckScript))
+	cmd.Env = append(filteredEnv("PATH"), "PATH="+sandboxBin)
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		return 0, string(out)
+	}
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		return exitErr.ExitCode(), string(out)
+	}
+	t.Fatalf("running %s: %v\noutput:\n%s", doctorCheckScript, err, out)
+	return 0, ""
+}
+
+// TestDoctorCheckVersionFloor exercises the dolt >= 1.86.2
+// version-gate added in ga-iwec. The gate guards against an
+// upstream GC/writer deadlock fixed in dolthub/dolt commit
+// ccf7bde206 (PR #10876) — older binaries hang sql-server during
+// dolt_backup('sync', ...) under heavy commit load. The gate must:
+//
+//  1. Reject older minors (1.85.9) AND the specific deadlock-
+//     affected version (1.86.1), with an explainer pointing at
+//     ccf7bde206 so on-call has the upstream context.
+//  2. Accept the boundary 1.86.2 exactly.
+//  3. Accept versions where the minor segment is multi-digit
+//     (1.86.10); lexical string comparison would order 1.86.10
+//     before 1.86.2 and reject it.
+//  4. Accept the next major (2.0.0).
+//  5. Reject pre-release/dev builds at the floor, while accepting
+//     build metadata on a final release.
+//  6. Fail closed when `dolt version` produces empty or
+//     unparseable output. The "no dolt at all" path is already
+//     covered by the command-not-found branch at the top of the
+//     script.
+func TestDoctorCheckVersionFloor(t *testing.T) {
+	tests := []struct {
+		name        string
+		version     string
+		wantExit    int
+		wantContain []string
+		wantOmit    []string
+	}{
+		{
+			name:        "older minor 1.85.9 rejected",
+			version:     "dolt version 1.85.9",
+			wantExit:    2,
+			wantContain: []string{"too old", "1.85.9", "1.86.2", "ccf7bde206"},
+		},
+		{
+			name:        "deadlock-affected 1.86.1 rejected",
+			version:     "dolt version 1.86.1",
+			wantExit:    2,
+			wantContain: []string{"too old", "1.86.1", "1.86.2", "ccf7bde206"},
+		},
+		{
+			name:        "boundary 1.86.2 accepted",
+			version:     "dolt version 1.86.2",
+			wantExit:    0,
+			wantContain: []string{"dolt available", "1.86.2", "flock ok", "lsof ok"},
+			wantOmit:    []string{"too old"},
+		},
+		{
+			name:        "multi-digit minor 1.86.10 accepted",
+			version:     "dolt version 1.86.10",
+			wantExit:    0,
+			wantContain: []string{"dolt available", "1.86.10"},
+			wantOmit:    []string{"too old"},
+		},
+		{
+			name:        "next major 2.0.0 accepted",
+			version:     "dolt version 2.0.0",
+			wantExit:    0,
+			wantContain: []string{"dolt available", "2.0.0"},
+			wantOmit:    []string{"too old"},
+		},
+		{
+			name:        "pre-release 1.86.2-rc1 rejected",
+			version:     "dolt version 1.86.2-rc1",
+			wantExit:    2,
+			wantContain: []string{"pre-release", "1.86.2-rc1", "1.86.2"},
+			wantOmit:    []string{"dolt available"},
+		},
+		{
+			name:        "pre-release with build metadata 1.86.2-rc1+build.5 rejected",
+			version:     "dolt version 1.86.2-rc1+build.5",
+			wantExit:    2,
+			wantContain: []string{"pre-release", "1.86.2-rc1+build.5", "1.86.2"},
+			wantOmit:    []string{"dolt available"},
+		},
+		{
+			name:        "dev build 1.86.2-dev rejected",
+			version:     "dolt version 1.86.2-dev.0",
+			wantExit:    2,
+			wantContain: []string{"pre-release", "1.86.2-dev.0", "1.86.2"},
+			wantOmit:    []string{"dolt available"},
+		},
+		{
+			name:        "pre-release above floor 1.99.0-rc1 rejected",
+			version:     "dolt version 1.99.0-rc1",
+			wantExit:    2,
+			wantContain: []string{"pre-release", "1.99.0-rc1", "1.86.2"},
+			wantOmit:    []string{"dolt available"},
+		},
+		{
+			name:        "pre-release next major 2.0.0-rc1 rejected",
+			version:     "dolt version 2.0.0-rc1",
+			wantExit:    2,
+			wantContain: []string{"pre-release", "2.0.0-rc1", "1.86.2"},
+			wantOmit:    []string{"dolt available"},
+		},
+		{
+			name:        "build metadata on 1.86.2 accepted",
+			version:     "dolt version 1.86.2+build.5",
+			wantExit:    0,
+			wantContain: []string{"dolt available", "1.86.2+build.5"},
+			wantOmit:    []string{"too old", "pre-release"},
+		},
+		{
+			name:        "hyphenated build metadata on 1.86.2 accepted",
+			version:     "dolt version 1.86.2+build-5",
+			wantExit:    0,
+			wantContain: []string{"dolt available", "1.86.2+build-5"},
+			wantOmit:    []string{"too old", "pre-release"},
+		},
+		{
+			name:        "v-prefixed 1.86.2 accepted",
+			version:     "dolt version v1.86.2",
+			wantExit:    0,
+			wantContain: []string{"dolt available", "v1.86.2", "flock ok", "lsof ok"},
+			wantOmit:    []string{"too old", "unrecognized"},
+		},
+		{
+			// Empty `dolt version` output is rejected at the top
+			// of the script (origin/main commit 885d07c2 added the
+			// "unrecognized dolt version output" branch). The
+			// version-floor gate must not trigger here — it would
+			// be a false positive to claim the binary is "too old"
+			// when we couldn't determine the version at all.
+			name:        "empty version output rejected before gate",
+			version:     "",
+			wantExit:    1,
+			wantContain: []string{"unrecognized dolt version output"},
+			wantOmit:    []string{"too old"},
+		},
+		{
+			name:        "non-version output fails closed",
+			version:     "weird-binary-junk",
+			wantExit:    1,
+			wantContain: []string{"unrecognized dolt version output"},
+			wantOmit:    []string{"too old"},
+		},
+		{
+			name:        "two-component 1.86 rejected",
+			version:     "dolt version 1.86",
+			wantExit:    1,
+			wantContain: []string{"unrecognized dolt version output"},
+			wantOmit:    []string{"too old", "pre-release"},
+		},
+		{
+			name:        "leading whitespace output rejected",
+			version:     "  dolt version 1.85.9",
+			wantExit:    1,
+			wantContain: []string{"unrecognized dolt version output"},
+			wantOmit:    []string{"too old", "pre-release"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			bin := doctorSandbox(t, doctorSandboxOpts{
+				dolt:         strPtr(tt.version),
+				includeFlock: true,
+				includeLsof:  true,
+			})
+			code, out := runDoctorCheck(t, bin)
+			if code != tt.wantExit {
+				t.Errorf("exit = %d, want %d\noutput:\n%s", code, tt.wantExit, out)
+			}
+			for _, sub := range tt.wantContain {
+				if !strings.Contains(out, sub) {
+					t.Errorf("output missing %q\noutput:\n%s", sub, out)
+				}
+			}
+			for _, sub := range tt.wantOmit {
+				if strings.Contains(out, sub) {
+					t.Errorf("output unexpectedly contains %q\noutput:\n%s", sub, out)
+				}
+			}
+		})
+	}
+}
+
+func TestDoctorCheckVersionFloorDoesNotRequireVersionSort(t *testing.T) {
+	bin := doctorSandbox(t, doctorSandboxOpts{
+		dolt:         strPtr("dolt version 1.86.10"),
+		includeFlock: true,
+		includeLsof:  true,
+	})
+	sortPath := filepath.Join(bin, "sort")
+	if err := os.Remove(sortPath); err != nil && !os.IsNotExist(err) {
+		t.Fatalf("remove sort shim: %v", err)
+	}
+	writeExecutable(t, sortPath, "#!/bin/sh\necho 'sort -V unsupported' >&2\nexit 64\n")
+
+	code, out := runDoctorCheck(t, bin)
+	if code != 0 {
+		t.Fatalf("exit = %d, want 0 without sort -V\noutput:\n%s", code, out)
+	}
+	if !strings.Contains(out, "dolt available") {
+		t.Fatalf("output = %s, want successful version probe", out)
+	}
+}
+
+// TestDoctorCheckMissingFlock asserts the script exits 2 with the
+// flock install hint when flock is absent. flock guards against
+// concurrent dolt server starts; running without it can race two
+// servers onto the same data directory and corrupt state.
+func TestDoctorCheckMissingFlock(t *testing.T) {
+	bin := doctorSandbox(t, doctorSandboxOpts{
+		dolt:         strPtr("dolt version 1.86.2"),
+		includeFlock: false,
+		includeLsof:  true,
+	})
+	code, out := runDoctorCheck(t, bin)
+	if code != 2 {
+		t.Errorf("exit = %d, want 2\noutput:\n%s", code, out)
+	}
+	if !strings.Contains(out, "flock not found") {
+		t.Errorf("output missing %q\noutput:\n%s", "flock not found", out)
+	}
+}
+
+// TestDoctorCheckMissingLsof asserts the script exits 2 with the
+// lsof install hint when lsof is absent. lsof is required for the
+// port-conflict detection path in runtime.sh / health.sh; failing
+// fast here keeps the rest of the pack from misdiagnosing port
+// state later.
+func TestDoctorCheckMissingLsof(t *testing.T) {
+	bin := doctorSandbox(t, doctorSandboxOpts{
+		dolt:         strPtr("dolt version 1.86.2"),
+		includeFlock: true,
+		includeLsof:  false,
+	})
+	code, out := runDoctorCheck(t, bin)
+	if code != 2 {
+		t.Errorf("exit = %d, want 2\noutput:\n%s", code, out)
+	}
+	if !strings.Contains(out, "lsof not found") {
+		t.Errorf("output missing %q\noutput:\n%s", "lsof not found", out)
+	}
+}
diff --git a/examples/dolt/formulas/mol-dog-backup.toml b/examples/dolt/formulas/mol-dog-backup.toml
index ed8a6b6681..6e849db48c 100644
--- a/examples/dolt/formulas/mol-dog-backup.toml
+++ b/examples/dolt/formulas/mol-dog-backup.toml
@@ -32,23 +32,59 @@ version = 1
 description = "List of databases to back up (comma-separated, or empty for auto-discover)"
 default = ""
 
+[[steps]]
+id = "preflight"
+title = "Verify dolt version compatible with backup sync"
+description = """
+**Required:** dolt >= 1.86.2.
+
+Older dolt versions have a GC/writer deadlock that hangs the sql-server
+during dolt_backup sync against databases under heavy concurrent write
+load (e.g. the gm bead store). The watchdog will kill the hung server
+and disrupt every dependent agent.
+
+Run:
+```bash
+dolt version | head -1
+```
+
+If the version is < 1.86.2, abort the molecule and nudge the mayor to
+upgrade dolt. Do NOT proceed to the sync step or close it as successful.
+
+Close this bead with:
+```bash
+bd update "$GC_BEAD_ID" --set-metadata gc.outcome=fail --set-metadata gc.failure_class=hard --set-metadata gc.failure_reason=dolt-too-old --status closed
+```
+This formula does not wire scoped-abort metadata; the failed preflight outcome
+is the stop signal. Check the preflight outcome before acting on `sync`.
+"""
+
 [[steps]]
 id = "sync"
 title = "Sync databases to backup remotes"
+needs = ["preflight"]
 description = """
 Run dolt backup sync for each production database.
 
-**1. Determine databases:**
+**1. Verify preflight passed:**
+Before running any `dolt backup sync`, read the `preflight` bead in this
+molecule and verify its `gc.outcome` metadata is `pass`. If the preflight
+outcome is `fail` or missing, close this bead with `gc.outcome=fail`,
+`gc.failure_class=hard`, and `gc.failure_reason=preflight-failed`. Do not run
+sync. This formula does not wire scoped-abort metadata; this check is the
+enforcement point.
+
+**2. Determine databases:**
 Use configured databases list, or auto-discover databases with
 `<name>-backup` remotes configured.
 
-**2. For each database:**
+**3. For each database:**
 ```bash
 cd <data_dir>/<db>
 dolt backup sync <db>-backup
 ```
 
-**3. Record results:**
+**4. Record results:**
 - Databases synced successfully
 - Databases that failed (with error)
 - Duration per database
@@ -94,7 +130,7 @@ Generate summary and signal completion.
 
 **2. Signal completion:**
 ```bash
-gc nudge deacon/ "DOG_DONE: backup — synced <count>/<total>, offsite: <status>"
+gc session nudge deacon/ "DOG_DONE: backup — synced <count>/<total>, offsite: <status>"
 ```
 
 **3. Close work and exit:**
diff --git a/examples/dolt/formulas/mol-dog-compactor.toml b/examples/dolt/formulas/mol-dog-compactor.toml
index 3f5abf02ec..aeadcf25db 100644
--- a/examples/dolt/formulas/mol-dog-compactor.toml
+++ b/examples/dolt/formulas/mol-dog-compactor.toml
@@ -178,7 +178,7 @@ Generate summary of compaction cycle.
 
 **2. Signal completion:**
 ```bash
-gc nudge deacon/ "DOG_DONE: compactor — compacted <count> databases, mode: {{mode}}"
+gc session nudge deacon/ "DOG_DONE: compactor — compacted <count> databases, mode: {{mode}}"
 ```
 
 **3. Close work and exit:**
diff --git a/examples/dolt/formulas/mol-dog-doctor.toml b/examples/dolt/formulas/mol-dog-doctor.toml
index 696633d447..8faf2f4c48 100644
--- a/examples/dolt/formulas/mol-dog-doctor.toml
+++ b/examples/dolt/formulas/mol-dog-doctor.toml
@@ -100,7 +100,8 @@ Check data directory size. Warn if exceeding configured threshold.
 SHOW DATABASES;
 ```
 Count databases matching orphan patterns: testdb_*, beads_t*, beads_pt*, doctest_*.
-Ignore Dolt internals: information_schema, mysql, dolt_cluster, __gc_probe.
+Ignore Dolt internals: information_schema, mysql, dolt_cluster,
+performance_schema, sys, __gc_probe.
 If orphan count > threshold, recommend cleanup:
 ```bash
 gc dolt cleanup
@@ -142,7 +143,7 @@ gc mail send mayor/ -s "ESCALATION: Dolt health critical [CRITICAL]" \\
 
 **3. Signal completion:**
 ```bash
-gc nudge deacon/ "DOG_DONE: doctor — server: <status>, conns: <count>/<max>, orphans: <count>"
+gc session nudge deacon/ "DOG_DONE: doctor — server: <status>, conns: <count>/<max>, orphans: <count>"
 ```
 
 **4. Close work and exit:**
diff --git a/examples/dolt/formulas/mol-dog-phantom-db.toml b/examples/dolt/formulas/mol-dog-phantom-db.toml
index 1169d93c87..5fab8715ea 100644
--- a/examples/dolt/formulas/mol-dog-phantom-db.toml
+++ b/examples/dolt/formulas/mol-dog-phantom-db.toml
@@ -1,20 +1,26 @@
 description = """
-Detect phantom databases in .dolt-data/ that can crash the Dolt server.
+Detect unservable databases in .dolt-data/ that can crash or confuse the Dolt server.
 
 A phantom database is a directory in .dolt-data/ that has a .dolt/ subdirectory
 but is missing the noms/manifest file. When Dolt auto-discovers these dirs at
 startup, the broken noms store crashes INFORMATION_SCHEMA and can take down
 the entire server.
 
+A retired replacement database is a directory whose name ends with
+.replaced-YYYYMMDDTHHMMSSZ. Dolt can leave these behind with a valid manifest
+after a replacement operation fails to cleanly remove the old directory. They
+must not be auto-discovered as active databases on the next start.
+
 This formula adds continuous monitoring: detect phantoms that appear between
 server restarts (e.g., from DROP DATABASE + branch_control re-materialization),
-and escalate before the next restart hits them.
+and retired replacements left by Dolt, then escalate before the next restart
+hits them.
 
 ## Dog Contract
 
 This is infrastructure work. You:
-1. Scan the .dolt-data/ directory for phantom databases
-2. Quarantine any phantoms found (remove corrupted dirs)
+1. Scan the .dolt-data/ directory for unservable databases
+2. Quarantine any phantoms or retired replacements found
 3. Report findings and exit
 4. Return to kennel
 
@@ -27,7 +33,8 @@ This is infrastructure work. You:
 ## Safety
 
 Phantom database directories have NO valid data (missing noms/manifest).
-Removing them is safe and prevents server crashes.
+Retired replacement directories may contain recoverable data, so move both
+cases into .quarantine/ instead of deleting them.
 
 Read each step's description before acting — Config values override defaults."""
 formula = "mol-dog-phantom-db"
@@ -40,66 +47,74 @@ default = ".dolt-data"
 
 [[steps]]
 id = "scan"
-title = "Scan for phantom databases"
+title = "Scan for unservable databases"
 description = """
-Scan the .dolt-data/ directory for phantom database directories.
+Scan the .dolt-data/ directory for unservable database directories.
 
 **1. List all directories in {{data_dir}}/:**
 ```bash
 ls -d {{data_dir}}/*/
 ```
 
-**2. For each directory, check for phantom condition:**
+**2. For each directory, check for unservable conditions:**
 A phantom database has:
 - A `.dolt/` subdirectory (looks like a database)
 - But NO `noms/manifest` file (broken/corrupted)
 
+A retired replacement database has:
+- A `.dolt/` subdirectory
+- A basename matching `*.replaced-YYYYMMDDTHHMMSSZ`
+
 ```bash
 # For each dir in {{data_dir}}/:
 #   if <dir>/.dolt/ exists AND <dir>/.dolt/noms/manifest does NOT exist:
 #     -> phantom detected
+#   if basename matches *.replaced-[0-9]{8}T[0-9]{6}Z:
+#     -> retired replacement detected
 ```
 
 **3. Record findings:**
 - Total directories scanned
 - Phantom databases found (names and paths)
+- Retired replacement databases found (names and paths)
 - Valid databases found
 
-**Exit criteria:** Scan complete, phantoms identified."""
+**Exit criteria:** Scan complete, unservable databases identified."""
 
 [[steps]]
 id = "quarantine"
-title = "Quarantine phantom databases"
+title = "Quarantine unservable databases"
 needs = ["scan"]
 description = """
-Remove phantom database directories to prevent server crashes.
+Move unservable database directories to quarantine before Dolt auto-discovers them.
 
-**1. If no phantoms found:**
+**1. If no unservable databases were found:**
 Skip this step — nothing to quarantine.
 
-**2. For each phantom database:**
-Remove the corrupted directory:
+**2. For each phantom or retired replacement database:**
+Move the directory into .quarantine/:
 ```bash
-rm -rf {{data_dir}}/<phantom-name>
+mkdir -p {{data_dir}}/.quarantine
+mv -f {{data_dir}}/<database-name> {{data_dir}}/.quarantine/$(date +%Y%m%dT%H%M%S)-<database-name>
 ```
 
 This is safe because:
-- The directory has no valid noms store (no manifest)
-- It contains no recoverable data
-- Leaving it would crash the server on next restart
+- Missing-manifest phantoms cannot be served by Dolt
+- Retired replacements are no longer the active database
+- The move preserves data for later inspection or recovery
 
 **3. Record results:**
-- Count of phantoms quarantined
+- Count of unservable databases quarantined
 - Any errors during removal
 
-**4. Escalate if phantoms were found:**
-Phantom databases indicate a Dolt bug that should be investigated:
+**4. Escalate if unservable databases were found:**
+Unservable databases indicate a Dolt cleanup or data-dir hygiene issue that should be investigated:
 ```bash
-gc mail send mayor/ -s "ESCALATION: Quarantined phantom databases [HIGH]" \\
-  -m "Found and quarantined <count> phantom database(s): <names>"
+gc mail send mayor/ -s "ESCALATION: Quarantined unservable databases [HIGH]" \\
+  -m "Found and quarantined <count> unservable database(s): <names>"
 ```
 
-**Exit criteria:** All phantoms quarantined (or none found)."""
+**Exit criteria:** All unservable databases quarantined (or none found)."""
 
 [[steps]]
 id = "report"
@@ -111,12 +126,13 @@ Generate summary and signal completion.
 **1. Generate report summary:**
 - Directories scanned
 - Phantoms found
-- Phantoms quarantined
+- Retired replacements found
+- Unservable databases quarantined
 - Valid databases
 
 **2. Signal completion:**
 ```bash
-gc nudge deacon/ "DOG_DONE: phantom-db — scanned: <count>, phantoms: <count>"
+gc session nudge deacon/ "DOG_DONE: phantom-db — scanned: <count>, phantoms: <count>"
 ```
 
 **3. Close work and exit:**
diff --git a/examples/dolt/formulas/mol-dog-stale-db.toml b/examples/dolt/formulas/mol-dog-stale-db.toml
index 67805e0117..8ec9f255f5 100644
--- a/examples/dolt/formulas/mol-dog-stale-db.toml
+++ b/examples/dolt/formulas/mol-dog-stale-db.toml
@@ -1,151 +1,274 @@
 description = """
-Detect stale and test databases accumulating in the Dolt server.
+Detect and clean stale Dolt databases and orphan Dolt processes.
 
-Stale databases are orphaned test databases (testdb_*, beads_t*, beads_pt*,
-doctest_*, doctortest_*, beads_vr*) that accumulate on the production Dolt
-server when tests leak or cleanup fails. These consume disk space, degrade
-server performance, and inflate SHOW DATABASES output.
-
-This formula adds continuous monitoring: detect orphan accumulation before
-it reaches crisis levels.
+This formula shells out to `gc dolt-cleanup --json`, parses the
+`gc.dolt.cleanup.v1` envelope, and emits one summary line per stage
+to `gc events` so operators skimming a long scrollback can spot
+trends. The full JSON report is appended to the work bead so a
+follow-up reader can `bd show <id>` to see details.
 
 ## Dog Contract
 
 This is infrastructure work. You:
-1. Query SHOW DATABASES and identify stale/test databases
-2. Count and classify orphans
-3. Clean up if count is manageable, escalate if excessive
-4. Report findings and exit
-5. Return to kennel
+1. Run a dry-run `gc dolt-cleanup --json --probe` scan.
+2. Decide: no work -> report, at/below stale-DB threshold -> apply, above threshold -> escalate.
+3. Apply with `gc dolt-cleanup --json --probe --force` only when safe.
+4. Report findings, nudge deacon if past warn threshold, exit.
+5. Return to kennel.
 
 ## Variables
 
 | Variable | Source | Description |
 |----------|--------|-------------|
-| port | config | Dolt server port (default 3307) |
-| max_orphans_for_sql | config | Max orphans for SQL-based cleanup (default 50) |
-| warn_threshold | config | Orphan count to trigger warning (default 5) |
+| max_orphans_for_sql | formula default | Max stale dropped databases before escalating instead of forcing (default 20) |
+| warn_threshold | formula default | Orphan count that triggers a warning to deacon (default 5) |
 
 ## Safety
 
-Only removes databases matching known test/orphan patterns. Production databases
-are identified by rig registry via gc rig list --json and are never touched.
-External rigs are supported (not subject to local glob limitations).
+`gc dolt-cleanup` resolves the Dolt port via the AD-04 chain
+(--port flag > city dolt.port > <rigRoot>/.beads/dolt-server.port >
+legacy 3307). Invalid explicit ports and unreadable or invalid rig
+port files fail closed; only absent rig port files can reach the
+legacy default. It cross-references registered rigs (HQ-first) and
+will not drop any database whose name matches a registered rig DB,
+nor any Dolt internals (`information_schema`, `mysql`,
+`dolt_cluster`, `__gc_probe`). Orphan-process kills are restricted
+to processes whose `--config` path lives under the test-config
+allowlist (`/tmp/Test*`, `os.TempDir()/Test*`, `~/.gotmp/Test*`).
+Database identifiers used for destructive DROP and purge calls must
+contain only ASCII letters, digits, underscores, and non-leading
+hyphens; rigs with other `dolt_database` names should be renamed or
+handled manually so the cleanup can stay SQL-injection safe.
+
+The apply branch treats a non-zero `gc dolt-cleanup --probe --force`
+exit as an operator escalation. Do not retry from this formula with
+the separate `gc dolt cleanup --server-down-ok` fallback; that is a
+TTY-only human action after independently verifying the dolt server
+process is stopped and the port is closed.
 
-Read each step's description before acting — Config values override defaults."""
+The runtime work is intentionally one formula step. Formula steps are
+separate agent interactions, so scan, decision, apply, and report state
+must stay inside one shell execution instead of relying on variables to
+cross step boundaries."""
 formula = "mol-dog-stale-db"
 version = 1
 
 [vars]
-[vars.port]
-description = "Dolt server port"
-default = "3307"
-
 [vars.max_orphans_for_sql]
-description = "Maximum orphan count for SQL-based cleanup (above this, escalate instead)"
-default = "50"
+description = "Maximum stale dropped database count the formula auto-applies; above this, it escalates instead"
+default = "20"
 
 [vars.warn_threshold]
-description = "Orphan count that triggers a warning"
+description = "Orphan count that triggers a warning nudge to deacon"
 default = "5"
 
 [[steps]]
-id = "scan"
-title = "Scan for stale and test databases"
+id = "cleanup"
+title = "Scan, decide, apply, and report stale Dolt cleanup"
 description = """
-Query the Dolt server and identify orphaned databases.
+Run this as one shell script so every derived value remains in the same process:
 
-**1. Query SHOW DATABASES:**
-```sql
-SHOW DATABASES;
-```
-Filter out Dolt internals (information_schema, mysql, dolt_cluster,
-__gc_probe).
+```bash
+set -euo pipefail
 
-**2. Classify each database:**
+WORK_BEAD="${GC_BEAD_ID:?GC_BEAD_ID required (set by gc hook); aborting}"
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/dolt-cleanup.XXXXXX")
+DRAIN_ACKED=0
 
-Known test/orphan patterns:
-- `testdb_*` — test harness databases
-- `beads_t*` — beads test databases
-- `beads_pt*` — beads patrol test databases
-- `beads_vr*` — beads version test databases
-- `doctest_*` — documentation test databases
-- `doctortest_*` — doctor test databases
+cleanup() {
+  rm -rf "$TMP_DIR"
+  if [ "$DRAIN_ACKED" -ne 1 ]; then
+    gc runtime drain-ack || true
+  fi
+}
+trap cleanup EXIT
 
-Production databases are those referenced by any rig's metadata.
+SCAN_FILE="$TMP_DIR/scan.json"
+APPLY_FILE="$TMP_DIR/apply.json"
 
-**3. Record findings:**
-- Total database count
-- Production database count and names
-- Orphan database count and names
-- Orphan total size (check filesystem)
+append_report_note() {
+  local title="$1"
+  local file="$2"
+  if [ -s "$file" ]; then
+    if ! bd update "$WORK_BEAD" --append-notes "$(printf '## %s %s\n\n```json\n%s\n```' "$title" "$(date -Is)" "$(cat "$file")")"; then
+      echo "failed to append ${title} report; continuing to drain-ack" >&2
+    fi
+  fi
+}
 
-**Exit criteria:** All databases classified."""
+run_or_warn() {
+  local label="$1"
+  shift
+  if ! "$@"; then
+    echo "${label} failed; continuing to drain-ack" >&2
+  fi
+}
 
-[[steps]]
-id = "cleanup"
-title = "Clean up orphan databases"
-needs = ["scan"]
-description = """
-Remove orphan databases if count is manageable.
+drain_ack_once() {
+  if [ "$DRAIN_ACKED" -ne 1 ]; then
+    gc runtime drain-ack
+    DRAIN_ACKED=1
+  fi
+}
 
-**1. If no orphans found:**
-Skip — nothing to clean.
+fail_open_after_drain() {
+  local message="$1"
+  echo "$message" >&2
+  drain_ack_once # drain-ack before failing open
+  exit 1
+}
 
-**2. If orphan count <= {{max_orphans_for_sql}}:**
-Clean up via SQL:
-```sql
-DROP DATABASE IF EXISTS `<orphan_name>`;
-```
+if ! gc dolt-cleanup --json --probe > "$SCAN_FILE"; then
+  append_report_note "scan (dry-run failed)" "$SCAN_FILE"
+  run_or_warn "emit dry-run failure escalation" gc event emit mol-dog-stale-db.escalate \
+    --message "dry-run failed before a valid cleanup decision; leaving work bead open"
+  fail_open_after_drain "gc dolt-cleanup dry-run failed; leaving work bead open"
+fi
+if ! jq -e '.schema == "gc.dolt.cleanup.v1"' "$SCAN_FILE" >/dev/null; then
+  append_report_note "scan (invalid JSON)" "$SCAN_FILE"
+  run_or_warn "emit invalid dry-run JSON escalation" gc event emit mol-dog-stale-db.escalate \
+    --message "dry-run returned invalid JSON; leaving work bead open"
+  fail_open_after_drain "gc dolt-cleanup dry-run returned invalid JSON; leaving work bead open"
+fi
 
-**3. If orphan count > {{max_orphans_for_sql}}:**
-SQL cleanup would take too long. Use gc dolt cleanup instead:
-```bash
-gc dolt cleanup --force --max <count>
-```
-If even that fails, escalate:
-```bash
-gc mail send mayor/ -s "ESCALATION: <count> orphan databases detected [HIGH]" \\
-  -m "Too many orphans for SQL cleanup. Recommend filesystem cleanup."
-```
+ORPHAN_DBS=$(jq -r '.dropped.count // 0' "$SCAN_FILE")
+ORPHAN_PROCS=$(jq -r '.reaped.targets | length' "$SCAN_FILE")
+ORPHAN_TOTAL=$((ORPHAN_DBS + ORPHAN_PROCS))
+DISK_BYTES=$(jq -r '.summary.bytes_freed_disk // .purge.bytes_reclaimed // 0' "$SCAN_FILE")
+RSS_BYTES=$(jq -r '.summary.bytes_freed_rss // 0' "$SCAN_FILE")
+SCAN_ERRS=$(jq -r '.summary.errors_total // 0' "$SCAN_FILE")
+INVALID_DROP_SKIPS=$(jq -r '[.dropped.skipped[]? | select(.reason == "invalid-identifier")] | length' "$SCAN_FILE")
+SCAN_FORCE_BLOCKERS=$(jq -r '[.force_blockers[]?] | length' "$SCAN_FILE")
 
-**4. Record results:**
-- Orphans removed (count)
-- Orphans remaining (count)
-- Any errors during cleanup
+run_or_warn "emit scan event" gc event emit mol-dog-stale-db.scan \
+  --message "$ORPHAN_DBS orphans (${DISK_BYTES} bytes), $ORPHAN_PROCS procs (${RSS_BYTES} bytes)" \
+  --payload "$(jq -c '{dropped: .dropped.count, purge_bytes: .purge.bytes_reclaimed, procs: (.reaped.targets | length), rss_bytes: .summary.bytes_freed_rss, errors: .summary.errors_total, invalid_identifier_skips: ([.dropped.skipped[]? | select(.reason == "invalid-identifier")] | length), force_blockers: ([.force_blockers[]?] | length)}' "$SCAN_FILE")"
 
-**Exit criteria:** Orphans cleaned (or escalated if too many)."""
+append_report_note "scan (dry-run)" "$SCAN_FILE"
 
-[[steps]]
-id = "report"
-title = "Report findings and return to kennel"
-needs = ["cleanup"]
-description = """
-Generate summary and signal completion.
+APPLIED=0
+ESCALATED=0
+DONE_BYTES=0
+DONE_ERRS="$SCAN_ERRS"
+DROP_OK=0
+DROP_FAIL=0
+PURGE_BYTES=0
+MISSED_PURGE_BYTES=0
+REAP_KILLED=0
+REAP_TOTAL="$ORPHAN_PROCS"
 
-**1. Generate report summary:**
-- Total databases
-- Production databases
-- Orphan databases found
-- Orphans removed
-- Orphans remaining
+if [ "$SCAN_ERRS" -gt 0 ] || [ "$INVALID_DROP_SKIPS" -gt 0 ] || [ "$SCAN_FORCE_BLOCKERS" -gt 0 ]; then
+  ESCALATED=1
+  run_or_warn "send dry-run error escalation mail" gc mail send mayor \
+    "ESCALATION: Dolt cleanup dry-run reported ${SCAN_ERRS} error(s), ${INVALID_DROP_SKIPS} invalid stale database identifier(s), ${SCAN_FORCE_BLOCKERS} force blocker(s)" \
+    "Dry-run report attached to work bead. Operator review required before forcing cleanup."
+  run_or_warn "emit dry-run error escalation" gc event emit mol-dog-stale-db.escalate \
+    --message "dry-run reported ${SCAN_ERRS} error(s), ${INVALID_DROP_SKIPS} invalid stale database identifier(s), ${SCAN_FORCE_BLOCKERS} force blocker(s); leaving work bead open"
+  fail_open_after_drain "gc dolt-cleanup dry-run reported ${SCAN_ERRS} error(s), ${INVALID_DROP_SKIPS} invalid stale database identifier(s), ${SCAN_FORCE_BLOCKERS} force blocker(s); leaving work bead open"
+elif [ "$ORPHAN_TOTAL" -eq 0 ] && [ "$DISK_BYTES" -le 0 ]; then
+  :
+elif [ "$ORPHAN_DBS" -gt "{{max_orphans_for_sql}}" ]; then
+  ESCALATED=1
+  DONE_BYTES=$((DISK_BYTES + RSS_BYTES))
+  run_or_warn "send max-orphan escalation mail" gc mail send mayor \
+    "ESCALATION: $ORPHAN_DBS stale Dolt databases exceed max_orphans_for_sql={{max_orphans_for_sql}}" \
+    "Dry-run report attached to work bead. Operator review required before forcing cleanup."
+  run_or_warn "emit max-orphan escalation" gc event emit mol-dog-stale-db.escalate \
+    --message "$ORPHAN_DBS stale databases > max_orphans_for_sql={{max_orphans_for_sql}} -> mail sent to mayor"
+else
+  if ! gc dolt-cleanup --json --probe --force --max-orphan-dbs "{{max_orphans_for_sql}}" > "$APPLY_FILE"; then
+    ESCALATED=1
+    append_report_note "apply (--force, failed)" "$APPLY_FILE"
+    run_or_warn "send apply refusal escalation mail" gc mail send mayor \
+      "ESCALATION: gc dolt-cleanup apply refused [HIGH]" \
+      "gc dolt-cleanup --probe --force refused. Do not retry from an agent. Operator must confirm dolt is stopped (process gone AND port closed), then use the separate gc dolt cleanup --server-down-ok fallback if appropriate."
+    run_or_warn "emit apply refusal escalation" gc event emit mol-dog-stale-db.escalate \
+      --message "apply refused; operator must verify dolt stopped before using gc dolt cleanup --server-down-ok"
+    fail_open_after_drain "gc dolt-cleanup apply failed; leaving work bead open"
+  fi
+  if ! jq -e '.schema == "gc.dolt.cleanup.v1"' "$APPLY_FILE" >/dev/null; then
+    append_report_note "apply (--force, invalid JSON)" "$APPLY_FILE"
+    run_or_warn "emit invalid apply JSON escalation" gc event emit mol-dog-stale-db.escalate \
+      --message "apply returned invalid JSON; leaving work bead open"
+    fail_open_after_drain "gc dolt-cleanup apply returned invalid JSON; leaving work bead open"
+  fi
 
-**2. Warn if above threshold:**
-If orphan count >= {{warn_threshold}}:
-```bash
-gc nudge deacon/ "WARN: <count> orphan databases detected"
-```
+  APPLY_ERRS=$(jq -r '.summary.errors_total // 0' "$APPLY_FILE")
+  APPLY_MAX_ORPHAN_REFUSALS=$(jq -r '[.errors[]? | select((.kind // "") == "max-orphan-refusal" or (((.error // "" | ascii_downcase) | (contains("--max-orphan-dbs") or contains("max-orphan") or contains("orphan databases")) and (contains("refus") or contains("exceed")))))] | length' "$APPLY_FILE")
+  if [ "$APPLY_ERRS" -gt 0 ] || [ "$APPLY_MAX_ORPHAN_REFUSALS" -gt 0 ]; then
+    ESCALATED=1
+    APPLY_REFUSAL_MESSAGE="apply reported ${APPLY_ERRS} error(s); leaving work bead open"
+    if [ "$APPLY_MAX_ORPHAN_REFUSALS" -gt 0 ]; then
+      APPLY_REFUSAL_MESSAGE="apply refused by max-orphan safety guard; leaving work bead open"
+    fi
+    append_report_note "apply (--force, refused)" "$APPLY_FILE"
+    run_or_warn "send apply refusal escalation mail" gc mail send mayor \
+      "ESCALATION: gc dolt-cleanup apply refused [HIGH]" \
+      "gc dolt-cleanup --probe --force refused or reported ${APPLY_ERRS} error(s). Do not retry from an agent. Operator must inspect the attached apply report before deciding whether any manual cleanup is appropriate."
+    run_or_warn "emit apply refusal escalation" gc event emit mol-dog-stale-db.escalate \
+      --message "$APPLY_REFUSAL_MESSAGE"
+    fail_open_after_drain "gc dolt-cleanup ${APPLY_REFUSAL_MESSAGE}"
+  fi
 
-**3. Signal completion:**
-```bash
-gc nudge deacon/ "DOG_DONE: stale-db — orphans: <count>, removed: <count>"
-```
+  DROP_OK=$(jq -r '.dropped.count // 0' "$APPLY_FILE")
+  DROP_FAIL=$(jq -r '.dropped.failed | length' "$APPLY_FILE")
+  PURGE_BYTES=$(jq -r '.purge.bytes_reclaimed // 0' "$APPLY_FILE")
+  REAP_KILLED=$(jq -r '.reaped.count // 0' "$APPLY_FILE")
+  REAP_TOTAL=$(jq -r '.reaped.targets | length' "$APPLY_FILE")
+  DONE_ERRS=$(jq -r '.summary.errors_total // 0' "$APPLY_FILE")
+  DONE_BYTES=$(jq -r '(.summary.bytes_freed_disk // 0) + (.summary.bytes_freed_rss // 0)' "$APPLY_FILE")
+  if [ "$PURGE_BYTES" -lt "$DISK_BYTES" ]; then
+    MISSED_PURGE_BYTES=$((DISK_BYTES - PURGE_BYTES))
+    DONE_ERRS=$((DONE_ERRS + 1))
+  fi
+  APPLIED=1
 
-**4. Close work and exit:**
-```bash
-gc bd close <work-bead> --reason "Stale DB scan complete"
-gc runtime drain-ack
+  run_or_warn "emit drop event" gc event emit mol-dog-stale-db.drop \
+    --message "${DROP_OK}/${ORPHAN_DBS} ok, ${DROP_FAIL} failed"
+
+  PURGE_MESSAGE="${PURGE_BYTES} bytes reclaimed"
+  if [ "$MISSED_PURGE_BYTES" -gt 0 ]; then
+    PURGE_MESSAGE="${PURGE_MESSAGE} (${MISSED_PURGE_BYTES} bytes missed)"
+  fi
+  run_or_warn "emit purge event" gc event emit mol-dog-stale-db.purge \
+    --message "$PURGE_MESSAGE"
+
+  run_or_warn "emit reap event" gc event emit mol-dog-stale-db.reap \
+    --message "${REAP_KILLED}/${REAP_TOTAL} procs killed"
+
+  append_report_note "apply (--force)" "$APPLY_FILE"
+fi
+
+if [ "$APPLIED" -eq 1 ]; then
+  DONE_MESSAGE="${DONE_BYTES} bytes freed; ${DONE_ERRS} errors"
+else
+  DONE_MESSAGE="${DONE_BYTES} bytes reclaimable; ${DONE_ERRS} errors"
+fi
+
+run_or_warn "emit done event" gc event emit mol-dog-stale-db.done \
+  --message "$DONE_MESSAGE"
+
+if [ "$APPLIED" -eq 1 ] && [ "$MISSED_PURGE_BYTES" -gt 0 ]; then
+  ESCALATED=1
+  run_or_warn "emit missed purge escalation" gc event emit mol-dog-stale-db.escalate \
+    --message "apply missed ${MISSED_PURGE_BYTES} reclaimable bytes; leaving work bead open"
+fi
+
+if [ "$ORPHAN_TOTAL" -ge "{{warn_threshold}}" ]; then
+  gc session nudge deacon "WARN: $ORPHAN_TOTAL Dolt orphan(s) seen this scan (warn_threshold={{warn_threshold}})" || true
+fi
+
+gc session nudge deacon "DOG_DONE: stale-db - orphans: ${ORPHAN_TOTAL}, applied: ${APPLIED}, escalated: ${ESCALATED}" || true
+
+if [ "$APPLIED" -eq 1 ] && [ "$MISSED_PURGE_BYTES" -gt 0 ]; then
+  fail_open_after_drain "gc dolt-cleanup apply missed ${MISSED_PURGE_BYTES} reclaimable bytes; leaving work bead open"
+fi
+
+bd close "$WORK_BEAD" --reason "Stale DB scan complete (orphans=${ORPHAN_TOTAL}, applied=${APPLIED}, escalated=${ESCALATED})"
+drain_ack_once # drain-ack before normal exit
 exit
 ```
 
-**Exit criteria:** Report sent, dog returned to kennel."""
+**Exit criteria:** JSON schema validated, scan JSON attached, apply JSON
+attached when forced, stage events emitted, deacon nudged through
+`gc session nudge`, work bead closed, dog returned to kennel."""
diff --git a/examples/dolt/orders/mol-dog-stale-db.toml b/examples/dolt/orders/mol-dog-stale-db.toml
index 30e38dfa6c..6cf5cdde43 100644
--- a/examples/dolt/orders/mol-dog-stale-db.toml
+++ b/examples/dolt/orders/mol-dog-stale-db.toml
@@ -1,6 +1,9 @@
+# Stale-database cleanup. Fires every four hours while the new threshold
+# proves out; after a measured week this can move back toward a nightly
+# schedule if the orphan counts stay below escalation levels.
 [order]
-description = "Detect and clean orphan Dolt databases"
+description = "Detect and clean stale Dolt databases and orphan dolt sql-server processes"
 formula = "mol-dog-stale-db"
-trigger = "cooldown"
-interval = "15m"
+trigger = "cron"
+schedule = "0 */4 * * *"
 pool = "dog"
diff --git a/examples/dolt/pack.toml b/examples/dolt/pack.toml
index 11825b5206..41a734f1d8 100644
--- a/examples/dolt/pack.toml
+++ b/examples/dolt/pack.toml
@@ -4,6 +4,12 @@
 # rollback, cleanup, health) for the Dolt SQL server backing bead storage.
 #
 # Dog-backed formulas and orders rely on the city's maintenance pack.
+#
+# Minimum dolt version: 1.86.2. Earlier versions have a GC/writer deadlock
+# that hangs sql-server during dolt_backup sync under heavy concurrent write
+# load. See dolthub/dolt commit ccf7bde206 (PR #10876). The doctor check
+# (doctor/check-dolt) fails closed; mol-dog-backup preflight records the same
+# failure outcome, and the sync step checks it before running backup sync.
 
 [pack]
 name = "dolt"
diff --git a/examples/dolt/sql_test.go b/examples/dolt/sql_test.go
new file mode 100644
index 0000000000..1878b2312c
--- /dev/null
+++ b/examples/dolt/sql_test.go
@@ -0,0 +1,139 @@
+// Package dolt_test validates that the dolt pack's sql.sh script
+// forwards extra arguments to the underlying `dolt sql` invocation.
+// Without forwarding, `gc dolt sql -q "QUERY"` is silently dropped:
+// the script execs `dolt … sql` and the agent's diagnostic SQL never
+// runs. The operational-awareness fragment relies on this for the
+// non-fatal Dolt diagnostic protocol (issue #1485).
+package dolt_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const sqlScript = "commands/sql/run.sh"
+
+// writeFakeDolt installs a stub `dolt` binary in dir that records
+// argv (one arg per line) to a file inside dir and exits 0. Returns
+// the argv-log path. Used to assert the wrapper script forwards args
+// verbatim without booting a real Dolt server.
+func writeFakeDolt(t *testing.T, dir string) string {
+	t.Helper()
+	argvFile := filepath.Join(dir, "argv.log")
+	body := `#!/bin/sh
+for a in "$@"; do
+  printf '%s\n' "$a"
+done > "` + argvFile + `"
+exit 0
+`
+	if err := os.WriteFile(filepath.Join(dir, "dolt"), []byte(body), 0o755); err != nil {
+		t.Fatalf("write fake dolt: %v", err)
+	}
+	return argvFile
+}
+
+// readArgv returns the recorded argv from a single fake-dolt
+// invocation. Empty if the binary was never called.
+func readArgv(t *testing.T, argvFile string) []string {
+	t.Helper()
+	data, err := os.ReadFile(argvFile)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		t.Fatalf("read argv file: %v", err)
+	}
+	trimmed := strings.Trim(string(data), "\n")
+	if trimmed == "" {
+		return nil
+	}
+	return strings.Split(trimmed, "\n")
+}
+
+// TestSQLScriptForwardsQueryArgs is the regression guard for the
+// arg-forwarding gap that motivated the #1485 fix. The wrapper used
+// to call `exec dolt $args sql` (no "$@"), which silently dropped
+// `-q "QUERY"`. The non-fatal Dolt diagnostic protocol (SHOW FULL
+// PROCESSLIST via `gc dolt sql -q`) only works if the wrapper passes
+// trailing args through.
+func TestSQLScriptForwardsQueryArgs(t *testing.T) {
+	root := repoRoot(t)
+	script := filepath.Join(root, sqlScript)
+
+	binDir := t.TempDir()
+	argvFile := writeFakeDolt(t, binDir)
+
+	// Provide a minimal data dir so the embedded branch finds a
+	// dolt-shaped subdirectory and reaches the exec. GC_DOLT_DATA_DIR
+	// overrides runtime.sh's DOLT_DATA_DIR computation directly.
+	cityPath := t.TempDir()
+	dataDir := filepath.Join(cityPath, "data")
+	if err := os.MkdirAll(filepath.Join(dataDir, "testdb", ".dolt"), 0o755); err != nil {
+		t.Fatalf("mkdir db: %v", err)
+	}
+
+	// Strip every Dolt-related env var the script consults so the
+	// branch selection inside the wrapper is determined entirely by
+	// the values set below. An ambient GC_DOLT_HOST in CI or a
+	// developer shell would otherwise silently flip the branch and
+	// hide whether the embedded path actually exercised "$@".
+	// Use a non-numeric GC_DOLT_PORT so managed_runtime_tcp_reachable
+	// (runtime.sh) takes its `''|*[!0-9]*` early-return path and the
+	// script falls deterministically into the embedded branch. This
+	// avoids the bind-then-close TOCTOU window of an "unused" port.
+	cmd := exec.Command("sh", script, "-q", "SELECT 1")
+	cmd.Env = append(filteredEnv("PATH",
+		"GC_DOLT_HOST", "GC_DOLT_PORT", "GC_DOLT_USER",
+		"GC_DOLT_PASSWORD", "GC_DOLT_DATA_DIR",
+		"GC_CITY_PATH", "GC_PACK_DIR",
+	),
+		"PATH="+binDir+":"+os.Getenv("PATH"),
+		"GC_CITY_PATH="+cityPath,
+		"GC_PACK_DIR="+root,
+		"GC_DOLT_DATA_DIR="+dataDir,
+		"GC_DOLT_PORT=unreachable",
+		"GC_DOLT_USER=root",
+		"GC_DOLT_PASSWORD=",
+	)
+
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("sql.sh exited non-zero: %v\noutput: %s", err, out)
+	}
+
+	argv := readArgv(t, argvFile)
+	if len(argv) == 0 {
+		t.Fatalf("fake dolt was never invoked; output: %s", out)
+	}
+
+	sqlIdx := -1
+	dataDirIdx := -1
+	for i, a := range argv {
+		switch a {
+		case "sql":
+			if sqlIdx == -1 {
+				sqlIdx = i
+			}
+		case "--data-dir":
+			if dataDirIdx == -1 {
+				dataDirIdx = i
+			}
+		}
+	}
+
+	// The embedded branch must be the one that ran (--data-dir before
+	// sql). If a future bug flips the script into the connected branch,
+	// this assertion catches it before the arg-forwarding check below.
+	if dataDirIdx == -1 || dataDirIdx >= sqlIdx {
+		t.Fatalf("argv did not exercise the embedded branch (--data-dir before sql): %v", argv)
+	}
+	if sqlIdx+2 >= len(argv) {
+		t.Fatalf("argv truncated after `sql`: %v (-q SELECT 1 was dropped)", argv)
+	}
+	if argv[sqlIdx+1] != "-q" || argv[sqlIdx+2] != "SELECT 1" {
+		t.Fatalf("argv after `sql` = %v; want [-q, SELECT 1] (the wrapper is dropping trailing args)", argv[sqlIdx+1:])
+	}
+}
diff --git a/examples/dolt/stale_db_formula_test.go b/examples/dolt/stale_db_formula_test.go
new file mode 100644
index 0000000000..110eb9722c
--- /dev/null
+++ b/examples/dolt/stale_db_formula_test.go
@@ -0,0 +1,1001 @@
+package dolt_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/formula"
+	"github.com/gastownhall/gascity/internal/orders"
+)
+
+func TestStaleDBFormulaRuntimeContract(t *testing.T) {
+	root := repoRoot(t)
+	f, err := formula.NewParser().ParseFile(filepath.Join(root, "formulas", "mol-dog-stale-db.toml"))
+	if err != nil {
+		t.Fatalf("ParseFile: %v", err)
+	}
+
+	if f.Version != 1 {
+		t.Fatalf("Version = %d, want 1", f.Version)
+	}
+	if len(f.Steps) != 1 {
+		t.Fatalf("len(Steps) = %d, want 1 so shell state stays inside one formula step", len(f.Steps))
+	}
+
+	desc := f.Steps[0].Description
+	for _, want := range []string{
+		`set -euo pipefail`,
+		`WORK_BEAD="${GC_BEAD_ID:?GC_BEAD_ID required`,
+		`TMP_DIR=$(mktemp -d`,
+		`trap cleanup EXIT`,
+		`drain_ack_once()`,
+		`gc dolt-cleanup --json --probe > "$SCAN_FILE"`,
+		`gc dolt-cleanup --json --probe --force --max-orphan-dbs "{{max_orphans_for_sql}}" > "$APPLY_FILE"`,
+		`jq -r '.dropped.count // 0'`,
+		`jq -r '[.dropped.skipped[]? | select(.reason == "invalid-identifier")] | length'`,
+		`jq -r '[.force_blockers[]?] | length'`,
+		`jq -r '.reaped.targets | length'`,
+		`gc event emit mol-dog-stale-db.scan`,
+		`gc event emit mol-dog-stale-db.drop`,
+		`gc event emit mol-dog-stale-db.purge`,
+		`gc event emit mol-dog-stale-db.reap`,
+		`gc event emit mol-dog-stale-db.done`,
+		`gc event emit mol-dog-stale-db.escalate`,
+		`if [ "$APPLIED" -eq 1 ] && [ "$MISSED_PURGE_BYTES" -gt 0 ]; then`,
+		`leaving work bead open`,
+		`gc session nudge deacon "WARN: $ORPHAN_TOTAL Dolt orphan(s) seen this scan`,
+		`gc session nudge deacon "DOG_DONE: stale-db - orphans: ${ORPHAN_TOTAL}, applied: ${APPLIED}, escalated: ${ESCALATED}" || true`,
+		`escalated=${ESCALATED}`,
+	} {
+		if !strings.Contains(desc, want) {
+			t.Errorf("formula step missing %q", want)
+		}
+	}
+	for _, bad := range []string{
+		`/tmp/dolt-cleanup`,
+		`gc nudge deacon`,
+		`GC_BEAD_ID:-<work-bead>`,
+		`Dolt orphan(s) detected`,
+	} {
+		if strings.Contains(desc, bad) {
+			t.Errorf("formula step still contains retired or leaky pattern %q", bad)
+		}
+	}
+}
+
+func TestStaleDBFormulaRenderedShellIsStrictAndValid(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	for _, want := range []string{
+		`set -euo pipefail`,
+		`WORK_BEAD="${GC_BEAD_ID:?GC_BEAD_ID required`,
+	} {
+		if !strings.Contains(script, want) {
+			t.Fatalf("rendered script missing %q", want)
+		}
+	}
+
+	cmd := exec.Command("bash", "-n")
+	cmd.Stdin = strings.NewReader(script)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("bash -n failed: %v\n%s", err, out)
+	}
+}
+
+func TestStaleDBFormulaApplyErrorsLeaveWorkOpen(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	applyPath := filepath.Join(dir, "apply.json")
+	writeTestFile(t, scanPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":1,"failed":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`)
+	writeTestFile(t, applyPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[{"name":"dolt_tmp","error":"drop failed"}]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":1}}`)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    case " $* " in
+      *" --force "*) cat "$GC_TEST_APPLY_JSON" ;;
+      *) cat "$GC_TEST_SCAN_JSON" ;;
+    esac
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    echo "gc $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  update|close)
+    echo "bd $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON", "GC_TEST_APPLY_JSON"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+		"GC_TEST_APPLY_JSON="+applyPath,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	log := string(logData)
+	if err == nil {
+		t.Fatalf("rendered script exited successfully; want apply errors to fail before success close\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	for _, want := range []string{
+		"bd update bead-1 --append-notes",
+		"## apply (--force, refused)",
+		"gc event emit mol-dog-stale-db.escalate",
+		"gc runtime drain-ack",
+	} {
+		if !strings.Contains(log, want) {
+			t.Fatalf("command log missing %q\nlog:\n%s\noutput:\n%s", want, log, out)
+		}
+	}
+	for _, forbidden := range []string{
+		"gc event emit mol-dog-stale-db.drop",
+		"gc event emit mol-dog-stale-db.purge",
+		"gc event emit mol-dog-stale-db.reap",
+		"gc event emit mol-dog-stale-db.done",
+	} {
+		if strings.Contains(log, forbidden) {
+			t.Fatalf("rendered script logged forbidden success path %q despite apply errors\nlog:\n%s\noutput:\n%s", forbidden, log, out)
+		}
+	}
+	if strings.Contains(log, "bd close bead-1") {
+		t.Fatalf("rendered script closed bead successfully despite apply errors\nlog:\n%s\noutput:\n%s", log, out)
+	}
+}
+
+func TestStaleDBFormulaApplyCommandFailureAppendsApplyJSON(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	applyPath := filepath.Join(dir, "apply.json")
+	writeTestFile(t, scanPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":1,"failed":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`)
+	writeTestFile(t, applyPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[{"name":"dolt_tmp","error":"drop failed"}]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":1},"errors":[{"stage":"drop","error":"drop failed"}]}`)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    case " $* " in
+      *" --force "*)
+        cat "$GC_TEST_APPLY_JSON"
+        exit 42
+        ;;
+      *) cat "$GC_TEST_SCAN_JSON" ;;
+    esac
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    echo "gc $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  update|close)
+    echo "bd $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON", "GC_TEST_APPLY_JSON"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+		"GC_TEST_APPLY_JSON="+applyPath,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	log := string(logData)
+	if err == nil {
+		t.Fatalf("rendered script exited successfully; want failed apply command to keep work open\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	if !strings.Contains(log, "## apply (--force, failed)") {
+		t.Fatalf("failed apply JSON was not appended to work bead\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	if !strings.Contains(log, `"stage":"drop"`) {
+		t.Fatalf("appended apply note missing JSON errors\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	if strings.Contains(log, "bd close bead-1") {
+		t.Fatalf("rendered script closed bead despite failed apply command\nlog:\n%s\noutput:\n%s", log, out)
+	}
+}
+
+func TestStaleDBFormulaDryRunFailureAppendsScanJSON(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	writeTestFile(t, scanPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":1}}`)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    cat "$GC_TEST_SCAN_JSON"
+    exit 42
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    echo "gc $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  update|close)
+    echo "bd $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	log := string(logData)
+	if err == nil {
+		t.Fatalf("rendered script exited successfully; want dry-run failure to keep work open\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	if !strings.Contains(log, "bd update bead-1 --append-notes") {
+		t.Fatalf("dry-run failure did not append scan JSON to work bead\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	if strings.Contains(log, "bd close bead-1") {
+		t.Fatalf("rendered script closed bead despite dry-run failure\nlog:\n%s\noutput:\n%s", log, out)
+	}
+}
+
+func TestStaleDBFormulaCleanApplyClosesWorkAndUsesDBThreshold(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	applyPath := filepath.Join(dir, "apply.json")
+	writeTestFile(t, scanPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":20,"failed":[]},"purge":{"bytes_reclaimed":1000},"reaped":{"count":0,"targets":[{"pid":1},{"pid":2}]},"summary":{"bytes_freed_disk":1000,"bytes_freed_rss":200,"errors_total":0}}`)
+	writeTestFile(t, applyPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":20,"failed":[]},"purge":{"bytes_reclaimed":1000},"reaped":{"count":2,"targets":[{"pid":1},{"pid":2}]},"summary":{"bytes_freed_disk":1000,"bytes_freed_rss":200,"errors_total":0}}`)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    echo "gc $*" >> "$GC_TEST_LOG"
+    case " $* " in
+      *" --force "*) cat "$GC_TEST_APPLY_JSON" ;;
+      *) cat "$GC_TEST_SCAN_JSON" ;;
+    esac
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    echo "gc $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  update|close)
+    echo "bd $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON", "GC_TEST_APPLY_JSON"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+		"GC_TEST_APPLY_JSON="+applyPath,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	log := string(logData)
+	if err != nil {
+		t.Fatalf("rendered script failed: %v\nlog:\n%s\noutput:\n%s", err, log, out)
+	}
+	for _, want := range []string{
+		"gc dolt-cleanup --json --probe --force --max-orphan-dbs 20",
+		"gc event emit mol-dog-stale-db.done --message 1200 bytes freed; 0 errors",
+		"bd close bead-1",
+	} {
+		if !strings.Contains(log, want) {
+			t.Fatalf("command log missing %q\nlog:\n%s\noutput:\n%s", want, log, out)
+		}
+	}
+	if strings.Contains(log, "mol-dog-stale-db.escalate") {
+		t.Fatalf("rendered script escalated at dropped.count == max_orphans_for_sql; want apply because threshold is >\nlog:\n%s\noutput:\n%s", log, out)
+	}
+}
+
+func TestStaleDBFormulaPurgeOnlyScanApplies(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	applyPath := filepath.Join(dir, "apply.json")
+	writeTestFile(t, scanPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"bytes_reclaimed":4096},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":4096,"bytes_freed_rss":0,"errors_total":0}}`)
+	writeTestFile(t, applyPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"bytes_reclaimed":4096},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":4096,"bytes_freed_rss":0,"errors_total":0}}`)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    echo "gc $*" >> "$GC_TEST_LOG"
+    case " $* " in
+      *" --force "*) cat "$GC_TEST_APPLY_JSON" ;;
+      *) cat "$GC_TEST_SCAN_JSON" ;;
+    esac
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    echo "gc $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  update|close)
+    echo "bd $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON", "GC_TEST_APPLY_JSON"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+		"GC_TEST_APPLY_JSON="+applyPath,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	log := string(logData)
+	if err != nil {
+		t.Fatalf("rendered script failed: %v\nlog:\n%s\noutput:\n%s", err, log, out)
+	}
+	for _, want := range []string{
+		"gc dolt-cleanup --json --probe --force --max-orphan-dbs 20",
+		"gc event emit mol-dog-stale-db.done --message 4096 bytes freed; 0 errors",
+		"bd close bead-1",
+	} {
+		if !strings.Contains(log, want) {
+			t.Fatalf("command log missing %q\nlog:\n%s\noutput:\n%s", want, log, out)
+		}
+	}
+	if strings.Contains(log, "mol-dog-stale-db.escalate") {
+		t.Fatalf("rendered script escalated purge-only cleanup\nlog:\n%s\noutput:\n%s", log, out)
+	}
+}
+
+func TestStaleDBFormulaPurgeOnlyApplySQLFailureLeavesWorkOpen(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	applyPath := filepath.Join(dir, "apply.json")
+	writeTestFile(t, scanPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"bytes_reclaimed":4096},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":4096,"bytes_freed_rss":0,"errors_total":0}}`)
+	writeTestFile(t, applyPath, `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"ok":false,"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":2},"errors":[{"stage":"drop","error":"open dolt connection: refused"},{"stage":"purge","error":"open dolt connection: refused"}]}`)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    echo "gc $*" >> "$GC_TEST_LOG"
+    case " $* " in
+      *" --force "*)
+        cat "$GC_TEST_APPLY_JSON"
+        exit 42
+        ;;
+      *) cat "$GC_TEST_SCAN_JSON" ;;
+    esac
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    echo "gc $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  update|close)
+    echo "bd $*" >> "$GC_TEST_LOG"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON", "GC_TEST_APPLY_JSON"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+		"GC_TEST_APPLY_JSON="+applyPath,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	log := string(logData)
+	if err == nil {
+		t.Fatalf("rendered script exited successfully; want SQL-backed apply failure to keep work open\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	for _, want := range []string{
+		"gc dolt-cleanup --json --probe --force --max-orphan-dbs 20",
+		"bd update bead-1 --append-notes",
+		"## apply (--force, failed)",
+		`"stage":"purge"`,
+	} {
+		if !strings.Contains(log, want) {
+			t.Fatalf("command log missing %q\nlog:\n%s\noutput:\n%s", want, log, out)
+		}
+	}
+	if strings.Contains(log, "bd close bead-1") {
+		t.Fatalf("rendered script closed bead despite SQL-backed apply failure\nlog:\n%s\noutput:\n%s", log, out)
+	}
+}
+
+func TestStaleDBFormulaExitZeroMaxOrphanRefusalLeavesWorkOpenWithoutSuccessEvents(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	log, out, err := runStaleDBFormulaFailureCase(t, staleDBFailureCase{
+		scanJSON:  `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":20,"failed":[]},"purge":{"bytes_reclaimed":4096},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":4096,"bytes_freed_rss":0,"errors_total":0}}`,
+		applyJSON: `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":21,"failed":[]},"purge":{"ok":false,"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":1},"errors":[{"stage":"drop","kind":"max-orphan-refusal","error":"stale database threshold tripped"}]}`,
+	})
+	if err == nil {
+		t.Fatalf("rendered script exited successfully; want exit-zero max-orphan refusal to keep work open\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	for _, forbidden := range []string{
+		"gc event emit mol-dog-stale-db.drop",
+		"gc event emit mol-dog-stale-db.purge",
+		"gc event emit mol-dog-stale-db.reap",
+		"bd close bead-1",
+	} {
+		if strings.Contains(log, forbidden) {
+			t.Fatalf("exit-zero max-orphan refusal logged forbidden success path %q\nlog:\n%s\noutput:\n%s", forbidden, log, out)
+		}
+	}
+	for _, want := range []string{
+		"bd update bead-1 --append-notes",
+		"## apply (--force, refused)",
+		"apply refused by max-orphan safety guard",
+		"gc event emit mol-dog-stale-db.escalate",
+		"gc runtime drain-ack",
+	} {
+		if !strings.Contains(log, want) {
+			t.Fatalf("exit-zero max-orphan refusal log missing %q\nlog:\n%s\noutput:\n%s", want, log, out)
+		}
+	}
+}
+
+func TestStaleDBFormulaDryRunForceBlockersLeaveWorkOpenBeforeApply(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	log, out, err := runStaleDBFormulaFailureCase(t, staleDBFailureCase{
+		scanJSON: `{"schema":"gc.dolt.cleanup.v1","force_blockers":[{"kind":"rig-protection","name":"missing","error":"missing metadata"}],"dropped":{"count":1,"failed":[]},"purge":{"bytes_reclaimed":4096},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":4096,"bytes_freed_rss":0,"errors_total":0}}`,
+		wantNote: "## scan (dry-run)",
+		wantLog:  "force blocker",
+	})
+	if err == nil {
+		t.Fatalf("rendered script exited successfully; want dry-run force blockers to keep work open\nlog:\n%s\noutput:\n%s", log, out)
+	}
+	for _, want := range []string{
+		"gc event emit mol-dog-stale-db.escalate",
+		"gc mail send mayor",
+		"gc runtime drain-ack",
+	} {
+		if !strings.Contains(log, want) {
+			t.Fatalf("force-blocker path missing %q\nlog:\n%s\noutput:\n%s", want, log, out)
+		}
+	}
+	for _, forbidden := range []string{
+		"gc dolt-cleanup --json --probe --force",
+		"gc event emit mol-dog-stale-db.drop",
+		"gc event emit mol-dog-stale-db.purge",
+		"gc event emit mol-dog-stale-db.reap",
+		"gc event emit mol-dog-stale-db.done",
+		"bd close bead-1",
+	} {
+		if strings.Contains(log, forbidden) {
+			t.Fatalf("force-blocker path logged forbidden command %q\nlog:\n%s\noutput:\n%s", forbidden, log, out)
+		}
+	}
+}
+
+type staleDBFailureCase struct {
+	scanJSON     string
+	scanExit     string
+	applyJSON    string
+	applyExit    string
+	failContains string
+	wantNote     string
+	wantLog      string
+	forbidLog    string
+	forbidOutput string
+}
+
+func TestStaleDBFormulaFailurePathsDrainAck(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	applyScanJSON := `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":1,"failed":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`
+	for _, tc := range []struct {
+		name string
+		spec staleDBFailureCase
+	}{
+		{
+			name: "dry run command failure",
+			spec: staleDBFailureCase{
+				scanJSON: `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":1}}`,
+				scanExit: "42",
+				wantNote: "## scan (dry-run failed)",
+			},
+		},
+		{
+			name: "invalid scan JSON",
+			spec: staleDBFailureCase{
+				scanJSON: `{"schema":"wrong"}`,
+				wantNote: "## scan (invalid JSON)",
+			},
+		},
+		{
+			name: "apply command failure",
+			spec: staleDBFailureCase{
+				scanJSON:  applyScanJSON,
+				applyJSON: `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[{"name":"dolt_tmp","error":"drop failed"}]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":1},"errors":[{"stage":"drop","error":"drop failed"}]}`,
+				applyExit: "42",
+				wantNote:  "## apply (--force, failed)",
+				wantLog:   "gc dolt cleanup --server-down-ok",
+				forbidLog: "agent with --server-down-ok",
+			},
+		},
+		{
+			name: "invalid apply JSON",
+			spec: staleDBFailureCase{
+				scanJSON:  applyScanJSON,
+				applyJSON: `{"schema":"wrong"}`,
+				wantNote:  "## apply (--force, invalid JSON)",
+			},
+		},
+		{
+			name: "apply misses dry-run reclaimable bytes",
+			spec: staleDBFailureCase{
+				scanJSON:     `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":1,"failed":[]},"purge":{"bytes_reclaimed":4096},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":4096,"bytes_freed_rss":0,"errors_total":0}}`,
+				applyJSON:    `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":1,"failed":[]},"purge":{"ok":true,"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`,
+				wantNote:     "## apply (--force)",
+				wantLog:      "apply missed 4096 reclaimable bytes",
+				forbidLog:    "apply reported",
+				forbidOutput: "apply reported",
+			},
+		},
+		{
+			name: "invalid identifier skipped in scan",
+			spec: staleDBFailureCase{
+				scanJSON: `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[],"skipped":[{"name":"testdb_bad;drop","reason":"invalid-identifier"}]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`,
+				wantNote: "## scan (dry-run)",
+				wantLog:  "invalid stale database identifier",
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			log, out, err := runStaleDBFormulaFailureCase(t, tc.spec)
+			if err == nil {
+				t.Fatalf("rendered script exited successfully; want failure path to keep work open\nlog:\n%s\noutput:\n%s", log, out)
+			}
+			if !strings.Contains(log, "gc runtime drain-ack") {
+				t.Fatalf("failure path did not drain-ack before exit\nlog:\n%s\noutput:\n%s", log, out)
+			}
+			if tc.spec.wantNote != "" && !strings.Contains(log, tc.spec.wantNote) {
+				t.Fatalf("failure path did not append expected note %q\nlog:\n%s\noutput:\n%s", tc.spec.wantNote, log, out)
+			}
+			if tc.spec.wantLog != "" && !strings.Contains(log, tc.spec.wantLog) {
+				t.Fatalf("failure path log missing %q\nlog:\n%s\noutput:\n%s", tc.spec.wantLog, log, out)
+			}
+			if tc.spec.forbidLog != "" && strings.Contains(log, tc.spec.forbidLog) {
+				t.Fatalf("failure path log still contains unsupported copy %q\nlog:\n%s\noutput:\n%s", tc.spec.forbidLog, log, out)
+			}
+			if tc.spec.forbidOutput != "" && strings.Contains(string(out), tc.spec.forbidOutput) {
+				t.Fatalf("failure path output still contains unsupported copy %q\nlog:\n%s\noutput:\n%s", tc.spec.forbidOutput, log, out)
+			}
+			if strings.Contains(log, "bd close bead-1") {
+				t.Fatalf("failure path closed bead despite non-zero outcome\nlog:\n%s\noutput:\n%s", log, out)
+			}
+		})
+	}
+}
+
+func TestStaleDBFormulaSuccessPathFailuresDrainAck(t *testing.T) {
+	if _, err := exec.LookPath("bash"); err != nil {
+		t.Skipf("bash not found: %v", err)
+	}
+	if _, err := exec.LookPath("jq"); err != nil {
+		t.Skipf("jq not found: %v", err)
+	}
+
+	cleanScan := `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[],"skipped":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`
+	for _, tc := range []struct {
+		name        string
+		fail        string
+		wantFailure bool
+	}{
+		{
+			name: "scan event failure",
+			fail: "gc event emit mol-dog-stale-db.scan",
+		},
+		{
+			name: "scan note failure",
+			fail: "bd update bead-1 --append-notes",
+		},
+		{
+			name:        "close failure",
+			fail:        "bd close bead-1",
+			wantFailure: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			log, out, err := runStaleDBFormulaFailureCase(t, staleDBFailureCase{
+				scanJSON:     cleanScan,
+				failContains: tc.fail,
+			})
+			if tc.wantFailure && err == nil {
+				t.Fatalf("rendered script exited successfully; want %q failure to preserve non-zero status\nlog:\n%s\noutput:\n%s", tc.fail, log, out)
+			}
+			if !tc.wantFailure && err != nil {
+				t.Fatalf("rendered script failed; want %q to be non-fatal\nlog:\n%s\noutput:\n%s", tc.fail, log, out)
+			}
+			if !strings.Contains(log, "gc runtime drain-ack") {
+				t.Fatalf("%q path did not drain-ack\nlog:\n%s\noutput:\n%s", tc.fail, log, out)
+			}
+			if !strings.Contains(log, tc.fail) {
+				t.Fatalf("command log missing injected failure %q\nlog:\n%s\noutput:\n%s", tc.fail, log, out)
+			}
+			if !tc.wantFailure && !strings.Contains(log, "bd close bead-1") {
+				t.Fatalf("%q path did not close work after nonessential failure\nlog:\n%s\noutput:\n%s", tc.fail, log, out)
+			}
+		})
+	}
+}
+
+func runStaleDBFormulaFailureCase(t *testing.T, tc staleDBFailureCase) (string, []byte, error) {
+	t.Helper()
+	script := renderStaleDBFormulaShell(t)
+	dir := t.TempDir()
+	binDir := filepath.Join(dir, "bin")
+	if err := os.Mkdir(binDir, 0o755); err != nil {
+		t.Fatalf("Mkdir: %v", err)
+	}
+
+	logPath := filepath.Join(dir, "commands.log")
+	scanPath := filepath.Join(dir, "scan.json")
+	applyPath := filepath.Join(dir, "apply.json")
+	if tc.applyJSON == "" {
+		tc.applyJSON = `{"schema":"gc.dolt.cleanup.v1","dropped":{"count":0,"failed":[]},"purge":{"bytes_reclaimed":0},"reaped":{"count":0,"targets":[]},"summary":{"bytes_freed_disk":0,"bytes_freed_rss":0,"errors_total":0}}`
+	}
+	writeTestFile(t, scanPath, tc.scanJSON)
+	writeTestFile(t, applyPath, tc.applyJSON)
+	writeTestFile(t, filepath.Join(binDir, "gc"), `#!/usr/bin/env bash
+set -euo pipefail
+maybe_fail() {
+  local rendered="$1"
+  if [ -n "${GC_TEST_FAIL_CONTAINS:-}" ] && [[ "$rendered" == *"$GC_TEST_FAIL_CONTAINS"* ]]; then
+    exit 70
+  fi
+}
+case "${1:-} ${2:-}" in
+  "dolt-cleanup "*)
+    echo "gc $*" >> "$GC_TEST_LOG"
+    case " $* " in
+      *" --force "*)
+        cat "$GC_TEST_APPLY_JSON"
+        if [ -n "${GC_TEST_APPLY_EXIT:-}" ]; then exit "$GC_TEST_APPLY_EXIT"; fi
+        ;;
+      *)
+        cat "$GC_TEST_SCAN_JSON"
+        if [ -n "${GC_TEST_SCAN_EXIT:-}" ]; then exit "$GC_TEST_SCAN_EXIT"; fi
+        ;;
+    esac
+    ;;
+  "event emit"|"session nudge"|"runtime drain-ack"|"mail send")
+    rendered="gc $*"
+    echo "$rendered" >> "$GC_TEST_LOG"
+    maybe_fail "$rendered"
+    ;;
+  *)
+    echo "unexpected gc command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+	writeTestFile(t, filepath.Join(binDir, "bd"), `#!/usr/bin/env bash
+set -euo pipefail
+maybe_fail() {
+  local rendered="$1"
+  if [ -n "${GC_TEST_FAIL_CONTAINS:-}" ] && [[ "$rendered" == *"$GC_TEST_FAIL_CONTAINS"* ]]; then
+    exit 70
+  fi
+}
+case "${1:-}" in
+  update|close)
+    rendered="bd $*"
+    echo "$rendered" >> "$GC_TEST_LOG"
+    maybe_fail "$rendered"
+    ;;
+  *)
+    echo "unexpected bd command: $*" >&2
+    exit 64
+    ;;
+esac
+`, 0o755)
+
+	cmd := exec.Command("bash", "-s")
+	cmd.Stdin = strings.NewReader(script)
+	cmd.Env = append(filteredEnv("GC_BEAD_ID", "PATH", "TMPDIR", "GC_TEST_LOG", "GC_TEST_SCAN_JSON", "GC_TEST_SCAN_EXIT", "GC_TEST_APPLY_JSON", "GC_TEST_APPLY_EXIT", "GC_TEST_FAIL_CONTAINS"),
+		"GC_BEAD_ID=bead-1",
+		"PATH="+binDir+string(os.PathListSeparator)+os.Getenv("PATH"),
+		"TMPDIR="+dir,
+		"GC_TEST_LOG="+logPath,
+		"GC_TEST_SCAN_JSON="+scanPath,
+		"GC_TEST_SCAN_EXIT="+tc.scanExit,
+		"GC_TEST_APPLY_JSON="+applyPath,
+		"GC_TEST_APPLY_EXIT="+tc.applyExit,
+		"GC_TEST_FAIL_CONTAINS="+tc.failContains,
+	)
+	out, err := cmd.CombinedOutput()
+	logData, readErr := os.ReadFile(logPath)
+	if readErr != nil {
+		t.Fatalf("ReadFile(%s): %v\noutput:\n%s", logPath, readErr, out)
+	}
+	return string(logData), out, err
+}
+
+func renderStaleDBFormulaShell(t *testing.T) string {
+	t.Helper()
+	root := repoRoot(t)
+	f, err := formula.NewParser().ParseFile(filepath.Join(root, "formulas", "mol-dog-stale-db.toml"))
+	if err != nil {
+		t.Fatalf("ParseFile: %v", err)
+	}
+	if len(f.Steps) != 1 {
+		t.Fatalf("len(Steps) = %d, want 1", len(f.Steps))
+	}
+
+	vars := make(map[string]string, len(f.Vars))
+	for name, def := range f.Vars {
+		if def.Default != nil {
+			vars[name] = *def.Default
+		}
+	}
+	rendered := formula.Substitute(f.Steps[0].Description, vars)
+	if residual := formula.CheckResidualVars(rendered); len(residual) != 0 {
+		t.Fatalf("rendered formula has residual vars: %v", residual)
+	}
+	return extractFirstBashFence(t, rendered)
+}
+
+func writeTestFile(t *testing.T, path string, data string, perm ...os.FileMode) {
+	t.Helper()
+	mode := os.FileMode(0o644)
+	if len(perm) > 0 {
+		mode = perm[0]
+	}
+	if err := os.WriteFile(path, []byte(data), mode); err != nil {
+		t.Fatalf("WriteFile(%s): %v", path, err)
+	}
+}
+
+func extractFirstBashFence(t *testing.T, markdown string) string {
+	t.Helper()
+	start := strings.Index(markdown, "```bash\n")
+	if start < 0 {
+		t.Fatal("missing bash code fence")
+	}
+	start += len("```bash\n")
+	end := strings.LastIndex(markdown, "\n```")
+	if end < 0 {
+		t.Fatal("missing closing code fence")
+	}
+	if end <= start {
+		t.Fatal("closing code fence appears before bash body")
+	}
+	return markdown[start:end]
+}
+
+func TestStaleDBOrderUsesParsedFieldsOnly(t *testing.T) {
+	root := repoRoot(t)
+	data, err := os.ReadFile(filepath.Join(root, "orders", "mol-dog-stale-db.toml"))
+	if err != nil {
+		t.Fatalf("ReadFile: %v", err)
+	}
+	if strings.Contains(string(data), "\n[vars]\n") {
+		t.Fatal("order contains [vars], but order parsing ignores that table")
+	}
+
+	order, err := orders.Parse(data)
+	if err != nil {
+		t.Fatalf("orders.Parse: %v", err)
+	}
+	if err := orders.Validate(order); err != nil {
+		t.Fatalf("orders.Validate: %v", err)
+	}
+	if order.Trigger != "cron" {
+		t.Fatalf("Trigger = %q, want cron", order.Trigger)
+	}
+	if order.Schedule != "0 */4 * * *" {
+		t.Fatalf("Schedule = %q, want 0 */4 * * *", order.Schedule)
+	}
+}
diff --git a/examples/gastown/bind_key_script_test.go b/examples/gastown/bind_key_script_test.go
new file mode 100644
index 0000000000..049b41846b
--- /dev/null
+++ b/examples/gastown/bind_key_script_test.go
@@ -0,0 +1,240 @@
+package gastown_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestBindKeyScriptDirectBind exercises bind-key.sh against a stubbed
+// tmux that controls list-keys output and logs bind-key invocations.
+//
+// The script under test installs a tmux prefix binding directly,
+// without if-shell wrapping or fallback parsing. Per-city tmux socket
+// isolation (GC_TMUX_SOCKET, set by the controller) guarantees every
+// session on the socket is a GC session, so there is no non-GC
+// fallback path to preserve.
+//
+// The test cases verify:
+//
+//  1. No existing binding: bind-key is called with the command directly
+//     (no if-shell wrapper, no fallback).
+//  2. Existing default tmux binding ("next-window"): bind-key called
+//     with the GC command, overwriting cleanly. (Regression: the prior
+//     shape would wrap the existing binding inside if-shell, leading
+//     to recursive accumulation across re-runs.)
+//  3. Already-bound to the same GC command: bind-key NOT called
+//     (idempotency optimization — the command is already there).
+//  4. Already-bound to a different GC command: bind-key called with
+//     the new command (overwrite).
+//
+// Cases 2 + 3 between them rule out the recursive-wrapping bug: there
+// is no way for the script to install if-shell, so re-runs cannot
+// nest layers.
+func TestBindKeyScriptDirectBind(t *testing.T) {
+	bindKey := filepath.Join(exampleDir(), "packs", "gastown", "assets", "scripts", "bind-key.sh")
+	if _, err := os.Stat(bindKey); err != nil {
+		t.Fatalf("bind-key.sh not found at %s: %v", bindKey, err)
+	}
+
+	tests := []struct {
+		name           string
+		key            string
+		command        string
+		listKeysOutput string // simulated tmux list-keys output
+		// wantBindKeyCalled = true means we expect bind-key to be invoked.
+		// wantBindKeyArgs is checked as a substring of the logged invocation.
+		wantBindKeyCalled bool
+		wantBindKeyArgs   string
+		// Also assert what we did NOT see (regression checks).
+		wantNotInLog []string
+	}{
+		{
+			name:              "no existing binding installs command directly",
+			key:               "n",
+			command:           "run-shell '/path/to/cycle.sh next #{session_name} #{client_tty}'",
+			listKeysOutput:    "",
+			wantBindKeyCalled: true,
+			wantBindKeyArgs:   "bind-key -T prefix n",
+			wantNotInLog:      []string{"if-shell", "show-environment"},
+		},
+		{
+			name:              "default tmux binding overwritten without if-shell wrap",
+			key:               "n",
+			command:           "run-shell '/path/to/cycle.sh next #{session_name} #{client_tty}'",
+			listKeysOutput:    "bind-key -T prefix n next-window\n",
+			wantBindKeyCalled: true,
+			wantBindKeyArgs:   "bind-key -T prefix n",
+			// Regression: the prior shape would have wrapped "next-window"
+			// inside if-shell as the fallback. We want no if-shell at all.
+			wantNotInLog: []string{"if-shell", "next-window"},
+		},
+		{
+			name:              "idempotent: same command already bound is a no-op",
+			key:               "n",
+			command:           "run-shell '/path/to/cycle.sh next #{session_name} #{client_tty}'",
+			listKeysOutput:    "bind-key -T prefix n run-shell '/path/to/cycle.sh next #{session_name} #{client_tty}'\n",
+			wantBindKeyCalled: false,
+		},
+		{
+			name:              "different command in same key triggers re-bind",
+			key:               "n",
+			command:           "run-shell '/new/cycle.sh next #{session_name} #{client_tty}'",
+			listKeysOutput:    "bind-key -T prefix n run-shell '/old/cycle.sh next #{session_name} #{client_tty}'\n",
+			wantBindKeyCalled: true,
+			wantBindKeyArgs:   "bind-key -T prefix n",
+			wantNotInLog:      []string{"if-shell"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			binDir := t.TempDir()
+			bindLog := filepath.Join(t.TempDir(), "tmux-bind.log")
+			listKeysFile := filepath.Join(t.TempDir(), "list-keys-output.txt")
+			if err := os.WriteFile(listKeysFile, []byte(tt.listKeysOutput), 0o644); err != nil {
+				t.Fatalf("WriteFile listKeys: %v", err)
+			}
+
+			// Stub tmux:
+			//   list-keys: emit controlled output from $LIST_KEYS_FILE
+			//   bind-key:  log full argv to $TMUX_BIND_LOG
+			//   else:      no-op
+			writeExecutable(t, filepath.Join(binDir, "tmux"), `#!/bin/sh
+# Drop a leading "-L <socket>" pair if present (cycle.sh-style guard).
+if [ "$1" = "-L" ]; then
+    shift 2
+fi
+case "$1" in
+  list-keys)
+    cat "$LIST_KEYS_FILE" 2>/dev/null
+    ;;
+  bind-key)
+    printf '%s\n' "$*" >> "$TMUX_BIND_LOG"
+    ;;
+esac
+exit 0
+`)
+
+			env := map[string]string{
+				"PATH":           binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+				"TMUX_BIND_LOG":  bindLog,
+				"LIST_KEYS_FILE": listKeysFile,
+				"GC_TMUX_SOCKET": "", // disable -L flag so stub sees clean argv
+			}
+
+			cmd := exec.Command(bindKey, tt.key, tt.command)
+			cmd.Env = mergeTestEnv(env)
+			out, err := cmd.CombinedOutput()
+			if err != nil {
+				t.Fatalf("bind-key.sh failed: %v\n%s", err, out)
+			}
+
+			logBytes, _ := os.ReadFile(bindLog)
+			log := string(logBytes)
+
+			if !tt.wantBindKeyCalled {
+				if log != "" {
+					t.Fatalf("expected no bind-key call, got log: %q", log)
+				}
+				return
+			}
+
+			if !strings.Contains(log, tt.wantBindKeyArgs) {
+				t.Fatalf("expected bind-key log to contain %q, got: %q", tt.wantBindKeyArgs, log)
+			}
+			for _, forbidden := range tt.wantNotInLog {
+				if strings.Contains(log, forbidden) {
+					t.Fatalf("expected bind-key log NOT to contain %q (regression), got: %q",
+						forbidden, log)
+				}
+			}
+		})
+	}
+}
+
+// TestBindKeyScriptNoRecursiveWrapping asserts the structural property
+// that ruled the original bug: no matter how many times bind-key.sh is
+// invoked with the same args, the resulting binding is a single direct
+// command, not a stack of wrapped if-shell layers. This is the property
+// that hq-5vw7 (recursive wrapping) and hq-w1qlv ("command too long")
+// both manifest under the prior shape.
+func TestBindKeyScriptNoRecursiveWrapping(t *testing.T) {
+	bindKey := filepath.Join(exampleDir(), "packs", "gastown", "assets", "scripts", "bind-key.sh")
+	if _, err := os.Stat(bindKey); err != nil {
+		t.Fatalf("bind-key.sh not found: %v", err)
+	}
+
+	binDir := t.TempDir()
+	bindLog := filepath.Join(t.TempDir(), "tmux-bind.log")
+	listKeysFile := filepath.Join(t.TempDir(), "list-keys-output.txt")
+
+	// Stub tmux: each bind-key call updates the list-keys output so the
+	// next bind-key.sh invocation "sees" the prior binding (simulating
+	// what would happen across pack reinstalls / session_live re-fires).
+	writeExecutable(t, filepath.Join(binDir, "tmux"), `#!/bin/sh
+if [ "$1" = "-L" ]; then
+    shift 2
+fi
+case "$1" in
+  list-keys)
+    cat "$LIST_KEYS_FILE" 2>/dev/null
+    ;;
+  bind-key)
+    printf '%s\n' "$*" >> "$TMUX_BIND_LOG"
+    # Update list-keys output to reflect the new binding.
+    shift # drop "bind-key"
+    if [ "$1" = "-T" ]; then
+      table="$2"; key="$3"; shift 3
+      printf 'bind-key -T %s %s %s\n' "$table" "$key" "$*" > "$LIST_KEYS_FILE"
+    fi
+    ;;
+esac
+exit 0
+`)
+
+	env := map[string]string{
+		"PATH":           binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"TMUX_BIND_LOG":  bindLog,
+		"LIST_KEYS_FILE": listKeysFile,
+		"GC_TMUX_SOCKET": "",
+	}
+
+	command := "run-shell '/path/to/cycle.sh next #{session_name} #{client_tty}'"
+
+	// Invoke bind-key.sh five times with the same args.
+	for i := 0; i < 5; i++ {
+		cmd := exec.Command(bindKey, "n", command)
+		cmd.Env = mergeTestEnv(env)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("bind-key.sh iteration %d failed: %v\n%s", i, err, out)
+		}
+	}
+
+	logBytes, _ := os.ReadFile(bindLog)
+	log := string(logBytes)
+
+	// First call binds, subsequent four are no-ops (idempotent).
+	bindCount := strings.Count(log, "bind-key -T prefix n")
+	if bindCount != 1 {
+		t.Fatalf("expected exactly 1 bind-key invocation across 5 calls (idempotency); got %d:\n%s",
+			bindCount, log)
+	}
+	if strings.Contains(log, "if-shell") {
+		t.Fatalf("regression: bind-key log contains 'if-shell'; per-city socket isolation makes the wrap unnecessary:\n%s",
+			log)
+	}
+
+	// Final list-keys file should show the direct binding, not a wrapped one.
+	finalKeys, _ := os.ReadFile(listKeysFile)
+	finalStr := string(finalKeys)
+	if strings.Contains(finalStr, "if-shell") {
+		t.Fatalf("regression: final binding contains 'if-shell':\n%s", finalStr)
+	}
+	if !strings.Contains(finalStr, command) {
+		t.Fatalf("final binding does not contain expected command:\nbinding: %q\nwant substring: %q",
+			finalStr, command)
+	}
+}
diff --git a/examples/gastown/city.toml b/examples/gastown/city.toml
index 820ac18c60..4d903ee177 100644
--- a/examples/gastown/city.toml
+++ b/examples/gastown/city.toml
@@ -24,9 +24,6 @@ name = "gastown"
 provider = "claude"
 global_fragments = ["command-glossary", "operational-awareness"]
 
-[imports.gastown]
-source = "packs/gastown"
-
 [daemon]
 patrol_interval = "30s"
 max_restarts = 5
diff --git a/examples/gastown/gastown_test.go b/examples/gastown/gastown_test.go
index c644316fd2..d6a6f73b9d 100644
--- a/examples/gastown/gastown_test.go
+++ b/examples/gastown/gastown_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/formula"
 	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/session"
 )
 
 func exampleDir() string {
@@ -73,14 +74,38 @@ func TestCityTomlParses(t *testing.T) {
 		t.Errorf("Workspace.Name = %q, want %q", cfg.Workspace.Name, "gastown")
 	}
 	if len(cfg.Workspace.Includes) != 0 {
-		t.Errorf("Workspace.Includes = %v, want empty (migrated to [imports.gastown])", cfg.Workspace.Includes)
+		t.Errorf("Workspace.Includes = %v, want empty (migrated to pack.toml)", cfg.Workspace.Includes)
 	}
-	gastownImp, ok := cfg.Imports["gastown"]
+	// Imports live in pack.toml (portable definition), not city.toml (deployment).
+	if len(cfg.Imports) != 0 {
+		t.Errorf("cfg.Imports = %v, want empty (imports migrated to pack.toml)", cfg.Imports)
+	}
+}
+
+func TestCityPackTomlParses(t *testing.T) {
+	dir := exampleDir()
+	data, err := os.ReadFile(filepath.Join(dir, "pack.toml"))
+	if err != nil {
+		t.Fatalf("reading pack.toml: %v", err)
+	}
+
+	var tc packFileConfig
+	if _, err := toml.Decode(string(data), &tc); err != nil {
+		t.Fatalf("parsing pack.toml: %v", err)
+	}
+
+	if tc.Pack.Name != "gastown" {
+		t.Errorf("[pack] name = %q, want %q", tc.Pack.Name, "gastown")
+	}
+	if tc.Pack.Schema != 2 {
+		t.Errorf("[pack] schema = %d, want 2", tc.Pack.Schema)
+	}
+	gastownImp, ok := tc.Imports["gastown"]
 	if !ok {
-		t.Fatalf("cfg.Imports = %v, want entry for \"gastown\"", cfg.Imports)
+		t.Fatalf("pack.toml imports = %v, want entry for \"gastown\"", tc.Imports)
 	}
 	if gastownImp.Source != "packs/gastown" {
-		t.Errorf("cfg.Imports[\"gastown\"].Source = %q, want %q", gastownImp.Source, "packs/gastown")
+		t.Errorf("pack.toml imports[\"gastown\"].Source = %q, want %q", gastownImp.Source, "packs/gastown")
 	}
 }
 
@@ -218,7 +243,7 @@ func TestRefineryFormulaRespectsExistingPRMetadata(t *testing.T) {
 		`--set-metadata gc.routed_to=human`,
 		`--set-metadata blocked_reason="$reason"`,
 		`gc mail send mayor/ -s "ESCALATION: invalid existing_pr for $WORK"`,
-		`NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --json | jq -r '.new_epic_id')`,
+		`NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{target_branch}} --var rig_name={{rig_name}} --var binding_prefix={{binding_prefix}} --json | jq -r '.new_epic_id')`,
 		`gc bd update "$NEXT" --assignee=$GC_AGENT`,
 		`CURRENT_WISP=${GC_BEAD_ID:-}`,
 		`gc bd mol burn "$CURRENT_WISP" --force`,
@@ -626,6 +651,235 @@ func TestPromptGuidanceUsesConfiguredRigRootsAndNamespacedWorktrees(t *testing.T
 	}
 }
 
+func TestGastownRoutedToTargetsUseBindingPrefix(t *testing.T) {
+	dir := exampleDir()
+	checks := []struct {
+		rel  string
+		want string
+	}{
+		{"packs/gastown/formulas/mol-deacon-patrol.toml", "gc.routed_to={{binding_prefix}}dog"},
+		{"packs/gastown/formulas/mol-polecat-work.toml", `${GC_RIG:+$GC_RIG/}{{binding_prefix}}refinery`},
+		{"packs/gastown/formulas/mol-refinery-patrol.toml", `${GC_RIG:+$GC_RIG/}{{binding_prefix}}polecat`},
+		{"packs/gastown/formulas/mol-idea-to-plan.toml", "$GC_RIG/{{binding_prefix}}polecat"},
+		{"packs/gastown/agents/mayor/prompt.template.md", `${TARGET_RIG:+$TARGET_RIG/}{{ .BindingPrefix }}polecat`},
+		{"packs/gastown/agents/polecat/prompt.template.md", `${GC_RIG:+$GC_RIG/}{{ .BindingPrefix }}polecat`},
+		{"packs/gastown/agents/polecat/prompt.template.md", `${GC_RIG:+$GC_RIG/}{{ .BindingPrefix }}refinery`},
+		{"packs/gastown/template-fragments/approval-fallacy.template.md", `${GC_RIG:+$GC_RIG/}{{ .BindingPrefix }}refinery`},
+	}
+	for _, check := range checks {
+		data, err := os.ReadFile(filepath.Join(dir, check.rel))
+		if err != nil {
+			t.Fatalf("reading %s: %v", check.rel, err)
+		}
+		body := string(data)
+		if !strings.Contains(body, check.want) {
+			t.Errorf("%s missing %q", check.rel, check.want)
+		}
+		for _, bad := range []string{
+			"gc.routed_to=dog",
+			"gc.routed_to=<rig>/polecat",
+			"gc.routed_to=<rig>/refinery",
+			"gc.routed_to={{ .RigName }}/refinery",
+			"gc.routed_to={{rig_name}}/{{binding_prefix}}refinery",
+			"gc.routed_to={{rig_name}}/{{binding_prefix}}polecat",
+			"gc.routed_to={{ .RigName }}/{{ .BindingPrefix }}refinery",
+			"{{ .RigName }}/{{ .BindingPrefix }}polecat",
+		} {
+			if strings.Contains(body, bad) {
+				t.Errorf("%s still contains short-form route %q", check.rel, bad)
+			}
+		}
+	}
+}
+
+func TestGastownRigTargetShellExpressionsRenderForRigAndHQ(t *testing.T) {
+	tests := []struct {
+		name      string
+		expr      string
+		gcRig     string
+		targetRig string
+		want      string
+	}{
+		{
+			name: "refinery hq no binding",
+			expr: `${GC_RIG:+$GC_RIG/}refinery`,
+			want: "refinery",
+		},
+		{
+			name:  "refinery rig with binding",
+			expr:  `${GC_RIG:+$GC_RIG/}review.refinery`,
+			gcRig: "gascity",
+			want:  "gascity/review.refinery",
+		},
+		{
+			name: "polecat hq with binding",
+			expr: `${GC_RIG:+$GC_RIG/}review.polecat`,
+			want: "review.polecat",
+		},
+		{
+			name:  "polecat rig with binding",
+			expr:  `${GC_RIG:+$GC_RIG/}review.polecat`,
+			gcRig: "gascity",
+			want:  "gascity/review.polecat",
+		},
+		{
+			name: "mayor polecat hq with binding",
+			expr: `${TARGET_RIG:+$TARGET_RIG/}review.polecat`,
+			want: "review.polecat",
+		},
+		{
+			name:      "mayor polecat rig with binding",
+			expr:      `${TARGET_RIG:+$TARGET_RIG/}review.polecat`,
+			targetRig: "gascity",
+			want:      "gascity/review.polecat",
+		},
+		{
+			name:      "gc rig expression ignores target rig",
+			expr:      `${GC_RIG:+$GC_RIG/}review.refinery`,
+			gcRig:     "gascity",
+			targetRig: "othercity",
+			want:      "gascity/review.refinery",
+		},
+		{
+			name:      "target rig expression ignores gc rig",
+			expr:      `${TARGET_RIG:+$TARGET_RIG/}review.polecat`,
+			gcRig:     "gascity",
+			targetRig: "othercity",
+			want:      "othercity/review.polecat",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := exec.Command("sh", "-c", `printf '%s' "`+tt.expr+`"`)
+			cmd.Env = append(os.Environ(), "GC_RIG="+tt.gcRig, "TARGET_RIG="+tt.targetRig)
+			out, err := cmd.Output()
+			if err != nil {
+				t.Fatalf("render target: %v", err)
+			}
+			if got := string(out); got != tt.want {
+				t.Fatalf("target = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGastownRefineryPatrolRejectionCommandsReturnWorkToPolecatPool(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join(exampleDir(), "packs/gastown/formulas/mol-refinery-patrol.toml"))
+	if err != nil {
+		t.Fatalf("reading mol-refinery-patrol.toml: %v", err)
+	}
+	body := string(data)
+
+	checks := []struct {
+		name      string
+		startText string
+		endText   string
+	}{
+		{
+			name:      "rebase conflict rejection",
+			startText: "If rebase FAILED (conflicts):",
+			endText:   "A new polecat will pick up the bead",
+		},
+		{
+			name:      "test failure rejection",
+			startText: "If branch caused it:",
+			endText:   "If pre-existing on target:",
+		},
+	}
+	for _, check := range checks {
+		t.Run(check.name, func(t *testing.T) {
+			start := strings.Index(body, check.startText)
+			if start < 0 {
+				t.Fatalf("missing section start %q", check.startText)
+			}
+			end := strings.Index(body[start:], check.endText)
+			if end < 0 {
+				t.Fatalf("missing section end %q after %q", check.endText, check.startText)
+			}
+			section := body[start : start+end]
+			for _, want := range []string{
+				"gc workflow delete-source $WORK --apply && gc workflow reopen-source $WORK",
+				"gc bd update $WORK",
+				"--status=open",
+				`--assignee=""`,
+				"--set-metadata rejection_reason=",
+				`--set-metadata gc.routed_to="${GC_RIG:+$GC_RIG/}{{binding_prefix}}polecat"`,
+			} {
+				if !strings.Contains(section, want) {
+					t.Errorf("%s missing %q:\n%s", check.name, want, section)
+				}
+			}
+		})
+	}
+}
+
+func TestGastownPatrolWispCommandsPropagateRoutingNamespace(t *testing.T) {
+	dir := exampleDir()
+	checks := []struct {
+		rel     string
+		formula string
+		vars    []string
+	}{
+		{
+			rel:     "packs/gastown/agents/deacon/prompt.template.md",
+			formula: "mol-deacon-patrol",
+			vars:    []string{"--var binding_prefix="},
+		},
+		{
+			rel:     "packs/gastown/formulas/mol-deacon-patrol.toml",
+			formula: "mol-deacon-patrol",
+			vars:    []string{"--var binding_prefix="},
+		},
+		{
+			rel:     "packs/gastown/agents/refinery/prompt.template.md",
+			formula: "mol-refinery-patrol",
+			vars:    []string{"--var target_branch=", "--var rig_name=", "--var binding_prefix="},
+		},
+		{
+			rel:     "packs/gastown/formulas/mol-refinery-patrol.toml",
+			formula: "mol-refinery-patrol",
+			vars:    []string{"--var target_branch=", "--var rig_name=", "--var binding_prefix="},
+		},
+	}
+	for _, check := range checks {
+		data, err := os.ReadFile(filepath.Join(dir, check.rel))
+		if err != nil {
+			t.Fatalf("reading %s: %v", check.rel, err)
+		}
+		for lineNo, line := range strings.Split(string(data), "\n") {
+			if !strings.Contains(line, "gc bd mol wisp "+check.formula+" --root-only") {
+				continue
+			}
+			for _, want := range check.vars {
+				if !strings.Contains(line, want) {
+					t.Errorf("%s:%d wisp command missing %q:\n%s", check.rel, lineNo+1, want, line)
+				}
+			}
+		}
+	}
+
+	renderVars := map[string]string{
+		"binding_prefix": "gastown.",
+		"rig_name":       "gascity",
+		"target_branch":  "main",
+	}
+	for _, rel := range []string{
+		"packs/gastown/formulas/mol-deacon-patrol.toml",
+		"packs/gastown/formulas/mol-refinery-patrol.toml",
+	} {
+		data, err := os.ReadFile(filepath.Join(dir, rel))
+		if err != nil {
+			t.Fatalf("reading %s: %v", rel, err)
+		}
+		rendered := formula.Substitute(string(data), renderVars)
+		for _, bad := range []string{"{{binding_prefix}}", "{{rig_name}}"} {
+			if strings.Contains(rendered, bad) {
+				t.Errorf("%s rendered patrol formula still contains %q", rel, bad)
+			}
+		}
+	}
+}
+
 func TestIdeaToPlanFormulaUsesSupportedPrimitives(t *testing.T) {
 	dir := exampleDir()
 	path := filepath.Join(dir, "packs", "gastown", "formulas", "mol-idea-to-plan.toml")
@@ -670,6 +924,177 @@ func TestReviewLegFormulaPersistsReportAndNotifiesCoordinator(t *testing.T) {
 	}
 }
 
+type witnessSessionFixture struct {
+	ID          string
+	State       string
+	Closed      bool
+	SessionName string
+	Alias       string
+	AgentName   string
+}
+
+type witnessSessionBeadFixture struct {
+	Status                  string
+	State                   string
+	ConfiguredNamedIdentity string
+}
+
+func resolveWitnessAssigneeForTest(
+	assignee string,
+	sessions []witnessSessionFixture,
+	sessionBeads []witnessSessionBeadFixture,
+) (string, bool) {
+	index := make(map[string]string)
+	add := func(key, state string, closed bool) {
+		key = strings.TrimSpace(key)
+		if key == "" {
+			return
+		}
+		if closed {
+			state = "closed"
+		}
+		index[key] = state
+	}
+	for _, s := range sessions {
+		add(s.ID, s.State, s.Closed)
+		add(s.SessionName, s.State, s.Closed)
+		add(s.Alias, s.State, s.Closed)
+		add(s.AgentName, s.State, s.Closed)
+	}
+	for _, b := range sessionBeads {
+		add(b.ConfiguredNamedIdentity, b.State, b.Status == "closed")
+	}
+	state, ok := index[assignee]
+	return state, ok
+}
+
+func witnessStateIsOrphanedForTest(state string) (bool, bool) {
+	switch state {
+	case string(session.StateActive),
+		string(session.StateAwake),
+		string(session.StateCreating),
+		string(session.StateAsleep),
+		string(session.StateDrained),
+		string(session.StateSuspended),
+		string(session.StateDraining),
+		string(session.StateQuarantined):
+		return false, true
+	case string(session.StateArchived), "closed", "absent":
+		return true, true
+	default:
+		return false, false
+	}
+}
+
+func TestWitnessPatrolLivenessProcedureUsesExactSessionIdentity(t *testing.T) {
+	dir := exampleDir()
+	path := filepath.Join(dir, "packs", "gastown", "formulas", "mol-witness-patrol.toml")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("reading witness patrol formula: %v", err)
+	}
+	body := string(data)
+
+	for _, forbidden := range []string{
+		`grep -oE '(hq|sc|gc|de)-[a-z0-9]+'`,
+		`(hq|sc|gc|de)-<id>`,
+	} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("witness patrol still contains fixed-prefix extraction %q", forbidden)
+		}
+	}
+	for _, want := range []string{
+		`$s.ID`,
+		`$s.SessionName`,
+		`$s.Alias`,
+		`$s.AgentName`,
+		`configured_named_identity`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("witness patrol liveness procedure missing exact lookup key %q", want)
+		}
+	}
+
+	sessions := []witnessSessionFixture{
+		{
+			ID:          "ga-n7iy6",
+			State:       string(session.StateActive),
+			SessionName: "polecats__sonnet-ga-n7iy6",
+			Alias:       "gastown/polecat-slot-1",
+			AgentName:   "gastown/sonnet",
+		},
+		{ID: "mp-7k4g", State: string(session.StateCreating)},
+	}
+	sessionBeads := []witnessSessionBeadFixture{
+		{
+			Status:                  "open",
+			State:                   string(session.StateAsleep),
+			ConfiguredNamedIdentity: "gastown/witness",
+		},
+	}
+	for _, tc := range []struct {
+		assignee string
+		want     string
+	}{
+		{assignee: "ga-n7iy6", want: string(session.StateActive)},
+		{assignee: "polecats__sonnet-ga-n7iy6", want: string(session.StateActive)},
+		{assignee: "gastown/polecat-slot-1", want: string(session.StateActive)},
+		{assignee: "gastown/sonnet", want: string(session.StateActive)},
+		{assignee: "mp-7k4g", want: string(session.StateCreating)},
+		{assignee: "gastown/witness", want: string(session.StateAsleep)},
+	} {
+		got, ok := resolveWitnessAssigneeForTest(tc.assignee, sessions, sessionBeads)
+		if !ok || got != tc.want {
+			t.Errorf("resolveWitnessAssigneeForTest(%q) = %q, %v; want %q, true", tc.assignee, got, ok, tc.want)
+		}
+	}
+	if got, ok := resolveWitnessAssigneeForTest("polecat-hq-00ohd", sessions, sessionBeads); ok {
+		t.Fatalf("embedded fixed-prefix assignee resolved to %q; want exact lookup miss", got)
+	}
+}
+
+func TestWitnessPatrolStateClassificationCoversSessionStates(t *testing.T) {
+	dir := exampleDir()
+	path := filepath.Join(dir, "packs", "gastown", "formulas", "mol-witness-patrol.toml")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("reading witness patrol formula: %v", err)
+	}
+	body := string(data)
+
+	notOrphaned := []session.State{
+		session.StateActive,
+		session.StateAwake,
+		session.StateCreating,
+		session.StateAsleep,
+		session.StateDrained,
+		session.StateSuspended,
+		session.StateDraining,
+		session.StateQuarantined,
+	}
+	for _, state := range notOrphaned {
+		if !strings.Contains(body, "`"+string(state)+"`") {
+			t.Errorf("witness patrol formula missing state %q", state)
+		}
+		got, ok := witnessStateIsOrphanedForTest(string(state))
+		if !ok || got {
+			t.Errorf("witnessStateIsOrphanedForTest(%q) = %v, %v; want false, true", state, got, ok)
+		}
+	}
+	for _, state := range []string{string(session.StateArchived), "closed", "absent"} {
+		if !strings.Contains(body, "`"+state+"`") {
+			t.Errorf("witness patrol formula missing state %q", state)
+		}
+		got, ok := witnessStateIsOrphanedForTest(state)
+		if !ok || !got {
+			t.Errorf("witnessStateIsOrphanedForTest(%q) = %v, %v; want true, true", state, got, ok)
+		}
+	}
+	if got, ok := witnessStateIsOrphanedForTest("future-state"); ok || got {
+		t.Fatalf("witnessStateIsOrphanedForTest(future-state) = %v, %v; want false, false", got, ok)
+	}
+}
+
 func TestAllFormulasExist(t *testing.T) {
 	dir := exampleDir()
 	formulaDir := filepath.Join(dir, "packs", "gastown", "formulas")
diff --git a/examples/gastown/maintenance_scripts_test.go b/examples/gastown/maintenance_scripts_test.go
index 5d354bdd85..b2ba7b1be2 100644
--- a/examples/gastown/maintenance_scripts_test.go
+++ b/examples/gastown/maintenance_scripts_test.go
@@ -11,10 +11,19 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
 )
 
 var rawDoltSQLCallRe = regexp.MustCompile(`(?m)(^|[^A-Za-z0-9_-])dolt(?:[ \t]+|[ \t]*\\[ \t]*\r?\n[ \t]*)+sql([ \t]|$)`)
 
+var (
+	sqlFenceRe            = regexp.MustCompile("(?s)```sql\\s*\\n(.*?)```")
+	mailTableRe           = regexp.MustCompile(`(?i)(?:FROM|UPDATE|INTO|JOIN|DELETE\s+FROM)\s+(?:\x60?[\w-]+\x60?\.)?\x60?mail\x60?\b`)
+	rawDurationIntervalRe = regexp.MustCompile(`(?i)\bINTERVAL\s+\{\{(?:max_age|purge_age|stale_issue_age)\}\}`)
+)
+
 func TestMaintenanceDoltScriptsUseProjectedConnectionTarget(t *testing.T) {
 	tests := []struct {
 		name   string
@@ -97,6 +106,182 @@ exit 0
 	}
 }
 
+func TestOrphanSweepPreservesQualifiedRigAssignees(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+case "$1" in
+  config)
+    if [ "$2" = "explain" ]; then
+      cat <<'EOF'
+Agent: gastown.deacon
+  source: pack
+Agent: project/gastown.refinery
+  source: pack
+Agent: project/gastown.polecat
+  source: pack
+EOF
+      exit 0
+    fi
+    ;;
+  rig)
+    if [ "$2" = "list" ] && [ "$3" = "--json" ]; then
+      printf '{"rigs":[{"name":"hq","hq":true},{"name":"project","hq":false}]}\n'
+      exit 0
+    fi
+    ;;
+  bd)
+    if [ "$2" = "list" ]; then
+      case "$*" in
+        *"--rig project"*)
+          cat <<'EOF'
+[
+  {"id":"ga-valid","status":"in_progress","assignee":"project/gastown.refinery"},
+  {"id":"ga-pool","status":"in_progress","assignee":"project/gastown.polecat-3"},
+  {"id":"ga-orphan","status":"in_progress","assignee":"project/gastown.missing"}
+]
+EOF
+          ;;
+        *)
+          printf '[]\n'
+          ;;
+      esac
+      exit 0
+    fi
+    if [ "$2" = "update" ]; then
+      exit 0
+    fi
+    ;;
+esac
+exit 1
+`)
+
+	env := map[string]string{
+		"GC_CITY":      cityDir,
+		"GC_CITY_PATH": cityDir,
+		"GC_CALL_LOG":  gcLog,
+		"PATH":         binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	script := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "orphan-sweep.sh")
+	cmd := exec.Command(script)
+	cmd.Env = mergeTestEnv(env)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("%s failed: %v\n%s", filepath.Base(script), err, out)
+	}
+	if !strings.Contains(string(out), "orphan-sweep: reset 1 orphaned beads") {
+		t.Fatalf("unexpected orphan-sweep output:\n%s", out)
+	}
+
+	logData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	log := string(logData)
+	if !strings.Contains(log, "bd update ga-orphan --status=open --assignee=") {
+		t.Fatalf("orphan bead was not reset:\n%s", log)
+	}
+	for _, preserved := range []string{"ga-valid", "ga-pool"} {
+		if strings.Contains(log, "bd update "+preserved+" ") {
+			t.Fatalf("valid assignee %s was reset:\n%s", preserved, log)
+		}
+	}
+}
+
+func TestOrphanSweepConfigShowFallbackPreservesQualifiedAssignees(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+case "$1" in
+  config)
+    if [ "$2" = "explain" ]; then
+      exit 1
+    fi
+    if [ "$2" = "show" ]; then
+      cat <<'EOF'
+[[agent]]
+  name = "deacon"
+[[agent]]
+  name = "polecat"
+EOF
+      exit 0
+    fi
+    ;;
+  rig)
+    if [ "$2" = "list" ] && [ "$3" = "--json" ]; then
+      printf '{"rigs":[{"name":"hq","hq":true},{"name":"project","hq":false}]}\n'
+      exit 0
+    fi
+    ;;
+  bd)
+    if [ "$2" = "list" ]; then
+      case "$*" in
+        *"--rig project"*)
+          cat <<'EOF'
+[
+  {"id":"ga-valid","status":"in_progress","assignee":"gastown.deacon"},
+  {"id":"ga-pool","status":"in_progress","assignee":"gastown.polecat-3"},
+  {"id":"ga-orphan","status":"in_progress","assignee":"gastown.missing"}
+]
+EOF
+          ;;
+        *)
+          printf '[]\n'
+          ;;
+      esac
+      exit 0
+    fi
+    if [ "$2" = "update" ]; then
+      exit 0
+    fi
+    ;;
+esac
+exit 1
+`)
+
+	env := map[string]string{
+		"GC_CITY":      cityDir,
+		"GC_CITY_PATH": cityDir,
+		"GC_CALL_LOG":  gcLog,
+		"PATH":         binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	script := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "orphan-sweep.sh")
+	cmd := exec.Command(script)
+	cmd.Env = mergeTestEnv(env)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("%s failed: %v\n%s", filepath.Base(script), err, out)
+	}
+	if !strings.Contains(string(out), "orphan-sweep: reset 1 orphaned beads") {
+		t.Fatalf("unexpected orphan-sweep output:\n%s", out)
+	}
+
+	logData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	log := string(logData)
+	if !strings.Contains(log, "config show") {
+		t.Fatalf("fallback config show path was not exercised:\n%s", log)
+	}
+	if !strings.Contains(log, "bd update ga-orphan --status=open --assignee=") {
+		t.Fatalf("orphan bead was not reset:\n%s", log)
+	}
+	for _, preserved := range []string{"ga-valid", "ga-pool"} {
+		if strings.Contains(log, "bd update "+preserved+" ") {
+			t.Fatalf("valid assignee %s was reset:\n%s", preserved, log)
+		}
+	}
+}
+
 func TestMaintenanceDoltScriptsFallbackToManagedRuntimePorts(t *testing.T) {
 	scripts := []struct {
 		name   string
@@ -604,378 +789,693 @@ func TestMaintenanceDoltScriptsRejectInvalidManagedPort(t *testing.T) {
 	}
 }
 
-func listenManagedDoltPort(t *testing.T) net.Listener {
-	t.Helper()
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("Listen: %v", err)
+func TestMaintenanceDoltScriptsSkipTestPatternDatabases(t *testing.T) {
+	tests := []struct {
+		name   string
+		script string
+		env    map[string]string
+	}{
+		{
+			name:   "reaper",
+			script: filepath.Join("packs", "maintenance", "assets", "scripts", "reaper.sh"),
+			env: map[string]string{
+				"GC_REAPER_DRY_RUN": "1",
+			},
+		},
+		{
+			name:   "jsonl export",
+			script: filepath.Join("packs", "maintenance", "assets", "scripts", "jsonl-export.sh"),
+			env: map[string]string{
+				"GC_JSONL_ARCHIVE_REPO":      "archive",
+				"GC_JSONL_MAX_PUSH_FAILURES": "99",
+			},
+		},
 	}
-	t.Cleanup(func() { _ = listener.Close() })
-	return listener
-}
-
-func writeManagedRuntimeState(t *testing.T, cityDir string, port int) {
-	t.Helper()
-	writeManagedRuntimeStateWithPID(t, cityDir, port, os.Getpid())
-}
 
-func writeManagedRuntimeStateWithPID(t *testing.T, cityDir string, port int, pid int) {
-	t.Helper()
-	stateDir := filepath.Join(cityDir, ".gc", "runtime", "packs", "dolt")
-	if err := os.MkdirAll(stateDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	payload, err := json.Marshal(map[string]any{
-		"running":    true,
-		"pid":        pid,
-		"port":       port,
-		"data_dir":   filepath.Join(cityDir, ".beads", "dolt"),
-		"started_at": "2026-04-20T00:00:00Z",
-	})
-	if err != nil {
-		t.Fatalf("Marshal(managed runtime state): %v", err)
+	excludedDBs := []string{
+		"benchdb",
+		"testdb_foo",
+		"beads_t1234abcd",
+		"beads_t1234abcd9",
+		"beads_ptbaz",
+		"beads_vrqux",
+		"doctest_xyz",
+		"doctortest_abc",
 	}
-	if err := os.WriteFile(filepath.Join(stateDir, "dolt-state.json"), payload, 0o644); err != nil {
-		t.Fatal(err)
+	includedDBs := []string{
+		"beads",
+		"customdb",
+		"beads_team",
+		"beads_t123",
+		"beads_tABCDEF12",
+		"beads_t1234abcg",
+		"beads_t1234abcdx",
 	}
-}
 
-func TestFormulaDoltSQLExamplesUseExplicitTarget(t *testing.T) {
-	examplesDir := filepath.Dir(exampleDir())
-	paths := []string{
-		filepath.Join(examplesDir, "dolt", "formulas", "mol-dog-doctor.toml"),
-		filepath.Join(exampleDir(), "packs", "maintenance", "formulas", "mol-dog-jsonl.toml"),
-	}
-	for _, path := range paths {
-		t.Run(filepath.Base(path), func(t *testing.T) {
-			data, err := os.ReadFile(path)
+	allDBs := append([]string{}, includedDBs...)
+	allDBs = append(allDBs, excludedDBs...)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cityDir := t.TempDir()
+			binDir := t.TempDir()
+			stateDir := t.TempDir()
+			doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+			gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+			writeMaintenanceDoltStub(t, filepath.Join(binDir, "dolt"))
+			writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+			env := map[string]string{
+				"DOLT_ARGS_LOG":       doltLog,
+				"DOLT_DBS":            strings.Join(allDBs, " "),
+				"GC_CALL_LOG":         gcLog,
+				"GC_CITY":             cityDir,
+				"GC_CITY_PATH":        cityDir,
+				"GC_PACK_STATE_DIR":   stateDir,
+				"GC_DOLT_HOST":        "127.0.0.1",
+				"GC_DOLT_PORT":        "3307",
+				"GC_DOLT_USER":        "root",
+				"GC_DOLT_PASSWORD":    "",
+				"GIT_CONFIG_GLOBAL":   filepath.Join(t.TempDir(), "gitconfig"),
+				"GIT_CONFIG_NOSYSTEM": "1",
+				"PATH":                binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+			}
+			for key, value := range tt.env {
+				if key == "GC_JSONL_ARCHIVE_REPO" {
+					value = filepath.Join(cityDir, value)
+				}
+				env[key] = value
+			}
+
+			runScript(t, filepath.Join(exampleDir(), tt.script), env)
+
+			logData, err := os.ReadFile(doltLog)
 			if err != nil {
-				t.Fatalf("ReadFile(%s): %v", path, err)
+				t.Fatalf("ReadFile(dolt log): %v", err)
 			}
-			if match := rawDoltSQLCallRe.Find(data); match != nil {
-				t.Fatalf("formula contains unqualified Dolt SQL command %q; include host, port, user, and no-tls args", match)
+			log := string(logData)
+			for _, excluded := range excludedDBs {
+				if strings.Contains(log, "`"+excluded+"`") {
+					t.Errorf("dolt log references excluded test-pattern database %q:\n%s", excluded, log)
+				}
+			}
+			for _, included := range includedDBs {
+				if !strings.Contains(log, "`"+included+"`") {
+					t.Errorf("dolt log missing included database %q:\n%s", included, log)
+				}
 			}
 		})
 	}
 }
 
-func TestSpawnStormDetectPersistsNewLedgerCounts(t *testing.T) {
-	cityDir := t.TempDir()
-	binDir := t.TempDir()
-	stateDir := t.TempDir()
-	gcLog := filepath.Join(t.TempDir(), "gc.log")
+func TestMaintenanceDoltScriptsSkipUnsafeDatabaseIdentifiers(t *testing.T) {
+	tests := []struct {
+		name   string
+		script string
+		env    map[string]string
+	}{
+		{
+			name:   "reaper",
+			script: filepath.Join("packs", "maintenance", "assets", "scripts", "reaper.sh"),
+			env: map[string]string{
+				"GC_REAPER_DRY_RUN": "1",
+			},
+		},
+		{
+			name:   "jsonl export",
+			script: filepath.Join("packs", "maintenance", "assets", "scripts", "jsonl-export.sh"),
+			env: map[string]string{
+				"GC_JSONL_ARCHIVE_REPO":      "archive",
+				"GC_JSONL_MAX_PUSH_FAILURES": "99",
+			},
+		},
+	}
 
-	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
-case "$1" in
-  list)
-    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cityDir := t.TempDir()
+			binDir := t.TempDir()
+			stateDir := t.TempDir()
+			doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+			gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+			writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\nfoo db\n'
     ;;
-  show)
-    printf '[{"id":"%s","status":"open","title":"Looping bead"}]\n' "$2"
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
+    ;;
+  *"SELECT *"*)
+    printf '{"id":"ga-1"}\n'
     ;;
 esac
 exit 0
 `)
-	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+			writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
 printf '%s\n' "$*" >> "$GC_CALL_LOG"
 exit 0
 `)
 
-	env := map[string]string{
-		"GC_CITY":               cityDir,
-		"GC_CITY_PATH":          cityDir,
-		"GC_PACK_STATE_DIR":     stateDir,
-		"GC_CALL_LOG":           gcLog,
-		"SPAWN_STORM_THRESHOLD": "1",
-		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
-	}
+			env := map[string]string{
+				"DOLT_ARGS_LOG":       doltLog,
+				"GC_CALL_LOG":         gcLog,
+				"GC_CITY":             cityDir,
+				"GC_CITY_PATH":        cityDir,
+				"GC_PACK_STATE_DIR":   stateDir,
+				"GC_DOLT_HOST":        "127.0.0.1",
+				"GC_DOLT_PORT":        "3307",
+				"GC_DOLT_USER":        "root",
+				"GC_DOLT_PASSWORD":    "",
+				"GIT_CONFIG_GLOBAL":   filepath.Join(t.TempDir(), "gitconfig"),
+				"GIT_CONFIG_NOSYSTEM": "1",
+				"PATH":                binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+			}
+			for key, value := range tt.env {
+				if key == "GC_JSONL_ARCHIVE_REPO" {
+					value = filepath.Join(cityDir, value)
+				}
+				env[key] = value
+			}
 
-	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+			runScript(t, filepath.Join(exampleDir(), tt.script), env)
 
-	ledgerData, err := os.ReadFile(filepath.Join(stateDir, "spawn-storm-counts.json"))
-	if err != nil {
-		t.Fatalf("ReadFile(ledger): %v", err)
+			logData, err := os.ReadFile(doltLog)
+			if err != nil {
+				t.Fatalf("ReadFile(dolt log): %v", err)
+			}
+			log := string(logData)
+			if !strings.Contains(log, "`beads`") {
+				t.Fatalf("script did not query safe database:\n%s", log)
+			}
+			for _, unsafe := range []string{"`foo db`", "`foo`", "`db`"} {
+				if strings.Contains(log, unsafe) {
+					t.Fatalf("script queried unsafe database token %s:\n%s", unsafe, log)
+				}
+			}
+		})
 	}
-	var counts map[string]int
-	if err := json.Unmarshal(ledgerData, &counts); err != nil {
-		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+}
+
+func TestReaperFormulaSQLReflectsCurrentSchema(t *testing.T) {
+	path := filepath.Join(exampleDir(), "packs", "maintenance", "formulas", "mol-dog-reaper.toml")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", path, err)
 	}
-	if got := counts["ga-loop"]; got != 1 {
-		t.Fatalf("ledger count for ga-loop = %d, want 1\nledger: %s", got, ledgerData)
+
+	// Extract every ```sql ... ``` fence body and scan only those — prose
+	// warnings about the deprecated patterns are intentional and must not
+	// trip this guard.
+	matches := sqlFenceRe.FindAllSubmatch(data, -1)
+	if len(matches) == 0 {
+		t.Fatalf("no ```sql fences found in %s; test is no-op", filepath.Base(path))
 	}
 
-	gcData, err := os.ReadFile(gcLog)
+	for i, m := range matches {
+		fence := string(m[1])
+		if strings.Contains(fence, "parent_id") {
+			t.Errorf("formula sql fence %d references parent_id (column does not exist in wisps):\n%s", i, fence)
+		}
+		if strings.Contains(fence, "LEFT JOIN wisps parent ON") {
+			t.Errorf("formula sql fence %d still has the broken parent self-join:\n%s", i, fence)
+		}
+		if mailTableRe.MatchString(fence) {
+			t.Errorf("formula sql fence %d treats `mail` as a SQL table; mail messages are beads with Type=message:\n%s", i, fence)
+		}
+		if rawDurationIntervalRe.MatchString(fence) {
+			t.Errorf("formula sql fence %d uses raw Go duration values in SQL INTERVAL; reaper.sh normalizes durations to integer hours:\n%s", i, fence)
+		}
+	}
+}
+
+func TestReaperParentIDIsParentChildDependencyProjection(t *testing.T) {
+	runner := func(_, name string, args ...string) ([]byte, error) {
+		call := name + " " + strings.Join(args, " ")
+		switch call {
+		case "bd list --json --label=parent-projection --include-infra --include-gates --limit 50":
+			return []byte(`[
+				{
+					"id":"ga-child",
+					"title":"child",
+					"status":"open",
+					"issue_type":"task",
+					"created_at":"2026-05-06T00:00:00Z",
+					"labels":["parent-projection"],
+					"dependencies":[
+						{"issue_id":"ga-child","depends_on_id":"ga-parent","type":"parent-child"}
+					]
+				}
+			]`), nil
+		default:
+			return nil, fmt.Errorf("unexpected command: %s", call)
+		}
+	}
+	store := beads.NewBdStore("/city", runner)
+
+	got, err := store.List(beads.ListQuery{Label: "parent-projection", Limit: 50})
 	if err != nil {
-		t.Fatalf("ReadFile(gc log): %v", err)
+		t.Fatalf("List: %v", err)
 	}
-	if !strings.Contains(string(gcData), "SPAWN_STORM: bead ga-loop reset 1x") {
-		t.Fatalf("gc log missing spawn storm notification:\n%s", gcData)
+	if len(got) != 1 {
+		t.Fatalf("List returned %d beads, want 1", len(got))
+	}
+	if got[0].ParentID != "ga-parent" {
+		t.Fatalf("ParentID = %q, want dependency-projected parent ga-parent", got[0].ParentID)
+	}
+
+	scriptPath := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh")
+	scriptData, err := os.ReadFile(scriptPath)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", scriptPath, err)
+	}
+	script := string(scriptData)
+	if strings.Contains(script, "parent_id") {
+		t.Fatalf("reaper queried parent_id directly; Dolt ParentID is projected from parent-child dependencies:\n%s", script)
+	}
+	if !strings.Contains(script, "dependencies d") || !strings.Contains(script, "d.type = 'parent-child'") {
+		t.Fatalf("reaper does not follow the canonical Dolt parent-child projection:\n%s", script)
 	}
 }
 
-func TestSpawnStormDetectPersistsCountWhenTitleLookupFails(t *testing.T) {
+func TestReaperSQLReflectsCurrentSchema(t *testing.T) {
 	cityDir := t.TempDir()
 	binDir := t.TempDir()
-	stateDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
 	gcLog := filepath.Join(t.TempDir(), "gc.log")
 
-	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
-case "$1" in
-  list)
-    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
-    ;;
-  show)
-    printf 'temporary backend failure\n' >&2
-    exit 1
-    ;;
-esac
-exit 0
-`)
+	writeMaintenanceDoltStub(t, filepath.Join(binDir, "dolt"))
 	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
 printf '%s\n' "$*" >> "$GC_CALL_LOG"
 exit 0
 `)
 
 	env := map[string]string{
-		"GC_CITY":               cityDir,
-		"GC_CITY_PATH":          cityDir,
-		"GC_PACK_STATE_DIR":     stateDir,
-		"GC_CALL_LOG":           gcLog,
-		"SPAWN_STORM_THRESHOLD": "1",
-		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"DOLT_ARGS_LOG":    doltLog,
+		"GC_CALL_LOG":      gcLog,
+		"DOLT_DBS":         "beads",
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"DOLT_PURGE_COUNT": "1",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		// No GC_REAPER_DRY_RUN — allow DOLT_COMMIT to fire.
 	}
 
-	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
 
-	ledgerData, err := os.ReadFile(filepath.Join(stateDir, "spawn-storm-counts.json"))
+	logData, err := os.ReadFile(doltLog)
 	if err != nil {
-		t.Fatalf("ReadFile(ledger): %v", err)
+		t.Fatalf("ReadFile(dolt log): %v", err)
 	}
-	var counts map[string]int
-	if err := json.Unmarshal(ledgerData, &counts); err != nil {
-		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+	log := string(logData)
+
+	// parent_id was removed: wisps schema has no such column.
+	if strings.Contains(log, "parent_id") {
+		t.Errorf("reaper SQL references parent_id (column does not exist in wisps):\n%s", log)
 	}
-	if got := counts["ga-loop"]; got != 1 {
-		t.Fatalf("ledger count for ga-loop = %d, want 1\nledger: %s", got, ledgerData)
+	// mail was removed: not a SQL table; messages are beads with type=message.
+	if strings.Contains(log, ".mail") {
+		t.Errorf("reaper SQL references .mail table (does not exist in beads schema):\n%s", log)
+	}
+	// DOLT_COMMIT must use CALL, not SELECT.
+	if strings.Contains(log, "SELECT DOLT_COMMIT") {
+		t.Errorf("reaper uses SELECT DOLT_COMMIT; must use CALL DOLT_COMMIT:\n%s", log)
+	}
+	if !strings.Contains(log, "CALL DOLT_COMMIT") {
+		t.Errorf("reaper missing CALL DOLT_COMMIT:\n%s", log)
+	}
+	// USE <db> must precede CALL DOLT_COMMIT so the procedure resolves.
+	callIdx := strings.Index(log, "CALL DOLT_COMMIT")
+	useIdx := strings.Index(log, "USE `beads`")
+	if useIdx < 0 {
+		t.Errorf("USE `beads` not found in dolt log:\n%s", log)
+	} else if callIdx >= 0 && useIdx > callIdx {
+		t.Errorf("USE `beads` appears after CALL DOLT_COMMIT:\n%s", log)
+	}
+	if strings.Contains(log, " mail=") || strings.Contains(log, " mail:") {
+		t.Errorf("reaper still reports removed mail cleanup in Dolt commit message:\n%s", log)
+	}
+	purgeIdx := strings.Index(log, "DELETE FROM `beads`.wisps")
+	if purgeIdx < 0 {
+		t.Errorf("reaper missing closed-wisp purge delete:\n%s", log)
+	} else {
+		purgeSQL := log[purgeIdx:]
+		if !strings.Contains(purgeSQL, "child_wisp.status IN ('open', 'hooked', 'in_progress')") ||
+			!strings.Contains(purgeSQL, "d.type = 'parent-child'") ||
+			!strings.Contains(purgeSQL, "d.depends_on_id IS NOT NULL") {
+			t.Errorf("reaper purge can delete closed parents with non-closed children:\n%s", purgeSQL)
+		}
 	}
 
 	gcData, err := os.ReadFile(gcLog)
 	if err != nil {
 		t.Fatalf("ReadFile(gc log): %v", err)
 	}
-	if !strings.Contains(string(gcData), "SPAWN_STORM: bead ga-loop reset 1x") {
-		t.Fatalf("gc log missing spawn storm notification:\n%s", gcData)
+	if strings.Contains(string(gcData), "mail:") {
+		t.Errorf("reaper DOG_DONE still reports removed mail cleanup:\n%s", gcData)
 	}
 }
 
-func TestSpawnStormDetectFailsOnMalformedOpenBeadJSON(t *testing.T) {
+func TestReaperClosesStaleWispChainsToFixpoint(t *testing.T) {
 	cityDir := t.TempDir()
 	binDir := t.TempDir()
-	stateDir := t.TempDir()
-	ledger := filepath.Join(stateDir, "spawn-storm-counts.json")
-	if err := os.MkdirAll(stateDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(ledger, []byte(`{"ga-existing":2}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	closeCountState := filepath.Join(t.TempDir(), "close-count-state")
 
-	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
-case "$1" in
-  list)
-    printf 'not-json\n'
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
     ;;
-  show)
-    printf '[{"id":"%s","status":"open","title":"Looping bead"}]\n' "$2"
+  *"COUNT(DISTINCT w.id)"*)
+    n=0
+    if [ -f "$CLOSE_COUNT_STATE" ]; then
+      n=$(cat "$CLOSE_COUNT_STATE")
+    fi
+    case "$n" in
+      0)
+        printf '1\n' > "$CLOSE_COUNT_STATE"
+        printf 'COUNT(*)\n1\n'
+        ;;
+      1)
+        printf '2\n' > "$CLOSE_COUNT_STATE"
+        printf 'COUNT(*)\n1\n'
+        ;;
+      *)
+        printf 'COUNT(*)\n0\n'
+        ;;
+    esac
+    ;;
+  *"UPDATE "*"wisps SET status='closed'"*)
+    printf 'ROW_COUNT()\n1\n'
+    ;;
+  *"SELECT COUNT(*) FROM "*"wisps"*"status IN ('open', 'hooked', 'in_progress')"*"created_at <"*)
+    printf 'COUNT(*)\n2\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
     ;;
 esac
 exit 0
 `)
 	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
 exit 0
 `)
 
 	env := map[string]string{
+		"CLOSE_COUNT_STATE": closeCountState,
+		"DOLT_ARGS_LOG":     doltLog,
+		"GC_CALL_LOG":       gcLog,
 		"GC_CITY":           cityDir,
 		"GC_CITY_PATH":      cityDir,
-		"GC_PACK_STATE_DIR": stateDir,
+		"GC_DOLT_HOST":      "127.0.0.1",
+		"GC_DOLT_PORT":      "3307",
+		"GC_DOLT_USER":      "root",
+		"GC_DOLT_PASSWORD":  "",
 		"PATH":              binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
 	}
 
-	script := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh")
-	cmd := exec.Command(script)
-	cmd.Env = mergeTestEnv(env)
-	if out, err := cmd.CombinedOutput(); err == nil {
-		t.Fatalf("%s succeeded with malformed bd JSON; output:\n%s", filepath.Base(script), out)
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	logData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt log): %v", err)
+	}
+	log := string(logData)
+	if got := strings.Count(log, "UPDATE `beads`.wisps SET status='closed'"); got != 2 {
+		t.Fatalf("reaper closed only %d stale wisp chain level(s), want 2:\n%s", got, log)
+	}
+	if !strings.Contains(log, "closed_wisps=2") {
+		t.Fatalf("reaper commit did not report all closed chain levels:\n%s", log)
 	}
 
-	ledgerData, err := os.ReadFile(ledger)
+	gcData, err := os.ReadFile(gcLog)
 	if err != nil {
-		t.Fatalf("ReadFile(ledger): %v", err)
+		t.Fatalf("ReadFile(gc log): %v", err)
 	}
-	if got, want := string(ledgerData), `{"ga-existing":2}`; got != want {
-		t.Fatalf("ledger changed after malformed JSON: got %s, want %s", got, want)
+	if !strings.Contains(string(gcData), "closed_wisps:2") {
+		t.Fatalf("reaper summary did not report all closed chain levels:\n%s", gcData)
 	}
 }
 
-func TestSpawnStormDetectPrunesClosedAndDeletedLedgerEntries(t *testing.T) {
+func TestReaperCountQueriesIgnoreSuccessfulStderrWarnings(t *testing.T) {
 	cityDir := t.TempDir()
 	binDir := t.TempDir()
-	stateDir := t.TempDir()
-	ledger := filepath.Join(stateDir, "spawn-storm-counts.json")
-	if err := os.MkdirAll(stateDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(ledger, []byte(`{"ga-closed":2,"ga-deleted":3,"ga-open":4}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
 
-	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
-case "$1" in
-  list)
-    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
     ;;
-  show)
-    case "$2" in
-      ga-closed)
-        printf '[{"id":"ga-closed","status":"closed","title":"Closed bead"}]\n'
-        ;;
-      ga-open|ga-loop)
-        printf '[{"id":"%s","status":"open","title":"Open bead"}]\n' "$2"
-        ;;
-      ga-deleted)
-        printf 'issue not found\n' >&2
-        exit 1
-        ;;
-    esac
+  *"DELETE FROM "*"wisps"*)
+    printf 'ROW_COUNT()\n1\n'
+    printf 'non-fatal mutation warning from dolt\n' >&2
+    ;;
+  *"status = 'closed'"*"closed_at <"*)
+    printf 'COUNT(*)\n1\n'
+    printf 'non-fatal warning from dolt\n' >&2
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
     ;;
 esac
 exit 0
 `)
 	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
 exit 0
 `)
 
 	env := map[string]string{
-		"GC_CITY":               cityDir,
-		"GC_CITY_PATH":          cityDir,
-		"GC_PACK_STATE_DIR":     stateDir,
-		"SPAWN_STORM_THRESHOLD": "99",
-		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"DOLT_ARGS_LOG":    doltLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
 	}
 
-	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
 
-	ledgerData, err := os.ReadFile(ledger)
+	doltData, err := os.ReadFile(doltLog)
 	if err != nil {
-		t.Fatalf("ReadFile(ledger): %v", err)
-	}
-	var counts map[string]int
-	if err := json.Unmarshal(ledgerData, &counts); err != nil {
-		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+		t.Fatalf("ReadFile(dolt log): %v", err)
 	}
-	if _, ok := counts["ga-closed"]; ok {
-		t.Fatalf("closed bead was not pruned: %s", ledgerData)
+	if !strings.Contains(string(doltData), "DELETE FROM `beads`.wisps") {
+		t.Fatalf("reaper did not act on count stdout when Dolt emitted stderr warning:\n%s", doltData)
 	}
-	if _, ok := counts["ga-deleted"]; ok {
-		t.Fatalf("deleted bead was not pruned: %s", ledgerData)
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
 	}
-	if got := counts["ga-open"]; got != 4 {
-		t.Fatalf("open bead count = %d, want 4\nledger: %s", got, ledgerData)
+	gcLogText := string(gcData)
+	if strings.Contains(gcLogText, "ESCALATION") || strings.Contains(gcLogText, "count returned non-numeric") {
+		t.Fatalf("reaper treated successful count stderr as an anomaly:\n%s", gcLogText)
 	}
-	if got := counts["ga-loop"]; got != 1 {
-		t.Fatalf("new loop count = %d, want 1\nledger: %s", got, ledgerData)
+	if !strings.Contains(gcLogText, "purged:1") {
+		t.Fatalf("reaper summary did not include purge count from stdout:\n%s", gcLogText)
 	}
 }
 
-func TestSpawnStormDetectPreservesLedgerOnTransientShowFailure(t *testing.T) {
+func TestReaperRowQueriesIgnoreSuccessfulStderrWarnings(t *testing.T) {
 	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "beads")
 	binDir := t.TempDir()
-	stateDir := t.TempDir()
-	ledger := filepath.Join(stateDir, "spawn-storm-counts.json")
-	if err := os.MkdirAll(stateDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(ledger, []byte(`{"ga-transient":5}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
 
-	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
-case "$1" in
-  list)
-    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
     ;;
-  show)
-    case "$2" in
-      ga-transient)
-        printf '{"error":"temporary backend failure"}\n'
-        exit 1
-        ;;
-      ga-loop)
-        printf '[{"id":"ga-loop","status":"open","title":"Open bead"}]\n'
-        ;;
-    esac
+  *"SELECT id FROM "*"issues"*)
+    printf 'id\nga-old\n'
+    printf 'non-fatal warning from dolt\n' >&2
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
     ;;
 esac
 exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
 `)
 	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
 exit 0
 `)
 
 	env := map[string]string{
-		"GC_CITY":               cityDir,
-		"GC_CITY_PATH":          cityDir,
-		"GC_PACK_STATE_DIR":     stateDir,
-		"SPAWN_STORM_THRESHOLD": "99",
-		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
 	}
 
-	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
 
-	ledgerData, err := os.ReadFile(ledger)
+	bdData, err := os.ReadFile(bdLog)
 	if err != nil {
-		t.Fatalf("ReadFile(ledger): %v", err)
-	}
-	var counts map[string]int
-	if err := json.Unmarshal(ledgerData, &counts); err != nil {
-		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+		t.Fatalf("ReadFile(bd log): %v", err)
 	}
-	if got := counts["ga-transient"]; got != 5 {
-		t.Fatalf("transient failure pruned or changed ledger count: got %d, want 5\nledger: %s", got, ledgerData)
+	bdLogText := string(bdData)
+	if !strings.Contains(bdLogText, "close ga-old --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not act on row-query stdout when Dolt emitted stderr warning:\n%s", bdLogText)
 	}
-	if got := counts["ga-loop"]; got != 1 {
-		t.Fatalf("new loop count = %d, want 1\nledger: %s", got, ledgerData)
+	if strings.Contains(bdLogText, "non-fatal warning") {
+		t.Fatalf("reaper treated successful row-query stderr as an issue id:\n%s", bdLogText)
 	}
-}
 
-func runScript(t *testing.T, script string, env map[string]string) {
-	t.Helper()
-	cmd := exec.Command(script)
-	cmd.Env = mergeTestEnv(env)
-	out, err := cmd.CombinedOutput()
+	gcData, err := os.ReadFile(gcLog)
 	if err != nil {
-		t.Fatalf("%s failed: %v\n%s", filepath.Base(script), err, out)
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if strings.Contains(gcLogText, "ESCALATION") || strings.Contains(gcLogText, "stale issue query failed") {
+		t.Fatalf("reaper treated successful row-query stderr as an anomaly:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "closed:1") {
+		t.Fatalf("reaper summary did not include city issue close from stdout:\n%s", gcLogText)
 	}
 }
 
-func writeExecutable(t *testing.T, path, body string) {
-	t.Helper()
-	if err := os.WriteFile(path, []byte(body), 0o755); err != nil {
-		t.Fatalf("WriteFile(%s): %v", path, err)
+func TestReaperDoesNotCloseNonClosedWispsByAgeOnly(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"UPDATE "*"wisps SET status='closed'"*)
+    printf 'ROW_COUNT()\n1\n'
+    ;;
+  *"COUNT("*"wisps w"*"dependencies d"*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"status IN ('open', 'hooked', 'in_progress')"*"created_at <"*)
+    printf 'COUNT(*)\n2\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	logData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt log): %v", err)
+	}
+	log := string(logData)
+	if strings.Contains(log, "UPDATE `beads`.wisps SET status='closed'") && !strings.Contains(log, "dependencies d") {
+		t.Fatalf("reaper closed non-closed wisps by age alone instead of using parent-child dependencies:\n%s", log)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "stale_wisps:2") {
+		t.Fatalf("reaper did not report observed stale non-closed wisps:\n%s", gcData)
 	}
 }
 
-func writeMaintenanceDoltStub(t *testing.T, path string) {
-	t.Helper()
-	writeExecutable(t, path, `#!/bin/sh
+func TestReaperClosesStaleWispsOnlyWithClosedParent(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	closeCountState := filepath.Join(t.TempDir(), "close-count-state")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
 printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
 case "$*" in
   *"SHOW DATABASES"*)
     printf 'Database\nbeads\n'
     ;;
-  *"SELECT *"*)
-    printf '{"id":"ga-1","title":"sample"}\n'
+  *"UPDATE "*"wisps SET status='closed'"*)
+    printf 'ROW_COUNT()\n1\n'
+    ;;
+  *"COUNT("*"wisps w"*"dependencies d"*)
+    n=0
+    if [ -f "$CLOSE_COUNT_STATE" ]; then
+      n=$(cat "$CLOSE_COUNT_STATE")
+    fi
+    if [ "$n" = "0" ]; then
+      printf '1\n' > "$CLOSE_COUNT_STATE"
+      printf 'COUNT(*)\n1\n'
+    else
+      printf 'COUNT(*)\n0\n'
+    fi
+    ;;
+  *"status IN ('open', 'hooked', 'in_progress')"*"created_at <"*)
+    printf 'COUNT(*)\n2\n'
     ;;
   *"COUNT("*)
     printf 'COUNT(*)\n0\n'
@@ -986,26 +1486,3249 @@ case "$*" in
 esac
 exit 0
 `)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"CLOSE_COUNT_STATE": closeCountState,
+		"DOLT_ARGS_LOG":     doltLog,
+		"GC_CALL_LOG":       gcLog,
+		"GC_CITY":           cityDir,
+		"GC_CITY_PATH":      cityDir,
+		"GC_DOLT_HOST":      "127.0.0.1",
+		"GC_DOLT_PORT":      "3307",
+		"GC_DOLT_USER":      "root",
+		"GC_DOLT_PASSWORD":  "",
+		"PATH":              binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	logData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt log): %v", err)
+	}
+	log := string(logData)
+	if strings.Contains(log, "parent_id") {
+		t.Fatalf("reaper used removed parent_id column:\n%s", log)
+	}
+	if !strings.Contains(log, "UPDATE `beads`.wisps SET status='closed'") {
+		t.Fatalf("reaper did not close schema-safe stale wisp candidates:\n%s", log)
+	}
+	if !strings.Contains(log, "COUNT(DISTINCT w.id)") {
+		t.Fatalf("reaper stale-wisp close count can be join-multiplied:\n%s", log)
+	}
+	if !strings.Contains(log, "dependencies d") || !strings.Contains(log, "d.type = 'parent-child'") {
+		t.Fatalf("reaper stale-wisp close path does not use parent-child dependencies:\n%s", log)
+	}
+	if strings.Contains(log, "parent_wisp.id IS NULL AND parent_issue.id IS NULL") {
+		t.Fatalf("reaper closes stale wisps when parent liveness is unresolved:\n%s", log)
+	}
+	if !strings.Contains(log, "parent_wisp.status = 'closed'") || !strings.Contains(log, "parent_issue.status = 'closed'") {
+		t.Fatalf("reaper stale-wisp close path does not require a closed parent:\n%s", log)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "stale_wisps:2") || !strings.Contains(string(gcData), "closed_wisps:1") {
+		t.Fatalf("reaper summary did not report observed and closed wisp counts:\n%s", gcData)
+	}
 }
 
-func mergeTestEnv(overrides map[string]string) []string {
-	env := os.Environ()
-	for key := range overrides {
-		prefix := key + "="
-		filtered := env[:0]
-		for _, entry := range env {
-			if !strings.HasPrefix(entry, prefix) {
-				filtered = append(filtered, entry)
-			}
-		}
-		env = filtered
+func TestReaperEscalatesDoltCommitFailure(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"CALL DOLT_COMMIT"*)
+    printf 'commit failed\n' >&2
+    exit 42
+    ;;
+  *"DELETE FROM "*"wisps"*)
+    printf 'ROW_COUNT()\n1\n'
+    ;;
+  *"status = 'closed'"*"closed_at <"*)
+    printf 'COUNT(*)\n1\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
 	}
-	keys := make([]string, 0, len(overrides))
-	for key := range overrides {
-		keys = append(keys, key)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	logData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt log): %v", err)
 	}
-	for _, key := range keys {
-		env = append(env, key+"="+overrides[key])
+	if !strings.Contains(string(logData), "CALL DOLT_COMMIT") {
+		t.Fatalf("reaper did not exercise CALL DOLT_COMMIT path:\n%s", logData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "mail send mayor/ -s ESCALATION: Reaper anomalies detected [MEDIUM]") {
+		t.Fatalf("reaper did not escalate Dolt commit failure:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "Dolt commit failed for beads") {
+		t.Fatalf("reaper escalation did not identify the failed database:\n%s", gcLogText)
+	}
+}
+
+func TestReaperDoesNotCountFailedPurgeAsSuccess(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"DELETE FROM "*"wisps"*)
+    printf 'delete failed\n' >&2
+    exit 42
+    ;;
+  *"status = 'closed'"*"closed_at <"*)
+    printf 'COUNT(*)\n1\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "purging closed wisps failed for beads") {
+		t.Fatalf("reaper did not escalate failed purge:\n%s", gcLogText)
+	}
+	if strings.Contains(gcLogText, "purged:1") {
+		t.Fatalf("reaper counted failed purge as success:\n%s", gcLogText)
+	}
+}
+
+func TestReaperCommitReportsOnlySuccessfulPurgeRows(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	closeCountState := filepath.Join(t.TempDir(), "close-count-state")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"UPDATE "*"wisps SET status='closed'"*)
+    printf 'ROW_COUNT()\n1\n'
+    ;;
+  *"DELETE FROM "*"wisps"*)
+    printf 'delete failed\n' >&2
+    exit 42
+    ;;
+  *"COUNT("*"wisps w"*"dependencies d"*)
+    n=0
+    if [ -f "$CLOSE_COUNT_STATE" ]; then
+      n=$(cat "$CLOSE_COUNT_STATE")
+    fi
+    if [ "$n" = "0" ]; then
+      printf '1\n' > "$CLOSE_COUNT_STATE"
+      printf 'COUNT(*)\n1\n'
+    else
+      printf 'COUNT(*)\n0\n'
+    fi
+    ;;
+  *"SELECT COUNT(*) FROM "*"wisps"*"status IN ('open', 'hooked', 'in_progress')"*"created_at <"*)
+    printf 'COUNT(*)\n1\n'
+    ;;
+  *"status = 'closed'"*"closed_at <"*)
+    printf 'COUNT(*)\n1\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"CLOSE_COUNT_STATE": closeCountState,
+		"DOLT_ARGS_LOG":     doltLog,
+		"GC_CALL_LOG":       gcLog,
+		"GC_CITY":           cityDir,
+		"GC_CITY_PATH":      cityDir,
+		"GC_DOLT_HOST":      "127.0.0.1",
+		"GC_DOLT_PORT":      "3307",
+		"GC_DOLT_USER":      "root",
+		"GC_DOLT_PASSWORD":  "",
+		"PATH":              binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	logData, err := os.ReadFile(doltLog)
+	if err != nil {
+		t.Fatalf("ReadFile(dolt log): %v", err)
+	}
+	log := string(logData)
+	if !strings.Contains(log, "CALL DOLT_COMMIT") {
+		t.Fatalf("reaper did not commit successful close after failed purge:\n%s", log)
+	}
+	if !strings.Contains(log, "closed_wisps=1 purged=0") {
+		t.Fatalf("reaper commit did not report only successful purge rows:\n%s", log)
+	}
+	if strings.Contains(log, "purged=1") {
+		t.Fatalf("reaper commit claimed failed purge rows:\n%s", log)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if strings.Contains(string(gcData), "purged:1") {
+		t.Fatalf("reaper summary claimed failed purge rows:\n%s", gcData)
+	}
+}
+
+func TestReaperDoesNotCountFailedIssueCloseAsSuccess(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "beads")
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"SELECT id FROM "*"issues"*)
+    printf 'id\nga-old\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+case "$*" in
+  close*)
+    printf 'close failed\n' >&2
+    exit 42
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      filepath.Join(t.TempDir(), "bd.log"),
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "closing stale issue ga-old failed for beads") {
+		t.Fatalf("reaper did not escalate failed issue close:\n%s", gcLogText)
+	}
+	if strings.Contains(gcLogText, "closed:1") {
+		t.Fatalf("reaper counted failed issue close as success:\n%s", gcLogText)
+	}
+}
+
+func TestReaperAutoClosesIssuesOnlyInCityDatabase(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "citydb")
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\ncitydb\nrigdb\n'
+    ;;
+  *"SELECT id FROM "*"citydb"*"issues"*)
+    printf 'id\nga-city\n'
+    ;;
+  *"SELECT id FROM "*"rigdb"*"issues"*)
+    printf 'id\nrig-old\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	bdLogText := string(bdData)
+	if !strings.Contains(bdLogText, "close ga-city --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not close city-scoped stale issue:\n%s", bdLogText)
+	}
+	if strings.Contains(bdLogText, "rig-old") {
+		t.Fatalf("reaper attempted unscoped close for rig-scoped stale issue:\n%s", bdLogText)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "closed:1") || !strings.Contains(gcLogText, "skipped_non_city_issues:1") {
+		t.Fatalf("reaper summary did not report city close and non-city skip:\n%s", gcLogText)
+	}
+	if strings.Contains(gcLogText, "mail send mayor/ -s ESCALATION") || strings.Contains(gcLogText, "non-city database") {
+		t.Fatalf("reaper escalated expected non-city stale issue skips:\n%s", gcLogText)
+	}
+}
+
+func TestReaperCityDatabaseUsesGCCityPathFallback(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "citydb")
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\ncitydb\n'
+    ;;
+  *"SELECT id FROM "*"citydb"*"issues"*)
+    printf 'id\nga-city\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          "",
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if !strings.Contains(string(bdData), "close ga-city --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not resolve city metadata through GC_CITY_PATH:\n%s", bdData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if strings.Contains(gcLogText, "stale issue auto-close disabled") {
+		t.Fatalf("reaper disabled issue auto-close despite GC_CITY_PATH metadata:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "closed:1") {
+		t.Fatalf("reaper summary did not report city issue close:\n%s", gcLogText)
+	}
+}
+
+func TestReaperScopesIssueAutoCloseToCityBeadsDir(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "citydb")
+	canonicalCityDir, err := filepath.EvalSymlinks(cityDir)
+	if err != nil {
+		t.Fatalf("EvalSymlinks(city dir): %v", err)
+	}
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	ambientBeadsDir := filepath.Join(t.TempDir(), "wrong-beads")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\ncitydb\n'
+    ;;
+  *"SELECT id FROM "*"citydb"*"issues"*)
+    printf 'id\nga-city\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf 'pwd=%s beads=%s args=%s\n' "$PWD" "${BEADS_DIR:-}" "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"BEADS_DIR":        ambientBeadsDir,
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	bdLogText := string(bdData)
+	if !strings.Contains(bdLogText, "args=close ga-city --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not close city issue:\n%s", bdLogText)
+	}
+	if !strings.Contains(bdLogText, "pwd="+canonicalCityDir) {
+		t.Fatalf("reaper did not run bd close from city dir:\n%s", bdLogText)
+	}
+	if !strings.Contains(bdLogText, "beads="+filepath.Join(canonicalCityDir, ".beads")) {
+		t.Fatalf("reaper did not scope bd close to the city beads dir:\n%s", bdLogText)
+	}
+	if strings.Contains(bdLogText, "beads="+ambientBeadsDir) {
+		t.Fatalf("reaper used ambient BEADS_DIR for city auto-close:\n%s", bdLogText)
+	}
+}
+
+func TestReaperSkipsIssueAutoCloseWhenConfiguredCityDatabaseDoesNotMatchMetadata(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "citydb")
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\ncitydb\nwrongdb\n'
+    ;;
+  *"SELECT id FROM "*"citydb"*"issues"*)
+    printf 'id\nga-city\n'
+    ;;
+  *"SELECT id FROM "*"wrongdb"*"issues"*)
+    printf 'id\nga-wrong\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":           doltLog,
+		"BD_CALL_LOG":             bdLog,
+		"GC_CALL_LOG":             gcLog,
+		"GC_CITY":                 cityDir,
+		"GC_CITY_PATH":            cityDir,
+		"GC_REAPER_CITY_DATABASE": "wrongdb",
+		"GC_DOLT_HOST":            "127.0.0.1",
+		"GC_DOLT_PORT":            "3307",
+		"GC_DOLT_USER":            "root",
+		"GC_DOLT_PASSWORD":        "",
+		"PATH":                    binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if strings.Contains(string(bdData), "close ") {
+		t.Fatalf("reaper attempted issue auto-close with invalid city database override:\n%s", bdData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "city database wrongdb from GC_REAPER_CITY_DATABASE does not match city metadata database citydb") {
+		t.Fatalf("reaper did not report invalid city database override:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "stale issue auto-close disabled") {
+		t.Fatalf("reaper did not disable stale issue auto-close for invalid city database override:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "skipped_non_city_issues:2") {
+		t.Fatalf("reaper did not report skipped stale issue candidate:\n%s", gcLogText)
+	}
+}
+
+func TestReaperSkipsIssueAutoCloseWhenCityMetadataIsNotJSON(t *testing.T) {
+	cityDir := t.TempDir()
+	metadataDir := filepath.Join(cityDir, ".beads")
+	if err := os.MkdirAll(metadataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%s): %v", metadataDir, err)
+	}
+	if err := os.WriteFile(filepath.Join(metadataDir, "metadata.json"), []byte(`not-json`), 0o644); err != nil {
+		t.Fatalf("WriteFile(metadata.json): %v", err)
+	}
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"SELECT id FROM "*"issues"*)
+    printf 'id\nga-old\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if strings.Contains(string(bdData), "close ") {
+		t.Fatalf("reaper attempted issue auto-close after metadata parse failed:\n%s", bdData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "stale issue auto-close disabled") {
+		t.Fatalf("reaper did not degrade to disabled auto-close after metadata parse failure:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "skipped_non_city_issues:1") {
+		t.Fatalf("reaper did not report skipped stale issue candidate:\n%s", gcLogText)
+	}
+}
+
+func TestReaperCityDatabaseUsesShellFallbackWhenJSONParsersUnavailable(t *testing.T) {
+	cityDir := t.TempDir()
+	writeCityBeadsMetadata(t, cityDir, "citydb")
+	binDir := t.TempDir()
+	for _, tool := range []string{"bash", "dirname", "tail", "grep", "cut", "tr", "mktemp", "rm", "sed", "wc", "cat", "head"} {
+		linkTestPathTool(t, binDir, tool)
+	}
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\ncitydb\n'
+    ;;
+  *"SELECT id FROM "*"citydb"*"issues"*)
+    printf 'id\nga-city\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir,
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if !strings.Contains(string(bdData), "close ga-city --reason stale:auto-closed by reaper") {
+		t.Fatalf("reaper did not close city issue through metadata fallback:\n%s", bdData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if strings.Contains(gcLogText, "ESCALATION") || strings.Contains(gcLogText, "stale issue auto-close disabled") {
+		t.Fatalf("reaper escalated despite successful shell metadata fallback:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "closed:1") {
+		t.Fatalf("reaper summary did not report city issue close:\n%s", gcLogText)
+	}
+}
+
+func TestReaperSkipsIssueAutoCloseWhenCityMetadataIsMalformed(t *testing.T) {
+	cityDir := t.TempDir()
+	metadataDir := filepath.Join(cityDir, ".beads")
+	if err := os.MkdirAll(metadataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%s): %v", metadataDir, err)
+	}
+	if err := os.WriteFile(filepath.Join(metadataDir, "metadata.json"), []byte(`{"dolt_database":"beads"`), 0o644); err != nil {
+		t.Fatalf("WriteFile(metadata.json): %v", err)
+	}
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"SELECT id FROM "*"issues"*)
+    printf 'id\nga-old\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if strings.Contains(string(bdData), "close ") {
+		t.Fatalf("reaper accepted malformed metadata and attempted issue auto-close:\n%s", bdData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "stale issue auto-close disabled") {
+		t.Fatalf("reaper did not disable auto-close for malformed city metadata:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "skipped_non_city_issues:1") {
+		t.Fatalf("reaper did not report skipped stale issue candidate:\n%s", gcLogText)
+	}
+}
+
+func TestReaperSkipsIssueAutoCloseWhenCityDatabaseUnknown(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\nrigdb\n'
+    ;;
+  *"SELECT id FROM "*"issues"*)
+    printf 'id\nga-old\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+printf '%s\n' "$*" >> "$BD_CALL_LOG"
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"BD_CALL_LOG":      bdLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	bdData, err := os.ReadFile(bdLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if strings.Contains(string(bdData), "close ") {
+		t.Fatalf("reaper attempted issue auto-close without city database identity:\n%s", bdData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if !strings.Contains(gcLogText, "stale issue auto-close disabled") {
+		t.Fatalf("reaper did not escalate missing city database identity:\n%s", gcLogText)
+	}
+	if !strings.Contains(gcLogText, "skipped_non_city_issues:2") {
+		t.Fatalf("reaper did not report skipped stale issue candidates:\n%s", gcLogText)
+	}
+}
+
+func TestReaperIgnoresNothingToCommitAfterMutationRace(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	doltLog := filepath.Join(t.TempDir(), "dolt-args.log")
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\nbeads\n'
+    ;;
+  *"CALL DOLT_COMMIT"*)
+    printf 'nothing to commit\n' >&2
+    exit 1
+    ;;
+  *"DELETE FROM "*"wisps"*)
+    printf 'ROW_COUNT()\n1\n'
+    ;;
+  *"status = 'closed'"*"closed_at <"*)
+    printf 'COUNT(*)\n1\n'
+    ;;
+  *"COUNT("*)
+    printf 'COUNT(*)\n0\n'
+    ;;
+  *"SELECT id"*)
+    printf 'id\n'
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"DOLT_ARGS_LOG":    doltLog,
+		"GC_CALL_LOG":      gcLog,
+		"GC_CITY":          cityDir,
+		"GC_CITY_PATH":     cityDir,
+		"GC_DOLT_HOST":     "127.0.0.1",
+		"GC_DOLT_PORT":     "3307",
+		"GC_DOLT_USER":     "root",
+		"GC_DOLT_PASSWORD": "",
+		"PATH":             binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh"), env)
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	gcLogText := string(gcData)
+	if strings.Contains(gcLogText, "mail send mayor/ -s ESCALATION") || strings.Contains(gcLogText, "Dolt commit found nothing to commit") {
+		t.Fatalf("reaper escalated benign nothing-to-commit race:\n%s", gcLogText)
+	}
+}
+
+func TestReaperFormulaMatchesScriptDefaults(t *testing.T) {
+	scriptPath := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "reaper.sh")
+	scriptData, err := os.ReadFile(scriptPath)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", scriptPath, err)
+	}
+	formulaPath := filepath.Join(exampleDir(), "packs", "maintenance", "formulas", "mol-dog-reaper.toml")
+	formulaData, err := os.ReadFile(formulaPath)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", formulaPath, err)
+	}
+
+	script := string(scriptData)
+	formula := string(formulaData)
+	for _, check := range []struct {
+		scriptEnv string
+		formVar   string
+	}{
+		{scriptEnv: "GC_REAPER_MAX_AGE", formVar: "max_age"},
+		{scriptEnv: "GC_REAPER_PURGE_AGE", formVar: "purge_age"},
+		{scriptEnv: "GC_REAPER_STALE_ISSUE_AGE", formVar: "stale_issue_age"},
+	} {
+		scriptDefault := extractShellDefault(t, script, check.scriptEnv)
+		formulaDefault := extractFormulaDefault(t, formula, check.formVar)
+		if scriptDefault != formulaDefault {
+			t.Errorf("%s default mismatch: script=%q formula=%q", check.formVar, scriptDefault, formulaDefault)
+		}
+	}
+}
+
+func extractShellDefault(t *testing.T, script, envName string) string {
+	t.Helper()
+	re := regexp.MustCompile(envName + `:-([^}"]+)`)
+	m := re.FindStringSubmatch(script)
+	if len(m) != 2 {
+		t.Fatalf("default for %s not found in script", envName)
+	}
+	return m[1]
+}
+
+func extractFormulaDefault(t *testing.T, formula, varName string) string {
+	t.Helper()
+	re := regexp.MustCompile(`(?s)\[vars\.` + regexp.QuoteMeta(varName) + `\].*?default = "([^"]+)"`)
+	m := re.FindStringSubmatch(formula)
+	if len(m) != 2 {
+		t.Fatalf("default for %s not found in formula", varName)
+	}
+	return m[1]
+}
+
+func listenManagedDoltPort(t *testing.T) net.Listener {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("Listen: %v", err)
+	}
+	t.Cleanup(func() { _ = listener.Close() })
+	return listener
+}
+
+func writeManagedRuntimeState(t *testing.T, cityDir string, port int) {
+	t.Helper()
+	writeManagedRuntimeStateWithPID(t, cityDir, port, os.Getpid())
+}
+
+func writeManagedRuntimeStateWithPID(t *testing.T, cityDir string, port int, pid int) {
+	t.Helper()
+	stateDir := filepath.Join(cityDir, ".gc", "runtime", "packs", "dolt")
+	if err := os.MkdirAll(stateDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	payload, err := json.Marshal(map[string]any{
+		"running":    true,
+		"pid":        pid,
+		"port":       port,
+		"data_dir":   filepath.Join(cityDir, ".beads", "dolt"),
+		"started_at": "2026-04-20T00:00:00Z",
+	})
+	if err != nil {
+		t.Fatalf("Marshal(managed runtime state): %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(stateDir, "dolt-state.json"), payload, 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestFormulaDoltSQLExamplesUseExplicitTarget(t *testing.T) {
+	examplesDir := filepath.Dir(exampleDir())
+	paths := []string{
+		filepath.Join(examplesDir, "dolt", "formulas", "mol-dog-doctor.toml"),
+		filepath.Join(exampleDir(), "packs", "maintenance", "formulas", "mol-dog-jsonl.toml"),
+	}
+	for _, path := range paths {
+		t.Run(filepath.Base(path), func(t *testing.T) {
+			data, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatalf("ReadFile(%s): %v", path, err)
+			}
+			if match := rawDoltSQLCallRe.Find(data); match != nil {
+				t.Fatalf("formula contains unqualified Dolt SQL command %q; include host, port, user, and no-tls args", match)
+			}
+		})
+	}
+}
+
+func TestSpawnStormDetectPersistsNewLedgerCounts(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+case "$1" in
+  list)
+    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+    ;;
+  show)
+    printf '[{"id":"%s","status":"open","title":"Looping bead"}]\n' "$2"
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"GC_CITY":               cityDir,
+		"GC_CITY_PATH":          cityDir,
+		"GC_PACK_STATE_DIR":     stateDir,
+		"GC_CALL_LOG":           gcLog,
+		"SPAWN_STORM_THRESHOLD": "1",
+		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+
+	ledgerData, err := os.ReadFile(filepath.Join(stateDir, "spawn-storm-counts.json"))
+	if err != nil {
+		t.Fatalf("ReadFile(ledger): %v", err)
+	}
+	var counts map[string]int
+	if err := json.Unmarshal(ledgerData, &counts); err != nil {
+		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+	}
+	if got := counts["ga-loop"]; got != 1 {
+		t.Fatalf("ledger count for ga-loop = %d, want 1\nledger: %s", got, ledgerData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "SPAWN_STORM: bead ga-loop reset 1x") {
+		t.Fatalf("gc log missing spawn storm notification:\n%s", gcData)
+	}
+}
+
+func TestSpawnStormDetectPersistsCountWhenTitleLookupFails(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+case "$1" in
+  list)
+    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+    ;;
+  show)
+    printf 'temporary backend failure\n' >&2
+    exit 1
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+exit 0
+`)
+
+	env := map[string]string{
+		"GC_CITY":               cityDir,
+		"GC_CITY_PATH":          cityDir,
+		"GC_PACK_STATE_DIR":     stateDir,
+		"GC_CALL_LOG":           gcLog,
+		"SPAWN_STORM_THRESHOLD": "1",
+		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+
+	ledgerData, err := os.ReadFile(filepath.Join(stateDir, "spawn-storm-counts.json"))
+	if err != nil {
+		t.Fatalf("ReadFile(ledger): %v", err)
+	}
+	var counts map[string]int
+	if err := json.Unmarshal(ledgerData, &counts); err != nil {
+		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+	}
+	if got := counts["ga-loop"]; got != 1 {
+		t.Fatalf("ledger count for ga-loop = %d, want 1\nledger: %s", got, ledgerData)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "SPAWN_STORM: bead ga-loop reset 1x") {
+		t.Fatalf("gc log missing spawn storm notification:\n%s", gcData)
+	}
+}
+
+func TestSpawnStormDetectFailsOnMalformedOpenBeadJSON(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	ledger := filepath.Join(stateDir, "spawn-storm-counts.json")
+	if err := os.MkdirAll(stateDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(ledger, []byte(`{"ga-existing":2}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+case "$1" in
+  list)
+    printf 'not-json\n'
+    ;;
+  show)
+    printf '[{"id":"%s","status":"open","title":"Looping bead"}]\n' "$2"
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+exit 0
+`)
+
+	env := map[string]string{
+		"GC_CITY":           cityDir,
+		"GC_CITY_PATH":      cityDir,
+		"GC_PACK_STATE_DIR": stateDir,
+		"PATH":              binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	script := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh")
+	cmd := exec.Command(script)
+	cmd.Env = mergeTestEnv(env)
+	if out, err := cmd.CombinedOutput(); err == nil {
+		t.Fatalf("%s succeeded with malformed bd JSON; output:\n%s", filepath.Base(script), out)
+	}
+
+	ledgerData, err := os.ReadFile(ledger)
+	if err != nil {
+		t.Fatalf("ReadFile(ledger): %v", err)
+	}
+	if got, want := string(ledgerData), `{"ga-existing":2}`; got != want {
+		t.Fatalf("ledger changed after malformed JSON: got %s, want %s", got, want)
+	}
+}
+
+func TestSpawnStormDetectPrunesClosedAndDeletedLedgerEntries(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	ledger := filepath.Join(stateDir, "spawn-storm-counts.json")
+	if err := os.MkdirAll(stateDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(ledger, []byte(`{"ga-closed":2,"ga-deleted":3,"ga-open":4}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+case "$1" in
+  list)
+    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+    ;;
+  show)
+    case "$2" in
+      ga-closed)
+        printf '[{"id":"ga-closed","status":"closed","title":"Closed bead"}]\n'
+        ;;
+      ga-open|ga-loop)
+        printf '[{"id":"%s","status":"open","title":"Open bead"}]\n' "$2"
+        ;;
+      ga-deleted)
+        printf 'issue not found\n' >&2
+        exit 1
+        ;;
+    esac
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+exit 0
+`)
+
+	env := map[string]string{
+		"GC_CITY":               cityDir,
+		"GC_CITY_PATH":          cityDir,
+		"GC_PACK_STATE_DIR":     stateDir,
+		"SPAWN_STORM_THRESHOLD": "99",
+		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+
+	ledgerData, err := os.ReadFile(ledger)
+	if err != nil {
+		t.Fatalf("ReadFile(ledger): %v", err)
+	}
+	var counts map[string]int
+	if err := json.Unmarshal(ledgerData, &counts); err != nil {
+		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+	}
+	if _, ok := counts["ga-closed"]; ok {
+		t.Fatalf("closed bead was not pruned: %s", ledgerData)
+	}
+	if _, ok := counts["ga-deleted"]; ok {
+		t.Fatalf("deleted bead was not pruned: %s", ledgerData)
+	}
+	if got := counts["ga-open"]; got != 4 {
+		t.Fatalf("open bead count = %d, want 4\nledger: %s", got, ledgerData)
+	}
+	if got := counts["ga-loop"]; got != 1 {
+		t.Fatalf("new loop count = %d, want 1\nledger: %s", got, ledgerData)
+	}
+}
+
+func TestSpawnStormDetectPreservesLedgerOnTransientShowFailure(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	ledger := filepath.Join(stateDir, "spawn-storm-counts.json")
+	if err := os.MkdirAll(stateDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(ledger, []byte(`{"ga-transient":5}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), `#!/bin/sh
+case "$1" in
+  list)
+    printf '[{"id":"ga-loop","status":"open","metadata":{"recovered":"true"}}]\n'
+    ;;
+  show)
+    case "$2" in
+      ga-transient)
+        printf '{"error":"temporary backend failure"}\n'
+        exit 1
+        ;;
+      ga-loop)
+        printf '[{"id":"ga-loop","status":"open","title":"Open bead"}]\n'
+        ;;
+    esac
+    ;;
+esac
+exit 0
+`)
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+exit 0
+`)
+
+	env := map[string]string{
+		"GC_CITY":               cityDir,
+		"GC_CITY_PATH":          cityDir,
+		"GC_PACK_STATE_DIR":     stateDir,
+		"SPAWN_STORM_THRESHOLD": "99",
+		"PATH":                  binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "spawn-storm-detect.sh"), env)
+
+	ledgerData, err := os.ReadFile(ledger)
+	if err != nil {
+		t.Fatalf("ReadFile(ledger): %v", err)
+	}
+	var counts map[string]int
+	if err := json.Unmarshal(ledgerData, &counts); err != nil {
+		t.Fatalf("Unmarshal(ledger): %v\n%s", err, ledgerData)
+	}
+	if got := counts["ga-transient"]; got != 5 {
+		t.Fatalf("transient failure pruned or changed ledger count: got %d, want 5\nledger: %s", got, ledgerData)
+	}
+	if got := counts["ga-loop"]; got != 1 {
+		t.Fatalf("new loop count = %d, want 1\nledger: %s", got, ledgerData)
+	}
+}
+
+func runScript(t *testing.T, script string, env map[string]string) {
+	t.Helper()
+	out, err := runScriptResult(t, script, env)
+	if err != nil {
+		t.Fatalf("%s failed: %v\n%s", filepath.Base(script), err, out)
+	}
+}
+
+func runScriptResult(t *testing.T, script string, env map[string]string) ([]byte, error) {
+	t.Helper()
+	cmd := exec.Command(script)
+	cmd.Env = mergeTestEnv(env)
+	return cmd.CombinedOutput()
+}
+
+func writeExecutable(t *testing.T, path, body string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(body), 0o755); err != nil {
+		t.Fatalf("WriteFile(%s): %v", path, err)
+	}
+}
+
+func linkTestPathTool(t *testing.T, binDir, name string) {
+	t.Helper()
+	realPath, err := exec.LookPath(name)
+	if err != nil {
+		t.Fatalf("LookPath(%s): %v", name, err)
+	}
+	linkPath := filepath.Join(binDir, name)
+	if err := os.Symlink(realPath, linkPath); err != nil {
+		t.Fatalf("Symlink(%s, %s): %v", realPath, linkPath, err)
+	}
+}
+
+func writeCityBeadsMetadata(t *testing.T, cityDir, db string) {
+	t.Helper()
+	metadataDir := filepath.Join(cityDir, ".beads")
+	if err := os.MkdirAll(metadataDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(%s): %v", metadataDir, err)
+	}
+	metadata := fmt.Sprintf("{\n  \"dolt_database\": %q\n}\n", db)
+	if err := os.WriteFile(filepath.Join(metadataDir, "metadata.json"), []byte(metadata), 0o644); err != nil {
+		t.Fatalf("WriteFile(metadata.json): %v", err)
+	}
+}
+
+func writeMaintenanceDoltStub(t *testing.T, path string) {
+	t.Helper()
+	writeExecutable(t, path, `#!/bin/sh
+printf '%s\n' "$*" >> "$DOLT_ARGS_LOG"
+case "$*" in
+*"SHOW DATABASES"*)
+  printf 'Database\n'
+  if [ -n "${DOLT_DBS:-}" ]; then
+    for db in $DOLT_DBS; do
+      printf '%s\n' "$db"
+    done
+  else
+    printf 'beads\n'
+  fi
+  ;;
+*"SELECT *"*)
+  printf '{"id":"ga-1","title":"sample"}\n'
+  ;;
+*"DELETE FROM "*"wisps"*)
+  if [ -n "${DOLT_PURGE_COUNT:-}" ]; then
+    printf 'ROW_COUNT()\n%s\n' "$DOLT_PURGE_COUNT"
+  else
+    printf 'ROW_COUNT()\n0\n'
+  fi
+  ;;
+*"status = 'closed'"*"closed_at <"*)
+  if [ -n "${DOLT_PURGE_COUNT:-}" ]; then
+    printf 'COUNT(*)\n%s\n' "$DOLT_PURGE_COUNT"
+  else
+    printf 'COUNT(*)\n0\n'
+  fi
+  ;;
+*"COUNT("*)
+  printf 'COUNT(*)\n0\n'
+  ;;
+*"SELECT id"*)
+  printf 'id\n'
+  ;;
+esac
+exit 0
+`)
+}
+
+func mergeTestEnv(overrides map[string]string) []string {
+	env := os.Environ()
+	for key := range overrides {
+		prefix := key + "="
+		filtered := env[:0]
+		for _, entry := range env {
+			if !strings.HasPrefix(entry, prefix) {
+				filtered = append(filtered, entry)
+			}
+		}
+		env = filtered
+	}
+	keys := make([]string, 0, len(overrides))
+	for key := range overrides {
+		keys = append(keys, key)
+	}
+	for _, key := range keys {
+		env = append(env, key+"="+overrides[key])
+	}
+	return env
+}
+
+// jsonlExportEnv builds the common env map used by the spike-detection tests
+// below. Callers append per-test overrides on the returned map.
+func jsonlExportEnv(t *testing.T, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog string) map[string]string {
+	t.Helper()
+	return map[string]string{
+		"GC_CALL_LOG":                gcLog,
+		"GC_MAIL_LOG":                mailLog,
+		"GC_CITY":                    cityDir,
+		"GC_CITY_PATH":               cityDir,
+		"GC_PACK_STATE_DIR":          stateDir,
+		"GC_DOLT_HOST":               "127.0.0.1",
+		"GC_DOLT_PORT":               "3307",
+		"GC_DOLT_USER":               "root",
+		"GC_DOLT_PASSWORD":           "",
+		"GC_JSONL_ARCHIVE_REPO":      archiveRepo,
+		"GC_JSONL_MAX_PUSH_FAILURES": "99",
+		"GC_JSONL_SCRUB":             "false",
+		"GIT_CONFIG_GLOBAL":          filepath.Join(t.TempDir(), "gitconfig"),
+		"GIT_CONFIG_NOSYSTEM":        "1",
+		"PATH":                       binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+}
+
+// writeJsonlExportGCStub installs a `gc` shim that mirrors mail-send calls into
+// a separate log so tests can assert escalations independently of the noisier
+// nudge stream.
+func writeJsonlExportGCStub(t *testing.T, binDir string) {
+	t.Helper()
+	writeJsonlExportGCStubWithMailExitCode(t, binDir, 0)
+}
+
+func writeJsonlExportGCStubWithMailExitCode(t *testing.T, binDir string, mailExitCode int) {
+	t.Helper()
+	writeExecutable(t, filepath.Join(binDir, "gc"), `#!/bin/sh
+printf '%s\n' "$*" >> "$GC_CALL_LOG"
+if [ "$1" = "mail" ] && [ "$2" = "send" ]; then
+    printf '%s\n' "$*" >> "$GC_MAIL_LOG"
+    exit `+strconv.Itoa(mailExitCode)+`
+fi
+exit 0
+`)
+}
+
+// initSeedArchive builds a git repo at archiveRepo with one committed copy of
+// issues.jsonl whose .rows array length equals prevCount, then returns the
+// resulting commit SHA. The default branch is forced to `main` so the script's
+// later `git push origin main` would target the same ref the test verifies.
+func initSeedArchive(t *testing.T, archiveRepo string, prevCount int) string {
+	t.Helper()
+	dbDir := filepath.Join(archiveRepo, "beads")
+	if err := os.MkdirAll(dbDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	rows := make([]string, 0, prevCount)
+	for i := 0; i < prevCount; i++ {
+		rows = append(rows, fmt.Sprintf(`{"id":"p%d","title":"prev-%d"}`, i, i))
+	}
+	body := `{"rows":[` + strings.Join(rows, ",") + `]}` + "\n"
+	if err := os.WriteFile(filepath.Join(dbDir, "issues.jsonl"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// Persist identity to the repo's local config so the production script's
+	// later `git commit` (no -c flags, no user-level config in the test env)
+	// has a committer.
+	steps := [][]string{
+		{"-c", "init.defaultBranch=main", "init", "-q"},
+		{"config", "user.email", "test@example.invalid"},
+		{"config", "user.name", "test"},
+		{"add", "-A"},
+		{"commit", "-q", "-m", "seed"},
+	}
+	for _, args := range steps {
+		full := append([]string{"-C", archiveRepo}, args...)
+		cmd := exec.Command("git", full...)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+		}
+	}
+	cmd := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// writeMultiRecordDoltStub emits a `dolt` shim that returns a JSON object with
+// the given record count for the issues table and an empty `{"rows":[]}` for
+// the supplemental tables. Crucially the issues output is on a SINGLE physical
+// line — the realistic shape of `dolt sql -r json` — so `wc -l` on it returns
+// 1 regardless of record count.
+func writeMultiRecordDoltStub(t *testing.T, binDir string, currentCount int) {
+	t.Helper()
+	rows := make([]string, 0, currentCount)
+	for i := 0; i < currentCount; i++ {
+		rows = append(rows, fmt.Sprintf(`{"id":"c%d","title":"cur-%d"}`, i, i))
+	}
+	writeIssuesPayloadDoltStub(t, binDir, `{"rows":[`+strings.Join(rows, ",")+`]}`)
+}
+
+func writeIssuesPayloadDoltStub(t *testing.T, binDir, issuesPayload string) {
+	t.Helper()
+	body := "#!/bin/sh\n" +
+		"case \"$*\" in\n" +
+		"  *\"SHOW DATABASES\"*)\n" +
+		"    printf 'Database\\nbeads\\n'\n" +
+		"    ;;\n" +
+		"  *\"FROM \\`beads\\`.issues\"*)\n" +
+		"    printf '%s\\n' '" + issuesPayload + "'\n" +
+		"    ;;\n" +
+		"  *\"SELECT *\"*)\n" +
+		"    printf '{\"rows\":[]}\\n'\n" +
+		"    ;;\n" +
+		"esac\n" +
+		"exit 0\n"
+	writeExecutable(t, filepath.Join(binDir, "dolt"), body)
+}
+
+func writeIssueRowsDoltStub(t *testing.T, binDir string, rows []string) {
+	t.Helper()
+	writeIssuesPayloadDoltStub(t, binDir, `{"rows":[`+strings.Join(rows, ",")+`]}`)
+}
+
+func writeNoUserDatabasesDoltStub(t *testing.T, binDir string) {
+	t.Helper()
+	writeExecutable(t, filepath.Join(binDir, "dolt"), `#!/bin/sh
+case "$*" in
+  *"SHOW DATABASES"*)
+    printf 'Database\n'
+    ;;
+esac
+exit 0
+`)
+}
+
+func writeEmptyIssuesPayloadDoltStub(t *testing.T, binDir string) {
+	t.Helper()
+	body := "#!/bin/sh\n" +
+		"case \"$*\" in\n" +
+		"  *\"SHOW DATABASES\"*)\n" +
+		"    printf 'Database\\nbeads\\n'\n" +
+		"    ;;\n" +
+		"  *\"FROM \\`beads\\`.issues\"*)\n" +
+		"    ;;\n" +
+		"  *\"SELECT *\"*)\n" +
+		"    printf '{\"rows\":[]}\\n'\n" +
+		"    ;;\n" +
+		"esac\n" +
+		"exit 0\n"
+	writeExecutable(t, filepath.Join(binDir, "dolt"), body)
+}
+
+func writeIssuesExportFailureDoltStub(t *testing.T, binDir string) {
+	t.Helper()
+	body := "#!/bin/sh\n" +
+		"case \"$*\" in\n" +
+		"  *\"SHOW DATABASES\"*)\n" +
+		"    printf 'Database\\nbeads\\n'\n" +
+		"    ;;\n" +
+		"  *\"FROM \\`beads\\`.issues\"*)\n" +
+		"    echo 'simulated issues export failure' >&2\n" +
+		"    exit 1\n" +
+		"    ;;\n" +
+		"  *\"SELECT *\"*)\n" +
+		"    printf '{\"rows\":[]}\\n'\n" +
+		"    ;;\n" +
+		"esac\n" +
+		"exit 0\n"
+	writeExecutable(t, filepath.Join(binDir, "dolt"), body)
+}
+
+func writeGitSubcommandFailureStub(t *testing.T, binDir, realGit, subcommand string) {
+	t.Helper()
+	writeExecutable(t, filepath.Join(binDir, "git"), fmt.Sprintf(`#!/bin/sh
+for arg in "$@"; do
+    if [ "$arg" = "%s" ]; then
+        echo "simulated git %s failure" >&2
+        exit 1
+    fi
+done
+exec '%s' "$@"
+`, subcommand, subcommand, realGit))
+}
+
+func initSeedArchiveWithoutLocalIdentity(t *testing.T, archiveRepo string, prevCount int) string {
+	t.Helper()
+	dbDir := filepath.Join(archiveRepo, "beads")
+	if err := os.MkdirAll(dbDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	rows := make([]string, 0, prevCount)
+	for i := 0; i < prevCount; i++ {
+		rows = append(rows, fmt.Sprintf(`{"id":"p%d","title":"prev-%d"}`, i, i))
+	}
+	body := `{"rows":[` + strings.Join(rows, ",") + `]}` + "\n"
+	if err := os.WriteFile(filepath.Join(dbDir, "issues.jsonl"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	steps := [][]string{
+		{"-c", "init.defaultBranch=main", "init", "-q"},
+		{"add", "-A"},
+		{"commit", "-q", "-m", "seed"},
+	}
+	commitEnv := append(os.Environ(),
+		"GIT_AUTHOR_NAME=seed-author",
+		"GIT_AUTHOR_EMAIL=seed-author@example.invalid",
+		"GIT_COMMITTER_NAME=seed-committer",
+		"GIT_COMMITTER_EMAIL=seed-committer@example.invalid",
+	)
+	for _, args := range steps {
+		full := append([]string{"-C", archiveRepo}, args...)
+		cmd := exec.Command("git", full...)
+		if len(args) > 0 && args[len(args)-1] == "seed" {
+			cmd.Env = commitEnv
+		}
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+		}
+	}
+	cmd := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func initSeedArchiveWithRemote(t *testing.T, archiveRepo string) (string, string) {
+	t.Helper()
+	remoteRepo := filepath.Join(t.TempDir(), "archive-remote.git")
+	if out, err := exec.Command("git", "init", "--bare", "-q", remoteRepo).CombinedOutput(); err != nil {
+		t.Fatalf("git init --bare: %v\n%s", err, out)
+	}
+	if out, err := exec.Command("git", "clone", "-q", remoteRepo, archiveRepo).CombinedOutput(); err != nil {
+		t.Fatalf("git clone: %v\n%s", err, out)
+	}
+
+	dbDir := filepath.Join(archiveRepo, "beads")
+	if err := os.MkdirAll(dbDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	rows := make([]string, 0, 100)
+	for i := 0; i < 100; i++ {
+		rows = append(rows, fmt.Sprintf(`{"id":"p%d","title":"prev-%d"}`, i, i))
+	}
+	body := `{"rows":[` + strings.Join(rows, ",") + `]}` + "\n"
+	if err := os.WriteFile(filepath.Join(dbDir, "issues.jsonl"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	steps := [][]string{
+		{"checkout", "-q", "-b", "main"},
+		{"config", "user.email", "test@example.invalid"},
+		{"config", "user.name", "test"},
+		{"add", "-A"},
+		{"commit", "-q", "-m", "seed"},
+		{"push", "-q", "-u", "origin", "main"},
+	}
+	for _, args := range steps {
+		full := append([]string{"-C", archiveRepo}, args...)
+		if out, err := exec.Command("git", full...).CombinedOutput(); err != nil {
+			t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+		}
+	}
+
+	headOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main: %v\n%s", err, headOut)
+	}
+	return remoteRepo, strings.TrimSpace(string(headOut))
+}
+
+func initEmptyArchiveRemote(t *testing.T, archiveRepo string, prevCount int) string {
+	t.Helper()
+	remoteRepo := filepath.Join(t.TempDir(), "archive-remote.git")
+	if out, err := exec.Command("git", "init", "--bare", "-q", remoteRepo).CombinedOutput(); err != nil {
+		t.Fatalf("git init --bare: %v\n%s", err, out)
+	}
+	initSeedArchive(t, archiveRepo, prevCount)
+	if out, err := exec.Command("git", "-C", archiveRepo, "remote", "add", "origin", remoteRepo).CombinedOutput(); err != nil {
+		t.Fatalf("git remote add origin: %v\n%s", err, out)
+	}
+	return remoteRepo
+}
+
+func advanceArchiveRemoteMain(t *testing.T, remoteRepo string) string {
+	t.Helper()
+	worktree := t.TempDir()
+	if out, err := exec.Command("git", "clone", "-q", remoteRepo, worktree).CombinedOutput(); err != nil {
+		t.Fatalf("git clone remote advance worktree: %v\n%s", err, out)
+	}
+	steps := [][]string{
+		{"-C", worktree, "checkout", "-q", "main"},
+		{"-C", worktree, "config", "user.email", "test@example.invalid"},
+		{"-C", worktree, "config", "user.name", "test"},
+	}
+	for _, args := range steps {
+		if out, err := exec.Command("git", args...).CombinedOutput(); err != nil {
+			t.Fatalf("git %s: %v\n%s", strings.Join(args[2:], " "), err, out)
+		}
+	}
+	if err := os.WriteFile(filepath.Join(worktree, "remote-marker.txt"), []byte("remote-advance\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(remote marker): %v", err)
+	}
+	for _, args := range [][]string{
+		{"-C", worktree, "add", "-A"},
+		{"-C", worktree, "commit", "-q", "-m", "remote advance"},
+		{"-C", worktree, "push", "-q", "origin", "main"},
+	} {
+		if out, err := exec.Command("git", args...).CombinedOutput(); err != nil {
+			t.Fatalf("git %s: %v\n%s", strings.Join(args[2:], " "), err, out)
+		}
+	}
+	headOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after advance: %v\n%s", err, headOut)
+	}
+	return strings.TrimSpace(string(headOut))
+}
+
+func TestJsonlExportCountsRecordsViaJq(t *testing.T) {
+	// Bug 1 (#1547): `wc -l` on `dolt -r json` output measures formatting, not
+	// records — the JSON object is one physical line regardless of row count.
+	// Verify CURRENT_COUNT reflects the actual record count (3).
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	writeMultiRecordDoltStub(t, binDir, 3)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	log := string(gcData)
+	if !strings.Contains(log, "records: 3") {
+		t.Fatalf("expected DOG_DONE summary to report records: 3 (jq counted .rows length); got:\n%s", log)
+	}
+}
+
+func TestJsonlExportSkipsSpikeCheckBelowMinPrev(t *testing.T) {
+	// Bug 2 (#1547): percent-delta with no absolute floor escalates on tiny
+	// counts. prev=2, current=1 → 50% delta would cross the 20% threshold.
+	// With the fix, no escalation when prev < GC_JSONL_MIN_PREV_FOR_SPIKE
+	// (default 10).
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	initSeedArchive(t, archiveRepo, 2)
+	writeMultiRecordDoltStub(t, binDir, 1)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if strings.Contains(string(mailData), "ESCALATION: JSONL spike") {
+		t.Fatalf("spike escalation fired despite prev<MIN_PREV; mail log:\n%s", mailData)
+	}
+}
+
+func TestJsonlExportCommitsOnHaltToAdvanceBaseline(t *testing.T) {
+	// Bug 3 (#1547): HALT path skipped `git commit`, so PREV_COUNT was frozen
+	// and the spike re-fired every cooldown. With the fix, HALT still commits
+	// the new file (baseline advances) and tags the commit `[HALT]`, but skips
+	// `git push`.
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchive(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	// Sanity: the spike (90% drop, prev=100, current=10) was escalated.
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if !strings.Contains(string(mailData), "ESCALATION: JSONL spike") {
+		t.Fatalf("expected spike escalation as preconditions for the HALT-baseline test; mail log:\n%s", mailData)
+	}
+
+	// Baseline must advance: HEAD past the seed.
+	revOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, revOut)
+	}
+	newHead := strings.TrimSpace(string(revOut))
+	if newHead == prevHead {
+		t.Fatalf("HEAD did not advance after HALT; baseline is still frozen at %s", prevHead)
+	}
+
+	// Commit message tagged [HALT] so operators reading the archive log can
+	// distinguish baseline-only commits from full backups.
+	logOut, err := exec.Command("git", "-C", archiveRepo, "log", "-1", "--format=%s").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git log: %v\n%s", err, logOut)
+	}
+	headMsg := strings.TrimSpace(string(logOut))
+	if !strings.Contains(headMsg, "HALT") {
+		t.Fatalf("HALT-baseline commit must include HALT marker; got: %q", headMsg)
+	}
+
+	// The DOG_DONE summary on HALT should be the spike-halt nudge, not the
+	// regular exported/records/push summary line.
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "HALTED on spike detection") {
+		t.Fatalf("expected HALT nudge in gc log:\n%s", gcData)
+	}
+	if strings.Contains(string(gcData), "DOG_DONE: jsonl — exported") {
+		t.Fatalf("HALT path must not emit the success summary nudge; gc log:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportFirstRunWithDisabledFloorSkipsSpikeCheck(t *testing.T) {
+	// Regression: GC_JSONL_MIN_PREV_FOR_SPIKE=0 is documented as "disable the
+	// floor", but combined with a first run (no archive yet → PREV_COUNT=0)
+	// the spike calculation would divide by zero and `set -e` would kill the
+	// script. The guard must skip the spike check when PREV_COUNT == 0
+	// regardless of the floor setting.
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	// No initSeedArchive call — first run, archive does not yet exist.
+	writeMultiRecordDoltStub(t, binDir, 5)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+	env["GC_JSONL_MIN_PREV_FOR_SPIKE"] = "0"
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	// Should not have escalated (no prior baseline).
+	if mailData, _ := os.ReadFile(mailLog); strings.Contains(string(mailData), "ESCALATION: JSONL spike") {
+		t.Fatalf("first run with disabled floor must not escalate; mail log:\n%s", mailData)
+	}
+	// Sanity: the success summary nudge fired (script reached the end).
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "DOG_DONE: jsonl") {
+		t.Fatalf("expected DOG_DONE nudge in gc log:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportScrubTrueFiltersRowsWithoutDroppingWholePayload(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	initSeedArchive(t, archiveRepo, 12)
+	rows := make([]string, 0, 13)
+	rows = append(rows, `{"id":"bd-100","title":"real-leading-prefix"}`)
+	for i := 1; i < 12; i++ {
+		rows = append(rows, fmt.Sprintf(`{"id":"prod-%d","title":"real-%d"}`, i, i))
+	}
+	rows = append(rows, `{"id":"prod-test","title":"Test Issue 99"}`)
+	writeIssueRowsDoltStub(t, binDir, rows)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+	env["GC_JSONL_SCRUB"] = "true"
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if strings.Contains(string(mailData), "ESCALATION: JSONL spike") {
+		t.Fatalf("row-level scrub should preserve legitimate rows and avoid false spikes; mail log:\n%s", mailData)
+	}
+
+	exported, err := os.ReadFile(filepath.Join(archiveRepo, "beads", "issues.jsonl"))
+	if err != nil {
+		t.Fatalf("ReadFile(issues.jsonl): %v", err)
+	}
+	if got := strings.Count(string(exported), `"id":`); got != 12 {
+		t.Fatalf("expected scrubbed export to retain 12 legitimate rows, got %d rows:\n%s", got, exported)
+	}
+	if !strings.Contains(string(exported), `"id":"bd-100"`) {
+		t.Fatalf("expected scrubbed export to preserve the legitimate bd-100 row, got:\n%s", exported)
+	}
+	if strings.Contains(string(exported), "Test Issue 99") {
+		t.Fatalf("expected scrubbed export to remove the test row, got:\n%s", exported)
+	}
+
+	legacyExported, err := os.ReadFile(filepath.Join(archiveRepo, "beads.jsonl"))
+	if err != nil {
+		t.Fatalf("ReadFile(beads.jsonl): %v", err)
+	}
+	if got := strings.Count(string(legacyExported), `"id":`); got != 12 {
+		t.Fatalf("expected legacy flat export to retain 12 legitimate rows, got %d rows:\n%s", got, legacyExported)
+	}
+	if !strings.Contains(string(legacyExported), `"id":"bd-100"`) {
+		t.Fatalf("expected legacy flat export to preserve the legitimate bd-100 row, got:\n%s", legacyExported)
+	}
+	if strings.Contains(string(legacyExported), "Test Issue 99") {
+		t.Fatalf("expected legacy flat export to remove the test row, got:\n%s", legacyExported)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "records: 12") {
+		t.Fatalf("expected DOG_DONE summary to report the scrubbed record count, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportHaltCommitAdvancesBaselineWithoutLocalGitIdentity(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchiveWithoutLocalIdentity(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	revOut, revErr := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if revErr != nil {
+		t.Fatalf("git rev-parse: %v\n%s", revErr, revOut)
+	}
+	if newHead := strings.TrimSpace(string(revOut)); newHead == prevHead {
+		t.Fatalf("HEAD did not advance without repo-local git identity; baseline stayed frozen at %s", prevHead)
+	}
+
+	gcData, readErr := os.ReadFile(gcLog)
+	if readErr != nil && !os.IsNotExist(readErr) {
+		t.Fatalf("ReadFile(gc log): %v", readErr)
+	}
+	if !strings.Contains(string(gcData), "HALTED on spike detection") {
+		t.Fatalf("expected HALT success nudge after baseline advance, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportDeletedHeadBaselineSkipsPreviousCountLookup(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	initSeedArchive(t, archiveRepo, 3)
+	steps := [][]string{
+		{"rm", "-q", "beads/issues.jsonl"},
+		{"commit", "-q", "-m", "delete issues baseline"},
+	}
+	for _, args := range steps {
+		cmd := exec.Command("git", append([]string{"-C", archiveRepo}, args...)...)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+		}
+	}
+
+	writeMultiRecordDoltStub(t, binDir, 5)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	if mailData, _ := os.ReadFile(mailLog); strings.Contains(string(mailData), "ESCALATION: JSONL spike") {
+		t.Fatalf("deleted HEAD baseline should behave like no baseline; mail log:\n%s", mailData)
+	}
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "DOG_DONE: jsonl") {
+		t.Fatalf("expected DOG_DONE summary after deleted HEAD baseline, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportScrubFailureDoesNotCommitBrokenOutputs(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchive(t, archiveRepo, 3)
+	writeIssuesPayloadDoltStub(t, binDir, `{bad json`)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+	env["GC_JSONL_SCRUB"] = "true"
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	revOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, revOut)
+	}
+	if newHead := strings.TrimSpace(string(revOut)); newHead != prevHead {
+		t.Fatalf("scrub failure must not advance HEAD: got %s want %s", newHead, prevHead)
+	}
+
+	statusOut, err := exec.Command("git", "-C", archiveRepo, "status", "--short").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git status: %v\n%s", err, statusOut)
+	}
+	if strings.TrimSpace(string(statusOut)) != "" {
+		t.Fatalf("scrub failure must leave the archive worktree clean, got:\n%s", statusOut)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "failed: beads ") {
+		t.Fatalf("expected scrub failure to report failed dbs, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportMalformedPayloadWithoutScrubDoesNotCommitBrokenOutputs(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchive(t, archiveRepo, 3)
+	writeIssuesPayloadDoltStub(t, binDir, `{bad json`)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+	env["GC_JSONL_SCRUB"] = "false"
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	revOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, revOut)
+	}
+	if newHead := strings.TrimSpace(string(revOut)); newHead != prevHead {
+		t.Fatalf("malformed payload without scrub must not advance HEAD: got %s want %s", newHead, prevHead)
+	}
+
+	statusOut, err := exec.Command("git", "-C", archiveRepo, "status", "--short").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git status: %v\n%s", err, statusOut)
+	}
+	if strings.TrimSpace(string(statusOut)) != "" {
+		t.Fatalf("malformed payload without scrub must leave the archive worktree clean, got:\n%s", statusOut)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "failed: beads ") {
+		t.Fatalf("expected malformed payload without scrub to report failed dbs, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportHaltStagingFailureExitsWithoutAdvancingBaseline(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchive(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	realGit, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatalf("LookPath(git): %v", err)
+	}
+	writeGitSubcommandFailureStub(t, binDir, realGit, "add")
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	out, runErr := runScriptResult(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+	if runErr == nil {
+		t.Fatalf("expected script to fail when git add fails on HALT path; output:\n%s", out)
+	}
+	if !strings.Contains(string(out), "staging archive outputs failed") {
+		t.Fatalf("expected staging failure diagnostic, got:\n%s", out)
+	}
+
+	revOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, revOut)
+	}
+	if newHead := strings.TrimSpace(string(revOut)); newHead != prevHead {
+		t.Fatalf("staging failure must not advance HEAD: got %s want %s", newHead, prevHead)
+	}
+
+	statusOut, err := exec.Command("git", "-C", archiveRepo, "status", "--short").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git status: %v\n%s", err, statusOut)
+	}
+	if strings.TrimSpace(string(statusOut)) != "" {
+		t.Fatalf("staging failure must leave the archive worktree clean, got:\n%s", statusOut)
+	}
+}
+
+func TestJsonlExportHaltCommitFailureLeavesArchiveClean(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchive(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	realGit, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatalf("LookPath(git): %v", err)
+	}
+	writeGitSubcommandFailureStub(t, binDir, realGit, "commit")
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	out, runErr := runScriptResult(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+	if runErr == nil {
+		t.Fatalf("expected script to fail when git commit fails on HALT path; output:\n%s", out)
+	}
+	if !strings.Contains(string(out), "HALT baseline commit failed") {
+		t.Fatalf("expected commit failure diagnostic, got:\n%s", out)
+	}
+
+	revOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, revOut)
+	}
+	if newHead := strings.TrimSpace(string(revOut)); newHead != prevHead {
+		t.Fatalf("commit failure must not advance HEAD: got %s want %s", newHead, prevHead)
+	}
+
+	statusOut, err := exec.Command("git", "-C", archiveRepo, "status", "--short").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git status: %v\n%s", err, statusOut)
+	}
+	if strings.TrimSpace(string(statusOut)) != "" {
+		t.Fatalf("commit failure must leave the archive worktree clean, got:\n%s", statusOut)
+	}
+}
+
+func TestJsonlExportHaltMailFailurePersistsPendingAlertAndRetriesNextRun(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	initSeedArchive(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStubWithMailExitCode(t, binDir, 1)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	var state map[string]any
+	if err := json.Unmarshal(stateData, &state); err != nil {
+		t.Fatalf("Unmarshal(state file): %v\n%s", err, stateData)
+	}
+	pendingAlerts, ok := state["pending_spike_alerts"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected pending_spike_alerts after mail failure, got:\n%s", stateData)
+	}
+	if _, ok := pendingAlerts["beads"]; !ok {
+		t.Fatalf("expected beads pending alert after mail failure, got:\n%s", stateData)
+	}
+
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if !strings.Contains(string(mailData), "ESCALATION: JSONL spike") {
+		t.Fatalf("expected initial failed mail attempt to be logged, got:\n%s", mailData)
+	}
+
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err = os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_spike_alert"`) {
+		t.Fatalf("expected pending spike alert to clear after retry, got:\n%s", stateData)
+	}
+
+	mailData, err = os.ReadFile(mailLog)
+	if err != nil {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if got := strings.Count(string(mailData), "ESCALATION: JSONL spike"); got != 2 {
+		t.Fatalf("expected one failed attempt and one retry delivery, got %d entries:\n%s", got, mailData)
+	}
+}
+
+func TestJsonlExportNoChangePushesPendingArchiveCommitAfterHalt(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	remoteRepo, remoteHead := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHead, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HEAD: %v\n%s", err, localHead)
+	}
+	localHaltHead := strings.TrimSpace(string(localHead))
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after halt: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != remoteHead {
+		t.Fatalf("HALT run must not push remote main: got %s want %s", got, remoteHead)
+	}
+	if localHaltHead == remoteHead {
+		t.Fatalf("HALT run must create a local-only commit")
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if !strings.Contains(string(stateData), `"pending_archive_push":true`) {
+		t.Fatalf("expected pending_archive_push after HALT, got:\n%s", stateData)
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	remoteHeadOut, err = exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after retry: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != localHaltHead {
+		t.Fatalf("expected no-change run to push pending local commit: got %s want %s", got, localHaltHead)
+	}
+
+	stateData, err = os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_archive_push":true`) {
+		t.Fatalf("expected pending_archive_push to clear after push, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportNoChangePushesPendingArchiveCommitWithoutPendingState(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	remoteRepo, remoteHead := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHead, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HEAD: %v\n%s", err, localHead)
+	}
+	localHaltHead := strings.TrimSpace(string(localHead))
+	if localHaltHead == remoteHead {
+		t.Fatalf("HALT run must create a local-only commit")
+	}
+
+	if err := os.WriteFile(stateFile, []byte("not-json\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after replay: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != localHaltHead {
+		t.Fatalf("expected git-state fallback to push stranded local commit: got %s want %s", got, localHaltHead)
+	}
+}
+
+func TestJsonlExportNoUserDatabasesPushesPendingArchiveCommit(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	remoteRepo, remoteHead := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HALT HEAD: %v\n%s", err, localHeadOut)
+	}
+	localHaltHead := strings.TrimSpace(string(localHeadOut))
+	if localHaltHead == remoteHead {
+		t.Fatalf("HALT run must create a local-only commit")
+	}
+
+	writeNoUserDatabasesDoltStub(t, binDir)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after empty-db replay: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != localHaltHead {
+		t.Fatalf("expected empty-db run to publish pending archive commit: got %s want %s", got, localHaltHead)
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_archive_push":true`) {
+		t.Fatalf("expected pending_archive_push to clear after empty-db replay, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportNoChangeRebasesPendingArchiveCommitOntoAdvancedRemote(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	remoteRepo, _ := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadBeforeReplay, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HALT HEAD: %v\n%s", err, localHeadBeforeReplay)
+	}
+	haltHead := strings.TrimSpace(string(localHeadBeforeReplay))
+
+	advancedRemoteHead := advanceArchiveRemoteMain(t, remoteRepo)
+	if advancedRemoteHead == haltHead {
+		t.Fatalf("remote advance must create a new remote commit")
+	}
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadAfterReplay, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local replay HEAD: %v\n%s", err, localHeadAfterReplay)
+	}
+	replayedHead := strings.TrimSpace(string(localHeadAfterReplay))
+	if replayedHead == haltHead {
+		t.Fatalf("expected replay to rebase HALT commit onto advanced remote")
+	}
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after replay: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != replayedHead {
+		t.Fatalf("expected replayed local HEAD to publish after remote advance: got remote %s want local %s", got, replayedHead)
+	}
+
+	logOut, err := exec.Command("git", "--git-dir", remoteRepo, "log", "--format=%s", "-2", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git log remote main: %v\n%s", err, logOut)
+	}
+	remoteLog := string(logOut)
+	if !strings.Contains(remoteLog, "remote advance") || !strings.Contains(remoteLog, "HALT") {
+		t.Fatalf("expected remote history to contain both remote advance and replayed HALT commit, got:\n%s", remoteLog)
+	}
+}
+
+func TestJsonlExportNoChangePushFailureWithMalformedStateUsesTrackingRef(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	remoteRepo, remoteHead := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HALT HEAD: %v\n%s", err, localHeadOut)
+	}
+	localHaltHead := strings.TrimSpace(string(localHeadOut))
+	if localHaltHead == remoteHead {
+		t.Fatalf("HALT run must create a local-only commit")
+	}
+
+	if err := os.WriteFile(stateFile, []byte("not-json\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	realGit, err := exec.LookPath("git")
+	if err != nil {
+		t.Fatalf("LookPath(git): %v", err)
+	}
+	writeGitSubcommandFailureStub(t, binDir, realGit, "fetch")
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	var state map[string]any
+	if err := json.Unmarshal(stateData, &state); err != nil {
+		t.Fatalf("Unmarshal(state file): %v\n%s", err, stateData)
+	}
+	if got := state["consecutive_push_failures"]; got != float64(1) {
+		t.Fatalf("consecutive_push_failures = %v, want 1\nstate: %s", got, stateData)
+	}
+	if got := state["pending_archive_push"]; got != true {
+		t.Fatalf("pending_archive_push = %v, want true\nstate: %s", got, stateData)
+	}
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after failed replay: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != remoteHead {
+		t.Fatalf("expected fetch failure to leave remote main unchanged: got %s want %s", got, remoteHead)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "push: failed") {
+		t.Fatalf("expected replay failure to surface push failure summary, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportExportFailureDoesNotBlockPendingArchiveReplay(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	remoteRepo, remoteHead := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadBeforeReplay, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HALT HEAD: %v\n%s", err, localHeadBeforeReplay)
+	}
+	haltHead := strings.TrimSpace(string(localHeadBeforeReplay))
+	if haltHead == remoteHead {
+		t.Fatalf("HALT run must create a local-only commit")
+	}
+
+	advancedRemoteHead := advanceArchiveRemoteMain(t, remoteRepo)
+	if advancedRemoteHead == haltHead {
+		t.Fatalf("remote advance must create a new remote commit")
+	}
+
+	writeIssuesExportFailureDoltStub(t, binDir)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadAfterReplay, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local replay HEAD: %v\n%s", err, localHeadAfterReplay)
+	}
+	replayedHead := strings.TrimSpace(string(localHeadAfterReplay))
+	if replayedHead == haltHead {
+		t.Fatalf("expected replay to rebase HALT commit onto advanced remote")
+	}
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after replay: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != replayedHead {
+		t.Fatalf("expected replayed local HEAD to publish after export failure: got remote %s want local %s", got, replayedHead)
+	}
+
+	statusOut, err := exec.Command("git", "-C", archiveRepo, "status", "--short").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git status: %v\n%s", err, statusOut)
+	}
+	if strings.TrimSpace(string(statusOut)) != "" {
+		t.Fatalf("export failure must leave the archive worktree clean, got:\n%s", statusOut)
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_archive_push":true`) {
+		t.Fatalf("expected pending_archive_push to clear after replay, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportPushBootstrapCreatesRemoteMainWhenMissing(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	remoteRepo := initEmptyArchiveRemote(t, archiveRepo, 3)
+	writeMultiRecordDoltStub(t, binDir, 5)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HEAD: %v\n%s", err, localHeadOut)
+	}
+	localHead := strings.TrimSpace(string(localHeadOut))
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != localHead {
+		t.Fatalf("expected bootstrap push to publish local HEAD: got remote %s want local %s", got, localHead)
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_archive_push":true`) {
+		t.Fatalf("expected pending_archive_push to clear after bootstrap push, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportLegacyStateBackupRecoversPendingArchiveReplay(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	legacyStateFile := filepath.Join(cityDir, ".gc", "jsonl-export-state.json")
+
+	remoteRepo, remoteHead := initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStub(t, binDir)
+
+	if err := os.MkdirAll(filepath.Dir(legacyStateFile), 0o755); err != nil {
+		t.Fatalf("MkdirAll(legacy state dir): %v", err)
+	}
+	if err := os.WriteFile(legacyStateFile, []byte("{}\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(legacy state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	localHeadOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse local HALT HEAD: %v\n%s", err, localHeadOut)
+	}
+	localHaltHead := strings.TrimSpace(string(localHeadOut))
+	if localHaltHead == remoteHead {
+		t.Fatalf("HALT run must create a local-only commit")
+	}
+
+	backupData, err := os.ReadFile(legacyStateFile + ".bak")
+	if err != nil {
+		t.Fatalf("ReadFile(legacy state backup): %v", err)
+	}
+	if !strings.Contains(string(backupData), `"pending_archive_push":true`) {
+		t.Fatalf("expected legacy backup to preserve pending archive push, got:\n%s", backupData)
+	}
+
+	if err := os.WriteFile(legacyStateFile, []byte("not-json\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(legacy state file): %v", err)
+	}
+
+	writeNoUserDatabasesDoltStub(t, binDir)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	remoteHeadOut, err := exec.Command("git", "--git-dir", remoteRepo, "rev-parse", "refs/heads/main").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse remote main after replay: %v\n%s", err, remoteHeadOut)
+	}
+	if got := strings.TrimSpace(string(remoteHeadOut)); got != localHaltHead {
+		t.Fatalf("expected legacy backup replay to publish pending archive commit: got %s want %s", got, localHaltHead)
+	}
+
+	stateData, err := os.ReadFile(legacyStateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(legacy state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_archive_push":true`) {
+		t.Fatalf("expected legacy pending_archive_push to clear after replay, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportEmptyIssuesPayloadDoesNotCommitBrokenOutputs(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+
+	prevHead := initSeedArchive(t, archiveRepo, 3)
+	writeEmptyIssuesPayloadDoltStub(t, binDir)
+	writeJsonlExportGCStub(t, binDir)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+	env["GC_JSONL_SCRUB"] = "false"
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	revOut, err := exec.Command("git", "-C", archiveRepo, "rev-parse", "HEAD").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git rev-parse: %v\n%s", err, revOut)
+	}
+	if newHead := strings.TrimSpace(string(revOut)); newHead != prevHead {
+		t.Fatalf("empty payload must not advance HEAD: got %s want %s", newHead, prevHead)
+	}
+
+	statusOut, err := exec.Command("git", "-C", archiveRepo, "status", "--short").CombinedOutput()
+	if err != nil {
+		t.Fatalf("git status: %v\n%s", err, statusOut)
+	}
+	if strings.TrimSpace(string(statusOut)) != "" {
+		t.Fatalf("empty payload must leave the archive worktree clean, got:\n%s", statusOut)
+	}
+
+	gcData, err := os.ReadFile(gcLog)
+	if err != nil {
+		t.Fatalf("ReadFile(gc log): %v", err)
+	}
+	if !strings.Contains(string(gcData), "failed: beads ") {
+		t.Fatalf("expected empty payload to report failed dbs, got:\n%s", gcData)
+	}
+}
+
+func TestJsonlExportPushFailureRecoversFromMalformedState(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	initSeedArchive(t, archiveRepo, 3)
+	writeMultiRecordDoltStub(t, binDir, 5)
+	writeJsonlExportGCStub(t, binDir)
+
+	if err := os.WriteFile(stateFile, []byte("not-json\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	var state map[string]any
+	if err := json.Unmarshal(stateData, &state); err != nil {
+		t.Fatalf("Unmarshal(state file): %v\n%s", err, stateData)
+	}
+	if got := state["consecutive_push_failures"]; got != float64(1) {
+		t.Fatalf("consecutive_push_failures = %v, want 1\nstate: %s", got, stateData)
+	}
+}
+
+func TestJsonlExportPushFailureRecoversFromWrongShapeState(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	initSeedArchive(t, archiveRepo, 3)
+	writeMultiRecordDoltStub(t, binDir, 5)
+	writeJsonlExportGCStub(t, binDir)
+
+	if err := os.WriteFile(stateFile, []byte("[]\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	var state map[string]any
+	if err := json.Unmarshal(stateData, &state); err != nil {
+		t.Fatalf("Unmarshal(state file): %v\n%s", err, stateData)
+	}
+	if got := state["consecutive_push_failures"]; got != float64(1) {
+		t.Fatalf("consecutive_push_failures = %v, want 1\nstate: %s", got, stateData)
+	}
+}
+
+func TestJsonlExportHaltMailFailureRecoversFromMalformedState(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	initSeedArchive(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStubWithMailExitCode(t, binDir, 1)
+
+	if err := os.WriteFile(stateFile, []byte("not-json\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	state := map[string]any{}
+	if err := json.Unmarshal(stateData, &state); err != nil {
+		t.Fatalf("Unmarshal(state file): %v\n%s", err, stateData)
+	}
+	pendingAlerts, ok := state["pending_spike_alerts"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected pending_spike_alerts map, got: %s", stateData)
+	}
+	pending, ok := pendingAlerts["beads"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected beads pending alert entry, got: %s", stateData)
+	}
+	if got := pending["database"]; got != "beads" {
+		t.Fatalf("pending_spike_alert.database = %v, want beads\nstate: %s", got, stateData)
+	}
+}
+
+func TestJsonlExportRetriesPendingAlertFromBackupAfterPrimaryCorruption(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	initSeedArchiveWithRemote(t, archiveRepo)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStubWithMailExitCode(t, binDir, 1)
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	backupData, err := os.ReadFile(stateFile + ".bak")
+	if err != nil {
+		t.Fatalf("ReadFile(state backup): %v", err)
+	}
+	if !strings.Contains(string(backupData), `"pending_spike_alerts"`) {
+		t.Fatalf("expected backup state to preserve pending spike alert, got:\n%s", backupData)
+	}
+	if err := os.WriteFile(stateFile, []byte("not-json\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	writeNoUserDatabasesDoltStub(t, binDir)
+	writeJsonlExportGCStub(t, binDir)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if got := strings.Count(string(mailData), "ESCALATION: JSONL spike"); got != 2 {
+		t.Fatalf("expected failed attempt plus backup-backed retry, got %d entries:\n%s", got, mailData)
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_spike_alert"`) {
+		t.Fatalf("expected pending spike alert to clear after backup-backed retry, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportRetriesPendingAlertWithoutUserDatabases(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	writeNoUserDatabasesDoltStub(t, binDir)
+	writeJsonlExportGCStub(t, binDir)
+
+	if err := os.WriteFile(stateFile, []byte(`{"pending_spike_alert":{"database":"beads","prev_count":100,"current_count":10,"delta":90,"threshold":20}}`+"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if got := strings.Count(string(mailData), "ESCALATION: JSONL spike"); got != 1 {
+		t.Fatalf("expected pending spike alert retry on empty-db run, got %d entries:\n%s", got, mailData)
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_spike_alert"`) {
+		t.Fatalf("expected pending spike alert to clear after retry, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportRetriesMultiplePendingAlertsWithoutUserDatabases(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	writeNoUserDatabasesDoltStub(t, binDir)
+	writeJsonlExportGCStub(t, binDir)
+
+	if err := os.WriteFile(stateFile, []byte(`{"pending_spike_alerts":{"alpha":{"database":"alpha","prev_count":100,"current_count":10,"delta":90,"threshold":20},"beta":{"database":"beta","prev_count":80,"current_count":20,"delta":75,"threshold":20}}}`+"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	mailData, err := os.ReadFile(mailLog)
+	if err != nil {
+		t.Fatalf("ReadFile(mail log): %v", err)
+	}
+	if got := strings.Count(string(mailData), "ESCALATION: JSONL spike"); got != 2 {
+		t.Fatalf("expected both pending spike alerts to retry, got %d entries:\n%s", got, mailData)
+	}
+	if !strings.Contains(string(mailData), "Database: alpha") || !strings.Contains(string(mailData), "Database: beta") {
+		t.Fatalf("expected both pending spike alerts to be delivered, got:\n%s", mailData)
+	}
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	if strings.Contains(string(stateData), `"pending_spike_alert"`) {
+		t.Fatalf("expected all pending spike alerts to clear after retry, got:\n%s", stateData)
+	}
+}
+
+func TestJsonlExportHaltMailFailurePreservesExistingPendingAlerts(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	stateDir := t.TempDir()
+	gcLog := filepath.Join(t.TempDir(), "gc.log")
+	mailLog := filepath.Join(t.TempDir(), "gc-mail.log")
+	archiveRepo := filepath.Join(cityDir, "archive")
+	stateFile := filepath.Join(stateDir, "jsonl-export-state.json")
+
+	initSeedArchive(t, archiveRepo, 100)
+	writeMultiRecordDoltStub(t, binDir, 10)
+	writeJsonlExportGCStubWithMailExitCode(t, binDir, 1)
+
+	if err := os.WriteFile(stateFile, []byte(`{"pending_spike_alert":{"database":"oldbeads","prev_count":90,"current_count":45,"delta":50,"threshold":20}}`+"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(state file): %v", err)
+	}
+
+	env := jsonlExportEnv(t, cityDir, binDir, stateDir, archiveRepo, gcLog, mailLog)
+
+	runScript(t, filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "jsonl-export.sh"), env)
+
+	stateData, err := os.ReadFile(stateFile)
+	if err != nil {
+		t.Fatalf("ReadFile(state file): %v", err)
+	}
+	var state map[string]any
+	if err := json.Unmarshal(stateData, &state); err != nil {
+		t.Fatalf("Unmarshal(state file): %v\n%s", err, stateData)
+	}
+	pendingAlerts, ok := state["pending_spike_alerts"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected pending_spike_alerts map, got:\n%s", stateData)
+	}
+	if _, ok := pendingAlerts["oldbeads"]; !ok {
+		t.Fatalf("expected existing pending alert to survive, got:\n%s", stateData)
+	}
+	if _, ok := pendingAlerts["beads"]; !ok {
+		t.Fatalf("expected new pending alert to be added, got:\n%s", stateData)
+	}
+}
+
+func TestWispCompactReportsNonZeroCounters(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+
+	pastTTL := "2020-01-01T00:00:00Z"
+	withinTTL := time.Now().UTC().Format(time.RFC3339)
+	beadsJSON := fmt.Sprintf(`[
+  {"id":"ga-old-1","status":"closed","ephemeral":true,"updated_at":"%s","comment_count":0,"labels":[]},
+  {"id":"ga-old-2","status":"closed","ephemeral":true,"updated_at":"%s","comment_count":0,"labels":[]},
+  {"id":"ga-stuck","status":"open","ephemeral":true,"updated_at":"%s","comment_count":0,"labels":[]},
+  {"id":"ga-fresh","status":"closed","ephemeral":true,"updated_at":"%s","comment_count":0,"labels":[]}
+]`, pastTTL, pastTTL, pastTTL, withinTTL)
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), fmt.Sprintf(`#!/bin/sh
+printf '%%s\n' "$*" >> "$BD_LOG"
+case "$1 $2" in
+  "list --json")
+    cat <<'JSON'
+%s
+JSON
+    ;;
+esac
+exit 0
+`, beadsJSON))
+
+	env := map[string]string{
+		"BD_LOG":       bdLog,
+		"GC_CITY":      cityDir,
+		"GC_CITY_PATH": cityDir,
+		"PATH":         binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	script := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "wisp-compact.sh")
+	cmd := exec.Command(script)
+	cmd.Env = mergeTestEnv(env)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("%s failed: %v\n%s", filepath.Base(script), err, out)
+	}
+
+	logData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	if !strings.Contains(string(logData), "list --json --all -n 0") {
+		t.Fatalf("bd list call not observed:\n%s", logData)
+	}
+
+	want := "wisp-compact: promoted=1 deleted=2 skipped=1"
+	if !strings.Contains(string(out), want) {
+		t.Fatalf("wisp-compact summary missing or wrong (subshell counter regression?)\nwant substring: %q\ngot output:\n%s", want, out)
+	}
+}
+
+func TestCrossRigDepsReportsNonZeroCounter(t *testing.T) {
+	cityDir := t.TempDir()
+	binDir := t.TempDir()
+	bdLog := filepath.Join(t.TempDir(), "bd.log")
+
+	closedJSON := `[{"id":"ga-closed-1"},{"id":"ga-closed-2"},{"id":"ga-closed-internal"}]`
+	depsForClosed1 := `[{"id":"external:rig-a/ga-dep-1"},{"id":"external:rig-b/ga-dep-2"}]`
+	depsForClosed2 := `[{"id":"external:rig-a/ga-dep-3"},{"id":"external:rig-c/ga-dep-4"}]`
+	depsForClosedInternal := `[{"id":"ga-internal-1"},{"id":"ga-internal-2"}]`
+
+	writeExecutable(t, filepath.Join(binDir, "bd"), fmt.Sprintf(`#!/bin/sh
+printf '%%s\n' "$*" >> "$BD_LOG"
+case "$1" in
+  list)
+    cat <<'JSON'
+%s
+JSON
+    exit 0
+    ;;
+  dep)
+    case "$2 $3" in
+      "list ga-closed-1")
+        cat <<'JSON'
+%s
+JSON
+        exit 0
+        ;;
+      "list ga-closed-2")
+        cat <<'JSON'
+%s
+JSON
+        exit 0
+        ;;
+      "list ga-closed-internal")
+        cat <<'JSON'
+%s
+JSON
+        exit 0
+        ;;
+      "remove "*|"add "*)
+        exit 0
+        ;;
+    esac
+    ;;
+esac
+exit 0
+`, closedJSON, depsForClosed1, depsForClosed2, depsForClosedInternal))
+
+	env := map[string]string{
+		"BD_LOG":       bdLog,
+		"GC_CITY":      cityDir,
+		"GC_CITY_PATH": cityDir,
+		"PATH":         binDir + string(os.PathListSeparator) + os.Getenv("PATH"),
+	}
+
+	script := filepath.Join(exampleDir(), "packs", "maintenance", "assets", "scripts", "cross-rig-deps.sh")
+	cmd := exec.Command(script)
+	cmd.Env = mergeTestEnv(env)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("%s failed: %v\n%s", filepath.Base(script), err, out)
+	}
+
+	logData, err := os.ReadFile(bdLog)
+	if err != nil {
+		t.Fatalf("ReadFile(bd log): %v", err)
+	}
+	for _, want := range []string{
+		"dep list ga-closed-1",
+		"dep list ga-closed-2",
+		"dep list ga-closed-internal",
+	} {
+		if !strings.Contains(string(logData), want) {
+			t.Fatalf("bd dep list call %q not observed:\n%s", want, logData)
+		}
+	}
+	if strings.Contains(string(logData), `dep remove "" `) || strings.Contains(string(logData), "dep remove  ") {
+		t.Fatalf("bogus empty-dep_id call observed (empty-filter guard regression?):\n%s", logData)
+	}
+
+	want := "cross-rig-deps: resolved 4 cross-rig dependencies"
+	if !strings.Contains(string(out), want) {
+		t.Fatalf("cross-rig-deps summary missing or wrong (subshell counter regression?)\nwant substring: %q\ngot output:\n%s\nbd log:\n%s", want, out, logData)
 	}
-	return env
 }
diff --git a/examples/gastown/operational_awareness_test.go b/examples/gastown/operational_awareness_test.go
new file mode 100644
index 0000000000..88d43b5500
--- /dev/null
+++ b/examples/gastown/operational_awareness_test.go
@@ -0,0 +1,98 @@
+// Package gastown_test asserts the operational-awareness template
+// fragment ships a non-fatal Dolt diagnostic protocol. The fragment
+// is rendered into agent prompts (gc prime, boot context, deacon
+// patrol), so its prose is operationally load-bearing — false claims
+// like "safe — does not kill the process" lead operators to destroy
+// the very evidence they are trying to capture (issue #1485).
+package gastown_test
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// killQUITRe matches `kill -QUIT` as an executable invocation:
+// anchored at start-of-line (with optional leading whitespace) and
+// followed by the QUIT signal across the common shape variations —
+// `kill -QUIT`, `kill  -QUIT` (multi-space), `kill\t-QUIT` (tab), and
+// `kill \\\n-QUIT` (line continuation). The line anchor matters: an
+// inline backticked mention like `... use \`kill -QUIT\` ...` in
+// markdown prose does NOT begin a line, so it does not match.
+// Combined with stripShellComments, this leaves only active shell
+// statements as match candidates.
+var killQUITRe = regexp.MustCompile(`(?m)^[ \t]*kill[ \t\\]+\n?[ \t]*-QUIT(\s|$)`)
+
+// operationalAwarenessFragment is the on-disk path to the template
+// fragment that ships into every gastown agent prompt via the
+// city's global_fragments list.
+const operationalAwarenessFragment = "packs/gastown/template-fragments/operational-awareness.template.md"
+
+// stripShellComments removes lines whose first non-whitespace
+// character is `#`, so commented-out documentation (like the
+// SIGQUIT-escalation example) doesn't trip content fences that
+// scan for active recommendations.
+func stripShellComments(s string) string {
+	var b strings.Builder
+	for _, line := range strings.Split(s, "\n") {
+		if strings.HasPrefix(strings.TrimSpace(line), "#") {
+			continue
+		}
+		b.WriteString(line)
+		b.WriteByte('\n')
+	}
+	return b.String()
+}
+
+// TestOperationalAwarenessFragmentNonFatalDiagnostic is the regression
+// fence for issue #1485. The fragment must (1) not actively recommend
+// `kill -QUIT` (fatal to Dolt's Go runtime), (2) document at least one
+// non-fatal in-process diagnostic as an active step, and (3) not carry
+// the original "safe — does not kill the process" claim.
+func TestOperationalAwarenessFragmentNonFatalDiagnostic(t *testing.T) {
+	path := filepath.Join(exampleDir(), operationalAwarenessFragment)
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", operationalAwarenessFragment, err)
+	}
+	body := string(data)
+	active := stripShellComments(body)
+
+	t.Run("no_active_kill_QUIT", func(t *testing.T) {
+		if m := killQUITRe.FindString(active); m != "" {
+			t.Errorf("%s contains an active `kill -QUIT` step (match: %q).\n"+
+				"SIGQUIT is fatal to Dolt's Go runtime — it dumps goroutines AND exits. "+
+				"This destroys the evidence the diagnostic protocol claims to preserve. "+
+				"Use a non-fatal in-process diagnostic (e.g. `gc dolt sql -q \"SHOW FULL PROCESSLIST\"`) "+
+				"as the default; document SIGQUIT only as a commented-out last-resort escalation. "+
+				"See issue #1485.", operationalAwarenessFragment, m)
+		}
+	})
+
+	t.Run("documents_non_fatal_default", func(t *testing.T) {
+		wantOne := []string{
+			"SHOW FULL PROCESSLIST",
+			"gc dolt sql -q",
+		}
+		for _, w := range wantOne {
+			if strings.Contains(active, w) {
+				return
+			}
+		}
+		t.Errorf("%s does not document any non-fatal Dolt diagnostic "+
+			"as an active step; expected at least one of %v outside "+
+			"shell comments. Without an active non-fatal default, "+
+			"operators fall back to fatal restarts. See issue #1485.",
+			operationalAwarenessFragment, wantOne)
+	})
+
+	t.Run("no_false_safe_claim", func(t *testing.T) {
+		if strings.Contains(body, "safe — does not kill the process") {
+			t.Errorf("%s still contains the false-safe SIGQUIT claim "+
+				"(\"safe — does not kill the process\"). SIGQUIT terminates "+
+				"the Dolt server. See issue #1485.", operationalAwarenessFragment)
+		}
+	})
+}
diff --git a/examples/gastown/pack.toml b/examples/gastown/pack.toml
new file mode 100644
index 0000000000..6de8bcb16f
--- /dev/null
+++ b/examples/gastown/pack.toml
@@ -0,0 +1,11 @@
+# Gas Town — city pack definition.
+#
+# Owns the portable configuration: imports and pack identity.
+# city.toml carries deployment-local settings (rigs, daemon, beads).
+
+[pack]
+name = "gastown"
+schema = 2
+
+[imports.gastown]
+source = "packs/gastown"
diff --git a/examples/gastown/packs/gastown/agents/boot/prompt.template.md b/examples/gastown/packs/gastown/agents/boot/prompt.template.md
index 7c15d8284a..9e6f1e1531 100644
--- a/examples/gastown/packs/gastown/agents/boot/prompt.template.md
+++ b/examples/gastown/packs/gastown/agents/boot/prompt.template.md
@@ -36,7 +36,7 @@ Narrow scope makes restarts cheap. The controller manages your lifecycle.
 ### Step 1: Check if deacon session exists
 
 ```bash
-{{ cmd }} agent peek deacon 1
+{{ cmd }} session peek deacon --lines 1
 ```
 
 If the deacon session doesn't exist: do nothing and exit. The controller
@@ -46,13 +46,13 @@ detects dead agents and restarts them — that's its job, not yours.
 
 ```bash
 # Recent pane output — is the deacon actively working?
-{{ cmd }} agent peek deacon 30
+{{ cmd }} session peek deacon --lines 30
 
 # Deacon's current patrol wisp — how fresh is it?
 gc bd list --assignee=deacon --status=in_progress --json --limit=5
 
 # Does the deacon have unread mail? (may explain idle state)
-gc mail inbox --address=deacon --json 2>/dev/null | jq length
+gc mail count deacon 2>/dev/null
 ```
 
 Read the wisp timestamps and pane output. Build a picture:
@@ -83,7 +83,7 @@ Use judgment — there are no hardcoded thresholds. Consider:
 
 **Possibly stuck (stale wisp, no activity, but ambiguous):** Nudge:
 ```bash
-{{ cmd }} nudge deacon "Boot check: are you making progress?"
+{{ cmd }} session nudge deacon "Boot check: are you making progress?"
 ```
 Drain-ack and exit. Next Boot tick will re-evaluate.
 
@@ -121,11 +121,11 @@ up your session and spawns you again next tick.
 
 | Want to... | Correct command |
 |------------|----------------|
-| View deacon output | `{{ cmd }} agent peek deacon 30` |
+| View deacon output | `{{ cmd }} session peek deacon --lines 30` |
 | Check deacon work | `gc bd list --assignee=deacon --status=in_progress --json` |
-| Nudge deacon | `{{ cmd }} nudge deacon "message"` |
+| Nudge deacon | `{{ cmd }} session nudge deacon "message"` |
 | File stuck warrant | `gc bd create --type=warrant --label=pool:dog --metadata '{...}'` |
-| Check agents | `{{ cmd }} agent list` |
+| Check active sessions | `{{ cmd }} session list` |
 
 Working directory: {{ .WorkDir }}
 Formula: none (ephemeral triage, no patrol loop)
diff --git a/examples/gastown/packs/gastown/agents/deacon/prompt.template.md b/examples/gastown/packs/gastown/agents/deacon/prompt.template.md
index 975899dc2b..6593266be7 100644
--- a/examples/gastown/packs/gastown/agents/deacon/prompt.template.md
+++ b/examples/gastown/packs/gastown/agents/deacon/prompt.template.md
@@ -65,7 +65,7 @@ gc bd list --assignee="$GC_ALIAS" --status=in_progress
 gc mail inbox
 
 # Step 3: Still nothing? Create patrol wisp (root-only — no child step beads)
-NEW_WISP=$(gc bd mol wisp mol-deacon-patrol --root-only --json | jq -r '.new_epic_id')
+NEW_WISP=$(gc bd mol wisp mol-deacon-patrol --root-only --var binding_prefix={{ .BindingPrefix }} --json | jq -r '.new_epic_id')
 gc bd update "$NEW_WISP" --assignee="$GC_ALIAS"
 
 # Step 4: Execute — read formula steps and work through them in order
@@ -122,7 +122,7 @@ gc bd create --type=warrant \
 ```bash
 gc mail send mayor/ -s "Subject" -m "Message"       # Escalate to mayor
 gc mail send <rig>/witness -s "Subject" -m "..."     # Witness questions
-gc nudge <target> "message"                          # Nudge an agent
+gc session nudge <target> "message"                  # Nudge an agent
 gc session peek <target> 50                              # View agent output
 ```
 
@@ -155,7 +155,7 @@ Individual stuck agents don't need escalation — the warrant system handles the
 
 | Want to... | Correct command |
 |------------|----------------|
-| Pour next wisp | `gc bd mol wisp mol-deacon-patrol --root-only` |
+| Pour next wisp | `gc bd mol wisp mol-deacon-patrol --root-only --var binding_prefix={{ .BindingPrefix }}` |
 | Context exhaustion | `gc runtime request-restart` |
 | Request target restart | `gc session kill <target>` |
 | Check gates | `gc bd gate check --type=timer --escalate` |
diff --git a/examples/gastown/packs/gastown/agents/mayor/prompt.template.md b/examples/gastown/packs/gastown/agents/mayor/prompt.template.md
index a92b8f173f..7a95b84159 100644
--- a/examples/gastown/packs/gastown/agents/mayor/prompt.template.md
+++ b/examples/gastown/packs/gastown/agents/mayor/prompt.template.md
@@ -21,7 +21,9 @@ When you file a bead, default to immediately dispatching it to a polecat:
 
 ```bash
 gc bd create "Fix the auth timeout bug" -t task --json   # file it
-gc bd update <bead-id> --set-metadata gc.routed_to=<rig>/polecat  # dispatch to polecat pool (pool reconciler picks up routed metadata)
+TARGET_RIG="${GC_RIG:-}"  # set to the target rig, or leave empty in an HQ-only city
+POLECAT_TARGET="${TARGET_RIG:+$TARGET_RIG/}{{ .BindingPrefix }}polecat"
+gc bd update <bead-id> --set-metadata gc.routed_to="$POLECAT_TARGET"  # dispatch to polecat pool (pool reconciler picks up routed metadata)
 ```
 
 **Why this is the default:**
@@ -142,7 +144,7 @@ Wrong. The issue is about beads code, so it goes in the beads rig.
 - **Strategic decisions**: Architecture, priorities, integration planning
 
 **NOT your job**: Per-worker cleanup, session killing, routine nudging (Witness handles that)
-**Exception**: If refinery/witness is stuck, use `{{ cmd }} nudge refinery "Process MQ"`
+**Exception**: If refinery/witness is stuck, use `{{ cmd }} session nudge refinery "Process MQ"`
 
 ## Rig Wake/Sleep Protocol
 
@@ -199,12 +201,12 @@ gh pr create --repo $(git remote get-url origin | sed 's/.*github.com[:/]\(.*\)\
 {{ cmd }} mail inbox                                  # Check your messages
 {{ cmd }} mail read <id>                              # Read a specific message
 {{ cmd }} mail send <addr> -s "Subject" -m "Message"  # Send mail
-{{ cmd }} nudge <target> "message"                    # Wake an agent
-{{ cmd }} agent list                                  # List all agents
+{{ cmd }} session nudge <target> "message"            # Wake an agent
+{{ cmd }} session list                                # List active sessions
 {{ cmd }} rig list                                    # List all rigs
 ```
 
-**ALWAYS use gc nudge, NEVER tmux send-keys** (drops Enter key)
+**ALWAYS use `gc session nudge`, NEVER `tmux send-keys`** (drops Enter key)
 
 ---
 
@@ -215,7 +217,7 @@ gh pr create --repo $(git remote get-url origin | sed 's/.*github.com[:/]\(.*\)\
 | Want to... | Correct command | Common mistake |
 |------------|----------------|----------------|
 | Dispatch work to polecat | `gc bd update <bead> --label=pool:<rig>/polecat` | ~~gc polecat spawn~~ / ~~--assignee=<rig>/polecat~~ |
-| Drain stuck polecat | `{{ cmd }} agent drain <name>` | ~~gc polecat kill~~ (not a command) |
+| Drain stuck polecat | `{{ cmd }} runtime drain <name>` | ~~gc polecat kill~~ (not a command) |
 | Pause rig (daemon won't restart) | `{{ cmd }} rig suspend <rig>` | ~~gc rig stop~~ (daemon will restart it) |
 | Re-enable suspended rig | `{{ cmd }} rig resume <rig>` | |
 | Create convoy for batch work | `{{ cmd }} convoy create "name" <issues>` | |
diff --git a/examples/gastown/packs/gastown/agents/polecat/prompt.template.md b/examples/gastown/packs/gastown/agents/polecat/prompt.template.md
index 4c665a3e9b..392426b609 100644
--- a/examples/gastown/packs/gastown/agents/polecat/prompt.template.md
+++ b/examples/gastown/packs/gastown/agents/polecat/prompt.template.md
@@ -100,7 +100,7 @@ gc mail inbox
 When nudged after dispatch, run `gc hook` or `{{ .WorkQuery }}`. That lookup
 checks assigned work first (session bead ID, runtime session name, then
 alias) and only falls through to unassigned pool work routed to
-`{{ .RigName }}/polecat`.
+`${GC_RIG:+$GC_RIG/}{{ .BindingPrefix }}polecat`.
 
 **Hook/work query -> Read formula steps -> Follow in order -> done sequence.**
 
@@ -153,7 +153,8 @@ When blocked, you MUST escalate. Do NOT wait for human input.
 **How:**
 ```bash
 # Blocking issues
-gc mail send {{ .RigName }}/witness -s "ESCALATION: Brief description [HIGH]" -m "Details"
+WITNESS_TARGET="${GC_RIG:+$GC_RIG/}witness"
+gc mail send "$WITNESS_TARGET" -s "ESCALATION: Brief description [HIGH]" -m "Details"
 
 # Cross-rig or strategic
 gc mail send mayor/ -s "BLOCKED: <topic>" -m "Context"
@@ -166,8 +167,9 @@ After escalating: continue if possible, otherwise `gc bd update <bead> --status=
 ## Communication
 
 ```bash
-gc nudge {{ .RigName }}/witness "Quick question about bead status"   # Default: nudge
-gc mail send {{ .RigName }}/witness -s "HELP: Blocked on X" -m "..."  # Escalation: mail
+WITNESS_TARGET="${GC_RIG:+$GC_RIG/}witness"
+gc session nudge "$WITNESS_TARGET" "Quick question about bead status" # Default: nudge
+gc mail send "$WITNESS_TARGET" -s "HELP: Blocked on X" -m "..."       # Escalation: mail
 gc mail send mayor/ -s "BLOCKED: Need coordination" -m "..."          # Cross-rig: mail
 ```
 
@@ -176,7 +178,7 @@ gc mail send mayor/ -s "BLOCKED: Need coordination" -m "..."          # Cross-ri
 **Your mail budget is 0-1 messages per session.**
 
 - **Escalation**: Mail to witness as HELP — this is the ONE allowed mail use
-- **Everything else**: Use `gc nudge` — ephemeral, zero Dolt overhead
+- **Everything else**: Use `gc session nudge` — ephemeral, zero Dolt overhead
 - **Completion**: The done sequence handles notification — do NOT mail "I'm done"
 - **Status updates**: If asked for status, respond via nudge, not mail
 
@@ -199,7 +201,8 @@ gc bd update <work-bead> \
   --set-metadata branch=$(git branch --show-current) \
   --set-metadata target={{ .DefaultBranch }} \
   --notes "Implemented: <brief summary>"
-gc bd update <work-bead> --status=open --assignee={{ .RigName }}/refinery --set-metadata gc.routed_to={{ .RigName }}/refinery
+REFINERY_TARGET="${GC_RIG:+$GC_RIG/}{{ .BindingPrefix }}refinery"
+gc bd update <work-bead> --status=open --assignee="$REFINERY_TARGET" --set-metadata gc.routed_to="$REFINERY_TARGET"
 gc runtime drain-ack
 exit
 ```
@@ -219,7 +222,7 @@ is the "Idle Polecat heresy."
 |------------|----------------|
 | Signal work complete | Done sequence (push, set metadata, reassign, `gc runtime drain-ack`, exit) |
 | Read formula steps | `gc bd show <wisp-id>` (shows formula ref) |
-| Escalate blocker | `gc mail send {{ .RigName }}/witness -s "ESCALATION: desc [HIGH]" -m "..."` |
+| Escalate blocker | `WITNESS_TARGET="${GC_RIG:+$GC_RIG/}witness"; gc mail send "$WITNESS_TARGET" -s "ESCALATION: desc [HIGH]" -m "..."` |
 | Context exhaustion | `gc runtime request-restart` |
 | Handoff to next session | `gc mail send -s "HANDOFF: ..." -m "..."` then `gc runtime drain-ack && exit` |
 
diff --git a/examples/gastown/packs/gastown/agents/refinery/prompt.template.md b/examples/gastown/packs/gastown/agents/refinery/prompt.template.md
index f3bac24fcc..c83341160c 100644
--- a/examples/gastown/packs/gastown/agents/refinery/prompt.template.md
+++ b/examples/gastown/packs/gastown/agents/refinery/prompt.template.md
@@ -53,7 +53,7 @@ Your formula: `mol-refinery-patrol`
 gc bd list --assignee="$GC_ALIAS" --status=in_progress
 
 # If none found, pour one (root-only — no child step beads) and assign it
-WISP=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{ .DefaultBranch }} --json | jq -r '.new_epic_id')
+WISP=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{ .DefaultBranch }} --var rig_name={{ .RigName }} --var binding_prefix={{ .BindingPrefix }} --json | jq -r '.new_epic_id')
 gc bd update "$WISP" --assignee="$GC_ALIAS"
 ```
 
@@ -145,7 +145,7 @@ and then ignored by landing directly to the target branch.
 
 ```bash
 gc mail inbox                                          # Check for messages
-gc nudge {{ .RigName }}/<polecat-name> "Run gc hook; it checks assigned work before routed pool work"
+gc session nudge {{ .RigName }}/<polecat-name> "Run gc hook; it checks assigned work before routed pool work"
 gc mail send mayor/ -s "ESCALATION: ..." -m "..."      # Escalate (mail — must survive)
 ```
 
@@ -161,7 +161,7 @@ work still arrives through bead assignment or pool routing.
 **Your only mail use:** Escalations to Mayor. Everything else is a nudge.
 
 MERGE_FAILED notifications are routine signals — the rejection metadata on
-the bead (`rejection_reason`) is the durable record. Use `gc nudge` to
+the bead (`rejection_reason`) is the durable record. Use `gc session nudge` to
 alert the witness, not `gc mail send`.
 
 ---
@@ -172,7 +172,7 @@ alert the witness, not `gc mail send`.
 
 | Want to... | Correct command |
 |------------|----------------|
-| Pour next wisp | `gc bd mol wisp mol-refinery-patrol --root-only` |
+| Pour next wisp | `gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{ .DefaultBranch }} --var rig_name={{ .RigName }} --var binding_prefix={{ .BindingPrefix }}` |
 | Burn current wisp | `gc bd mol burn <wisp-id> --force` |
 | Find assigned work | `gc bd list --assignee="$GC_ALIAS" --status=open` |
 | Snapshot event position | `gc events --seq` |
diff --git a/examples/gastown/packs/gastown/agents/witness/prompt.template.md b/examples/gastown/packs/gastown/agents/witness/prompt.template.md
index 10ff296121..f43a516f7d 100644
--- a/examples/gastown/packs/gastown/agents/witness/prompt.template.md
+++ b/examples/gastown/packs/gastown/agents/witness/prompt.template.md
@@ -79,9 +79,10 @@ The drain protocol does NOT release beads. Crash recovery resumes work
 via formula step resumption. But when an agent genuinely won't come back, its
 beads sit assigned forever unless the witness recovers them.
 
-**Detection:** Compare bead assignees against `gc session list`. If the
-assigned agent is neither running nor a desired agent that the controller
-will restart -> orphaned.
+**Detection:** Follow the `mol-witness-patrol` `recover-orphaned-beads` step.
+It is the source of truth for orphan classification. Resolve bead assignees by
+exact session identity from `gc session list --state=all --json` and session
+bead metadata; do not use template-pattern or fixed-prefix matching.
 
 **Recovery follows the canonical chain.** Read `metadata.work_dir` and
 `metadata.branch` from the bead — polecats record both early in
@@ -108,9 +109,11 @@ Mail the mayor only when the recovery is unexpected or concerning:
 
 Routine recoveries from pool resizing or config changes don't need mayor mail.
 
-**Do NOT recover beads for agents that are simply restarting.** The
-controller restarts crashed agents and mol resumption handles the
-worktree. Give it time.
+**Do NOT recover beads for sessions that are still controller- or
+operator-owned.** Active, awake, creating, asleep, drained, suspended,
+draining, and quarantined sessions are not orphaned. Only recover pool work
+whose resolved owner is archived, closed, or absent after exact identity
+lookup.
 
 ---
 
@@ -181,8 +184,8 @@ re-reads formula steps and resumes from context.
 ```bash
 gc mail send mayor/ -s "Subject" -m "Message"              # Escalate to mayor
 gc mail send {{ .RigName }}/refinery -s "Subject" -m "..."  # Refinery questions
-gc nudge {{ .RigName }}/<polecat-name> "Run gc hook; it checks assigned work before routed pool work"
-gc session peek {{ .RigName }}/<polecat-name> 50             # View polecat output
+gc session nudge {{ .RigName }}/<polecat-name> "Run gc hook; it checks assigned work before routed pool work"
+gc session peek {{ .RigName }}/<polecat-name> --lines 50     # View polecat output
 ```
 
 Use the concrete polecat name from `gc status` or `gc session list`;
diff --git a/examples/gastown/packs/gastown/assets/prompts/crew.template.md b/examples/gastown/packs/gastown/assets/prompts/crew.template.md
index 83d5287240..bc1ea65b6a 100644
--- a/examples/gastown/packs/gastown/assets/prompts/crew.template.md
+++ b/examples/gastown/packs/gastown/assets/prompts/crew.template.md
@@ -193,22 +193,22 @@ ONE exception where branches are created. But the rule still applies:
 - Submit to that rig's Refinery immediately when done
 - Never leave cross-rig work sitting on an unmerged branch
 
-## gc nudge: Waking Agents
+## gc session nudge: Waking Agents
 
-`{{ cmd }} nudge` is the **core mechanism for inter-agent communication**. It sends a message
+`{{ cmd }} session nudge` is the **core mechanism for inter-agent communication**. It sends a message
 directly to another agent's Claude Code session via tmux.
 
 **When to use nudge vs mail:**
 | Use Case | Tool | Why |
 |----------|------|-----|
-| Wake a sleeping agent | `{{ cmd }} nudge` | Immediate delivery to their session |
+| Wake a sleeping agent | `{{ cmd }} session nudge` | Immediate delivery to their session |
 | Send task for later | `{{ cmd }} mail send` | Queued, they'll see it on next check |
-| Both: assign + wake | `{{ cmd }} mail send` then `{{ cmd }} nudge` | Mail carries payload, nudge wakes them |
+| Both: assign + wake | `{{ cmd }} mail send` then `{{ cmd }} session nudge` | Mail carries payload, nudge wakes them |
 
 **Common patterns:**
 ```bash
-gc nudge {{ .RigName }}/crew/alice "Check your mail - PR review waiting"
-gc nudge {{ .RigName }}/<polecat-name> "Run gc hook; it checks assigned work before routed pool work"
+gc session nudge {{ .RigName }}/crew/alice "Check your mail - PR review waiting"
+gc session nudge {{ .RigName }}/<polecat-name> "Run gc hook; it checks assigned work before routed pool work"
 gc mail send {{ .RigName }}/alice -s "Urgent" -m "..." --notify
 ```
 
@@ -237,8 +237,8 @@ EOF
 - Forgetting the address format: `<rig>/<agent>` for rig agents, `mayor/` for city agents
 - Unquoted multi-line text (shell eats newlines) — use `"$(cat <<'EOF' ... EOF)"` pattern
 
-**Important:** `{{ cmd }} nudge` is the ONLY reliable way to send text to Claude sessions.
-Raw `tmux send-keys` is unreliable. Always use `{{ cmd }} nudge` for agent-to-agent communication.
+**Important:** `{{ cmd }} session nudge` is the ONLY reliable way to send text to Claude sessions.
+Raw `tmux send-keys` is unreliable. Always use `{{ cmd }} session nudge` for agent-to-agent communication.
 
 ### Nudge Delivery Modes
 
@@ -400,7 +400,7 @@ See `{{ .CityRoot }}/docs/AGENT-ERGONOMICS.md` for the full philosophy.
 | Want to... | Correct command | Common mistake |
 |------------|----------------|----------------|
 | Dispatch work to polecat | `gc bd update <bead> --label=pool:<rig>/polecat` | ~~gc polecat spawn~~ / ~~--assignee=<rig>/polecat~~ |
-| Stop my session | `{{ cmd }} agent drain {{ basename .AgentName }}` | ~~gc rig stop~~ (stops rig agents, not crew) |
+| Stop my session | `{{ cmd }} runtime drain {{ basename .AgentName }}` | ~~gc rig stop~~ (stops rig agents, not crew) |
 | Pause rig (daemon won't restart) | `{{ cmd }} rig suspend <rig>` | ~~gc rig stop~~ (daemon will restart it) |
 | Re-enable suspended rig | `{{ cmd }} rig resume <rig>` | |
 
diff --git a/examples/gastown/packs/gastown/assets/scripts/bind-key.sh b/examples/gastown/packs/gastown/assets/scripts/bind-key.sh
index 9df584c146..33caaf42db 100755
--- a/examples/gastown/packs/gastown/assets/scripts/bind-key.sh
+++ b/examples/gastown/packs/gastown/assets/scripts/bind-key.sh
@@ -1,65 +1,32 @@
 #!/bin/sh
-# bind-key.sh — idempotent tmux keybinding with fallback preservation.
-# Usage: bind-key.sh <key> <gc-command> [guard-pattern]
+# bind-key.sh — install a tmux prefix keybinding directly.
+# Usage: bind-key.sh <key> <command>
 #
-# If the key already has a GC binding (if-shell + gc), does nothing.
-# Otherwise captures the existing binding as fallback, then installs
-# an if-shell binding that runs <gc-command> in GC sessions and the
-# original binding in non-GC sessions.
+# Per-city tmux socket isolation (GC_TMUX_SOCKET, set by the controller
+# in internal/runtime/tmux/adapter.go) makes every session on the socket
+# a GC session. There is no non-GC fallback path to preserve, so the
+# binding installs <command> directly without if-shell wrapping.
 #
-# With per-city socket isolation, all sessions on the socket are GC
-# sessions. The guard checks for the GC_AGENT env var (set by the
-# controller on every agent session) as a reliable indicator.
+# tmux's bind-key naturally overwrites existing bindings; calling this
+# script twice with the same args is a no-op at the tmux level. The
+# early-exit on already-matching binding is an optimization to skip the
+# tmux call.
 set -e
 
-# Socket-aware tmux command (uses GC_TMUX_SOCKET when set).
-gcmux() { tmux ${GC_TMUX_SOCKET:+-L "$GC_TMUX_SOCKET"} "$@"; }
-
 key="$1"
-gc_command="$2"
-guard_pattern="${3:-GC_AGENT}"
+command="$2"
 
-[ -z "$key" ] || [ -z "$gc_command" ] && exit 1
+[ -z "$key" ] || [ -z "$command" ] && exit 1
+
+# Socket-aware tmux command (uses GC_TMUX_SOCKET when set).
+gcmux() { tmux ${GC_TMUX_SOCKET:+-L "$GC_TMUX_SOCKET"} "$@"; }
 
-# Check if already a GC binding (idempotent).
+# Skip the bind-key call if the binding already contains the requested
+# command. Fixed-string substring match is robust against tmux's quoting
+# variations across versions.
 existing=$(gcmux list-keys -T prefix "$key" 2>/dev/null || true)
-if printf '%s' "$existing" | grep -q 'if-shell' && printf '%s' "$existing" | grep -q 'gc '; then
+if printf '%s' "$existing" | grep -qF "$command"; then
     exit 0
 fi
 
-# Parse existing binding command as fallback.
-# tmux list-keys format: bind-key [-r] -T <table> <key> <command> [args...]
-fallback=""
-if [ -n "$existing" ]; then
-    # Skip past "-T prefix <key>" to get the command portion.
-    # Handle optional -r flag.
-    fallback=$(printf '%s' "$existing" | head -1 | awk '
-    {
-        i = 1
-        # skip "bind-key"
-        if ($i == "bind-key") i++
-        # skip optional -r
-        if ($i == "-r") i++
-        # skip -T <table> <key>
-        if ($i == "-T") i += 3
-        # rest is the command
-        cmd = ""
-        for (; i <= NF; i++) cmd = cmd (cmd ? " " : "") $i
-        print cmd
-    }')
-fi
-
-# Default fallbacks for common keys.
-if [ -z "$fallback" ]; then
-    case "$key" in
-        n) fallback="next-window" ;;
-        p) fallback="previous-window" ;;
-        *) fallback="command-prompt" ;;
-    esac
-fi
-
-# Install the if-shell binding.
-# Guard checks for GC_AGENT env var in the session environment,
-# which the controller sets on every agent session at startup.
-guard="tmux ${GC_TMUX_SOCKET:+-L $GC_TMUX_SOCKET} show-environment -t '#{session_name}' ${guard_pattern} >/dev/null 2>&1"
-gcmux bind-key -T prefix "$key" if-shell "$guard" "$gc_command" "$fallback"
+gcmux bind-key -T prefix "$key" "$command"
diff --git a/examples/gastown/packs/gastown/assets/scripts/tmux-keybindings.sh b/examples/gastown/packs/gastown/assets/scripts/tmux-keybindings.sh
index 343e124796..5fd61172a4 100755
--- a/examples/gastown/packs/gastown/assets/scripts/tmux-keybindings.sh
+++ b/examples/gastown/packs/gastown/assets/scripts/tmux-keybindings.sh
@@ -13,22 +13,10 @@ gcmux() { tmux ${GC_TMUX_SOCKET:+-L "$GC_TMUX_SOCKET"} "$@"; }
 
 # ── Mail click binding (root table: left-click on status-right) ───────
 # Shows unread mail preview in a popup when clicking the status-right area.
-guard="tmux ${GC_TMUX_SOCKET:+-L $GC_TMUX_SOCKET} show-environment -t '#{session_name}' GC_AGENT >/dev/null 2>&1"
+# Per-city socket isolation makes every session on this socket a GC
+# session, so we install the popup directly without an if-shell guard.
+mail_popup="display-popup -E -w 60 -h 15 'gc mail peek || echo No unread mail'"
 existing=$(gcmux list-keys -T root MouseDown1StatusRight 2>/dev/null || true)
-if ! printf '%s' "$existing" | grep -q 'gc mail'; then
-    fallback=""
-    if [ -n "$existing" ]; then
-        fallback=$(printf '%s' "$existing" | head -1 | awk '
-        {
-            i = 1; if ($i == "bind-key") i++; if ($i == "-r") i++
-            if ($i == "-T") i += 3
-            cmd = ""; for (; i <= NF; i++) cmd = cmd (cmd ? " " : "") $i
-            print cmd
-        }')
-    fi
-    [ -z "$fallback" ] && fallback=":"
-    gcmux bind-key -T root MouseDown1StatusRight \
-        if-shell "$guard" \
-        "display-popup -E -w 60 -h 15 'gc mail peek || echo No unread mail'" \
-        "$fallback"
+if ! printf '%s' "$existing" | grep -qF "$mail_popup"; then
+    gcmux bind-key -T root MouseDown1StatusRight "$mail_popup"
 fi
diff --git a/examples/gastown/packs/gastown/formulas/mol-deacon-patrol.toml b/examples/gastown/packs/gastown/formulas/mol-deacon-patrol.toml
index 8fb50804d1..ea72eaf3f9 100644
--- a/examples/gastown/packs/gastown/formulas/mol-deacon-patrol.toml
+++ b/examples/gastown/packs/gastown/formulas/mol-deacon-patrol.toml
@@ -1,7 +1,7 @@
 description = """
 Deacon patrol loop. Poured as a root-only wisp on startup:
 
-  gc bd mol wisp mol-deacon-patrol --root-only
+  gc bd mol wisp mol-deacon-patrol --root-only --var binding_prefix={{binding_prefix}}
   gc bd update $WISP --assignee=$GC_AGENT
 
 Each wisp is ONE iteration: check inbox, run town-wide coordination
@@ -162,7 +162,7 @@ something is stuck. This is exactly why an LLM does it, not Go code.
 gc bd create --type=warrant \
   --title="Stuck: <rig>/<role>" \
   --metadata '{"target":"<session>","reason":"<reason>","requester":"deacon"}' \
-  --set-metadata gc.routed_to=dog
+  --set-metadata gc.routed_to={{binding_prefix}}dog
 ```
 
 The dog pool runs `mol-shutdown-dance` for due process.
@@ -186,7 +186,7 @@ wisp timestamps.
 
 **Step 1: Find active utility agent work:**
 ```bash
-gc bd list --status=in_progress --metadata-field gc.routed_to=dog --json --limit=0
+gc bd list --status=in_progress --metadata-field gc.routed_to={{binding_prefix}}dog --json --limit=0
 ```
 
 **Step 2: For each, assess progress:**
@@ -202,7 +202,7 @@ No hardcoded thresholds. Use judgment.
 gc bd create --type=warrant \
   --title="Stuck dog: <agent>" \
   --metadata '{"target":"<session>","reason":"<reason>","requester":"deacon"}' \
-  --set-metadata gc.routed_to=dog
+  --set-metadata gc.routed_to={{binding_prefix}}dog
 ```
 
 A different dog from the pool picks up the warrant and runs the
@@ -265,14 +265,14 @@ The compactor dog (`mol-dog-compactor`) may have failed. Log for awareness.
 If the compactor order is configured, it will self-dispatch. Otherwise
 nudge the dog pool:
 ```bash
-gc nudge dog/ "Compactor needed: <db_name> has <count> commits"
+gc session nudge dog/ "Compactor needed: <db_name> has <count> commits"
 ```
 
 **Stale backups:**
 The backup dog (`mol-dog-backup`) may have failed. Same pattern — log and
 nudge if order hasn't self-healed:
 ```bash
-gc nudge dog/ "Backup needed: dolt backup is <age> old"
+gc session nudge dog/ "Backup needed: dolt backup is <age> old"
 ```
 
 **Zombie processes:**
@@ -340,7 +340,7 @@ Handle any urgent messages that arrived during patrol. Archive the rest.
 
 **3. Pour next iteration BEFORE burning:**
 ```bash
-NEXT=$(gc bd mol wisp mol-deacon-patrol --root-only --json | jq -r '.new_epic_id')
+NEXT=$(gc bd mol wisp mol-deacon-patrol --root-only --var binding_prefix={{binding_prefix}} --json | jq -r '.new_epic_id')
 gc bd update "$NEXT" --assignee=$GC_AGENT
 ```
 
diff --git a/examples/gastown/packs/gastown/formulas/mol-digest-generate.toml b/examples/gastown/packs/gastown/formulas/mol-digest-generate.toml
index f3e4c3eeef..32988bedea 100644
--- a/examples/gastown/packs/gastown/formulas/mol-digest-generate.toml
+++ b/examples/gastown/packs/gastown/formulas/mol-digest-generate.toml
@@ -10,7 +10,7 @@ in `city.toml` under `[formulas]`:
 formula = "mol-digest-generate"
 trigger = "cooldown"
 interval = "24h"
-pool = "dog"
+pool = "gastown.dog"
 ```
 
 The deacon checks if enough time has passed since the last run
@@ -102,9 +102,9 @@ gc bd list --label=incident --created-after=$SINCE --json
 
 **3. Collect town-level data:**
 
-a) **Agent events:**
+a) **Session lifecycle events:**
 ```bash
-gc events --since=$SINCE --type=agent.started,agent.stopped,agent.crashed --json
+gc events --since=$SINCE --type=session.woke,session.stopped,session.crashed --json
 ```
 
 b) **Escalations:**
diff --git a/examples/gastown/packs/gastown/formulas/mol-idea-to-plan.toml b/examples/gastown/packs/gastown/formulas/mol-idea-to-plan.toml
index d5ca9e2257..8893f33e95 100644
--- a/examples/gastown/packs/gastown/formulas/mol-idea-to-plan.toml
+++ b/examples/gastown/packs/gastown/formulas/mol-idea-to-plan.toml
@@ -44,7 +44,7 @@ description = "Additional context: constraints, prior decisions, related code, l
 default = ""
 
 [vars.review_target]
-description = "Agent or pool that should execute review legs (for example, my-rig/polecat). Empty means derive $GC_RIG/polecat."
+description = "Agent or pool that should execute review legs (for example, my-rig/{{binding_prefix}}polecat). Empty means derive $GC_RIG/{{binding_prefix}}polecat."
 default = ""
 
 [vars.review_formula]
@@ -78,9 +78,9 @@ cd "$REPO_ROOT"
 REVIEW_TARGET="{{review_target}}"
 if [ -z "$REVIEW_TARGET" ]; then
   if [ -n "$GC_RIG" ]; then
-    REVIEW_TARGET="$GC_RIG/polecat"
+    REVIEW_TARGET="$GC_RIG/{{binding_prefix}}polecat"
   else
-    echo "Pass --var review_target=<rig>/polecat when not running inside a rig session."
+    echo "Pass --var review_target=<rig>/{{binding_prefix}}polecat when not running inside a rig session."
   fi
 fi
 COORDINATOR="$GC_AGENT"
diff --git a/examples/gastown/packs/gastown/formulas/mol-polecat-work.toml b/examples/gastown/packs/gastown/formulas/mol-polecat-work.toml
index afcbc722af..2b8e9f6e39 100644
--- a/examples/gastown/packs/gastown/formulas/mol-polecat-work.toml
+++ b/examples/gastown/packs/gastown/formulas/mol-polecat-work.toml
@@ -33,7 +33,7 @@ refinery. Resume the existing branch — don't redo all the work.
 | Unsure what to do | Mail Witness, don't guess |"""
 formula = "mol-polecat-work"
 extends = ["mol-polecat-base"]
-version = 8
+version = 9
 
 [[steps]]
 id = "workspace-setup"
@@ -204,9 +204,16 @@ the PR is open and matches the branch, base, and origin repository.
 
 **5. Reassign to refinery:**
 ```bash
-gc bd update {{issue}} --status=open --assignee=<rig>/refinery --set-metadata gc.routed_to=<rig>/refinery
+REFINERY_TARGET="${GC_RIG:+$GC_RIG/}{{binding_prefix}}refinery"
+gc bd update {{issue}} --status=open --assignee="$REFINERY_TARGET" --set-metadata gc.routed_to="$REFINERY_TARGET"
 ```
 
+`${GC_RIG:+$GC_RIG/}{{binding_prefix}}refinery` resolves to
+`$GC_RIG/{{binding_prefix}}refinery` when running inside a rig session,
+or `{{binding_prefix}}refinery` when running in an HQ-only city where
+the workspace is the rig. Writing a rendered empty rig prefix produces
+`/{{binding_prefix}}refinery` and strands beads outside the refinery pool.
+
 Update both `assignee` AND `gc.routed_to` so the reconciler stops
 counting this bead for the polecat pool and starts counting it for
 the refinery pool. Without updating `gc.routed_to`, the reconciler
diff --git a/examples/gastown/packs/gastown/formulas/mol-refinery-patrol.toml b/examples/gastown/packs/gastown/formulas/mol-refinery-patrol.toml
index d6a858dd15..490d704b08 100644
--- a/examples/gastown/packs/gastown/formulas/mol-refinery-patrol.toml
+++ b/examples/gastown/packs/gastown/formulas/mol-refinery-patrol.toml
@@ -1,7 +1,7 @@
 description = """
 Refinery patrol loop. Poured as a root-only wisp on startup:
 
-  gc bd mol wisp mol-refinery-patrol --root-only
+  gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{target_branch}} --var rig_name={{rig_name}} --var binding_prefix={{binding_prefix}}
   gc bd update $WISP --assignee=$GC_AGENT
 
 Each wisp is ONE iteration: check for work, merge one branch, pour
@@ -29,7 +29,7 @@ closes the bead once the PR is verified.
 
 Read each step's description before acting — Config values override defaults."""
 formula = "mol-refinery-patrol"
-version = 2
+version = 3
 contract = "graph.v2"
 
 [vars]
@@ -166,14 +166,16 @@ gc workflow delete-source $WORK --apply && gc workflow reopen-source $WORK
 3. Put the work bead back in the pool with rejection metadata:
 ```bash
 gc bd update $WORK \
+  --status=open \
+  --assignee="" \
   --set-metadata rejection_reason="Conflicts with $TARGET at $(git rev-parse origin/$TARGET)" \
-  --set-metadata gc.routed_to=<rig>/polecat
+  --set-metadata gc.routed_to="${GC_RIG:+$GC_RIG/}{{binding_prefix}}polecat"
 ```
 4. Do NOT delete the branch (new polecat needs it for conflict resolution).
 5. Clean up temp branch: `git checkout {{target_branch}} && git branch -D temp`
 6. Pour next patrol iteration before burning:
 ```bash
-NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --json | jq -r '.new_epic_id')
+NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{target_branch}} --var rig_name={{rig_name}} --var binding_prefix={{binding_prefix}} --json | jq -r '.new_epic_id')
 gc bd update "$NEXT" --assignee=$GC_AGENT
 ```
 7. Burn this wisp: `gc bd mol burn <wisp-id> --force`
@@ -236,13 +238,16 @@ TARGET=$(gc bd show $WORK --json | jq -r '.[0].metadata.target // "{{target_bran
    - Put the work bead back in the pool with rejection metadata:
      ```bash
      gc bd update $WORK \
-       --set-metadata rejection_reason="<failure summary>"
+       --status=open \
+       --assignee="" \
+       --set-metadata rejection_reason="<failure summary>" \
+       --set-metadata gc.routed_to="${GC_RIG:+$GC_RIG/}{{binding_prefix}}polecat"
      ```
    - Delete branch: `git push origin --delete $BRANCH`
    - Clean up: `git checkout "$TARGET" && git branch -D temp`
    - Pour next patrol iteration before burning:
      ```bash
-     NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --json | jq -r '.new_epic_id')
+     NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{target_branch}} --var rig_name={{rig_name}} --var binding_prefix={{binding_prefix}} --json | jq -r '.new_epic_id')
      gc bd update "$NEXT" --assignee=$GC_AGENT
      ```
    - Burn this wisp: `gc bd mol burn <wisp-id> --force`
@@ -297,7 +302,7 @@ Work bead: $WORK
 Existing PR: $EXISTING_PR
 Branch: $BRANCH
 Target: $TARGET"
-  NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --json | jq -r '.new_epic_id')
+  NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{target_branch}} --var rig_name={{rig_name}} --var binding_prefix={{binding_prefix}} --json | jq -r '.new_epic_id')
   gc bd update "$NEXT" --assignee=$GC_AGENT
   CURRENT_WISP=${GC_BEAD_ID:-}
   if [ -n "$CURRENT_WISP" ]; then
@@ -600,7 +605,7 @@ If auto_land = "false": skip this entirely.
 
 **2. Pour next iteration:**
 ```bash
-NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --json | jq -r '.new_epic_id')
+NEXT=$(gc bd mol wisp mol-refinery-patrol --root-only --var target_branch={{target_branch}} --var rig_name={{rig_name}} --var binding_prefix={{binding_prefix}} --json | jq -r '.new_epic_id')
 gc bd update "$NEXT" --assignee=$GC_AGENT
 ```
 
diff --git a/examples/gastown/packs/gastown/formulas/mol-witness-patrol.toml b/examples/gastown/packs/gastown/formulas/mol-witness-patrol.toml
index 232958c933..c87d094c47 100644
--- a/examples/gastown/packs/gastown/formulas/mol-witness-patrol.toml
+++ b/examples/gastown/packs/gastown/formulas/mol-witness-patrol.toml
@@ -55,7 +55,7 @@ the worktree. This makes the work schedulable again.
 
 Read each step's description before acting — Config values override defaults."""
 formula = "mol-witness-patrol"
-version = 7
+version = 8
 
 [vars]
 [vars.event_timeout]
@@ -134,7 +134,7 @@ This happens when:
 - An agent was removed from config
 - An agent crashed and the controller decided not to restart it (quarantine)
 
-**Step 1: Find orphaned beads.**
+**Step 1: Find orphaned beads via session-ID liveness.**
 
 List beads assigned to agents in YOUR rig:
 ```bash
@@ -142,25 +142,83 @@ gc bd list --status=in_progress --json --limit=0
 gc bd list --status=open --json --limit=0
 ```
 
-Filter for beads assigned to polecat-pattern agents (e.g., `<rig>/polecats/<name>`).
+Filter for beads with an assignee (skip unassigned beads). This pass does not
+solve the controller race where orphaned work may already have been released to
+open/unassigned before witness observes it; that requires a separate
+worktree-salvage scan keyed by `metadata.work_dir`.
 
-Cross-reference against running sessions and configured (desired) agents:
+Get the full session roster for liveness checks:
 ```bash
-gc session list --json   # running sessions
-gc config show           # configured agents (includes pool templates)
+gc session list --state=all --json
+gc bd list --type=session --label=gc:session --include-infra --include-gates --all --json --limit=0
 ```
 
-For each bead with a polecat assignee:
-- If the assigned agent has a running session → not orphaned, skip
-- If the assigned agent matches a configured agent name (or is a pool
-  instance like worker-3 matching template worker) → controller will
-  restart it, skip
-- If the agent is neither running nor configured → **orphaned bead**
-
-**Important**: Do NOT recover beads assigned to agents that are simply
-restarting (crash recovery). The controller restarts crashed agents,
-and the fresh session resumes work from context. Only recover
-beads when the agent genuinely won't come back.
+For each bead with an assignee, check **session-ID liveness** — NOT
+template pattern matching. Pool instances get new IDs on restart, so
+matching against a template pattern (e.g., `worker-3` matches template
+`worker`) gives false negatives: the old session ID is dead but the
+witness skips it thinking "the pool will restart it." The pool creates
+a NEW session with a different ID — the old one never comes back.
+
+**Liveness check procedure:**
+
+1. Resolve the bead assignee by exact identifier lookup. Do not extract a
+   session ID with a regex or fixed prefix list: rig prefixes are
+   configuration-derived, and assignees may be a session bead ID, session
+   name, alias, concrete agent name, or configured named identity. Build the
+   lookup from `gc session list --state=all --json` plus session bead metadata:
+   ```bash
+   SESSIONS_JSON=$(gc session list --state=all --json)
+   SESSION_BEADS_JSON=$(gc bd list --type=session --label=gc:session --include-infra --include-gates --all --json --limit=0)
+
+   MATCH_JSON=$(jq -n \
+     --arg assignee "$ASSIGNEE" \
+     --argjson sessions "$SESSIONS_JSON" \
+     --argjson session_beads "$SESSION_BEADS_JSON" '
+       def add($m; $key; $state; $closed):
+         if (($key // "") | length) == 0 then $m
+         else $m + {($key): {
+           state: (if $closed then "closed" else ($state // "") end)
+         }}
+         end;
+
+       (reduce $sessions[] as $s ({};
+         add(.; $s.ID; $s.State; ($s.Closed // false))
+         | add(.; $s.SessionName; $s.State; ($s.Closed // false))
+         | add(.; $s.Alias; $s.State; ($s.Closed // false))
+         | add(.; $s.AgentName; $s.State; ($s.Closed // false))
+       )) as $from_session_list
+       | reduce $session_beads[] as $b ($from_session_list;
+           add(.; $b.metadata.configured_named_identity; $b.metadata.state; ($b.status == "closed")))
+       | .[$assignee] // empty')
+   ```
+
+2. Classify an absent exact match separately from a dead resolved session:
+   ```bash
+   if [ -z "$MATCH_JSON" ]; then
+     STATE=absent
+   else
+     STATE=$(echo "$MATCH_JSON" | jq -r '.state // "absent"')
+   fi
+   ```
+   An absent match is orphaned only for pool/ephemeral work identities. If the
+   assignee is a refinery, witness, or other configured infrastructure identity,
+   skip it instead of recovering it.
+
+3. Classify:
+   - `active` or `awake` → **not orphaned** (may be stuck —
+     `check-polecat-health` handles that separately)
+   - `creating`, `asleep`, `drained`, `suspended`, `draining`, or
+     `quarantined` → **not orphaned** (controller or operator state still owns
+     the session)
+   - `archived`, `closed`, or `absent` after the exact lookup → **orphaned
+     bead** for pool/ephemeral work — the owning session is gone and will never
+     come back, regardless of whether the pool template still exists
+
+**Important**: Beads assigned to the refinery, witness, or other
+infrastructure agents (not pool instances) should be skipped — those
+agents have persistent identity and the controller manages their
+lifecycle directly.
 
 **Step 2: For each orphaned bead, salvage work from the worktree.**
 
@@ -326,7 +384,7 @@ wisp is stale, the refinery may be stuck.
 
 **Step 3: Nudge if needed:**
 ```bash
-gc nudge <rig>/refinery "Work beads waiting for merge. Please check queue."
+gc session nudge <rig>/refinery "Work beads waiting for merge. Please check queue."
 ```
 
 **Step 4: Escalate if needed:**
diff --git a/examples/gastown/packs/gastown/orders/digest-generate.toml b/examples/gastown/packs/gastown/orders/digest-generate.toml
index 4206c31646..8c7efca6e2 100644
--- a/examples/gastown/packs/gastown/orders/digest-generate.toml
+++ b/examples/gastown/packs/gastown/orders/digest-generate.toml
@@ -3,4 +3,4 @@ description = "Generate daily code digest across all rigs"
 formula = "mol-digest-generate"
 trigger = "cooldown"
 interval = "24h"
-pool = "dog"
+pool = "gastown.dog"
diff --git a/examples/gastown/packs/gastown/overlay/.claude/settings.json b/examples/gastown/packs/gastown/overlay/.claude/settings.json
index 950f240f69..7307bc277d 100644
--- a/examples/gastown/packs/gastown/overlay/.claude/settings.json
+++ b/examples/gastown/packs/gastown/overlay/.claude/settings.json
@@ -21,7 +21,7 @@
           },
           {
             "type": "command",
-            "command": "gc handoff \"context cycle\""
+            "command": "gc handoff --auto \"context cycle\""
           }
         ]
       }
diff --git a/examples/gastown/packs/gastown/template-fragments/approval-fallacy.template.md b/examples/gastown/packs/gastown/template-fragments/approval-fallacy.template.md
index 8e9ef057a2..328d952b8c 100644
--- a/examples/gastown/packs/gastown/template-fragments/approval-fallacy.template.md
+++ b/examples/gastown/packs/gastown/template-fragments/approval-fallacy.template.md
@@ -41,7 +41,8 @@ gc bd update <work-bead> \
   --set-metadata branch=$(git branch --show-current) \
   --set-metadata target={{ .DefaultBranch }} \
   --notes "Implemented: <brief summary>"
-gc bd update <work-bead> --status=open --assignee={{ .RigName }}/refinery --set-metadata gc.routed_to={{ .RigName }}/refinery
+REFINERY_TARGET="${GC_RIG:+$GC_RIG/}{{ .BindingPrefix }}refinery"
+gc bd update <work-bead> --status=open --assignee="$REFINERY_TARGET" --set-metadata gc.routed_to="$REFINERY_TARGET"
 gc runtime drain-ack
 exit
 ```
diff --git a/examples/gastown/packs/gastown/template-fragments/operational-awareness.template.md b/examples/gastown/packs/gastown/template-fragments/operational-awareness.template.md
index 3e68f0d820..12612cfcd2 100644
--- a/examples/gastown/packs/gastown/template-fragments/operational-awareness.template.md
+++ b/examples/gastown/packs/gastown/template-fragments/operational-awareness.template.md
@@ -18,21 +18,70 @@ single server on port 3307 serving all databases. **It is fragile.**
 If you detect Dolt trouble (commands hang/timeout, "connection refused",
 "database not found", query latency > 5s, unexpected empty results):
 
-**BEFORE restarting Dolt, collect diagnostics.** Dolt hangs are hard to
-reproduce. A blind restart destroys the evidence. Always:
+**BEFORE restarting Dolt, collect non-fatal diagnostics.** Dolt hangs
+are hard to reproduce. A blind restart destroys the evidence. Always:
 
 ```bash
-# 1. Capture goroutine dump (safe — does not kill the process)
-kill -QUIT $(cat {{ .CityRoot }}/.gc/runtime/packs/dolt/dolt.pid)
-
-# 2. Capture server status while it's still (mis)behaving
-gc dolt status 2>&1 | tee /tmp/dolt-hang-$(date +%s).log
-
-# 3. THEN escalate with the evidence
+# Group all four captures under one timestamp so the bundle is easy
+# to attach to the escalation note. Each timed step writes via
+# redirect (not `tee`) so timeout's exit 124 propagates to `||` and
+# the agent gets an explicit "diagnostic timed out" signal — POSIX
+# pipelines mask the upstream exit code via tee.
+ts=$(date +%s)
+
+# 1. Capture live process state via SQL (non-fatal — Dolt keeps running).
+#    SHOW FULL PROCESSLIST lists active connections, the query each is
+#    running, and time-in-state. Bound the call so a wedged server can't
+#    block the diagnostic itself.
+timeout 5 gc dolt sql -q "SHOW FULL PROCESSLIST" \
+    > /tmp/dolt-hang-$ts-procs.log 2>&1 \
+  || echo "(step 1 timed out or failed — see procs.log for partial output)"
+cat /tmp/dolt-hang-$ts-procs.log
+
+# 2. Capture recent server log (timestamps, slow queries, prior crashes).
+#    `gc dolt logs` is a `tail` against an on-disk file — does not
+#    touch the live server, so no outer timeout is needed. Use the
+#    redirect form for the same reason as the other steps: a missing
+#    log file should surface as a "diagnostic failed" signal, not be
+#    masked by the `tee` exit code.
+gc dolt logs -n 500 \
+    > /tmp/dolt-hang-$ts-logs.log 2>&1 \
+  || echo "(step 2 failed — see logs.log; the dolt log file may be missing)"
+cat /tmp/dolt-hang-$ts-logs.log
+
+# 3. Capture the structured health snapshot. `gc dolt health` bounds
+#    each per-database SQL probe internally with `run_bounded 5`, but
+#    worst-case wall time is roughly 5s + 5s × N_databases. 60s covers
+#    cities up to ~10 databases at the limit; if the timeout fires,
+#    treat it as evidence the data plane is wedged and escalate.
+timeout 60 gc dolt health --json \
+    > /tmp/dolt-hang-$ts-health.json 2>&1 \
+  || echo "(step 3 timed out or failed — see health.json for partial output)"
+cat /tmp/dolt-hang-$ts-health.json
+
+# 4. Capture reachability + PID for the escalation note. Bound the
+#    call: `gc dolt status` probes /dev/tcp, which can stall on a
+#    server that accepts connections but never speaks MySQL.
+timeout 10 gc dolt status \
+    > /tmp/dolt-hang-$ts-status.log 2>&1 \
+  || echo "(step 4 timed out or failed — see status.log for partial output)"
+cat /tmp/dolt-hang-$ts-status.log
+
+# 5. THEN escalate with the evidence.
 gc mail send mayor -s "Dolt: <describe symptom>" -m "<paste evidence>"
 ```
 
-**Do NOT just `gc dolt stop && gc dolt start` without steps 1-2.**
+**Do NOT just `gc dolt stop && gc dolt start` without steps 1-4.**
+
+**Last resort, only with explicit human consent:** SIGQUIT to the Dolt
+PID writes a goroutine dump to `dolt.log` AND exits the server (Dolt's
+Go runtime treats SIGQUIT as a fatal default). Use only when steps 1-4
+above were insufficient AND the operator has approved a Dolt restart:
+
+```bash
+# WARNING: this terminates the Dolt server. Restart will follow.
+# kill -QUIT $(cat {{ .CityRoot }}/.gc/runtime/packs/dolt/dolt.pid)
+```
 
 Orphan databases (testdb_*, beads_t*, beads_pt*) accumulate on the production
 server and degrade performance. Use `gc dolt cleanup` to remove them safely.
@@ -40,15 +89,16 @@ server and degrade performance. Use `gc dolt cleanup` to remove them safely.
 
 ### Communication: Nudge First, Mail Rarely
 
-Every `gc mail send` creates a permanent bead with a Dolt commit. `gc nudge`
-is ephemeral and costs zero. **Default to nudge for all routine communication.**
+Every `gc mail send` creates a permanent bead with a Dolt commit. The
+`gc session nudge` path is ephemeral and costs zero. **Default to nudge for all
+routine communication.**
 
 **The litmus test:** "If the recipient dies and restarts, do they need this
 message?" If yes -> mail. If no -> nudge.
 
 **Ephemeral protocol messages:** MERGE_READY, MERGE_FAILED, RECOVERY_NEEDED,
-LIFECYCLE:Shutdown, and WORK_DONE are routine signals. Use `gc nudge` — the
-underlying bead state (assignee, status, metadata) is the durable record.
+LIFECYCLE:Shutdown, and WORK_DONE are routine signals. Use `gc session nudge`
+— the underlying bead state (assignee, status, metadata) is the durable record.
 
 **When you must mail**, use shell quoting for multi-line messages:
 
diff --git a/examples/gastown/packs/maintenance/agents/dog/prompt.template.md b/examples/gastown/packs/maintenance/agents/dog/prompt.template.md
index a07dfbcdf5..ec23e06a4c 100644
--- a/examples/gastown/packs/maintenance/agents/dog/prompt.template.md
+++ b/examples/gastown/packs/maintenance/agents/dog/prompt.template.md
@@ -42,7 +42,7 @@ before killing the session.
 
 | Attempt | Timeout | Message |
 |---------|---------|---------|
-| 1 | 60s | Health check via `gc nudge` |
+| 1 | 60s | Health check via `gc session nudge` |
 | 2 | 120s | Second health check |
 | 3 | 240s | Final warning |
 
@@ -75,8 +75,8 @@ and the pool can't recycle your slot.
 ## Communication
 
 ```bash
-gc nudge <target> "message"                        # Nudge an agent
-gc session peek <target> 50                        # View agent output
+gc session nudge <target> "message"                # Nudge an agent
+gc session peek <target> --lines 50                # View agent output
 gc session list                                    # Check agent status
 ```
 
@@ -84,7 +84,7 @@ gc session list                                    # Check agent status
 
 **Dogs NEVER send mail.** Your results go to:
 1. Event beads (for audit trail)
-2. `gc nudge deacon/ "DOG_DONE: <warrant> <result>"` (for immediate notification)
+2. `gc session nudge deacon/ "DOG_DONE: <warrant> <result>"` (for immediate notification)
 3. Escalation via `gc mail send mayor/` ONLY for unresolvable problems
 
 **Never use `gc mail send` for routine reporting.** Every mail creates a permanent
@@ -97,7 +97,7 @@ When you complete a warrant (pardon or execute), notify the requester
 via nudge:
 
 ```bash
-gc nudge {{"{{requester}}"}}/ "DOG_DONE: <target> — <outcome>"
+gc session nudge {{"{{requester}}"}}/ "DOG_DONE: <target> — <outcome>"
 ```
 
 ---
@@ -115,7 +115,8 @@ gc nudge {{"{{requester}}"}}/ "DOG_DONE: <target> — <outcome>"
 | Close completed work | `gc bd close <id> --reason "..."` |
 | Request target restart | `gc session kill <target>` |
 | List orphan databases | `gc dolt cleanup` |
-| Remove orphan databases | `gc dolt cleanup --force` |
+| Remove orphan databases | `gc dolt cleanup --force` (safe via SQL DROP when dolt is up) |
+| Remove orphan databases (dolt stopped) | `gc dolt cleanup --force --server-down-ok` (**operator/TTY-only**; do **not** use from autonomous/agent contexts — the rm fallback corrupts NBS state if dolt is actually running, #1549) |
 | Exit (return to pool) | `gc runtime drain-ack && exit` |
 
 Working directory: {{ .WorkDir }}
diff --git a/examples/gastown/packs/maintenance/assets/scripts/cross-rig-deps.sh b/examples/gastown/packs/maintenance/assets/scripts/cross-rig-deps.sh
index 6fdfe3038d..7bd64d66f5 100755
--- a/examples/gastown/packs/maintenance/assets/scripts/cross-rig-deps.sh
+++ b/examples/gastown/packs/maintenance/assets/scripts/cross-rig-deps.sh
@@ -29,22 +29,35 @@ if [ -z "$CLOSED" ] || [ "$CLOSED" = "[]" ]; then
 fi
 
 # Step 2: For each closed issue, check for cross-rig dependents.
+# Capture jq output into variables (instead of piping into the loops) so
+# producer failures still trip pipefail+set -e fail-loud, and the loop
+# bodies run in the parent shell — RESOLVED is incremented in scope and
+# survives to the summary echo below. CLOSED is pre-validated as a
+# non-empty array on lines 26-29, so CLOSED_IDS is non-empty here.
 RESOLVED=0
-echo "$CLOSED" | jq -r '.[].id' 2>/dev/null | while IFS= read -r closed_id; do
+CLOSED_IDS=$(echo "$CLOSED" | jq -r '.[].id' 2>/dev/null)
+while IFS= read -r closed_id; do
     # Find beads that have a blocks dep on this closed issue.
     DEPS=$(bd dep list "$closed_id" --direction=up --type=blocks --json 2>/dev/null) || continue
     if [ -z "$DEPS" ] || [ "$DEPS" = "[]" ]; then
         continue
     fi
 
-    # Filter for external (cross-rig) deps.
-    echo "$DEPS" | jq -r '.[] | select(.id | startswith("external:")) | .id' 2>/dev/null | while IFS= read -r dep_id; do
+    # Filter for external (cross-rig) deps. The select() filter may yield
+    # zero matches, in which case we skip rather than feed an empty
+    # here-string into `read` (which would produce one bogus iteration
+    # with dep_id="").
+    EXTERNAL_DEPS=$(echo "$DEPS" | jq -r '.[] | select(.id | startswith("external:")) | .id' 2>/dev/null)
+    if [ -z "$EXTERNAL_DEPS" ]; then
+        continue
+    fi
+    while IFS= read -r dep_id; do
         # Convert blocks → related: remove blocking semantics, keep audit trail.
         bd dep remove "$dep_id" "external:$closed_id" 2>/dev/null || true
         bd dep add "$dep_id" "external:$closed_id" --type=related 2>/dev/null || true
         RESOLVED=$((RESOLVED + 1))
-    done
-done
+    done <<< "$EXTERNAL_DEPS"
+done <<< "$CLOSED_IDS"
 
 if [ "$RESOLVED" -gt 0 ]; then
     echo "cross-rig-deps: resolved $RESOLVED cross-rig dependencies"
diff --git a/examples/gastown/packs/maintenance/assets/scripts/gate-sweep.sh b/examples/gastown/packs/maintenance/assets/scripts/gate-sweep.sh
index f1c536f6b5..c95006675b 100755
--- a/examples/gastown/packs/maintenance/assets/scripts/gate-sweep.sh
+++ b/examples/gastown/packs/maintenance/assets/scripts/gate-sweep.sh
@@ -1,50 +1,17 @@
 #!/usr/bin/env bash
 # gate-sweep — evaluate and close pending gates.
 #
-# Replaces the deacon patrol check-gates step. All gate evaluation is
-# deterministic: timer gates are timestamp comparison, condition gates
-# are exit code checks, GitHub gates are API status queries.
+# Runs as an exec order (no LLM, no agent, no wisp). bd dispatches per
+# type. `|| true` is load-bearing: bd shells out to `gh` for gh:run /
+# gh:pr gates, and fresh cities without `gh auth` would otherwise fail
+# this order on every 30s cooldown. bd's combined output reaches the
+# controller log only on non-zero exit (cmd/gc/order_dispatch.go:466-475),
+# so the suppression also hides real bd errors — diagnose by hand.
 #
-# Runs as an exec order (no LLM, no agent, no wisp).
+# Bead-type gates are skipped: in beads v1.0.2, checkBeadGate is
+# hard-coded to fail because cross-rig routing was removed upstream.
+# Restore `bd gate check --type=bead --escalate` when beads adds it back.
 set -euo pipefail
 
-CITY="${GC_CITY:-.}"
-
-# Step 1: Close elapsed timer gates.
-# bd gate check evaluates all open gate beads, closes those past their
-# timeout, and prints a summary. --escalate sends mail for expired gates.
-bd gate check --type=timer --escalate 2>/dev/null || true
-
-# Step 2: Evaluate condition gates.
-# For each open condition gate, run its check command. Close if exit 0.
-CONDITION_GATES=$(bd gate list --type=condition --status=open --json 2>/dev/null) || true
-if [ -n "$CONDITION_GATES" ] && [ "$CONDITION_GATES" != "[]" ]; then
-    echo "$CONDITION_GATES" | jq -r '.[] | "\(.id)\t\(.metadata.check)"' 2>/dev/null | while IFS=$'\t' read -r gate_id check_cmd; do
-        if [ -n "$check_cmd" ] && eval "$check_cmd" >/dev/null 2>&1; then
-            bd gate close "$gate_id" --reason "condition satisfied" 2>/dev/null || true
-        fi
-    done
-fi
-
-# Step 3: Evaluate GitHub gates (gh:run, gh:pr).
-# For each open GitHub gate, check the workflow/PR status and close if done.
-GH_GATES=$(bd gate list --type=gh --status=open --json 2>/dev/null) || true
-if [ -n "$GH_GATES" ] && [ "$GH_GATES" != "[]" ]; then
-    echo "$GH_GATES" | jq -r '.[] | "\(.id)\t\(.metadata.await_type)\t\(.metadata.ref)"' 2>/dev/null | while IFS=$'\t' read -r gate_id await_type ref; do
-        case "$await_type" in
-            gh:run)
-                STATUS=$(gh run view "$ref" --json status -q .status 2>/dev/null) || continue
-                if [ "$STATUS" = "completed" ]; then
-                    CONCLUSION=$(gh run view "$ref" --json conclusion -q .conclusion 2>/dev/null)
-                    bd gate close "$gate_id" --reason "workflow $CONCLUSION" 2>/dev/null || true
-                fi
-                ;;
-            gh:pr)
-                STATE=$(gh pr view "$ref" --json state -q .state 2>/dev/null) || continue
-                if [ "$STATE" = "MERGED" ] || [ "$STATE" = "CLOSED" ]; then
-                    bd gate close "$gate_id" --reason "PR $STATE" 2>/dev/null || true
-                fi
-                ;;
-        esac
-    done
-fi
+bd gate check --type=timer --escalate || true
+bd gate check --type=gh --escalate || true
diff --git a/examples/gastown/packs/maintenance/assets/scripts/jsonl-export.sh b/examples/gastown/packs/maintenance/assets/scripts/jsonl-export.sh
index 36dd9429fb..192ae60b85 100755
--- a/examples/gastown/packs/maintenance/assets/scripts/jsonl-export.sh
+++ b/examples/gastown/packs/maintenance/assets/scripts/jsonl-export.sh
@@ -2,8 +2,8 @@
 # jsonl-export — export Dolt databases to JSONL and push to git archive.
 #
 # Replaces mol-dog-jsonl formula. All operations are deterministic:
-# dolt sql exports, wc -l comparisons against spike threshold, git
-# add/commit/push. No LLM judgment needed.
+# dolt sql exports, jq record-count comparisons against spike threshold,
+# git add/commit/push. No LLM judgment needed.
 #
 # Runs as an exec order (no LLM, no agent, no wisp).
 set -euo pipefail
@@ -11,16 +11,408 @@ set -euo pipefail
 CITY="${GC_CITY:-.}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 . "$SCRIPT_DIR/dolt-target.sh"
+
+# jq is a hard dependency: count_jsonl_rows below relies on it, and a missing
+# jq would silently zero every record count and could mask spikes on a stale
+# baseline. Fail loud at startup instead.
+if ! command -v jq >/dev/null 2>&1; then
+    echo "jsonl-export: jq is required but not found in PATH" >&2
+    exit 1
+fi
 PACK_STATE_DIR="${GC_PACK_STATE_DIR:-${GC_CITY_RUNTIME_DIR:-$CITY/.gc/runtime}/packs/maintenance}"
 LEGACY_ARCHIVE_REPO="$CITY/.gc/jsonl-archive"
 LEGACY_STATE_FILE="$CITY/.gc/jsonl-export-state.json"
 
 # Configurable via environment (defaults match the old formula).
 SPIKE_THRESHOLD="${GC_JSONL_SPIKE_THRESHOLD:-20}"  # percentage (0-100)
+# Skip the percentage spike check when the previous record count is below
+# this absolute floor — small-N percentages are noise. Set to 0 to disable.
+MIN_PREV_FOR_SPIKE_CHECK="${GC_JSONL_MIN_PREV_FOR_SPIKE:-10}"
 MAX_PUSH_FAILURES="${GC_JSONL_MAX_PUSH_FAILURES:-3}"
 SCRUB="${GC_JSONL_SCRUB:-true}"
 ARCHIVE_REPO="${GC_JSONL_ARCHIVE_REPO:-$PACK_STATE_DIR/jsonl-archive}"
 
+# Count records in a `dolt sql -r json` payload. The output is `{"rows":[...]}`
+# on (typically) a single physical line, so `wc -l` measures formatting, not
+# records. Falls back to 0 on empty/missing/unparseable input; jq parse errors
+# are forwarded to stderr so a corrupt archive surfaces in operator logs
+# instead of being silently scored as zero rows.
+count_jsonl_rows() {
+    jq -s -r 'if length == 0 then 0 else ((.[0].rows // []) | length) end' || echo "0"
+}
+
+# Scrub test-only rows while preserving the JSON export structure and legitimate
+# rows in the same payload. The input is one JSON object with a .rows array, not
+# newline-delimited JSON, so row-level filtering must happen inside jq.
+scrub_exported_issues() {
+    jq -c '
+        if (.rows? | type) == "array" then
+            .rows |= map(
+                select(
+                    ((.title // "") | test("^(Test Issue|test_)") | not) and
+                    (
+                        (
+                            (.id // "") == "bd-1" or
+                            (.id // "") == "bd-abc12" or
+                            ((.id // "") | test("^(testdb_|beads_t)"))
+                        ) | not
+                    )
+                )
+            )
+        else
+            .
+        end
+    '
+}
+
+validate_exported_issues() {
+    jq -e -c '
+        if (type == "object") and ((.rows? | type) == "array") then
+            .
+        else
+            error("issues export must be a JSON object with a rows array")
+        end
+    '
+}
+
+normalize_pending_spike_alert_state() {
+    jq -c '
+        (.pending_spike_alerts //= {}) |
+        if (.pending_spike_alert? | type) == "object" and ((.pending_spike_alert.database // "") != "") then
+            .pending_spike_alerts[.pending_spike_alert.database] = (.pending_spike_alerts[.pending_spike_alert.database] // .pending_spike_alert)
+        else
+            .
+        end |
+        del(.pending_spike_alert) |
+        if .pending_spike_alerts == {} then
+            del(.pending_spike_alerts)
+        else
+            .
+        end
+    '
+}
+
+read_state_object() {
+    local path="$1"
+
+    jq -c '
+        if type == "object" then
+            .
+        else
+            error("state root must be a JSON object")
+        end
+    ' "$path" 2>/dev/null
+}
+
+read_state_json() {
+    if [ -f "$STATE_FILE" ] && read_state_object "$STATE_FILE"; then
+        return
+    fi
+    if [ -f "$STATE_FILE_BACKUP" ] && read_state_object "$STATE_FILE_BACKUP"; then
+        if [ -f "$STATE_FILE" ]; then
+            echo "jsonl-export: state file malformed; using last-known-good backup" >&2
+        else
+            echo "jsonl-export: state file missing; using last-known-good backup" >&2
+        fi
+        return
+    fi
+    if [ -f "$STATE_FILE" ]; then
+        echo "jsonl-export: state file malformed; resetting to empty state" >&2
+    fi
+    echo '{}'
+}
+
+write_state_file_atomically() {
+    local path="$1"
+    local label="$2"
+    local content="$3"
+    local tmpfile
+
+    if ! tmpfile=$(mktemp "${path}.tmp.XXXXXX"); then
+        echo "jsonl-export: creating temporary $label failed" >&2
+        return 1
+    fi
+    if ! printf '%s\n' "$content" > "$tmpfile"; then
+        echo "jsonl-export: writing temporary $label failed" >&2
+        rm -f "$tmpfile"
+        return 1
+    fi
+    if ! mv -f "$tmpfile" "$path"; then
+        echo "jsonl-export: replacing $label failed" >&2
+        rm -f "$tmpfile"
+        return 1
+    fi
+}
+
+write_state_json() {
+    if ! write_state_file_atomically "$STATE_FILE" "state file" "$1"; then
+        return 1
+    fi
+    if ! write_state_file_atomically "$STATE_FILE_BACKUP" "state backup" "$1"; then
+        echo "jsonl-export: state backup update failed; continuing with primary state only" >&2
+    fi
+}
+
+set_consecutive_push_failures() {
+    local count="$1"
+    write_state_json "$(read_state_json | jq -c --argjson count "$count" '.consecutive_push_failures = $count')"
+}
+
+set_pending_archive_push() {
+    write_state_json "$(read_state_json | jq -c '.pending_archive_push = true')"
+}
+
+clear_pending_archive_push() {
+    write_state_json "$(read_state_json | jq -c 'del(.pending_archive_push)')"
+}
+
+has_pending_archive_push() {
+    [ "$(read_state_json | jq -r '.pending_archive_push // false')" = "true" ]
+}
+
+refresh_archive_remote_main() {
+    git fetch origin main -q 2>/dev/null
+}
+
+archive_has_local_only_commits_from_tracking() {
+    local merge_base
+
+    if ! git rev-parse --verify refs/remotes/origin/main >/dev/null 2>&1; then
+        return 1
+    fi
+    merge_base=$(git merge-base refs/remotes/origin/main HEAD 2>/dev/null) || return 1
+    [ "$(git rev-list --count "$merge_base..HEAD" 2>/dev/null || echo "0")" -gt 0 ]
+}
+
+archive_has_local_only_commits() {
+    if refresh_archive_remote_main >/dev/null 2>&1; then
+        archive_has_local_only_commits_from_tracking
+        return
+    fi
+    if archive_has_local_only_commits_from_tracking; then
+        echo "jsonl-export: fetch failed while checking deferred archive push; using existing origin/main tracking ref" >&2
+        return 0
+    fi
+    return 1
+}
+
+set_pending_spike_alert() {
+    local db="$1"
+    local prev_count="$2"
+    local current_count="$3"
+    local delta="$4"
+    local threshold="$5"
+
+    write_state_json "$(
+        read_state_json \
+            | normalize_pending_spike_alert_state \
+            | jq -c \
+            --arg db "$db" \
+            --argjson prev_count "$prev_count" \
+            --argjson current_count "$current_count" \
+            --argjson delta "$delta" \
+            --argjson threshold "$threshold" \
+            '.pending_spike_alerts[$db] = {
+                database: $db,
+                prev_count: $prev_count,
+                current_count: $current_count,
+                delta: $delta,
+                threshold: $threshold
+            }'
+    )"
+}
+
+clear_pending_spike_alert() {
+    local db="${1:-}"
+
+    if [ -z "$db" ]; then
+        write_state_json "$(read_state_json | jq -c 'del(.pending_spike_alert, .pending_spike_alerts)')"
+        return
+    fi
+
+    write_state_json "$(
+        read_state_json \
+            | normalize_pending_spike_alert_state \
+            | jq -c --arg db "$db" '
+                del(.pending_spike_alerts[$db]) |
+                if (.pending_spike_alerts // {}) == {} then
+                    del(.pending_spike_alerts)
+                else
+                    .
+                end
+            '
+    )"
+}
+
+send_spike_alert() {
+    local db="$1"
+    local prev_count="$2"
+    local current_count="$3"
+    local delta="$4"
+    local threshold="$5"
+
+    gc mail send mayor/ -s "ESCALATION: JSONL spike detected [HIGH]" \
+        -m "Database: $db, prev: $prev_count, current: $current_count, delta: ${delta}%, threshold: ${threshold}%" \
+        2>/dev/null
+}
+
+retry_pending_spike_alert() {
+    local state_json
+    local updated_state_json
+    local state_changed=0
+    local alert_json
+    local pending_alerts=()
+    local db
+    local prev_count
+    local current_count
+    local delta
+    local threshold
+
+    state_json=$(read_state_json | normalize_pending_spike_alert_state)
+    updated_state_json="$state_json"
+    while IFS= read -r alert_json; do
+        [ -n "$alert_json" ] || continue
+        pending_alerts+=("$alert_json")
+    done < <(
+        printf '%s\n' "$state_json" \
+            | jq -c '.pending_spike_alerts // {} | to_entries | sort_by(.key) | .[].value'
+    )
+    if [ "${#pending_alerts[@]}" -eq 0 ]; then
+        return
+    fi
+
+    for alert_json in "${pending_alerts[@]}"; do
+        db=$(printf '%s\n' "$alert_json" | jq -r '.database // empty')
+        if [ -z "$db" ]; then
+            continue
+        fi
+        prev_count=$(printf '%s\n' "$alert_json" | jq -r '.prev_count // 0')
+        current_count=$(printf '%s\n' "$alert_json" | jq -r '.current_count // 0')
+        delta=$(printf '%s\n' "$alert_json" | jq -r '.delta // 0')
+        threshold=$(printf '%s\n' "$alert_json" | jq -r '.threshold // 0')
+
+        if send_spike_alert "$db" "$prev_count" "$current_count" "$delta" "$threshold"; then
+            updated_state_json=$(
+                printf '%s\n' "$updated_state_json" \
+                    | jq -c --arg db "$db" '
+                        del(.pending_spike_alerts[$db]) |
+                        if (.pending_spike_alerts // {}) == {} then
+                            del(.pending_spike_alerts)
+                        else
+                            .
+                        end
+                    '
+            )
+            state_changed=1
+            continue
+        fi
+        echo "jsonl-export: pending spike alert delivery failed for $db" >&2
+    done
+
+    if [ "$state_changed" -eq 1 ]; then
+        write_state_json "$updated_state_json"
+    fi
+}
+
+push_archive_main() {
+    local consecutive
+
+    record_archive_push_failure() {
+        local message="$1"
+
+        echo "$message" >&2
+        consecutive=$(read_state_json | jq -r '.consecutive_push_failures // 0' || echo "0")
+        consecutive=$((consecutive + 1))
+        set_consecutive_push_failures "$consecutive"
+        set_pending_archive_push
+
+        if [ "$consecutive" -ge "$MAX_PUSH_FAILURES" ]; then
+            gc mail send mayor/ -s "ESCALATION: JSONL push failed [HIGH]" \
+                -m "Consecutive failures: $consecutive (threshold: $MAX_PUSH_FAILURES)" \
+                2>/dev/null || true
+        fi
+
+        return 1
+    }
+
+    if ! refresh_archive_remote_main; then
+        if git rev-parse --verify refs/remotes/origin/main >/dev/null 2>&1; then
+            record_archive_push_failure "jsonl-export: fetching origin/main failed"
+            return 1
+        fi
+        echo "jsonl-export: origin/main missing; attempting initial push bootstrap" >&2
+    fi
+
+    if git rev-parse --verify refs/remotes/origin/main >/dev/null 2>&1; then
+        if ! git merge-base --is-ancestor refs/remotes/origin/main HEAD >/dev/null 2>&1; then
+            if ! git rebase refs/remotes/origin/main >/dev/null 2>&1; then
+                git rebase --abort >/dev/null 2>&1 || true
+                record_archive_push_failure "jsonl-export: rebase onto origin/main failed during archive push recovery"
+                return 1
+            fi
+        fi
+        if ! archive_has_local_only_commits_from_tracking; then
+            set_consecutive_push_failures "0"
+            clear_pending_archive_push
+            return 0
+        fi
+    fi
+
+    if git push origin main -q 2>/dev/null; then
+        set_consecutive_push_failures "0"
+        clear_pending_archive_push
+        return 0
+    fi
+
+    record_archive_push_failure "jsonl-export: pushing archive main failed"
+}
+
+commit_archive_snapshot() {
+    local message="$1"
+    local context="$2"
+
+    if ! GIT_AUTHOR_NAME="Gas Town Daemon" \
+        GIT_AUTHOR_EMAIL="daemon@gastown.local" \
+        GIT_COMMITTER_NAME="Gas Town Daemon" \
+        GIT_COMMITTER_EMAIL="daemon@gastown.local" \
+        git commit -q -m "$message"; then
+        echo "jsonl-export: $context commit failed" >&2
+        return 1
+    fi
+}
+
+discard_failed_db_outputs() {
+    local db="$1"
+
+    rm -rf "$ARCHIVE_REPO/$db"
+    rm -f "$ARCHIVE_REPO/$db.jsonl"
+
+    if git -C "$ARCHIVE_REPO" cat-file -e "HEAD:$db/issues.jsonl" 2>/dev/null; then
+        git -C "$ARCHIVE_REPO" restore --source=HEAD --worktree -- "$db" >/dev/null 2>&1 || true
+    fi
+    if git -C "$ARCHIVE_REPO" cat-file -e "HEAD:$db.jsonl" 2>/dev/null; then
+        git -C "$ARCHIVE_REPO" restore --source=HEAD --worktree -- "$db.jsonl" >/dev/null 2>&1 || true
+    fi
+}
+
+discard_staged_archive_outputs() {
+    local path
+
+    if [ "${#STAGE_PATHS[@]}" -eq 0 ]; then
+        return
+    fi
+
+    git reset -q -- "${STAGE_PATHS[@]}" >/dev/null 2>&1 || true
+    for path in "${STAGE_PATHS[@]}"; do
+        if git cat-file -e "HEAD:$path" 2>/dev/null; then
+            git restore --source=HEAD --staged --worktree -- "$path" >/dev/null 2>&1 || true
+            git clean -fd -- "$path" >/dev/null 2>&1 || true
+            continue
+        fi
+        rm -rf "$path"
+    done
+}
+
 # State file for tracking consecutive push failures.
 STATE_FILE="$PACK_STATE_DIR/jsonl-export-state.json"
 
@@ -30,12 +422,54 @@ fi
 if [ ! -e "$STATE_FILE" ] && [ -e "$LEGACY_STATE_FILE" ]; then
     STATE_FILE="$LEGACY_STATE_FILE"
 fi
+STATE_FILE_BACKUP="${STATE_FILE}.bak"
 mkdir -p "$(dirname "$STATE_FILE")"
 
-# Discover databases. Exclude Dolt/MySQL system schemas and Gas City's internal
-# health-probe database; the remaining databases are expected to be bead stores.
-DATABASES=$(dolt_sql -r csv -q "SHOW DATABASES" 2>/dev/null | tail -n +2 | grep -vi '^information_schema$\|^mysql$\|^dolt_cluster$\|^__gc_probe$' || true)
+retry_pending_spike_alert
+
+is_user_database() {
+    case "$1" in
+        information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe|benchdb|testdb_*|beads_pt*|beads_vr*|doctest_*|doctortest_*)
+            return 1
+            ;;
+        beads_t*)
+            local suffix="${1#beads_t}"
+            if [[ "$suffix" =~ ^[0-9a-f]{8,}$ ]]; then
+                return 1
+            fi
+            return 0
+            ;;
+        *)
+            return 0
+            ;;
+    esac
+}
+
+# Discover databases. Exclude Dolt/MySQL system schemas, Gas City's internal
+# health-probe database, and test-fixture scratch databases (benchdb,
+# testdb_*, lowercase beads_t[0-9a-f]{8,}, beads_pt*, beads_vr*,
+# doctest_*, doctortest_* — matching the Go cleanup planner contract); the
+# remaining databases are expected to be bead stores.
+DATABASES=$(
+    while IFS= read -r db; do
+        if is_user_database "$db"; then
+            printf '%s\n' "$db"
+        fi
+    done < <(dolt_sql -r csv -q "SHOW DATABASES" 2>/dev/null | tail -n +2)
+)
 if [ -z "$DATABASES" ]; then
+    if [ -d "$ARCHIVE_REPO/.git" ]; then
+        cd "$ARCHIVE_REPO"
+        if has_pending_archive_push || archive_has_local_only_commits; then
+            PUSH_STATUS="ok"
+            if ! push_archive_main; then
+                PUSH_STATUS="failed"
+            fi
+            SUMMARY="jsonl — no user databases, push: $PUSH_STATUS"
+            gc session nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
+            echo "jsonl-export: $SUMMARY"
+        fi
+    fi
     exit 0
 fi
 
@@ -54,16 +488,55 @@ fi
 TOTAL_EXPORTED=0
 TOTAL_DBS=0
 FAILED_DBS=""
+FAILED_DB_COUNT=0
 HALTED=0
+STAGE_PATHS=()
+HALT_DB=""
+HALT_PREV_COUNT=0
+HALT_CURRENT_COUNT=0
+HALT_DELTA=0
+
+valid_database_identifier() {
+    local name="$1"
 
-for DB in $DATABASES; do
+    case "$name" in
+        ''|-*|*[!A-Za-z0-9_-]*)
+            return 1
+            ;;
+    esac
+
+    return 0
+}
+
+while IFS= read -r DB; do
+    [ -z "$DB" ] && continue
     TOTAL_DBS=$((TOTAL_DBS + 1))
+    if ! valid_database_identifier "$DB"; then
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
+        continue
+    fi
+
     DB_DIR="$ARCHIVE_REPO/$DB"
     mkdir -p "$DB_DIR"
 
     # Step 1: Export issues table.
-    if ! dolt_sql -r json -q "SELECT * FROM \`$DB\`.issues $SCRUB_FILTER" > "$DB_DIR/issues.jsonl" 2>/dev/null; then
-        FAILED_DBS="${FAILED_DBS}$DB "
+    ISSUE_EXPORT_TMP=$(mktemp "$DB_DIR/issues.jsonl.tmp.XXXXXX")
+    if ! dolt_sql -r json -q "SELECT * FROM \`$DB\`.issues $SCRUB_FILTER" > "$ISSUE_EXPORT_TMP" 2>/dev/null; then
+        rm -f "$ISSUE_EXPORT_TMP"
+        discard_failed_db_outputs "$DB"
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
+        continue
+    fi
+    if ! mv -f "$ISSUE_EXPORT_TMP" "$DB_DIR/issues.jsonl"; then
+        rm -f "$ISSUE_EXPORT_TMP"
+        discard_failed_db_outputs "$DB"
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
         continue
     fi
 
@@ -72,96 +545,175 @@ for DB in $DATABASES; do
         dolt_sql -r json -q "SELECT * FROM \`$DB\`.\`$TABLE\`" > "$DB_DIR/$TABLE.jsonl" 2>/dev/null || true
     done
 
-    # Legacy flat file.
-    cp "$DB_DIR/issues.jsonl" "$ARCHIVE_REPO/$DB.jsonl" 2>/dev/null || true
+    # Step 2: Validate the exported JSON payload and optionally scrub it. Even
+    # when SCRUB=false we still fail the DB on malformed JSON so corrupt live
+    # exports cannot silently score as zero rows and become the new baseline.
+    TMPFILE=$(mktemp)
+    if [ "$SCRUB" = "true" ]; then
+        if ! scrub_exported_issues < "$DB_DIR/issues.jsonl" > "$TMPFILE"; then
+            rm -f "$TMPFILE"
+            discard_failed_db_outputs "$DB"
+            FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+            FAILED_DBS="${FAILED_DBS}$DB
+"
+            continue
+        fi
+    elif ! validate_exported_issues < "$DB_DIR/issues.jsonl" > "$TMPFILE"; then
+        rm -f "$TMPFILE"
+        discard_failed_db_outputs "$DB"
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
+        continue
+    fi
+    if [ ! -s "$TMPFILE" ]; then
+        echo "jsonl-export: issues export for $DB was empty" >&2
+        rm -f "$TMPFILE"
+        discard_failed_db_outputs "$DB"
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
+        continue
+    fi
+    if ! validate_exported_issues < "$TMPFILE" >/dev/null; then
+        rm -f "$TMPFILE"
+        discard_failed_db_outputs "$DB"
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
+        continue
+    fi
+    mv -f "$TMPFILE" "$DB_DIR/issues.jsonl"
+
+    # Legacy flat file mirrors the scrubbed per-db export. Keep the two output
+    # shapes in sync so any downstream reader sees the same filtered payload.
+    if ! cp -f "$DB_DIR/issues.jsonl" "$ARCHIVE_REPO/$DB.jsonl" 2>/dev/null; then
+        discard_failed_db_outputs "$DB"
+        FAILED_DB_COUNT=$((FAILED_DB_COUNT + 1))
+        FAILED_DBS="${FAILED_DBS}$DB
+"
+        continue
+    fi
 
-    # Count records exported.
-    CURRENT_COUNT=$(wc -l < "$DB_DIR/issues.jsonl" 2>/dev/null || echo "0")
+    # Count records from the final persisted payload (post-scrub / post-
+    # validation) so commit messages and DOG_DONE summaries reflect what was
+    # actually archived, not the pre-scrub raw export.
+    CURRENT_COUNT=$(count_jsonl_rows < "$DB_DIR/issues.jsonl")
     TOTAL_EXPORTED=$((TOTAL_EXPORTED + CURRENT_COUNT))
 
-    # Step 2: Filter test pollution.
-    if [ "$SCRUB" = "true" ] && [ -s "$DB_DIR/issues.jsonl" ]; then
-        # Remove test patterns in-place. Use a temp file for atomicity.
-        TMPFILE=$(mktemp)
-        grep -v -E '"title"\s*:\s*"(Test Issue|test_)' "$DB_DIR/issues.jsonl" \
-            | grep -v -E '"id"\s*:\s*"(bd-1|bd-abc12|testdb_|beads_t)' \
-            > "$TMPFILE" 2>/dev/null || true
-        mv "$TMPFILE" "$DB_DIR/issues.jsonl"
-    fi
+    STAGE_PATHS+=("$DB" "$DB.jsonl")
 
-    # Step 3: Spike detection — compare against previous commit.
+    # Step 3: Spike detection — compare record counts against previous commit.
     PREV_COUNT=0
-    if git -C "$ARCHIVE_REPO" log -1 --format=%H -- "$DB/issues.jsonl" >/dev/null 2>&1; then
-        PREV_COUNT=$(git -C "$ARCHIVE_REPO" show HEAD:"$DB/issues.jsonl" 2>/dev/null | wc -l || echo "0")
+    if git -C "$ARCHIVE_REPO" cat-file -e "HEAD:$DB/issues.jsonl" 2>/dev/null; then
+        PREV_COUNT=$(git -C "$ARCHIVE_REPO" show "HEAD:$DB/issues.jsonl" 2>/dev/null | count_jsonl_rows || echo "0")
     fi
 
-    if [ "$PREV_COUNT" -gt 0 ]; then
-        FILTERED_COUNT=$(wc -l < "$DB_DIR/issues.jsonl" 2>/dev/null || echo "0")
-        if [ "$PREV_COUNT" -gt 0 ]; then
-            DELTA=$(( (FILTERED_COUNT - PREV_COUNT) * 100 / PREV_COUNT ))
-            # Use absolute value.
-            if [ "$DELTA" -lt 0 ]; then
-                DELTA=$(( -DELTA ))
-            fi
-            if [ "$DELTA" -gt "$SPIKE_THRESHOLD" ]; then
-                gc mail send mayor/ -s "ESCALATION: JSONL spike detected [HIGH]" \
-                    -m "Database: $DB, prev: $PREV_COUNT, current: $FILTERED_COUNT, delta: ${DELTA}%, threshold: ${SPIKE_THRESHOLD}%" \
-                    2>/dev/null || true
-                HALTED=1
-                echo "jsonl-export: HALTED — spike in $DB (${DELTA}% > ${SPIKE_THRESHOLD}%)"
-                break
-            fi
+    # Skip the percentage check on the first run (no prior commit) and when
+    # the previous count is below the absolute floor — a 1→2 swing is 100% but
+    # meaningless on a tiny database. The PREV_COUNT > 0 guard also avoids the
+    # division-by-zero on line `DELTA=...` when the floor is set to 0 to
+    # disable the small-N skip.
+    if [ "$PREV_COUNT" -gt 0 ] && [ "$PREV_COUNT" -ge "$MIN_PREV_FOR_SPIKE_CHECK" ]; then
+        FILTERED_COUNT=$(count_jsonl_rows < "$DB_DIR/issues.jsonl")
+        DELTA=$(( (FILTERED_COUNT - PREV_COUNT) * 100 / PREV_COUNT ))
+        if [ "$DELTA" -lt 0 ]; then
+            DELTA=$(( -DELTA ))
         fi
+        if [ "$DELTA" -gt "$SPIKE_THRESHOLD" ]; then
+            HALTED=1
+            HALT_DB="$DB"
+            HALT_PREV_COUNT="$PREV_COUNT"
+            HALT_CURRENT_COUNT="$FILTERED_COUNT"
+            HALT_DELTA="$DELTA"
+            echo "jsonl-export: HALTED — spike in $DB (${DELTA}% > ${SPIKE_THRESHOLD}%)"
+            break
+        fi
+    fi
+done <<EOF
+$DATABASES
+EOF
+
+cd "$ARCHIVE_REPO"
+if [ "${#STAGE_PATHS[@]}" -gt 0 ]; then
+    if ! git add -A -- "${STAGE_PATHS[@]}"; then
+        discard_staged_archive_outputs
+        echo "jsonl-export: staging archive outputs failed" >&2
+        exit 1
     fi
-done
+fi
 
+# On HALT we still commit the new export so PREV_COUNT advances on the next
+# run — otherwise the same spike re-fires every cooldown and floods the inbox
+# (#1547 root cause #3). Push is skipped, so the spike snapshot stays local
+# until a later successful non-HALT run pushes the archive forward.
 if [ "$HALTED" -eq 1 ]; then
-    gc nudge deacon/ "DOG_DONE: jsonl — HALTED on spike detection" 2>/dev/null || true
+    if ! git diff --cached --quiet 2>/dev/null; then
+        EXPORTED_DBS=$((TOTAL_DBS - FAILED_DB_COUNT))
+        commit_archive_snapshot \
+            "[HALT] backup $(date -u +%Y-%m-%dT%H:%M:%SZ): exported=$EXPORTED_DBS/$TOTAL_DBS records=$TOTAL_EXPORTED (spike detected; push skipped)" \
+            "HALT baseline" || {
+            discard_staged_archive_outputs
+            exit 1
+        }
+        set_pending_archive_push
+    fi
+    set_pending_spike_alert "$HALT_DB" "$HALT_PREV_COUNT" "$HALT_CURRENT_COUNT" "$HALT_DELTA" "$SPIKE_THRESHOLD"
+    if send_spike_alert "$HALT_DB" "$HALT_PREV_COUNT" "$HALT_CURRENT_COUNT" "$HALT_DELTA" "$SPIKE_THRESHOLD"; then
+        clear_pending_spike_alert "$HALT_DB"
+    else
+        echo "jsonl-export: spike alert delivery failed; will retry from state" >&2
+    fi
+    gc session nudge deacon/ "DOG_DONE: jsonl — HALTED on spike detection" 2>/dev/null || true
     exit 0
 fi
 
-# Step 4: Commit and push.
-cd "$ARCHIVE_REPO"
-git add -A *.jsonl */ 2>/dev/null || true
-
 if git diff --cached --quiet 2>/dev/null; then
+    if has_pending_archive_push || archive_has_local_only_commits; then
+        PUSH_STATUS="ok"
+        if ! push_archive_main; then
+            PUSH_STATUS="failed"
+        fi
+        if [ -n "$FAILED_DBS" ]; then
+            EXPORTED_DBS=$((TOTAL_DBS - FAILED_DB_COUNT))
+            SUMMARY="jsonl — exported $EXPORTED_DBS/$TOTAL_DBS, records: $TOTAL_EXPORTED, push: $PUSH_STATUS, failed: $(printf '%s' "$FAILED_DBS" | tr '\n' ' ')"
+        else
+            SUMMARY="jsonl — no changes, push: $PUSH_STATUS"
+        fi
+        gc session nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
+        echo "jsonl-export: $SUMMARY"
+        exit 0
+    fi
+    if [ -n "$FAILED_DBS" ]; then
+        EXPORTED_DBS=$((TOTAL_DBS - FAILED_DB_COUNT))
+        SUMMARY="jsonl — exported $EXPORTED_DBS/$TOTAL_DBS, records: $TOTAL_EXPORTED, push: skipped, failed: $(printf '%s' "$FAILED_DBS" | tr '\n' ' ')"
+        gc session nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
+        echo "jsonl-export: $SUMMARY"
+        exit 0
+    fi
     # No changes.
-    gc nudge deacon/ "DOG_DONE: jsonl — no changes" 2>/dev/null || true
+    gc session nudge deacon/ "DOG_DONE: jsonl — no changes" 2>/dev/null || true
     exit 0
 fi
 
-EXPORTED_DBS=$((TOTAL_DBS - $(echo "$FAILED_DBS" | wc -w)))
-git commit -q -m "backup $(date -u +%Y-%m-%dT%H:%M:%SZ): exported=$EXPORTED_DBS/$TOTAL_DBS records=$TOTAL_EXPORTED" \
-    --author="Gas Town Daemon <daemon@gastown.local>" 2>/dev/null || true
+EXPORTED_DBS=$((TOTAL_DBS - FAILED_DB_COUNT))
+commit_archive_snapshot \
+    "backup $(date -u +%Y-%m-%dT%H:%M:%SZ): exported=$EXPORTED_DBS/$TOTAL_DBS records=$TOTAL_EXPORTED" \
+    "archive snapshot" || {
+    discard_staged_archive_outputs
+    exit 1
+}
+set_pending_archive_push
 
 PUSH_STATUS="ok"
-if ! git push origin main -q 2>/dev/null; then
+if ! push_archive_main; then
     PUSH_STATUS="failed"
-
-    # Track consecutive failures.
-    CONSECUTIVE=0
-    if [ -f "$STATE_FILE" ]; then
-        CONSECUTIVE=$(jq -r '.consecutive_push_failures // 0' "$STATE_FILE" 2>/dev/null || echo "0")
-    fi
-    CONSECUTIVE=$((CONSECUTIVE + 1))
-    echo "{\"consecutive_push_failures\": $CONSECUTIVE}" > "$STATE_FILE"
-
-    if [ "$CONSECUTIVE" -ge "$MAX_PUSH_FAILURES" ]; then
-        gc mail send mayor/ -s "ESCALATION: JSONL push failed [HIGH]" \
-            -m "Consecutive failures: $CONSECUTIVE (threshold: $MAX_PUSH_FAILURES)" \
-            2>/dev/null || true
-    fi
-else
-    # Reset failure counter on success.
-    if [ -f "$STATE_FILE" ]; then
-        echo '{"consecutive_push_failures": 0}' > "$STATE_FILE"
-    fi
 fi
 
 SUMMARY="jsonl — exported $EXPORTED_DBS/$TOTAL_DBS, records: $TOTAL_EXPORTED, push: $PUSH_STATUS"
 if [ -n "$FAILED_DBS" ]; then
-    SUMMARY="$SUMMARY, failed: $FAILED_DBS"
+    SUMMARY="$SUMMARY, failed: $(printf '%s' "$FAILED_DBS" | tr '\n' ' ')"
 fi
 
-gc nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
+gc session nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
 echo "jsonl-export: $SUMMARY"
diff --git a/examples/gastown/packs/maintenance/assets/scripts/orphan-sweep.sh b/examples/gastown/packs/maintenance/assets/scripts/orphan-sweep.sh
index b95317a361..0bb1bf572f 100755
--- a/examples/gastown/packs/maintenance/assets/scripts/orphan-sweep.sh
+++ b/examples/gastown/packs/maintenance/assets/scripts/orphan-sweep.sh
@@ -13,23 +13,43 @@ set -euo pipefail
 
 CITY="${GC_CITY:-.}"
 
-# Step 1: Get all in-progress beads with assignees.
-IN_PROGRESS=$(bd list --status=in_progress --json --limit=0 2>/dev/null) || exit 0
-if [ -z "$IN_PROGRESS" ] || [ "$IN_PROGRESS" = "[]" ]; then
+# Step 1: Collect in-progress beads from HQ and every rig.
+# `gc bd list` without --rig is HQ-scoped from the city cwd, so per-rig
+# beads are invisible to a bare query — walk every rig explicitly.
+TMP=$(mktemp) || exit 0
+trap 'rm -f "$TMP"' EXIT
+
+gc bd list --status=in_progress --json --limit=0 2>/dev/null >>"$TMP" || true
+
+RIG_LIST=$(gc rig list --json 2>/dev/null) || RIG_LIST=""
+if [ -n "$RIG_LIST" ]; then
+    RIG_NAMES=$(echo "$RIG_LIST" | jq -r '.rigs[] | select(.hq == false) | .name' 2>/dev/null) || RIG_NAMES=""
+    while IFS= read -r rig; do
+        [ -z "$rig" ] && continue
+        gc bd list --rig "$rig" --status=in_progress --json --limit=0 2>/dev/null >>"$TMP" || true
+    done <<<"$RIG_NAMES"
+fi
+
+IN_PROGRESS=$(jq -c -s 'add // []' "$TMP" 2>/dev/null) || IN_PROGRESS="[]"
+if [ "$IN_PROGRESS" = "[]" ]; then
     exit 0
 fi
 
-# Step 2: Get all known agent names (from config, scoped to [[agent]] blocks).
-AGENTS=$(gc config show 2>/dev/null | awk '/^\[\[agent\]\]/{a=1} a && /^\s*name\s*=/{print; a=0}' | sed 's/.*=\s*"\(.*\)"/\1/') || exit 0
+# Step 2: Get all known agent identities from resolved config.
+# `gc config explain` prints Agent.QualifiedName(), including import binding
+# and rig scope. Fall back to the older config-show parser for older binaries.
+AGENTS=$(gc config explain 2>/dev/null | awk '/^Agent: /{print $2}') || AGENTS=""
+if [ -z "$AGENTS" ]; then
+    AGENTS=$(gc config show 2>/dev/null | awk '/^\[\[agent\]\]/{a=1} a && /^[[:space:]]*name[[:space:]]*=/{print; a=0}' | sed 's/.*=[[:space:]]*"\(.*\)"/\1/') || exit 0
+fi
 if [ -z "$AGENTS" ]; then
     exit 0
 fi
 
-# Build a lookup set of known agents.
-declare -A KNOWN_AGENTS
-while IFS= read -r agent; do
-    KNOWN_AGENTS["$agent"]=1
-done <<< "$AGENTS"
+agent_exists() {
+    local candidate="$1"
+    [ -n "$candidate" ] && printf '%s\n' "$AGENTS" | grep -Fxq -- "$candidate"
+}
 
 # Step 3: Find orphaned beads (assigned to non-existent agents).
 # Pool instances use names like "worker-3"; strip the -N suffix to match
@@ -37,20 +57,35 @@ done <<< "$AGENTS"
 is_known_agent() {
     local name="$1"
     # Direct match.
-    if [ -n "${KNOWN_AGENTS[$name]+x}" ]; then return 0; fi
+    if agent_exists "$name"; then return 0; fi
     # Pool instance: strip trailing -<digits> and check template name.
     local base="${name%-[0-9]*}"
-    if [ "$base" != "$name" ] && [ -n "${KNOWN_AGENTS[$base]+x}" ]; then return 0; fi
+    if [ "$base" != "$name" ] && agent_exists "$base"; then return 0; fi
+    # City-qualified assignee (gastown.deacon): strip everything through the
+    # last dot and re-check. This relies on flattened pack binding chains.
+    # Defense-in-depth for older binaries that fall through to `gc config show`
+    # and emit unqualified names. Also covers pool patterns like
+    # "gastown.dog-3" by re-stripping the -N suffix.
+    local short="${name##*.}"
+    if [ "$short" != "$name" ]; then
+        if agent_exists "$short"; then return 0; fi
+        local short_base="${short%-[0-9]*}"
+        if [ "$short_base" != "$short" ] && agent_exists "$short_base"; then return 0; fi
+    fi
     return 1
 }
 
 ORPHANED=0
-echo "$IN_PROGRESS" | jq -r '.[] | select(.assignee != null and .assignee != "") | "\(.id)\t\(.assignee)"' 2>/dev/null | while IFS=$'\t' read -r bead_id assignee; do
+# Process substitution (not a pipe) keeps the loop body in the parent
+# shell so $ORPHANED survives for the summary message below.
+while IFS=$'\t' read -r bead_id assignee; do
     if ! is_known_agent "$assignee"; then
-        bd update "$bead_id" --status=open --assignee="" 2>/dev/null || true
+        # `gc bd update` auto-resolves the bead's prefix to the right rig
+        # store, so HQ and rig beads update in the correct database.
+        gc bd update "$bead_id" --status=open --assignee="" 2>/dev/null || true
         ORPHANED=$((ORPHANED + 1))
     fi
-done
+done < <(echo "$IN_PROGRESS" | jq -r '.[] | select(.assignee != null and .assignee != "") | "\(.id)\t\(.assignee)"' 2>/dev/null)
 
 if [ "$ORPHANED" -gt 0 ]; then
     echo "orphan-sweep: reset $ORPHANED orphaned beads"
diff --git a/examples/gastown/packs/maintenance/assets/scripts/reaper.sh b/examples/gastown/packs/maintenance/assets/scripts/reaper.sh
index 9f7446aadf..6babf71d6a 100755
--- a/examples/gastown/packs/maintenance/assets/scripts/reaper.sh
+++ b/examples/gastown/packs/maintenance/assets/scripts/reaper.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# reaper — reap stale wisps, purge old closed data, auto-close stale issues.
+# reaper — close stale wisps with closed parents, purge old closed data, auto-close stale issues.
 #
 # Replaces mol-dog-reaper formula. All operations are deterministic:
 # SQL queries with age thresholds, bd close/update commands, count
@@ -8,15 +8,16 @@
 # Runs as an exec order (no LLM, no agent, no wisp).
 set -euo pipefail
 
-CITY="${GC_CITY:-.}"
+CITY="${GC_CITY_PATH:-${GC_CITY:-.}}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 . "$SCRIPT_DIR/dolt-target.sh"
+CITY_ABS="$(cd "$CITY" 2>/dev/null && pwd -P || printf '%s\n' "$CITY")"
+CITY_BEADS_DIR="$CITY_ABS/.beads"
 
-# Configurable thresholds (defaults match the old formula).
+# Configurable thresholds.
 MAX_AGE="${GC_REAPER_MAX_AGE:-24h}"
 PURGE_AGE="${GC_REAPER_PURGE_AGE:-168h}"
 STALE_ISSUE_AGE="${GC_REAPER_STALE_ISSUE_AGE:-720h}"
-MAIL_DELETE_AGE="${GC_REAPER_MAIL_DELETE_AGE:-168h}"
 ALERT_THRESHOLD="${GC_REAPER_ALERT_THRESHOLD:-500}"
 DRY_RUN="${GC_REAPER_DRY_RUN:-}"
 
@@ -30,80 +31,387 @@ duration_to_hours() {
 MAX_AGE_H=$(duration_to_hours "$MAX_AGE")
 PURGE_AGE_H=$(duration_to_hours "$PURGE_AGE")
 STALE_AGE_H=$(duration_to_hours "$STALE_ISSUE_AGE")
-MAIL_AGE_H=$(duration_to_hours "$MAIL_DELETE_AGE")
 
-# Discover databases from Dolt server. Exclude Dolt/MySQL system schemas and
-# Gas City's internal health-probe database; remaining DBs are bead stores.
-DATABASES=$(dolt_sql -r csv -q "SHOW DATABASES" 2>/dev/null | tail -n +2 | grep -vi '^information_schema$\|^mysql$\|^dolt_cluster$\|^__gc_probe$' || true)
+CITY_DB_METADATA_RESULT=""
+
+city_database_name() {
+    local metadata="$CITY_BEADS_DIR/metadata.json"
+    local db=""
+    CITY_DB_METADATA_RESULT=""
+
+    if [ -f "$metadata" ]; then
+        if command -v jq >/dev/null 2>&1; then
+            if ! db=$(jq -er '.dolt_database // empty | strings' "$metadata" 2>/dev/null); then
+                return 0
+            fi
+        elif command -v python3 >/dev/null 2>&1; then
+            if ! db=$(python3 - "$metadata" 2>/dev/null <<'PY'
+import json
+import sys
+
+with open(sys.argv[1], encoding="utf-8") as f:
+    value = json.load(f).get("dolt_database", "")
+if isinstance(value, str) and value:
+    print(value)
+PY
+            ); then
+                return 0
+            fi
+        elif command -v grep >/dev/null 2>&1 && command -v sed >/dev/null 2>&1 && command -v head >/dev/null 2>&1; then
+            if grep -q '}' "$metadata" 2>/dev/null; then
+                db=$(grep -o '"dolt_database"[[:space:]]*:[[:space:]]*"[^"]*"' "$metadata" 2>/dev/null \
+                    | sed 's/.*"dolt_database"[[:space:]]*:[[:space:]]*"//;s/"//' \
+                    | head -1 || true)
+            fi
+        else
+            return 0
+        fi
+    fi
+
+    if [ -n "$db" ]; then
+        CITY_DB_METADATA_RESULT="$db"
+    fi
+}
+
+is_user_database() {
+    case "$1" in
+        information_schema|mysql|dolt_cluster|performance_schema|sys|__gc_probe|benchdb|testdb_*|beads_pt*|beads_vr*|doctest_*|doctortest_*)
+            return 1
+            ;;
+        beads_t*)
+            local suffix="${1#beads_t}"
+            if [[ "$suffix" =~ ^[0-9a-f]{8,}$ ]]; then
+                return 1
+            fi
+            return 0
+            ;;
+        *)
+            return 0
+            ;;
+    esac
+}
+
+# Discover databases from Dolt server. Exclude Dolt/MySQL system schemas,
+# Gas City's internal health-probe database, and test-fixture scratch
+# databases (benchdb, testdb_*, lowercase beads_t[0-9a-f]{8,}, beads_pt*,
+# beads_vr*, doctest_*, doctortest_* — matching the Go cleanup planner
+# contract); the remainder are bead stores.
+DATABASES=$(
+    while IFS= read -r db; do
+        if is_user_database "$db"; then
+            printf '%s\n' "$db"
+        fi
+    done < <(dolt_sql -r csv -q "SHOW DATABASES" 2>/dev/null | tail -n +2)
+)
 if [ -z "$DATABASES" ]; then
     # No databases accessible — nothing to do.
     exit 0
 fi
 
-TOTAL_REAPED=0
+TOTAL_STALE_WISPS=0
+TOTAL_CLOSED_WISPS=0
 TOTAL_PURGED=0
-TOTAL_MAIL_PURGED=0
 TOTAL_ISSUES_CLOSED=0
+TOTAL_STALE_ISSUES_SKIPPED=0
 ANOMALIES=""
 
-for DB in $DATABASES; do
-    # Step 1: Reap — close open wisps past max_age with closed/missing parent.
-    REAP_COUNT=$(dolt_sql -r csv -q "
-        SELECT COUNT(*) FROM \`$DB\`.wisps w
-        LEFT JOIN \`$DB\`.wisps parent ON w.parent_id = parent.id
-        WHERE w.status IN ('open', 'hooked', 'in_progress')
-        AND w.created_at < DATE_SUB(NOW(), INTERVAL $MAX_AGE_H HOUR)
-        AND (parent.id IS NULL OR parent.status = 'closed')
-    " 2>/dev/null | tail -1 || echo "0")
-
-    if [ "$REAP_COUNT" -gt 0 ] && [ -z "$DRY_RUN" ]; then
-        dolt_sql -q "
+sanitize_output() {
+    printf '%s' "$1" | tr '\n' ' ' | cut -c1-500
+}
+
+record_anomaly() {
+    local db="$1"
+    shift
+    ANOMALIES="${ANOMALIES}$db: $*
+"
+}
+
+CITY_DB_ANOMALY_RECORDED=0
+
+valid_database_identifier() {
+    local name="$1"
+
+    case "$name" in
+        ''|-*|*[!A-Za-z0-9_-]*)
+            return 1
+            ;;
+    esac
+
+    return 0
+}
+
+database_list_contains() {
+    local needle="$1"
+    local db
+
+    while IFS= read -r db; do
+        if [ "$db" = "$needle" ]; then
+            return 0
+        fi
+    done <<EOF
+$DATABASES
+EOF
+
+    return 1
+}
+
+CITY_DB=""
+CITY_DB_SOURCE="$CITY_BEADS_DIR/metadata.json"
+city_database_name
+CITY_METADATA_DB="$CITY_DB_METADATA_RESULT"
+
+if [ -n "${GC_REAPER_CITY_DATABASE:-}" ]; then
+    CITY_DB_SOURCE="GC_REAPER_CITY_DATABASE"
+    if [ -z "$CITY_METADATA_DB" ]; then
+        record_anomaly "city" "city database $GC_REAPER_CITY_DATABASE from GC_REAPER_CITY_DATABASE could not be verified against $CITY_BEADS_DIR/metadata.json; stale issue auto-close disabled"
+        CITY_DB_ANOMALY_RECORDED=1
+    elif [ "$GC_REAPER_CITY_DATABASE" != "$CITY_METADATA_DB" ]; then
+        record_anomaly "city" "city database $GC_REAPER_CITY_DATABASE from GC_REAPER_CITY_DATABASE does not match city metadata database $CITY_METADATA_DB; stale issue auto-close disabled"
+        CITY_DB_ANOMALY_RECORDED=1
+    else
+        CITY_DB="$GC_REAPER_CITY_DATABASE"
+    fi
+else
+    CITY_DB="$CITY_METADATA_DB"
+fi
+
+if [ -n "$CITY_DB" ] && ! valid_database_identifier "$CITY_DB"; then
+    record_anomaly "city" "city database $CITY_DB from $CITY_DB_SOURCE is not a safe Dolt identifier; stale issue auto-close disabled"
+    CITY_DB=""
+    CITY_DB_ANOMALY_RECORDED=1
+elif [ -n "$CITY_DB" ] && ! database_list_contains "$CITY_DB"; then
+    record_anomaly "city" "city database $CITY_DB from $CITY_DB_SOURCE was not found in discovered databases; stale issue auto-close disabled"
+    CITY_DB=""
+    CITY_DB_ANOMALY_RECORDED=1
+fi
+
+SQL_COUNT_RESULT=0
+get_sql_count() {
+    local db="$1"
+    local label="$2"
+    local query="$3"
+    local output
+    local stderr_file
+    local stderr_output
+    local count
+
+    SQL_COUNT_RESULT=0
+    if ! stderr_file=$(mktemp); then
+        record_anomaly "$db" "$label count failed for $db: could not create stderr capture file"
+        return 0
+    fi
+    if ! output=$(dolt_sql -r csv -q "$query" 2>"$stderr_file"); then
+        stderr_output=$(cat "$stderr_file" 2>/dev/null || true)
+        rm -f "$stderr_file"
+        record_anomaly "$db" "$label count failed for $db: $(sanitize_output "$output $stderr_output")"
+        return 0
+    fi
+    rm -f "$stderr_file"
+
+    count=$(printf '%s\n' "$output" | tail -1 | tr -d '\r')
+    if [ -z "$count" ] || ! [[ "$count" =~ ^[0-9]+$ ]]; then
+        record_anomaly "$db" "$label count returned non-numeric value for $db: $(sanitize_output "$output")"
+        return 0
+    fi
+
+    SQL_COUNT_RESULT="$count"
+}
+
+SQL_ROWS_RESULT=""
+get_sql_rows() {
+    local db="$1"
+    local label="$2"
+    local query="$3"
+    local output
+    local stderr_file
+    local stderr_output
+
+    SQL_ROWS_RESULT=""
+    if ! stderr_file=$(mktemp); then
+        record_anomaly "$db" "$label query failed for $db: could not create stderr capture file"
+        return 0
+    fi
+    if ! output=$(dolt_sql -r csv -q "$query" 2>"$stderr_file"); then
+        stderr_output=$(cat "$stderr_file" 2>/dev/null || true)
+        rm -f "$stderr_file"
+        record_anomaly "$db" "$label query failed for $db: $(sanitize_output "$output $stderr_output")"
+        return 0
+    fi
+    rm -f "$stderr_file"
+
+    SQL_ROWS_RESULT=$(printf '%s\n' "$output" | tail -n +2 | tr -d '\r')
+}
+
+SQL_CHANGE_ROWS_RESULT=0
+close_city_issue() {
+    local issue_id="$1"
+    local reason="$2"
+
+    if [ ! -d "$CITY_BEADS_DIR" ]; then
+        printf 'city bead store %s is unavailable' "$CITY_BEADS_DIR"
+        return 1
+    fi
+
+    (
+        cd "$CITY_ABS"
+        BEADS_DIR="$CITY_BEADS_DIR" bd close "$issue_id" --reason "$reason"
+    )
+}
+
+run_sql_change() {
+    local db="$1"
+    local label="$2"
+    local query="$3"
+    local output
+    local rows
+    local stderr_file
+    local stderr_output
+
+    SQL_CHANGE_ROWS_RESULT=0
+    if ! stderr_file=$(mktemp); then
+        record_anomaly "$db" "$label failed for $db: could not create stderr capture file"
+        return 1
+    fi
+    if ! output=$(dolt_sql -r csv -q "
+$query;
+SELECT ROW_COUNT();
+    " 2>"$stderr_file"); then
+        stderr_output=$(cat "$stderr_file" 2>/dev/null || true)
+        rm -f "$stderr_file"
+        record_anomaly "$db" "$label failed for $db: $(sanitize_output "$output $stderr_output")"
+        return 1
+    fi
+    stderr_output=$(cat "$stderr_file" 2>/dev/null || true)
+    rm -f "$stderr_file"
+
+    rows=$(printf '%s\n' "$output" | tail -1 | tr -d '\r')
+    if [ -z "$rows" ] || ! [[ "$rows" =~ ^[0-9]+$ ]]; then
+        record_anomaly "$db" "$label returned non-numeric row count for $db: $(sanitize_output "$output $stderr_output")"
+        return 1
+    fi
+
+    SQL_CHANGE_ROWS_RESULT="$rows"
+    return 0
+}
+
+while IFS= read -r DB; do
+    [ -z "$DB" ] && continue
+    if ! valid_database_identifier "$DB"; then
+        record_anomaly "$DB" "unsafe Dolt database identifier skipped by reaper"
+        continue
+    fi
+
+    DB_MUTATIONS=0
+
+    # Step 1: Count stale non-closed wisps, then close only candidates whose
+    # explicit parent-child edge points to a closed parent. Wisps
+    # without a parent edge are reported but not closed by age alone.
+    get_sql_count "$DB" "stale non-closed wisp" "
+        SELECT COUNT(*) FROM \`$DB\`.wisps
+        WHERE status IN ('open', 'hooked', 'in_progress')
+        AND created_at < DATE_SUB(NOW(), INTERVAL $MAX_AGE_H HOUR)
+    "
+    STALE_WISP_COUNT=$SQL_COUNT_RESULT
+
+    if [ "$STALE_WISP_COUNT" -gt 0 ]; then
+        TOTAL_STALE_WISPS=$((TOTAL_STALE_WISPS + STALE_WISP_COUNT))
+    fi
+
+    CLOSE_WISP_COUNT=0
+    DB_CLOSED_WISPS=0
+    DB_PURGED=0
+    while [ "$STALE_WISP_COUNT" -gt 0 ] && [ "$CLOSE_WISP_COUNT" -lt "$STALE_WISP_COUNT" ]; do
+        get_sql_count "$DB" "schema-safe stale wisp" "
+            SELECT COUNT(DISTINCT w.id) FROM \`$DB\`.wisps w
+            INNER JOIN \`$DB\`.dependencies d
+                ON d.issue_id = w.id
+                AND d.type = 'parent-child'
+            LEFT JOIN \`$DB\`.wisps parent_wisp ON d.depends_on_id = parent_wisp.id
+            LEFT JOIN \`$DB\`.issues parent_issue ON d.depends_on_id = parent_issue.id
+            WHERE w.status IN ('open', 'hooked', 'in_progress')
+            AND w.created_at < DATE_SUB(NOW(), INTERVAL $MAX_AGE_H HOUR)
+            AND (
+                parent_wisp.status = 'closed'
+                OR parent_issue.status = 'closed'
+            )
+        "
+        CLOSE_WISP_BATCH=$SQL_COUNT_RESULT
+        if [ "$CLOSE_WISP_BATCH" -eq 0 ] || [ -n "$DRY_RUN" ]; then
+            break
+        fi
+
+        if run_sql_change "$DB" "closing stale wisps" "
             UPDATE \`$DB\`.wisps SET status='closed', closed_at=NOW()
             WHERE status IN ('open', 'hooked', 'in_progress')
             AND created_at < DATE_SUB(NOW(), INTERVAL $MAX_AGE_H HOUR)
             AND id IN (
-                SELECT w.id FROM (SELECT * FROM \`$DB\`.wisps) w
-                LEFT JOIN \`$DB\`.wisps parent ON w.parent_id = parent.id
-                WHERE parent.id IS NULL OR parent.status = 'closed'
+                SELECT id FROM (
+                    SELECT w.id FROM \`$DB\`.wisps w
+                    INNER JOIN \`$DB\`.dependencies d
+                        ON d.issue_id = w.id
+                        AND d.type = 'parent-child'
+                    LEFT JOIN \`$DB\`.wisps parent_wisp ON d.depends_on_id = parent_wisp.id
+                    LEFT JOIN \`$DB\`.issues parent_issue ON d.depends_on_id = parent_issue.id
+                    WHERE w.status IN ('open', 'hooked', 'in_progress')
+                    AND w.created_at < DATE_SUB(NOW(), INTERVAL $MAX_AGE_H HOUR)
+                    AND (
+                        parent_wisp.status = 'closed'
+                        OR parent_issue.status = 'closed'
+                    )
+                ) reaper_wisp_candidates
             )
-        " 2>/dev/null || true
-        TOTAL_REAPED=$((TOTAL_REAPED + REAP_COUNT))
-    fi
+        "; then
+            CLOSE_WISP_ROWS=$SQL_CHANGE_ROWS_RESULT
+            if [ "$CLOSE_WISP_ROWS" -eq 0 ]; then
+                break
+            fi
+            CLOSE_WISP_COUNT=$((CLOSE_WISP_COUNT + CLOSE_WISP_ROWS))
+            DB_CLOSED_WISPS=$((DB_CLOSED_WISPS + CLOSE_WISP_ROWS))
+            TOTAL_CLOSED_WISPS=$((TOTAL_CLOSED_WISPS + CLOSE_WISP_ROWS))
+            DB_MUTATIONS=$((DB_MUTATIONS + CLOSE_WISP_ROWS))
+        else
+            break
+        fi
+    done
 
     # Step 2: Purge — delete closed wisps past purge_age.
-    PURGE_COUNT=$(dolt_sql -r csv -q "
+    get_sql_count "$DB" "closed wisp purge" "
         SELECT COUNT(*) FROM \`$DB\`.wisps
         WHERE status = 'closed'
         AND closed_at < DATE_SUB(NOW(), INTERVAL $PURGE_AGE_H HOUR)
-    " 2>/dev/null | tail -1 || echo "0")
+        AND id NOT IN (
+            SELECT DISTINCT d.depends_on_id FROM \`$DB\`.dependencies d
+            INNER JOIN \`$DB\`.wisps child_wisp ON d.issue_id = child_wisp.id
+            WHERE d.type = 'parent-child'
+            AND d.depends_on_id IS NOT NULL
+            AND child_wisp.status IN ('open', 'hooked', 'in_progress')
+        )
+    "
+    PURGE_COUNT=$SQL_COUNT_RESULT
 
     if [ "$PURGE_COUNT" -gt 0 ] && [ -z "$DRY_RUN" ]; then
-        dolt_sql -q "
+        if run_sql_change "$DB" "purging closed wisps" "
             DELETE FROM \`$DB\`.wisps
             WHERE status = 'closed'
             AND closed_at < DATE_SUB(NOW(), INTERVAL $PURGE_AGE_H HOUR)
-        " 2>/dev/null || true
-        TOTAL_PURGED=$((TOTAL_PURGED + PURGE_COUNT))
-    fi
-
-    # Step 3: Purge closed mail past mail_delete_age.
-    MAIL_COUNT=$(dolt_sql -r csv -q "
-        SELECT COUNT(*) FROM \`$DB\`.mail
-        WHERE status = 'closed'
-        AND closed_at < DATE_SUB(NOW(), INTERVAL $MAIL_AGE_H HOUR)
-    " 2>/dev/null | tail -1 || echo "0")
-
-    if [ "$MAIL_COUNT" -gt 0 ] && [ -z "$DRY_RUN" ]; then
-        dolt_sql -q "
-            DELETE FROM \`$DB\`.mail
-            WHERE status = 'closed'
-            AND closed_at < DATE_SUB(NOW(), INTERVAL $MAIL_AGE_H HOUR)
-        " 2>/dev/null || true
-        TOTAL_MAIL_PURGED=$((TOTAL_MAIL_PURGED + MAIL_COUNT))
+            AND id NOT IN (
+                SELECT DISTINCT d.depends_on_id FROM \`$DB\`.dependencies d
+                INNER JOIN \`$DB\`.wisps child_wisp ON d.issue_id = child_wisp.id
+                WHERE d.type = 'parent-child'
+                AND d.depends_on_id IS NOT NULL
+                AND child_wisp.status IN ('open', 'hooked', 'in_progress')
+            )
+        "; then
+            PURGED_ROWS=$SQL_CHANGE_ROWS_RESULT
+            DB_PURGED=$((DB_PURGED + PURGED_ROWS))
+            TOTAL_PURGED=$((TOTAL_PURGED + PURGED_ROWS))
+            DB_MUTATIONS=$((DB_MUTATIONS + PURGED_ROWS))
+        fi
     fi
 
     # Step 4: Auto-close stale issues (exclude P0/P1, epics, active deps).
-    STALE_IDS=$(dolt_sql -r csv -q "
+    DB_ISSUES_CLOSED=0
+    get_sql_rows "$DB" "stale issue" "
         SELECT id FROM \`$DB\`.issues
         WHERE status IN ('open', 'in_progress')
         AND updated_at < DATE_SUB(NOW(), INTERVAL $STALE_AGE_H HOUR)
@@ -118,44 +426,78 @@ for DB in $DATABASES; do
             INNER JOIN \`$DB\`.issues i ON d.issue_id = i.id
             WHERE i.status IN ('open', 'in_progress')
         )
-    " 2>/dev/null | tail -n +2 || true)
+    "
+    STALE_IDS=$SQL_ROWS_RESULT
 
     if [ -n "$STALE_IDS" ] && [ -z "$DRY_RUN" ]; then
-        while IFS= read -r issue_id; do
-            [ -z "$issue_id" ] && continue
-            bd close "$issue_id" --reason "stale:auto-closed by reaper" 2>/dev/null || true
-            TOTAL_ISSUES_CLOSED=$((TOTAL_ISSUES_CLOSED + 1))
-        done <<< "$STALE_IDS"
+        if [ -z "$CITY_DB" ]; then
+            if [ "$CITY_DB_ANOMALY_RECORDED" -eq 0 ]; then
+                record_anomaly "city" "city database could not be determined from GC_REAPER_CITY_DATABASE or $CITY/.beads/metadata.json; stale issue auto-close disabled"
+                CITY_DB_ANOMALY_RECORDED=1
+            fi
+            SKIPPED_ISSUES=$(printf '%s\n' "$STALE_IDS" | sed '/^[[:space:]]*$/d' | wc -l | tr -d ' ')
+            TOTAL_STALE_ISSUES_SKIPPED=$((TOTAL_STALE_ISSUES_SKIPPED + SKIPPED_ISSUES))
+        elif [ "$DB" != "$CITY_DB" ]; then
+            SKIPPED_ISSUES=$(printf '%s\n' "$STALE_IDS" | sed '/^[[:space:]]*$/d' | wc -l | tr -d ' ')
+            TOTAL_STALE_ISSUES_SKIPPED=$((TOTAL_STALE_ISSUES_SKIPPED + SKIPPED_ISSUES))
+        else
+            while IFS= read -r issue_id; do
+                [ -z "$issue_id" ] && continue
+                if CLOSE_OUTPUT=$(close_city_issue "$issue_id" "stale:auto-closed by reaper" 2>&1); then
+                    DB_ISSUES_CLOSED=$((DB_ISSUES_CLOSED + 1))
+                    TOTAL_ISSUES_CLOSED=$((TOTAL_ISSUES_CLOSED + 1))
+                    DB_MUTATIONS=$((DB_MUTATIONS + 1))
+                else
+                    record_anomaly "$DB" "closing stale issue $issue_id failed for $DB: $(sanitize_output "$CLOSE_OUTPUT")"
+                fi
+            done <<< "$STALE_IDS"
+        fi
     fi
 
     # Step 5: Anomaly check — open wisp count.
-    OPEN_WISPS=$(dolt_sql -r csv -q "
+    get_sql_count "$DB" "open wisp" "
         SELECT COUNT(*) FROM \`$DB\`.wisps
         WHERE status IN ('open', 'hooked', 'in_progress')
-    " 2>/dev/null | tail -1 || echo "0")
+    "
+    OPEN_WISPS=$SQL_COUNT_RESULT
 
     if [ "$OPEN_WISPS" -gt "$ALERT_THRESHOLD" ]; then
         ANOMALIES="${ANOMALIES}$DB: $OPEN_WISPS open wisps (threshold: $ALERT_THRESHOLD)\n"
     fi
 
-    # Commit Dolt changes.
-    if [ -z "$DRY_RUN" ]; then
-        dolt_sql -q "
-            SELECT DOLT_COMMIT('-Am', 'reaper: reaped=$REAP_COUNT purged=$PURGE_COUNT mail=$MAIL_COUNT stale=$TOTAL_ISSUES_CLOSED', '--author', 'reaper <reaper@gastown.local>')
-        " 2>/dev/null || true
+    # Commit Dolt changes. Must use CALL (not SELECT) and have an active
+    # database via USE so CALL DOLT_COMMIT(...) runs in the target database.
+    # Commit failures are surfaced as anomalies so the dog loop does not
+    # silently retry forever.
+    if [ -z "$DRY_RUN" ] && [ "$DB_MUTATIONS" -gt 0 ]; then
+        if ! COMMIT_OUTPUT=$(dolt_sql -q "
+            USE \`$DB\`;
+            CALL DOLT_COMMIT('-Am', 'reaper: stale_wisps=$STALE_WISP_COUNT closed_wisps=$DB_CLOSED_WISPS purged=$DB_PURGED stale_issues=$DB_ISSUES_CLOSED', '--author', 'reaper <reaper@gastown.local>')
+        " 2>&1); then
+            case "$COMMIT_OUTPUT" in
+                *"nothing to commit"*|*"Nothing to commit"*)
+                    :
+                    ;;
+                *)
+                    record_anomaly "$DB" "Dolt commit failed for $DB: $(sanitize_output "$COMMIT_OUTPUT")"
+                    ;;
+            esac
+        fi
     fi
-done
+done <<EOF
+$DATABASES
+EOF
 
 # Report.
 if [ -n "$ANOMALIES" ]; then
     gc mail send mayor/ -s "ESCALATION: Reaper anomalies detected [MEDIUM]" \
-        -m "$(echo -e "$ANOMALIES")" 2>/dev/null || true
+        -m "$ANOMALIES" 2>/dev/null || true
 fi
 
-SUMMARY="reaper — reaped:$TOTAL_REAPED, purged:$TOTAL_PURGED, mail:$TOTAL_MAIL_PURGED, closed:$TOTAL_ISSUES_CLOSED"
+SUMMARY="reaper — stale_wisps:$TOTAL_STALE_WISPS, closed_wisps:$TOTAL_CLOSED_WISPS, purged:$TOTAL_PURGED, closed:$TOTAL_ISSUES_CLOSED, skipped_non_city_issues:$TOTAL_STALE_ISSUES_SKIPPED"
 if [ -n "$DRY_RUN" ]; then
     SUMMARY="$SUMMARY (dry run)"
 fi
 
-gc nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
+gc session nudge deacon/ "DOG_DONE: $SUMMARY" 2>/dev/null || true
 echo "reaper: $SUMMARY"
diff --git a/examples/gastown/packs/maintenance/assets/scripts/wisp-compact.sh b/examples/gastown/packs/maintenance/assets/scripts/wisp-compact.sh
index e3529af6aa..7305b902cf 100755
--- a/examples/gastown/packs/maintenance/assets/scripts/wisp-compact.sh
+++ b/examples/gastown/packs/maintenance/assets/scripts/wisp-compact.sh
@@ -31,8 +31,14 @@ PROMOTED=0
 DELETED=0
 SKIPPED=0
 
-# Process each ephemeral bead.
-echo "$EPHEMERALS" | jq -c '.[]' 2>/dev/null | while IFS= read -r bead; do
+# Process each ephemeral bead. Capturing jq output into BEADS first
+# (instead of piping into the loop) preserves the original pipefail
+# fail-loud on jq error AND keeps PROMOTED/DELETED/SKIPPED in the parent
+# shell so they survive to the summary echo below. EPHEMERALS is
+# pre-validated as a non-empty array on lines 22-27, so BEADS is
+# guaranteed non-empty here.
+BEADS=$(echo "$EPHEMERALS" | jq -c '.[]' 2>/dev/null)
+while IFS= read -r bead; do
     id=$(echo "$bead" | jq -r '.id')
     status=$(echo "$bead" | jq -r '.status')
     updated_at=$(echo "$bead" | jq -r '.updated_at // .created_at')
@@ -50,8 +56,13 @@ echo "$EPHEMERALS" | jq -c '.[]' 2>/dev/null | while IFS= read -r bead; do
         esac
     done
 
-    # Calculate age.
-    BEAD_TS=$(date -d "$updated_at" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%S" "$updated_at" +%s 2>/dev/null) || continue
+    # Calculate age. bd emits RFC3339 timestamps with a trailing 'Z'; the
+    # second BSD `date -j -f` fallback handles that explicitly because the
+    # third (no-Z) layout rejects it. GNU `date -d` is lenient and accepts
+    # both forms via the first fallback.
+    BEAD_TS=$(date -d "$updated_at" +%s 2>/dev/null || \
+              date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s 2>/dev/null || \
+              date -j -f "%Y-%m-%dT%H:%M:%S" "$updated_at" +%s 2>/dev/null) || continue
     AGE=$((NOW - BEAD_TS))
 
     # Skip if within TTL (unless force-promote via keep label).
@@ -73,7 +84,7 @@ echo "$EPHEMERALS" | jq -c '.[]' 2>/dev/null | while IFS= read -r bead; do
     # Closed + past TTL + no special attributes → delete.
     bd delete "$id" --force 2>/dev/null || true
     DELETED=$((DELETED + 1))
-done
+done <<< "$BEADS"
 
 TOTAL=$((PROMOTED + DELETED))
 if [ "$TOTAL" -gt 0 ]; then
diff --git a/examples/gastown/packs/maintenance/formulas/mol-dog-jsonl.toml b/examples/gastown/packs/maintenance/formulas/mol-dog-jsonl.toml
index dbd65fcd7f..7bf073b79f 100644
--- a/examples/gastown/packs/maintenance/formulas/mol-dog-jsonl.toml
+++ b/examples/gastown/packs/maintenance/formulas/mol-dog-jsonl.toml
@@ -105,14 +105,15 @@ Remove records matching test patterns from exported JSONL:
 Compare current export record counts against previous commit.
 
 **3. Evaluate results:**
-- If delta > {{spike_threshold}} (default 20%) for ANY database -> HALT
+- If delta > {{spike_threshold}} (default 20%) for ANY database -> HALT after
+  committing the refreshed export locally so the baseline advances
 - Log anomalies: sudden jumps = pollution, sudden drops = data loss
 - Escalate to Mayor:
   ```bash
   gc mail send mayor/ -s "ESCALATION: JSONL spike detected [HIGH]" \\
     -m "Database: <db>, delta: <pct>%, threshold: {{spike_threshold}}"
   ```
-- Do NOT proceed to commit/push
+- Skip push so the spike snapshot stays local until a later successful run
 
 **4. First export:**
 Skip verification when no baseline exists (previous commit has no file).
@@ -126,6 +127,9 @@ needs = ["verify"]
 description = """
 Stage, commit, and push JSONL files to the archive repository.
 
+If the verify step halts on a spike, this push step is skipped because the
+HALT path already wrote a local baseline-advance commit.
+
 **1. Stage changes:**
 ```bash
 git -C <git_repo> add -A *.jsonl */
@@ -176,7 +180,7 @@ Generate summary and signal completion.
 
 **2. Signal completion:**
 ```bash
-gc nudge deacon/ "DOG_DONE: jsonl — exported <count>/<total>, push: <status>"
+gc session nudge deacon/ "DOG_DONE: jsonl — exported <count>/<total>, push: <status>"
 ```
 
 **3. Close work and exit:**
diff --git a/examples/gastown/packs/maintenance/formulas/mol-dog-reaper.toml b/examples/gastown/packs/maintenance/formulas/mol-dog-reaper.toml
index 343b9e766b..8c23f68113 100644
--- a/examples/gastown/packs/maintenance/formulas/mol-dog-reaper.toml
+++ b/examples/gastown/packs/maintenance/formulas/mol-dog-reaper.toml
@@ -1,25 +1,42 @@
 description = """
-Reap stale wisps and close stale issues across all Dolt databases.
+Reap stale wisps across Dolt databases and close stale issues in the city DB.
 
-The Reaper Dog closes wisps past their retention age, purges closed wisps
-and mail older than the purge threshold, and auto-closes stale issues.
-This keeps the wisp and mail tables from growing unbounded.
+The Reaper Dog closes stale non-closed wisps only when parent-child
+dependency data proves the parent is closed, purges closed wisps
+older than the purge threshold, and auto-closes stale issues only in the city
+database where `bd close` is correctly scoped. This keeps the wisps table from
+growing unbounded without closing active wisps by age alone.
 
 Current behavior:
-- Closes open/hooked/in_progress wisps older than max_age (default 24h)
-  whose parent molecule is closed or missing
-- Purges (deletes) closed wisps past purge_age (default 3 days)
-- Purges closed mail past mail_delete_age (default 3 days)
-- Auto-closes stale issues open >7 days with no status change
+- Observes open/hooked/in_progress wisps older than max_age (default 24h)
+- Closes only the subset whose parent-child dependency points to a closed
+  parent
+- Purges (deletes) closed wisps past purge_age (default 7 days)
+- Auto-closes stale city issues open >30 days with no status change
+- Reports stale issue candidates in non-city databases without closing them
 - Alerts if open wisp count exceeds threshold (500)
 
+Mail is NOT a SQL table — mail messages are beads (Type=message). Any
+mail cleanup must go through `bd`, never Dolt. BD-backed mail retention is
+tracked separately as `ga-w9jfl5`; until that lands, Reaper intentionally does
+not delete mail. Wisp parentage is no longer carried on the wisps row; it
+lives in `dependencies` rows with `type='parent-child'`. For the Dolt-backed
+bead store, `ParentID` is a projection from those parent-child dependencies,
+not a separate `parent_id` column for Reaper to query. Non-closed wisps without
+that parentage signal are reported only; they are not closed by age alone.
+Legacy `mail_delete_age` overrides do not apply to Reaper and should be
+removed or moved to the BD-backed mail cleanup tool. Legacy `databases`
+overrides from earlier formula drafts are also no longer accepted; the script
+auto-discovers production bead databases from Dolt and filters known scratch
+database patterns.
+
 ## Dog Contract
 
 This is infrastructure work. You:
 1. Scan all production databases for candidates
-2. Reap (close) wisps past max_age whose parent is closed/missing
-3. Purge (delete) closed wisps past purge_age + old closed mail
-4. Auto-close stale issues (with exclusions)
+2. Report non-closed wisps past max_age and close only wisps whose parent is closed
+3. Purge (delete) closed wisps past purge_age
+4. Auto-close stale city issues (with exclusions)
 5. Report findings and flag anomalies
 6. Return to kennel
 
@@ -27,28 +44,39 @@ This is infrastructure work. You:
 
 | Variable | Source | Description |
 |----------|--------|-------------|
-| max_age | config | Max wisp age before reaping (default 24h) |
-| purge_age | config | Max closed wisp age before purging (default 3d) |
-| stale_issue_age | config | Max issue staleness before auto-close (default 7d) |
-| mail_delete_age | config | Max closed mail age before purging (default 3d) |
+| max_age | config | Max non-closed wisp age before reporting/parent-safe close (default 24h) |
+| purge_age | config | Max closed wisp age before purging (default 7d) |
+| stale_issue_age | config | Max issue staleness before auto-close (default 30d) |
 | alert_threshold | config | Open wisp count that triggers escalation (default 500) |
 | dry_run | config | If "true", report without acting |
-| databases | config | Comma-separated DB list (empty = auto-discover) |
 | dolt_port | config | Dolt server port (default 3307) |
 
+The duration variables are Go duration strings in configuration. The exec
+script normalizes them to integer hour values before building Dolt SQL, so SQL
+examples below use `<max_age_hours>`, `<purge_age_hours>`, and
+`<stale_issue_age_hours>` placeholders.
+
 ## Safety
 
-Reaping closes wisps — reversible (can reopen). Purging deletes rows —
-irreversible but only targets already-closed wisps past retention.
-Auto-close excludes P0/P1, epics, and issues with active dependencies.
+Non-closed wisps are closed only when a parent-child dependency points to a
+closed parent. Wisps without a parent-child edge, or with an unresolved parent
+record, are observed, not closed by age alone. Purging deletes rows —
+irreversible but only targets already-closed wisps past retention. Auto-close
+excludes P0/P1, epics, and issues with active dependencies. Non-city database
+issue candidates are report-only until the maintenance pack has an explicit
+DB-to-`BEADS_DIR` routing map for scoped `bd close`. If the canonical city
+database cannot be resolved from bead metadata, a `GC_REAPER_CITY_DATABASE`
+override does not match that metadata, or the resolved database is not present
+in the discovered database list, stale issue auto-close is disabled for that
+run and reported as an anomaly.
 
 ## Anomaly Detection
 
 The Dog should watch for and flag:
-- Dangling parent references (wisps referencing purged parents)
-- Sudden spikes in reap candidates (suggests a wisp lifecycle problem)
+- Sudden spikes in stale non-closed wisps (suggests a wisp lifecycle problem)
 - Open wisp counts exceeding alert_threshold
-- Dolt commit failures (data may not be persisted)
+- Dolt commit failures except benign no-op races where another process already
+  committed the counted change
 
 Read each step's description before acting — Config values override defaults."""
 formula = "mol-dog-reaper"
@@ -57,20 +85,16 @@ contract = "graph.v2"
 
 [vars]
 [vars.max_age]
-description = "Max wisp age before reaping (e.g., '24h')"
+description = "Max non-closed wisp age before reporting (e.g., '24h')"
 default = "24h"
 
 [vars.purge_age]
-description = "Max closed wisp age before purging (e.g., '72h' = 3 days)"
-default = "72h"
-
-[vars.stale_issue_age]
-description = "Max issue staleness before auto-close (e.g., '168h' = 7 days)"
+description = "Max closed wisp age before purging (e.g., '168h' = 7 days)"
 default = "168h"
 
-[vars.mail_delete_age]
-description = "Max closed mail age before purging (e.g., '72h' = 3 days)"
-default = "72h"
+[vars.stale_issue_age]
+description = "Max issue staleness before auto-close (e.g., '720h' = 30 days)"
+default = "720h"
 
 [vars.alert_threshold]
 description = "Open wisp count that triggers escalation warning"
@@ -80,10 +104,6 @@ default = "500"
 description = "If 'true', report without modifying data"
 default = ""
 
-[vars.databases]
-description = "Comma-separated database names (empty = auto-discover)"
-default = ""
-
 [vars.dolt_port]
 description = "Dolt server port"
 default = "3307"
@@ -95,36 +115,53 @@ description = """
 Discover databases and count candidates for each operation.
 
 **1. Determine databases to scan:**
-Use configured database list from {{databases}}, or auto-discover from Dolt server
-on port {{dolt_port}}.
+Auto-discover production databases from the Dolt server on port {{dolt_port}}.
 
 **2. For each database, count candidates:**
 ```sql
--- Open wisps past max_age with closed/missing parent (reap candidates)
-SELECT COUNT(*) FROM wisps w
-LEFT JOIN wisps parent ON w.parent_id = parent.id
+-- Non-closed wisps past max_age (reported)
+SELECT COUNT(*) FROM wisps
+WHERE status IN ('open', 'hooked', 'in_progress')
+AND created_at < DATE_SUB(NOW(), INTERVAL <max_age_hours> HOUR);
+
+-- Schema-safe close candidates: stale child wisps with closed parent
+SELECT COUNT(DISTINCT w.id) FROM wisps w
+INNER JOIN dependencies d
+  ON d.issue_id = w.id
+  AND d.type = 'parent-child'
+LEFT JOIN wisps parent_wisp ON d.depends_on_id = parent_wisp.id
+LEFT JOIN issues parent_issue ON d.depends_on_id = parent_issue.id
 WHERE w.status IN ('open', 'hooked', 'in_progress')
-AND w.created_at < NOW() - INTERVAL {{max_age}}
-AND (parent.id IS NULL OR parent.status = 'closed');
+AND w.created_at < DATE_SUB(NOW(), INTERVAL <max_age_hours> HOUR)
+AND (
+  parent_wisp.status = 'closed'
+  OR parent_issue.status = 'closed'
+);
+-- Repeat the count/update pair until this returns zero so multi-level stale
+-- child chains converge in one reaper run.
 
 -- Closed wisps past purge_age (purge candidates)
 SELECT COUNT(*) FROM wisps
 WHERE status = 'closed'
-AND closed_at < NOW() - INTERVAL {{purge_age}};
-
--- Closed mail past mail_delete_age (mail purge candidates)
-SELECT COUNT(*) FROM mail
-WHERE status = 'closed'
-AND closed_at < NOW() - INTERVAL {{mail_delete_age}};
+AND closed_at < DATE_SUB(NOW(), INTERVAL <purge_age_hours> HOUR)
+AND id NOT IN (
+  SELECT DISTINCT d.depends_on_id FROM dependencies d
+  INNER JOIN wisps child_wisp ON d.issue_id = child_wisp.id
+  WHERE d.type = 'parent-child'
+  AND d.depends_on_id IS NOT NULL
+  AND child_wisp.status IN ('open', 'hooked', 'in_progress')
+);
 
 -- Total open wisps (for alert threshold)
 SELECT COUNT(*) FROM wisps
 WHERE status IN ('open', 'hooked', 'in_progress');
 ```
 
+Mail is not a SQL table — do not query it via Dolt. Mail messages are
+beads with Type=message; any mail cleanup goes through `bd`.
+
 **3. Check for anomalies:**
-- Dangling parent references: wisps whose parent_id points to a missing row
-- Sudden spikes in reap candidates vs previous cycle
+- Sudden spikes in stale non-closed wisps vs previous cycle
 - Open wisp count exceeding {{alert_threshold}}
 
 **4. Decide whether to proceed:**
@@ -135,77 +172,114 @@ WHERE status IN ('open', 'hooked', 'in_progress');
 
 [[steps]]
 id = "reap"
-title = "Reap stale wisps"
+title = "Close stale wisps with closed parents"
 needs = ["scan"]
 description = """
-Close wisps past max_age whose parent molecule is closed or missing.
+Report wisps past max_age and close only the schema-safe subset whose
+parent-child dependency points to a closed parent.
+
+Wisp parentage no longer lives on the wisps row (the schema has no
+`parent_id` column); parentage is in `dependencies` rows with
+`type='parent-child'`. The SDK `ParentID` field is projected from those rows
+for Dolt-backed beads. Do not close non-closed wisps by age alone.
+`wisp-compact.sh` promotes non-closed wisps past TTL for stuck detection.
+The close step repeats until no schema-safe candidates remain, so a stale
+multi-level child chain whose root is closed converges in one reaper run.
+
+**1. For each database with stale non-closed wisps:**
+```sql
+SELECT COUNT(*) FROM wisps
+WHERE status IN ('open', 'hooked', 'in_progress')
+AND created_at < DATE_SUB(NOW(), INTERVAL <max_age_hours> HOUR);
+```
 
-**1. For each database with reap candidates:**
+**2. Close only stale wisps with closed parents, repeating to a fixpoint:**
 ```sql
 UPDATE wisps SET status='closed', closed_at=NOW()
 WHERE status IN ('open', 'hooked', 'in_progress')
-AND created_at < NOW() - INTERVAL {{max_age}}
+AND created_at < DATE_SUB(NOW(), INTERVAL <max_age_hours> HOUR)
 AND id IN (
-  SELECT w.id FROM wisps w
-  LEFT JOIN wisps parent ON w.parent_id = parent.id
-  WHERE parent.id IS NULL OR parent.status = 'closed'
+  SELECT id FROM (
+    SELECT w.id FROM wisps w
+    INNER JOIN dependencies d
+      ON d.issue_id = w.id
+      AND d.type = 'parent-child'
+    LEFT JOIN wisps parent_wisp ON d.depends_on_id = parent_wisp.id
+    LEFT JOIN issues parent_issue ON d.depends_on_id = parent_issue.id
+    WHERE w.status IN ('open', 'hooked', 'in_progress')
+    AND w.created_at < DATE_SUB(NOW(), INTERVAL <max_age_hours> HOUR)
+    AND (
+      parent_wisp.status = 'closed'
+      OR parent_issue.status = 'closed'
+    )
+  ) reaper_wisp_candidates
 );
 ```
 
-**2. Record results:**
-- Count reaped per database
+**3. Record results:**
+- Count stale non-closed wisps per database
+- Count closed-parent stale wisps closed per database
 - Any errors encountered
 
-**3. Alert check:**
+**4. Alert check:**
 If total open wisps across all databases exceed {{alert_threshold}},
 log a warning and consider escalating.
 
-**Exit criteria:** All stale wisps closed."""
+**Exit criteria:** Stale non-closed wisps counted; only stale wisps with closed parents closed."""
 
 [[steps]]
 id = "purge"
-title = "Purge old closed wisps and mail"
+title = "Purge old closed wisps"
 needs = ["reap"]
 description = """
-Delete closed wisps past purge_age and closed mail past mail_delete_age.
+Delete closed wisps past purge_age.
 
 **1. Purge closed wisps for each database:**
 ```sql
 DELETE FROM wisps
 WHERE status = 'closed'
-AND closed_at < NOW() - INTERVAL {{purge_age}};
-```
-
-**2. Purge closed mail for each database:**
-```sql
-DELETE FROM mail
-WHERE status = 'closed'
-AND closed_at < NOW() - INTERVAL {{mail_delete_age}};
+AND closed_at < DATE_SUB(NOW(), INTERVAL <purge_age_hours> HOUR)
+AND id NOT IN (
+  SELECT DISTINCT d.depends_on_id FROM dependencies d
+  INNER JOIN wisps child_wisp ON d.issue_id = child_wisp.id
+  WHERE d.type = 'parent-child'
+  AND d.depends_on_id IS NOT NULL
+  AND child_wisp.status IN ('open', 'hooked', 'in_progress')
+);
 ```
 
-**3. Check for anomalies:**
+**2. Check for anomalies:**
 - Verify Dolt commit succeeded (data may not be persisted if commit fails)
 - Check purge counts are reasonable (not suspiciously high or low)
 
-**Safety:** Only deletes wisps/mail that are already closed AND past the
-retention window. Active wisps are never touched. Reverse dependency
-references are cleaned up to prevent dangling parent refs.
+**Safety:** Only deletes wisps that are already closed AND past the
+retention window, and never deletes a closed parent wisp while any
+non-closed child wisp still depends on it. Active wisps are never touched.
+Mail messages live as beads (Type=message), not in a SQL table — use `bd`
+for any mail cleanup, never DELETE FROM mail.
 
-**Exit criteria:** Old closed wisps and mail purged."""
+**Exit criteria:** Old closed wisps purged."""
 
 [[steps]]
 id = "auto-close"
-title = "Auto-close stale issues"
+title = "Auto-close stale city issues"
 needs = ["purge"]
 description = """
-Close issues that have been open with no status change past stale_issue_age.
+Close city-scoped issues that have been open with no status change past
+stale_issue_age. Rig/non-city database candidates are report-only because a
+bare `bd close` is scoped to the city store and must not be used for other
+databases. If the city database identity is unavailable, a
+`GC_REAPER_CITY_DATABASE` override does not match bead metadata, or the
+resolved database is not present in the discovered database list, skip all
+stale issue auto-close mutations and escalate the missing/invalid identity as
+an anomaly.
 
 **1. For each production database, find stale issues:**
 ```sql
 -- Candidates: open past stale_issue_age, not updated, not P0/P1, not epic
 SELECT id, title, updated_at FROM issues
 WHERE status IN ('open', 'in_progress')
-AND updated_at < NOW() - INTERVAL {{stale_issue_age}}
+AND updated_at < DATE_SUB(NOW(), INTERVAL <stale_issue_age_hours> HOUR)
 AND priority > 1
 AND issue_type != 'epic'
 AND id NOT IN (
@@ -220,14 +294,17 @@ AND id NOT IN (
 )
 ```
 
-**2. Close each candidate** with reason 'stale:auto-closed by reaper'.
+**2. Close each city database candidate** with reason
+'stale:auto-closed by reaper'. For non-city databases, report the candidate
+count only and do not call `bd close`.
 
 **3. Verify exclusions are working** — P0/P1, epics, and dependency-linked
 issues should never be auto-closed.
 
-**4. Record total closed for report.**
+**4. Record total closed and non-city skipped candidates for report.**
 
-**Exit criteria:** All eligible stale issues auto-closed."""
+**Exit criteria:** All eligible city stale issues auto-closed; non-city stale
+issue candidates reported without mutation."""
 
 [[steps]]
 id = "report"
@@ -238,10 +315,11 @@ Generate summary and signal completion.
 
 **1. Generate report summary:**
 - Databases scanned
-- Wisps reaped (closed stale open wisps)
+- Stale non-closed wisps observed
+- Closed-parent stale wisps closed
 - Wisps purged (deleted old closed wisps)
-- Mail purged (deleted old closed mail)
-- Issues auto-closed (stale past {{stale_issue_age}}, excl. epics/P0-P1/deps)
+- City issues auto-closed (stale past {{stale_issue_age}}, excl. epics/P0-P1/deps)
+- Non-city stale issue candidates skipped as report-only
 - Open wisps remaining
 - Anomalies detected (if any)
 - Per-database breakdown
@@ -254,7 +332,7 @@ gc mail send mayor/ -s "ESCALATION: Reaper anomalies detected [MEDIUM]" \
 
 **3. Signal completion:**
 ```bash
-gc nudge deacon/ "DOG_DONE: reaper — reaped:<count>, purged:<count>, mail:<count>, closed:<count>"
+gc session nudge deacon/ "DOG_DONE: reaper — stale_wisps:<count>, closed_wisps:<count>, purged:<count>, closed:<count>, skipped_non_city_issues:<count>"
 ```
 
 **4. Close work and exit:**
diff --git a/examples/gastown/packs/maintenance/formulas/mol-shutdown-dance.toml b/examples/gastown/packs/maintenance/formulas/mol-shutdown-dance.toml
index a5dfd0f23a..19eda88ca5 100644
--- a/examples/gastown/packs/maintenance/formulas/mol-shutdown-dance.toml
+++ b/examples/gastown/packs/maintenance/formulas/mol-shutdown-dance.toml
@@ -104,7 +104,7 @@ First attempt to contact the stuck agent. Give it 60 seconds.
 
 **1. Send health check via nudge:**
 ```bash
-gc nudge {{target}} "[DOG] HEALTH CHECK: Respond ALIVE within 60s or face termination.
+gc session nudge {{target}} "[DOG] HEALTH CHECK: Respond ALIVE within 60s or face termination.
 Warrant: {{warrant_id}}
 Reason: {{reason}}
 Filed by: {{requester}}
@@ -143,7 +143,7 @@ got no response.
 
 **1. Send health check:**
 ```bash
-gc nudge {{target}} "[DOG] HEALTH CHECK: Respond ALIVE within 120s or face termination.
+gc session nudge {{target}} "[DOG] HEALTH CHECK: Respond ALIVE within 120s or face termination.
 Warrant: {{warrant_id}}
 Reason: {{reason}}
 Filed by: {{requester}}
@@ -179,7 +179,7 @@ respond in 4 minutes after 3 attempts, it's genuinely stuck.
 
 **1. Send health check:**
 ```bash
-gc nudge {{target}} "[DOG] HEALTH CHECK: FINAL WARNING. Respond ALIVE within 240s.
+gc session nudge {{target}} "[DOG] HEALTH CHECK: FINAL WARNING. Respond ALIVE within 240s.
 Warrant: {{warrant_id}}
 Reason: {{reason}}
 Filed by: {{requester}}
diff --git a/examples/gastown/packs/maintenance/orders/gate-sweep.toml b/examples/gastown/packs/maintenance/orders/gate-sweep.toml
index 14e6081420..0c7639360a 100644
--- a/examples/gastown/packs/maintenance/orders/gate-sweep.toml
+++ b/examples/gastown/packs/maintenance/orders/gate-sweep.toml
@@ -1,10 +1,8 @@
-# Replaces deacon patrol step: check-gates
-#
-# Gate evaluation is 100% mechanical — timer comparison, cron matching,
-# condition exit codes. No LLM judgment needed. The controller runs this
+# Gate evaluation is 100% mechanical — timer comparison and GitHub API
+# status decoding. No LLM judgment needed. The controller runs this
 # directly via exec instead of burning agent context.
 [order]
-description = "Evaluate and close pending gates (timer, condition, GitHub)"
+description = "Evaluate and close pending gates (timer, GitHub)"
 trigger = "cooldown"
 interval = "30s"
 exec = "$PACK_DIR/assets/scripts/gate-sweep.sh"
diff --git a/examples/gastown/packs/maintenance/orders/mol-dog-jsonl.toml b/examples/gastown/packs/maintenance/orders/mol-dog-jsonl.toml
index 3386d8ac10..cffc8e026d 100644
--- a/examples/gastown/packs/maintenance/orders/mol-dog-jsonl.toml
+++ b/examples/gastown/packs/maintenance/orders/mol-dog-jsonl.toml
@@ -1,5 +1,5 @@
 # Converted from formula+pool to exec. All JSONL export operations are
-# deterministic: dolt sql exports, wc -l spike comparisons, git push.
+# deterministic: dolt sql exports, jq record-count comparisons, git push.
 # No LLM judgment needed — runs inline in the controller.
 [order]
 description = "Export Dolt databases to JSONL git archive"
diff --git a/examples/gastown/packs/maintenance/orders/order-tracking-sweep.toml b/examples/gastown/packs/maintenance/orders/order-tracking-sweep.toml
new file mode 100644
index 0000000000..8ca614faff
--- /dev/null
+++ b/examples/gastown/packs/maintenance/orders/order-tracking-sweep.toml
@@ -0,0 +1,8 @@
+# Closes stale order tracking beads left behind by crashed or resource-starved
+# exec dispatches. Fresh tracking beads are left alone so in-flight orders keep
+# their normal single-flight protection.
+[order]
+description = "Close stale order-tracking beads so blocked orders can retry"
+trigger = "cooldown"
+interval = "1m"
+exec = "gc order sweep-tracking --stale-after 10m --quiet"
diff --git a/examples/gastown/precompact_hook_test.go b/examples/gastown/precompact_hook_test.go
new file mode 100644
index 0000000000..f858055214
--- /dev/null
+++ b/examples/gastown/precompact_hook_test.go
@@ -0,0 +1,151 @@
+package gastown_test
+
+import (
+	"encoding/json"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// TestPreCompactHandoffHooksUseAuto guards shipped PreCompact hooks against
+// the destructive-eviction regression documented in gc-flp1.
+//
+// `gc handoff` (bare) sends mail AND requests a controller restart, which kills
+// the running session. For PreCompact — which fires automatically on provider
+// context cycles inside sessions running these overlays — restart-mode turns
+// every compaction into a session kill.
+//
+// `gc handoff --auto` is the documented mode for this scenario: send mail,
+// skip restart, return immediately. The internal SDK hook config
+// (internal/hooks/config/claude.json) was switched to --auto in commit
+// 7b3b913a ("fix: add auto handoff for precompact"); the gastown pack overlay
+// must match.
+func TestPreCompactHandoffHooksUseAuto(t *testing.T) {
+	repoRoot := filepath.Clean(filepath.Join(exampleDir(), "..", ".."))
+	paths := preCompactHookConfigPaths(t, repoRoot)
+	if len(paths) == 0 {
+		t.Fatalf("expected shipped PreCompact hook configs; got none")
+	}
+
+	var sawHandoff bool
+	for _, path := range paths {
+		path := path
+		t.Run(relPath(t, repoRoot, path), func(t *testing.T) {
+			data, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatalf("reading hook config: %v", err)
+			}
+
+			var cfg map[string]any
+			if err := json.Unmarshal(data, &cfg); err != nil {
+				t.Fatalf("parsing hook config as JSON: %v", err)
+			}
+
+			for _, command := range preCompactCommands(cfg) {
+				if !containsGCHandoff(command) {
+					continue
+				}
+				sawHandoff = true
+				if !hasAutoFlag(command) {
+					t.Errorf("PreCompact hook invokes 'gc handoff' without --auto; bare gc handoff requests a restart and kills the session on every compaction (gc-flp1).\n  command: %q\n  fix: insert --auto, e.g. 'gc handoff --auto \"context cycle\"'", command)
+				}
+			}
+		})
+	}
+	if !sawHandoff {
+		t.Errorf("shipped PreCompact hooks do not call 'gc handoff' at all; expected 'gc handoff --auto \"context cycle\"'")
+	}
+}
+
+func preCompactHookConfigPaths(t *testing.T, repoRoot string) []string {
+	t.Helper()
+
+	var paths []string
+	for _, root := range []string{"examples", "internal/bootstrap/packs"} {
+		err := filepath.WalkDir(filepath.Join(repoRoot, root), func(path string, d fs.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() {
+				return nil
+			}
+
+			dir := filepath.Base(filepath.Dir(path))
+			name := filepath.Base(path)
+			if (dir == ".claude" && name == "settings.json") || (dir == ".cursor" && name == "hooks.json") {
+				paths = append(paths, path)
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatalf("walking %s: %v", root, err)
+		}
+	}
+	sort.Strings(paths)
+	return paths
+}
+
+func preCompactCommands(cfg map[string]any) []string {
+	hooks, ok := cfg["hooks"].(map[string]any)
+	if !ok {
+		return nil
+	}
+
+	var commands []string
+	for _, key := range []string{"PreCompact", "preCompact"} {
+		commands = append(commands, hookCommands(hooks[key])...)
+	}
+	return commands
+}
+
+func hookCommands(raw any) []string {
+	var commands []string
+	items, ok := raw.([]any)
+	if !ok {
+		return commands
+	}
+
+	for _, item := range items {
+		hook, ok := item.(map[string]any)
+		if !ok {
+			continue
+		}
+		if command, ok := hook["command"].(string); ok {
+			commands = append(commands, command)
+		}
+		commands = append(commands, hookCommands(hook["hooks"])...)
+	}
+	return commands
+}
+
+func containsGCHandoff(command string) bool {
+	fields := strings.Fields(command)
+	for i := 0; i < len(fields)-1; i++ {
+		if fields[i] == "gc" && fields[i+1] == "handoff" {
+			return true
+		}
+	}
+	return false
+}
+
+func hasAutoFlag(command string) bool {
+	for _, field := range strings.Fields(command) {
+		if field == "--auto" {
+			return true
+		}
+	}
+	return false
+}
+
+func relPath(t *testing.T, base, path string) string {
+	t.Helper()
+
+	rel, err := filepath.Rel(base, path)
+	if err != nil {
+		return path
+	}
+	return rel
+}
diff --git a/examples/hyperscale/packs/hyperscale/assets/scripts/mock-worker.sh b/examples/hyperscale/packs/hyperscale/assets/scripts/mock-worker.sh
index de3606c159..114ddabdf3 100755
--- a/examples/hyperscale/packs/hyperscale/assets/scripts/mock-worker.sh
+++ b/examples/hyperscale/packs/hyperscale/assets/scripts/mock-worker.sh
@@ -5,13 +5,15 @@
 # 100 of these run in parallel on K8s to demonstrate pool scaling.
 #
 # Required env vars (set by gc start):
-#   GC_AGENT — this agent's name (e.g., "worker-42")
-#   GC_DIR   — working directory
+#   GC_AGENT    — this agent's name (e.g., "worker-42")
+#   GC_TEMPLATE — canonical pool route target (e.g., "demo/worker")
+#   GC_DIR      — working directory
 
 set -euo pipefail
 cd "$GC_DIR"
 
 AGENT_SHORT=$(basename "$GC_AGENT")
+POOL_LABEL="${GC_TEMPLATE:?GC_TEMPLATE must be set to canonical pool route target}"
 echo "[$AGENT_SHORT] Starting up"
 
 # Jitter to avoid 100 workers racing on the same bead.
@@ -22,7 +24,7 @@ sleep "$JITTER"
 
 BEAD_ID=""
 for attempt in $(seq 1 10); do
-    ready=$(bd ready --metadata-field gc.routed_to=worker --unassigned 2>/dev/null || true)
+    ready=$(bd ready --metadata-field "gc.routed_to=$POOL_LABEL" --unassigned 2>/dev/null || true)
     if echo "$ready" | grep -qE '[a-z]{2}-[a-z0-9]'; then
         BEAD_ID=$(echo "$ready" | head -1 | awk '{print $2}')
         if bd update "$BEAD_ID" --claim --actor="$GC_AGENT" 2>/dev/null; then
diff --git a/examples/lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh b/examples/lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh
index 030f51c28a..bdff9dbe70 100755
--- a/examples/lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh
+++ b/examples/lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh
@@ -5,9 +5,10 @@
 # file, commits on the branch, then hands off to the refinery for merge.
 #
 # Required env vars (set by gc start):
-#   GC_AGENT — this agent's name (e.g., "demo-repo/polecat-1")
-#   GC_CITY  — path to the city directory
-#   GC_DIR   — working directory (rig repo path)
+#   GC_AGENT    — this agent's session name
+#   GC_TEMPLATE — canonical pool route target (e.g., "demo-repo/lifecycle.polecat")
+#   GC_CITY     — path to the city directory
+#   GC_DIR      — working directory (rig repo path)
 
 set -euo pipefail
 
@@ -35,13 +36,23 @@ git config --global user.name 2>/dev/null || git config --global user.name "gc-a
 git pull --ff-only origin main 2>/dev/null || true
 
 AGENT_SHORT=$(basename "$GC_AGENT")
-
-# Pool label is the agent name without the instance suffix (-1, -2, etc.).
-# For pool max=1 the name has no suffix, so we only strip if it ends in -N.
-POOL_LABEL="$GC_AGENT"
-if [[ "$POOL_LABEL" =~ -[0-9]+$ ]]; then
-    POOL_LABEL="${POOL_LABEL%-*}"
-fi
+POOL_LABEL="${GC_TEMPLATE:?GC_TEMPLATE must be set to canonical pool route target}"
+
+derive_refinery_target() {
+    case "${GC_TEMPLATE:-}" in
+        *polecat)
+            printf '%s\n' "${GC_TEMPLATE%polecat}refinery"
+            ;;
+        "")
+            echo "GC_TEMPLATE must be set to canonical pool route target" >&2
+            return 1
+            ;;
+        *)
+            echo "GC_TEMPLATE=$GC_TEMPLATE does not end in 'polecat'; cannot derive refinery target" >&2
+            return 1
+            ;;
+    esac
+}
 
 echo "[$AGENT_SHORT] Starting up in rig dir: $GC_DIR"
 # Jitter startup to avoid pool members racing on the same bead.
@@ -158,7 +169,7 @@ echo "[$AGENT_SHORT] Worktree cleaned up. Branch $BRANCH persists."
 # ── Step 7: Hand off to refinery ──────────────────────────────────────────
 
 # Set branch metadata and reassign to the refinery for merge.
-REFINERY="${GC_AGENT%/*}/refinery"
+REFINERY="$(derive_refinery_target)"
 bd update "$BEAD_ID" --metadata "{\"branch\":\"$BRANCH\"}" --assignee="$REFINERY" 2>/dev/null || true
 
 gc mail send --all "READY FOR MERGE: $BRANCH ($BEAD_TITLE) → $REFINERY" 2>/dev/null || true
diff --git a/examples/lifecycle/packs/lifecycle/assets/scripts/mock-refinery.sh b/examples/lifecycle/packs/lifecycle/assets/scripts/mock-refinery.sh
index f3f36b53fc..101e2514e6 100755
--- a/examples/lifecycle/packs/lifecycle/assets/scripts/mock-refinery.sh
+++ b/examples/lifecycle/packs/lifecycle/assets/scripts/mock-refinery.sh
@@ -6,7 +6,8 @@
 # closes the bead.
 #
 # Required env vars (set by gc start):
-#   GC_AGENT — this agent's name (e.g., "demo-repo/refinery")
+#   GC_AGENT — this agent's session name
+#   GC_ALIAS — canonical agent alias (e.g., "demo-repo/lifecycle.refinery")
 #   GC_CITY  — path to the city directory
 #   GC_DIR   — working directory (rig repo path)
 
@@ -21,6 +22,7 @@ export GIT_TERMINAL_PROMPT=0
 git pull --ff-only origin main 2>/dev/null || true
 
 AGENT_SHORT=$(basename "$GC_AGENT")
+MERGE_ASSIGNEE="${GC_ALIAS:?GC_ALIAS must be set to canonical refinery route target}"
 POLL_INTERVAL="${GC_REFINERY_POLL:-3}"
 
 echo "[$AGENT_SHORT] Starting merge agent in rig dir: $GC_DIR"
@@ -35,8 +37,8 @@ while true; do
     # separate pods; local: branches exist locally, fetch is a no-op).
     git fetch origin 2>/dev/null || true
 
-    # Scan for beads assigned to us (polecats reassign after pushing their branch).
-    MERGE_BEADS=$(bd list --assignee="$GC_AGENT" --status=in_progress --json 2>/dev/null || echo "[]")
+    # Scan for beads assigned to the canonical alias polecats hand off to.
+    MERGE_BEADS=$(bd list --assignee="$MERGE_ASSIGNEE" --status=in_progress --json 2>/dev/null || echo "[]")
 
     if echo "$MERGE_BEADS" | jq -e 'length > 0' >/dev/null 2>&1; then
         # Process each bead that has branch metadata.
diff --git a/examples/routing_namespace_test.go b/examples/routing_namespace_test.go
new file mode 100644
index 0000000000..24cb2a8fa4
--- /dev/null
+++ b/examples/routing_namespace_test.go
@@ -0,0 +1,226 @@
+package examples_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestShippedExamplesDoNotHardcodeShortRoutedToPools(t *testing.T) {
+	_, filename, _, _ := runtime.Caller(0)
+	root := filepath.Dir(filename)
+	badRoutes := []string{
+		"gc.routed_to=dog",
+		"gc.routed_to=worker",
+		"gc.routed_to=<rig>/polecat",
+		"gc.routed_to=<rig>/refinery",
+		"gc.routed_to={{ .RigName }}/refinery",
+	}
+
+	err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		body := string(data)
+		for _, bad := range badRoutes {
+			if strings.Contains(body, bad) {
+				t.Errorf("%s contains short-form routed_to target %q", path, bad)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestExamplePoolScriptsUseCanonicalGCTemplateRoutes(t *testing.T) {
+	root := examplesRoot(t)
+
+	tests := []struct {
+		name     string
+		rel      string
+		template string
+		want     string
+	}{
+		{
+			name:     "hyperscale worker",
+			rel:      "hyperscale/packs/hyperscale/assets/scripts/mock-worker.sh",
+			template: "demo/hyperscale.worker",
+			want:     "demo/hyperscale.worker",
+		},
+		{
+			name:     "lifecycle polecat",
+			rel:      "lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh",
+			template: "demo/lifecycle.polecat",
+			want:     "demo/lifecycle.polecat",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(root, tt.rel)
+			assignment := shellLineContaining(t, path, "POOL_LABEL=")
+			got := runShell(t, []string{"GC_TEMPLATE=" + tt.template}, assignment+`
+printf '%s' "$POOL_LABEL"
+`)
+			if got != tt.want {
+				t.Fatalf("POOL_LABEL = %q, want %q", got, tt.want)
+			}
+
+			cmd := shellCommand(t, nil, assignment)
+			if err := cmd.Run(); err == nil {
+				t.Fatalf("POOL_LABEL assignment succeeded without GC_TEMPLATE")
+			}
+		})
+	}
+}
+
+func TestLifecyclePolecatDerivesRefineryTargetFromCanonicalTemplate(t *testing.T) {
+	root := examplesRoot(t)
+	path := filepath.Join(root, "lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh")
+	function := shellFunction(t, path, "derive_refinery_target")
+
+	tests := []struct {
+		name     string
+		template string
+		want     string
+	}{
+		{
+			name:     "v1 template",
+			template: "demo/polecat",
+			want:     "demo/refinery",
+		},
+		{
+			name:     "binding qualified template",
+			template: "demo/lifecycle.polecat",
+			want:     "demo/lifecycle.refinery",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := runShell(t, []string{"GC_TEMPLATE=" + tt.template}, function+`
+derive_refinery_target
+`)
+			if got != tt.want {
+				t.Fatalf("derive_refinery_target() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+
+	cmd := shellCommand(t, []string{"GC_TEMPLATE=demo/lifecycle.worker"}, function+`
+derive_refinery_target
+`)
+	if err := cmd.Run(); err == nil {
+		t.Fatalf("derive_refinery_target succeeded for a non-polecat template")
+	}
+}
+
+func TestLifecycleRefineryConsumesPolecatHandoffAlias(t *testing.T) {
+	root := examplesRoot(t)
+	polecatPath := filepath.Join(root, "lifecycle/packs/lifecycle/assets/scripts/mock-polecat.sh")
+	refineryPath := filepath.Join(root, "lifecycle/packs/lifecycle/assets/scripts/mock-refinery.sh")
+
+	polecatTarget := runShell(t, []string{"GC_TEMPLATE=demo/lifecycle.polecat"}, shellFunction(t, polecatPath, "derive_refinery_target")+`
+derive_refinery_target
+`)
+	refineryAssignment := shellLineContaining(t, refineryPath, "MERGE_ASSIGNEE=")
+	refineryAssignee := runShell(t, []string{
+		"GC_ALIAS=" + polecatTarget,
+		"GC_AGENT=demo--lifecycle__refinery",
+	}, refineryAssignment+`
+printf '%s' "$MERGE_ASSIGNEE"
+`)
+
+	if refineryAssignee != polecatTarget {
+		t.Fatalf("refinery consumes assignee %q, want polecat handoff target %q", refineryAssignee, polecatTarget)
+	}
+	if refineryAssignee == "demo--lifecycle__refinery" {
+		t.Fatalf("refinery still consumes sanitized GC_AGENT instead of canonical GC_ALIAS")
+	}
+}
+
+func examplesRoot(t *testing.T) string {
+	t.Helper()
+	_, filename, _, _ := runtime.Caller(0)
+	return filepath.Dir(filename)
+}
+
+func shellLineContaining(t *testing.T, path, needle string) string {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("reading %s: %v", path, err)
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		if strings.Contains(line, needle) {
+			return line
+		}
+	}
+	t.Fatalf("%s missing shell line containing %q", path, needle)
+	return ""
+}
+
+func shellFunction(t *testing.T, path, name string) string {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("reading %s: %v", path, err)
+	}
+	lines := strings.Split(string(data), "\n")
+	for i, line := range lines {
+		if line == name+"() {" {
+			for j := i + 1; j < len(lines); j++ {
+				if lines[j] == "}" {
+					return strings.Join(lines[i:j+1], "\n")
+				}
+			}
+			t.Fatalf("%s shell function %q has no closing brace", path, name)
+		}
+	}
+	t.Fatalf("%s missing shell function %q", path, name)
+	return ""
+}
+
+func runShell(t *testing.T, env []string, body string) string {
+	t.Helper()
+	cmd := shellCommand(t, env, body)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("shell command failed: %v\n%s", err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func shellCommand(t *testing.T, env []string, body string) *exec.Cmd {
+	t.Helper()
+	cmd := exec.Command("bash", "-e", "-u", "-o", "pipefail", "-c", body)
+	cmd.Env = append(scrubEnv(os.Environ(), "GC_TEMPLATE", "GC_ALIAS", "GC_AGENT"), env...)
+	return cmd
+}
+
+func scrubEnv(env []string, names ...string) []string {
+	blocked := make(map[string]struct{}, len(names))
+	for _, name := range names {
+		blocked[name] = struct{}{}
+	}
+	kept := env[:0]
+	for _, entry := range env {
+		name, _, _ := strings.Cut(entry, "=")
+		if _, ok := blocked[name]; !ok {
+			kept = append(kept, entry)
+		}
+	}
+	return kept
+}
diff --git a/examples/swarm/packs/swarm/agents/deacon/prompt.template.md b/examples/swarm/packs/swarm/agents/deacon/prompt.template.md
index 293c41b684..1e9e946f3e 100644
--- a/examples/swarm/packs/swarm/agents/deacon/prompt.template.md
+++ b/examples/swarm/packs/swarm/agents/deacon/prompt.template.md
@@ -20,7 +20,7 @@ Check that agents are responsive:
 
 - Verify tmux sessions exist for expected agents
 - Report stalls or unresponsive agents to the mayor
-- Restart agents that have crashed (via `gc agent restart`)
+- Note crashed agents — the reconciler auto-restarts dead sessions
 
 ## Communication
 
diff --git a/examples/testenv_import_test.go b/examples/testenv_import_test.go
new file mode 100644
index 0000000000..133debf277
--- /dev/null
+++ b/examples/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package examples_test
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/go.mod b/go.mod
index f3ec976fd6..8a4e92902e 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/gastownhall/gascity
 
-go 1.25.0
+go 1.25.9
 
 require (
 	github.com/BurntSushi/toml v1.6.0
@@ -24,6 +24,7 @@ require (
 	go.opentelemetry.io/otel/sdk/log v0.19.0
 	go.opentelemetry.io/otel/sdk/metric v1.43.0
 	golang.org/x/sync v0.20.0
+	golang.org/x/sys v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.35.2
 	k8s.io/apimachinery v0.35.2
@@ -75,7 +76,6 @@ require (
 	go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/term v0.41.0 // indirect
 	golang.org/x/text v0.35.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
diff --git a/internal/api/cache_read_model.go b/internal/api/cache_read_model.go
new file mode 100644
index 0000000000..a5134cab39
--- /dev/null
+++ b/internal/api/cache_read_model.go
@@ -0,0 +1,34 @@
+package api
+
+import (
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+type cachedListStore interface {
+	CachedList(beads.ListQuery) ([]beads.Bead, bool)
+}
+
+func listSessionBeadsForReadModel(store beads.Store) ([]beads.Bead, error) {
+	query := beads.ListQuery{
+		Label: session.LabelSession,
+		Sort:  beads.SortCreatedDesc,
+	}
+	if cached, ok := store.(cachedListStore); ok {
+		if rows, cacheOK := cached.CachedList(query); cacheOK {
+			return rows, nil
+		}
+	}
+	return store.List(query)
+}
+
+func sessionReadModelRows(store beads.Store) ([]beads.Bead, []string, error) {
+	rows, err := listSessionBeadsForReadModel(store)
+	if err == nil {
+		return rows, nil, nil
+	}
+	if beads.IsPartialResult(err) && len(rows) > 0 {
+		return rows, []string{err.Error()}, nil
+	}
+	return nil, nil, err
+}
diff --git a/internal/api/client.go b/internal/api/client.go
index 1ac31b07ac..8f5e241e9f 100644
--- a/internal/api/client.go
+++ b/internal/api/client.go
@@ -12,15 +12,20 @@
 package api
 
 import (
+	"bufio"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
+	"net/url"
 	"reflect"
 	"strings"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/api/genclient"
+	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/workspacesvc"
 )
@@ -85,22 +90,14 @@ func ShouldFallback(err error) bool {
 // when a controller is running.
 type Client struct {
 	cw       *genclient.ClientWithResponses
+	baseURL  string // stored for SSE stream connections
 	cityName string // non-empty for city-scoped clients; passed to every per-city call
 	initErr  error  // set when NewClient failed to build the transport (malformed baseURL, etc.)
 }
 
 const sessionMessageTimeout = 4 * time.Minute
 
-// SessionSubmitResponse is the domain-facing shape of POST
-// /v0/city/{cityName}/session/{id}/submit's 202 body. It intentionally
-// shadows genclient.SessionSubmitOutputBody instead of re-exporting it
-// so callers in cmd/gc do not depend on the generated-client package:
-//
-//  1. regenerating the client (different tool, renamed field) would
-//     otherwise force a cascading edit across every CLI command; and
-//  2. the wire uses a string for Intent but the domain uses the typed
-//     session.SubmitIntent — this wrapper does the conversion in one
-//     place and lets callers work with the strong type.
+// SessionSubmitResponse is the domain-facing shape of a session submit result.
 type SessionSubmitResponse struct {
 	Status string               `json:"status"`
 	ID     string               `json:"id"`
@@ -108,6 +105,141 @@ type SessionSubmitResponse struct {
 	Intent session.SubmitIntent `json:"intent"`
 }
 
+// sseEvent is a parsed SSE frame from the event stream.
+type sseEvent struct {
+	Event string
+	Data  string
+}
+
+// sseEnvelope is the JSON envelope of a typed event on the stream.
+type sseEnvelope struct {
+	Type    string          `json:"type"`
+	Payload json.RawMessage `json:"payload"`
+}
+
+// waitForEvent connects to the appropriate SSE stream, reads frames
+// until it finds an event matching the given request_id (in success or
+// failure payloads), and returns the envelope. The caller decodes the
+// typed payload.
+func (c *Client) waitForEvent(ctx context.Context, requestID string, successType, failOp, eventCursor string) (*sseEnvelope, error) {
+	streamURL := c.baseURL + "/v0/events/stream"
+	cursor := strings.TrimSpace(eventCursor)
+	if c.cityName != "" {
+		if cursor == "" {
+			cursor = "0"
+		}
+		streamURL = c.baseURL + "/v0/city/" + c.cityName + "/events/stream?after_seq=" + url.QueryEscape(cursor)
+	} else {
+		if cursor == "" {
+			cursor = "0"
+		}
+		streamURL += "?after_cursor=" + url.QueryEscape(cursor)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, streamURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("build SSE request: %w", err)
+	}
+	req.Header.Set("Accept", "text/event-stream")
+	req.Header.Set("X-GC-Request", "true")
+
+	resp, err := (&http.Client{}).Do(req)
+	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
+		return nil, fmt.Errorf("SSE connect: %w", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		detail := strings.TrimSpace(string(body))
+		if detail == "" {
+			detail = resp.Status
+		}
+		return nil, fmt.Errorf("SSE connect failed: %s: %s", resp.Status, detail)
+	}
+
+	scanner := bufio.NewScanner(resp.Body)
+	scanner.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
+	var current sseEvent
+	for scanner.Scan() {
+		line := scanner.Text()
+		switch {
+		case strings.HasPrefix(line, "event:"):
+			current.Event = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
+		case strings.HasPrefix(line, "data:"):
+			data := strings.TrimPrefix(line, "data:")
+			data = strings.TrimPrefix(data, " ")
+			if current.Data == "" {
+				current.Data = data
+			} else {
+				current.Data += "\n" + data
+			}
+		case line == "":
+			if current.Data == "" {
+				current = sseEvent{}
+				continue
+			}
+			var env sseEnvelope
+			if err := json.Unmarshal([]byte(current.Data), &env); err != nil {
+				return nil, fmt.Errorf("decode SSE event: %w", err)
+			}
+			if env.Type == successType {
+				matches, err := payloadContainsRequestID(env.Payload, requestID)
+				if err != nil {
+					return nil, fmt.Errorf("decode %s payload: %w", successType, err)
+				}
+				if matches {
+					return &env, nil
+				}
+			}
+			if env.Type == events.RequestFailed {
+				matches, err := payloadMatchesRequest(env.Payload, requestID, failOp)
+				if err != nil {
+					return nil, fmt.Errorf("decode %s payload: %w", events.RequestFailed, err)
+				}
+				if matches {
+					return &env, nil
+				}
+			}
+			current = sseEvent{}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
+		return nil, fmt.Errorf("SSE scan: %w", err)
+	}
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		return nil, ctxErr
+	}
+	return nil, fmt.Errorf("SSE stream closed before event for %s arrived", requestID)
+}
+
+func payloadContainsRequestID(raw json.RawMessage, requestID string) (bool, error) {
+	// Success event types are per-operation, so the typed envelope selects the
+	// operation and the payload only needs the unique correlation ID.
+	var p struct {
+		RequestID string `json:"request_id"`
+	}
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return false, err
+	}
+	return p.RequestID == requestID, nil
+}
+
+func payloadMatchesRequest(raw json.RawMessage, requestID, operation string) (bool, error) {
+	var p struct {
+		RequestID string `json:"request_id"`
+		Operation string `json:"operation"`
+	}
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return false, err
+	}
+	return p.RequestID == requestID && p.Operation == operation, nil
+}
+
 // NewClient creates a new supervisor-scope API client targeting the
 // given base URL (e.g., "http://127.0.0.1:8080"). Supervisor-scope
 // operations (ListCities, ListServices-via-city, etc.) work through
@@ -139,7 +271,7 @@ func newClient(baseURL, cityName string) *Client {
 		// every method rather than panicking.
 		return &Client{initErr: &clientInitError{err: err}}
 	}
-	return &Client{cw: cw, cityName: cityName}
+	return &Client{cw: cw, baseURL: baseURL, cityName: cityName}
 }
 
 // requireCityScope reports an error if the client was constructed as a
@@ -321,8 +453,9 @@ func (c *Client) KillSession(id string) error {
 	return checkMutation(resp, err)
 }
 
-// SendSessionMessage delivers a message to a session via the compatibility
-// POST /v0/city/{cityName}/session/{id}/messages endpoint.
+// SendSessionMessage delivers a message to a session via the async
+// POST /v0/city/{cityName}/session/{id}/messages endpoint. Internally
+// handles the async protocol: POST → 202 + request_id → SSE event.
 func (c *Client) SendSessionMessage(id, message string) error {
 	if err := c.requireCityScope(); err != nil {
 		return err
@@ -332,11 +465,34 @@ func (c *Client) SendSessionMessage(id, message string) error {
 	resp, err := c.cw.SendSessionMessageWithResponse(ctx, c.cityName, id, nil, genclient.SendSessionMessageJSONRequestBody{
 		Message: message,
 	})
-	return checkMutation(resp, err)
+	if err != nil {
+		return &connError{err: fmt.Errorf("request failed: %w", err)}
+	}
+	if err := checkMutation(resp, err); err != nil {
+		return err
+	}
+	if resp.JSON202 == nil {
+		return fmt.Errorf("API returned %d with no body", resp.StatusCode())
+	}
+	requestID := resp.JSON202.RequestId
+
+	env, err := c.waitForEvent(ctx, requestID, events.RequestResultSessionMessage, RequestOperationSessionMessage, resp.JSON202.EventCursor)
+	if err != nil {
+		return err
+	}
+	if env.Type == events.RequestFailed {
+		var p RequestFailedPayload
+		if err := json.Unmarshal(env.Payload, &p); err != nil {
+			return fmt.Errorf("decode message failure: %w", err)
+		}
+		return fmt.Errorf("message failed: %s: %s", p.ErrorCode, p.ErrorMessage)
+	}
+	return nil
 }
 
 // SubmitSession sends a semantic submit request to a session. The id may
-// be either a bead ID or a resolvable session alias/name.
+// be either a bead ID or a resolvable session alias/name. Internally
+// handles the async protocol: POST → 202 + request_id → SSE event.
 func (c *Client) SubmitSession(id, message string, intent session.SubmitIntent) (SessionSubmitResponse, error) {
 	if err := c.requireCityScope(); err != nil {
 		return SessionSubmitResponse{}, err
@@ -356,19 +512,34 @@ func (c *Client) SubmitSession(id, message string, intent session.SubmitIntent)
 	if err := apiErrorFromResponse(resp.StatusCode(), resp.ApplicationproblemJSONDefault); err != nil {
 		return SessionSubmitResponse{}, err
 	}
-	// SubmitSession returns 202 Accepted on success.
 	if resp.JSON202 == nil {
 		return SessionSubmitResponse{}, fmt.Errorf("API returned %d with no body", resp.StatusCode())
 	}
-	out := SessionSubmitResponse{
-		Status: resp.JSON202.Status,
-		ID:     resp.JSON202.Id,
-		Queued: resp.JSON202.Queued,
-	}
-	if resp.JSON202.Intent != "" {
-		out.Intent = session.SubmitIntent(resp.JSON202.Intent)
+	requestID := resp.JSON202.RequestId
+
+	ctx, cancel := context.WithTimeout(context.Background(), sessionMessageTimeout)
+	defer cancel()
+	env, err := c.waitForEvent(ctx, requestID, events.RequestResultSessionSubmit, RequestOperationSessionSubmit, resp.JSON202.EventCursor)
+	if err != nil {
+		return SessionSubmitResponse{}, err
 	}
-	return out, nil
+	if env.Type == events.RequestFailed {
+		var p RequestFailedPayload
+		if err := json.Unmarshal(env.Payload, &p); err != nil {
+			return SessionSubmitResponse{}, fmt.Errorf("decode submit failure: %w", err)
+		}
+		return SessionSubmitResponse{}, fmt.Errorf("submit failed: %s: %s", p.ErrorCode, p.ErrorMessage)
+	}
+	var p SessionSubmitSucceededPayload
+	if err := json.Unmarshal(env.Payload, &p); err != nil {
+		return SessionSubmitResponse{}, fmt.Errorf("decode submit result: %w", err)
+	}
+	return SessionSubmitResponse{
+		Status: "accepted",
+		ID:     p.SessionID,
+		Queued: p.Queued,
+		Intent: session.SubmitIntent(p.Intent),
+	}, nil
 }
 
 var errClientUninitialized = errors.New("api client not initialized")
diff --git a/internal/api/client_test.go b/internal/api/client_test.go
index e70b8c8eb8..10b1e99c9c 100644
--- a/internal/api/client_test.go
+++ b/internal/api/client_test.go
@@ -1,14 +1,41 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
+	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/session"
 	"github.com/gastownhall/gascity/internal/workspacesvc"
 )
 
+func writeSSEEnvelope(t *testing.T, w http.ResponseWriter, typ string, payload any) {
+	t.Helper()
+	raw, err := json.Marshal(struct {
+		Type    string `json:"type"`
+		Payload any    `json:"payload"`
+	}{
+		Type:    typ,
+		Payload: payload,
+	})
+	if err != nil {
+		t.Fatalf("marshal SSE envelope: %v", err)
+	}
+	w.Header().Set("Content-Type", "text/event-stream")
+	_, _ = w.Write([]byte("data: "))
+	_, _ = w.Write(raw)
+	_, _ = w.Write([]byte("\n\n"))
+	if flusher, ok := w.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}
+
 func TestClientSuspendCity(t *testing.T) {
 	var gotMethod, gotPath string
 	var gotBody map[string]any
@@ -37,6 +64,211 @@ func TestClientSuspendCity(t *testing.T) {
 	}
 }
 
+func TestClientWaitForEventRequestsReplayCursorForCityStream(t *testing.T) {
+	seen := make(chan url.Values, 1)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v0/city/alpha/events/stream" {
+			t.Fatalf("path = %q, want /v0/city/alpha/events/stream", r.URL.Path)
+		}
+		seen <- r.URL.Query()
+		w.Header().Set("Content-Type", "text/event-stream")
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	_, _ = c.waitForEvent(t.Context(), "req-never", "request.result.session.message", RequestOperationSessionMessage, "")
+
+	query := <-seen
+	if got := query.Get("after_seq"); got != "0" {
+		t.Fatalf("after_seq = %q, want 0", got)
+	}
+}
+
+func TestClientWaitForEventRequestsReplayCursorForSupervisorStream(t *testing.T) {
+	seen := make(chan url.Values, 1)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v0/events/stream" {
+			t.Fatalf("path = %q, want /v0/events/stream", r.URL.Path)
+		}
+		seen <- r.URL.Query()
+		w.Header().Set("Content-Type", "text/event-stream")
+	}))
+	defer ts.Close()
+
+	c := NewClient(ts.URL)
+	_, _ = c.waitForEvent(t.Context(), "req-never", "request.result.city.create", RequestOperationCityCreate, "")
+
+	query := <-seen
+	if got := query.Get("after_cursor"); got != "0" {
+		t.Fatalf("after_cursor = %q, want 0", got)
+	}
+}
+
+func TestClientWaitForEventUsesAcceptedCursorForCityStream(t *testing.T) {
+	seen := make(chan url.Values, 1)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v0/city/alpha/events/stream" {
+			t.Fatalf("path = %q, want /v0/city/alpha/events/stream", r.URL.Path)
+		}
+		seen <- r.URL.Query()
+		w.Header().Set("Content-Type", "text/event-stream")
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	_, _ = c.waitForEvent(t.Context(), "req-never", "request.result.session.message", RequestOperationSessionMessage, "42")
+
+	query := <-seen
+	if got := query.Get("after_seq"); got != "42" {
+		t.Fatalf("after_seq = %q, want 42", got)
+	}
+}
+
+func TestClientWaitForEventUsesAcceptedCursorForSupervisorStream(t *testing.T) {
+	seen := make(chan url.Values, 1)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v0/events/stream" {
+			t.Fatalf("path = %q, want /v0/events/stream", r.URL.Path)
+		}
+		seen <- r.URL.Query()
+		w.Header().Set("Content-Type", "text/event-stream")
+	}))
+	defer ts.Close()
+
+	c := NewClient(ts.URL)
+	_, _ = c.waitForEvent(t.Context(), "req-never", "request.result.city.create", RequestOperationCityCreate, "alpha:7,__supervisor__:9")
+
+	query := <-seen
+	if got := query.Get("after_cursor"); got != "alpha:7,__supervisor__:9" {
+		t.Fatalf("after_cursor = %q, want alpha:7,__supervisor__:9", got)
+	}
+}
+
+func TestClientWaitForEventReportsNonOKSSEStatus(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, `{"detail":"stream unavailable"}`, http.StatusServiceUnavailable)
+	}))
+	defer ts.Close()
+
+	c := NewClient(ts.URL)
+	_, err := c.waitForEvent(t.Context(), "req-never", "request.result.city.create", RequestOperationCityCreate, "")
+	if err == nil {
+		t.Fatal("waitForEvent succeeded for non-OK SSE response")
+	}
+	if !strings.Contains(err.Error(), "503") || !strings.Contains(err.Error(), "stream unavailable") {
+		t.Fatalf("error = %q, want status and response detail", err.Error())
+	}
+}
+
+func TestClientWaitForEventReportsScannerError(t *testing.T) {
+	largePayload := strings.Repeat("x", 5*1024*1024)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte("data: " + largePayload + "\n\n"))
+	}))
+	defer ts.Close()
+
+	c := NewClient(ts.URL)
+	_, err := c.waitForEvent(t.Context(), "req-never", "request.result.city.create", RequestOperationCityCreate, "")
+	if err == nil {
+		t.Fatal("waitForEvent succeeded after scanner failure")
+	}
+	if !strings.Contains(err.Error(), "SSE scan") {
+		t.Fatalf("error = %q, want scanner error context", err.Error())
+	}
+}
+
+func TestClientWaitForEventHandlesMultiLineDataFrames(t *testing.T) {
+	frame := "event: tagged_event\n" +
+		`data: {"type":"request.result.session.message","payload":` + "\n" +
+		`data: {"request_id":"req-1","session_id":"gc-1"}}` + "\n\n"
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte(frame))
+	}))
+	defer ts.Close()
+
+	c := NewClient(ts.URL)
+	env, err := c.waitForEvent(t.Context(), "req-1", "request.result.session.message", RequestOperationSessionMessage, "")
+	if err != nil {
+		t.Fatalf("waitForEvent: %v", err)
+	}
+	if env.Type != "request.result.session.message" {
+		t.Fatalf("event type = %q, want request.result.session.message", env.Type)
+	}
+}
+
+func TestClientWaitForEventHandlesEventFieldWithoutSpace(t *testing.T) {
+	frame := "event:tagged_event\n" +
+		`data: {"type":"request.result.session.message","payload":{"request_id":"req-1","session_id":"gc-1"}}` + "\n\n"
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte(frame))
+	}))
+	defer ts.Close()
+
+	c := NewClient(ts.URL)
+	env, err := c.waitForEvent(t.Context(), "req-1", "request.result.session.message", RequestOperationSessionMessage, "")
+	if err != nil {
+		t.Fatalf("waitForEvent: %v", err)
+	}
+	if env.Type != "request.result.session.message" {
+		t.Fatalf("event type = %q, want request.result.session.message", env.Type)
+	}
+}
+
+func TestClientWaitForEventReportsMalformedMatchingSuccessPayload(t *testing.T) {
+	frame := `data: {"type":"request.result.session.message","payload":"not an object"}` + "\n\n"
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte(frame))
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	_, err := c.waitForEvent(t.Context(), "req-1", "request.result.session.message", RequestOperationSessionMessage, "")
+	if err == nil {
+		t.Fatal("waitForEvent succeeded with malformed matching success payload")
+	}
+	if !strings.Contains(err.Error(), "decode request.result.session.message payload") {
+		t.Fatalf("error = %q, want malformed success payload context", err.Error())
+	}
+}
+
+func TestClientWaitForEventReportsMalformedRequestFailedPayload(t *testing.T) {
+	frame := `data: {"type":"request.failed","payload":"not an object"}` + "\n\n"
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte(frame))
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	_, err := c.waitForEvent(t.Context(), "req-1", "request.result.session.message", RequestOperationSessionMessage, "")
+	if err == nil {
+		t.Fatal("waitForEvent succeeded with malformed request.failed payload")
+	}
+	if !strings.Contains(err.Error(), "decode request.failed payload") {
+		t.Fatalf("error = %q, want malformed failure payload context", err.Error())
+	}
+}
+
+func TestClientWaitForEventHonorsContextCancellation(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		<-r.Context().Done()
+	}))
+	defer ts.Close()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	c := NewClient(ts.URL)
+	_, err := c.waitForEvent(ctx, "req-never", "request.result.city.create", RequestOperationCityCreate, "")
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("error = %v, want context.Canceled", err)
+	}
+}
+
 func TestClientResumeCity(t *testing.T) {
 	var gotBody map[string]any
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -421,6 +653,163 @@ func TestClientKillSession(t *testing.T) {
 	}
 }
 
+func TestClientSendSessionMessageWaitsForResultEvent(t *testing.T) {
+	var gotBody struct {
+		Message string `json:"message"`
+	}
+	var gotHeader string
+	var sawPost bool
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/v0/city/alpha/session/sess-123/messages":
+			gotHeader = r.Header.Get("X-GC-Request")
+			sawPost = true
+			if err := json.NewDecoder(r.Body).Decode(&gotBody); err != nil {
+				t.Fatalf("decode message body: %v", err)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusAccepted)
+			json.NewEncoder(w).Encode(map[string]string{"request_id": "req-msg", "event_cursor": "17"}) //nolint:errcheck
+		case r.Method == http.MethodGet && r.URL.Path == "/v0/city/alpha/events/stream":
+			if !sawPost {
+				t.Fatal("event stream opened before message POST")
+			}
+			if got := r.URL.Query().Get("after_seq"); got != "17" {
+				t.Fatalf("after_seq = %q, want 17", got)
+			}
+			writeSSEEnvelope(t, w, events.RequestResultSessionMessage, SessionMessageSucceededPayload{
+				RequestID: "req-msg",
+				SessionID: "sess-123",
+			})
+		default:
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.String())
+		}
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	if err := c.SendSessionMessage("sess-123", "wake up"); err != nil {
+		t.Fatalf("SendSessionMessage: %v", err)
+	}
+	if gotBody.Message != "wake up" {
+		t.Fatalf("message = %q, want wake up", gotBody.Message)
+	}
+	if gotHeader != "true" {
+		t.Fatalf("X-GC-Request = %q, want true", gotHeader)
+	}
+}
+
+func TestClientSendSessionMessageReportsAsyncFailure(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/v0/city/alpha/session/sess-123/messages":
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusAccepted)
+			json.NewEncoder(w).Encode(map[string]string{"request_id": "req-msg", "event_cursor": "18"}) //nolint:errcheck
+		case r.Method == http.MethodGet && r.URL.Path == "/v0/city/alpha/events/stream":
+			writeSSEEnvelope(t, w, events.RequestFailed, RequestFailedPayload{
+				RequestID:    "req-msg",
+				Operation:    RequestOperationSessionMessage,
+				ErrorCode:    "delivery_failed",
+				ErrorMessage: "session is gone",
+			})
+		default:
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.String())
+		}
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	err := c.SendSessionMessage("sess-123", "wake up")
+	if err == nil {
+		t.Fatal("SendSessionMessage succeeded after request.failed")
+	}
+	if !strings.Contains(err.Error(), "message failed: delivery_failed: session is gone") {
+		t.Fatalf("error = %q, want async failure detail", err.Error())
+	}
+}
+
+func TestClientSubmitSessionWaitsForResultEvent(t *testing.T) {
+	var gotBody struct {
+		Message string `json:"message"`
+		Intent  string `json:"intent"`
+	}
+	var sawPost bool
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/v0/city/alpha/session/sess-123/submit":
+			sawPost = true
+			if err := json.NewDecoder(r.Body).Decode(&gotBody); err != nil {
+				t.Fatalf("decode submit body: %v", err)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusAccepted)
+			json.NewEncoder(w).Encode(map[string]string{"request_id": "req-submit", "event_cursor": "21"}) //nolint:errcheck
+		case r.Method == http.MethodGet && r.URL.Path == "/v0/city/alpha/events/stream":
+			if !sawPost {
+				t.Fatal("event stream opened before submit POST")
+			}
+			if got := r.URL.Query().Get("after_seq"); got != "21" {
+				t.Fatalf("after_seq = %q, want 21", got)
+			}
+			writeSSEEnvelope(t, w, events.RequestResultSessionSubmit, SessionSubmitSucceededPayload{
+				RequestID: "req-submit",
+				SessionID: "sess-123",
+				Queued:    true,
+				Intent:    string(session.SubmitIntentInterruptNow),
+			})
+		default:
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.String())
+		}
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	resp, err := c.SubmitSession("sess-123", "take this now", session.SubmitIntentInterruptNow)
+	if err != nil {
+		t.Fatalf("SubmitSession: %v", err)
+	}
+	if gotBody.Message != "take this now" {
+		t.Fatalf("message = %q, want take this now", gotBody.Message)
+	}
+	if gotBody.Intent != string(session.SubmitIntentInterruptNow) {
+		t.Fatalf("intent = %q, want %q", gotBody.Intent, session.SubmitIntentInterruptNow)
+	}
+	if resp.Status != "accepted" || resp.ID != "sess-123" || !resp.Queued || resp.Intent != session.SubmitIntentInterruptNow {
+		t.Fatalf("response = %#v, want accepted queued interrupt_now for sess-123", resp)
+	}
+}
+
+func TestClientSubmitSessionReportsAsyncFailure(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/v0/city/alpha/session/sess-123/submit":
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusAccepted)
+			json.NewEncoder(w).Encode(map[string]string{"request_id": "req-submit", "event_cursor": "22"}) //nolint:errcheck
+		case r.Method == http.MethodGet && r.URL.Path == "/v0/city/alpha/events/stream":
+			writeSSEEnvelope(t, w, events.RequestFailed, RequestFailedPayload{
+				RequestID:    "req-submit",
+				Operation:    RequestOperationSessionSubmit,
+				ErrorCode:    "not_ready",
+				ErrorMessage: "session is starting",
+			})
+		default:
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.String())
+		}
+	}))
+	defer ts.Close()
+
+	c := NewCityScopedClient(ts.URL, "alpha")
+	_, err := c.SubmitSession("sess-123", "take this now", session.SubmitIntentInterruptNow)
+	if err == nil {
+		t.Fatal("SubmitSession succeeded after request.failed")
+	}
+	if !strings.Contains(err.Error(), "submit failed: not_ready: session is starting") {
+		t.Fatalf("error = %q, want async failure detail", err.Error())
+	}
+}
+
 func TestClientCSRFHeader(t *testing.T) {
 	var gotHeader string
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
diff --git a/internal/api/convoy_event_stream.go b/internal/api/convoy_event_stream.go
index 44c257d4a5..85921efed8 100644
--- a/internal/api/convoy_event_stream.go
+++ b/internal/api/convoy_event_stream.go
@@ -45,9 +45,8 @@ type WorkflowAttemptSummary struct {
 // WireEvent is the list-endpoint wire shape for a single event,
 // emitted by GET /v0/city/{cityName}/events. Same envelope fields as
 // eventStreamEnvelope minus the SSE-specific Workflow projection.
-// Payload is decoded via the events registry into a typed variant so
-// the list endpoint's wire schema matches the stream endpoint's
-// instead of falling back to opaque bytes.
+// Payload is decoded via the events registry into a typed variant when
+// possible. Custom event types pass through with their raw JSON payload.
 type WireEvent struct {
 	Seq     uint64            `json:"seq"`
 	Type    string            `json:"type"`
@@ -58,6 +57,13 @@ type WireEvent struct {
 	Payload EventPayloadUnion `json:"payload,omitempty"`
 }
 
+// Schema makes list endpoints use the same envelope-discriminated schema as
+// the city event stream. Runtime JSON stays the struct shape above; the
+// OpenAPI contract tells clients to select payload type from envelope.type.
+func (WireEvent) Schema(r huma.Registry) *huma.Schema {
+	return typedEventStreamEnvelopeSchema{}.Schema(r)
+}
+
 // WireTaggedEvent is the supervisor-scope list wire shape for
 // GET /v0/events, carrying the City the event originated from.
 type WireTaggedEvent struct {
@@ -65,31 +71,29 @@ type WireTaggedEvent struct {
 	City string `json:"city"`
 }
 
-// toWireEvent decodes the bus's opaque Payload into the registered
-// typed variant and returns the list-endpoint wire shape.
-//
-// Policy:
-//   - Registered event types: emit with the typed payload variant.
-//   - Unregistered event types (e.g. ad-hoc `gc event emit custom.foo`
-//     from a user hook): emit the envelope with a null payload so the
-//     CLI user's custom events remain visible in the list. The type
-//     string, actor, subject, message, seq, and ts are preserved — only
-//     structured payload data is dropped (there is no registered schema
-//     to interpret it against). The registry-coverage test
-//     (TestEveryKnownEventTypeHasRegisteredPayload) still guarantees
-//     every KnownEventTypes constant has a registered payload; this
-//     passthrough covers only types the SDK does not know about.
-//   - Decode error on registered types: skip + log. Emitting a typed
-//     event with bus corruption would violate Principle 7.
+// Schema makes supervisor event lists use the same envelope-discriminated
+// schema as the supervisor event stream.
+func (WireTaggedEvent) Schema(r huma.Registry) *huma.Schema {
+	return typedTaggedEventStreamEnvelopeSchema{}.Schema(r)
+}
+
+// toWireEvent decodes the bus's opaque Payload into the registered typed
+// variant when one exists. Custom event types are still part of the public
+// event contract because `gc event emit` accepts them, so they pass through
+// under the schema's custom-event branch.
 func toWireEvent(e events.Event) (WireEvent, bool) {
 	decoded, registered, err := events.DecodePayload(e.Type, e.Payload)
 	if err != nil {
 		log.Printf("api: events wire: decode payload for %q seq=%d: %v", e.Type, e.Seq, err)
 		return WireEvent{}, false
 	}
-	var payload events.Payload
+	payload, err := customEventPayload(e.Payload)
+	if err != nil {
+		log.Printf("api: events wire: decode custom payload for %q seq=%d: %v", e.Type, e.Seq, err)
+		return WireEvent{}, false
+	}
 	if registered {
-		payload, _ = decoded.(events.Payload)
+		payload = decoded
 	}
 	return WireEvent{
 		Seq:     e.Seq,
@@ -104,13 +108,14 @@ func toWireEvent(e events.Event) (WireEvent, bool) {
 
 // toWireTaggedEvent is the supervisor-scope analog of toWireEvent,
 // preserving the City tag the multiplexer attached to the event.
-// Same skip-not-degrade contract: returns ok=false on decode failure.
+// Same skip-not-degrade contract for corrupt registered payloads; custom
+// event types pass through.
 func toWireTaggedEvent(te events.TaggedEvent) (WireTaggedEvent, bool) {
 	wire, ok := toWireEvent(te.Event)
 	if !ok {
 		return WireTaggedEvent{}, false
 	}
-	return WireTaggedEvent{WireEvent: wire, City: te.City}, true
+	return WireTaggedEvent{WireEvent: wire, City: taggedEventWireCity(te)}, true
 }
 
 // eventStreamEnvelope is the wire shape emitted on
@@ -145,26 +150,18 @@ type taggedEventStreamEnvelope struct {
 	Workflow *workflowEventProjection `json:"workflow,omitempty"`
 }
 
-// EventPayloadUnion wraps any registered events.Payload for wire
-// emission. Its MarshalJSON emits the concrete variant's shape
-// directly (no wrapper object); its Schema registers a named
-// EventPayload oneOf component in the OpenAPI spec so generated
-// clients receive a discriminated union over every registered payload
-// type (Principle 7). MarshalJSON is schema-intentional per Principle
-// 4's edge-case list: it enables the oneOf wire shape, not opaque
-// pass-through. No UnmarshalJSON is defined — the server is
-// marshal-only on this type, and absence of a custom unmarshaler
-// makes accidental in-process round-trips fail loudly at the
-// interface field rather than silently dropping bytes.
+// EventPayloadUnion wraps any registered events.Payload or custom raw JSON
+// payload for wire emission. Known event types keep their registered payload
+// shape; custom event types preserve what was recorded.
 type EventPayloadUnion struct {
-	Value events.Payload
+	Value any
 }
 
 // MarshalJSON emits the concrete payload's JSON directly so the wire
 // sees {"rig":...} (for mail) rather than {"Value": {...}}.
 func (p EventPayloadUnion) MarshalJSON() ([]byte, error) {
 	if p.Value == nil {
-		return []byte("null"), nil
+		return []byte("{}"), nil
 	}
 	return json.Marshal(p.Value)
 }
@@ -204,20 +201,20 @@ func (EventPayloadUnion) Schema(r huma.Registry) *huma.Schema {
 	return &huma.Schema{Ref: schemaRefPrefix + name}
 }
 
-// wireEventFrom decodes the bus's opaque Payload into the registered
-// typed variant and returns a wire envelope ready for SSE emission on
-// the per-city stream. Unregistered event types cause an error —
-// Principle 7's strict policy enforced at emission time
-// (the registry-coverage test catches this at CI).
+// wireEventFrom decodes the bus's opaque Payload into the registered typed
+// variant when one exists and otherwise emits a custom-event envelope.
 func wireEventFrom(e events.Event, workflow *workflowEventProjection) (eventStreamEnvelope, error) {
 	decoded, registered, err := events.DecodePayload(e.Type, e.Payload)
 	if err != nil {
 		return eventStreamEnvelope{}, fmt.Errorf("decode %s payload: %w", e.Type, err)
 	}
-	if !registered {
-		return eventStreamEnvelope{}, fmt.Errorf("event type %q has no registered payload (see internal/api/event_payloads.go)", e.Type)
+	payload, err := customEventPayload(e.Payload)
+	if err != nil {
+		return eventStreamEnvelope{}, fmt.Errorf("decode custom %s payload: %w", e.Type, err)
+	}
+	if registered {
+		payload = decoded
 	}
-	payload, _ := decoded.(events.Payload)
 	return eventStreamEnvelope{
 		Seq:      e.Seq,
 		Type:     e.Type,
@@ -236,10 +233,13 @@ func wireTaggedEventFrom(te events.TaggedEvent, workflow *workflowEventProjectio
 	if err != nil {
 		return taggedEventStreamEnvelope{}, fmt.Errorf("decode %s payload: %w", te.Type, err)
 	}
-	if !registered {
-		return taggedEventStreamEnvelope{}, fmt.Errorf("event type %q has no registered payload (see internal/api/event_payloads.go)", te.Type)
+	payload, err := customEventPayload(te.Payload)
+	if err != nil {
+		return taggedEventStreamEnvelope{}, fmt.Errorf("decode custom %s payload: %w", te.Type, err)
+	}
+	if registered {
+		payload = decoded
 	}
-	payload, _ := decoded.(events.Payload)
 	return taggedEventStreamEnvelope{
 		Seq:      te.Seq,
 		Type:     te.Type,
@@ -248,11 +248,52 @@ func wireTaggedEventFrom(te events.TaggedEvent, workflow *workflowEventProjectio
 		Subject:  te.Subject,
 		Message:  te.Message,
 		Payload:  EventPayloadUnion{Value: payload},
-		City:     te.City,
+		City:     taggedEventWireCity(te),
 		Workflow: workflow,
 	}, nil
 }
 
+func taggedEventWireCity(te events.TaggedEvent) string {
+	if te.City != "__supervisor__" {
+		return te.City
+	}
+	if te.Subject != "" && isCityRequestResultType(te.Type) {
+		return te.Subject
+	}
+	switch te.Type {
+	case events.RequestResultCityCreate:
+		var payload CityCreateSucceededPayload
+		if json.Unmarshal(te.Payload, &payload) == nil && payload.Name != "" {
+			return payload.Name
+		}
+	case events.RequestResultCityUnregister:
+		var payload CityUnregisterSucceededPayload
+		if json.Unmarshal(te.Payload, &payload) == nil && payload.Name != "" {
+			return payload.Name
+		}
+	}
+	return te.City
+}
+
+func isCityRequestResultType(eventType string) bool {
+	switch eventType {
+	case events.RequestResultCityCreate, events.RequestResultCityUnregister, events.RequestFailed:
+		return true
+	default:
+		return false
+	}
+}
+
+func customEventPayload(raw json.RawMessage) (any, error) {
+	if len(raw) == 0 {
+		return map[string]any{}, nil
+	}
+	if !json.Valid(raw) {
+		return nil, fmt.Errorf("invalid JSON")
+	}
+	return raw, nil
+}
+
 func projectWorkflowEvent(state State, event events.Event) *workflowEventProjection {
 	if !isWorkflowEventType(event.Type) {
 		return nil
diff --git a/internal/api/convoy_event_stream_test.go b/internal/api/convoy_event_stream_test.go
index 9aca4436fa..d9cb864d82 100644
--- a/internal/api/convoy_event_stream_test.go
+++ b/internal/api/convoy_event_stream_test.go
@@ -14,11 +14,7 @@ func TestCityLifecycleEventsSharePayloadTypeForOneOfValidation(t *testing.T) {
 	registered := events.RegisteredPayloadTypes()
 	cityEvents := []string{
 		events.CityCreated,
-		events.CityReady,
-		events.CityInitFailed,
 		events.CityUnregisterRequested,
-		events.CityUnregistered,
-		events.CityUnregisterFailed,
 	}
 
 	firstType := reflect.TypeOf(registered[cityEvents[0]])
diff --git a/internal/api/convoy_sql.go b/internal/api/convoy_sql.go
index 28750a43a4..68719facd6 100644
--- a/internal/api/convoy_sql.go
+++ b/internal/api/convoy_sql.go
@@ -272,7 +272,7 @@ func (s *Server) tryFullWorkflowSQL(workflowID, fallbackScopeKind, fallbackScope
 
 	store := &prefetchedDepStore{deps: depMap}
 
-	// Collect physical deps only — logical nodes are computed by MC.
+	// Collect physical deps only — logical nodes are computed by real-world app.
 	workflowDeps, partial := collectWorkflowDeps(store, beadIndex)
 
 	scopeKind := fallbackScopeKind
diff --git a/internal/api/event_envelope_schemas.go b/internal/api/event_envelope_schemas.go
index d40848ba69..1d361a783c 100644
--- a/internal/api/event_envelope_schemas.go
+++ b/internal/api/event_envelope_schemas.go
@@ -63,6 +63,12 @@ func registerTypedEventEnvelopeSchema(r huma.Registry, cfg typedEventEnvelopeSch
 			oneOf = append(oneOf, &huma.Schema{Ref: ref})
 			mapping[variant.eventType] = ref
 		}
+		customName := cfg.name + "Custom"
+		customRef := schemaRefPrefix + customName
+		if _, ok := r.Map()[customName]; !ok {
+			r.Map()[customName] = customEventEnvelopeVariantSchema(r, cfg)
+		}
+		oneOf = append(oneOf, &huma.Schema{Ref: customRef})
 		r.Map()[cfg.name] = &huma.Schema{
 			Title:       cfg.title,
 			Description: cfg.description,
@@ -142,6 +148,51 @@ func typedEventEnvelopeVariantSchema(r huma.Registry, variant typedEventEnvelope
 	}
 }
 
+func customEventEnvelopeVariantSchema(r huma.Registry, cfg typedEventEnvelopeSchemaConfig) *huma.Schema {
+	knownTypes := make([]any, 0, len(events.KnownEventTypes))
+	for _, eventType := range events.KnownEventTypes {
+		knownTypes = append(knownTypes, eventType)
+	}
+	properties := map[string]*huma.Schema{
+		"seq": {
+			Type:    huma.TypeInteger,
+			Format:  "int64",
+			Minimum: float64Ptr(0),
+		},
+		"type": {
+			Type: huma.TypeString,
+			Not:  &huma.Schema{Enum: knownTypes},
+		},
+		"ts": {
+			Type:   huma.TypeString,
+			Format: "date-time",
+		},
+		"actor": {
+			Type: huma.TypeString,
+		},
+		"subject": {
+			Type: huma.TypeString,
+		},
+		"message": {
+			Type: huma.TypeString,
+		},
+		"workflow": r.Schema(reflect.TypeOf(workflowEventProjection{}), true, "WorkflowEventProjection"),
+		"payload":  {},
+	}
+	required := []string{"seq", "type", "ts", "actor", "payload"}
+	if cfg.includeCity {
+		properties["city"] = &huma.Schema{Type: huma.TypeString}
+		required = append(required, "city")
+	}
+	return &huma.Schema{
+		Title:                cfg.name + " custom",
+		Type:                 huma.TypeObject,
+		AdditionalProperties: false,
+		Properties:           properties,
+		Required:             required,
+	}
+}
+
 func eventTypeSchemaSuffix(eventType string) string {
 	parts := strings.FieldsFunc(eventType, func(r rune) bool {
 		return r == '.' || r == '_' || r == '-'
diff --git a/internal/api/event_payloads.go b/internal/api/event_payloads.go
index fffb9755e3..9ab6d600ce 100644
--- a/internal/api/event_payloads.go
+++ b/internal/api/event_payloads.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"encoding/json"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -28,45 +29,97 @@ type MailEventPayload struct {
 // IsEventPayload marks MailEventPayload as an events.Payload variant.
 func (MailEventPayload) IsEventPayload() {}
 
-// CityLifecyclePayload is emitted by city lifecycle events. Keeping all
-// same-shaped city lifecycle payloads on one Go type keeps the generated
-// EventPayload oneOf unambiguous for validators that only see the payload
-// object, not the enclosing event type.
-type CityLifecyclePayload struct {
-	Name            string   `json:"name"`
-	Path            string   `json:"path"`
-	Error           string   `json:"error,omitempty"`
-	PhasesCompleted []string `json:"phases_completed,omitempty"`
+// Operation constants used by RequestFailedPayload.
+const (
+	RequestOperationCityCreate     = "city.create"
+	RequestOperationCityUnregister = "city.unregister"
+	RequestOperationSessionCreate  = "session.create"
+	RequestOperationSessionMessage = "session.message"
+	RequestOperationSessionSubmit  = "session.submit"
+)
+
+// --- Typed async request result payloads ---
+//
+// 5 success types (one per operation, fully typed) + 1 shared failure
+// type. The event type encodes operation and outcome; no string
+// discriminator fields on success payloads.
+
+// CityCreateSucceededPayload is emitted on request.result.city.create.
+type CityCreateSucceededPayload struct {
+	RequestID string `json:"request_id" doc:"Correlation ID from the 202 response."`
+	Name      string `json:"name" doc:"Resolved city name."`
+	Path      string `json:"path" doc:"Resolved absolute city directory path."`
 }
 
-// IsEventPayload marks CityLifecyclePayload as an events.Payload variant.
-func (CityLifecyclePayload) IsEventPayload() {}
+// IsEventPayload marks CityCreateSucceededPayload as an events.Payload variant.
+func (CityCreateSucceededPayload) IsEventPayload() {}
+
+// CityUnregisterSucceededPayload is emitted on request.result.city.unregister.
+type CityUnregisterSucceededPayload struct {
+	RequestID string `json:"request_id" doc:"Correlation ID from the 202 response."`
+	Name      string `json:"name" doc:"City name that was unregistered."`
+	Path      string `json:"path" doc:"Absolute city directory path."`
+}
+
+// IsEventPayload marks CityUnregisterSucceededPayload as an events.Payload variant.
+func (CityUnregisterSucceededPayload) IsEventPayload() {}
+
+// SessionCreateSucceededPayload is emitted on request.result.session.create.
+type SessionCreateSucceededPayload struct {
+	RequestID string          `json:"request_id" doc:"Correlation ID from the 202 response."`
+	Session   sessionResponse `json:"session" doc:"Full session state as returned by GET /session/{id}. For session.create, this result is emitted only after the session has left creating and can accept normal metadata and lifecycle commands."`
+}
+
+// IsEventPayload marks SessionCreateSucceededPayload as an events.Payload variant.
+func (SessionCreateSucceededPayload) IsEventPayload() {}
+
+// SessionMessageSucceededPayload is emitted on request.result.session.message.
+type SessionMessageSucceededPayload struct {
+	RequestID string `json:"request_id" doc:"Correlation ID from the 202 response."`
+	SessionID string `json:"session_id" doc:"Session ID that received the message."`
+}
 
-// CityCreatedPayload is emitted on city.created when the supervisor's
-// POST /v0/city handler has scaffolded and registered a new city.
-type CityCreatedPayload = CityLifecyclePayload
+// IsEventPayload marks SessionMessageSucceededPayload as an events.Payload variant.
+func (SessionMessageSucceededPayload) IsEventPayload() {}
 
-// CityReadyPayload is emitted on city.ready when the supervisor
-// reconciler has finished preparing a city.
-type CityReadyPayload = CityLifecyclePayload
+// SessionSubmitSucceededPayload is emitted on request.result.session.submit.
+type SessionSubmitSucceededPayload struct {
+	RequestID string `json:"request_id" doc:"Correlation ID from the 202 response."`
+	SessionID string `json:"session_id" doc:"Session ID that received the submission."`
+	Queued    bool   `json:"queued" doc:"Whether the message was queued for later delivery."`
+	Intent    string `json:"intent" doc:"Resolved submit intent (default, follow_up, interrupt_now)."`
+}
 
-// CityInitFailedPayload is emitted on city.init_failed when the
-// supervisor reconciler fails to bring up a city.
-type CityInitFailedPayload = CityLifecyclePayload
+// IsEventPayload marks SessionSubmitSucceededPayload as an events.Payload variant.
+func (SessionSubmitSucceededPayload) IsEventPayload() {}
 
-// CityUnregisterRequestedPayload is emitted when unregister starts.
-type CityUnregisterRequestedPayload = CityLifecyclePayload
+// RequestFailedPayload is emitted on request.failed for any async
+// operation that fails. The operation enum identifies which operation.
+type RequestFailedPayload struct {
+	RequestID    string `json:"request_id" doc:"Correlation ID from the 202 response."`
+	Operation    string `json:"operation" enum:"city.create,city.unregister,session.create,session.message,session.submit" doc:"Which operation failed."`
+	ErrorCode    string `json:"error_code" doc:"Machine-readable error code."`
+	ErrorMessage string `json:"error_message" doc:"Human-readable error description."`
+}
 
-// CityUnregisteredPayload is emitted when unregister completes.
-type CityUnregisteredPayload = CityLifecyclePayload
+// IsEventPayload marks RequestFailedPayload as an events.Payload variant.
+func (RequestFailedPayload) IsEventPayload() {}
 
-// CityUnregisterFailedPayload is emitted when unregister fails.
-type CityUnregisterFailedPayload = CityLifecyclePayload
+// CityLifecyclePayload is the shape of non-terminal city.created and
+// city.unregister_requested events recorded in the per-city event log
+// during init/unregister for diagnostics.
+type CityLifecyclePayload struct {
+	Name string `json:"name"`
+	Path string `json:"path"`
+}
+
+// IsEventPayload marks CityLifecyclePayload as an events.Payload variant.
+func (CityLifecyclePayload) IsEventPayload() {}
 
 // BeadEventPayload is the shape of every bead.* event payload
 // (BeadCreated, BeadUpdated, BeadClosed). The payload carries a full
-// snapshot of the bead as of the event; it is emitted by the beads
-// CachingStore's reconcile loop when external changes are detected.
+// snapshot of the bead as of the event; it is emitted by bd hooks and by
+// the beads CachingStore's reconcile loop when external changes are detected.
 type BeadEventPayload struct {
 	Bead beads.Bead `json:"bead"`
 }
@@ -74,6 +127,79 @@ type BeadEventPayload struct {
 // IsEventPayload marks BeadEventPayload as an events.Payload variant.
 func (BeadEventPayload) IsEventPayload() {}
 
+// UnmarshalJSON accepts the current {"bead": ...} payload shape and the
+// legacy raw-bead shape emitted by older bd hook scripts.
+func (p *BeadEventPayload) UnmarshalJSON(data []byte) error {
+	var wrapped struct {
+		Bead *json.RawMessage `json:"bead"`
+	}
+	if err := json.Unmarshal(data, &wrapped); err != nil {
+		return err
+	}
+	if wrapped.Bead != nil {
+		bead, err := decodeBeadEventPayloadBead(*wrapped.Bead)
+		if err != nil {
+			return err
+		}
+		p.Bead = bead
+		return nil
+	}
+
+	bead, err := decodeBeadEventPayloadBead(data)
+	if err != nil {
+		return err
+	}
+	p.Bead = bead
+	return nil
+}
+
+func decodeBeadEventPayloadBead(data []byte) (beads.Bead, error) {
+	var wire struct {
+		ID           string          `json:"id"`
+		Title        string          `json:"title"`
+		Status       string          `json:"status"`
+		Type         string          `json:"issue_type"`
+		TypeCompat   string          `json:"type,omitempty"`
+		Priority     *int            `json:"priority,omitempty"`
+		CreatedAt    time.Time       `json:"created_at"`
+		Assignee     string          `json:"assignee,omitempty"`
+		From         string          `json:"from,omitempty"`
+		ParentID     string          `json:"parent,omitempty"`
+		Ref          string          `json:"ref,omitempty"`
+		Needs        []string        `json:"needs,omitempty"`
+		Description  string          `json:"description,omitempty"`
+		Labels       []string        `json:"labels,omitempty"`
+		Metadata     beads.StringMap `json:"metadata,omitempty"`
+		Dependencies []beads.Dep     `json:"dependencies,omitempty"`
+	}
+	if err := json.Unmarshal(data, &wire); err != nil {
+		return beads.Bead{}, err
+	}
+	bead := beads.Bead{
+		ID:           wire.ID,
+		Title:        wire.Title,
+		Status:       wire.Status,
+		Type:         wire.Type,
+		Priority:     wire.Priority,
+		CreatedAt:    wire.CreatedAt,
+		Assignee:     wire.Assignee,
+		From:         wire.From,
+		ParentID:     wire.ParentID,
+		Ref:          wire.Ref,
+		Needs:        wire.Needs,
+		Description:  wire.Description,
+		Labels:       wire.Labels,
+		Dependencies: wire.Dependencies,
+	}
+	if bead.Type == "" {
+		bead.Type = wire.TypeCompat
+	}
+	if wire.Metadata != nil {
+		bead.Metadata = map[string]string(wire.Metadata)
+	}
+	return bead, nil
+}
+
 // WorkerOperationEventPayload is the typed payload projected for
 // worker.operation events on the supervisor event stream.
 type WorkerOperationEventPayload struct {
@@ -132,15 +258,21 @@ func init() {
 	events.RegisterPayload(events.ControllerStopped, events.NoPayload{})
 	events.RegisterPayload(events.CitySuspended, events.NoPayload{})
 	events.RegisterPayload(events.CityResumed, events.NoPayload{})
-	events.RegisterPayload(events.CityCreated, CityCreatedPayload{})
-	events.RegisterPayload(events.CityReady, CityReadyPayload{})
-	events.RegisterPayload(events.CityInitFailed, CityInitFailedPayload{})
+	// Typed async request result events.
+	events.RegisterPayload(events.RequestResultCityCreate, CityCreateSucceededPayload{})
+	events.RegisterPayload(events.RequestResultCityUnregister, CityUnregisterSucceededPayload{})
+	events.RegisterPayload(events.RequestResultSessionCreate, SessionCreateSucceededPayload{})
+	events.RegisterPayload(events.RequestResultSessionMessage, SessionMessageSucceededPayload{})
+	events.RegisterPayload(events.RequestResultSessionSubmit, SessionSubmitSucceededPayload{})
+	events.RegisterPayload(events.RequestFailed, RequestFailedPayload{})
+
+	// Non-terminal city lifecycle events (diagnostics only).
+	events.RegisterPayload(events.CityCreated, CityLifecyclePayload{})
+	events.RegisterPayload(events.CityUnregisterRequested, CityLifecyclePayload{})
+
 	events.RegisterPayload(events.OrderFired, events.NoPayload{})
 	events.RegisterPayload(events.OrderCompleted, events.NoPayload{})
 	events.RegisterPayload(events.OrderFailed, events.NoPayload{})
 	events.RegisterPayload(events.ProviderSwapped, events.NoPayload{})
 	events.RegisterPayload(events.WorkerOperation, WorkerOperationEventPayload{})
-	events.RegisterPayload(events.CityUnregisterRequested, CityUnregisterRequestedPayload{})
-	events.RegisterPayload(events.CityUnregistered, CityUnregisteredPayload{})
-	events.RegisterPayload(events.CityUnregisterFailed, CityUnregisterFailedPayload{})
 }
diff --git a/internal/api/event_payloads_test.go b/internal/api/event_payloads_test.go
new file mode 100644
index 0000000000..fb1bb285b0
--- /dev/null
+++ b/internal/api/event_payloads_test.go
@@ -0,0 +1,81 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+func TestDecodeBeadEventPayloadWrapped(t *testing.T) {
+	raw := json.RawMessage(`{"bead":{"id":"bd-123","title":"test bead","status":"open","issue_type":"task","created_at":"2026-04-26T21:37:46Z","metadata":{"state":"awake"}}}`)
+
+	got, registered, err := events.DecodePayload(events.BeadUpdated, raw)
+	if err != nil {
+		t.Fatalf("DecodePayload: %v", err)
+	}
+	if !registered {
+		t.Fatal("registered = false, want true")
+	}
+	payload, ok := got.(BeadEventPayload)
+	if !ok {
+		t.Fatalf("payload = %T, want BeadEventPayload", got)
+	}
+	if payload.Bead.ID != "bd-123" {
+		t.Fatalf("bead id = %q, want bd-123", payload.Bead.ID)
+	}
+	if payload.Bead.Metadata["state"] != "awake" {
+		t.Fatalf("metadata state = %q, want awake", payload.Bead.Metadata["state"])
+	}
+	if payload.Bead.CreatedAt != time.Date(2026, 4, 26, 21, 37, 46, 0, time.UTC) {
+		t.Fatalf("created_at = %s, want 2026-04-26T21:37:46Z", payload.Bead.CreatedAt.Format(time.RFC3339))
+	}
+}
+
+func TestDecodeBeadEventPayloadLegacyRawBead(t *testing.T) {
+	raw := json.RawMessage(`{"id":"bd-123","title":"test bead","status":"open","issue_type":"task","created_at":"2026-04-26T21:37:46Z","metadata":{"state":"awake"}}`)
+
+	got, registered, err := events.DecodePayload(events.BeadUpdated, raw)
+	if err != nil {
+		t.Fatalf("DecodePayload: %v", err)
+	}
+	if !registered {
+		t.Fatal("registered = false, want true")
+	}
+	payload, ok := got.(BeadEventPayload)
+	if !ok {
+		t.Fatalf("payload = %T, want BeadEventPayload", got)
+	}
+	if payload.Bead.ID != "bd-123" {
+		t.Fatalf("bead id = %q, want bd-123", payload.Bead.ID)
+	}
+	if payload.Bead.Metadata["state"] != "awake" {
+		t.Fatalf("metadata state = %q, want awake", payload.Bead.Metadata["state"])
+	}
+}
+
+func TestDecodeBeadEventPayloadCoercesNonStringMetadata(t *testing.T) {
+	raw := json.RawMessage(`{"bead":{"id":"bd-123","title":"test bead","status":"open","issue_type":"session","created_at":"2026-04-26T21:37:46Z","metadata":{"generation":3,"pending_create_claim":true,"wake_attempts":0}}}`)
+
+	got, registered, err := events.DecodePayload(events.BeadUpdated, raw)
+	if err != nil {
+		t.Fatalf("DecodePayload: %v", err)
+	}
+	if !registered {
+		t.Fatal("registered = false, want true")
+	}
+	payload, ok := got.(BeadEventPayload)
+	if !ok {
+		t.Fatalf("payload = %T, want BeadEventPayload", got)
+	}
+	if payload.Bead.Metadata["generation"] != "3" {
+		t.Fatalf("generation = %q, want 3", payload.Bead.Metadata["generation"])
+	}
+	if payload.Bead.Metadata["pending_create_claim"] != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", payload.Bead.Metadata["pending_create_claim"])
+	}
+	if payload.Bead.Metadata["wake_attempts"] != "0" {
+		t.Fatalf("wake_attempts = %q, want 0", payload.Bead.Metadata["wake_attempts"])
+	}
+}
diff --git a/internal/api/genclient/client_gen.go b/internal/api/genclient/client_gen.go
index 2b1a71518a..7a1ffcb4e7 100644
--- a/internal/api/genclient/client_gen.go
+++ b/internal/api/genclient/client_gen.go
@@ -81,6 +81,33 @@ func (e ConversationKind) Valid() bool {
 	}
 }
 
+// Defines values for RequestFailedPayloadOperation.
+const (
+	CityCreate     RequestFailedPayloadOperation = "city.create"
+	CityUnregister RequestFailedPayloadOperation = "city.unregister"
+	SessionCreate  RequestFailedPayloadOperation = "session.create"
+	SessionMessage RequestFailedPayloadOperation = "session.message"
+	SessionSubmit  RequestFailedPayloadOperation = "session.submit"
+)
+
+// Valid indicates whether the value is a known member of the RequestFailedPayloadOperation enum.
+func (e RequestFailedPayloadOperation) Valid() bool {
+	switch e {
+	case CityCreate:
+		return true
+	case CityUnregister:
+		return true
+	case SessionCreate:
+		return true
+	case SessionMessage:
+		return true
+	case SessionSubmit:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for SubmitIntent.
 const (
 	Default      SubmitIntent = "default"
@@ -386,6 +413,27 @@ type AnnotatedProviderResponse struct {
 	ReadyDelayMs *int64  `json:"ready_delay_ms,omitempty"`
 }
 
+// AsyncAcceptedBody defines model for AsyncAcceptedBody.
+type AsyncAcceptedBody struct {
+	// EventCursor City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty.
+	EventCursor string `json:"event_cursor"`
+
+	// RequestId Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id.
+	RequestId string `json:"request_id"`
+
+	// Status Async request status.
+	Status string `json:"status"`
+}
+
+// AsyncAcceptedResponse defines model for AsyncAcceptedResponse.
+type AsyncAcceptedResponse struct {
+	// EventCursor Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty.
+	EventCursor string `json:"event_cursor"`
+
+	// RequestId Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id.
+	RequestId string `json:"request_id"`
+}
+
 // Bead defines model for Bead.
 type Bead struct {
 	Assignee     *string            `json:"assignee,omitempty"`
@@ -509,23 +557,26 @@ type CityCreateRequest struct {
 	// Dir Directory to create the city in. Absolute or relative to $HOME.
 	Dir string `json:"dir"`
 
-	// Provider Provider name for the city's default session template.
-	Provider string `json:"provider"`
+	// Provider Provider name for the city's default session template. Mutually exclusive with start_command.
+	Provider *string `json:"provider,omitempty"`
+
+	// StartCommand Custom workspace start command for the city's default session template. Mutually exclusive with provider.
+	StartCommand *string `json:"start_command,omitempty"`
 }
 
 // CityCreateRequestBootstrapProfile Optional bootstrap profile.
 type CityCreateRequestBootstrapProfile string
 
-// CityCreateResponse defines model for CityCreateResponse.
-type CityCreateResponse struct {
-	// Name Resolved city name as persisted in city.toml. Use this to filter the event stream for completion.
+// CityCreateSucceededPayload defines model for CityCreateSucceededPayload.
+type CityCreateSucceededPayload struct {
+	// Name Resolved city name.
 	Name string `json:"name"`
 
-	// Ok True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready.
-	Ok bool `json:"ok"`
-
-	// Path Resolved absolute path of the created city directory.
+	// Path Resolved absolute city directory path.
 	Path string `json:"path"`
+
+	// RequestId Correlation ID from the 202 response.
+	RequestId string `json:"request_id"`
 }
 
 // CityGetResponse defines model for CityGetResponse.
@@ -553,10 +604,8 @@ type CityInfo struct {
 
 // CityLifecyclePayload defines model for CityLifecyclePayload.
 type CityLifecyclePayload struct {
-	Error           *string   `json:"error,omitempty"`
-	Name            string    `json:"name"`
-	Path            string    `json:"path"`
-	PhasesCompleted *[]string `json:"phases_completed,omitempty"`
+	Name string `json:"name"`
+	Path string `json:"path"`
 }
 
 // CityPatchInputBody defines model for CityPatchInputBody.
@@ -565,16 +614,16 @@ type CityPatchInputBody struct {
 	Suspended *bool `json:"suspended,omitempty"`
 }
 
-// CityUnregisterResponse defines model for CityUnregisterResponse.
-type CityUnregisterResponse struct {
-	// Name Resolved registry name. Filter the event stream by this to observe completion.
+// CityUnregisterSucceededPayload defines model for CityUnregisterSucceededPayload.
+type CityUnregisterSucceededPayload struct {
+	// Name City name that was unregistered.
 	Name string `json:"name"`
 
-	// Ok True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered.
-	Ok bool `json:"ok"`
-
-	// Path Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry.
+	// Path Absolute city directory path.
 	Path string `json:"path"`
+
+	// RequestId Correlation ID from the 202 response.
+	RequestId string `json:"request_id"`
 }
 
 // ConfigAgentResponse defines model for ConfigAgentResponse.
@@ -1062,6 +1111,9 @@ type FormulaListBody struct {
 
 	// Partial Whether the list is partial.
 	Partial bool `json:"partial"`
+
+	// Total Total number of formulas in the list.
+	Total int64 `json:"total"`
 }
 
 // FormulaPreviewBody defines model for FormulaPreviewBody.
@@ -1430,7 +1482,7 @@ type ListBodyStatus struct {
 // ListBodyWireEvent defines model for ListBodyWireEvent.
 type ListBodyWireEvent struct {
 	// Items The list of items.
-	Items *[]WireEvent `json:"items"`
+	Items *[]TypedEventStreamEnvelope `json:"items"`
 
 	// NextCursor Cursor for the next page of results.
 	NextCursor *string `json:"next_cursor,omitempty"`
@@ -1993,6 +2045,24 @@ type ReadinessResponse struct {
 	Items map[string]ReadinessItem `json:"items"`
 }
 
+// RequestFailedPayload defines model for RequestFailedPayload.
+type RequestFailedPayload struct {
+	// ErrorCode Machine-readable error code.
+	ErrorCode string `json:"error_code"`
+
+	// ErrorMessage Human-readable error description.
+	ErrorMessage string `json:"error_message"`
+
+	// Operation Which operation failed.
+	Operation RequestFailedPayloadOperation `json:"operation"`
+
+	// RequestId Correlation ID from the 202 response.
+	RequestId string `json:"request_id"`
+}
+
+// RequestFailedPayloadOperation Which operation failed.
+type RequestFailedPayloadOperation string
+
 // RigActionBody defines model for RigActionBody.
 type RigActionBody struct {
 	// Action Action that was performed.
@@ -2156,6 +2226,13 @@ type SessionCreateBody struct {
 	Title *string `json:"title,omitempty"`
 }
 
+// SessionCreateSucceededPayload defines model for SessionCreateSucceededPayload.
+type SessionCreateSucceededPayload struct {
+	// RequestId Correlation ID from the 202 response.
+	RequestId string          `json:"request_id"`
+	Session   SessionResponse `json:"session"`
+}
+
 // SessionInfo defines model for SessionInfo.
 type SessionInfo struct {
 	Attached     bool       `json:"attached"`
@@ -2169,13 +2246,13 @@ type SessionMessageInputBody struct {
 	Message string `json:"message"`
 }
 
-// SessionMessageOutputBody defines model for SessionMessageOutputBody.
-type SessionMessageOutputBody struct {
-	// Id Session ID.
-	Id string `json:"id"`
+// SessionMessageSucceededPayload defines model for SessionMessageSucceededPayload.
+type SessionMessageSucceededPayload struct {
+	// RequestId Correlation ID from the 202 response.
+	RequestId string `json:"request_id"`
 
-	// Status Operation result.
-	Status string `json:"status"`
+	// SessionId Session ID that received the message.
+	SessionId string `json:"session_id"`
 }
 
 // SessionPatchBody defines model for SessionPatchBody.
@@ -2296,19 +2373,19 @@ type SessionSubmitInputBody struct {
 	Message string `json:"message"`
 }
 
-// SessionSubmitOutputBody defines model for SessionSubmitOutputBody.
-type SessionSubmitOutputBody struct {
-	// Id Session ID.
-	Id string `json:"id"`
-
-	// Intent Resolved submit intent.
+// SessionSubmitSucceededPayload defines model for SessionSubmitSucceededPayload.
+type SessionSubmitSucceededPayload struct {
+	// Intent Resolved submit intent (default, follow_up, interrupt_now).
 	Intent string `json:"intent"`
 
-	// Queued Whether the message was queued.
+	// Queued Whether the message was queued for later delivery.
 	Queued bool `json:"queued"`
 
-	// Status Operation result.
-	Status string `json:"status"`
+	// RequestId Correlation ID from the 202 response.
+	RequestId string `json:"request_id"`
+
+	// SessionId Session ID that received the submission.
+	SessionId string `json:"session_id"`
 }
 
 // SessionTranscriptGetResponse defines model for SessionTranscriptGetResponse.
@@ -2419,6 +2496,12 @@ type StatusBody struct {
 	// Name City name.
 	Name string `json:"name"`
 
+	// Partial True when one or more status backing reads returned incomplete data.
+	Partial *bool `json:"partial,omitempty"`
+
+	// PartialErrors Human-readable errors from incomplete status backing reads.
+	PartialErrors *[]string `json:"partial_errors,omitempty"`
+
 	// Path City directory path.
 	Path string `json:"path"`
 
@@ -2490,8 +2573,10 @@ type SupervisorCitiesOutputBody struct {
 
 // SupervisorEventListOutputBody defines model for SupervisorEventListOutputBody.
 type SupervisorEventListOutputBody struct {
-	Items *[]WireTaggedEvent `json:"items"`
-	Total int64              `json:"total"`
+	// EventCursor Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog.
+	EventCursor string                            `json:"event_cursor"`
+	Items       *[]TypedTaggedEventStreamEnvelope `json:"items"`
+	Total       int64                             `json:"total"`
 }
 
 // SupervisorHealthOutputBody defines model for SupervisorHealthOutputBody.
@@ -2597,30 +2682,6 @@ type TypedEventStreamEnvelopeCityCreated struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedEventStreamEnvelopeCityInitFailed defines model for TypedEventStreamEnvelopeCityInitFailed.
-type TypedEventStreamEnvelopeCityInitFailed struct {
-	Actor    string                   `json:"actor"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
-// TypedEventStreamEnvelopeCityReady defines model for TypedEventStreamEnvelopeCityReady.
-type TypedEventStreamEnvelopeCityReady struct {
-	Actor    string                   `json:"actor"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
 // TypedEventStreamEnvelopeCityResumed defines model for TypedEventStreamEnvelopeCityResumed.
 type TypedEventStreamEnvelopeCityResumed struct {
 	Actor    string                   `json:"actor"`
@@ -2645,18 +2706,6 @@ type TypedEventStreamEnvelopeCitySuspended struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedEventStreamEnvelopeCityUnregisterFailed defines model for TypedEventStreamEnvelopeCityUnregisterFailed.
-type TypedEventStreamEnvelopeCityUnregisterFailed struct {
-	Actor    string                   `json:"actor"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
 // TypedEventStreamEnvelopeCityUnregisterRequested defines model for TypedEventStreamEnvelopeCityUnregisterRequested.
 type TypedEventStreamEnvelopeCityUnregisterRequested struct {
 	Actor    string                   `json:"actor"`
@@ -2669,18 +2718,6 @@ type TypedEventStreamEnvelopeCityUnregisterRequested struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedEventStreamEnvelopeCityUnregistered defines model for TypedEventStreamEnvelopeCityUnregistered.
-type TypedEventStreamEnvelopeCityUnregistered struct {
-	Actor    string                   `json:"actor"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
 // TypedEventStreamEnvelopeControllerStarted defines model for TypedEventStreamEnvelopeControllerStarted.
 type TypedEventStreamEnvelopeControllerStarted struct {
 	Actor    string                   `json:"actor"`
@@ -2729,6 +2766,18 @@ type TypedEventStreamEnvelopeConvoyCreated struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
+// TypedEventStreamEnvelopeCustom defines model for TypedEventStreamEnvelopeCustom.
+type TypedEventStreamEnvelopeCustom struct {
+	Actor    string                   `json:"actor"`
+	Message  *string                  `json:"message,omitempty"`
+	Payload  interface{}              `json:"payload"`
+	Seq      int64                    `json:"seq"`
+	Subject  *string                  `json:"subject,omitempty"`
+	Ts       time.Time                `json:"ts"`
+	Type     string                   `json:"type"`
+	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
 // TypedEventStreamEnvelopeExtmsgAdapterAdded defines model for TypedEventStreamEnvelopeExtmsgAdapterAdded.
 type TypedEventStreamEnvelopeExtmsgAdapterAdded struct {
 	Actor    string                   `json:"actor"`
@@ -2945,6 +2994,78 @@ type TypedEventStreamEnvelopeProviderSwapped struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
+// TypedEventStreamEnvelopeRequestFailed defines model for TypedEventStreamEnvelopeRequestFailed.
+type TypedEventStreamEnvelopeRequestFailed struct {
+	Actor    string                   `json:"actor"`
+	Message  *string                  `json:"message,omitempty"`
+	Payload  RequestFailedPayload     `json:"payload"`
+	Seq      int64                    `json:"seq"`
+	Subject  *string                  `json:"subject,omitempty"`
+	Ts       time.Time                `json:"ts"`
+	Type     string                   `json:"type"`
+	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
+// TypedEventStreamEnvelopeRequestResultCityCreate defines model for TypedEventStreamEnvelopeRequestResultCityCreate.
+type TypedEventStreamEnvelopeRequestResultCityCreate struct {
+	Actor    string                     `json:"actor"`
+	Message  *string                    `json:"message,omitempty"`
+	Payload  CityCreateSucceededPayload `json:"payload"`
+	Seq      int64                      `json:"seq"`
+	Subject  *string                    `json:"subject,omitempty"`
+	Ts       time.Time                  `json:"ts"`
+	Type     string                     `json:"type"`
+	Workflow *WorkflowEventProjection   `json:"workflow,omitempty"`
+}
+
+// TypedEventStreamEnvelopeRequestResultCityUnregister defines model for TypedEventStreamEnvelopeRequestResultCityUnregister.
+type TypedEventStreamEnvelopeRequestResultCityUnregister struct {
+	Actor    string                         `json:"actor"`
+	Message  *string                        `json:"message,omitempty"`
+	Payload  CityUnregisterSucceededPayload `json:"payload"`
+	Seq      int64                          `json:"seq"`
+	Subject  *string                        `json:"subject,omitempty"`
+	Ts       time.Time                      `json:"ts"`
+	Type     string                         `json:"type"`
+	Workflow *WorkflowEventProjection       `json:"workflow,omitempty"`
+}
+
+// TypedEventStreamEnvelopeRequestResultSessionCreate defines model for TypedEventStreamEnvelopeRequestResultSessionCreate.
+type TypedEventStreamEnvelopeRequestResultSessionCreate struct {
+	Actor    string                        `json:"actor"`
+	Message  *string                       `json:"message,omitempty"`
+	Payload  SessionCreateSucceededPayload `json:"payload"`
+	Seq      int64                         `json:"seq"`
+	Subject  *string                       `json:"subject,omitempty"`
+	Ts       time.Time                     `json:"ts"`
+	Type     string                        `json:"type"`
+	Workflow *WorkflowEventProjection      `json:"workflow,omitempty"`
+}
+
+// TypedEventStreamEnvelopeRequestResultSessionMessage defines model for TypedEventStreamEnvelopeRequestResultSessionMessage.
+type TypedEventStreamEnvelopeRequestResultSessionMessage struct {
+	Actor    string                         `json:"actor"`
+	Message  *string                        `json:"message,omitempty"`
+	Payload  SessionMessageSucceededPayload `json:"payload"`
+	Seq      int64                          `json:"seq"`
+	Subject  *string                        `json:"subject,omitempty"`
+	Ts       time.Time                      `json:"ts"`
+	Type     string                         `json:"type"`
+	Workflow *WorkflowEventProjection       `json:"workflow,omitempty"`
+}
+
+// TypedEventStreamEnvelopeRequestResultSessionSubmit defines model for TypedEventStreamEnvelopeRequestResultSessionSubmit.
+type TypedEventStreamEnvelopeRequestResultSessionSubmit struct {
+	Actor    string                        `json:"actor"`
+	Message  *string                       `json:"message,omitempty"`
+	Payload  SessionSubmitSucceededPayload `json:"payload"`
+	Seq      int64                         `json:"seq"`
+	Subject  *string                       `json:"subject,omitempty"`
+	Ts       time.Time                     `json:"ts"`
+	Type     string                        `json:"type"`
+	Workflow *WorkflowEventProjection      `json:"workflow,omitempty"`
+}
+
 // TypedEventStreamEnvelopeSessionCrashed defines model for TypedEventStreamEnvelopeSessionCrashed.
 type TypedEventStreamEnvelopeSessionCrashed struct {
 	Actor    string                   `json:"actor"`
@@ -3122,32 +3243,6 @@ type TypedTaggedEventStreamEnvelopeCityCreated struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeCityInitFailed defines model for TypedTaggedEventStreamEnvelopeCityInitFailed.
-type TypedTaggedEventStreamEnvelopeCityInitFailed struct {
-	Actor    string                   `json:"actor"`
-	City     string                   `json:"city"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
-// TypedTaggedEventStreamEnvelopeCityReady defines model for TypedTaggedEventStreamEnvelopeCityReady.
-type TypedTaggedEventStreamEnvelopeCityReady struct {
-	Actor    string                   `json:"actor"`
-	City     string                   `json:"city"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
 // TypedTaggedEventStreamEnvelopeCityResumed defines model for TypedTaggedEventStreamEnvelopeCityResumed.
 type TypedTaggedEventStreamEnvelopeCityResumed struct {
 	Actor    string                   `json:"actor"`
@@ -3174,19 +3269,6 @@ type TypedTaggedEventStreamEnvelopeCitySuspended struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeCityUnregisterFailed defines model for TypedTaggedEventStreamEnvelopeCityUnregisterFailed.
-type TypedTaggedEventStreamEnvelopeCityUnregisterFailed struct {
-	Actor    string                   `json:"actor"`
-	City     string                   `json:"city"`
-	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
-	Seq      int64                    `json:"seq"`
-	Subject  *string                  `json:"subject,omitempty"`
-	Ts       time.Time                `json:"ts"`
-	Type     string                   `json:"type"`
-	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
-}
-
 // TypedTaggedEventStreamEnvelopeCityUnregisterRequested defines model for TypedTaggedEventStreamEnvelopeCityUnregisterRequested.
 type TypedTaggedEventStreamEnvelopeCityUnregisterRequested struct {
 	Actor    string                   `json:"actor"`
@@ -3200,12 +3282,12 @@ type TypedTaggedEventStreamEnvelopeCityUnregisterRequested struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeCityUnregistered defines model for TypedTaggedEventStreamEnvelopeCityUnregistered.
-type TypedTaggedEventStreamEnvelopeCityUnregistered struct {
+// TypedTaggedEventStreamEnvelopeControllerStarted defines model for TypedTaggedEventStreamEnvelopeControllerStarted.
+type TypedTaggedEventStreamEnvelopeControllerStarted struct {
 	Actor    string                   `json:"actor"`
 	City     string                   `json:"city"`
 	Message  *string                  `json:"message,omitempty"`
-	Payload  CityLifecyclePayload     `json:"payload"`
+	Payload  NoPayload                `json:"payload"`
 	Seq      int64                    `json:"seq"`
 	Subject  *string                  `json:"subject,omitempty"`
 	Ts       time.Time                `json:"ts"`
@@ -3213,8 +3295,8 @@ type TypedTaggedEventStreamEnvelopeCityUnregistered struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeControllerStarted defines model for TypedTaggedEventStreamEnvelopeControllerStarted.
-type TypedTaggedEventStreamEnvelopeControllerStarted struct {
+// TypedTaggedEventStreamEnvelopeControllerStopped defines model for TypedTaggedEventStreamEnvelopeControllerStopped.
+type TypedTaggedEventStreamEnvelopeControllerStopped struct {
 	Actor    string                   `json:"actor"`
 	City     string                   `json:"city"`
 	Message  *string                  `json:"message,omitempty"`
@@ -3226,8 +3308,8 @@ type TypedTaggedEventStreamEnvelopeControllerStarted struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeControllerStopped defines model for TypedTaggedEventStreamEnvelopeControllerStopped.
-type TypedTaggedEventStreamEnvelopeControllerStopped struct {
+// TypedTaggedEventStreamEnvelopeConvoyClosed defines model for TypedTaggedEventStreamEnvelopeConvoyClosed.
+type TypedTaggedEventStreamEnvelopeConvoyClosed struct {
 	Actor    string                   `json:"actor"`
 	City     string                   `json:"city"`
 	Message  *string                  `json:"message,omitempty"`
@@ -3239,8 +3321,8 @@ type TypedTaggedEventStreamEnvelopeControllerStopped struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeConvoyClosed defines model for TypedTaggedEventStreamEnvelopeConvoyClosed.
-type TypedTaggedEventStreamEnvelopeConvoyClosed struct {
+// TypedTaggedEventStreamEnvelopeConvoyCreated defines model for TypedTaggedEventStreamEnvelopeConvoyCreated.
+type TypedTaggedEventStreamEnvelopeConvoyCreated struct {
 	Actor    string                   `json:"actor"`
 	City     string                   `json:"city"`
 	Message  *string                  `json:"message,omitempty"`
@@ -3252,12 +3334,12 @@ type TypedTaggedEventStreamEnvelopeConvoyClosed struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
-// TypedTaggedEventStreamEnvelopeConvoyCreated defines model for TypedTaggedEventStreamEnvelopeConvoyCreated.
-type TypedTaggedEventStreamEnvelopeConvoyCreated struct {
+// TypedTaggedEventStreamEnvelopeCustom defines model for TypedTaggedEventStreamEnvelopeCustom.
+type TypedTaggedEventStreamEnvelopeCustom struct {
 	Actor    string                   `json:"actor"`
 	City     string                   `json:"city"`
 	Message  *string                  `json:"message,omitempty"`
-	Payload  NoPayload                `json:"payload"`
+	Payload  interface{}              `json:"payload"`
 	Seq      int64                    `json:"seq"`
 	Subject  *string                  `json:"subject,omitempty"`
 	Ts       time.Time                `json:"ts"`
@@ -3499,6 +3581,84 @@ type TypedTaggedEventStreamEnvelopeProviderSwapped struct {
 	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
 }
 
+// TypedTaggedEventStreamEnvelopeRequestFailed defines model for TypedTaggedEventStreamEnvelopeRequestFailed.
+type TypedTaggedEventStreamEnvelopeRequestFailed struct {
+	Actor    string                   `json:"actor"`
+	City     string                   `json:"city"`
+	Message  *string                  `json:"message,omitempty"`
+	Payload  RequestFailedPayload     `json:"payload"`
+	Seq      int64                    `json:"seq"`
+	Subject  *string                  `json:"subject,omitempty"`
+	Ts       time.Time                `json:"ts"`
+	Type     string                   `json:"type"`
+	Workflow *WorkflowEventProjection `json:"workflow,omitempty"`
+}
+
+// TypedTaggedEventStreamEnvelopeRequestResultCityCreate defines model for TypedTaggedEventStreamEnvelopeRequestResultCityCreate.
+type TypedTaggedEventStreamEnvelopeRequestResultCityCreate struct {
+	Actor    string                     `json:"actor"`
+	City     string                     `json:"city"`
+	Message  *string                    `json:"message,omitempty"`
+	Payload  CityCreateSucceededPayload `json:"payload"`
+	Seq      int64                      `json:"seq"`
+	Subject  *string                    `json:"subject,omitempty"`
+	Ts       time.Time                  `json:"ts"`
+	Type     string                     `json:"type"`
+	Workflow *WorkflowEventProjection   `json:"workflow,omitempty"`
+}
+
+// TypedTaggedEventStreamEnvelopeRequestResultCityUnregister defines model for TypedTaggedEventStreamEnvelopeRequestResultCityUnregister.
+type TypedTaggedEventStreamEnvelopeRequestResultCityUnregister struct {
+	Actor    string                         `json:"actor"`
+	City     string                         `json:"city"`
+	Message  *string                        `json:"message,omitempty"`
+	Payload  CityUnregisterSucceededPayload `json:"payload"`
+	Seq      int64                          `json:"seq"`
+	Subject  *string                        `json:"subject,omitempty"`
+	Ts       time.Time                      `json:"ts"`
+	Type     string                         `json:"type"`
+	Workflow *WorkflowEventProjection       `json:"workflow,omitempty"`
+}
+
+// TypedTaggedEventStreamEnvelopeRequestResultSessionCreate defines model for TypedTaggedEventStreamEnvelopeRequestResultSessionCreate.
+type TypedTaggedEventStreamEnvelopeRequestResultSessionCreate struct {
+	Actor    string                        `json:"actor"`
+	City     string                        `json:"city"`
+	Message  *string                       `json:"message,omitempty"`
+	Payload  SessionCreateSucceededPayload `json:"payload"`
+	Seq      int64                         `json:"seq"`
+	Subject  *string                       `json:"subject,omitempty"`
+	Ts       time.Time                     `json:"ts"`
+	Type     string                        `json:"type"`
+	Workflow *WorkflowEventProjection      `json:"workflow,omitempty"`
+}
+
+// TypedTaggedEventStreamEnvelopeRequestResultSessionMessage defines model for TypedTaggedEventStreamEnvelopeRequestResultSessionMessage.
+type TypedTaggedEventStreamEnvelopeRequestResultSessionMessage struct {
+	Actor    string                         `json:"actor"`
+	City     string                         `json:"city"`
+	Message  *string                        `json:"message,omitempty"`
+	Payload  SessionMessageSucceededPayload `json:"payload"`
+	Seq      int64                          `json:"seq"`
+	Subject  *string                        `json:"subject,omitempty"`
+	Ts       time.Time                      `json:"ts"`
+	Type     string                         `json:"type"`
+	Workflow *WorkflowEventProjection       `json:"workflow,omitempty"`
+}
+
+// TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit defines model for TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit.
+type TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit struct {
+	Actor    string                        `json:"actor"`
+	City     string                        `json:"city"`
+	Message  *string                       `json:"message,omitempty"`
+	Payload  SessionSubmitSucceededPayload `json:"payload"`
+	Seq      int64                         `json:"seq"`
+	Subject  *string                       `json:"subject,omitempty"`
+	Ts       time.Time                     `json:"ts"`
+	Type     string                        `json:"type"`
+	Workflow *WorkflowEventProjection      `json:"workflow,omitempty"`
+}
+
 // TypedTaggedEventStreamEnvelopeSessionCrashed defines model for TypedTaggedEventStreamEnvelopeSessionCrashed.
 type TypedTaggedEventStreamEnvelopeSessionCrashed struct {
 	Actor    string                   `json:"actor"`
@@ -3635,29 +3795,6 @@ type UnboundEventPayload struct {
 	SessionId string `json:"session_id"`
 }
 
-// WireEvent defines model for WireEvent.
-type WireEvent struct {
-	Actor   string        `json:"actor"`
-	Message *string       `json:"message,omitempty"`
-	Payload *EventPayload `json:"payload,omitempty"`
-	Seq     int64         `json:"seq"`
-	Subject *string       `json:"subject,omitempty"`
-	Ts      time.Time     `json:"ts"`
-	Type    string        `json:"type"`
-}
-
-// WireTaggedEvent defines model for WireTaggedEvent.
-type WireTaggedEvent struct {
-	Actor   string        `json:"actor"`
-	City    string        `json:"city"`
-	Message *string       `json:"message,omitempty"`
-	Payload *EventPayload `json:"payload,omitempty"`
-	Seq     int64         `json:"seq"`
-	Subject *string       `json:"subject,omitempty"`
-	Ts      time.Time     `json:"ts"`
-	Type    string        `json:"type"`
-}
-
 // WorkerOperationEventPayload defines model for WorkerOperationEventPayload.
 type WorkerOperationEventPayload struct {
 	Delivered   *bool     `json:"delivered,omitempty"`
@@ -4035,10 +4172,10 @@ type EmitEventParams struct {
 
 // StreamEventsParams defines parameters for StreamEvents.
 type StreamEventsParams struct {
-	// AfterSeq Reconnect position: only deliver events after this sequence number.
+	// AfterSeq Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.
 	AfterSeq *string `form:"after_seq,omitempty" json:"after_seq,omitempty"`
 
-	// LastEventID SSE reconnect position from the last received event ID.
+	// LastEventID SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.
 	LastEventID *string `json:"Last-Event-ID,omitempty"`
 }
 
@@ -4327,6 +4464,12 @@ type PostV0CityByCityNameOrderByNameEnableParams struct {
 	XGCRequest string `json:"X-GC-Request"`
 }
 
+// GetV0CityByCityNameOrdersCheckParams defines parameters for GetV0CityByCityNameOrdersCheck.
+type GetV0CityByCityNameOrdersCheckParams struct {
+	// Fresh Bypass cached order-check responses and cached order history.
+	Fresh *bool `form:"fresh,omitempty" json:"fresh,omitempty"`
+}
+
 // GetV0CityByCityNameOrdersFeedParams defines parameters for GetV0CityByCityNameOrdersFeed.
 type GetV0CityByCityNameOrdersFeedParams struct {
 	// ScopeKind Scope kind (city or rig).
@@ -4556,6 +4699,9 @@ type GetV0CityByCityNameSessionByIdTranscriptParams struct {
 
 	// Before Pagination cursor: return entries before this UUID.
 	Before *string `form:"before,omitempty" json:"before,omitempty"`
+
+	// After Pagination cursor: return entries after this UUID.
+	After *string `form:"after,omitempty" json:"after,omitempty"`
 }
 
 // PostV0CityByCityNameSessionByIdWakeParams defines parameters for PostV0CityByCityNameSessionByIdWake.
@@ -4650,10 +4796,10 @@ type GetV0EventsParams struct {
 
 // StreamSupervisorEventsParams defines parameters for StreamSupervisorEvents.
 type StreamSupervisorEventsParams struct {
-	// AfterCursor Alternative to Last-Event-ID for browsers that can't set custom headers.
+	// AfterCursor Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.
 	AfterCursor *string `form:"after_cursor,omitempty" json:"after_cursor,omitempty"`
 
-	// LastEventID Reconnect cursor (composite per-city cursor).
+	// LastEventID Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.
 	LastEventID *string `json:"Last-Event-ID,omitempty"`
 }
 
@@ -4873,6 +5019,32 @@ func (t *EventPayload) MergeBoundEventPayload(v BoundEventPayload) error {
 	return err
 }
 
+// AsCityCreateSucceededPayload returns the union data inside the EventPayload as a CityCreateSucceededPayload
+func (t EventPayload) AsCityCreateSucceededPayload() (CityCreateSucceededPayload, error) {
+	var body CityCreateSucceededPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromCityCreateSucceededPayload overwrites any union data inside the EventPayload as the provided CityCreateSucceededPayload
+func (t *EventPayload) FromCityCreateSucceededPayload(v CityCreateSucceededPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeCityCreateSucceededPayload performs a merge with any union data inside the EventPayload, using the provided CityCreateSucceededPayload
+func (t *EventPayload) MergeCityCreateSucceededPayload(v CityCreateSucceededPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsCityLifecyclePayload returns the union data inside the EventPayload as a CityLifecyclePayload
 func (t EventPayload) AsCityLifecyclePayload() (CityLifecyclePayload, error) {
 	var body CityLifecyclePayload
@@ -4899,6 +5071,32 @@ func (t *EventPayload) MergeCityLifecyclePayload(v CityLifecyclePayload) error {
 	return err
 }
 
+// AsCityUnregisterSucceededPayload returns the union data inside the EventPayload as a CityUnregisterSucceededPayload
+func (t EventPayload) AsCityUnregisterSucceededPayload() (CityUnregisterSucceededPayload, error) {
+	var body CityUnregisterSucceededPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromCityUnregisterSucceededPayload overwrites any union data inside the EventPayload as the provided CityUnregisterSucceededPayload
+func (t *EventPayload) FromCityUnregisterSucceededPayload(v CityUnregisterSucceededPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeCityUnregisterSucceededPayload performs a merge with any union data inside the EventPayload, using the provided CityUnregisterSucceededPayload
+func (t *EventPayload) MergeCityUnregisterSucceededPayload(v CityUnregisterSucceededPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsGroupCreatedEventPayload returns the union data inside the EventPayload as a GroupCreatedEventPayload
 func (t EventPayload) AsGroupCreatedEventPayload() (GroupCreatedEventPayload, error) {
 	var body GroupCreatedEventPayload
@@ -5029,22 +5227,22 @@ func (t *EventPayload) MergeOutboundEventPayload(v OutboundEventPayload) error {
 	return err
 }
 
-// AsUnboundEventPayload returns the union data inside the EventPayload as a UnboundEventPayload
-func (t EventPayload) AsUnboundEventPayload() (UnboundEventPayload, error) {
-	var body UnboundEventPayload
+// AsRequestFailedPayload returns the union data inside the EventPayload as a RequestFailedPayload
+func (t EventPayload) AsRequestFailedPayload() (RequestFailedPayload, error) {
+	var body RequestFailedPayload
 	err := json.Unmarshal(t.union, &body)
 	return body, err
 }
 
-// FromUnboundEventPayload overwrites any union data inside the EventPayload as the provided UnboundEventPayload
-func (t *EventPayload) FromUnboundEventPayload(v UnboundEventPayload) error {
+// FromRequestFailedPayload overwrites any union data inside the EventPayload as the provided RequestFailedPayload
+func (t *EventPayload) FromRequestFailedPayload(v RequestFailedPayload) error {
 	b, err := json.Marshal(v)
 	t.union = b
 	return err
 }
 
-// MergeUnboundEventPayload performs a merge with any union data inside the EventPayload, using the provided UnboundEventPayload
-func (t *EventPayload) MergeUnboundEventPayload(v UnboundEventPayload) error {
+// MergeRequestFailedPayload performs a merge with any union data inside the EventPayload, using the provided RequestFailedPayload
+func (t *EventPayload) MergeRequestFailedPayload(v RequestFailedPayload) error {
 	b, err := json.Marshal(v)
 	if err != nil {
 		return err
@@ -5055,22 +5253,22 @@ func (t *EventPayload) MergeUnboundEventPayload(v UnboundEventPayload) error {
 	return err
 }
 
-// AsWorkerOperationEventPayload returns the union data inside the EventPayload as a WorkerOperationEventPayload
-func (t EventPayload) AsWorkerOperationEventPayload() (WorkerOperationEventPayload, error) {
-	var body WorkerOperationEventPayload
+// AsSessionCreateSucceededPayload returns the union data inside the EventPayload as a SessionCreateSucceededPayload
+func (t EventPayload) AsSessionCreateSucceededPayload() (SessionCreateSucceededPayload, error) {
+	var body SessionCreateSucceededPayload
 	err := json.Unmarshal(t.union, &body)
 	return body, err
 }
 
-// FromWorkerOperationEventPayload overwrites any union data inside the EventPayload as the provided WorkerOperationEventPayload
-func (t *EventPayload) FromWorkerOperationEventPayload(v WorkerOperationEventPayload) error {
+// FromSessionCreateSucceededPayload overwrites any union data inside the EventPayload as the provided SessionCreateSucceededPayload
+func (t *EventPayload) FromSessionCreateSucceededPayload(v SessionCreateSucceededPayload) error {
 	b, err := json.Marshal(v)
 	t.union = b
 	return err
 }
 
-// MergeWorkerOperationEventPayload performs a merge with any union data inside the EventPayload, using the provided WorkerOperationEventPayload
-func (t *EventPayload) MergeWorkerOperationEventPayload(v WorkerOperationEventPayload) error {
+// MergeSessionCreateSucceededPayload performs a merge with any union data inside the EventPayload, using the provided SessionCreateSucceededPayload
+func (t *EventPayload) MergeSessionCreateSucceededPayload(v SessionCreateSucceededPayload) error {
 	b, err := json.Marshal(v)
 	if err != nil {
 		return err
@@ -5081,18 +5279,122 @@ func (t *EventPayload) MergeWorkerOperationEventPayload(v WorkerOperationEventPa
 	return err
 }
 
-func (t EventPayload) MarshalJSON() ([]byte, error) {
-	b, err := t.union.MarshalJSON()
-	return b, err
+// AsSessionMessageSucceededPayload returns the union data inside the EventPayload as a SessionMessageSucceededPayload
+func (t EventPayload) AsSessionMessageSucceededPayload() (SessionMessageSucceededPayload, error) {
+	var body SessionMessageSucceededPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
 }
 
-func (t *EventPayload) UnmarshalJSON(b []byte) error {
-	err := t.union.UnmarshalJSON(b)
+// FromSessionMessageSucceededPayload overwrites any union data inside the EventPayload as the provided SessionMessageSucceededPayload
+func (t *EventPayload) FromSessionMessageSucceededPayload(v SessionMessageSucceededPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
 	return err
 }
 
-// AsSessionActivityEvent returns the union data inside the SessionStreamCommonEvent as a SessionActivityEvent
-func (t SessionStreamCommonEvent) AsSessionActivityEvent() (SessionActivityEvent, error) {
+// MergeSessionMessageSucceededPayload performs a merge with any union data inside the EventPayload, using the provided SessionMessageSucceededPayload
+func (t *EventPayload) MergeSessionMessageSucceededPayload(v SessionMessageSucceededPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsSessionSubmitSucceededPayload returns the union data inside the EventPayload as a SessionSubmitSucceededPayload
+func (t EventPayload) AsSessionSubmitSucceededPayload() (SessionSubmitSucceededPayload, error) {
+	var body SessionSubmitSucceededPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromSessionSubmitSucceededPayload overwrites any union data inside the EventPayload as the provided SessionSubmitSucceededPayload
+func (t *EventPayload) FromSessionSubmitSucceededPayload(v SessionSubmitSucceededPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeSessionSubmitSucceededPayload performs a merge with any union data inside the EventPayload, using the provided SessionSubmitSucceededPayload
+func (t *EventPayload) MergeSessionSubmitSucceededPayload(v SessionSubmitSucceededPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsUnboundEventPayload returns the union data inside the EventPayload as a UnboundEventPayload
+func (t EventPayload) AsUnboundEventPayload() (UnboundEventPayload, error) {
+	var body UnboundEventPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromUnboundEventPayload overwrites any union data inside the EventPayload as the provided UnboundEventPayload
+func (t *EventPayload) FromUnboundEventPayload(v UnboundEventPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeUnboundEventPayload performs a merge with any union data inside the EventPayload, using the provided UnboundEventPayload
+func (t *EventPayload) MergeUnboundEventPayload(v UnboundEventPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsWorkerOperationEventPayload returns the union data inside the EventPayload as a WorkerOperationEventPayload
+func (t EventPayload) AsWorkerOperationEventPayload() (WorkerOperationEventPayload, error) {
+	var body WorkerOperationEventPayload
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromWorkerOperationEventPayload overwrites any union data inside the EventPayload as the provided WorkerOperationEventPayload
+func (t *EventPayload) FromWorkerOperationEventPayload(v WorkerOperationEventPayload) error {
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeWorkerOperationEventPayload performs a merge with any union data inside the EventPayload, using the provided WorkerOperationEventPayload
+func (t *EventPayload) MergeWorkerOperationEventPayload(v WorkerOperationEventPayload) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+func (t EventPayload) MarshalJSON() ([]byte, error) {
+	b, err := t.union.MarshalJSON()
+	return b, err
+}
+
+func (t *EventPayload) UnmarshalJSON(b []byte) error {
+	err := t.union.UnmarshalJSON(b)
+	return err
+}
+
+// AsSessionActivityEvent returns the union data inside the SessionStreamCommonEvent as a SessionActivityEvent
+func (t SessionStreamCommonEvent) AsSessionActivityEvent() (SessionActivityEvent, error) {
 	var body SessionActivityEvent
 	err := json.Unmarshal(t.union, &body)
 	return body, err
@@ -5291,62 +5593,6 @@ func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCityCreated(v Ty
 	return err
 }
 
-// AsTypedEventStreamEnvelopeCityInitFailed returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCityInitFailed
-func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCityInitFailed() (TypedEventStreamEnvelopeCityInitFailed, error) {
-	var body TypedEventStreamEnvelopeCityInitFailed
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedEventStreamEnvelopeCityInitFailed overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeCityInitFailed
-func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeCityInitFailed(v TypedEventStreamEnvelopeCityInitFailed) error {
-	v.Type = "city.init_failed"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedEventStreamEnvelopeCityInitFailed performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeCityInitFailed
-func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCityInitFailed(v TypedEventStreamEnvelopeCityInitFailed) error {
-	v.Type = "city.init_failed"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-// AsTypedEventStreamEnvelopeCityReady returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCityReady
-func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCityReady() (TypedEventStreamEnvelopeCityReady, error) {
-	var body TypedEventStreamEnvelopeCityReady
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedEventStreamEnvelopeCityReady overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeCityReady
-func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeCityReady(v TypedEventStreamEnvelopeCityReady) error {
-	v.Type = "city.ready"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedEventStreamEnvelopeCityReady performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeCityReady
-func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCityReady(v TypedEventStreamEnvelopeCityReady) error {
-	v.Type = "city.ready"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
 // AsTypedEventStreamEnvelopeCityResumed returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCityResumed
 func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCityResumed() (TypedEventStreamEnvelopeCityResumed, error) {
 	var body TypedEventStreamEnvelopeCityResumed
@@ -5403,34 +5649,6 @@ func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCitySuspended(v
 	return err
 }
 
-// AsTypedEventStreamEnvelopeCityUnregisterFailed returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCityUnregisterFailed
-func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCityUnregisterFailed() (TypedEventStreamEnvelopeCityUnregisterFailed, error) {
-	var body TypedEventStreamEnvelopeCityUnregisterFailed
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedEventStreamEnvelopeCityUnregisterFailed overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeCityUnregisterFailed
-func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeCityUnregisterFailed(v TypedEventStreamEnvelopeCityUnregisterFailed) error {
-	v.Type = "city.unregister_failed"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedEventStreamEnvelopeCityUnregisterFailed performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeCityUnregisterFailed
-func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCityUnregisterFailed(v TypedEventStreamEnvelopeCityUnregisterFailed) error {
-	v.Type = "city.unregister_failed"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
 // AsTypedEventStreamEnvelopeCityUnregisterRequested returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCityUnregisterRequested
 func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCityUnregisterRequested() (TypedEventStreamEnvelopeCityUnregisterRequested, error) {
 	var body TypedEventStreamEnvelopeCityUnregisterRequested
@@ -5459,34 +5677,6 @@ func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCityUnregisterRe
 	return err
 }
 
-// AsTypedEventStreamEnvelopeCityUnregistered returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCityUnregistered
-func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCityUnregistered() (TypedEventStreamEnvelopeCityUnregistered, error) {
-	var body TypedEventStreamEnvelopeCityUnregistered
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedEventStreamEnvelopeCityUnregistered overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeCityUnregistered
-func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeCityUnregistered(v TypedEventStreamEnvelopeCityUnregistered) error {
-	v.Type = "city.unregistered"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedEventStreamEnvelopeCityUnregistered performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeCityUnregistered
-func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCityUnregistered(v TypedEventStreamEnvelopeCityUnregistered) error {
-	v.Type = "city.unregistered"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
 // AsTypedEventStreamEnvelopeControllerStarted returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeControllerStarted
 func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeControllerStarted() (TypedEventStreamEnvelopeControllerStarted, error) {
 	var body TypedEventStreamEnvelopeControllerStarted
@@ -6103,6 +6293,174 @@ func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeProviderSwapped(
 	return err
 }
 
+// AsTypedEventStreamEnvelopeRequestFailed returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeRequestFailed
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeRequestFailed() (TypedEventStreamEnvelopeRequestFailed, error) {
+	var body TypedEventStreamEnvelopeRequestFailed
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeRequestFailed overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeRequestFailed
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeRequestFailed(v TypedEventStreamEnvelopeRequestFailed) error {
+	v.Type = "request.failed"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeRequestFailed performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeRequestFailed
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeRequestFailed(v TypedEventStreamEnvelopeRequestFailed) error {
+	v.Type = "request.failed"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeRequestResultCityCreate returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeRequestResultCityCreate
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeRequestResultCityCreate() (TypedEventStreamEnvelopeRequestResultCityCreate, error) {
+	var body TypedEventStreamEnvelopeRequestResultCityCreate
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeRequestResultCityCreate overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeRequestResultCityCreate
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeRequestResultCityCreate(v TypedEventStreamEnvelopeRequestResultCityCreate) error {
+	v.Type = "request.result.city.create"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeRequestResultCityCreate performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeRequestResultCityCreate
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeRequestResultCityCreate(v TypedEventStreamEnvelopeRequestResultCityCreate) error {
+	v.Type = "request.result.city.create"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeRequestResultCityUnregister returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeRequestResultCityUnregister
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeRequestResultCityUnregister() (TypedEventStreamEnvelopeRequestResultCityUnregister, error) {
+	var body TypedEventStreamEnvelopeRequestResultCityUnregister
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeRequestResultCityUnregister overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeRequestResultCityUnregister
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeRequestResultCityUnregister(v TypedEventStreamEnvelopeRequestResultCityUnregister) error {
+	v.Type = "request.result.city.unregister"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeRequestResultCityUnregister performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeRequestResultCityUnregister
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeRequestResultCityUnregister(v TypedEventStreamEnvelopeRequestResultCityUnregister) error {
+	v.Type = "request.result.city.unregister"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeRequestResultSessionCreate returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeRequestResultSessionCreate
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeRequestResultSessionCreate() (TypedEventStreamEnvelopeRequestResultSessionCreate, error) {
+	var body TypedEventStreamEnvelopeRequestResultSessionCreate
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeRequestResultSessionCreate overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeRequestResultSessionCreate
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeRequestResultSessionCreate(v TypedEventStreamEnvelopeRequestResultSessionCreate) error {
+	v.Type = "request.result.session.create"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeRequestResultSessionCreate performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeRequestResultSessionCreate
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeRequestResultSessionCreate(v TypedEventStreamEnvelopeRequestResultSessionCreate) error {
+	v.Type = "request.result.session.create"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeRequestResultSessionMessage returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeRequestResultSessionMessage
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeRequestResultSessionMessage() (TypedEventStreamEnvelopeRequestResultSessionMessage, error) {
+	var body TypedEventStreamEnvelopeRequestResultSessionMessage
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeRequestResultSessionMessage overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeRequestResultSessionMessage
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeRequestResultSessionMessage(v TypedEventStreamEnvelopeRequestResultSessionMessage) error {
+	v.Type = "request.result.session.message"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeRequestResultSessionMessage performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeRequestResultSessionMessage
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeRequestResultSessionMessage(v TypedEventStreamEnvelopeRequestResultSessionMessage) error {
+	v.Type = "request.result.session.message"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeRequestResultSessionSubmit returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeRequestResultSessionSubmit
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeRequestResultSessionSubmit() (TypedEventStreamEnvelopeRequestResultSessionSubmit, error) {
+	var body TypedEventStreamEnvelopeRequestResultSessionSubmit
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeRequestResultSessionSubmit overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeRequestResultSessionSubmit
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeRequestResultSessionSubmit(v TypedEventStreamEnvelopeRequestResultSessionSubmit) error {
+	v.Type = "request.result.session.submit"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeRequestResultSessionSubmit performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeRequestResultSessionSubmit
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeRequestResultSessionSubmit(v TypedEventStreamEnvelopeRequestResultSessionSubmit) error {
+	v.Type = "request.result.session.submit"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsTypedEventStreamEnvelopeSessionCrashed returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeSessionCrashed
 func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeSessionCrashed() (TypedEventStreamEnvelopeSessionCrashed, error) {
 	var body TypedEventStreamEnvelopeSessionCrashed
@@ -6355,24 +6713,52 @@ func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeSessionWoke(v Ty
 	return err
 }
 
-// AsTypedEventStreamEnvelopeWorkerOperation returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeWorkerOperation
-func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeWorkerOperation() (TypedEventStreamEnvelopeWorkerOperation, error) {
-	var body TypedEventStreamEnvelopeWorkerOperation
+// AsTypedEventStreamEnvelopeWorkerOperation returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeWorkerOperation
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeWorkerOperation() (TypedEventStreamEnvelopeWorkerOperation, error) {
+	var body TypedEventStreamEnvelopeWorkerOperation
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedEventStreamEnvelopeWorkerOperation overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeWorkerOperation
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeWorkerOperation(v TypedEventStreamEnvelopeWorkerOperation) error {
+	v.Type = "worker.operation"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedEventStreamEnvelopeWorkerOperation performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeWorkerOperation
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeWorkerOperation(v TypedEventStreamEnvelopeWorkerOperation) error {
+	v.Type = "worker.operation"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedEventStreamEnvelopeCustom returns the union data inside the TypedEventStreamEnvelope as a TypedEventStreamEnvelopeCustom
+func (t TypedEventStreamEnvelope) AsTypedEventStreamEnvelopeCustom() (TypedEventStreamEnvelopeCustom, error) {
+	var body TypedEventStreamEnvelopeCustom
 	err := json.Unmarshal(t.union, &body)
 	return body, err
 }
 
-// FromTypedEventStreamEnvelopeWorkerOperation overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeWorkerOperation
-func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeWorkerOperation(v TypedEventStreamEnvelopeWorkerOperation) error {
-	v.Type = "worker.operation"
+// FromTypedEventStreamEnvelopeCustom overwrites any union data inside the TypedEventStreamEnvelope as the provided TypedEventStreamEnvelopeCustom
+func (t *TypedEventStreamEnvelope) FromTypedEventStreamEnvelopeCustom(v TypedEventStreamEnvelopeCustom) error {
+	v.Type = "TypedEventStreamEnvelopeCustom"
 	b, err := json.Marshal(v)
 	t.union = b
 	return err
 }
 
-// MergeTypedEventStreamEnvelopeWorkerOperation performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeWorkerOperation
-func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeWorkerOperation(v TypedEventStreamEnvelopeWorkerOperation) error {
-	v.Type = "worker.operation"
+// MergeTypedEventStreamEnvelopeCustom performs a merge with any union data inside the TypedEventStreamEnvelope, using the provided TypedEventStreamEnvelopeCustom
+func (t *TypedEventStreamEnvelope) MergeTypedEventStreamEnvelopeCustom(v TypedEventStreamEnvelopeCustom) error {
+	v.Type = "TypedEventStreamEnvelopeCustom"
 	b, err := json.Marshal(v)
 	if err != nil {
 		return err
@@ -6397,6 +6783,8 @@ func (t TypedEventStreamEnvelope) ValueByDiscriminator() (interface{}, error) {
 		return nil, err
 	}
 	switch discriminator {
+	case "TypedEventStreamEnvelopeCustom":
+		return t.AsTypedEventStreamEnvelopeCustom()
 	case "bead.closed":
 		return t.AsTypedEventStreamEnvelopeBeadClosed()
 	case "bead.created":
@@ -6405,20 +6793,12 @@ func (t TypedEventStreamEnvelope) ValueByDiscriminator() (interface{}, error) {
 		return t.AsTypedEventStreamEnvelopeBeadUpdated()
 	case "city.created":
 		return t.AsTypedEventStreamEnvelopeCityCreated()
-	case "city.init_failed":
-		return t.AsTypedEventStreamEnvelopeCityInitFailed()
-	case "city.ready":
-		return t.AsTypedEventStreamEnvelopeCityReady()
 	case "city.resumed":
 		return t.AsTypedEventStreamEnvelopeCityResumed()
 	case "city.suspended":
 		return t.AsTypedEventStreamEnvelopeCitySuspended()
-	case "city.unregister_failed":
-		return t.AsTypedEventStreamEnvelopeCityUnregisterFailed()
 	case "city.unregister_requested":
 		return t.AsTypedEventStreamEnvelopeCityUnregisterRequested()
-	case "city.unregistered":
-		return t.AsTypedEventStreamEnvelopeCityUnregistered()
 	case "controller.started":
 		return t.AsTypedEventStreamEnvelopeControllerStarted()
 	case "controller.stopped":
@@ -6463,6 +6843,18 @@ func (t TypedEventStreamEnvelope) ValueByDiscriminator() (interface{}, error) {
 		return t.AsTypedEventStreamEnvelopeOrderFired()
 	case "provider.swapped":
 		return t.AsTypedEventStreamEnvelopeProviderSwapped()
+	case "request.failed":
+		return t.AsTypedEventStreamEnvelopeRequestFailed()
+	case "request.result.city.create":
+		return t.AsTypedEventStreamEnvelopeRequestResultCityCreate()
+	case "request.result.city.unregister":
+		return t.AsTypedEventStreamEnvelopeRequestResultCityUnregister()
+	case "request.result.session.create":
+		return t.AsTypedEventStreamEnvelopeRequestResultSessionCreate()
+	case "request.result.session.message":
+		return t.AsTypedEventStreamEnvelopeRequestResultSessionMessage()
+	case "request.result.session.submit":
+		return t.AsTypedEventStreamEnvelopeRequestResultSessionSubmit()
 	case "session.crashed":
 		return t.AsTypedEventStreamEnvelopeSessionCrashed()
 	case "session.draining":
@@ -6610,62 +7002,6 @@ func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCity
 	return err
 }
 
-// AsTypedTaggedEventStreamEnvelopeCityInitFailed returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCityInitFailed
-func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCityInitFailed() (TypedTaggedEventStreamEnvelopeCityInitFailed, error) {
-	var body TypedTaggedEventStreamEnvelopeCityInitFailed
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedTaggedEventStreamEnvelopeCityInitFailed overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeCityInitFailed
-func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeCityInitFailed(v TypedTaggedEventStreamEnvelopeCityInitFailed) error {
-	v.Type = "city.init_failed"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedTaggedEventStreamEnvelopeCityInitFailed performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeCityInitFailed
-func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCityInitFailed(v TypedTaggedEventStreamEnvelopeCityInitFailed) error {
-	v.Type = "city.init_failed"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-// AsTypedTaggedEventStreamEnvelopeCityReady returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCityReady
-func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCityReady() (TypedTaggedEventStreamEnvelopeCityReady, error) {
-	var body TypedTaggedEventStreamEnvelopeCityReady
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedTaggedEventStreamEnvelopeCityReady overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeCityReady
-func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeCityReady(v TypedTaggedEventStreamEnvelopeCityReady) error {
-	v.Type = "city.ready"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedTaggedEventStreamEnvelopeCityReady performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeCityReady
-func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCityReady(v TypedTaggedEventStreamEnvelopeCityReady) error {
-	v.Type = "city.ready"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
 // AsTypedTaggedEventStreamEnvelopeCityResumed returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCityResumed
 func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCityResumed() (TypedTaggedEventStreamEnvelopeCityResumed, error) {
 	var body TypedTaggedEventStreamEnvelopeCityResumed
@@ -6722,34 +7058,6 @@ func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCity
 	return err
 }
 
-// AsTypedTaggedEventStreamEnvelopeCityUnregisterFailed returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCityUnregisterFailed
-func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCityUnregisterFailed() (TypedTaggedEventStreamEnvelopeCityUnregisterFailed, error) {
-	var body TypedTaggedEventStreamEnvelopeCityUnregisterFailed
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedTaggedEventStreamEnvelopeCityUnregisterFailed overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeCityUnregisterFailed
-func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeCityUnregisterFailed(v TypedTaggedEventStreamEnvelopeCityUnregisterFailed) error {
-	v.Type = "city.unregister_failed"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedTaggedEventStreamEnvelopeCityUnregisterFailed performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeCityUnregisterFailed
-func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCityUnregisterFailed(v TypedTaggedEventStreamEnvelopeCityUnregisterFailed) error {
-	v.Type = "city.unregister_failed"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
 // AsTypedTaggedEventStreamEnvelopeCityUnregisterRequested returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCityUnregisterRequested
 func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCityUnregisterRequested() (TypedTaggedEventStreamEnvelopeCityUnregisterRequested, error) {
 	var body TypedTaggedEventStreamEnvelopeCityUnregisterRequested
@@ -6778,34 +7086,6 @@ func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCity
 	return err
 }
 
-// AsTypedTaggedEventStreamEnvelopeCityUnregistered returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCityUnregistered
-func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCityUnregistered() (TypedTaggedEventStreamEnvelopeCityUnregistered, error) {
-	var body TypedTaggedEventStreamEnvelopeCityUnregistered
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromTypedTaggedEventStreamEnvelopeCityUnregistered overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeCityUnregistered
-func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeCityUnregistered(v TypedTaggedEventStreamEnvelopeCityUnregistered) error {
-	v.Type = "city.unregistered"
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeTypedTaggedEventStreamEnvelopeCityUnregistered performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeCityUnregistered
-func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCityUnregistered(v TypedTaggedEventStreamEnvelopeCityUnregistered) error {
-	v.Type = "city.unregistered"
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
 // AsTypedTaggedEventStreamEnvelopeControllerStarted returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeControllerStarted
 func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeControllerStarted() (TypedTaggedEventStreamEnvelopeControllerStarted, error) {
 	var body TypedTaggedEventStreamEnvelopeControllerStarted
@@ -7422,6 +7702,174 @@ func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeProv
 	return err
 }
 
+// AsTypedTaggedEventStreamEnvelopeRequestFailed returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeRequestFailed
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeRequestFailed() (TypedTaggedEventStreamEnvelopeRequestFailed, error) {
+	var body TypedTaggedEventStreamEnvelopeRequestFailed
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeRequestFailed overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeRequestFailed
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeRequestFailed(v TypedTaggedEventStreamEnvelopeRequestFailed) error {
+	v.Type = "request.failed"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeRequestFailed performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeRequestFailed
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeRequestFailed(v TypedTaggedEventStreamEnvelopeRequestFailed) error {
+	v.Type = "request.failed"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedTaggedEventStreamEnvelopeRequestResultCityCreate returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeRequestResultCityCreate
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeRequestResultCityCreate() (TypedTaggedEventStreamEnvelopeRequestResultCityCreate, error) {
+	var body TypedTaggedEventStreamEnvelopeRequestResultCityCreate
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeRequestResultCityCreate overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeRequestResultCityCreate
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeRequestResultCityCreate(v TypedTaggedEventStreamEnvelopeRequestResultCityCreate) error {
+	v.Type = "request.result.city.create"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeRequestResultCityCreate performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeRequestResultCityCreate
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeRequestResultCityCreate(v TypedTaggedEventStreamEnvelopeRequestResultCityCreate) error {
+	v.Type = "request.result.city.create"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedTaggedEventStreamEnvelopeRequestResultCityUnregister returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeRequestResultCityUnregister
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeRequestResultCityUnregister() (TypedTaggedEventStreamEnvelopeRequestResultCityUnregister, error) {
+	var body TypedTaggedEventStreamEnvelopeRequestResultCityUnregister
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeRequestResultCityUnregister overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeRequestResultCityUnregister
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeRequestResultCityUnregister(v TypedTaggedEventStreamEnvelopeRequestResultCityUnregister) error {
+	v.Type = "request.result.city.unregister"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeRequestResultCityUnregister performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeRequestResultCityUnregister
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeRequestResultCityUnregister(v TypedTaggedEventStreamEnvelopeRequestResultCityUnregister) error {
+	v.Type = "request.result.city.unregister"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedTaggedEventStreamEnvelopeRequestResultSessionCreate returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeRequestResultSessionCreate
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeRequestResultSessionCreate() (TypedTaggedEventStreamEnvelopeRequestResultSessionCreate, error) {
+	var body TypedTaggedEventStreamEnvelopeRequestResultSessionCreate
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeRequestResultSessionCreate overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeRequestResultSessionCreate
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeRequestResultSessionCreate(v TypedTaggedEventStreamEnvelopeRequestResultSessionCreate) error {
+	v.Type = "request.result.session.create"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeRequestResultSessionCreate performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeRequestResultSessionCreate
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeRequestResultSessionCreate(v TypedTaggedEventStreamEnvelopeRequestResultSessionCreate) error {
+	v.Type = "request.result.session.create"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedTaggedEventStreamEnvelopeRequestResultSessionMessage returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeRequestResultSessionMessage
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeRequestResultSessionMessage() (TypedTaggedEventStreamEnvelopeRequestResultSessionMessage, error) {
+	var body TypedTaggedEventStreamEnvelopeRequestResultSessionMessage
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeRequestResultSessionMessage overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeRequestResultSessionMessage
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeRequestResultSessionMessage(v TypedTaggedEventStreamEnvelopeRequestResultSessionMessage) error {
+	v.Type = "request.result.session.message"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeRequestResultSessionMessage performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeRequestResultSessionMessage
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeRequestResultSessionMessage(v TypedTaggedEventStreamEnvelopeRequestResultSessionMessage) error {
+	v.Type = "request.result.session.message"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
+// AsTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit() (TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit, error) {
+	var body TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit(v TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit) error {
+	v.Type = "request.result.session.submit"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit(v TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit) error {
+	v.Type = "request.result.session.submit"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 // AsTypedTaggedEventStreamEnvelopeSessionCrashed returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeSessionCrashed
 func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeSessionCrashed() (TypedTaggedEventStreamEnvelopeSessionCrashed, error) {
 	var body TypedTaggedEventStreamEnvelopeSessionCrashed
@@ -7702,6 +8150,34 @@ func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeWork
 	return err
 }
 
+// AsTypedTaggedEventStreamEnvelopeCustom returns the union data inside the TypedTaggedEventStreamEnvelope as a TypedTaggedEventStreamEnvelopeCustom
+func (t TypedTaggedEventStreamEnvelope) AsTypedTaggedEventStreamEnvelopeCustom() (TypedTaggedEventStreamEnvelopeCustom, error) {
+	var body TypedTaggedEventStreamEnvelopeCustom
+	err := json.Unmarshal(t.union, &body)
+	return body, err
+}
+
+// FromTypedTaggedEventStreamEnvelopeCustom overwrites any union data inside the TypedTaggedEventStreamEnvelope as the provided TypedTaggedEventStreamEnvelopeCustom
+func (t *TypedTaggedEventStreamEnvelope) FromTypedTaggedEventStreamEnvelopeCustom(v TypedTaggedEventStreamEnvelopeCustom) error {
+	v.Type = "TypedTaggedEventStreamEnvelopeCustom"
+	b, err := json.Marshal(v)
+	t.union = b
+	return err
+}
+
+// MergeTypedTaggedEventStreamEnvelopeCustom performs a merge with any union data inside the TypedTaggedEventStreamEnvelope, using the provided TypedTaggedEventStreamEnvelopeCustom
+func (t *TypedTaggedEventStreamEnvelope) MergeTypedTaggedEventStreamEnvelopeCustom(v TypedTaggedEventStreamEnvelopeCustom) error {
+	v.Type = "TypedTaggedEventStreamEnvelopeCustom"
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	merged, err := runtime.JSONMerge(t.union, b)
+	t.union = merged
+	return err
+}
+
 func (t TypedTaggedEventStreamEnvelope) Discriminator() (string, error) {
 	var discriminator struct {
 		Discriminator string `json:"type"`
@@ -7716,6 +8192,8 @@ func (t TypedTaggedEventStreamEnvelope) ValueByDiscriminator() (interface{}, err
 		return nil, err
 	}
 	switch discriminator {
+	case "TypedTaggedEventStreamEnvelopeCustom":
+		return t.AsTypedTaggedEventStreamEnvelopeCustom()
 	case "bead.closed":
 		return t.AsTypedTaggedEventStreamEnvelopeBeadClosed()
 	case "bead.created":
@@ -7724,20 +8202,12 @@ func (t TypedTaggedEventStreamEnvelope) ValueByDiscriminator() (interface{}, err
 		return t.AsTypedTaggedEventStreamEnvelopeBeadUpdated()
 	case "city.created":
 		return t.AsTypedTaggedEventStreamEnvelopeCityCreated()
-	case "city.init_failed":
-		return t.AsTypedTaggedEventStreamEnvelopeCityInitFailed()
-	case "city.ready":
-		return t.AsTypedTaggedEventStreamEnvelopeCityReady()
 	case "city.resumed":
 		return t.AsTypedTaggedEventStreamEnvelopeCityResumed()
 	case "city.suspended":
 		return t.AsTypedTaggedEventStreamEnvelopeCitySuspended()
-	case "city.unregister_failed":
-		return t.AsTypedTaggedEventStreamEnvelopeCityUnregisterFailed()
 	case "city.unregister_requested":
 		return t.AsTypedTaggedEventStreamEnvelopeCityUnregisterRequested()
-	case "city.unregistered":
-		return t.AsTypedTaggedEventStreamEnvelopeCityUnregistered()
 	case "controller.started":
 		return t.AsTypedTaggedEventStreamEnvelopeControllerStarted()
 	case "controller.stopped":
@@ -7782,6 +8252,18 @@ func (t TypedTaggedEventStreamEnvelope) ValueByDiscriminator() (interface{}, err
 		return t.AsTypedTaggedEventStreamEnvelopeOrderFired()
 	case "provider.swapped":
 		return t.AsTypedTaggedEventStreamEnvelopeProviderSwapped()
+	case "request.failed":
+		return t.AsTypedTaggedEventStreamEnvelopeRequestFailed()
+	case "request.result.city.create":
+		return t.AsTypedTaggedEventStreamEnvelopeRequestResultCityCreate()
+	case "request.result.city.unregister":
+		return t.AsTypedTaggedEventStreamEnvelopeRequestResultCityUnregister()
+	case "request.result.session.create":
+		return t.AsTypedTaggedEventStreamEnvelopeRequestResultSessionCreate()
+	case "request.result.session.message":
+		return t.AsTypedTaggedEventStreamEnvelopeRequestResultSessionMessage()
+	case "request.result.session.submit":
+		return t.AsTypedTaggedEventStreamEnvelopeRequestResultSessionSubmit()
 	case "session.crashed":
 		return t.AsTypedTaggedEventStreamEnvelopeSessionCrashed()
 	case "session.draining":
@@ -8186,7 +8668,7 @@ type ClientInterface interface {
 	GetV0CityByCityNameOrders(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*http.Response, error)
 
 	// GetV0CityByCityNameOrdersCheck request
-	GetV0CityByCityNameOrdersCheck(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*http.Response, error)
+	GetV0CityByCityNameOrdersCheck(ctx context.Context, cityName string, params *GetV0CityByCityNameOrdersCheckParams, reqEditors ...RequestEditorFn) (*http.Response, error)
 
 	// GetV0CityByCityNameOrdersFeed request
 	GetV0CityByCityNameOrdersFeed(ctx context.Context, cityName string, params *GetV0CityByCityNameOrdersFeedParams, reqEditors ...RequestEditorFn) (*http.Response, error)
@@ -9684,8 +10166,8 @@ func (c *Client) GetV0CityByCityNameOrders(ctx context.Context, cityName string,
 	return c.Client.Do(req)
 }
 
-func (c *Client) GetV0CityByCityNameOrdersCheck(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*http.Response, error) {
-	req, err := NewGetV0CityByCityNameOrdersCheckRequest(c.Server, cityName)
+func (c *Client) GetV0CityByCityNameOrdersCheck(ctx context.Context, cityName string, params *GetV0CityByCityNameOrdersCheckParams, reqEditors ...RequestEditorFn) (*http.Response, error) {
+	req, err := NewGetV0CityByCityNameOrdersCheckRequest(c.Server, cityName, params)
 	if err != nil {
 		return nil, err
 	}
@@ -15952,7 +16434,7 @@ func NewGetV0CityByCityNameOrdersRequest(server string, cityName string) (*http.
 }
 
 // NewGetV0CityByCityNameOrdersCheckRequest generates requests for GetV0CityByCityNameOrdersCheck
-func NewGetV0CityByCityNameOrdersCheckRequest(server string, cityName string) (*http.Request, error) {
+func NewGetV0CityByCityNameOrdersCheckRequest(server string, cityName string, params *GetV0CityByCityNameOrdersCheckParams) (*http.Request, error) {
 	var err error
 
 	var pathParam0 string
@@ -15977,6 +16459,28 @@ func NewGetV0CityByCityNameOrdersCheckRequest(server string, cityName string) (*
 		return nil, err
 	}
 
+	if params != nil {
+		queryValues := queryURL.Query()
+
+		if params.Fresh != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", false, "fresh", *params.Fresh, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "boolean", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
+		queryURL.RawQuery = queryValues.Encode()
+	}
+
 	req, err := http.NewRequest("GET", queryURL.String(), nil)
 	if err != nil {
 		return nil, err
@@ -18736,6 +19240,22 @@ func NewGetV0CityByCityNameSessionByIdTranscriptRequest(server string, cityName
 
 		}
 
+		if params.After != nil {
+
+			if queryFrag, err := runtime.StyleParamWithOptions("form", false, "after", *params.After, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil {
+				return nil, err
+			} else if parsed, err := url.ParseQuery(queryFrag); err != nil {
+				return nil, err
+			} else {
+				for k, v := range parsed {
+					for _, v2 := range v {
+						queryValues.Add(k, v2)
+					}
+				}
+			}
+
+		}
+
 		queryURL.RawQuery = queryValues.Encode()
 	}
 
@@ -19977,7 +20497,7 @@ type ClientWithResponsesInterface interface {
 	GetV0CityByCityNameOrdersWithResponse(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersResponse, error)
 
 	// GetV0CityByCityNameOrdersCheckWithResponse request
-	GetV0CityByCityNameOrdersCheckWithResponse(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersCheckResponse, error)
+	GetV0CityByCityNameOrdersCheckWithResponse(ctx context.Context, cityName string, params *GetV0CityByCityNameOrdersCheckParams, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersCheckResponse, error)
 
 	// GetV0CityByCityNameOrdersFeedWithResponse request
 	GetV0CityByCityNameOrdersFeedWithResponse(ctx context.Context, cityName string, params *GetV0CityByCityNameOrdersFeedParams, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersFeedResponse, error)
@@ -20240,7 +20760,7 @@ func (r GetV0CitiesResponse) StatusCode() int {
 type PostV0CityResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
-	JSON202                       *CityCreateResponse
+	JSON202                       *AsyncAcceptedResponse
 	ApplicationproblemJSONDefault *ErrorModel
 }
 
@@ -22997,7 +23517,7 @@ func (r PostV0CityByCityNameSessionByIdKillResponse) StatusCode() int {
 type SendSessionMessageResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
-	JSON202                       *SessionMessageOutputBody
+	JSON202                       *AsyncAcceptedBody
 	ApplicationproblemJSONDefault *ErrorModel
 }
 
@@ -23134,7 +23654,7 @@ func (r StreamSessionResponse) StatusCode() int {
 type SubmitSessionResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
-	JSON202                       *SessionSubmitOutputBody
+	JSON202                       *AsyncAcceptedBody
 	ApplicationproblemJSONDefault *ErrorModel
 }
 
@@ -23249,7 +23769,7 @@ func (r GetV0CityByCityNameSessionsResponse) StatusCode() int {
 type CreateSessionResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
-	JSON202                       *SessionResponse
+	JSON202                       *AsyncAcceptedBody
 	ApplicationproblemJSONDefault *ErrorModel
 }
 
@@ -23318,7 +23838,7 @@ func (r GetV0CityByCityNameStatusResponse) StatusCode() int {
 type PostV0CityByCityNameUnregisterResponse struct {
 	Body                          []byte
 	HTTPResponse                  *http.Response
-	JSON202                       *CityUnregisterResponse
+	JSON202                       *AsyncAcceptedResponse
 	ApplicationproblemJSONDefault *ErrorModel
 }
 
@@ -24413,8 +24933,8 @@ func (c *ClientWithResponses) GetV0CityByCityNameOrdersWithResponse(ctx context.
 }
 
 // GetV0CityByCityNameOrdersCheckWithResponse request returning *GetV0CityByCityNameOrdersCheckResponse
-func (c *ClientWithResponses) GetV0CityByCityNameOrdersCheckWithResponse(ctx context.Context, cityName string, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersCheckResponse, error) {
-	rsp, err := c.GetV0CityByCityNameOrdersCheck(ctx, cityName, reqEditors...)
+func (c *ClientWithResponses) GetV0CityByCityNameOrdersCheckWithResponse(ctx context.Context, cityName string, params *GetV0CityByCityNameOrdersCheckParams, reqEditors ...RequestEditorFn) (*GetV0CityByCityNameOrdersCheckResponse, error) {
+	rsp, err := c.GetV0CityByCityNameOrdersCheck(ctx, cityName, params, reqEditors...)
 	if err != nil {
 		return nil, err
 	}
@@ -25163,7 +25683,7 @@ func ParsePostV0CityResponse(rsp *http.Response) (*PostV0CityResponse, error) {
 
 	switch {
 	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
-		var dest CityCreateResponse
+		var dest AsyncAcceptedResponse
 		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
 			return nil, err
 		}
@@ -29102,7 +29622,7 @@ func ParseSendSessionMessageResponse(rsp *http.Response) (*SendSessionMessageRes
 
 	switch {
 	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
-		var dest SessionMessageOutputBody
+		var dest AsyncAcceptedBody
 		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
 			return nil, err
 		}
@@ -29293,7 +29813,7 @@ func ParseSubmitSessionResponse(rsp *http.Response) (*SubmitSessionResponse, err
 
 	switch {
 	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
-		var dest SessionSubmitOutputBody
+		var dest AsyncAcceptedBody
 		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
 			return nil, err
 		}
@@ -29458,7 +29978,7 @@ func ParseCreateSessionResponse(rsp *http.Response) (*CreateSessionResponse, err
 
 	switch {
 	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
-		var dest SessionResponse
+		var dest AsyncAcceptedBody
 		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
 			return nil, err
 		}
@@ -29557,7 +30077,7 @@ func ParsePostV0CityByCityNameUnregisterResponse(rsp *http.Response) (*PostV0Cit
 
 	switch {
 	case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 202:
-		var dest CityUnregisterResponse
+		var dest AsyncAcceptedResponse
 		if err := json.Unmarshal(bodyBytes, &dest); err != nil {
 			return nil, err
 		}
diff --git a/internal/api/handler_agent_crud_test.go b/internal/api/handler_agent_crud_test.go
index 7f2a615dff..9fbc4a249e 100644
--- a/internal/api/handler_agent_crud_test.go
+++ b/internal/api/handler_agent_crud_test.go
@@ -1,11 +1,18 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
 )
 
 func TestHandleAgentCreate(t *testing.T) {
@@ -33,6 +40,184 @@ func TestHandleAgentCreate(t *testing.T) {
 	}
 }
 
+// agentVisibilityFakeState wraps fakeMutatorState with an
+// AgentVisibilityWaiter implementation so the handler-side wiring can be
+// exercised without spinning up the real controller.
+type agentVisibilityFakeState struct {
+	*fakeMutatorState
+	waitCalled             atomic.Bool
+	waitName               atomic.Value // string
+	waitErr                error
+	waitUntilContextDone   bool
+	publishAgentDuringWait bool
+	pendingAgent           *config.Agent
+}
+
+func (s *agentVisibilityFakeState) CreateAgent(a config.Agent) error {
+	if !s.publishAgentDuringWait {
+		return s.fakeMutatorState.CreateAgent(a)
+	}
+	pending := a
+	s.pendingAgent = &pending
+	return nil
+}
+
+func (s *agentVisibilityFakeState) WaitForAgentVisibility(ctx context.Context, qualifiedName string) error {
+	s.waitCalled.Store(true)
+	s.waitName.Store(qualifiedName)
+	if s.waitUntilContextDone {
+		<-ctx.Done()
+		return ctx.Err()
+	}
+	if s.waitErr != nil {
+		return s.waitErr
+	}
+	if s.publishAgentDuringWait && s.pendingAgent != nil {
+		s.cfg.Agents = append(s.cfg.Agents, *s.pendingAgent)
+		s.pendingAgent = nil
+	}
+	return nil
+}
+
+// TestHandleAgentCreate_InvokesVisibilityWaiter verifies that POST /agents
+// calls WaitForAgentVisibility with the qualified name on success. This is
+// the read-after-write guarantee that prevents a follow-up POST /sling from
+// 404ing on the freshly created target.
+func TestHandleAgentCreate_InvokesVisibilityWaiter(t *testing.T) {
+	fs := &agentVisibilityFakeState{fakeMutatorState: newFakeMutatorState(t)}
+	h := newTestCityHandler(t, fs)
+
+	body := `{"name":"coder","dir":"myrig","provider":"claude"}`
+	req := newPostRequest(cityURL(fs, "/agents"), strings.NewReader(body))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want %d; body = %s", w.Code, http.StatusCreated, w.Body.String())
+	}
+	if !fs.waitCalled.Load() {
+		t.Fatal("WaitForAgentVisibility was not called")
+	}
+	if got, _ := fs.waitName.Load().(string); got != "myrig/coder" {
+		t.Errorf("WaitForAgentVisibility called with %q, want %q", got, "myrig/coder")
+	}
+}
+
+// TestHandleAgentCreate_MakesImmediateSlingTargetVisible proves the handler
+// sequence that regressed in the live contract: once POST /agents returns 201,
+// a POST /sling against the same freshly-created target resolves through the
+// handler's current Config snapshot.
+func TestHandleAgentCreate_MakesImmediateSlingTargetVisible(t *testing.T) {
+	fs := &agentVisibilityFakeState{
+		fakeMutatorState:       newFakeMutatorState(t),
+		publishAgentDuringWait: true,
+	}
+	fs.cfg.Rigs[0].Prefix = "gc"
+	srv := New(fs)
+	srv.SlingRunnerFunc = func(_ string, _ string, _ map[string]string) (string, error) {
+		return "", nil
+	}
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	b, err := fs.stores["myrig"].Create(beads.Bead{Title: "route me", Type: "task"})
+	if err != nil {
+		t.Fatalf("create bead: %v", err)
+	}
+
+	createReq := newPostRequest(cityURL(fs, "/agents"), strings.NewReader(
+		`{"name":"coder","dir":"myrig","provider":"test-agent"}`,
+	))
+	createRec := httptest.NewRecorder()
+	h.ServeHTTP(createRec, createReq)
+	if createRec.Code != http.StatusCreated {
+		t.Fatalf("create status = %d, want %d; body = %s", createRec.Code, http.StatusCreated, createRec.Body.String())
+	}
+
+	slingBody := `{"target":"myrig/coder","bead":"` + b.ID + `"}`
+	slingRec := httptest.NewRecorder()
+	h.ServeHTTP(slingRec, newPostRequest(cityURL(fs, "/sling"), strings.NewReader(slingBody)))
+	if slingRec.Code != http.StatusOK {
+		t.Fatalf("sling status = %d, want %d; body = %s", slingRec.Code, http.StatusOK, slingRec.Body.String())
+	}
+}
+
+func TestHandleAgentCreate_VisibilityWaiterTimeoutIsBounded(t *testing.T) {
+	fs := &agentVisibilityFakeState{
+		fakeMutatorState:     newFakeMutatorState(t),
+		waitUntilContextDone: true,
+	}
+	srv := New(fs)
+	srv.agentVisibilityWaitTimeout = 10 * time.Millisecond
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	req := newPostRequest(cityURL(fs, "/agents"), strings.NewReader(
+		`{"name":"coder","dir":"myrig","provider":"test-agent"}`,
+	))
+	rec := httptest.NewRecorder()
+	start := time.Now()
+	h.ServeHTTP(rec, req)
+
+	if elapsed := time.Since(start); elapsed > time.Second {
+		t.Fatalf("handler returned after %s, want bounded visibility timeout", elapsed)
+	}
+	if rec.Code != http.StatusGatewayTimeout {
+		t.Fatalf("status = %d, want %d; body = %s", rec.Code, http.StatusGatewayTimeout, rec.Body.String())
+	}
+	if got := rec.Header().Get("Retry-After"); got != "1" {
+		t.Fatalf("Retry-After = %q, want 1", got)
+	}
+	if strings.Contains(rec.Body.String(), context.DeadlineExceeded.Error()) {
+		t.Fatalf("response leaked raw context error: %s", rec.Body.String())
+	}
+}
+
+func TestHandleAgentCreate_VisibilityWaiterCancelIsServiceUnavailable(t *testing.T) {
+	fs := &agentVisibilityFakeState{
+		fakeMutatorState: newFakeMutatorState(t),
+		waitErr:          context.Canceled,
+	}
+	h := newTestCityHandler(t, fs)
+
+	req := newPostRequest(cityURL(fs, "/agents"), strings.NewReader(
+		`{"name":"coder","dir":"myrig","provider":"test-agent"}`,
+	))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want %d; body = %s", rec.Code, http.StatusServiceUnavailable, rec.Body.String())
+	}
+	if got := rec.Header().Get("Retry-After"); got != "1" {
+		t.Fatalf("Retry-After = %q, want 1", got)
+	}
+	if strings.Contains(rec.Body.String(), context.Canceled.Error()) {
+		t.Fatalf("response leaked raw context error: %s", rec.Body.String())
+	}
+}
+
+// TestHandleAgentCreate_VisibilityWaiterErrorSurfacesAs500 ensures that a
+// projection failure does not silently 201 — the caller must know the agent
+// isn't yet reachable through findAgent.
+func TestHandleAgentCreate_VisibilityWaiterErrorSurfacesAs500(t *testing.T) {
+	fs := &agentVisibilityFakeState{
+		fakeMutatorState: newFakeMutatorState(t),
+		waitErr:          errors.New("simulated visibility wait failure"),
+	}
+	h := newTestCityHandler(t, fs)
+
+	body := `{"name":"coder","dir":"myrig","provider":"claude"}`
+	req := newPostRequest(cityURL(fs, "/agents"), strings.NewReader(body))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status = %d, want %d; body = %s", w.Code, http.StatusInternalServerError, w.Body.String())
+	}
+	if strings.Contains(w.Body.String(), "simulated visibility wait failure") {
+		t.Fatalf("response leaked raw waiter error: %s", w.Body.String())
+	}
+}
+
 func TestHandleAgentCreate_MissingName(t *testing.T) {
 	fs := newFakeMutatorState(t)
 	h := newTestCityHandler(t, fs)
diff --git a/internal/api/handler_agent_output_test.go b/internal/api/handler_agent_output_test.go
index 96f441ceb2..b4c34b157d 100644
--- a/internal/api/handler_agent_output_test.go
+++ b/internal/api/handler_agent_output_test.go
@@ -530,14 +530,50 @@ func TestAgentOutputStreamStoppedAgent(t *testing.T) {
 	if rec.Code != http.StatusOK {
 		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
 	}
-	if got := rec.Header().Get("GC-Agent-Status"); got != "stopped" {
-		t.Errorf("GC-Agent-Status = %q, want %q", got, "stopped")
+	if got := rec.Result().Header.Get("GC-Agent-Status"); got != "stopped" {
+		t.Errorf("committed GC-Agent-Status = %q, want %q", got, "stopped")
 	}
 	if !strings.Contains(rec.Body.String(), "hello") {
 		t.Errorf("body should contain session data, got: %s", rec.Body.String())
 	}
 }
 
+func TestAgentOutputStreamStoppedAgentCommitsStatusHeader(t *testing.T) {
+	state := newFakeState(t)
+	rigDir := t.TempDir()
+	state.cfg.Rigs = []config.Rig{{Name: "myrig", Path: rigDir}}
+
+	searchBase := t.TempDir()
+	writeSessionJSONL(t, searchBase, rigDir,
+		`{"uuid":"1","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"hello\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+	)
+
+	srv := newServerWithSearchPaths(state, searchBase)
+	h := newTestCityHandlerWith(t, state, srv)
+	ts := httptest.NewServer(h)
+	defer ts.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, ts.URL+cityURL(state, "/agent/myrig/worker/output/stream"), nil)
+	if err != nil {
+		t.Fatalf("NewRequest: %v", err)
+	}
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatalf("Do: %v", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	cancel()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+	if got := resp.Header.Get("GC-Agent-Status"); got != "stopped" {
+		t.Fatalf("committed GC-Agent-Status = %q, want %q", got, "stopped")
+	}
+}
+
 func TestAgentOutputStreamFollowsRotatedGeminiTranscriptAfterWake(t *testing.T) {
 	fixture := newGeminiAgentOutputStreamFixture(t)
 
diff --git a/internal/api/handler_agents.go b/internal/api/handler_agents.go
index a7a8be4e2a..f8941db238 100644
--- a/internal/api/handler_agents.go
+++ b/internal/api/handler_agents.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"strings"
@@ -14,6 +15,26 @@ import (
 
 const lookPathCacheTTL = 30 * time.Second
 
+// agentVisibilityPollInterval is how often WaitForAgentVisibilityIn re-reads
+// the cfg snapshot while waiting for a freshly created agent to become
+// resolvable through findAgent. Kept short because the typical race window
+// (a runtime config-reload tick that started before the mutation but applies
+// after it) is sub-second; the fast cadence keeps the POST /agents response
+// from blocking the caller for a perceptible time on the happy path.
+const agentVisibilityPollInterval = 50 * time.Millisecond
+
+// defaultAgentVisibilityWaitTimeout bounds the POST /agents read-after-write wait.
+// The controller should converge much faster; this timeout prevents a broken
+// projection from tying up the handler after the config mutation succeeded.
+const defaultAgentVisibilityWaitTimeout = 3 * time.Second
+
+func (s *Server) agentCreateVisibilityWaitTimeout() time.Duration {
+	if s.agentVisibilityWaitTimeout > 0 {
+		return s.agentVisibilityWaitTimeout
+	}
+	return defaultAgentVisibilityWaitTimeout
+}
+
 type agentResponse struct {
 	Name        string       `json:"name"`
 	Description string       `json:"description,omitempty"`
@@ -151,6 +172,44 @@ func agentSessionName(cityName, qualifiedName, sessionTemplate string) string {
 	return agent.SessionNameFor(cityName, qualifiedName, sessionTemplate)
 }
 
+// WaitForAgentVisibilityIn polls cfgSnapshot() until findAgent resolves the
+// given qualified agent name, or returns an error if ctx is done. It is the
+// shared building block for AgentVisibilityWaiter implementations.
+//
+// Callers pass cs.Config (or any other snapshot accessor that returns the
+// hot-reloaded *config.City) so the polling reads the live snapshot, not a
+// stale capture. The first check happens before the first sleep so the
+// happy path returns immediately when no runtime race occurred.
+func WaitForAgentVisibilityIn(ctx context.Context, cfgSnapshot func() *config.City, qualifiedName string) error {
+	return waitForAgentVisibilityIn(ctx, cfgSnapshot, qualifiedName, agentVisibilityPollInterval)
+}
+
+func waitForAgentVisibilityIn(ctx context.Context, cfgSnapshot func() *config.City, qualifiedName string, interval time.Duration) error {
+	check := func() bool {
+		cfg := cfgSnapshot()
+		if cfg == nil {
+			return false
+		}
+		_, ok := findAgent(cfg, qualifiedName)
+		return ok
+	}
+	if check() {
+		return nil
+	}
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("waiting for agent %q to become visible: %w", qualifiedName, ctx.Err())
+		case <-ticker.C:
+		}
+		if check() {
+			return nil
+		}
+	}
+}
+
 // findAgent looks up an agent by qualified name in the config.
 // For multi-session agents, it matches instance names.
 func findAgent(cfg *config.City, name string) (config.Agent, bool) {
@@ -243,13 +302,25 @@ func (s *Server) findActiveBeadForAssigneesWithFreshness(rig string, live bool,
 	}
 	for _, assignee := range unique {
 		for _, rn := range rigNames {
-			matches, err := stores[rn].List(beads.ListQuery{
+			query := beads.ListQuery{
 				Assignee: assignee,
 				Status:   "in_progress",
 				Live:     live,
 				Limit:    1,
 				Sort:     beads.SortCreatedDesc,
-			})
+			}
+			if !live {
+				if cached, ok := stores[rn].(cachedListStore); ok {
+					matches, cacheOK := cached.CachedList(query)
+					if cacheOK {
+						if len(matches) > 0 {
+							return matches[0].ID
+						}
+						continue
+					}
+				}
+			}
+			matches, err := stores[rn].List(query)
 			if err != nil {
 				continue
 			}
diff --git a/internal/api/handler_agents_test.go b/internal/api/handler_agents_test.go
index 3742b7c4c7..d431a5d9e4 100644
--- a/internal/api/handler_agents_test.go
+++ b/internal/api/handler_agents_test.go
@@ -1023,3 +1023,68 @@ func TestProviderPathCheck_FallsBackToRawWhenNoCache(t *testing.T) {
 		t.Errorf("providerPathCheck = %q, want custom-cli", got)
 	}
 }
+
+// TestWaitForAgentVisibilityIn_ReturnsImmediatelyOnHit covers the happy
+// path: the freshly created agent is already visible in the snapshot
+// and the wait returns without sleeping.
+func TestWaitForAgentVisibilityIn_ReturnsImmediatelyOnHit(t *testing.T) {
+	cfg := &config.City{
+		Agents: []config.Agent{{Name: "worker", Dir: "alpha"}},
+	}
+	calls := 0
+	snapshot := func() *config.City {
+		calls++
+		return cfg
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := WaitForAgentVisibilityIn(ctx, snapshot, "alpha/worker"); err != nil {
+		t.Fatalf("WaitForAgentVisibilityIn: %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("snapshot calls = %d, want 1 (no polling on hit)", calls)
+	}
+}
+
+// TestWaitForAgentVisibilityIn_PollsUntilVisible covers the race recovery
+// path: a stale runtime tick clobbers the snapshot after CreateAgent, the
+// next runtime tick restores it, and the wait succeeds once the agent
+// reappears.
+func TestWaitForAgentVisibilityIn_PollsUntilVisible(t *testing.T) {
+	stale := &config.City{}
+	fresh := &config.City{
+		Agents: []config.Agent{{Name: "worker", Dir: "alpha"}},
+	}
+	calls := 0
+	snapshot := func() *config.City {
+		calls++
+		if calls < 3 {
+			return stale
+		}
+		return fresh
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := waitForAgentVisibilityIn(ctx, snapshot, "alpha/worker", time.Millisecond); err != nil {
+		t.Fatalf("waitForAgentVisibilityIn: %v", err)
+	}
+	if calls < 3 {
+		t.Errorf("snapshot calls = %d, want >= 3 (polled past stale snapshots)", calls)
+	}
+}
+
+// TestWaitForAgentVisibilityIn_RespectsContext covers the bounded-failure
+// case: the agent never appears and the wait surfaces ctx.Err() instead of
+// blocking indefinitely.
+func TestWaitForAgentVisibilityIn_RespectsContext(t *testing.T) {
+	snapshot := func() *config.City { return &config.City{} }
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+	defer cancel()
+	err := waitForAgentVisibilityIn(ctx, snapshot, "alpha/worker", time.Millisecond)
+	if err == nil {
+		t.Fatal("expected timeout error, got nil")
+	}
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Errorf("error = %v, want wrapped DeadlineExceeded", err)
+	}
+}
diff --git a/internal/api/handler_beads.go b/internal/api/handler_beads.go
index e4141241d8..0e63d5d19c 100644
--- a/internal/api/handler_beads.go
+++ b/internal/api/handler_beads.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/session"
 )
 
@@ -109,7 +110,11 @@ func (s *Server) findStore(rig string) beads.Store {
 // prefix/routes mapping when possible. If there is no routed match, it falls
 // back to the legacy store scan order.
 func (s *Server) beadStoresForID(id string) []beads.Store {
-	if prefix := beadPrefix(strings.TrimSpace(id)); prefix != "" {
+	id = strings.TrimSpace(id)
+	if store := s.resolveStoreByConfiguredIDPrefix(id); store != nil {
+		return []beads.Store{store}
+	}
+	if prefix := beadPrefix(id); prefix != "" {
 		if store := s.resolveStoreByPrefix(prefix); store != nil {
 			return []beads.Store{store}
 		}
@@ -127,6 +132,45 @@ func (s *Server) beadStoresForID(id string) []beads.Store {
 	return candidates
 }
 
+func (s *Server) resolveStoreByConfiguredIDPrefix(id string) beads.Store {
+	if id == "" {
+		return nil
+	}
+	cfg := s.state.Config()
+	if cfg == nil {
+		return nil
+	}
+
+	var bestStore beads.Store
+	bestLen := -1
+	if prefix := strings.TrimSpace(config.EffectiveHQPrefix(cfg)); beadIDHasConfiguredPrefix(id, prefix) {
+		if cityStore := s.state.CityBeadStore(); cityStore != nil {
+			bestStore = cityStore
+			bestLen = len(prefix)
+		}
+	}
+	for _, rig := range cfg.Rigs {
+		prefix := strings.TrimSpace(rig.EffectivePrefix())
+		if !beadIDHasConfiguredPrefix(id, prefix) || len(prefix) <= bestLen {
+			continue
+		}
+		store := s.state.BeadStore(rig.Name)
+		if store == nil {
+			continue
+		}
+		bestStore = store
+		bestLen = len(prefix)
+	}
+	return bestStore
+}
+
+func beadIDHasConfiguredPrefix(id, prefix string) bool {
+	if prefix == "" {
+		return false
+	}
+	return id == prefix || strings.HasPrefix(id, prefix+"-")
+}
+
 // resolveStoreByPrefix finds the store that owns a bead prefix by checking
 // routes.jsonl files in the city and each rig's .beads/ directory, then
 // mapping the resolved store path back to the correct store.
@@ -138,6 +182,21 @@ func (s *Server) resolveStoreByPrefix(prefix string) beads.Store {
 	stores := s.state.BeadStores()
 	cityPath := strings.TrimSpace(s.state.CityPath())
 
+	if prefix == config.EffectiveHQPrefix(cfg) {
+		if cityStore := s.state.CityBeadStore(); cityStore != nil {
+			return cityStore
+		}
+	}
+	for _, rig := range cfg.Rigs {
+		if prefix != rig.EffectivePrefix() {
+			continue
+		}
+		if store, exists := stores[rig.Name]; exists {
+			return store
+		}
+		return nil
+	}
+
 	// Build rig path → name map for reverse lookup (used by both city
 	// and rig route resolution below).
 	rigPathToName := make(map[string]string, len(cfg.Rigs))
@@ -325,13 +384,17 @@ func mergeWorkflowDeps(primary, extra []workflowDepResponse) []workflowDepRespon
 	return primary
 }
 
-// beadPrefix extracts the alphabetic prefix from a bead ID (e.g., "ga" from "ga-5b8i").
+// beadPrefix extracts the configured prefix from a bead ID (e.g., "ga" from
+// "ga-5b8i"). bd prefixes may contain digits after the first character.
 func beadPrefix(id string) string {
 	for i, c := range id {
 		if c == '-' {
 			return id[:i]
 		}
 		if c < 'a' || c > 'z' {
+			if i > 0 && c >= '0' && c <= '9' {
+				continue
+			}
 			return ""
 		}
 	}
diff --git a/internal/api/handler_beads_partial_test.go b/internal/api/handler_beads_partial_test.go
index 37a74c1bb8..60dd3bbf06 100644
--- a/internal/api/handler_beads_partial_test.go
+++ b/internal/api/handler_beads_partial_test.go
@@ -18,23 +18,31 @@ import (
 type failingBeadStore struct {
 	beads.Store
 	listErr        error
+	listResult     []beads.Bead
 	readyErr       error
+	readyResult    []beads.Bead
 	updateFailAt   map[string]error // item ID → error (fails Update for that ID)
 	updateCallback func(id string)  // optional: called on every Update before injecting failure
 }
 
 func (f *failingBeadStore) List(q beads.ListQuery) ([]beads.Bead, error) {
 	if f.listErr != nil {
+		if f.listResult != nil {
+			return f.listResult, f.listErr
+		}
 		return nil, f.listErr
 	}
 	return f.Store.List(q)
 }
 
-func (f *failingBeadStore) Ready() ([]beads.Bead, error) {
+func (f *failingBeadStore) Ready(query ...beads.ReadyQuery) ([]beads.Bead, error) {
 	if f.readyErr != nil {
+		if f.readyResult != nil {
+			return f.readyResult, f.readyErr
+		}
 		return nil, f.readyErr
 	}
-	return f.Store.Ready()
+	return f.Store.Ready(query...)
 }
 
 func (f *failingBeadStore) Update(id string, opts beads.UpdateOpts) error {
@@ -94,6 +102,49 @@ func TestBeadListSurfacesStoreErrorsAsPartial(t *testing.T) {
 	}
 }
 
+func TestBeadListPreservesPartialResultRows(t *testing.T) {
+	fs := newPartialListState(t, nil, nil)
+	bad := fs.stores["bad"]
+	survivors, err := bad.List(beads.ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("seed survivors: %v", err)
+	}
+	fs.stores["bad"] = &failingBeadStore{
+		Store:      bad,
+		listResult: survivors,
+		listErr: &beads.PartialResultError{
+			Op:  "bd list",
+			Err: errors.New("skipped 1 corrupt bead"),
+		},
+	}
+	h := newTestCityHandler(t, fs)
+
+	req := httptest.NewRequest("GET", cityURL(fs, "/beads"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("status = %d, want 200 (body=%q)", rec.Code, rec.Body.String())
+	}
+
+	var body struct {
+		Items         []beads.Bead `json:"items"`
+		Partial       bool         `json:"partial"`
+		PartialErrors []string     `json:"partial_errors"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode: %v (body=%q)", err, rec.Body.String())
+	}
+	if !body.Partial {
+		t.Fatalf("Partial = false, want true")
+	}
+	if len(body.PartialErrors) == 0 {
+		t.Fatalf("PartialErrors empty")
+	}
+	if !containsBeadTitle(body.Items, "would-be-lost") {
+		t.Fatalf("Items = %+v, want surviving partial row from bad rig", body.Items)
+	}
+}
+
 // When EVERY rig store fails, returning 200 + empty + partial=true
 // conflates outage with "no data". The handler must return 503 so
 // clients can tell the difference.
@@ -113,6 +164,69 @@ func TestBeadListReturns503OnTotalOutage(t *testing.T) {
 	}
 }
 
+func TestBeadListReturns503OnEmptyPartialTotalOutage(t *testing.T) {
+	fs := newFakeState(t)
+	fs.stores["myrig"] = &failingBeadStore{
+		Store:      fs.stores["myrig"],
+		listResult: []beads.Bead{},
+		listErr: &beads.PartialResultError{
+			Op:  "bd list",
+			Err: errors.New("skipped 1 corrupt bead"),
+		},
+	}
+
+	h := newTestCityHandler(t, fs)
+	req := httptest.NewRequest("GET", cityURL(fs, "/beads"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 503 {
+		t.Errorf("status = %d, want 503 when every backend has zero usable rows (body=%q)", rec.Code, rec.Body.String())
+	}
+}
+
+func TestBeadReadyPreservesPartialResultRows(t *testing.T) {
+	fs := newPartialListState(t, nil, nil)
+	bad := fs.stores["bad"]
+	survivors, err := bad.Ready()
+	if err != nil {
+		t.Fatalf("seed ready survivors: %v", err)
+	}
+	fs.stores["bad"] = &failingBeadStore{
+		Store:       bad,
+		readyResult: survivors,
+		readyErr: &beads.PartialResultError{
+			Op:  "bd ready",
+			Err: errors.New("skipped 1 corrupt bead"),
+		},
+	}
+	h := newTestCityHandler(t, fs)
+
+	req := httptest.NewRequest("GET", cityURL(fs, "/beads/ready"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("status = %d, want 200 (body=%q)", rec.Code, rec.Body.String())
+	}
+
+	var body struct {
+		Items         []beads.Bead `json:"items"`
+		Partial       bool         `json:"partial"`
+		PartialErrors []string     `json:"partial_errors"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode: %v (body=%q)", err, rec.Body.String())
+	}
+	if !body.Partial {
+		t.Fatalf("Partial = false, want true")
+	}
+	if len(body.PartialErrors) == 0 {
+		t.Fatalf("PartialErrors empty")
+	}
+	if !containsBeadTitle(body.Items, "would-be-lost") {
+		t.Fatalf("Items = %+v, want surviving partial ready row from bad rig", body.Items)
+	}
+}
+
 func TestBeadReadySurfacesStoreErrorsAsPartial(t *testing.T) {
 	boom := errors.New("ready: disk is on fire")
 	fs := newPartialListState(t, nil, boom)
@@ -139,3 +253,32 @@ func TestBeadReadySurfacesStoreErrorsAsPartial(t *testing.T) {
 		t.Errorf("PartialErrors empty")
 	}
 }
+
+func TestBeadReadyReturns503OnEmptyPartialTotalOutage(t *testing.T) {
+	fs := newFakeState(t)
+	fs.stores["myrig"] = &failingBeadStore{
+		Store:       fs.stores["myrig"],
+		readyResult: []beads.Bead{},
+		readyErr: &beads.PartialResultError{
+			Op:  "bd ready",
+			Err: errors.New("skipped 1 corrupt bead"),
+		},
+	}
+
+	h := newTestCityHandler(t, fs)
+	req := httptest.NewRequest("GET", cityURL(fs, "/beads/ready"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 503 {
+		t.Errorf("status = %d, want 503 when every backend has zero usable ready rows (body=%q)", rec.Code, rec.Body.String())
+	}
+}
+
+func containsBeadTitle(items []beads.Bead, title string) bool {
+	for _, item := range items {
+		if item.Title == title {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/api/handler_beads_test.go b/internal/api/handler_beads_test.go
index d90542d1a9..3103283d1c 100644
--- a/internal/api/handler_beads_test.go
+++ b/internal/api/handler_beads_test.go
@@ -22,6 +22,7 @@ type prefixedAliasStore struct {
 	getCalls      int
 	updateCalls   int
 	closeCalls    int
+	reopenCalls   int
 	childrenCalls int
 }
 
@@ -140,6 +141,11 @@ func (s *prefixedAliasStore) Close(id string) error {
 	return s.base.Close(s.aliasToBase(id))
 }
 
+func (s *prefixedAliasStore) Reopen(id string) error {
+	s.reopenCalls++
+	return s.base.Reopen(s.aliasToBase(id))
+}
+
 func (s *prefixedAliasStore) CloseAll(ids []string, metadata map[string]string) (int, error) {
 	mapped := make([]string, 0, len(ids))
 	for _, id := range ids {
@@ -188,8 +194,8 @@ func (s *prefixedAliasStore) List(query beads.ListQuery) ([]beads.Bead, error) {
 	return out, nil
 }
 
-func (s *prefixedAliasStore) Ready() ([]beads.Bead, error) {
-	items, err := s.base.Ready()
+func (s *prefixedAliasStore) Ready(query ...beads.ReadyQuery) ([]beads.Bead, error) {
+	items, err := s.base.Ready(query...)
 	if err != nil {
 		return nil, err
 	}
@@ -318,6 +324,86 @@ func configureBeadRouteState(t *testing.T) (*fakeState, *prefixedAliasStore, *pr
 	return state, alphaStore, betaStore
 }
 
+func TestBeadPrefixAllowsAlphanumericPrefixes(t *testing.T) {
+	if got := beadPrefix("mcdi3bsyeryols-yyn"); got != "mcdi3bsyeryols" {
+		t.Fatalf("beadPrefix() = %q, want alphanumeric prefix", got)
+	}
+}
+
+func TestBeadCloseVerifiesStoreContainsBeadBeforeClosing(t *testing.T) {
+	rigStore := beads.NewMemStore()
+	created, err := rigStore.Create(beads.Bead{Title: "close me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	status := "in_progress"
+	if err := rigStore.Update(created.ID, beads.UpdateOpts{Status: &status}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	misrouted := &closeSucceedsWithoutBeadStore{Store: beads.NewMemStore()}
+	state := newFakeState(t)
+	state.cityBeadStore = misrouted
+	state.stores = map[string]beads.Store{"myrig": rigStore}
+
+	s := New(state)
+	if _, err := s.humaHandleBeadClose(context.Background(), &BeadCloseInput{ID: created.ID}); err != nil {
+		t.Fatalf("humaHandleBeadClose: %v", err)
+	}
+
+	if misrouted.closeCalls != 0 {
+		t.Fatalf("misrouted close calls = %d, want 0", misrouted.closeCalls)
+	}
+	got, err := rigStore.Get(created.ID)
+	if err != nil {
+		t.Fatalf("rig Get: %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("rig status = %q, want closed", got.Status)
+	}
+}
+
+func TestBeadStoresForIDUsesConfiguredRigPrefixBeforeFallback(t *testing.T) {
+	state := newFakeState(t)
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	state.cityBeadStore = cityStore
+	state.stores = map[string]beads.Store{"myrig": rigStore}
+	state.cfg.Workspace.Prefix = "ct"
+	state.cfg.Rigs = []config.Rig{{Name: "myrig", Path: filepath.Join(state.cityPath, "rigs", "myrig"), Prefix: "rw"}}
+
+	s := New(state)
+	stores := s.beadStoresForID("rw-1")
+	if len(stores) != 1 || stores[0] != rigStore {
+		t.Fatalf("beadStoresForID(rw-1) = %#v, want only configured rig store", stores)
+	}
+}
+
+func TestBeadStoresForIDUsesConfiguredHyphenatedRigPrefix(t *testing.T) {
+	state := newFakeState(t)
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	state.cityBeadStore = cityStore
+	state.stores = map[string]beads.Store{"myrig": rigStore}
+	state.cfg.Workspace.Prefix = "mlcm"
+	state.cfg.Rigs = []config.Rig{{Name: "myrig", Path: filepath.Join(state.cityPath, "rigs", "myrig"), Prefix: "mc-mogbzvrs"}}
+
+	s := New(state)
+	stores := s.beadStoresForID("mc-mogbzvrs-hiv.1")
+	if len(stores) != 1 || stores[0] != rigStore {
+		t.Fatalf("beadStoresForID(hyphenated prefix) = %#v, want only configured rig store", stores)
+	}
+}
+
+type closeSucceedsWithoutBeadStore struct {
+	beads.Store
+	closeCalls int
+}
+
+func (s *closeSucceedsWithoutBeadStore) Close(string) error {
+	s.closeCalls++
+	return nil
+}
+
 func TestBeadCRUD(t *testing.T) {
 	state := newFakeState(t)
 	h := newTestCityHandler(t, state)
@@ -376,6 +462,73 @@ func TestBeadCRUD(t *testing.T) {
 	}
 }
 
+type laggyParentProjectionStore struct {
+	beads.Store
+	pendingChildren map[string]string
+	waitCalls       int
+}
+
+func newLaggyParentProjectionStore() *laggyParentProjectionStore {
+	return &laggyParentProjectionStore{
+		Store:           beads.NewMemStore(),
+		pendingChildren: make(map[string]string),
+	}
+}
+
+func (s *laggyParentProjectionStore) Update(id string, opts beads.UpdateOpts) error {
+	parentChanged := false
+	newParentID := ""
+	if opts.ParentID != nil {
+		current, err := s.Get(id)
+		if err != nil {
+			return err
+		}
+		parentChanged = current.ParentID != *opts.ParentID
+		newParentID = *opts.ParentID
+	}
+	if err := s.Store.Update(id, opts); err != nil {
+		return err
+	}
+	if parentChanged && newParentID != "" {
+		s.pendingChildren[id] = newParentID
+	}
+	return nil
+}
+
+func (s *laggyParentProjectionStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	items, err := s.Store.List(query)
+	if err != nil {
+		return nil, err
+	}
+	if query.ParentID == "" || len(s.pendingChildren) == 0 {
+		return items, nil
+	}
+	filtered := make([]beads.Bead, 0, len(items))
+	for _, item := range items {
+		if s.pendingChildren[item.ID] == query.ParentID {
+			continue
+		}
+		filtered = append(filtered, item)
+	}
+	return filtered, nil
+}
+
+func (s *laggyParentProjectionStore) WaitForParentProjection(_ context.Context, id string, _, _ string) error {
+	s.waitCalls++
+	delete(s.pendingChildren, id)
+	return nil
+}
+
+type projectionConflictStore struct {
+	beads.Store
+	waitCalls int
+}
+
+func (s *projectionConflictStore) WaitForParentProjection(_ context.Context, _, _, _ string) error {
+	s.waitCalls++
+	return beads.ErrParentProjectionSuperseded
+}
+
 func TestBeadListFiltering(t *testing.T) {
 	state := newFakeState(t)
 	store := state.stores["myrig"]
@@ -604,6 +757,27 @@ func TestBeadUpdate(t *testing.T) {
 	}
 }
 
+func TestBeadUpdateStatusAndMetadata(t *testing.T) {
+	state := newFakeState(t)
+	store := state.stores["myrig"]
+	b, _ := store.Create(beads.Bead{Title: "Test"})
+	h := newTestCityHandler(t, state)
+
+	body := `{"status":"in_progress","metadata":{"verified":"true"}}`
+	req := newPostRequest(cityURL(state, "/bead/")+b.ID+"/update", bytes.NewBufferString(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("update status = %d, want %d", rec.Code, http.StatusOK)
+	}
+
+	got, _ := store.Get(b.ID)
+	if got.Status != "in_progress" || got.Metadata["verified"] != "true" {
+		t.Fatalf("bead = %+v, want in_progress plus metadata", got)
+	}
+}
+
 func TestBeadCreatePersistsMetadataAndParent(t *testing.T) {
 	state := newFakeState(t)
 	store := state.stores["myrig"]
@@ -619,8 +793,8 @@ func TestBeadCreatePersistsMetadataAndParent(t *testing.T) {
 		"type":"feature",
 		"parent":"` + parent.ID + `",
 		"metadata":{
-			"mc.contract.role":"child",
-			"mc.contract.run_id":"run-1"
+			"real_world_app.contract.role":"child",
+			"real_world_app.contract.run_id":"run-1"
 		}
 	}`
 	req := newPostRequest(cityURL(state, "/beads"), bytes.NewBufferString(body))
@@ -638,8 +812,8 @@ func TestBeadCreatePersistsMetadataAndParent(t *testing.T) {
 	if created.ParentID != parent.ID {
 		t.Fatalf("response parent = %q, want %q", created.ParentID, parent.ID)
 	}
-	if created.Metadata["mc.contract.run_id"] != "run-1" {
-		t.Fatalf("response metadata = %#v, want mc.contract.run_id=run-1", created.Metadata)
+	if created.Metadata["real_world_app.contract.run_id"] != "run-1" {
+		t.Fatalf("response metadata = %#v, want real_world_app.contract.run_id=run-1", created.Metadata)
 	}
 
 	got, err := store.Get(created.ID)
@@ -649,8 +823,8 @@ func TestBeadCreatePersistsMetadataAndParent(t *testing.T) {
 	if got.ParentID != parent.ID {
 		t.Fatalf("stored parent = %q, want %q", got.ParentID, parent.ID)
 	}
-	if got.Metadata["mc.contract.role"] != "child" || got.Metadata["mc.contract.run_id"] != "run-1" {
-		t.Fatalf("stored metadata = %#v, want MC metadata", got.Metadata)
+	if got.Metadata["real_world_app.contract.role"] != "child" || got.Metadata["real_world_app.contract.run_id"] != "run-1" {
+		t.Fatalf("stored metadata = %#v, want real-world app metadata", got.Metadata)
 	}
 }
 
@@ -670,7 +844,7 @@ func TestBeadCreateResponseUsesAuthoritativeStoredBead(t *testing.T) {
 		"type":"feature",
 		"parent":"` + parent.ID + `",
 		"labels":["urgent"],
-		"metadata":{"mc.contract.run_id":"run-1"}
+		"metadata":{"real_world_app.contract.run_id":"run-1"}
 	}`
 	req := newPostRequest(cityURL(state, "/beads"), bytes.NewBufferString(body))
 	rec := httptest.NewRecorder()
@@ -690,8 +864,8 @@ func TestBeadCreateResponseUsesAuthoritativeStoredBead(t *testing.T) {
 	if len(created.Labels) != 1 || created.Labels[0] != "urgent" {
 		t.Fatalf("response labels = %#v, want [urgent]", created.Labels)
 	}
-	if created.Metadata["mc.contract.run_id"] != "run-1" {
-		t.Fatalf("response metadata = %#v, want mc.contract.run_id=run-1", created.Metadata)
+	if created.Metadata["real_world_app.contract.run_id"] != "run-1" {
+		t.Fatalf("response metadata = %#v, want real_world_app.contract.run_id=run-1", created.Metadata)
 	}
 }
 
@@ -727,6 +901,26 @@ func TestBeadUpdateUsesRoutePrefixStore(t *testing.T) {
 	}
 }
 
+func TestBeadStoresForIDUsesLongestConfiguredHyphenatedPrefix(t *testing.T) {
+	state := newFakeState(t)
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	state.cityBeadStore = cityStore
+	state.cfg.Workspace.Prefix = "mc"
+	state.cfg.Rigs = []config.Rig{{
+		Name:   "alpha",
+		Path:   "/tmp/alpha",
+		Prefix: "mc-alpha",
+	}}
+	state.stores = map[string]beads.Store{"alpha": rigStore}
+
+	server := &Server{state: state}
+	stores := server.beadStoresForID("mc-alpha-123")
+	if len(stores) != 1 || stores[0] != rigStore {
+		t.Fatalf("beadStoresForID returned %#v, want only authoritative rig store", stores)
+	}
+}
+
 func TestBeadUpdateSetsAndClearsParent(t *testing.T) {
 	state := newFakeState(t)
 	store := state.stores["myrig"]
@@ -772,6 +966,290 @@ func TestBeadUpdateSetsAndClearsParent(t *testing.T) {
 	}
 }
 
+func TestBeadUpdateWaitsForParentProjectionBeforeReturning(t *testing.T) {
+	state := newFakeState(t)
+	store := newLaggyParentProjectionStore()
+	state.stores["myrig"] = store
+	parent, err := store.Create(beads.Bead{Title: "Parent"})
+	if err != nil {
+		t.Fatalf("Create(parent): %v", err)
+	}
+	child, err := store.Create(beads.Bead{Title: "Child"})
+	if err != nil {
+		t.Fatalf("Create(child): %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := newPostRequest(cityURL(state, "/bead/")+child.ID+"/update", bytes.NewBufferString(`{"parent":"`+parent.ID+`"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("update status = %d, want %d, body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if store.waitCalls != 1 {
+		t.Fatalf("waitCalls = %d, want 1", store.waitCalls)
+	}
+
+	req = httptest.NewRequest("GET", cityURL(state, "/bead/")+parent.ID+"/deps", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("deps status = %d, want %d, body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Children []beads.Bead `json:"children"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("Decode(): %v", err)
+	}
+	if len(resp.Children) != 1 || resp.Children[0].ID != child.ID {
+		t.Fatalf("children = %#v, want [%s]", resp.Children, child.ID)
+	}
+}
+
+func TestBeadUpdateWaitsForParentProjectionThroughCachingStore(t *testing.T) {
+	state := newFakeState(t)
+	backing := newLaggyParentProjectionStore()
+	state.stores["myrig"] = beads.NewCachingStoreForTest(backing, nil)
+	parent, err := state.stores["myrig"].Create(beads.Bead{Title: "Parent"})
+	if err != nil {
+		t.Fatalf("Create(parent): %v", err)
+	}
+	child, err := state.stores["myrig"].Create(beads.Bead{Title: "Child"})
+	if err != nil {
+		t.Fatalf("Create(child): %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := newPostRequest(cityURL(state, "/bead/")+child.ID+"/update", bytes.NewBufferString(`{"parent":"`+parent.ID+`"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("update status = %d, want %d, body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if backing.waitCalls != 1 {
+		t.Fatalf("waitCalls = %d, want 1", backing.waitCalls)
+	}
+
+	req = httptest.NewRequest("GET", cityURL(state, "/bead/")+parent.ID+"/deps", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("deps status = %d, want %d, body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Children []beads.Bead `json:"children"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("Decode(): %v", err)
+	}
+	if len(resp.Children) != 1 || resp.Children[0].ID != child.ID {
+		t.Fatalf("children = %#v, want [%s]", resp.Children, child.ID)
+	}
+}
+
+func TestBeadUpdateSkipsParentProjectionWaitForClosedBead(t *testing.T) {
+	state := newFakeState(t)
+	store := newLaggyParentProjectionStore()
+	state.stores["myrig"] = store
+	parent, err := store.Create(beads.Bead{Title: "Parent"})
+	if err != nil {
+		t.Fatalf("Create(parent): %v", err)
+	}
+	child, err := store.Create(beads.Bead{Title: "Child"})
+	if err != nil {
+		t.Fatalf("Create(child): %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := newPostRequest(cityURL(state, "/bead/")+child.ID+"/update", bytes.NewBufferString(`{"parent":"`+parent.ID+`","status":"closed"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("update status = %d, want %d, body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if store.waitCalls != 0 {
+		t.Fatalf("waitCalls = %d, want 0", store.waitCalls)
+	}
+}
+
+func TestBeadUpdateReturnsConflictWhenParentProjectionIsSuperseded(t *testing.T) {
+	state := newFakeState(t)
+	store := &projectionConflictStore{Store: beads.NewMemStore()}
+	state.stores["myrig"] = store
+	parent, err := store.Create(beads.Bead{Title: "Parent"})
+	if err != nil {
+		t.Fatalf("Create(parent): %v", err)
+	}
+	child, err := store.Create(beads.Bead{Title: "Child"})
+	if err != nil {
+		t.Fatalf("Create(child): %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := newPostRequest(cityURL(state, "/bead/")+child.ID+"/update", bytes.NewBufferString(`{"parent":"`+parent.ID+`"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("status = %d, want %d, body: %s", rec.Code, http.StatusConflict, rec.Body.String())
+	}
+	if store.waitCalls != 1 {
+		t.Fatalf("waitCalls = %d, want 1", store.waitCalls)
+	}
+}
+
+func TestBeadParentRestoreGraphAndFilteredListWithRig(t *testing.T) {
+	state := newFakeState(t)
+	backing := beads.NewMemStore()
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	state.stores["alpha"] = cache
+	state.cfg.Rigs = append(state.cfg.Rigs, config.Rig{Name: "alpha", Path: "/tmp/alpha"})
+	h := newTestCityHandler(t, state)
+
+	createBead := func(body string) beads.Bead {
+		t.Helper()
+		req := newPostRequest(cityURL(state, "/beads"), bytes.NewBufferString(body))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusCreated {
+			t.Fatalf("create status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+		}
+		var created beads.Bead
+		if err := json.NewDecoder(rec.Body).Decode(&created); err != nil {
+			t.Fatalf("decode created bead: %v", err)
+		}
+		return created
+	}
+	postOK := func(path, body string) {
+		t.Helper()
+		req := newPostRequest(cityURL(state, path), bytes.NewBufferString(body))
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("POST %s status = %d, want %d; body: %s", path, rec.Code, http.StatusOK, rec.Body.String())
+		}
+	}
+	containsID := func(items []beads.Bead, id string) bool {
+		for _, item := range items {
+			if item.ID == id {
+				return true
+			}
+		}
+		return false
+	}
+
+	root := createBead(`{
+		"rig":"alpha",
+		"title":"MC live contract root",
+		"type":"feature",
+		"priority":2,
+		"labels":["mc-live-contract","root"],
+		"metadata":{"mc.contract.run_id":"run-1"}
+	}`)
+	postOK("/bead/"+root.ID+"/update", `{"status":"in_progress","metadata":{"mc.contract.updated":"true"}}`)
+	postOK("/bead/"+root.ID+"/close", ``)
+	postOK("/bead/"+root.ID+"/reopen", ``)
+
+	child := createBead(`{
+		"rig":"alpha",
+		"title":"MC live contract child",
+		"type":"task",
+		"priority":1,
+		"parent":"` + root.ID + `",
+		"labels":["mc-live-contract","child","needs-update"],
+		"metadata":{"mc.contract.run_id":"run-1"}
+	}`)
+	sibling := createBead(`{
+		"rig":"alpha",
+		"title":"MC live contract sibling",
+		"type":"bug",
+		"priority":3,
+		"parent":"` + root.ID + `",
+		"labels":["mc-live-contract","sibling"],
+		"metadata":{"mc.contract.run_id":"run-1"}
+	}`)
+
+	postOK("/bead/"+child.ID+"/update", `{
+		"parent":"",
+		"status":"in_progress",
+		"labels":["verified"],
+		"remove_labels":["needs-update"],
+		"metadata":{"mc.contract.updated":"true"},
+		"type":"bug",
+		"priority":4
+	}`)
+	postOK("/bead/"+child.ID+"/update", `{
+		"parent":"`+root.ID+`",
+		"metadata":{"mc.contract.parent_restored":"true"}
+	}`)
+
+	getBead := httptest.NewRecorder()
+	h.ServeHTTP(getBead, httptest.NewRequest("GET", cityURL(state, "/bead/")+child.ID, nil))
+	if getBead.Code != http.StatusOK {
+		t.Fatalf("get child status = %d, want %d; body: %s", getBead.Code, http.StatusOK, getBead.Body.String())
+	}
+	var restored beads.Bead
+	if err := json.NewDecoder(getBead.Body).Decode(&restored); err != nil {
+		t.Fatalf("decode restored child: %v", err)
+	}
+	if restored.ParentID != root.ID {
+		t.Fatalf("restored child parent = %q, want %q", restored.ParentID, root.ID)
+	}
+
+	depsRec := httptest.NewRecorder()
+	h.ServeHTTP(depsRec, httptest.NewRequest("GET", cityURL(state, "/bead/")+root.ID+"/deps", nil))
+	if depsRec.Code != http.StatusOK {
+		t.Fatalf("deps status = %d, want %d; body: %s", depsRec.Code, http.StatusOK, depsRec.Body.String())
+	}
+	var deps BeadDepsResponse
+	if err := json.NewDecoder(depsRec.Body).Decode(&deps); err != nil {
+		t.Fatalf("decode deps: %v", err)
+	}
+	if !containsID(deps.Children, child.ID) {
+		t.Fatalf("deps children = %#v, want child %s", deps.Children, child.ID)
+	}
+
+	graphRec := httptest.NewRecorder()
+	h.ServeHTTP(graphRec, httptest.NewRequest("GET", cityURL(state, "/beads/graph/")+root.ID, nil))
+	if graphRec.Code != http.StatusOK {
+		t.Fatalf("graph status = %d, want %d; body: %s", graphRec.Code, http.StatusOK, graphRec.Body.String())
+	}
+	var graph BeadGraphResponse
+	if err := json.NewDecoder(graphRec.Body).Decode(&graph); err != nil {
+		t.Fatalf("decode graph: %v", err)
+	}
+	if !containsID(graph.Beads, child.ID) || !containsID(graph.Beads, sibling.ID) {
+		t.Fatalf("graph beads = %#v, want child %s and sibling %s", graph.Beads, child.ID, sibling.ID)
+	}
+
+	listRec := httptest.NewRecorder()
+	h.ServeHTTP(listRec, httptest.NewRequest("GET", cityURL(state, "/beads?label=mc-live-contract&limit=50&rig=alpha"), nil))
+	if listRec.Code != http.StatusOK {
+		t.Fatalf("list status = %d, want %d; body: %s", listRec.Code, http.StatusOK, listRec.Body.String())
+	}
+	var list struct {
+		Items []beads.Bead `json:"items"`
+		Total int          `json:"total"`
+	}
+	if err := json.NewDecoder(listRec.Body).Decode(&list); err != nil {
+		t.Fatalf("decode list: %v", err)
+	}
+	if list.Total < 3 || !containsID(list.Items, root.ID) || !containsID(list.Items, sibling.ID) {
+		t.Fatalf("filtered beads = %+v, want root %s and sibling %s", list, root.ID, sibling.ID)
+	}
+}
+
 func TestBeadDepsUsesRoutePrefixStore(t *testing.T) {
 	state, alphaStore, betaStore := configureBeadRouteState(t)
 	parent, err := betaStore.Create(beads.Bead{Title: "Parent"})
@@ -922,7 +1400,8 @@ func TestBeadUpdateNullPriorityRejected(t *testing.T) {
 
 func TestBeadReopen(t *testing.T) {
 	state := newFakeState(t)
-	store := state.stores["myrig"]
+	store := newPrefixedAliasStore("myrig-")
+	state.stores["myrig"] = store
 	b, _ := store.Create(beads.Bead{Title: "Closed task"})
 	store.Close(b.ID) //nolint:errcheck
 	h := newTestCityHandler(t, state)
@@ -941,6 +1420,12 @@ func TestBeadReopen(t *testing.T) {
 	if got.Status != "open" {
 		t.Errorf("Status = %q, want %q", got.Status, "open")
 	}
+	if store.reopenCalls != 1 {
+		t.Fatalf("reopen calls = %d, want 1", store.reopenCalls)
+	}
+	if store.updateCalls != 0 {
+		t.Fatalf("update calls = %d, want 0; reopen must not use generic update", store.updateCalls)
+	}
 }
 
 func TestBeadReopenNotClosed(t *testing.T) {
diff --git a/internal/api/handler_config_test.go b/internal/api/handler_config_test.go
index 060d9a7d77..1ff41a9239 100644
--- a/internal/api/handler_config_test.go
+++ b/internal/api/handler_config_test.go
@@ -358,7 +358,7 @@ func TestHandleConfigGet_V2BindingNameIncludedInAgentName(t *testing.T) {
 	// V2 imported agents carry a BindingName that's runtime-only (json:"-").
 	// The config response still needs to expose it so clients can
 	// reconstruct the same qualified identity that appears in
-	// session.template — otherwise downstream filters (e.g. gasworks-gui's
+	// session.template — otherwise downstream filters (e.g. a real-world app's
 	// CityInfo session bucket) compare "mayor" against "gastown.mayor" and
 	// drop the session.
 	fs := newFakeState(t)
diff --git a/internal/api/handler_convoy_dispatch.go b/internal/api/handler_convoy_dispatch.go
index c690906966..5ddd2fd878 100644
--- a/internal/api/handler_convoy_dispatch.go
+++ b/internal/api/handler_convoy_dispatch.go
@@ -342,7 +342,7 @@ func workflowRootScope(root beads.Bead) (string, string) {
 }
 
 // collectWorkflowDeps returns the physical bead-to-bead dependencies.
-// Logical edge computation is handled by the MC server's presentation layer.
+// Logical edge computation is handled by the real-world app server's presentation layer.
 func collectWorkflowDeps(store beads.Store, beadIndex map[string]beads.Bead) ([]workflowDepResponse, bool) {
 	workflowDeps := make([]workflowDepResponse, 0)
 	seen := map[string]bool{}
diff --git a/internal/api/handler_events_test.go b/internal/api/handler_events_test.go
index b3dc17fbba..bd55dbbc2a 100644
--- a/internal/api/handler_events_test.go
+++ b/internal/api/handler_events_test.go
@@ -59,6 +59,38 @@ func TestEventListFilterByType(t *testing.T) {
 	}
 }
 
+func TestEventListIncludesCustomEventTypes(t *testing.T) {
+	state := newFakeState(t)
+	ep := state.eventProv.(*events.Fake)
+	ep.Record(events.Event{Type: "custom.untyped", Actor: "tester", Payload: json.RawMessage(`{"source":"test"}`)})
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "gc"})
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/events"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []map[string]any `json:"items"`
+		Total int              `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 2 || len(resp.Items) != 2 {
+		t.Fatalf("response = %+v, want custom and registered events", resp)
+	}
+	custom := eventListItemByType(t, resp.Items, "custom.untyped")
+	payload := assertJSONPayloadObject(t, custom["payload"])
+	if payload["source"] != "test" {
+		t.Fatalf("custom payload = %v, want source=test", payload)
+	}
+}
+
 func TestEventListRejectsInvalidSince(t *testing.T) {
 	state := newFakeState(t)
 	h := newTestCityHandler(t, state)
@@ -124,6 +156,33 @@ func TestEventStream(t *testing.T) {
 	}
 }
 
+func TestEventStreamCommitsHeadersBeforeFirstEvent(t *testing.T) {
+	state := newFakeState(t)
+	h := newTestCityHandler(t, state)
+	server := httptest.NewServer(h)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 250*time.Millisecond)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, server.URL+cityURL(state, "/events/stream"), nil)
+	if err != nil {
+		t.Fatalf("build stream request: %v", err)
+	}
+	req.Header.Set("Accept", "text/event-stream")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET events stream before first event: %v", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+	if ct := resp.Header.Get("Content-Type"); ct != "text/event-stream" {
+		t.Fatalf("Content-Type = %q, want text/event-stream", ct)
+	}
+}
+
 func TestEventStreamProjectsWorkflowMetadata(t *testing.T) {
 	state := newFakeState(t)
 	store := state.stores["myrig"]
diff --git a/internal/api/handler_formulas_test.go b/internal/api/handler_formulas_test.go
index 843e7bc16b..11b8c2464c 100644
--- a/internal/api/handler_formulas_test.go
+++ b/internal/api/handler_formulas_test.go
@@ -49,6 +49,7 @@ title = "Review PR"
 
 	var resp struct {
 		Items []formulaSummaryResponse `json:"items"`
+		Total int                      `json:"total"`
 	}
 	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
 		t.Fatalf("Decode(catalog): %v", err)
@@ -56,6 +57,9 @@ title = "Review PR"
 	if len(resp.Items) != 1 {
 		t.Fatalf("items = %+v, want 1 entry", resp.Items)
 	}
+	if resp.Total != len(resp.Items) {
+		t.Fatalf("total = %d, want len(items)=%d", resp.Total, len(resp.Items))
+	}
 	item := resp.Items[0]
 	if item.Name != "mol-adopt-pr-v2" {
 		t.Fatalf("name = %q, want mol-adopt-pr-v2", item.Name)
diff --git a/internal/api/handler_mail.go b/internal/api/handler_mail.go
index 3ed001ae92..5e1dcefa15 100644
--- a/internal/api/handler_mail.go
+++ b/internal/api/handler_mail.go
@@ -142,8 +142,14 @@ func (s *Server) resolveMailQueryRecipientsWithContext(ctx context.Context, reci
 }
 
 func (s *Server) mailRecipientsForNamedSession(store beads.Store, spec apiNamedSessionSpec) ([]string, error) {
+	identity := apiNormalizeSessionTarget(spec.Identity)
+	if identity == "" {
+		return nil, nil
+	}
 	candidates, err := store.List(beads.ListQuery{
-		Label:         session.LabelSession,
+		Metadata: map[string]string{
+			session.NamedSessionIdentityMetadata: identity,
+		},
 		IncludeClosed: true,
 	})
 	if err != nil {
@@ -167,6 +173,32 @@ func (s *Server) mailRecipientsForNamedSession(store beads.Store, spec apiNamedS
 	return recipients, nil
 }
 
+func (s *Server) configuredNamedMailIdentities(identifier string) []string {
+	identifier = apiNormalizeSessionTarget(identifier)
+	seen := make(map[string]bool)
+	identities := make([]string, 0, 2)
+	add := func(identity string) {
+		identity = apiNormalizeSessionTarget(identity)
+		if identity == "" || seen[identity] {
+			return
+		}
+		seen[identity] = true
+		identities = append(identities, identity)
+	}
+	add(identifier)
+	cfg := s.state.Config()
+	if cfg == nil {
+		return identities
+	}
+	for i := range cfg.NamedSessions {
+		identity := cfg.NamedSessions[i].QualifiedName()
+		if session.TargetBasename(identity) == identifier {
+			add(identity)
+		}
+	}
+	return identities
+}
+
 type apiResolvedMailTarget struct {
 	display    string
 	recipients []string
@@ -209,11 +241,25 @@ func (s *Server) resolveLiveConfiguredNamedMailTarget(store beads.Store, identif
 	if store == nil || identifier == "" || identifier == "human" || strings.Contains(identifier, "/") {
 		return apiResolvedMailTarget{}, false, nil
 	}
-	all, err := store.List(beads.ListQuery{
-		Label: session.LabelSession,
-	})
-	if err != nil {
-		return apiResolvedMailTarget{}, false, err
+	identities := s.configuredNamedMailIdentities(identifier)
+	all := make([]beads.Bead, 0, len(identities))
+	seenBeads := make(map[string]bool)
+	for _, identity := range identities {
+		items, err := store.List(beads.ListQuery{
+			Metadata: map[string]string{
+				session.NamedSessionIdentityMetadata: identity,
+			},
+		})
+		if err != nil {
+			return apiResolvedMailTarget{}, false, err
+		}
+		for _, b := range items {
+			if b.ID != "" && seenBeads[b.ID] {
+				continue
+			}
+			seenBeads[b.ID] = true
+			all = append(all, b)
+		}
 	}
 
 	matches := make(map[string]apiResolvedMailTarget)
@@ -299,6 +345,11 @@ func mailMessagesForRecipients(fetch func(string) ([]mail.Message, error), recip
 
 func mailCountForRecipients(mp mail.Provider, recipients []string) (int, int, error) {
 	recipients = uniqueMailRecipients(recipients)
+	if counter, ok := mp.(interface {
+		CountRecipients([]string) (int, int, error)
+	}); ok {
+		return counter.CountRecipients(recipients)
+	}
 	var totalAll, unreadAll int
 	for _, recipient := range recipients {
 		total, unread, err := mp.Count(recipient)
diff --git a/internal/api/handler_mail_test.go b/internal/api/handler_mail_test.go
index 77dc9e6d3d..7a84333db2 100644
--- a/internal/api/handler_mail_test.go
+++ b/internal/api/handler_mail_test.go
@@ -8,8 +8,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/mail"
+	"github.com/gastownhall/gascity/internal/session"
 )
 
 func TestMailLifecycle(t *testing.T) {
@@ -76,6 +78,11 @@ func TestMailLifecycle(t *testing.T) {
 	if rec.Code != http.StatusOK {
 		t.Fatalf("get status = %d, want %d", rec.Code, http.StatusOK)
 	}
+	var readMsg mail.Message
+	json.NewDecoder(rec.Body).Decode(&readMsg) //nolint:errcheck
+	if !readMsg.Read {
+		t.Fatalf("get after read: Read = false, want true")
+	}
 
 	// Archive.
 	req = newPostRequest(cityURL(state, "/mail/")+sent.ID+"/archive", nil)
@@ -87,6 +94,50 @@ func TestMailLifecycle(t *testing.T) {
 	}
 }
 
+func TestMailMarkUnread(t *testing.T) {
+	state := newFakeState(t)
+	h := newTestCityHandler(t, state)
+
+	body := `{"from":"mayor","to":"worker","subject":"Unread test","body":"check this"}`
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, newPostRequest(cityURL(state, "/mail"), bytes.NewBufferString(body)))
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("send status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	}
+	var sent mail.Message
+	json.NewDecoder(rec.Body).Decode(&sent) //nolint:errcheck
+
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, newPostRequest(cityURL(state, "/mail/")+sent.ID+"/read", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("read status = %d, want %d", rec.Code, http.StatusOK)
+	}
+
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, newPostRequest(cityURL(state, "/mail/")+sent.ID+"/mark-unread", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("mark-unread status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", cityURL(state, "/mail?agent=myrig/worker"), nil))
+	var inbox struct {
+		Items []mail.Message `json:"items"`
+		Total int            `json:"total"`
+	}
+	json.NewDecoder(rec.Body).Decode(&inbox) //nolint:errcheck
+	if inbox.Total != 1 {
+		t.Fatalf("inbox after mark-unread: Total = %d, want 1 (message should reappear)", inbox.Total)
+	}
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", cityURL(state, "/mail/")+sent.ID, nil))
+	var unread mail.Message
+	json.NewDecoder(rec.Body).Decode(&unread) //nolint:errcheck
+	if unread.Read {
+		t.Fatalf("get after mark-unread: Read = true, want false")
+	}
+}
+
 func TestMailSendValidation(t *testing.T) {
 	state := newFakeState(t)
 	h := newTestCityHandler(t, state)
@@ -153,6 +204,52 @@ func TestMailCount(t *testing.T) {
 	}
 }
 
+func TestMailInboxSeesHistoricalAliasSessionAddedAfterInitialMiss(t *testing.T) {
+	state := newFakeState(t)
+	h := newTestCityHandler(t, state)
+
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", cityURL(state, "/mail?agent=old-worker"), nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("initial inbox status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	store := state.stores["myrig"]
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "worker",
+			"alias_history": "old-worker",
+		},
+	}); err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+	if _, err := state.cityMailProv.Send("human", "worker", "Fresh session", "visible after initial miss"); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", cityURL(state, "/mail?agent=old-worker"), nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("second inbox status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var inbox struct {
+		Items []mail.Message `json:"items"`
+		Total int            `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&inbox); err != nil {
+		t.Fatalf("decode inbox: %v", err)
+	}
+	if inbox.Total != 1 {
+		t.Fatalf("second inbox Total = %d, want 1", inbox.Total)
+	}
+	if len(inbox.Items) != 1 || inbox.Items[0].Body != "visible after initial miss" {
+		t.Fatalf("second inbox items = %#v, want visible historical-alias message", inbox.Items)
+	}
+}
+
 func TestMailDelete(t *testing.T) {
 	state := newFakeState(t)
 	mp := state.cityMailProv
diff --git a/internal/api/handler_orders_test.go b/internal/api/handler_orders_test.go
index 36f66b9e71..0337950110 100644
--- a/internal/api/handler_orders_test.go
+++ b/internal/api/handler_orders_test.go
@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"strconv"
 	"testing"
 	"time"
 
@@ -405,6 +407,33 @@ func TestHandleOrderCheckTreatsWispFailedAsFailed(t *testing.T) {
 	}
 }
 
+func TestHandleOrderCheckRunsConditionByDefault(t *testing.T) {
+	fs := newFakeState(t)
+	marker := t.TempDir() + "/condition-ran"
+	fs.autos = []orders.Order{
+		{Name: "router", Formula: "review-pr", Trigger: "condition", Check: "printf x >> " + strconv.Quote(marker)},
+	}
+
+	h := newTestCityHandler(t, fs)
+	for _, path := range []string{"/orders/check", "/orders/check", "/orders/check?fresh=true"} {
+		req := httptest.NewRequest(http.MethodGet, cityURL(fs, path), nil)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Fatalf("status for %s = %d, want 200; body = %s", path, w.Code, w.Body.String())
+		}
+	}
+
+	got, err := os.ReadFile(marker)
+	if err != nil {
+		t.Fatalf("read condition marker: %v", err)
+	}
+	if string(got) != "xxx" {
+		t.Fatalf("condition marker = %q, want one execution per request", got)
+	}
+}
+
 func TestLastRunOutcomeFromLabelsPrioritizesTerminalLabels(t *testing.T) {
 	tests := []struct {
 		name   string
@@ -731,6 +760,126 @@ func TestHandleOrderCheckUsesRigStoreLastRunState(t *testing.T) {
 	}
 }
 
+type cachedOnlyOrderHistoryStore struct {
+	beads.Store
+	cached                 []beads.Bead
+	cacheOK                bool
+	includeClosedListCalls int
+}
+
+func (s *cachedOnlyOrderHistoryStore) CachedList(query beads.ListQuery) ([]beads.Bead, bool) {
+	return beads.ApplyListQuery(s.cached, query), s.cacheOK
+}
+
+func (s *cachedOnlyOrderHistoryStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.IncludeClosed {
+		s.includeClosedListCalls++
+	}
+	return s.Store.List(query)
+}
+
+func TestHandleOrderCheckUsesCachedHistoryWhenAvailable(t *testing.T) {
+	fs := newFakeState(t)
+	run := beads.Bead{
+		ID:        "run-1",
+		Title:     "nightly-review wisp",
+		Status:    "closed",
+		CreatedAt: time.Now().UTC(),
+		Labels:    []string{"order-run:nightly-review", "wisp"},
+	}
+	cachedStore := &cachedOnlyOrderHistoryStore{
+		Store:   beads.NewMemStore(),
+		cached:  []beads.Bead{run},
+		cacheOK: true,
+	}
+	fs.cityBeadStore = cachedStore
+	fs.autos = []orders.Order{
+		{Name: "nightly-review", Formula: "mol-adopt-pr-v2", Trigger: "cooldown", Interval: "24h"},
+	}
+
+	h := newTestCityHandler(t, fs)
+	req := httptest.NewRequest(http.MethodGet, cityURL(fs, "/orders/check"), nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body = %s", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	var resp struct {
+		Checks []struct {
+			Due            bool    `json:"due"`
+			LastRunOutcome *string `json:"last_run_outcome"`
+		} `json:"checks"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(resp.Checks) != 1 {
+		t.Fatalf("len(checks) = %d, want 1", len(resp.Checks))
+	}
+	if resp.Checks[0].Due {
+		t.Fatal("due = true, want false from cached recent run")
+	}
+	if resp.Checks[0].LastRunOutcome == nil || *resp.Checks[0].LastRunOutcome != "success" {
+		t.Fatalf("last_run_outcome = %v, want success", resp.Checks[0].LastRunOutcome)
+	}
+	if cachedStore.includeClosedListCalls != 0 {
+		t.Fatalf("IncludeClosed List calls = %d, want 0 when cached history is available", cachedStore.includeClosedListCalls)
+	}
+}
+
+func TestHandleOrderCheckFallsBackToLiveHistoryWhenCacheUnavailable(t *testing.T) {
+	fs := newFakeState(t)
+	cachedStore := &cachedOnlyOrderHistoryStore{
+		Store: beads.NewMemStore(),
+	}
+	_, err := cachedStore.Create(beads.Bead{
+		Title:     "nightly-review wisp",
+		Status:    "closed",
+		CreatedAt: time.Now().UTC(),
+		Labels:    []string{"order-run:nightly-review", "wisp"},
+	})
+	if err != nil {
+		t.Fatalf("create live history bead: %v", err)
+	}
+	fs.cityBeadStore = cachedStore
+	fs.autos = []orders.Order{
+		{Name: "nightly-review", Formula: "mol-adopt-pr-v2", Trigger: "cooldown", Interval: "24h"},
+	}
+
+	h := newTestCityHandler(t, fs)
+	req := httptest.NewRequest(http.MethodGet, cityURL(fs, "/orders/check"), nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body = %s", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	var resp struct {
+		Checks []struct {
+			Due            bool    `json:"due"`
+			LastRunOutcome *string `json:"last_run_outcome"`
+		} `json:"checks"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(resp.Checks) != 1 {
+		t.Fatalf("len(checks) = %d, want 1", len(resp.Checks))
+	}
+	if resp.Checks[0].Due {
+		t.Fatal("due = true, want false from live recent run")
+	}
+	if resp.Checks[0].LastRunOutcome == nil || *resp.Checks[0].LastRunOutcome != "success" {
+		t.Fatalf("last_run_outcome = %v, want success", resp.Checks[0].LastRunOutcome)
+	}
+	if cachedStore.includeClosedListCalls == 0 {
+		t.Fatal("IncludeClosed List calls = 0, want live fallback when cache is unavailable")
+	}
+}
+
 func TestHandleOrderCheckSkipsUnavailableRigStore(t *testing.T) {
 	fs := newFakeState(t)
 	fs.cityBeadStore = beads.NewMemStore()
@@ -813,6 +962,55 @@ func TestHandleOrderHistoryUsesRigStore(t *testing.T) {
 	}
 }
 
+func TestHandleOrderHistoryMarksAdHocOutputMetadata(t *testing.T) {
+	fs := newFakeState(t)
+	fs.cityBeadStore = beads.NewMemStore()
+	rigStore := fs.stores["myrig"]
+	if rigStore == nil {
+		t.Fatal("expected rig store")
+	}
+
+	run, err := rigStore.Create(beads.Bead{
+		Title:  "ad hoc order output",
+		Status: "closed",
+		Labels: []string{"order-run:ad-hoc:rig:myrig", "wisp"},
+		Metadata: map[string]string{
+			"convergence.gate_stdout": "done",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create rig history bead: %v", err)
+	}
+
+	h := newTestCityHandler(t, fs)
+	req := httptest.NewRequest(http.MethodGet, cityURL(fs, "/orders/history?scoped_name=ad-hoc:rig:myrig"), nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body = %s", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	var resp struct {
+		Entries []struct {
+			BeadID    string `json:"bead_id"`
+			HasOutput bool   `json:"has_output"`
+		} `json:"entries"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(resp.Entries) != 1 {
+		t.Fatalf("len(entries) = %d, want 1", len(resp.Entries))
+	}
+	if resp.Entries[0].BeadID != run.ID {
+		t.Fatalf("bead_id = %q, want %q", resp.Entries[0].BeadID, run.ID)
+	}
+	if !resp.Entries[0].HasOutput {
+		t.Fatal("has_output = false, want true for captured output metadata")
+	}
+}
+
 func TestHandleOrderHistoryIncludesStoreRefForCollidingIDs(t *testing.T) {
 	fs := newFakeState(t)
 	fs.cityBeadStore = beads.NewMemStore()
diff --git a/internal/api/handler_provider_readiness.go b/internal/api/handler_provider_readiness.go
index 5557001857..3169f05c2d 100644
--- a/internal/api/handler_provider_readiness.go
+++ b/internal/api/handler_provider_readiness.go
@@ -481,7 +481,7 @@ func probeGitHubCLIAuthStatus(ctx context.Context, homeDir, ghPath string) provi
 	stdout, stderr, err := runProbeCommand(
 		ctx,
 		homeDir,
-		2*time.Second,
+		5*time.Second,
 		ghPath,
 		"auth",
 		"status",
diff --git a/internal/api/handler_provider_readiness_test.go b/internal/api/handler_provider_readiness_test.go
index 3d9019db9a..b32ba79a39 100644
--- a/internal/api/handler_provider_readiness_test.go
+++ b/internal/api/handler_provider_readiness_test.go
@@ -148,8 +148,8 @@ func TestFindProbeBinaryUsesNVMInstallDir(t *testing.T) {
 
 	originalPathEnv := providerProbePathEnv
 	originalGOOS := providerProbeGOOS
-	providerProbePathEnv = "/usr/local/bin:/usr/bin:/bin"
-	providerProbeGOOS = "darwin"
+	providerProbePathEnv = filepath.Join(homeDir, "empty-path")
+	providerProbeGOOS = "test"
 	defer func() {
 		providerProbePathEnv = originalPathEnv
 		providerProbeGOOS = originalGOOS
diff --git a/internal/api/handler_rigs.go b/internal/api/handler_rigs.go
index 2795a9fdfe..749ec7964c 100644
--- a/internal/api/handler_rigs.go
+++ b/internal/api/handler_rigs.go
@@ -6,11 +6,10 @@ import (
 	"time"
 
 	"github.com/gastownhall/gascity/internal/agent"
-	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	gitpkg "github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/runtime"
 	workdirutil "github.com/gastownhall/gascity/internal/workdir"
-	"github.com/gastownhall/gascity/internal/worker"
 )
 
 type rigResponse struct {
@@ -33,7 +32,7 @@ type gitStatus struct {
 }
 
 // buildRigResponse creates a rigResponse with agent counts and last activity.
-func (s *Server) buildRigResponse(cfg *config.City, rig config.Rig, store beads.Store, sp sessionLister, cityName, cityPath string) rigResponse {
+func (s *Server) buildRigResponse(cfg *config.City, rig config.Rig, sp runtime.Provider, cityName, cityPath string) rigResponse {
 	tmpl := cfg.Workspace.SessionTemplate
 	var agentCount, runningCount int
 	var maxActivity time.Time
@@ -46,8 +45,7 @@ func (s *Server) buildRigResponse(cfg *config.City, rig config.Rig, store beads.
 		for _, ea := range expanded {
 			agentCount++
 			sessionName := agent.SessionNameFor(cityName, ea.qualifiedName, tmpl)
-			handle, _ := s.workerHandleForSessionTarget(store, sessionName)
-			obs, _ := worker.ObserveHandle(context.Background(), handle)
+			obs := observeProviderSession(sp, sessionName, nil)
 			if obs.Running {
 				runningCount++
 			}
@@ -60,7 +58,7 @@ func (s *Server) buildRigResponse(cfg *config.City, rig config.Rig, store beads.
 	resp := rigResponse{
 		Name:         rig.Name,
 		Path:         rig.Path,
-		Suspended:    s.rigSuspended(cfg, rig, store, sp, cityName, cityPath),
+		Suspended:    s.rigSuspended(cfg, rig, sp, cityName, cityPath),
 		Prefix:       rig.Prefix,
 		AgentCount:   agentCount,
 		RunningCount: runningCount,
@@ -74,7 +72,7 @@ func (s *Server) buildRigResponse(cfg *config.City, rig config.Rig, store beads.
 // rigSuspended computes effective suspended state for a rig by merging config
 // and runtime session metadata. A rig is suspended if the config says so, or
 // if all its agents are runtime-suspended via session metadata.
-func (s *Server) rigSuspended(cfg *config.City, rig config.Rig, store beads.Store, sp sessionLister, cityName, cityPath string) bool {
+func (s *Server) rigSuspended(cfg *config.City, rig config.Rig, sp runtime.Provider, cityName, cityPath string) bool {
 	if rig.Suspended {
 		return true
 	}
@@ -88,8 +86,7 @@ func (s *Server) rigSuspended(cfg *config.City, rig config.Rig, store beads.Stor
 		for _, ea := range expanded {
 			agentCount++
 			sessionName := agent.SessionNameFor(cityName, ea.qualifiedName, tmpl)
-			handle, _ := s.workerHandleForSessionTarget(store, sessionName)
-			obs, _ := worker.ObserveHandle(context.Background(), handle)
+			obs := observeProviderSession(sp, sessionName, nil)
 			if obs.Suspended {
 				suspendedCount++
 			}
diff --git a/internal/api/handler_session_agents.go b/internal/api/handler_session_agents.go
index fe27919f6e..3e7409ff35 100644
--- a/internal/api/handler_session_agents.go
+++ b/internal/api/handler_session_agents.go
@@ -32,7 +32,7 @@ func (s *Server) handleSessionAgentList(w http.ResponseWriter, r *http.Request)
 	mappings, err := handle.AgentMappings(r.Context())
 	if err != nil {
 		if errors.Is(err, worker.ErrHistoryUnavailable) {
-			writeJSON(w, http.StatusOK, map[string]any{"agents": []any{}})
+			writeJSON(w, http.StatusOK, sessionAgentListResponse{})
 			return
 		}
 		writeSessionManagerError(w, err)
@@ -41,11 +41,7 @@ func (s *Server) handleSessionAgentList(w http.ResponseWriter, r *http.Request)
 	if mappings == nil {
 		mappings = []worker.AgentMapping{}
 	}
-	if len(mappings) == 0 {
-		writeJSON(w, http.StatusOK, map[string]any{"agents": []any{}})
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"agents": mappings})
+	writeJSON(w, http.StatusOK, sessionAgentListResponse{Agents: mappings})
 }
 
 // handleSessionAgentGet returns the transcript and status of a subagent.
@@ -95,9 +91,8 @@ func (s *Server) handleSessionAgentGet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Build raw message array for API pass-through (same as raw transcript).
-	writeJSON(w, http.StatusOK, map[string]any{
-		"messages": agentSession.RawMessages,
-		"status":   agentSession.Session.Status,
+	writeJSON(w, http.StatusOK, sessionAgentGetResponse{
+		Messages: agentSession.Session.RawPayloads(),
+		Status:   agentSession.Session.Status,
 	})
 }
diff --git a/internal/api/handler_session_chat_test.go b/internal/api/handler_session_chat_test.go
index b429f0e6eb..88e7298d2c 100644
--- a/internal/api/handler_session_chat_test.go
+++ b/internal/api/handler_session_chat_test.go
@@ -135,6 +135,7 @@ func TestBuildSessionResumePreservesStoredResolvedCommand(t *testing.T) {
 func TestBuildSessionResumeRebuildsBareStoredCommandForPoolClaudeAgent(t *testing.T) {
 	fs := newSessionFakeState(t)
 	claude := config.BuiltinProviders()["claude"]
+	claude.PathCheck = "true" // use /usr/bin/true so LookPath succeeds in CI
 	maxActive := 3
 	gcDir := filepath.Join(fs.cityPath, ".gc")
 	if err := os.MkdirAll(gcDir, 0o755); err != nil {
diff --git a/internal/api/handler_session_create.go b/internal/api/handler_session_create.go
index d71090d650..921b4094a4 100644
--- a/internal/api/handler_session_create.go
+++ b/internal/api/handler_session_create.go
@@ -27,7 +27,7 @@ type sessionCreateRequest struct {
 	Message           string            `json:"message,omitempty"`
 	Async             bool              `json:"async,omitempty"`
 	Options           map[string]string `json:"options,omitempty"`
-	// ProjectID is an opaque identifier for the MC project context.
+	// ProjectID is an opaque identifier for the real-world app project context.
 	// Stored in bead metadata for session-to-project association.
 	ProjectID string `json:"project_id,omitempty"`
 	Title     string `json:"title,omitempty"`
@@ -177,7 +177,7 @@ func (s *Server) handleSessionCreate(w http.ResponseWriter, r *http.Request) {
 
 	// Agent sessions always use async (bead-only) creation. The reconciler
 	// starts the agent process on the next tick. This avoids blocking the
-	// HTTP response for 10-30s while the agent boots in tmux, and lets MC
+	// HTTP response for 10-30s while the agent boots in tmux, and lets real-world apps
 	// show the session in the sidebar immediately via optimistic UI.
 	resolvedCfg, err := resolvedSessionConfigForProvider(alias, createCtx.ExplicitName, template, title, transport, extraMeta, resolved, command, workDir, mcpServers)
 	if err != nil {
@@ -241,7 +241,7 @@ func (s *Server) handleSessionCreate(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 	if handle, handleErr := s.workerHandleForSession(store, info.ID); handleErr == nil {
-		s.enrichSessionResponse(&resp, info, s.state.Config(), handle, false, true)
+		s.enrichSessionResponse(&resp, info, s.state.Config(), handle, false, true, true)
 	}
 	statusCode := http.StatusAccepted // always async for agent sessions
 	s.idem.storeResponse(idemKey, bodyHash, statusCode, resp)
@@ -428,7 +428,7 @@ func (s *Server) createProviderSession(w http.ResponseWriter, r *http.Request, s
 		}
 	}
 	if handle, handleErr := s.workerHandleForSession(store, info.ID); handleErr == nil {
-		s.enrichSessionResponse(&resp, info, s.state.Config(), handle, false, true)
+		s.enrichSessionResponse(&resp, info, s.state.Config(), handle, false, true, true)
 	}
 	statusCode := http.StatusCreated
 	s.idem.storeResponse(idemKey, bodyHash, statusCode, resp)
@@ -473,10 +473,10 @@ func (s *Server) persistSessionMeta(store beads.Store, sessionID, kind, projectI
 		batch[k] = v
 	}
 	if kind != "" && kind != "provider" {
-		batch["mc_session_kind"] = kind
+		batch["real_world_app_session_kind"] = kind
 	}
 	if projectID != "" {
-		batch["mc_project_id"] = projectID
+		batch["real_world_app_project_id"] = projectID
 	}
 	if len(batch) > 0 {
 		if err := store.SetMetadataBatch(sessionID, batch); err != nil {
diff --git a/internal/api/handler_session_stream.go b/internal/api/handler_session_stream.go
index d089096544..3d555a2489 100644
--- a/internal/api/handler_session_stream.go
+++ b/internal/api/handler_session_stream.go
@@ -38,6 +38,20 @@ type SessionStreamRawMessageEvent struct {
 	Pagination *sessionlog.PaginationInfo `json:"pagination,omitempty"`
 }
 
+type sessionStreamActivityPayload struct {
+	Activity string `json:"activity"`
+}
+
+type syntheticContentBlock struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
+type syntheticAssistantFrame struct {
+	Role    string                  `json:"role"`
+	Content []syntheticContentBlock `json:"content"`
+}
+
 var sessionStreamPendingStallTimeout = 5 * time.Second
 
 func runtimePendingInteraction(pending *worker.PendingInteraction) runtime.PendingInteraction {
@@ -73,13 +87,14 @@ func (s *Server) handleSessionStream(w http.ResponseWriter, r *http.Request) {
 		writeSessionManagerError(w, err)
 		return
 	}
+	format := r.URL.Query().Get("format")
 	handle, err := s.workerHandleForSession(store, id)
 	if err != nil {
 		writeSessionManagerError(w, err)
 		return
 	}
 	historyReq := worker.HistoryRequest{}
-	if r.URL.Query().Get("format") == "raw" && !info.Closed {
+	if format == "raw" && !info.Closed {
 		historyReq.TailCompactions = 1
 	}
 	history, historyErr := handle.History(worker.WithoutOperationEvents(r.Context()), historyReq)
@@ -115,7 +130,16 @@ func (s *Server) handleSessionStream(w http.ResponseWriter, r *http.Request) {
 	}
 
 	ctx := r.Context()
-	format := r.URL.Query().Get("format")
+	if format == "raw" && !info.Closed {
+		data, _ := json.Marshal(SessionStreamRawMessageEvent{
+			ID:       info.ID,
+			Template: info.Template,
+			Provider: info.Provider,
+			Format:   "raw",
+			Messages: []SessionRawMessageFrame{},
+		})
+		writeSSE(w, "message", 0, data)
+	}
 	if info.Closed {
 		if format == "raw" {
 			s.emitClosedSessionSnapshotRaw(w, info, history)
@@ -133,20 +157,9 @@ func (s *Server) handleSessionStream(w http.ResponseWriter, r *http.Request) {
 		}
 	case format == "raw":
 		// No log file yet. If the session is running, poll tmux pane content
-		// and wrap it as a fake raw JSONL assistant message so MC's existing
+		// and wrap it as a fake raw JSONL assistant message so a real-world app's existing
 		// rendering pipeline shows terminal output (e.g. OAuth prompts).
-		if running {
-			s.streamSessionPeekRaw(ctx, w, info, handle)
-		} else {
-			data, _ := json.Marshal(SessionStreamRawMessageEvent{
-				ID:       info.ID,
-				Template: info.Template,
-				Provider: info.Provider,
-				Format:   "raw",
-				Messages: []SessionRawMessageFrame{},
-			})
-			writeSSE(w, "message", 1, data)
-		}
+		s.streamSessionPeekRaw(ctx, w, info, handle)
 		return
 	default:
 		s.streamSessionPeek(ctx, w, info, handle)
@@ -182,7 +195,7 @@ func (s *Server) emitClosedSessionSnapshot(w http.ResponseWriter, info session.I
 		return
 	}
 	writeSSE(w, "turn", 1, data)
-	actData, _ := json.Marshal(map[string]string{"activity": "idle"})
+	actData, _ := json.Marshal(sessionStreamActivityPayload{Activity: "idle"})
 	writeSSE(w, "activity", 2, actData)
 }
 
@@ -206,7 +219,7 @@ func (s *Server) emitClosedSessionSnapshotRaw(w http.ResponseWriter, info sessio
 		return
 	}
 	writeSSE(w, "message", 1, data)
-	actData, _ := json.Marshal(map[string]string{"activity": "idle"})
+	actData, _ := json.Marshal(sessionStreamActivityPayload{Activity: "idle"})
 	writeSSE(w, "activity", 2, actData)
 }
 
@@ -285,7 +298,7 @@ func (s *Server) streamSessionTranscriptHistoryRaw(ctx context.Context, w http.R
 		if currentActivity != "" && currentActivity != lastActivity {
 			lastActivity = currentActivity
 			seq++
-			actData, _ := json.Marshal(map[string]string{"activity": currentActivity})
+			actData, _ := json.Marshal(sessionStreamActivityPayload{Activity: currentActivity})
 			writeSSE(w, "activity", seq, actData)
 			lastProgress = time.Now()
 			emitted = true
@@ -306,7 +319,7 @@ func (s *Server) streamSessionTranscriptHistoryRaw(ctx context.Context, w http.R
 					activity = "in-turn"
 				}
 				seq++
-				actData, _ := json.Marshal(map[string]string{"activity": activity})
+				actData, _ := json.Marshal(sessionStreamActivityPayload{Activity: activity})
 				writeSSE(w, "activity", seq, actData)
 				return true
 			}
@@ -340,12 +353,12 @@ func (s *Server) streamSessionTranscriptHistoryRaw(ctx context.Context, w http.R
 		return emitted
 	}
 
-	_ = emitSnapshot(initial)
 	if logPath != "" {
 		poll.Stop()
 		keepalive.Stop()
 		lw = newLogFileWatcher(logPath)
 		defer lw.Close()
+		_ = emitSnapshot(initial)
 		lw.Run(ctx, reloadSnapshot, func() { writeSSEComment(w) }, RunOpts{
 			OnStall:      func() { _ = emitPending() },
 			StallTimeout: sessionStreamPendingStallTimeout,
@@ -354,6 +367,7 @@ func (s *Server) streamSessionTranscriptHistoryRaw(ctx context.Context, w http.R
 		return
 	}
 
+	_ = emitSnapshot(initial)
 	for {
 		select {
 		case <-ctx.Done():
@@ -438,7 +452,7 @@ func (s *Server) streamSessionTranscriptHistory(ctx context.Context, w http.Resp
 		if activity != "" && activity != lastActivity {
 			lastActivity = activity
 			seq++
-			actData, _ := json.Marshal(map[string]string{"activity": activity})
+			actData, _ := json.Marshal(sessionStreamActivityPayload{Activity: activity})
 			writeSSE(w, "activity", seq, actData)
 			emitted = true
 		}
@@ -462,16 +476,17 @@ func (s *Server) streamSessionTranscriptHistory(ctx context.Context, w http.Resp
 		return emitted
 	}
 
-	_ = emitSnapshot(initial)
 	if logPath != "" {
 		poll.Stop()
 		keepalive.Stop()
 		lw = newLogFileWatcher(logPath)
 		defer lw.Close()
+		_ = emitSnapshot(initial)
 		lw.Run(ctx, reloadSnapshot, func() { writeSSEComment(w) }, RunOpts{Wake: workerOps})
 		return
 	}
 
+	_ = emitSnapshot(initial)
 	for {
 		select {
 		case <-ctx.Done():
@@ -491,7 +506,7 @@ func (s *Server) streamSessionTranscriptHistory(ctx context.Context, w http.Resp
 }
 
 // streamSessionPeekRaw polls tmux pane content and wraps it as format=raw
-// messages so MC's JSONL rendering pipeline can display terminal output
+// messages so a real-world app's JSONL rendering pipeline can display terminal output
 // (e.g. OAuth prompts, startup screens) when no transcript log exists yet.
 func (s *Server) streamSessionPeekRaw(ctx context.Context, w http.ResponseWriter, info session.Info, handle interface {
 	worker.PeekHandle
@@ -532,11 +547,9 @@ func (s *Server) streamSessionPeekRaw(ctx context.Context, w http.ResponseWriter
 			lastOutput = output
 			seq++
 			if output != "" {
-				fakeMsg, _ := json.Marshal(map[string]interface{}{
-					"role": "assistant",
-					"content": []map[string]string{
-						{"type": "text", "text": output},
-					},
+				fakeMsg, _ := json.Marshal(syntheticAssistantFrame{
+					Role:    "assistant",
+					Content: []syntheticContentBlock{{Type: "text", Text: output}},
 				})
 				data, err := json.Marshal(SessionStreamRawMessageEvent{
 					ID:       info.ID,
@@ -759,12 +772,12 @@ func (s *Server) streamSessionTranscriptLogRawHuma(ctx context.Context, send sse
 		return emitted
 	}
 
-	_ = emitSnapshot(initial)
 	if logPath != "" {
 		poll.Stop()
 		keepalive.Stop()
 		lw = newLogFileWatcher(logPath)
 		defer lw.Close()
+		_ = emitSnapshot(initial)
 		lw.Run(ctx, reloadSnapshot, func() {
 			_ = send.Data(HeartbeatEvent{Timestamp: time.Now().UTC().Format(time.RFC3339)})
 		}, RunOpts{
@@ -775,6 +788,7 @@ func (s *Server) streamSessionTranscriptLogRawHuma(ctx context.Context, send sse
 		return
 	}
 
+	_ = emitSnapshot(initial)
 	for {
 		select {
 		case <-ctx.Done():
@@ -885,18 +899,19 @@ func (s *Server) streamSessionTranscriptLogHuma(ctx context.Context, send sse.Se
 		return emitted
 	}
 
-	_ = emitSnapshot(initial)
 	if logPath != "" {
 		poll.Stop()
 		keepalive.Stop()
 		lw = newLogFileWatcher(logPath)
 		defer lw.Close()
+		_ = emitSnapshot(initial)
 		lw.Run(ctx, reloadSnapshot, func() {
 			_ = send.Data(HeartbeatEvent{Timestamp: time.Now().UTC().Format(time.RFC3339)})
 		}, RunOpts{Wake: workerOps})
 		return
 	}
 
+	_ = emitSnapshot(initial)
 	for {
 		select {
 		case <-ctx.Done():
@@ -957,11 +972,9 @@ func (s *Server) streamSessionPeekRawHuma(ctx context.Context, send sse.Sender,
 		lastOutput = output
 
 		if output != "" {
-			fakeMsg, err := json.Marshal(map[string]any{
-				"role": "assistant",
-				"content": []map[string]string{
-					{"type": "text", "text": output},
-				},
+			fakeMsg, err := json.Marshal(syntheticAssistantFrame{
+				Role:    "assistant",
+				Content: []syntheticContentBlock{{Type: "text", Text: output}},
 			})
 			if err == nil {
 				seq++
diff --git a/internal/api/handler_session_submit_test.go b/internal/api/handler_session_submit_test.go
index 03568084f0..6eb0d755db 100644
--- a/internal/api/handler_session_submit_test.go
+++ b/internal/api/handler_session_submit_test.go
@@ -31,28 +31,24 @@ func TestHandleSessionSubmitDefaultsToProviderDefaultBehavior(t *testing.T) {
 	if rec.Code != http.StatusAccepted {
 		t.Fatalf("submit status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-	var resp map[string]any
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	if got := resp["queued"]; got != false {
-		t.Fatalf("queued = %#v, want false", got)
+	if accepted.RequestID == "" {
+		t.Fatal("missing request_id")
 	}
-	if got := resp["intent"]; got != string(session.SubmitIntentDefault) {
-		t.Fatalf("intent = %#v, want %q", got, session.SubmitIntentDefault)
+
+	success, failure := waitForSessionSubmitResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session submit failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
-	if !fs.sp.IsRunning(info.SessionName) {
-		t.Fatal("session should be running after POST /submit")
+	// Default intent on a suspended session resumes immediately (not queued).
+	if success.Queued {
+		t.Fatalf("queued = true, want false (default intent resumes)")
 	}
-	found := false
-	for _, call := range fs.sp.Calls {
-		if call.Method == "Nudge" && call.Name == info.SessionName && call.Message == "hello" {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("calls = %#v, want Nudge(hello)", fs.sp.Calls)
+	if success.Intent != string(session.SubmitIntentDefault) {
+		t.Fatalf("intent = %q, want %q", success.Intent, session.SubmitIntentDefault)
 	}
 }
 
@@ -76,15 +72,17 @@ func TestHandleSessionSubmitUsesImmediateDefaultForCodex(t *testing.T) {
 	if rec.Code != http.StatusAccepted {
 		t.Fatalf("submit status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-	found := false
-	for _, call := range fs.sp.Calls {
-		if call.Method == "NudgeNow" && call.Name == info.SessionName && call.Message == "hello" {
-			found = true
-			break
-		}
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if accepted.RequestID == "" {
+		t.Fatal("missing request_id")
 	}
-	if !found {
-		t.Fatalf("calls = %#v, want NudgeNow(hello)", fs.sp.Calls)
+
+	success, failure := waitForSessionSubmitResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session submit failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 }
 
@@ -101,13 +99,19 @@ func TestHandleSessionSubmitFollowUpQueuesMessage(t *testing.T) {
 	if rec.Code != http.StatusAccepted {
 		t.Fatalf("submit status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-	var resp map[string]any
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	if got := resp["queued"]; got != true {
-		t.Fatalf("queued = %#v, want true", got)
+	if accepted.RequestID == "" {
+		t.Fatal("missing request_id")
 	}
+
+	success, failure := waitForSessionSubmitResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session submit failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+
 	state, err := nudgequeue.LoadState(fs.cityPath)
 	if err != nil {
 		t.Fatalf("LoadState: %v", err)
diff --git a/internal/api/handler_session_transcript.go b/internal/api/handler_session_transcript.go
index e7ba1c051b..25af4d09e6 100644
--- a/internal/api/handler_session_transcript.go
+++ b/internal/api/handler_session_transcript.go
@@ -70,11 +70,18 @@ func (s *Server) handleSessionTranscript(w http.ResponseWriter, r *http.Request)
 			}
 		}
 		before := r.URL.Query().Get("before")
+		after := r.URL.Query().Get("after")
+
+		if before != "" && after != "" {
+			writeError(w, http.StatusUnprocessableEntity, "invalid_params", "before and after are mutually exclusive")
+			return
+		}
 
 		if wantRaw {
 			transcript, err := handle.Transcript(r.Context(), worker.TranscriptRequest{
 				TailCompactions: tail,
 				BeforeEntryID:   before,
+				AfterEntryID:    after,
 				Raw:             true,
 			})
 			if err != nil {
@@ -94,6 +101,7 @@ func (s *Server) handleSessionTranscript(w http.ResponseWriter, r *http.Request)
 		transcript, err := handle.Transcript(r.Context(), worker.TranscriptRequest{
 			TailCompactions: tail,
 			BeforeEntryID:   before,
+			AfterEntryID:    after,
 		})
 		if err != nil {
 			writeError(w, http.StatusInternalServerError, "internal", "reading session log: "+err.Error())
diff --git a/internal/api/handler_sessions.go b/internal/api/handler_sessions.go
index 75871a4892..55ffa75423 100644
--- a/internal/api/handler_sessions.go
+++ b/internal/api/handler_sessions.go
@@ -62,7 +62,7 @@ type sessionResponse struct {
 	// template_overrides bead metadata (e.g., {"permission_mode":"unrestricted"}).
 	Options map[string]string `json:"options,omitempty"`
 
-	// Metadata exposes mc_-prefixed bead metadata for external consumers.
+	// Metadata exposes real_world_app_-prefixed bead metadata for external consumers.
 	Metadata map[string]string `json:"metadata,omitempty"`
 }
 
@@ -71,6 +71,13 @@ type sessionResponseHandle interface {
 	worker.PeekHandle
 }
 
+func (s *Server) runtimeSessionResponseHandle(info session.Info) sessionResponseHandle {
+	if info.State != session.StateActive {
+		return nil
+	}
+	return newProviderSessionResponseHandle(s.state.SessionProvider(), info.SessionName, info.Provider)
+}
+
 func sessionToResponse(info session.Info, cfg *config.City) sessionResponse {
 	provider, displayName := info.Provider, ""
 	if cfg != nil {
@@ -135,24 +142,24 @@ func sessionResponseWithReason(info session.Info, b *beads.Bead, cfg *config.Cit
 		return r
 	}
 	// Populate kind from persisted metadata.
-	if k := b.Metadata["mc_session_kind"]; k != "" {
+	if k := b.Metadata["real_world_app_session_kind"]; k != "" {
 		r.Kind = k
 	}
 	r.Reason = session.LifecycleDisplayReason(b.Status, b.Metadata, time.Now().UTC())
 	r.ConfiguredNamedSession = strings.TrimSpace(b.Metadata[apiNamedSessionMetadataKey]) == "true"
 	r.SubmissionCapabilities = session.SubmissionCapabilitiesForMetadata(b.Metadata, hasDeferredQueue)
-	// Expose only mc_* prefixed metadata keys to API consumers.
+	// Expose only real_world_app_* prefixed metadata keys to API consumers.
 	// Internal fields (session_key, command, work_dir, etc.) are redacted.
 	r.Metadata = filterMetadata(b.Metadata)
 	return r
 }
 
-// filterMetadataAllowedKeys lists non-mc_ metadata keys that are safe to expose.
+// filterMetadataAllowedKeys lists non-real_world_app_ metadata keys that are safe to expose.
 var filterMetadataAllowedKeys = map[string]bool{
 	"template_overrides": true,
 }
 
-// filterMetadata returns only metadata keys with the "mc_" prefix plus
+// filterMetadata returns only metadata keys with the "real_world_app_" prefix plus
 // explicitly allowlisted keys. This prevents leaking internal bead fields
 // (session_key, command, work_dir, quarantine state) to API consumers.
 func filterMetadata(m map[string]string) map[string]string {
@@ -161,7 +168,7 @@ func filterMetadata(m map[string]string) map[string]string {
 	}
 	filtered := make(map[string]string)
 	for k, v := range m {
-		if strings.HasPrefix(k, "mc_") || filterMetadataAllowedKeys[k] {
+		if strings.HasPrefix(k, "real_world_app_") || filterMetadataAllowedKeys[k] {
 			filtered[k] = v
 		}
 	}
@@ -201,28 +208,25 @@ func (s *Server) handleSessionList(w http.ResponseWriter, r *http.Request) {
 	templateFilter := q.Get("template")
 	wantPeek := q.Get("peek") == "true"
 
-	sessions, err := catalog.List(stateFilter, templateFilter)
+	all, partialErrors, err := sessionReadModelRows(store)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal", err.Error())
 		return
 	}
+	listResult := catalog.ListFullFromBeads(all, stateFilter, templateFilter)
+	sessions := listResult.Sessions
 
 	// Build bead index for reason enrichment.
 	beadIndex := make(map[string]*beads.Bead)
-	if all, err := store.List(beads.ListQuery{Label: session.LabelSession}); err == nil {
-		for i := range all {
-			beadIndex[all[i].ID] = &all[i]
-		}
+	for i := range listResult.Beads {
+		beadIndex[listResult.Beads[i].ID] = &listResult.Beads[i]
 	}
 
 	items := make([]sessionResponse, len(sessions))
 	hasDeferredQueue := strings.TrimSpace(s.state.CityPath()) != ""
 	for i, sess := range sessions {
 		items[i] = sessionResponseWithReason(sess, beadIndex[sess.ID], cfg, hasDeferredQueue)
-		handle, err := s.workerHandleForSession(store, sess.ID)
-		if err == nil {
-			s.enrichSessionResponse(&items[i], sess, cfg, handle, wantPeek, false)
-		}
+		s.enrichSessionResponse(&items[i], sess, cfg, s.runtimeSessionResponseHandle(sess), wantPeek, false, false)
 	}
 
 	pp := parsePagination(r, maxPaginationLimit)
@@ -230,14 +234,25 @@ func (s *Server) handleSessionList(w http.ResponseWriter, r *http.Request) {
 		if pp.Limit < len(items) {
 			items = items[:pp.Limit]
 		}
-		writeJSON(w, http.StatusOK, listResponse{Items: items, Total: len(items)})
+		writeJSON(w, http.StatusOK, listResponse{
+			Items:         items,
+			Total:         len(items),
+			Partial:       len(partialErrors) > 0,
+			PartialErrors: partialErrors,
+		})
 		return
 	}
 	page, total, nextCursor := paginate(items, pp)
 	if page == nil {
 		page = []sessionResponse{}
 	}
-	writeJSON(w, http.StatusOK, listResponse{Items: page, Total: total, NextCursor: nextCursor})
+	writeJSON(w, http.StatusOK, listResponse{
+		Items:         page,
+		Total:         total,
+		NextCursor:    nextCursor,
+		Partial:       len(partialErrors) > 0,
+		PartialErrors: partialErrors,
+	})
 }
 
 func (s *Server) handleSessionGet(w http.ResponseWriter, r *http.Request) {
@@ -268,7 +283,7 @@ func (s *Server) handleSessionGet(w http.ResponseWriter, r *http.Request) {
 	resp := sessionResponseWithReason(info, &b, cfg, strings.TrimSpace(s.state.CityPath()) != "")
 	handle, err := s.workerHandleForSession(store, id)
 	if err == nil {
-		s.enrichSessionResponse(&resp, info, cfg, handle, wantPeek, true)
+		s.enrichSessionResponse(&resp, info, cfg, handle, wantPeek, true, true)
 	}
 	writeJSON(w, http.StatusOK, resp)
 }
@@ -328,7 +343,7 @@ func (s *Server) handleSessionClose(w http.ResponseWriter, r *http.Request) {
 
 	// Optional: permanently delete the bead after closing.
 	if r.URL.Query().Get("delete") == "true" {
-		if err := store.Delete(id); err != nil {
+		if err := deleteSessionBeadAfterClose(store, id); err != nil {
 			log.Printf("gc api: deleting bead after close %s: %v", id, err)
 			writeError(w, http.StatusInternalServerError, "internal", "closed but delete failed: "+err.Error())
 			return
@@ -338,6 +353,36 @@ func (s *Server) handleSessionClose(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+func deleteSessionBeadAfterClose(store beads.Store, id string) error {
+	const maxAttempts = 5
+	var err error
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		err = store.Delete(id)
+		if err == nil {
+			return nil
+		}
+		if errors.Is(err, beads.ErrNotFound) {
+			log.Printf("gc api: deleting bead after close %s: already gone", id)
+			return nil
+		}
+		if !isTransientBeadDeleteConflict(err) {
+			return err
+		}
+		time.Sleep(time.Duration(attempt+1) * 25 * time.Millisecond)
+	}
+	return err
+}
+
+func isTransientBeadDeleteConflict(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "Error 1213") ||
+		strings.Contains(msg, "40001") ||
+		strings.Contains(msg, "serialization failure")
+}
+
 // handleSessionWake clears hold and quarantine on a session.
 func (s *Server) handleSessionWake(w http.ResponseWriter, r *http.Request) {
 	store := s.state.CityBeadStore()
@@ -449,7 +494,7 @@ func (s *Server) handleSessionRename(w http.ResponseWriter, r *http.Request) {
 
 // enrichSessionResponse populates runtime fields on a session response:
 // running state, active bead, peek output, and model/context metadata.
-func (s *Server) enrichSessionResponse(resp *sessionResponse, info session.Info, _ *config.City, runtimeHandle any, wantPeek, liveActiveBead bool) {
+func (s *Server) enrichSessionResponse(resp *sessionResponse, info session.Info, cfg *config.City, runtimeHandle any, wantPeek, liveActiveBead, allowWorkdirTranscriptDiscovery bool) {
 	if info.State != session.StateActive {
 		return
 	}
@@ -523,7 +568,14 @@ func (s *Server) enrichSessionResponse(resp *sessionResponse, info session.Info,
 		}
 		// Prefer session-key lookup to avoid cross-reading another session's transcript.
 		// Cache the resolved file path — session files don't move once created.
-		sessionFile := factory.DiscoverTranscript(info.Provider, workDir, info.SessionKey)
+		provider := info.Provider
+		if strings.TrimSpace(provider) == "" && cfg != nil {
+			provider, _ = resolveProviderInfo(provider, cfg)
+		}
+		if !allowWorkdirTranscriptDiscovery && !canUseCheapTranscriptLookup(provider, info.SessionKey) {
+			return
+		}
+		sessionFile := factory.DiscoverTranscript(provider, workDir, info.SessionKey)
 		if sessionFile != "" {
 			if meta, err := factory.TailMeta(sessionFile); err == nil && meta != nil {
 				resp.Model = meta.Model
@@ -537,6 +589,17 @@ func (s *Server) enrichSessionResponse(resp *sessionResponse, info session.Info,
 	}
 }
 
+func canUseCheapTranscriptLookup(provider, sessionKey string) bool {
+	if strings.TrimSpace(sessionKey) == "" {
+		return false
+	}
+	p := strings.ToLower(strings.TrimSpace(provider))
+	if strings.Contains(p, "codex") || strings.Contains(p, "gemini") {
+		return false
+	}
+	return true
+}
+
 // handleSessionPatch handles PATCH /v0/session/{id}. Title and alias are mutable.
 func (s *Server) handleSessionPatch(w http.ResponseWriter, r *http.Request) {
 	store := s.state.CityBeadStore()
diff --git a/internal/api/handler_sessions_test.go b/internal/api/handler_sessions_test.go
index 1eb6ba7503..0c6693de31 100644
--- a/internal/api/handler_sessions_test.go
+++ b/internal/api/handler_sessions_test.go
@@ -1,10 +1,13 @@
 package api
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"log"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -32,6 +35,156 @@ func newSessionFakeState(t *testing.T) *fakeState {
 	return fs
 }
 
+const testEventTimeout = 5 * time.Second
+
+func decodeAsyncAccepted(t *testing.T, body io.Reader) asyncAcceptedBody {
+	t.Helper()
+
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(body).Decode(&accepted); err != nil {
+		t.Fatalf("decode async accepted body: %v", err)
+	}
+	if accepted.RequestID == "" {
+		t.Fatal("async accepted body missing request_id")
+	}
+	return accepted
+}
+
+// waitForSessionCreateResult waits for either a session create success or a request.failed event
+// matching session.create and requestID. Returns the success payload and true, or the failure payload and false.
+func waitForSessionCreateResult(t *testing.T, prov events.Provider, requestID string) (*SessionCreateSucceededPayload, *RequestFailedPayload) {
+	t.Helper()
+	deadline := time.Now().Add(testEventTimeout)
+	for time.Now().Before(deadline) {
+		successEvents, _ := prov.List(events.Filter{Type: events.RequestResultSessionCreate})
+		for _, e := range successEvents {
+			var p SessionCreateSucceededPayload
+			if err := json.Unmarshal(e.Payload, &p); err == nil && requestIDMatches(p.RequestID, requestID) {
+				return &p, nil
+			}
+		}
+		failedEvents, _ := prov.List(events.Filter{Type: events.RequestFailed})
+		for _, e := range failedEvents {
+			var p RequestFailedPayload
+			if json.Unmarshal(e.Payload, &p) == nil && p.Operation == RequestOperationSessionCreate && requestIDMatches(p.RequestID, requestID) {
+				return nil, &p
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for session create result")
+	return nil, nil
+}
+
+func TestWaitForSessionCreateResultMatchesRequestID(t *testing.T) {
+	prov := events.NewFake()
+	first, err := json.Marshal(SessionCreateSucceededPayload{RequestID: "req-old"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := json.Marshal(SessionCreateSucceededPayload{RequestID: "req-want"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	prov.Record(events.Event{Type: events.RequestResultSessionCreate, Payload: first})
+	prov.Record(events.Event{Type: events.RequestResultSessionCreate, Payload: second})
+
+	success, failure := waitForSessionCreateResult(t, prov, "req-want")
+	if failure != nil {
+		t.Fatalf("unexpected failure: %+v", failure)
+	}
+	if success == nil || success.RequestID != "req-want" {
+		t.Fatalf("success = %+v, want request_id req-want", success)
+	}
+}
+
+// waitForSessionMessageResult waits for session message success or failure.
+func waitForSessionMessageResult(t *testing.T, prov events.Provider, requestID string) (*SessionMessageSucceededPayload, *RequestFailedPayload) {
+	t.Helper()
+	deadline := time.Now().Add(testEventTimeout)
+	for time.Now().Before(deadline) {
+		successEvents, _ := prov.List(events.Filter{Type: events.RequestResultSessionMessage})
+		for _, e := range successEvents {
+			var p SessionMessageSucceededPayload
+			if err := json.Unmarshal(e.Payload, &p); err == nil && requestIDMatches(p.RequestID, requestID) {
+				return &p, nil
+			}
+		}
+		failedEvents, _ := prov.List(events.Filter{Type: events.RequestFailed})
+		for _, e := range failedEvents {
+			var p RequestFailedPayload
+			if json.Unmarshal(e.Payload, &p) == nil && p.Operation == RequestOperationSessionMessage && requestIDMatches(p.RequestID, requestID) {
+				return nil, &p
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for session message result")
+	return nil, nil
+}
+
+// waitForSessionSubmitResult waits for session submit success or failure.
+func waitForSessionSubmitResult(t *testing.T, prov events.Provider, requestID string) (*SessionSubmitSucceededPayload, *RequestFailedPayload) {
+	t.Helper()
+	deadline := time.Now().Add(testEventTimeout)
+	for time.Now().Before(deadline) {
+		successEvents, _ := prov.List(events.Filter{Type: events.RequestResultSessionSubmit})
+		for _, e := range successEvents {
+			var p SessionSubmitSucceededPayload
+			if err := json.Unmarshal(e.Payload, &p); err == nil && requestIDMatches(p.RequestID, requestID) {
+				return &p, nil
+			}
+		}
+		failedEvents, _ := prov.List(events.Filter{Type: events.RequestFailed})
+		for _, e := range failedEvents {
+			var p RequestFailedPayload
+			if json.Unmarshal(e.Payload, &p) == nil && p.Operation == RequestOperationSessionSubmit && requestIDMatches(p.RequestID, requestID) {
+				return nil, &p
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for session submit result")
+	return nil, nil
+}
+
+func requestIDMatches(got, want string) bool {
+	return got == want
+}
+
+// waitForRequestFailed polls for a request.failed event with the given request_id.
+func waitForRequestFailed(t *testing.T, prov events.Provider, requestID string, timeout time.Duration) *RequestFailedPayload {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		failedEvents, _ := prov.List(events.Filter{Type: events.RequestFailed})
+		for _, e := range failedEvents {
+			var p RequestFailedPayload
+			if json.Unmarshal(e.Payload, &p) == nil && p.RequestID == requestID {
+				return &p
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for request.failed with request_id=%q", requestID)
+	return nil
+}
+
+// waitForNSessionCreateEvents waits until at least n session create success events have been published.
+func waitForNSessionCreateEvents(t *testing.T, prov events.Provider, n int, timeout time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		evts, _ := prov.List(events.Filter{Type: events.RequestResultSessionCreate})
+		if len(evts) >= n {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	evts, _ := prov.List(events.Filter{Type: events.RequestResultSessionCreate})
+	t.Fatalf("timed out waiting for %d session create events (got %d)", n, len(evts))
+}
+
 func createTestSession(t *testing.T, store beads.Store, sp *runtime.Fake, title string) session.Info {
 	t.Helper()
 	mgr := session.NewManager(store, sp)
@@ -42,6 +195,142 @@ func createTestSession(t *testing.T, store beads.Store, sp *runtime.Fake, title
 	return info
 }
 
+type cachedOnlyListStoreForSessionTest struct {
+	*beads.MemStore
+	blockList bool
+	listCalls int
+}
+
+func (s *cachedOnlyListStoreForSessionTest) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if s.blockList {
+		s.listCalls++
+		return nil, errors.New("backing List should not be used")
+	}
+	return s.MemStore.List(query)
+}
+
+func (s *cachedOnlyListStoreForSessionTest) CachedList(query beads.ListQuery) ([]beads.Bead, bool) {
+	rows, err := s.MemStore.List(query)
+	if err != nil {
+		return nil, false
+	}
+	return rows, true
+}
+
+type apiListQueryCaptureStore struct {
+	beads.Store
+	listCalls []beads.ListQuery
+}
+
+func (s *apiListQueryCaptureStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.listCalls = append(s.listCalls, query)
+	return s.Store.List(query)
+}
+
+type partialPrimeSessionStore struct {
+	*beads.MemStore
+	partialRows    []beads.Bead
+	labelListCalls int
+}
+
+func (s *partialPrimeSessionStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	rows, err := s.MemStore.List(query)
+	if err != nil {
+		return nil, err
+	}
+	if query.AllowScan || query.Label == session.LabelSession {
+		if query.Label == session.LabelSession {
+			s.labelListCalls++
+		}
+		if s.partialRows != nil {
+			rows = append([]beads.Bead(nil), s.partialRows...)
+		}
+		return rows, &beads.PartialResultError{
+			Op:  "bd list",
+			Err: errors.New("skipped 1 corrupt bead"),
+		}
+	}
+	return rows, nil
+}
+
+func TestListSessionBeadsForReadModelFallsBackAfterPartialCachePrime(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialPrimeSessionStore{MemStore: beads.NewMemStore()}
+	survivor, err := backing.Create(beads.Bead{
+		Title:  "session survivor",
+		Labels: []string{session.LabelSession},
+	})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	if _, err := backing.Create(beads.Bead{
+		Title:  "dropped session",
+		Labels: []string{session.LabelSession},
+	}); err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	backing.partialRows = []beads.Bead{survivor}
+
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	rows, err := listSessionBeadsForReadModel(cache)
+	var partial *beads.PartialResultError
+	if !errors.As(err, &partial) {
+		t.Fatalf("listSessionBeadsForReadModel error = %v, want *PartialResultError", err)
+	}
+	if backing.labelListCalls != 1 {
+		t.Fatalf("label List calls = %d, want 1 backing fallback after partial prime", backing.labelListCalls)
+	}
+	if len(rows) != 1 || rows[0].ID != survivor.ID {
+		t.Fatalf("rows = %+v, want partial survivor %s", rows, survivor.ID)
+	}
+}
+
+func TestHandleSessionListPreservesPartialRows(t *testing.T) {
+	fs := newSessionFakeState(t)
+	store := &partialPrimeSessionStore{MemStore: beads.NewMemStore()}
+	fs.cityBeadStore = store
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, store, fs.sp, "Session survivor")
+	survivor, err := store.Get(info.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", info.ID, err)
+	}
+	store.partialRows = []beads.Bead{survivor}
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("GET", cityURL(fs, "/sessions"), nil)
+	h.ServeHTTP(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", w.Code, w.Body.String())
+	}
+	var body struct {
+		Items         []sessionResponse `json:"items"`
+		Total         int               `json:"total"`
+		Partial       bool              `json:"partial"`
+		PartialErrors []string          `json:"partial_errors"`
+	}
+	if err := json.NewDecoder(w.Body).Decode(&body); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !body.Partial {
+		t.Fatal("partial = false, want true")
+	}
+	if len(body.PartialErrors) == 0 {
+		t.Fatal("partial_errors empty")
+	}
+	if body.Total != 1 || len(body.Items) != 1 || body.Items[0].ID != info.ID {
+		t.Fatalf("body = %+v, want surviving session %s", body, info.ID)
+	}
+}
+
 func writeGeminiHistoryFixtureForAPI(t *testing.T, path, sessionID string, messages ...string) {
 	t.Helper()
 
@@ -85,6 +374,51 @@ func (p *transportCapableProvider) SupportsTransport(transport string) bool {
 	return transport == "acp"
 }
 
+type blockingStartProvider struct {
+	*runtime.Fake
+	started chan struct{}
+	unblock chan struct{}
+	once    sync.Once
+}
+
+func (p *blockingStartProvider) Start(ctx context.Context, name string, cfg runtime.Config) error {
+	if p.started != nil {
+		p.once.Do(func() {
+			close(p.started)
+		})
+	}
+	if p.unblock != nil {
+		select {
+		case <-p.unblock:
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+	return p.Fake.Start(ctx, name, cfg)
+}
+
+type blockingNudgeProvider struct {
+	*runtime.Fake
+	started chan struct{}
+	unblock chan struct{}
+}
+
+func (p *blockingNudgeProvider) Nudge(name string, content []runtime.ContentBlock) error {
+	if p.started != nil {
+		close(p.started)
+	}
+	<-p.unblock
+	return p.Fake.Nudge(name, content)
+}
+
+type pendingSessionMissingProvider struct {
+	*runtime.Fake
+}
+
+func (p *pendingSessionMissingProvider) Pending(_ string) (*runtime.PendingInteraction, error) {
+	return nil, fmt.Errorf("capturing pane: %w", runtime.ErrSessionNotFound)
+}
+
 type stateWithSessionProvider struct {
 	*fakeState
 	provider runtime.Provider
@@ -404,7 +738,7 @@ func TestHandleSessionListActiveBeadUsesCachedLookup(t *testing.T) {
 	resp := sessionResponse{}
 	srv.enrichSessionResponse(&resp, info, fs.Config(), sessionResponseCapabilityHandle{
 		state: worker.State{Phase: worker.PhaseReady},
-	}, false, false)
+	}, false, false, false)
 
 	if !resp.Running {
 		t.Fatal("Running = false, want true")
@@ -414,6 +748,173 @@ func TestHandleSessionListActiveBeadUsesCachedLookup(t *testing.T) {
 	}
 }
 
+func TestHandleSessionListUsesCachedSessionBeadsWhenAvailable(t *testing.T) {
+	fs := newSessionFakeState(t)
+	store := &cachedOnlyListStoreForSessionTest{MemStore: beads.NewMemStore()}
+	fs.cityBeadStore = store
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "My Session")
+	store.blockList = true
+
+	req := httptest.NewRequest("GET", cityURL(fs, "/sessions"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []sessionResponse `json:"items"`
+		Total int               `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 1 || len(resp.Items) != 1 || resp.Items[0].ID != info.ID {
+		t.Fatalf("response = %#v, want one session %s", resp, info.ID)
+	}
+	if store.listCalls != 0 {
+		t.Fatalf("backing List calls = %d, want 0", store.listCalls)
+	}
+}
+
+func TestHandleSessionListSkipsWorkdirOnlyCodexTranscriptDiscovery(t *testing.T) {
+	fs := newSessionFakeState(t)
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	if err := os.MkdirAll(filepath.Join(home, ".codex", "sessions"), 0o755); err != nil {
+		t.Fatalf("MkdirAll default codex sessions: %v", err)
+	}
+	searchBase := t.TempDir()
+	srv := New(fs)
+	srv.sessionLogSearchPaths = []string{searchBase}
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	workDir := t.TempDir()
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Codex Chat", "codex", workDir, "codex-max", nil, session.ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if info.SessionKey != "" {
+		t.Fatalf("SessionKey = %q, want empty for codex provider without SessionIDFlag", info.SessionKey)
+	}
+
+	codexDir := filepath.Join(searchBase, "2026", "04", "18")
+	if err := os.MkdirAll(codexDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll: %v", err)
+	}
+	codexPayload := strings.Join([]string{
+		fmt.Sprintf(`{"type":"session_meta","payload":{"cwd":%q}}`, workDir),
+		`{"type":"assistant","message":{"model":"gpt-5.5","usage":{"input_tokens":1000}}}`,
+	}, "\n") + "\n"
+	if err := os.WriteFile(filepath.Join(codexDir, "session.jsonl"), []byte(codexPayload), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	req := httptest.NewRequest("GET", cityURL(fs, "/sessions?template=myrig%2Fworker"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []sessionResponse `json:"items"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.Items) != 1 || resp.Items[0].ID != info.ID {
+		t.Fatalf("items = %#v, want session %s", resp.Items, info.ID)
+	}
+	if resp.Items[0].Model != "" || resp.Items[0].ContextPct != nil {
+		t.Fatalf("session list used workdir-only Codex transcript discovery: model=%q context=%v", resp.Items[0].Model, resp.Items[0].ContextPct)
+	}
+}
+
+func TestHandleSessionGetAllowsWorkdirOnlyCodexTranscriptDiscovery(t *testing.T) {
+	fs := newSessionFakeState(t)
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	if err := os.MkdirAll(filepath.Join(home, ".codex", "sessions"), 0o755); err != nil {
+		t.Fatalf("MkdirAll default codex sessions: %v", err)
+	}
+	searchBase := t.TempDir()
+	srv := New(fs)
+	srv.sessionLogSearchPaths = []string{searchBase}
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	workDir := t.TempDir()
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Codex Chat", "codex", workDir, "codex-max", nil, session.ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	codexDir := filepath.Join(searchBase, "2026", "04", "18")
+	if err := os.MkdirAll(codexDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll: %v", err)
+	}
+	codexPayload := strings.Join([]string{
+		fmt.Sprintf(`{"type":"session_meta","payload":{"cwd":%q}}`, workDir),
+		`{"type":"assistant","message":{"model":"gpt-5.5","usage":{"input_tokens":1000}}}`,
+	}, "\n") + "\n"
+	if err := os.WriteFile(filepath.Join(codexDir, "session.jsonl"), []byte(codexPayload), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	req := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID, nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp sessionResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.ID != info.ID {
+		t.Fatalf("ID = %q, want %q", resp.ID, info.ID)
+	}
+	if resp.Model != "gpt-5.5" {
+		t.Fatalf("model = %q, want gpt-5.5", resp.Model)
+	}
+}
+
+func TestHandleSessionListActiveBeadUsesCachedListWhenAvailable(t *testing.T) {
+	fs := newSessionFakeState(t)
+	store := &cachedOnlyListStoreForSessionTest{MemStore: beads.NewMemStore(), blockList: true}
+	fs.stores["myrig"] = store
+	srv := New(fs)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "My Session")
+	work, err := store.Create(beads.Bead{Title: "active work"})
+	if err != nil {
+		t.Fatalf("Create(work): %v", err)
+	}
+	status := "in_progress"
+	assignee := info.ID
+	if err := store.Update(work.ID, beads.UpdateOpts{Status: &status, Assignee: &assignee}); err != nil {
+		t.Fatalf("Update(work): %v", err)
+	}
+
+	resp := sessionResponse{}
+	srv.enrichSessionResponse(&resp, info, fs.Config(), sessionResponseCapabilityHandle{
+		state: worker.State{Phase: worker.PhaseReady},
+	}, false, false, false)
+
+	if got := resp.ActiveBead; got != work.ID {
+		t.Fatalf("active_bead = %q, want cached %q", got, work.ID)
+	}
+	if store.listCalls != 0 {
+		t.Fatalf("backing List calls = %d, want 0", store.listCalls)
+	}
+}
+
 func TestHandleSessionGetActiveBeadUsesLiveLookup(t *testing.T) {
 	fs := newSessionFakeState(t)
 	backing := beads.NewMemStore()
@@ -442,7 +943,7 @@ func TestHandleSessionGetActiveBeadUsesLiveLookup(t *testing.T) {
 	resp := sessionResponse{}
 	srv.enrichSessionResponse(&resp, info, fs.Config(), sessionResponseCapabilityHandle{
 		state: worker.State{Phase: worker.PhaseReady},
-	}, false, true)
+	}, false, true, true)
 
 	if !resp.Running {
 		t.Fatal("Running = false, want true")
@@ -604,6 +1105,135 @@ func TestHandleSessionClose(t *testing.T) {
 	}
 }
 
+func TestHandleSessionCloseDeleteIgnoresMissingBeadAfterClose(t *testing.T) {
+	fs := newSessionFakeState(t)
+	mem := beads.NewMemStore()
+	fs.cityBeadStore = deleteMissingStore{Store: mem}
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "To Close And Delete")
+
+	rec := httptest.NewRecorder()
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/close?delete=true", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+}
+
+func TestHandleSessionCloseDeleteRetriesTransientConflict(t *testing.T) {
+	fs := newSessionFakeState(t)
+	mem := beads.NewMemStore()
+	store := &transientDeleteConflictStore{Store: mem}
+	fs.cityBeadStore = store
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "Transient Delete")
+
+	rec := httptest.NewRecorder()
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/close?delete=true", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if store.deleteCalls != 2 {
+		t.Fatalf("delete calls = %d, want 2", store.deleteCalls)
+	}
+	if _, err := mem.Get(info.ID); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("Get(%s) error = %v, want ErrNotFound", info.ID, err)
+	}
+}
+
+func TestDeleteSessionBeadAfterCloseReturnsLastTransientError(t *testing.T) {
+	store := &alwaysTransientDeleteConflictStore{Store: beads.NewMemStore()}
+
+	err := deleteSessionBeadAfterClose(store, "gc-test")
+
+	if err == nil {
+		t.Fatal("deleteSessionBeadAfterClose error = nil, want transient failure")
+	}
+	if store.deleteCalls != 5 {
+		t.Fatalf("delete calls = %d, want 5", store.deleteCalls)
+	}
+	if !strings.Contains(err.Error(), "conflict attempt 5") {
+		t.Fatalf("error = %v, want final underlying conflict", err)
+	}
+}
+
+func TestDeleteSessionBeadAfterCloseDoesNotRetryNonTransientError(t *testing.T) {
+	store := &nonTransientDeleteErrorStore{err: errors.New("permission denied")}
+
+	err := deleteSessionBeadAfterClose(store, "gc-test")
+
+	if err == nil || !strings.Contains(err.Error(), "permission denied") {
+		t.Fatalf("deleteSessionBeadAfterClose error = %v, want permission denied", err)
+	}
+	if store.deleteCalls != 1 {
+		t.Fatalf("delete calls = %d, want 1", store.deleteCalls)
+	}
+}
+
+func TestDeleteSessionBeadAfterCloseLogsAlreadyGone(t *testing.T) {
+	var logs bytes.Buffer
+	oldOutput := log.Writer()
+	log.SetOutput(&logs)
+	defer log.SetOutput(oldOutput)
+
+	err := deleteSessionBeadAfterClose(deleteMissingStore{Store: beads.NewMemStore()}, "gc-test")
+	if err != nil {
+		t.Fatalf("deleteSessionBeadAfterClose: %v", err)
+	}
+	if !strings.Contains(logs.String(), "already gone") {
+		t.Fatalf("logs = %q, want already gone signal", logs.String())
+	}
+}
+
+type deleteMissingStore struct {
+	beads.Store
+}
+
+func (s deleteMissingStore) Delete(id string) error {
+	return fmt.Errorf("deleting bead %q: %w", id, beads.ErrNotFound)
+}
+
+type transientDeleteConflictStore struct {
+	beads.Store
+	deleteCalls int
+}
+
+func (s *transientDeleteConflictStore) Delete(id string) error {
+	s.deleteCalls++
+	if s.deleteCalls == 1 {
+		return fmt.Errorf("deleting bead %q: sql commit: Error 1213 (40001): serialization failure: this transaction conflicts with a committed transaction from another client, try restarting transaction", id)
+	}
+	return s.Store.Delete(id)
+}
+
+type alwaysTransientDeleteConflictStore struct {
+	beads.Store
+	deleteCalls int
+}
+
+func (s *alwaysTransientDeleteConflictStore) Delete(id string) error {
+	s.deleteCalls++
+	return fmt.Errorf("deleting bead %q: sql commit: Error 1213 (40001): serialization failure: conflict attempt %d", id, s.deleteCalls)
+}
+
+type nonTransientDeleteErrorStore struct {
+	beads.Store
+	deleteCalls int
+	err         error
+}
+
+func (s *nonTransientDeleteErrorStore) Delete(string) error {
+	s.deleteCalls++
+	return s.err
+}
+
 func TestHandleSessionWake_DoesNotRewriteHistoricalWaitNudge(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
@@ -763,6 +1393,36 @@ func TestHandleSessionWake(t *testing.T) {
 	}
 }
 
+func TestHandleSessionWakeStartsSuspendedRuntime(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "Suspended Session")
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+	if fs.sp.IsRunning(info.SessionName) {
+		t.Fatalf("session %q running after suspend", info.SessionName)
+	}
+
+	w := httptest.NewRecorder()
+	r := newPostRequest(cityURL(fs, "/session/")+info.ID+"/wake", nil)
+	h.ServeHTTP(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+	}
+	deadline := time.Now().Add(testEventTimeout)
+	for !fs.sp.IsRunning(info.SessionName) && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if !fs.sp.IsRunning(info.SessionName) {
+		t.Fatalf("session %q should be running after async POST /wake start", info.SessionName)
+	}
+}
+
 func TestHandleSessionWakeClosed(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
@@ -1124,10 +1784,19 @@ func TestHandleSessionCreate(t *testing.T) {
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(w.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
+	if accepted.RequestID == "" {
+		t.Fatal("response must include request_id")
+	}
+
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	resp := success.Session
 	if resp.Template != "myrig/worker" {
 		t.Errorf("Template = %q, want %q", resp.Template, "myrig/worker")
 	}
@@ -1182,13 +1851,20 @@ func TestHandleSessionCreateUsesACPTransportCommandForAgentTemplate(t *testing.T
 		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	bead, err := state.cityBeadStore.Get(resp.ID)
+	if accepted.RequestID == "" {
+		t.Fatal("response must include request_id")
+	}
+	success, failure := waitForSessionCreateResult(t, state.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	bead, err := state.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", resp.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
 	if got, want := bead.Metadata["command"], "/bin/echo acp"; got != want {
 		t.Fatalf("command metadata = %q, want %q", got, want)
@@ -1229,9 +1905,16 @@ func TestHumaHandleSessionCreateUsesACPTransportCommandForAgentTemplate(t *testi
 	if got, want := out.Status, http.StatusAccepted; got != want {
 		t.Fatalf("status = %d, want %d", got, want)
 	}
-	bead, err := state.cityBeadStore.Get(out.Body.ID)
+	if out.Body.RequestID == "" {
+		t.Fatal("request_id is empty")
+	}
+	success, failure := waitForSessionCreateResult(t, state.eventProv, out.Body.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	bead, err := state.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", out.Body.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
 	if got, want := bead.Metadata["command"], "/bin/echo acp"; got != want {
 		t.Fatalf("command metadata = %q, want %q", got, want)
@@ -1269,6 +1952,42 @@ func TestHandleSessionCreateRejectsACPAgentWithoutACPRouting(t *testing.T) {
 	}
 }
 
+func TestHandleSessionCreateRejectsExplicitTmuxAgentWhenCitySessionProviderIsACP(t *testing.T) {
+	fs := newSessionFakeState(t)
+	fs.cfg.Session.Provider = "acp"
+	fs.cfg.Agents[0].Provider = "opencode"
+	fs.cfg.Agents[0].Session = "tmux"
+	fs.cfg.Providers["opencode"] = config.ProviderSpec{
+		DisplayName: "OpenCode",
+		Command:     "/bin/echo",
+		PathCheck:   "true",
+	}
+	state := &stateWithSessionProvider{
+		fakeState: fs,
+		provider:  &transportCapableProvider{Fake: runtime.NewFake()},
+	}
+	srv := New(state)
+	h := newTestCityHandlerWith(t, state, srv)
+
+	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(`{"kind":"agent","name":"myrig/worker"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusServiceUnavailable, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "requires tmux transport") {
+		t.Fatalf("body = %q, want tmux transport error", rec.Body.String())
+	}
+	items, err := fs.cityBeadStore.ListByLabel(session.LabelSession, 0)
+	if err != nil {
+		t.Fatalf("ListByLabel: %v", err)
+	}
+	if len(items) != 0 {
+		t.Fatalf("session bead count = %d, want 0", len(items))
+	}
+}
+
 func TestHumaHandleSessionCreateRejectsACPAgentWithoutACPRouting(t *testing.T) {
 	supportsACP := true
 	fs := newSessionFakeState(t)
@@ -1351,52 +2070,168 @@ command = [broken
 		fakeState: fs,
 		provider:  &transportCapableProvider{Fake: runtime.NewFake()},
 	}
-	srv := New(state)
+	srv := New(state)
+
+	if _, err := srv.humaHandleSessionCreate(context.Background(), &SessionCreateInput{
+		Body: sessionCreateBody{
+			Kind: "agent",
+			Name: "myrig/worker",
+		},
+	}); err == nil {
+		t.Fatal("humaHandleSessionCreate() error = nil, want MCP resolution error")
+	} else if !strings.Contains(err.Error(), "loading effective MCP") {
+		t.Fatalf("humaHandleSessionCreate() error = %v, want MCP resolution error", err)
+	}
+}
+
+func TestHandleSessionCreateIgnoresBrokenMCPWithoutACPTransport(t *testing.T) {
+	fs := newSessionFakeState(t)
+	fs.cfg.PackMCPDir = filepath.Join(fs.cityPath, "mcp")
+	if err := os.MkdirAll(fs.cfg.PackMCPDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll(mcp): %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(fs.cfg.PackMCPDir, "filesystem.toml"), []byte(`
+name = "filesystem"
+command = [broken
+`), 0o644); err != nil {
+		t.Fatalf("WriteFile(mcp): %v", err)
+	}
+
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(`{"kind":"agent","name":"myrig/worker"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+}
+
+func TestHandleSessionCreateProviderReturns202WithRequestID(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	body := `{"kind":"provider","name":"test-agent","project_id":"alpha","title":"contract test","alias":"contract-test"}`
+	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("provider session create status = %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
+	}
+	var resp struct {
+		RequestID string `json:"request_id"`
+	}
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.RequestID == "" {
+		t.Fatal("response must include request_id for async correlation")
+	}
+
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, resp.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	if success.Session.ID == "" {
+		t.Fatal("session create event must include session.id")
+	}
+}
+
+func TestHandleSessionCreateAsync(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+	_ = h
+
+	body := `{"kind":"agent","name":"myrig/worker","alias":"sky","async":true}`
+	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
+	}
 
-	if _, err := srv.humaHandleSessionCreate(context.Background(), &SessionCreateInput{
-		Body: sessionCreateBody{
-			Kind: "agent",
-			Name: "myrig/worker",
-		},
-	}); err == nil {
-		t.Fatal("humaHandleSessionCreate() error = nil, want MCP resolution error")
-	} else if !strings.Contains(err.Error(), "loading effective MCP") {
-		t.Fatalf("humaHandleSessionCreate() error = %v, want MCP resolution error", err)
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(w.Body).Decode(&accepted); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if accepted.RequestID == "" {
+		t.Fatal("response must include request_id")
 	}
-}
 
-func TestHandleSessionCreateIgnoresBrokenMCPWithoutACPTransport(t *testing.T) {
-	fs := newSessionFakeState(t)
-	fs.cfg.PackMCPDir = filepath.Join(fs.cityPath, "mcp")
-	if err := os.MkdirAll(fs.cfg.PackMCPDir, 0o755); err != nil {
-		t.Fatalf("MkdirAll(mcp): %v", err)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
-	if err := os.WriteFile(filepath.Join(fs.cfg.PackMCPDir, "filesystem.toml"), []byte(`
-name = "filesystem"
-command = [broken
-`), 0o644); err != nil {
-		t.Fatalf("WriteFile(mcp): %v", err)
+	if success.Session.Alias != "sky" {
+		t.Fatalf("Alias = %q, want %q", success.Session.Alias, "sky")
+	}
+	if fs.pokeCount != 1 {
+		t.Fatalf("pokeCount = %d, want 1", fs.pokeCount)
 	}
+}
 
+func TestHandleSessionCreateAsyncResultIsCommandable(t *testing.T) {
+	fs := newSessionFakeState(t)
 	srv := New(fs)
 	h := newTestCityHandlerWith(t, fs, srv)
 
-	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(`{"kind":"agent","name":"myrig/worker"}`))
+	body := `{"kind":"agent","name":"myrig/worker","alias":"commandable","async":true}`
+	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusAccepted {
-		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
+		t.Fatalf("create status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	if success.Session.State == string(session.StateCreating) {
+		t.Fatalf("session create result state = %q, want commandable state", success.Session.State)
+	}
+
+	suspendReq := newPostRequest(cityURL(fs, "/session/")+success.Session.ID+"/suspend", nil)
+	suspendRec := httptest.NewRecorder()
+	h.ServeHTTP(suspendRec, suspendReq)
+
+	if suspendRec.Code != http.StatusOK {
+		t.Fatalf("suspend status = %d, want %d; body: %s", suspendRec.Code, http.StatusOK, suspendRec.Body.String())
+	}
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
+	}
+	if got := bead.Metadata["state"]; got != string(session.StateSuspended) {
+		t.Fatalf("state after suspend = %q, want %q", got, session.StateSuspended)
 	}
 }
 
-func TestHandleSessionCreateAsync(t *testing.T) {
+func TestHandleSessionCreateAsyncEmitsBeforeOptionalMetadataPersistenceCompletes(t *testing.T) {
 	fs := newSessionFakeState(t)
+	blocking := &blockingSetMetadataBatchStore{
+		Store: fs.cityBeadStore,
+		shouldBlock: func(kvs map[string]string) bool {
+			return kvs["real_world_app_session_kind"] == "agent" &&
+				kvs["real_world_app_project_id"] == "myrig"
+		},
+		entered: make(chan struct{}),
+		release: make(chan struct{}),
+	}
+	fs.cityBeadStore = blocking
+	defer close(blocking.release)
+
 	srv := New(fs)
 	h := newTestCityHandlerWith(t, fs, srv)
-	_ = h
 
-	body := `{"kind":"agent","name":"myrig/worker","alias":"sky","async":true}`
+	body := `{"kind":"agent","name":"myrig/worker","alias":"sky","async":true,"project_id":"myrig"}`
 	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
@@ -1404,23 +2239,42 @@ func TestHandleSessionCreateAsync(t *testing.T) {
 	if w.Code != http.StatusAccepted {
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
+	accepted := decodeAsyncAccepted(t, w.Body)
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if resp.State != "creating" {
-		t.Fatalf("State = %q, want %q", resp.State, "creating")
-	}
-	if resp.Running {
-		t.Fatalf("Running = true, want false for async create")
+	select {
+	case <-blocking.entered:
+	case <-time.After(testEventTimeout):
+		t.Fatal("SetMetadataBatch was not reached")
 	}
-	if resp.Alias != "sky" {
-		t.Fatalf("Alias = %q, want %q", resp.Alias, "sky")
+
+	deadline := time.Now().Add(250 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		successEvents, _ := fs.eventProv.List(events.Filter{Type: events.RequestResultSessionCreate})
+		for _, e := range successEvents {
+			var p SessionCreateSucceededPayload
+			if err := json.Unmarshal(e.Payload, &p); err == nil && requestIDMatches(p.RequestID, accepted.RequestID) {
+				return
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
 	}
-	if fs.pokeCount != 1 {
-		t.Fatalf("pokeCount = %d, want 1", fs.pokeCount)
+	t.Fatal("session create result was not emitted while metadata persistence was blocked")
+}
+
+type blockingSetMetadataBatchStore struct {
+	beads.Store
+	shouldBlock func(map[string]string) bool
+	entered     chan struct{}
+	release     chan struct{}
+	once        sync.Once
+}
+
+func (s *blockingSetMetadataBatchStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if s.shouldBlock != nil && s.shouldBlock(kvs) {
+		s.once.Do(func() { close(s.entered) })
+		<-s.release
 	}
+	return s.Store.SetMetadataBatch(id, kvs)
 }
 
 func TestHandleSessionCreateAsyncAcceptsInlineMessage(t *testing.T) {
@@ -1463,6 +2317,9 @@ func TestHandleSessionCreateAsync_PoolTemplateWithoutAliasUsesGeneratedWorkDirId
 		if rec.Code != http.StatusAccepted {
 			t.Fatalf("create #%d status = %d, want %d; body: %s", i+1, rec.Code, http.StatusAccepted, rec.Body.String())
 		}
+		// Wait for the async goroutine to finish before issuing the next create,
+		// so the lock/uniqueness checks see the previous session.
+		waitForNSessionCreateEvents(t, fs.eventProv, i+1, 5*time.Second)
 	}
 
 	items, err := fs.cityBeadStore.ListByLabel(session.LabelSession, 0)
@@ -1579,20 +2436,27 @@ func TestHandleSessionCreateAsync_PoolTemplateCanonicalizesAliasCollisions(t *te
 	if rec.Code != http.StatusAccepted {
 		t.Fatalf("first create status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("first create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
-	if resp.Alias != "myrig/ant-fenrir" {
-		t.Fatalf("Alias = %q, want canonical qualified alias", resp.Alias)
+	if success.Session.Alias != "myrig/ant-fenrir" {
+		t.Fatalf("Alias = %q, want canonical qualified alias", success.Session.Alias)
 	}
 
 	req = newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(`{"kind":"agent","name":"myrig/ant","alias":"myrig/ant-fenrir"}`))
 	req.Header.Set("Idempotency-Key", "pool-alias-2")
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	if rec.Code != http.StatusConflict {
-		t.Fatalf("second create status = %d, want %d; body: %s", rec.Code, http.StatusConflict, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("second create status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted2 := decodeAsyncAccepted(t, rec.Body)
+	// The second create should fail asynchronously due to alias collision.
+	failure2 := waitForRequestFailed(t, fs.eventProv, accepted2.RequestID, 5*time.Second)
+	if failure2 == nil {
+		t.Fatal("expected second create to fail due to alias collision")
 	}
 }
 
@@ -1795,39 +2659,20 @@ func TestHandleProviderSessionCreateWithMessageUsesProviderDefaultNudge(t *testi
 	fs := newSessionFakeState(t)
 	srv := New(fs)
 	h := newTestCityHandlerWith(t, fs, srv)
-	_ = h
 
 	body := `{"kind":"provider","name":"test-agent","message":"hello"}`
 	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
 
-	if w.Code != http.StatusCreated {
-		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusCreated, w.Body.String())
-	}
-
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if resp.ID == "" {
-		t.Fatal("response missing id")
-	}
-	if resp.SessionName == "" {
-		t.Fatal("response missing session_name")
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	nudgeCount := 0
-	for _, call := range fs.sp.Calls {
-		if call.Name != resp.SessionName || call.Message != "hello" {
-			continue
-		}
-		if call.Method == "Nudge" {
-			nudgeCount++
-		}
-	}
-	if nudgeCount != 1 {
-		t.Fatalf("Nudge count for %q = %d, want 1; calls=%#v", resp.SessionName, nudgeCount, fs.sp.Calls)
+	accepted := decodeAsyncAccepted(t, w.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 }
 
@@ -1855,30 +2700,34 @@ func TestHandleProviderSessionCreateUsesACPTransportCommand(t *testing.T) {
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	start := acpSP.LastStartConfig(resp.SessionName)
+	success, failure := waitForSessionCreateResult(t, state.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	start := acpSP.LastStartConfig(success.Session.SessionName)
 	if start == nil {
-		t.Fatalf("LastStartConfig(%q) = nil", resp.SessionName)
+		t.Fatalf("LastStartConfig(%q) = nil", success.Session.SessionName)
 	}
 	if got, want := start.Command, "/bin/echo acp"; got != want {
 		t.Fatalf("start command = %q, want %q", got, want)
 	}
-	bead, err := fs.cityBeadStore.Get(resp.ID)
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", resp.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
 	if got, want := bead.Metadata["transport"], "acp"; got != want {
 		t.Fatalf("transport metadata = %q, want %q", got, want)
 	}
-	if defaultSP.IsRunning(resp.SessionName) {
-		t.Fatalf("default backend should not own ACP session %q", resp.SessionName)
+	if defaultSP.IsRunning(success.Session.SessionName) {
+		t.Fatalf("default backend should not own ACP session %q", success.Session.SessionName)
 	}
 }
 
@@ -1908,25 +2757,33 @@ func TestHumaCreateProviderSessionUsesACPTransportCommand(t *testing.T) {
 	if err != nil {
 		t.Fatalf("humaCreateProviderSession: %v", err)
 	}
-	if got, want := out.Status, http.StatusCreated; got != want {
+	if got, want := out.Status, http.StatusAccepted; got != want {
 		t.Fatalf("status = %d, want %d", got, want)
 	}
-	start := acpSP.LastStartConfig(out.Body.SessionName)
+	if out.Body.RequestID == "" {
+		t.Fatal("request_id is empty")
+	}
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, out.Body.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
+	}
+	sessionName := bead.Metadata["session_name"]
+	start := acpSP.LastStartConfig(sessionName)
 	if start == nil {
-		t.Fatalf("LastStartConfig(%q) = nil", out.Body.SessionName)
+		t.Fatalf("LastStartConfig(%q) = nil", sessionName)
 	}
 	if got, want := start.Command, "/bin/echo acp"; got != want {
 		t.Fatalf("start command = %q, want %q", got, want)
 	}
-	bead, err := fs.cityBeadStore.Get(out.Body.ID)
-	if err != nil {
-		t.Fatalf("Get(%s): %v", out.Body.ID, err)
-	}
 	if got, want := bead.Metadata["transport"], "acp"; got != want {
 		t.Fatalf("transport metadata = %q, want %q", got, want)
 	}
-	if defaultSP.IsRunning(out.Body.SessionName) {
-		t.Fatalf("default backend should not own ACP session %q", out.Body.SessionName)
+	if defaultSP.IsRunning(sessionName) {
+		t.Fatalf("default backend should not own ACP session %q", sessionName)
 	}
 }
 
@@ -1953,24 +2810,28 @@ func TestHandleProviderSessionCreateUsesACPTransportCapabilityProvider(t *testin
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	start := provider.LastStartConfig(resp.SessionName)
+	success, failure := waitForSessionCreateResult(t, state.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	start := provider.LastStartConfig(success.Session.SessionName)
 	if start == nil {
-		t.Fatalf("LastStartConfig(%q) = nil", resp.SessionName)
+		t.Fatalf("LastStartConfig(%q) = nil", success.Session.SessionName)
 	}
 	if got, want := start.Command, "/bin/echo acp"; got != want {
 		t.Fatalf("start command = %q, want %q", got, want)
 	}
-	bead, err := fs.cityBeadStore.Get(resp.ID)
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", resp.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
 	if got, want := bead.Metadata["transport"], "acp"; got != want {
 		t.Fatalf("transport metadata = %q, want %q", got, want)
@@ -2011,24 +2872,28 @@ args = ["{{.AgentName}}", "{{.WorkDir}}", "{{.TemplateName}}"]
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(rec.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	start := provider.LastStartConfig(resp.SessionName)
+	success, failure := waitForSessionCreateResult(t, state.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	start := provider.LastStartConfig(success.Session.SessionName)
 	if start == nil {
-		t.Fatalf("LastStartConfig(%q) = nil", resp.SessionName)
+		t.Fatalf("LastStartConfig(%q) = nil", success.Session.SessionName)
 	}
 	if len(start.MCPServers) != 1 {
 		t.Fatalf("Start MCPServers len = %d, want 1", len(start.MCPServers))
 	}
-	bead, err := fs.cityBeadStore.Get(resp.ID)
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", resp.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
 	if got := bead.Metadata[session.MCPIdentityMetadataKey]; got == "" {
 		t.Fatal("mcp_identity metadata = empty, want per-session identity")
@@ -2103,48 +2968,31 @@ func TestHandleProviderSessionCreateWithMessageRollsBackOnDeliveryFailure(t *tes
 
 	body := `{"kind":"provider","name":"test-agent","message":"hello","title":"Retryable"}`
 	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
-	req.Header.Set("Idempotency-Key", "provider-create-rollback")
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusInternalServerError {
-		t.Fatalf("first create status = %d, want %d; body: %s", rec.Code, http.StatusInternalServerError, rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), "initial message delivery failed") {
-		t.Fatalf("first create body = %q, want initial message delivery failure detail", rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("create status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	items, err := fs.cityBeadStore.ListByLabel(session.LabelSession, 0, beads.IncludeClosed)
-	if err != nil {
-		t.Fatalf("ListByLabel: %v", err)
-	}
-	if len(items) != 0 {
-		t.Fatalf("session bead count after rollback = %d, want 0", len(items))
-	}
-	running, err := provider.ListRunning("")
-	if err != nil {
-		t.Fatalf("ListRunning: %v", err)
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success != nil {
+		t.Fatalf("session create succeeded unexpectedly: %+v", success)
 	}
-	if len(running) != 0 {
-		t.Fatalf("running sessions after rollback = %v, want none", running)
+	if failure == nil {
+		t.Fatal("expected session create failure event")
 	}
-
-	provider.err = nil
-	req = newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
-	req.Header.Set("Idempotency-Key", "provider-create-rollback")
-	rec = httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("retry create status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	if failure.ErrorCode != "message_delivery_failed" {
+		t.Fatalf("failure error_code = %q, want message_delivery_failed; message=%s", failure.ErrorCode, failure.ErrorMessage)
 	}
-
-	items, err = fs.cityBeadStore.ListByLabel(session.LabelSession, 0, beads.IncludeClosed)
+	mgr := session.NewManager(fs.cityBeadStore, provider)
+	sessions, err := mgr.List("", "")
 	if err != nil {
-		t.Fatalf("ListByLabel after retry: %v", err)
+		t.Fatalf("list sessions after rollback: %v", err)
 	}
-	if len(items) != 1 {
-		t.Fatalf("session bead count after retry = %d, want 1", len(items))
+	if len(sessions) != 0 {
+		t.Fatalf("got %d sessions after rollback, want 0: %+v", len(sessions), sessions)
 	}
 }
 
@@ -2163,10 +3011,12 @@ func TestHandleSessionCreatePersistsAlias(t *testing.T) {
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, w.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
+	resp := success.Session
 	if resp.Alias != "sky" {
 		t.Fatalf("Alias = %q, want sky", resp.Alias)
 	}
@@ -2186,8 +3036,16 @@ func TestHandleSessionCreateRejectsReservedQualifiedAlias(t *testing.T) {
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
 
-	if w.Code != http.StatusConflict {
-		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusConflict, w.Body.String())
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
+	}
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(w.Body).Decode(&accepted); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	_, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if failure == nil {
+		t.Fatal("expected session create to fail for reserved alias")
 	}
 }
 
@@ -2195,15 +3053,20 @@ func TestHandleProviderSessionCreateRejectsReservedQualifiedAlias(t *testing.T)
 	fs := newSessionFakeState(t)
 	srv := New(fs)
 	h := newTestCityHandlerWith(t, fs, srv)
-	_ = h
 
 	body := `{"kind":"provider","name":"test-agent","alias":"myrig/worker"}`
 	req := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(body))
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, req)
 
-	if w.Code != http.StatusConflict {
-		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusConflict, w.Body.String())
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
+	}
+
+	accepted := decodeAsyncAccepted(t, w.Body)
+	_, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if failure == nil {
+		t.Fatalf("expected session create to fail for reserved alias, got success")
 	}
 }
 
@@ -2273,13 +3136,30 @@ func TestHandleSessionCreateRejectsDuplicateAlias(t *testing.T) {
 	if firstW.Code != http.StatusAccepted {
 		t.Fatalf("first create status %d, want %d; body: %s", firstW.Code, http.StatusAccepted, firstW.Body.String())
 	}
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(firstW.Body).Decode(&accepted); err != nil {
+		t.Fatalf("decode first 202: %v", err)
+	}
+	// Wait for the first create to finish so the alias is persisted.
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("first create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
 
 	second := newPostRequest(cityURL(fs, "/sessions"), strings.NewReader(`{"kind":"agent","name":"myrig/worker","alias":"sky"}`))
 	secondW := httptest.NewRecorder()
 	h.ServeHTTP(secondW, second)
 
-	if secondW.Code != http.StatusConflict {
-		t.Fatalf("got status %d, want %d; body: %s", secondW.Code, http.StatusConflict, secondW.Body.String())
+	if secondW.Code != http.StatusAccepted {
+		t.Fatalf("second create status = %d, want %d; body: %s", secondW.Code, http.StatusAccepted, secondW.Body.String())
+	}
+	var accepted2 asyncAcceptedBody
+	if err := json.NewDecoder(secondW.Body).Decode(&accepted2); err != nil {
+		t.Fatalf("decode second 202: %v", err)
+	}
+	failure2 := waitForRequestFailed(t, fs.eventProv, accepted2.RequestID, 5*time.Second)
+	if failure2 == nil {
+		t.Fatal("expected second create to fail due to duplicate alias")
 	}
 }
 
@@ -2297,10 +3177,18 @@ func TestHandleSessionCreateCanonicalizesBareTemplate(t *testing.T) {
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+	var accepted asyncAcceptedBody
+	if err := json.NewDecoder(w.Body).Decode(&accepted); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
+	if accepted.RequestID == "" {
+		t.Fatal("missing request_id")
+	}
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	resp := success.Session
 	if resp.Template != "myrig/worker" {
 		t.Errorf("Template = %q, want %q", resp.Template, "myrig/worker")
 	}
@@ -2364,12 +3252,13 @@ func TestHandleSessionCreateDoesNotApplyProviderDefaultsToAgentCommand(t *testin
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, w.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 
-	b, err := fs.cityBeadStore.Get(resp.ID)
+	b, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
 		t.Fatalf("get bead: %v", err)
 	}
@@ -2397,12 +3286,13 @@ func TestHandleSessionCreateStoresExplicitOverridesWithoutCommandRewrite(t *test
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, w.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 
-	b, err := fs.cityBeadStore.Get(resp.ID)
+	b, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
 		t.Fatalf("get bead: %v", err)
 	}
@@ -2441,12 +3331,13 @@ func TestHandleSessionCreatePersistsExplicitOptionsInTemplateOverrides(t *testin
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, w.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 
-	b, err := fs.cityBeadStore.Get(resp.ID)
+	b, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
 		t.Fatalf("get bead: %v", err)
 	}
@@ -2488,12 +3379,13 @@ func TestHandleSessionCreatePreservesInitialMessageWithOptions(t *testing.T) {
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, w.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 
-	b, err := fs.cityBeadStore.Get(resp.ID)
+	b, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
 		t.Fatalf("get bead: %v", err)
 	}
@@ -2525,14 +3417,18 @@ func TestHandleSessionMessageMaterializedNamedSessionUsesLaunchCommandDefaults(t
 	if rec.Code != http.StatusAccepted {
 		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-
-	var resp map[string]string
+	var resp asyncAcceptedBody
 	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	id := resp["id"]
+
+	success, failure := waitForSessionMessageResult(t, fs.eventProv, resp.RequestID)
+	if success == nil {
+		t.Fatalf("session message failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+	id := success.SessionID
 	if id == "" {
-		t.Fatal("response missing session id")
+		t.Fatal("session message event missing session_id")
 	}
 
 	bead, err := fs.cityBeadStore.Get(id)
@@ -2548,11 +3444,8 @@ func TestHandleSessionMessageMaterializedNamedSessionUsesLaunchCommandDefaults(t
 	}
 }
 
-func TestHandleSessionMessageResumesSuspendedSessionUsingProviderDefaultNudge(t *testing.T) {
+func TestHandleSessionMessageQueuesSuspendedSessionMessage(t *testing.T) {
 	fs := newSessionFakeState(t)
-	srv := New(fs)
-	h := newTestCityHandlerWith(t, fs, srv)
-	_ = h
 
 	info := createTestSession(t, fs.cityBeadStore, fs.sp, "Resume Me")
 	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
@@ -2560,34 +3453,59 @@ func TestHandleSessionMessageResumesSuspendedSessionUsingProviderDefaultNudge(t
 		t.Fatalf("Suspend: %v", err)
 	}
 
+	blocker := &blockingStartProvider{
+		Fake:    fs.sp,
+		started: make(chan struct{}),
+		unblock: make(chan struct{}),
+	}
+	var unblockOnce sync.Once
+	unblock := func() {
+		unblockOnce.Do(func() {
+			close(blocker.unblock)
+		})
+	}
+	t.Cleanup(unblock)
+
+	srv := New(&stateWithSessionProvider{fakeState: fs, provider: blocker})
+	h := newTestCityHandlerWith(t, fs, srv)
+
 	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/messages", strings.NewReader(`{"message":"hello"}`))
 	req.Header.Set("Idempotency-Key", "sess-msg-1")
 	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
+	done := make(chan struct{})
+	go func() {
+		h.ServeHTTP(w, req)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("handler blocked on suspended-session start instead of returning accepted")
+	}
 
 	if w.Code != http.StatusAccepted {
 		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
 	}
-	if !fs.sp.IsRunning(info.SessionName) {
-		t.Fatal("session should be running after POST /messages")
-	}
-	found := false
-	for _, call := range fs.sp.Calls {
-		if call.Method == "Nudge" && call.Name == info.SessionName && call.Message == "hello" {
-			found = true
-			break
-		}
+	accepted := decodeAsyncAccepted(t, w.Body)
+
+	select {
+	case <-blocker.started:
+	case <-time.After(testEventTimeout):
+		t.Fatal("provider start was not reached")
 	}
-	if !found {
-		t.Fatalf("calls = %#v, want provider-default nudge hello", fs.sp.Calls)
+	unblock()
+
+	success, failure := waitForSessionMessageResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session message failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 }
 
-func TestHandleSessionMessageMaterializesNamedSessionUsingProviderDefaultNudge(t *testing.T) {
+func TestHandleSessionMessageMaterializesNamedSessionAsync(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
 	h := newTestCityHandlerWith(t, fs, srv)
-	_ = h
 
 	req := newPostRequest(cityURL(fs, "/session/worker/messages"), strings.NewReader(`{"message":"hello"}`))
 	rec := httptest.NewRecorder()
@@ -2596,41 +3514,133 @@ func TestHandleSessionMessageMaterializesNamedSessionUsingProviderDefaultNudge(t
 	if rec.Code != http.StatusAccepted {
 		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-
-	var resp map[string]string
+	var resp asyncAcceptedBody
 	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
 		t.Fatalf("decode: %v", err)
 	}
-	id := resp["id"]
-	if id == "" {
-		t.Fatal("response missing session id")
+	if resp.RequestID == "" {
+		t.Fatal("response missing request_id")
 	}
-	b, err := fs.cityBeadStore.Get(id)
-	if err != nil {
-		t.Fatalf("Get(%q): %v", id, err)
+	if resp.Status != "accepted" {
+		t.Fatalf("response status = %q, want accepted", resp.Status)
 	}
-	if got := b.Metadata[apiNamedSessionMetadataKey]; got != "true" {
-		t.Fatalf("configured_named_session = %q, want true", got)
+
+	success, failure := waitForSessionMessageResult(t, fs.eventProv, resp.RequestID)
+	if success == nil {
+		t.Fatalf("session message failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
-	if got := b.Metadata["alias"]; got != "myrig/worker" {
-		t.Fatalf("alias = %q, want myrig/worker", got)
+	if success.SessionID == "" {
+		t.Fatal("event missing session_id")
 	}
-	sessionName := b.Metadata["session_name"]
-	if sessionName == "" {
-		t.Fatal("materialized named session missing session_name")
+}
+
+func TestHandleSessionMessageEmitsFailureWhenProviderNudgeHangs(t *testing.T) {
+	fs := newSessionFakeState(t)
+	blocker := &blockingNudgeProvider{
+		Fake:    fs.sp,
+		started: make(chan struct{}),
+		unblock: make(chan struct{}),
 	}
-	if !fs.sp.IsRunning(sessionName) {
-		t.Fatalf("session %q should be running after POST /messages", sessionName)
+	t.Cleanup(func() {
+		close(blocker.unblock)
+	})
+	prevTimeout := sessionMessageAsyncTimeout
+	sessionMessageAsyncTimeout = 50 * time.Millisecond
+	t.Cleanup(func() {
+		sessionMessageAsyncTimeout = prevTimeout
+	})
+
+	srv := New(&stateWithSessionProvider{fakeState: fs, provider: blocker})
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "blocked-message")
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/messages", strings.NewReader(`{"message":"hello"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted := decodeAsyncAccepted(t, rec.Body)
+
+	select {
+	case <-blocker.started:
+	case <-time.After(testEventTimeout):
+		t.Fatal("provider nudge was not reached")
+	}
+	success, failure := waitForSessionMessageResult(t, fs.eventProv, accepted.RequestID)
+	if success != nil {
+		t.Fatalf("unexpected success: %+v", success)
+	}
+	if failure == nil {
+		t.Fatal("expected request.failed for blocked provider nudge")
+	}
+	if failure.ErrorCode != "timeout" {
+		t.Fatalf("failure error_code = %q, want timeout", failure.ErrorCode)
+	}
+}
+
+func TestSessionMessageAsyncTimeoutMatchesClientTimeout(t *testing.T) {
+	if sessionMessageAsyncTimeout != sessionMessageTimeout {
+		t.Fatalf("sessionMessageAsyncTimeout = %s, want client timeout %s", sessionMessageAsyncTimeout, sessionMessageTimeout)
+	}
+}
+
+func TestHandleSessionMessageLogsLateProviderResultAfterTimeout(t *testing.T) {
+	fs := newSessionFakeState(t)
+	blocker := &blockingNudgeProvider{
+		Fake:    fs.sp,
+		started: make(chan struct{}),
+		unblock: make(chan struct{}),
+	}
+	prevTimeout := sessionMessageAsyncTimeout
+	sessionMessageAsyncTimeout = 50 * time.Millisecond
+	t.Cleanup(func() {
+		sessionMessageAsyncTimeout = prevTimeout
+	})
+
+	var logs bytes.Buffer
+	oldOutput := log.Writer()
+	oldFlags := log.Flags()
+	log.SetOutput(&logs)
+	log.SetFlags(0)
+	t.Cleanup(func() {
+		log.SetOutput(oldOutput)
+		log.SetFlags(oldFlags)
+	})
+
+	srv := New(&stateWithSessionProvider{fakeState: fs, provider: blocker})
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "late-message")
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/messages", strings.NewReader(`{"message":"hello"}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted := decodeAsyncAccepted(t, rec.Body)
+
+	select {
+	case <-blocker.started:
+	case <-time.After(testEventTimeout):
+		t.Fatal("provider nudge was not reached")
+	}
+	_, failure := waitForSessionMessageResult(t, fs.eventProv, accepted.RequestID)
+	if failure == nil || failure.ErrorCode != "timeout" {
+		t.Fatalf("failure = %+v, want timeout", failure)
 	}
-	nudgeCount := 0
-	for _, call := range fs.sp.Calls {
-		if call.Method == "Nudge" && call.Name == sessionName && call.Message == "hello" {
-			nudgeCount++
+
+	close(blocker.unblock)
+	deadline := time.Now().Add(testEventTimeout)
+	for time.Now().Before(deadline) {
+		if strings.Contains(logs.String(), "late session.message result after timeout") {
+			return
 		}
+		time.Sleep(10 * time.Millisecond)
 	}
-	if nudgeCount != 1 {
-		t.Fatalf("Nudge count for %q = %d, want 1; calls=%#v", sessionName, nudgeCount, fs.sp.Calls)
-	}
+	t.Fatalf("logs = %q, want late session.message result after timeout", logs.String())
 }
 
 func TestHandleSessionMessageMaterializesBoundNamedSessionUsingQualifiedIdentity(t *testing.T) {
@@ -2656,13 +3666,14 @@ func TestHandleSessionMessageMaterializesBoundNamedSessionUsingQualifiedIdentity
 		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp map[string]string
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	success, failure := waitForSessionMessageResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session message failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
-	id := resp["id"]
+	id := success.SessionID
 	if id == "" {
-		t.Fatal("response missing session id")
+		t.Fatal("session message event missing session_id")
 	}
 	b, err := fs.cityBeadStore.Get(id)
 	if err != nil {
@@ -2674,22 +3685,6 @@ func TestHandleSessionMessageMaterializesBoundNamedSessionUsingQualifiedIdentity
 	if got := b.Metadata["alias"]; got != "employees.corp--alex" {
 		t.Fatalf("alias = %q, want employees.corp--alex", got)
 	}
-	sessionName := b.Metadata["session_name"]
-	if sessionName == "" {
-		t.Fatal("materialized named session missing session_name")
-	}
-	if !fs.sp.IsRunning(sessionName) {
-		t.Fatalf("session %q should be running after POST /messages", sessionName)
-	}
-	nudgeCount := 0
-	for _, call := range fs.sp.Calls {
-		if call.Method == "Nudge" && call.Name == sessionName && call.Message == "hello" {
-			nudgeCount++
-		}
-	}
-	if nudgeCount != 1 {
-		t.Fatalf("Nudge count for %q = %d, want 1; calls=%#v", sessionName, nudgeCount, fs.sp.Calls)
-	}
 }
 
 func TestResolveSessionIDMaterializingNamedWithContext_RollsBackCanceledCreate(t *testing.T) {
@@ -2908,6 +3903,115 @@ func TestResolveSessionIDMaterializingNamed_QualifiedAliasBasenameDoesNotStealNa
 	}
 }
 
+func TestResolveConfiguredNamedSessionIDWithContext_BoundedListCalls(t *testing.T) {
+	fs := newSessionFakeState(t)
+	store := &apiListQueryCaptureStore{Store: beads.NewMemStore()}
+	fs.cityBeadStore = store
+	srv := New(fs)
+
+	spec, ok, err := srv.findNamedSessionSpecForTarget(store, "worker")
+	if err != nil {
+		t.Fatalf("findNamedSessionSpecForTarget(worker): %v", err)
+	}
+	if !ok {
+		t.Fatal("expected named session spec for worker")
+	}
+	for i := 0; i < 200; i++ {
+		if _, err := store.Create(beads.Bead{
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"session_name": fmt.Sprintf("worker-%d", i),
+			},
+		}); err != nil {
+			t.Fatalf("create irrelevant session %d: %v", i, err)
+		}
+	}
+	target, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name":             spec.SessionName,
+			"alias":                    spec.Identity,
+			apiNamedSessionMetadataKey: "true",
+			apiNamedSessionIdentityKey: spec.Identity,
+			apiNamedSessionModeKey:     spec.Mode,
+		},
+	})
+	if err != nil {
+		t.Fatalf("create canonical named session: %v", err)
+	}
+
+	id, matched, err := srv.resolveConfiguredNamedSessionIDWithContext(context.Background(), store, "worker", apiSessionResolveOptions{})
+	if err != nil {
+		t.Fatalf("resolveConfiguredNamedSessionIDWithContext(worker): %v", err)
+	}
+	if !matched {
+		t.Fatal("matched = false, want true")
+	}
+	if id != target.ID {
+		t.Fatalf("id = %q, want canonical %q", id, target.ID)
+	}
+	if len(store.listCalls) != 1 {
+		t.Fatalf("List calls = %d, want 1 canonical lookup", len(store.listCalls))
+	}
+	assertSessionResolverMetadataFilteredListCalls(t, store.listCalls)
+}
+
+func TestResolveConfiguredNamedSessionIDWithContext_BoundedConflictListCalls(t *testing.T) {
+	fs := newSessionFakeState(t)
+	store := &apiListQueryCaptureStore{Store: beads.NewMemStore()}
+	fs.cityBeadStore = store
+	srv := New(fs)
+
+	spec, ok, err := srv.findNamedSessionSpecForTarget(store, "worker")
+	if err != nil {
+		t.Fatalf("findNamedSessionSpecForTarget(worker): %v", err)
+	}
+	if !ok {
+		t.Fatal("expected named session spec for worker")
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": spec.SessionName,
+			"template":     "other/worker",
+			"agent_name":   "other/worker",
+			"state":        "asleep",
+		},
+	}); err != nil {
+		t.Fatalf("create wrong-template runtime bead: %v", err)
+	}
+
+	_, matched, err := srv.resolveConfiguredNamedSessionIDWithContext(context.Background(), store, "worker", apiSessionResolveOptions{})
+	if err == nil {
+		t.Fatal("resolveConfiguredNamedSessionIDWithContext(worker) succeeded, want conflict")
+	}
+	if !matched {
+		t.Fatal("matched = false, want true")
+	}
+	if !errors.Is(err, errConfiguredNamedSessionConflict) {
+		t.Fatalf("error = %v, want errConfiguredNamedSessionConflict", err)
+	}
+	if len(store.listCalls) > 4 {
+		t.Fatalf("List calls = %d, want bounded small constant without duplicate session_name lookup", len(store.listCalls))
+	}
+	assertSessionResolverMetadataFilteredListCalls(t, store.listCalls)
+}
+
+func assertSessionResolverMetadataFilteredListCalls(t *testing.T, calls []beads.ListQuery) {
+	t.Helper()
+	if len(calls) == 0 {
+		t.Fatal("expected at least one List call")
+	}
+	for i, query := range calls {
+		if len(query.Metadata) == 0 {
+			t.Fatalf("List call #%d has no metadata filter (would scan broad bead sets): %+v", i, query)
+		}
+	}
+}
+
 func TestResolveSessionIDMaterializingNamed_AdoptsCanonicalRuntimeSessionNameBead(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
@@ -3189,6 +4293,176 @@ func TestHandleSessionTranscriptClosedSession(t *testing.T) {
 	}
 }
 
+func TestHandleSessionTranscriptAfterCursor(t *testing.T) {
+	fs := newSessionFakeState(t)
+	searchBase := t.TempDir()
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+	_ = h
+	srv.sessionLogSearchPaths = []string{searchBase}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	writeNamedSessionJSONL(t, searchBase, workDir, info.SessionKey+".jsonl",
+		`{"uuid":"1","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"first\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+		`{"uuid":"2","parentUuid":"1","type":"assistant","message":"{\"role\":\"assistant\",\"content\":\"second\"}","timestamp":"2025-01-01T00:00:01Z"}`,
+		`{"uuid":"3","parentUuid":"2","type":"user","message":"{\"role\":\"user\",\"content\":\"third\"}","timestamp":"2025-01-01T00:00:02Z"}`,
+		`{"uuid":"4","parentUuid":"3","type":"assistant","message":"{\"role\":\"assistant\",\"content\":\"fourth\"}","timestamp":"2025-01-01T00:00:03Z"}`,
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/transcript?after=2", nil)
+	h.ServeHTTP(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	var resp SessionStreamMessageEvent
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.Turns) != 2 {
+		t.Fatalf("got %d turns, want 2 (entries after uuid 2); turns: %+v", len(resp.Turns), resp.Turns)
+	}
+	if resp.Turns[0].Text != "third" {
+		t.Errorf("Turns[0].Text = %q, want %q", resp.Turns[0].Text, "third")
+	}
+	if resp.Turns[1].Text != "fourth" {
+		t.Errorf("Turns[1].Text = %q, want %q", resp.Turns[1].Text, "fourth")
+	}
+}
+
+func TestHandleSessionTranscriptAfterCursorRaw(t *testing.T) {
+	fs := newSessionFakeState(t)
+	searchBase := t.TempDir()
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+	_ = h
+	srv.sessionLogSearchPaths = []string{searchBase}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	writeNamedSessionJSONL(t, searchBase, workDir, info.SessionKey+".jsonl",
+		`{"uuid":"1","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"first\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+		`{"uuid":"2","parentUuid":"1","type":"assistant","message":"{\"role\":\"assistant\",\"content\":\"second\"}","timestamp":"2025-01-01T00:00:01Z"}`,
+		`{"uuid":"3","parentUuid":"2","type":"user","message":"{\"role\":\"user\",\"content\":\"third\"}","timestamp":"2025-01-01T00:00:02Z"}`,
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/transcript?format=raw&after=1", nil)
+	h.ServeHTTP(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	var raw struct {
+		Messages []json.RawMessage `json:"messages"`
+	}
+	if err := json.NewDecoder(w.Body).Decode(&raw); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(raw.Messages) != 2 {
+		t.Fatalf("got %d raw messages, want 2 (entries after uuid 1)", len(raw.Messages))
+	}
+}
+
+func TestHandleSessionTranscriptBeforeAndAfterExclusive(t *testing.T) {
+	fs := newSessionFakeState(t)
+	searchBase := t.TempDir()
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+	_ = h
+	srv.sessionLogSearchPaths = []string{searchBase}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	writeNamedSessionJSONL(t, searchBase, workDir, info.SessionKey+".jsonl",
+		`{"uuid":"1","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"hello\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/transcript?before=3&after=1", nil)
+	h.ServeHTTP(w, r)
+
+	if w.Code != http.StatusUnprocessableEntity {
+		t.Fatalf("got status %d, want %d (before+after exclusive); body: %s", w.Code, http.StatusUnprocessableEntity, w.Body.String())
+	}
+}
+
+func TestHandleSessionTranscriptAfterCursorNotFound(t *testing.T) {
+	fs := newSessionFakeState(t)
+	searchBase := t.TempDir()
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+	_ = h
+	srv.sessionLogSearchPaths = []string{searchBase}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	writeNamedSessionJSONL(t, searchBase, workDir, info.SessionKey+".jsonl",
+		`{"uuid":"1","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"hello\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+		`{"uuid":"2","parentUuid":"1","type":"assistant","message":"{\"role\":\"assistant\",\"content\":\"world\"}","timestamp":"2025-01-01T00:00:01Z"}`,
+	)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/transcript?after=nonexistent", nil)
+	h.ServeHTTP(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("got status %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	var resp SessionStreamMessageEvent
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.Turns) != 2 {
+		t.Fatalf("got %d turns, want 2 (cursor not found = full set)", len(resp.Turns))
+	}
+}
+
 func TestHandleSessionPendingAndRespond(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
@@ -3209,25 +4483,65 @@ func TestHandleSessionPendingAndRespond(t *testing.T) {
 	if w.Code != http.StatusOK {
 		t.Fatalf("pending status = %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
 	}
-
+
+	var pendingResp sessionPendingResponse
+	if err := json.NewDecoder(w.Body).Decode(&pendingResp); err != nil {
+		t.Fatalf("decode pending: %v", err)
+	}
+	if !pendingResp.Supported || pendingResp.Pending == nil || pendingResp.Pending.RequestID != "req-1" {
+		t.Fatalf("pending response = %#v, want req-1", pendingResp)
+	}
+
+	respondReq := newPostRequest(cityURL(fs, "/session/")+info.ID+"/respond", strings.NewReader(`{"action":"approve"}`))
+	respondReq.Header.Set("Idempotency-Key", "sess-respond-1")
+	respondRec := httptest.NewRecorder()
+	h.ServeHTTP(respondRec, respondReq)
+
+	if respondRec.Code != http.StatusAccepted {
+		t.Fatalf("respond status = %d, want %d; body: %s", respondRec.Code, http.StatusAccepted, respondRec.Body.String())
+	}
+	if got := fs.sp.Responses[info.SessionName]; len(got) != 1 || got[0].Action != "approve" {
+		t.Fatalf("responses = %#v, want single approve", got)
+	}
+}
+
+func TestHandleSessionPendingReturnsEmptyWhenRuntimeSessionMissing(t *testing.T) {
+	fs := newSessionFakeState(t)
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "Interactive")
+	state := &stateWithSessionProvider{
+		fakeState: fs,
+		provider:  &pendingSessionMissingProvider{Fake: fs.sp},
+	}
+	srv := New(state)
+	h := newTestCityHandlerWith(t, state, srv)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/pending", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("pending status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
 	var pendingResp sessionPendingResponse
-	if err := json.NewDecoder(w.Body).Decode(&pendingResp); err != nil {
+	if err := json.NewDecoder(rec.Body).Decode(&pendingResp); err != nil {
 		t.Fatalf("decode pending: %v", err)
 	}
-	if !pendingResp.Supported || pendingResp.Pending == nil || pendingResp.Pending.RequestID != "req-1" {
-		t.Fatalf("pending response = %#v, want req-1", pendingResp)
+	if !pendingResp.Supported {
+		t.Fatalf("Supported = false, want true for interaction-capable provider")
+	}
+	if pendingResp.Pending != nil {
+		t.Fatalf("Pending = %#v, want nil when runtime session is gone", pendingResp.Pending)
 	}
 
 	respondReq := newPostRequest(cityURL(fs, "/session/")+info.ID+"/respond", strings.NewReader(`{"action":"approve"}`))
-	respondReq.Header.Set("Idempotency-Key", "sess-respond-1")
 	respondRec := httptest.NewRecorder()
 	h.ServeHTTP(respondRec, respondReq)
 
-	if respondRec.Code != http.StatusAccepted {
-		t.Fatalf("respond status = %d, want %d; body: %s", respondRec.Code, http.StatusAccepted, respondRec.Body.String())
+	if respondRec.Code != http.StatusConflict {
+		t.Fatalf("respond status = %d, want %d; body: %s", respondRec.Code, http.StatusConflict, respondRec.Body.String())
 	}
-	if got := fs.sp.Responses[info.SessionName]; len(got) != 1 || got[0].Action != "approve" {
-		t.Fatalf("responses = %#v, want single approve", got)
+	if !strings.Contains(respondRec.Body.String(), "no_pending") {
+		t.Fatalf("respond body = %q, want no_pending problem", respondRec.Body.String())
 	}
 }
 
@@ -3248,16 +4562,14 @@ func TestHandleSessionMessageRejectsPendingInteraction(t *testing.T) {
 	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/messages", strings.NewReader(`{"message":"hello"}`))
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusConflict {
-		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusConflict, rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), "pending_interaction") {
-		t.Fatalf("message body = %s, want pending_interaction error", rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-	for _, call := range fs.sp.Calls {
-		if (call.Method == "Nudge" || call.Method == "NudgeNow") && call.Name == info.SessionName {
-			t.Fatalf("unexpected nudge while pending interaction is active: %#v", fs.sp.Calls)
-		}
+
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	_, failure := waitForSessionMessageResult(t, fs.eventProv, accepted.RequestID)
+	if failure == nil {
+		t.Fatalf("expected session message to fail (pending interaction should reject), got success")
 	}
 }
 
@@ -3280,11 +4592,14 @@ func TestHandleSessionMessageRejectsClosedNamedSession(t *testing.T) {
 	req := newPostRequest(cityURL(fs, "/session/sky/messages"), strings.NewReader(`{"message":"hello"}`))
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusNotFound {
-		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusNotFound, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("message status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
-	if !strings.Contains(rec.Body.String(), "not_found") {
-		t.Fatalf("message body = %s, want not_found error", rec.Body.String())
+
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	_, failure := waitForSessionMessageResult(t, fs.eventProv, accepted.RequestID)
+	if failure == nil {
+		t.Fatalf("expected session message to fail for closed session, got success")
 	}
 }
 
@@ -3380,6 +4695,53 @@ func TestHandleSessionStreamStoppedWithoutOutputReturnsNotFound(t *testing.T) {
 	}
 }
 
+func TestHandleSessionStreamRawStoppedWithoutOutputReturnsNotFound(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+	srv.sessionLogSearchPaths = []string{t.TempDir()}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	info, err := mgr.Create(context.Background(), "default", "No Output", "echo test", t.TempDir(), "test", nil, session.ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/stream?format=raw", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("got status %d, want %d; body: %s", rec.Code, http.StatusNotFound, rec.Body.String())
+	}
+}
+
+func TestLegacySessionStreamRawStoppedWithoutOutputReturnsNotFound(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	srv.sessionLogSearchPaths = []string{t.TempDir()}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	info, err := mgr.Create(context.Background(), "default", "No Output", "echo test", t.TempDir(), "test", nil, session.ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/v0/session/"+info.ID+"/stream?format=raw", nil)
+	srv.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("got status %d, want %d; body: %s", rec.Code, http.StatusNotFound, rec.Body.String())
+	}
+}
+
 func TestHandleSessionStreamClosedSessionReturnsSnapshot(t *testing.T) {
 	fs := newSessionFakeState(t)
 	searchBase := t.TempDir()
@@ -3407,7 +4769,9 @@ func TestHandleSessionStreamClosedSessionReturnsSnapshot(t *testing.T) {
 		t.Fatalf("Close: %v", err)
 	}
 
-	req := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/stream", nil)
+	reqCtx, cancelReq := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancelReq()
+	req := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/stream", nil).WithContext(reqCtx)
 	rec := httptest.NewRecorder()
 	done := make(chan struct{})
 	go func() {
@@ -3417,8 +4781,8 @@ func TestHandleSessionStreamClosedSessionReturnsSnapshot(t *testing.T) {
 
 	select {
 	case <-done:
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("closed session stream should return immediately")
+	case <-time.After(time.Second):
+		t.Fatal("closed session stream should return without waiting for request cancellation")
 	}
 
 	if !strings.Contains(rec.Body.String(), "event: turn") || !strings.Contains(rec.Body.String(), "hello") || !strings.Contains(rec.Body.String(), "world") {
@@ -3431,6 +4795,58 @@ func TestHandleSessionStreamClosedSessionReturnsSnapshot(t *testing.T) {
 	}
 }
 
+func TestHandleSessionStreamStoppedSessionCommitsStatusHeaders(t *testing.T) {
+	fs := newSessionFakeState(t)
+	searchBase := t.TempDir()
+	srv := New(fs)
+	srv.sessionLogSearchPaths = []string{searchBase}
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	writeNamedSessionJSONL(t, searchBase, workDir, info.SessionKey+".jsonl",
+		`{"uuid":"1","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"hello\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+	)
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+
+	ts := httptest.NewServer(h)
+	defer ts.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, ts.URL+cityURL(fs, "/session/")+info.ID+"/stream", nil)
+	if err != nil {
+		t.Fatalf("NewRequest: %v", err)
+	}
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatalf("Do: %v", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	cancel()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+	if got := resp.Header.Get("GC-Session-State"); got != "suspended" {
+		t.Fatalf("committed GC-Session-State = %q, want %q", got, "suspended")
+	}
+	if got := resp.Header.Get("GC-Session-Status"); got != "stopped" {
+		t.Fatalf("committed GC-Session-Status = %q, want %q", got, "stopped")
+	}
+}
+
 func TestHandleSessionStreamClosedNamedSessionReturnsSnapshot(t *testing.T) {
 	fs := newSessionFakeState(t)
 	searchBase := t.TempDir()
@@ -3458,7 +4874,9 @@ func TestHandleSessionStreamClosedNamedSessionReturnsSnapshot(t *testing.T) {
 		t.Fatalf("Close: %v", err)
 	}
 
-	req := httptest.NewRequest("GET", cityURL(fs, "/session/sky/stream"), nil)
+	reqCtx, cancelReq := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancelReq()
+	req := httptest.NewRequest("GET", cityURL(fs, "/session/sky/stream"), nil).WithContext(reqCtx)
 	rec := httptest.NewRecorder()
 	done := make(chan struct{})
 	go func() {
@@ -3468,8 +4886,8 @@ func TestHandleSessionStreamClosedNamedSessionReturnsSnapshot(t *testing.T) {
 
 	select {
 	case <-done:
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("closed named session stream should return immediately")
+	case <-time.After(time.Second):
+		t.Fatal("closed named session stream should return without waiting for request cancellation")
 	}
 
 	if !strings.Contains(rec.Body.String(), "event: turn") || !strings.Contains(rec.Body.String(), "hello") || !strings.Contains(rec.Body.String(), "world") {
@@ -3558,6 +4976,68 @@ func TestStreamSessionTranscriptHistoryDoesNotSkipTurnsAcrossCompactionBoundarie
 	}
 }
 
+func TestStreamSessionTranscriptHistoryReloadsChangesWrittenAfterInitialHistory(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	searchBase := t.TempDir()
+	srv.sessionLogSearchPaths = []string{searchBase}
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	writeNamedSessionJSONL(t, searchBase, workDir, info.SessionKey+".jsonl",
+		`{"uuid":"a","parentUuid":"","type":"user","message":"{\"role\":\"user\",\"content\":\"before initial history\"}","timestamp":"2025-01-01T00:00:00Z"}`,
+	)
+
+	handle, err := srv.workerHandleForSession(fs.cityBeadStore, info.ID)
+	if err != nil {
+		t.Fatalf("workerHandleForSession: %v", err)
+	}
+	initial, err := handle.History(context.Background(), worker.HistoryRequest{})
+	if err != nil {
+		t.Fatalf("History(initial): %v", err)
+	}
+
+	logPath := filepath.Join(searchBase, sessionlog.ProjectSlug(workDir), info.SessionKey+".jsonl")
+	appendFile, err := os.OpenFile(logPath, os.O_APPEND|os.O_WRONLY, 0o644)
+	if err != nil {
+		t.Fatalf("OpenFile: %v", err)
+	}
+	if _, err := appendFile.WriteString(
+		`{"uuid":"b","parentUuid":"a","type":"assistant","message":"{\"role\":\"assistant\",\"content\":\"after initial history\"}","timestamp":"2025-01-01T00:00:01Z"}` + "\n",
+	); err != nil {
+		_ = appendFile.Close()
+		t.Fatalf("append transcript: %v", err)
+	}
+	if err := appendFile.Close(); err != nil {
+		t.Fatalf("close transcript: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+
+	rec := newSyncResponseRecorder()
+	done := make(chan struct{})
+	go func() {
+		srv.streamSessionTranscriptHistory(ctx, rec, info, handle, initial)
+		close(done)
+	}()
+
+	if body := waitForRecorderSubstring(t, rec, "after initial history", time.Second); !strings.Contains(body, "after initial history") {
+		t.Fatalf("stream body missing post-initial-history turn: %s", body)
+	}
+	cancel()
+	<-done
+}
+
 func TestCityScopedSessionStreamReloadsRotatedGeminiTranscriptAcrossRestart(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
@@ -3989,6 +5469,44 @@ func TestHandleSessionStreamRawStallEmitsPendingEventOnCityRoute(t *testing.T) {
 	}
 }
 
+func TestHandleSessionStreamRawRunningSessionWithoutTranscriptOpensImmediately(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	resume := session.ProviderResume{
+		ResumeFlag:    "--resume",
+		ResumeStyle:   "flag",
+		SessionIDFlag: "--session-id",
+	}
+	workDir := t.TempDir()
+	info, err := mgr.Create(context.Background(), "myrig/worker", "Chat", "claude", workDir, "claude", nil, resume, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	req := httptest.NewRequest("GET", cityURL(fs, "/session/")+info.ID+"/stream?format=raw", nil).WithContext(ctx)
+	rec := newSyncResponseRecorder()
+	done := make(chan struct{})
+	go func() {
+		h.ServeHTTP(rec, req)
+		close(done)
+	}()
+
+	body := waitForRecorderSubstring(t, rec, `"messages":[]`, time.Second)
+	cancel()
+	<-done
+
+	if !strings.Contains(body, `"messages":[]`) {
+		t.Fatalf("raw stream body missing initial empty message payload: %s", body)
+	}
+	if !strings.Contains(body, `"format":"raw"`) {
+		t.Fatalf("raw stream body missing raw format payload: %s", body)
+	}
+}
+
 func TestHandleSessionStreamTranscriptWriteWakesWithoutPolling(t *testing.T) {
 	fs := newSessionFakeState(t)
 	searchBase := t.TempDir()
@@ -4264,7 +5782,7 @@ func TestHandleSessionGetActivity(t *testing.T) {
 	}
 }
 
-func TestFilterMetadataAllowlistsMCPrefix(t *testing.T) {
+func TestFilterMetadataAllowlistsRealWorldAppPrefix(t *testing.T) {
 	tests := []struct {
 		name string
 		in   map[string]string
@@ -4281,14 +5799,14 @@ func TestFilterMetadataAllowlistsMCPrefix(t *testing.T) {
 			want: nil,
 		},
 		{
-			name: "mc_ keys preserved",
-			in:   map[string]string{"mc_session_kind": "agent", "mc_permission_mode": "plan", "session_key": "secret"},
-			want: map[string]string{"mc_session_kind": "agent", "mc_permission_mode": "plan"},
+			name: "real_world_app_ keys preserved",
+			in:   map[string]string{"real_world_app_session_kind": "agent", "real_world_app_permission_mode": "plan", "session_key": "secret"},
+			want: map[string]string{"real_world_app_session_kind": "agent", "real_world_app_permission_mode": "plan"},
 		},
 		{
 			name: "mixed keys",
-			in:   map[string]string{"mc_project_id": "proj-1", "quarantined_until": "2025-01-01", "held_until": "2025-01-02"},
-			want: map[string]string{"mc_project_id": "proj-1"},
+			in:   map[string]string{"real_world_app_project_id": "proj-1", "quarantined_until": "2025-01-01", "held_until": "2025-01-02"},
+			want: map[string]string{"real_world_app_project_id": "proj-1"},
 		},
 	}
 
@@ -4322,14 +5840,14 @@ func TestHandleSessionGetMetadataFiltered(t *testing.T) {
 
 	info := createTestSession(t, fs.cityBeadStore, fs.sp, "Test")
 
-	// Set metadata with both mc_ and internal keys.
+	// Set metadata with both real_world_app_ and internal keys.
 	if err := fs.cityBeadStore.SetMetadataBatch(info.ID, map[string]string{
-		"mc_project_id":  "proj-1",
-		"session_key":    "secret-key",
-		"command":        "claude --skip",
-		"work_dir":       "/private/dir",
-		"sleep_reason":   "",
-		"mc_custom_mode": "plan",
+		"real_world_app_project_id":  "proj-1",
+		"session_key":                "secret-key",
+		"command":                    "claude --skip",
+		"work_dir":                   "/private/dir",
+		"sleep_reason":               "",
+		"real_world_app_custom_mode": "plan",
 	}); err != nil {
 		t.Fatalf("set metadata: %v", err)
 	}
@@ -4347,15 +5865,15 @@ func TestHandleSessionGetMetadataFiltered(t *testing.T) {
 		t.Fatalf("decode: %v", err)
 	}
 
-	// Only mc_ prefixed keys should be present.
+	// Only real_world_app_ prefixed keys should be present.
 	if len(resp.Metadata) != 2 {
 		t.Fatalf("got %d metadata keys, want 2: %v", len(resp.Metadata), resp.Metadata)
 	}
-	if resp.Metadata["mc_project_id"] != "proj-1" {
-		t.Errorf("mc_project_id = %q, want %q", resp.Metadata["mc_project_id"], "proj-1")
+	if resp.Metadata["real_world_app_project_id"] != "proj-1" {
+		t.Errorf("real_world_app_project_id = %q, want %q", resp.Metadata["real_world_app_project_id"], "proj-1")
 	}
-	if resp.Metadata["mc_custom_mode"] != "plan" {
-		t.Errorf("mc_custom_mode = %q, want %q", resp.Metadata["mc_custom_mode"], "plan")
+	if resp.Metadata["real_world_app_custom_mode"] != "plan" {
+		t.Errorf("real_world_app_custom_mode = %q, want %q", resp.Metadata["real_world_app_custom_mode"], "plan")
 	}
 	// Internal keys must NOT be present.
 	if _, ok := resp.Metadata["session_key"]; ok {
@@ -4401,3 +5919,125 @@ func TestSessionToResponse_BaseOnlyDescendant_InheritsDisplayName(t *testing.T)
 		t.Errorf("DisplayName = %q, want %q (inherited)", resp.DisplayName, "Codex CLI")
 	}
 }
+
+func TestHandleSessionStopReturnsOKWithID(t *testing.T) {
+	fs := newSessionFakeState(t)
+	h := newTestCityHandler(t, fs)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "stop-test")
+
+	rec := httptest.NewRecorder()
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/stop", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("stop status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	var body struct {
+		Status string `json:"status"`
+		ID     string `json:"id"`
+	}
+	json.NewDecoder(rec.Body).Decode(&body) //nolint:errcheck
+	if body.ID != info.ID {
+		t.Errorf("stop response id = %q, want %q", body.ID, info.ID)
+	}
+	if body.Status != "ok" {
+		t.Errorf("stop response status = %q, want %q", body.Status, "ok")
+	}
+}
+
+func TestHandleSessionKillReturnsOKWithID(t *testing.T) {
+	fs := newSessionFakeState(t)
+	h := newTestCityHandler(t, fs)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "kill-test")
+
+	rec := httptest.NewRecorder()
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/kill", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("kill status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	var body struct {
+		Status string `json:"status"`
+		ID     string `json:"id"`
+	}
+	json.NewDecoder(rec.Body).Decode(&body) //nolint:errcheck
+	if body.ID != info.ID {
+		t.Errorf("kill response id = %q, want %q", body.ID, info.ID)
+	}
+	if body.Status != "ok" {
+		t.Errorf("kill response status = %q, want %q", body.Status, "ok")
+	}
+}
+
+func TestHandleSessionKillClosedSessionIsOK(t *testing.T) {
+	fs := newSessionFakeState(t)
+	h := newTestCityHandler(t, fs)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "kill-closed-test")
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	if err := mgr.Close(info.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	rec := httptest.NewRecorder()
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/kill", nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("kill closed status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	var body struct {
+		Status string `json:"status"`
+		ID     string `json:"id"`
+	}
+	json.NewDecoder(rec.Body).Decode(&body) //nolint:errcheck
+	if body.ID != info.ID {
+		t.Errorf("kill closed response id = %q, want %q", body.ID, info.ID)
+	}
+	if body.Status != "ok" {
+		t.Errorf("kill closed response status = %q, want %q", body.Status, "ok")
+	}
+}
+
+func TestHandleSessionKillNotFound(t *testing.T) {
+	fs := newSessionFakeState(t)
+	h := newTestCityHandler(t, fs)
+
+	rec := httptest.NewRecorder()
+	req := newPostRequest(cityURL(fs, "/session/nonexistent/kill"), nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("kill nonexistent status = %d, want %d; body: %s", rec.Code, http.StatusNotFound, rec.Body.String())
+	}
+}
+
+func TestHandleSessionMessageQueuesWhenSuspended(t *testing.T) {
+	fs := newSessionFakeState(t)
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	info := createTestSession(t, fs.cityBeadStore, fs.sp, "queue-test")
+	mgr := session.NewManager(fs.cityBeadStore, fs.sp)
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+
+	req := newPostRequest(cityURL(fs, "/session/")+info.ID+"/messages", strings.NewReader(`{"message":"hello after suspend"}`))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusAccepted {
+		t.Fatalf("suspended message status = %d, want %d; body: %s", w.Code, http.StatusAccepted, w.Body.String())
+	}
+
+	body := decodeAsyncAccepted(t, w.Body)
+
+	success, failure := waitForSessionMessageResult(t, fs.eventProv, body.RequestID)
+	if success == nil {
+		t.Fatalf("session message failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
+	}
+}
diff --git a/internal/api/handler_sling.go b/internal/api/handler_sling.go
index 5c1e3acc3b..524042fa74 100644
--- a/internal/api/handler_sling.go
+++ b/internal/api/handler_sling.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/execenv"
 	"github.com/gastownhall/gascity/internal/sling"
 	"github.com/gastownhall/gascity/internal/sourceworkflow"
 )
@@ -89,10 +90,13 @@ func (s *Server) execSling(ctx context.Context, body slingBody, _ string) (*slin
 			return s.sourceWorkflowStores(), nil
 		},
 		Runner:   s.slingRunner(),
+		Router:   apiBeadRouter{server: s, store: store},
 		Resolver: apiAgentResolver{},
 		Branches: apiBranchResolver{cityPath: s.state.CityPath()},
 		Notify:   &apiNotifier{state: s.state},
-		Stderr:   apiSlingStderr(),
+		Tracer: func(format string, args ...any) {
+			fmt.Fprintf(apiSlingStderr(), format+"\n", args...) //nolint:errcheck
+		},
 	}
 	sl, err := sling.New(deps)
 	if err != nil {
@@ -190,7 +194,7 @@ func (s *Server) execSling(ctx context.Context, body slingBody, _ string) (*slin
 	if resp.WorkflowID == "" && resp.RootBeadID == "" {
 		return nil, http.StatusInternalServerError, "internal", "sling did not produce a workflow or bead id", nil
 	}
-	return resp, http.StatusCreated, "", "", nil
+	return resp, http.StatusOK, "", "", nil
 }
 
 func allowsForceStoreFallback(body slingBody, agentCfg config.Agent) bool {
@@ -266,14 +270,15 @@ func (s *Server) slingStoreScopeForBead(beadID string) (rigName string, cityScop
 	if beadID == "" {
 		return "", false
 	}
-	prefix := sling.BeadPrefix(beadID)
+	cfg := s.state.Config()
+	prefix := sling.BeadPrefixForCity(cfg, beadID)
 	if prefix == "" {
 		return "", false
 	}
-	if sling.IsHQPrefix(s.state.Config(), prefix) {
+	if sling.IsHQPrefix(cfg, prefix) {
 		return "", true
 	}
-	rig, ok := sling.FindRigByPrefix(s.state.Config(), prefix)
+	rig, ok := sling.FindRigByPrefix(cfg, prefix)
 	if !ok {
 		return "", false
 	}
@@ -313,9 +318,7 @@ func (s *Server) slingRunner() sling.SlingRunner {
 		if dir != "" {
 			cmd.Dir = dir
 		}
-		if len(env) > 0 {
-			cmd.Env = mergeEnvForSling(env)
-		}
+		cmd.Env = mergeEnvForSling(env)
 		out, err := cmd.CombinedOutput()
 		if err != nil {
 			return string(out), fmt.Errorf("running %q: %w", command, err)
@@ -326,13 +329,7 @@ func (s *Server) slingRunner() sling.SlingRunner {
 
 // mergeEnvForSling merges extra env vars into the current process env.
 func mergeEnvForSling(extra map[string]string) []string {
-	base := os.Environ()
-	merged := make([]string, 0, len(base)+len(extra))
-	merged = append(merged, base...)
-	for k, v := range extra {
-		merged = append(merged, k+"="+v)
-	}
-	return merged
+	return execenv.MergeMap(os.Environ(), extra)
 }
 
 // apiAgentResolver implements sling.AgentResolver for the API context.
@@ -407,3 +404,39 @@ func (n *apiNotifier) PokeController(_ string) {
 func (n *apiNotifier) PokeControlDispatch(_ string) {
 	n.state.Poke()
 }
+
+type apiBeadRouter struct {
+	server *Server
+	store  beads.Store
+}
+
+func (r apiBeadRouter) Route(_ context.Context, req sling.RouteRequest) error {
+	if r.server == nil {
+		return fmt.Errorf("sling router: missing server")
+	}
+	cfg := r.server.state.Config()
+	if cfg != nil {
+		if agentCfg, ok := findAgentByQualifiedTemplate(cfg, req.Target); ok && sling.IsCustomSlingQuery(agentCfg) {
+			runner := r.server.slingRunner()
+			if runner == nil {
+				return fmt.Errorf("custom sling_query requires a runner")
+			}
+			slingCmd, slingWarn := sling.BuildSlingCommandForAgent("sling_query", agentCfg.EffectiveSlingQuery(), req.BeadID, r.server.state.CityPath(), r.server.state.CityName(), agentCfg, cfg.Rigs)
+			if slingWarn != "" {
+				fmt.Fprintf(apiSlingStderr(), "gc api sling: %s\n", slingWarn) //nolint:errcheck
+			}
+			_, err := runner(req.WorkDir, slingCmd, req.Env)
+			return err
+		}
+	}
+	if r.store == nil {
+		return fmt.Errorf("built-in sling routing requires a store")
+	}
+	if err := r.store.SetMetadata(req.BeadID, "gc.routed_to", req.Target); err != nil {
+		if req.Force && errors.Is(err, beads.ErrNotFound) {
+			return nil
+		}
+		return fmt.Errorf("setting gc.routed_to on %s: %w", req.BeadID, err)
+	}
+	return nil
+}
diff --git a/internal/api/handler_sling_test.go b/internal/api/handler_sling_test.go
index 82949689dd..5b758dbc61 100644
--- a/internal/api/handler_sling_test.go
+++ b/internal/api/handler_sling_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/formula"
+	"github.com/gastownhall/gascity/internal/formulatest"
 	"github.com/gastownhall/gascity/internal/molecule"
 )
 
@@ -47,12 +48,10 @@ func TestNewSyncsFormulaV2FeatureFlags(t *testing.T) {
 	state := newFakeMutatorState(t)
 	state.cfg.Daemon.FormulaV2 = true
 
-	prevFormulaV2 := formula.IsFormulaV2Enabled()
+	formulatest.SetV2ForTest(t, false)
 	prevGraphApply := molecule.IsGraphApplyEnabled()
-	formula.SetFormulaV2Enabled(false)
 	molecule.SetGraphApplyEnabled(false)
 	t.Cleanup(func() {
-		formula.SetFormulaV2Enabled(prevFormulaV2)
 		molecule.SetGraphApplyEnabled(prevGraphApply)
 	})
 
@@ -92,6 +91,13 @@ func TestSlingWithBead(t *testing.T) {
 	if resp["mode"] != "direct" {
 		t.Fatalf("mode = %q, want %q", resp["mode"], "direct")
 	}
+	updated, err := store.Get(b.ID)
+	if err != nil {
+		t.Fatalf("Get(%q): %v", b.ID, err)
+	}
+	if got := updated.Metadata["gc.routed_to"]; got != "myrig/worker" {
+		t.Fatalf("gc.routed_to = %q, want myrig/worker", got)
+	}
 }
 
 func TestSlingWithMissingBeadReturnsBadRequest(t *testing.T) {
@@ -567,19 +573,19 @@ func TestSlingConflictReturns409ForExistingLiveWorkflow(t *testing.T) {
 	//      which is default-false out of newFakeMutatorState.
 	//   2. We then set state.cfg.Daemon.FormulaV2 = true for reads that go
 	//      through config (handler-level checks).
-	//   3. The global flag is what formula compile calls, so we call
-	//      formula.SetFormulaV2Enabled(true) AFTER newSlingTestServer so
-	//      New()'s syncFeatureFlags doesn't stomp it back to false.
-	prevFormulaV2 := formula.IsFormulaV2Enabled()
+	//   3. The compile-time flag is process-global, so this test holds the
+	//      shared formulatest guard and flips it to true AFTER
+	//      newSlingTestServer so New()'s syncFeatureFlags doesn't stomp it
+	//      back to false.
+	setFormulaV2 := formulatest.LockV2ForTest(t)
 	prevGraphApply := molecule.IsGraphApplyEnabled()
 	t.Cleanup(func() {
-		formula.SetFormulaV2Enabled(prevFormulaV2)
 		molecule.SetGraphApplyEnabled(prevGraphApply)
 	})
 
 	srv, state := newSlingTestServer(t)
 	state.cfg.Daemon.FormulaV2 = true
-	formula.SetFormulaV2Enabled(true)
+	setFormulaV2(true)
 	molecule.SetGraphApplyEnabled(true)
 	formulaDir := t.TempDir()
 	state.cfg.FormulaLayers.City = []string{formulaDir}
diff --git a/internal/api/handler_status.go b/internal/api/handler_status.go
index a44f754d8b..d31d396578 100644
--- a/internal/api/handler_status.go
+++ b/internal/api/handler_status.go
@@ -3,10 +3,13 @@ package api
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
-	"github.com/gastownhall/gascity/internal/worker"
+	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/session"
+	workdirutil "github.com/gastownhall/gascity/internal/workdir"
 )
 
 // statusResponse is the JSON body for GET /v0/status.
@@ -50,28 +53,35 @@ func (s *Server) humaHandleStatus(ctx context.Context, input *StatusInput) (*Ind
 func (s *Server) buildStatusBody() StatusBody {
 	cfg := s.state.Config()
 	sp := s.state.SessionProvider()
-	store := s.state.CityBeadStore()
 	cityName := s.state.CityName()
 	sessTmpl := cfg.Workspace.SessionTemplate
+	sessionSnapshot := s.statusSessionSnapshot()
+	partialErrors := append([]string(nil), sessionSnapshot.partialErrors...)
 
 	// Count agents by state.
 	var ac agentCounts
 	var rawRunning int
+	rigAgentCounts := make(map[string]int)
+	rigSuspendedCounts := make(map[string]int)
 	for _, a := range cfg.Agents {
-		for _, ea := range expandAgent(a, cityName, sessTmpl, sp) {
+		rigName := workdirutil.ConfiguredRigName(s.state.CityPath(), a, cfg.Rigs)
+		for _, slot := range statusAgentSlots(a, cityName, sessTmpl, sessionSnapshot) {
 			ac.Total++
-			sessName := agentSessionName(cityName, ea.qualifiedName, sessTmpl)
-			handle, _ := s.workerHandleForSessionTarget(store, sessName)
-			obs, _ := worker.ObserveHandle(context.Background(), handle)
-			running := obs.Running
+			if rigName != "" {
+				rigAgentCounts[rigName]++
+			}
+			running := statusProviderRunning(sp, slot.sessionName)
 			if running {
 				rawRunning++
 			}
-			suspended := ea.suspended || obs.Suspended
+			suspended := a.Suspended || slot.suspended
+			if suspended && rigName != "" {
+				rigSuspendedCounts[rigName]++
+			}
 			switch {
 			case suspended:
 				ac.Suspended++
-			case s.state.IsQuarantined(sessName):
+			case s.state.IsQuarantined(slot.sessionName):
 				ac.Quarantined++
 			case running:
 				ac.Running++
@@ -82,7 +92,11 @@ func (s *Server) buildStatusBody() StatusBody {
 	// Count rigs by state.
 	rc := rigCounts{Total: len(cfg.Rigs)}
 	for _, rig := range cfg.Rigs {
-		if s.rigSuspended(cfg, rig, store, sp, cityName, s.state.CityPath()) {
+		if rig.Suspended {
+			rc.Suspended++
+			continue
+		}
+		if total := rigAgentCounts[rig.Name]; total > 0 && total == rigSuspendedCounts[rig.Name] {
 			rc.Suspended++
 		}
 	}
@@ -100,7 +114,10 @@ func (s *Server) buildStatusBody() StatusBody {
 		seenStores[key] = true
 		list, err := store.List(beads.ListQuery{AllowScan: true})
 		if err != nil {
-			continue
+			partialErrors = append(partialErrors, fmt.Sprintf("rig %s work: %v", rigName, err))
+			if !beads.IsPartialResult(err) || len(list) == 0 {
+				continue
+			}
 		}
 		for _, b := range list {
 			switch b.Type {
@@ -136,19 +153,146 @@ func (s *Server) buildStatusBody() StatusBody {
 	uptime := int(time.Since(s.state.StartedAt()).Seconds())
 
 	return StatusBody{
-		Name:       cityName,
-		Path:       s.state.CityPath(),
-		Version:    s.state.Version(),
-		UptimeSec:  uptime,
-		Suspended:  cfg.Workspace.Suspended,
-		AgentCount: ac.Total,
-		RigCount:   rc.Total,
-		Running:    rawRunning,
-		Agents:     ac,
-		Rigs:       rc,
-		Work:       wc,
-		Mail:       mc,
+		Name:          cityName,
+		Path:          s.state.CityPath(),
+		Version:       s.state.Version(),
+		UptimeSec:     uptime,
+		Suspended:     cfg.Workspace.Suspended,
+		AgentCount:    ac.Total,
+		RigCount:      rc.Total,
+		Running:       rawRunning,
+		Agents:        ac,
+		Rigs:          rc,
+		Work:          wc,
+		Mail:          mc,
+		Partial:       len(partialErrors) > 0,
+		PartialErrors: partialErrors,
+	}
+}
+
+type statusSessionSnapshot struct {
+	bySessionName map[string]statusSessionInfo
+	byTemplate    map[string][]statusSessionInfo
+	partialErrors []string
+}
+
+type statusSessionInfo struct {
+	sessionName string
+	template    string
+	state       session.State
+}
+
+type statusAgentSlot struct {
+	sessionName string
+	suspended   bool
+}
+
+func (s *Server) statusSessionSnapshot() statusSessionSnapshot {
+	snapshot := statusSessionSnapshot{
+		bySessionName: make(map[string]statusSessionInfo),
+		byTemplate:    make(map[string][]statusSessionInfo),
+	}
+	store := s.state.CityBeadStore()
+	if store == nil {
+		return snapshot
+	}
+
+	rows, partialErrors, err := sessionReadModelRows(store)
+	if err != nil {
+		snapshot.partialErrors = []string{fmt.Sprintf("sessions: %v", err)}
+		return snapshot
+	}
+	for _, partialErr := range partialErrors {
+		snapshot.partialErrors = append(snapshot.partialErrors, fmt.Sprintf("sessions: %s", partialErr))
+	}
+
+	seenSessionName := make(map[string]bool, len(rows))
+	for _, b := range rows {
+		if b.Status == "closed" {
+			continue
+		}
+		info := statusSessionInfo{
+			sessionName: strings.TrimSpace(b.Metadata["session_name"]),
+			template:    strings.TrimSpace(b.Metadata["template"]),
+			state:       statusSessionState(b),
+		}
+		if info.sessionName == "" {
+			continue
+		}
+		if info.state == session.StateArchived {
+			continue
+		}
+		if seenSessionName[info.sessionName] {
+			continue
+		}
+		seenSessionName[info.sessionName] = true
+		snapshot.bySessionName[info.sessionName] = info
+		if info.template != "" {
+			snapshot.byTemplate[info.template] = append(snapshot.byTemplate[info.template], info)
+		}
+	}
+	return snapshot
+}
+
+func statusSessionState(b beads.Bead) session.State {
+	state := session.State(strings.TrimSpace(b.Metadata["state"]))
+	switch state {
+	case "awake":
+		return session.StateActive
+	case "drained":
+		return session.StateAsleep
+	default:
+		return state
+	}
+}
+
+func statusAgentSlots(a config.Agent, cityName, sessTmpl string, snapshot statusSessionSnapshot) []statusAgentSlot {
+	maxSess := a.EffectiveMaxActiveSessions()
+	isMultiSession := maxSess == nil || *maxSess != 1
+	if isMultiSession && (maxSess == nil || *maxSess < 0) {
+		sessions := snapshot.byTemplate[a.QualifiedName()]
+		slots := make([]statusAgentSlot, 0, len(sessions))
+		for _, info := range sessions {
+			slots = append(slots, statusAgentSlot{
+				sessionName: info.sessionName,
+				suspended:   info.state == session.StateSuspended,
+			})
+		}
+		return slots
+	}
+
+	if !isMultiSession {
+		sessionName := agentSessionName(cityName, a.QualifiedName(), sessTmpl)
+		info, ok := snapshot.bySessionName[sessionName]
+		return []statusAgentSlot{{
+			sessionName: sessionName,
+			suspended:   ok && info.state == session.StateSuspended,
+		}}
+	}
+
+	poolMax := 1
+	if maxSess != nil && *maxSess > 1 {
+		poolMax = *maxSess
+	}
+	slots := make([]statusAgentSlot, 0, poolMax)
+	for i := 1; i <= poolMax; i++ {
+		memberName := poolInstanceNameForAPI(a.Name, i, a)
+		sessionName := agentSessionName(cityName, a.QualifiedInstanceName(memberName), sessTmpl)
+		info, ok := snapshot.bySessionName[sessionName]
+		slots = append(slots, statusAgentSlot{
+			sessionName: sessionName,
+			suspended:   ok && info.state == session.StateSuspended,
+		})
+	}
+	return slots
+}
+
+func statusProviderRunning(sp interface{ IsRunning(string) bool }, sessionName string) bool {
+	sessionName = strings.TrimSpace(sessionName)
+	if sp == nil || sessionName == "" {
+		return false
 	}
+	return sp.IsRunning(sessionName)
 }
 
 // HealthInput is the Huma input for GET /v0/city/{cityName}/health.
diff --git a/internal/api/handler_status_test.go b/internal/api/handler_status_test.go
index 7e8921279b..ff12488f5e 100644
--- a/internal/api/handler_status_test.go
+++ b/internal/api/handler_status_test.go
@@ -3,11 +3,14 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
+	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/session"
 )
 
 func TestHandleStatus(t *testing.T) {
@@ -83,6 +86,69 @@ func TestHandleStatusEnriched(t *testing.T) {
 	}
 }
 
+func TestHandleStatusPreservesPartialWorkCountSurvivors(t *testing.T) {
+	state := newFakeState(t)
+	store := beads.NewMemStore()
+	open, err := store.Create(beads.Bead{Type: "task", Title: "open survivor", Status: "open"})
+	if err != nil {
+		t.Fatalf("Create(open): %v", err)
+	}
+	ready, err := store.Create(beads.Bead{Type: "task", Title: "ready survivor", Status: "ready"})
+	if err != nil {
+		t.Fatalf("Create(ready): %v", err)
+	}
+	readyStatus := "ready"
+	if err := store.Update(ready.ID, beads.UpdateOpts{Status: &readyStatus}); err != nil {
+		t.Fatalf("Update(ready): %v", err)
+	}
+	ready, err = store.Get(ready.ID)
+	if err != nil {
+		t.Fatalf("Get(ready): %v", err)
+	}
+	inProgress, err := store.Create(beads.Bead{Type: "task", Title: "claimed survivor", Status: "in_progress"})
+	if err != nil {
+		t.Fatalf("Create(in_progress): %v", err)
+	}
+	inProgressStatus := "in_progress"
+	if err := store.Update(inProgress.ID, beads.UpdateOpts{Status: &inProgressStatus}); err != nil {
+		t.Fatalf("Update(in_progress): %v", err)
+	}
+	inProgress, err = store.Get(inProgress.ID)
+	if err != nil {
+		t.Fatalf("Get(in_progress): %v", err)
+	}
+	state.stores["myrig"] = &failingBeadStore{
+		Store:      store,
+		listResult: []beads.Bead{open, ready, inProgress},
+		listErr: &beads.PartialResultError{
+			Op:  "bd list",
+			Err: errors.New("skipped 1 corrupt bead"),
+		},
+	}
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Work.Open != 1 || resp.Work.Ready != 1 || resp.Work.InProgress != 1 {
+		t.Fatalf("Work = %+v, want partial survivors counted", resp.Work)
+	}
+	if !resp.Partial {
+		t.Fatalf("Partial = false, want true for partial work count")
+	}
+	if len(resp.PartialErrors) == 0 {
+		t.Fatalf("PartialErrors empty")
+	}
+}
+
 func TestHandleHealth(t *testing.T) {
 	state := newFakeState(t)
 	h := newTestCityHandler(t, state)
@@ -133,3 +199,300 @@ func TestHandleStatus_Suspended(t *testing.T) {
 		t.Error("expected suspended=true in status response")
 	}
 }
+
+func TestHandleStatusUsesCachedSessionStateForSuspendedAgents(t *testing.T) {
+	state := newFakeState(t)
+	store := beads.NewMemStore()
+	state.cityBeadStore = store
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateSuspended),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker",
+		},
+	}); err != nil {
+		t.Fatalf("Create session bead: %v", err)
+	}
+	if err := state.sp.Start(context.Background(), "myrig--worker", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	state.sp.Calls = nil
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Agents.Suspended != 1 {
+		t.Fatalf("Agents.Suspended = %d, want 1", resp.Agents.Suspended)
+	}
+	if resp.Agents.Running != 0 {
+		t.Fatalf("Agents.Running = %d, want 0 for suspended session", resp.Agents.Running)
+	}
+	if resp.Running != 1 {
+		t.Fatalf("Running = %d, want raw liveness count 1", resp.Running)
+	}
+}
+
+func TestHandleStatusUsesPartialSessionRows(t *testing.T) {
+	state := newFakeState(t)
+	store := &partialPrimeSessionStore{MemStore: beads.NewMemStore()}
+	state.cityBeadStore = store
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateSuspended),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session bead: %v", err)
+	}
+	store.partialRows = []beads.Bead{sessionBead}
+	if err := state.sp.Start(context.Background(), "myrig--worker", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Agents.Suspended != 1 {
+		t.Fatalf("Agents.Suspended = %d, want partial survivor to mark session suspended", resp.Agents.Suspended)
+	}
+	if resp.Agents.Running != 0 {
+		t.Fatalf("Agents.Running = %d, want 0 for suspended partial survivor", resp.Agents.Running)
+	}
+	if resp.Running != 1 {
+		t.Fatalf("Running = %d, want raw liveness count 1", resp.Running)
+	}
+	if !resp.Partial {
+		t.Fatalf("Partial = false, want true for partial session snapshot")
+	}
+	if len(resp.PartialErrors) == 0 {
+		t.Fatalf("PartialErrors empty")
+	}
+}
+
+func TestHandleStatusUsesNewestSessionBeadForDuplicateSessionName(t *testing.T) {
+	state := newFakeState(t)
+	store := beads.NewMemStore()
+	state.cityBeadStore = store
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateSuspended),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker",
+		},
+	}); err != nil {
+		t.Fatalf("Create old session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateActive),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker",
+		},
+	}); err != nil {
+		t.Fatalf("Create new session bead: %v", err)
+	}
+	if err := state.sp.Start(context.Background(), "myrig--worker", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Agents.Suspended != 0 {
+		t.Fatalf("Agents.Suspended = %d, want 0 from newest active bead", resp.Agents.Suspended)
+	}
+	if resp.Agents.Running != 1 {
+		t.Fatalf("Agents.Running = %d, want 1", resp.Agents.Running)
+	}
+}
+
+func TestHandleStatusUnlimitedPoolUsesOpenNonArchivedSessionBeads(t *testing.T) {
+	state := newFakeState(t)
+	state.cfg.Agents[0].MaxActiveSessions = intPtr(-1)
+	store := beads.NewMemStore()
+	state.cityBeadStore = store
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateActive),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker-1",
+		},
+	}); err != nil {
+		t.Fatalf("Create active session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateSuspended),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker-2",
+		},
+	}); err != nil {
+		t.Fatalf("Create suspended session bead: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateArchived),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker-3",
+		},
+	}); err != nil {
+		t.Fatalf("Create archived session bead: %v", err)
+	}
+	if err := state.sp.Start(context.Background(), "myrig--worker-1", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Agents.Total != 2 {
+		t.Fatalf("Agents.Total = %d, want 2 non-archived unlimited-pool slots", resp.Agents.Total)
+	}
+	if resp.Agents.Running != 1 {
+		t.Fatalf("Agents.Running = %d, want 1", resp.Agents.Running)
+	}
+	if resp.Agents.Suspended != 1 {
+		t.Fatalf("Agents.Suspended = %d, want 1", resp.Agents.Suspended)
+	}
+}
+
+func TestHandleStatusBoundedPoolUsesCachedSessionState(t *testing.T) {
+	state := newFakeState(t)
+	state.cfg.Agents[0].MaxActiveSessions = intPtr(2)
+	store := beads.NewMemStore()
+	state.cityBeadStore = store
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Status: "open",
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"state":        string(session.StateSuspended),
+			"template":     "myrig/worker",
+			"session_name": "myrig--worker-2",
+		},
+	}); err != nil {
+		t.Fatalf("Create suspended pool session bead: %v", err)
+	}
+	if err := state.sp.Start(context.Background(), "myrig--worker-1", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Agents.Total != 2 {
+		t.Fatalf("Agents.Total = %d, want 2 bounded pool slots", resp.Agents.Total)
+	}
+	if resp.Agents.Running != 1 {
+		t.Fatalf("Agents.Running = %d, want 1", resp.Agents.Running)
+	}
+	if resp.Agents.Suspended != 1 {
+		t.Fatalf("Agents.Suspended = %d, want 1", resp.Agents.Suspended)
+	}
+}
+
+func TestHandleStatusOnlyUsesProviderLiveness(t *testing.T) {
+	state := newFakeState(t)
+	if err := state.sp.Start(context.Background(), "myrig--worker", runtime.Config{}); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if err := state.sp.SetMeta("myrig--worker", "suspended", "true"); err != nil {
+		t.Fatalf("SetMeta: %v", err)
+	}
+	state.sp.SetAttached("myrig--worker", true)
+	state.sp.SetActivity("myrig--worker", state.startedAt)
+	state.sp.Calls = nil
+	h := newTestCityHandler(t, state)
+
+	req := httptest.NewRequest("GET", cityURL(state, "/status"), nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	for _, call := range state.sp.Calls {
+		switch call.Method {
+		case "ProcessAlive", "IsAttached", "GetLastActivity", "GetMeta", "ListRunning":
+			t.Fatalf("/status called provider %s for %q; calls=%#v", call.Method, call.Name, state.sp.Calls)
+		}
+	}
+	var resp statusResponse
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Agents.Running != 1 {
+		t.Fatalf("Agents.Running = %d, want 1", resp.Agents.Running)
+	}
+	if resp.Running != 1 {
+		t.Fatalf("Running = %d, want 1", resp.Running)
+	}
+}
diff --git a/internal/api/helpers.go b/internal/api/helpers.go
index b159a0ee2e..12cea3af13 100644
--- a/internal/api/helpers.go
+++ b/internal/api/helpers.go
@@ -5,9 +5,11 @@ package api
 // fixtures) and by the agents-cache envelope. Huma handlers use
 // ListOutput[T] / ListBody[T] instead.
 type listResponse struct {
-	Items      any    `json:"items"`
-	Total      int    `json:"total"`
-	NextCursor string `json:"next_cursor,omitempty"`
+	Items         any      `json:"items"`
+	Total         int      `json:"total"`
+	NextCursor    string   `json:"next_cursor,omitempty"`
+	Partial       bool     `json:"partial,omitempty"`
+	PartialErrors []string `json:"partial_errors,omitempty"`
 }
 
 // latestIndex returns the latest event sequence, or 0 if unavailable.
diff --git a/internal/api/huma_handlers_agents.go b/internal/api/huma_handlers_agents.go
index 26c3b02b81..c62e242014 100644
--- a/internal/api/huma_handlers_agents.go
+++ b/internal/api/huma_handlers_agents.go
@@ -2,6 +2,9 @@ package api
 
 import (
 	"context"
+	"errors"
+	"log"
+	"net/http"
 	"strings"
 	"time"
 
@@ -236,7 +239,7 @@ func (s *Server) agentByName(name string) (*IndexOutput[agentResponse], error) {
 // humaHandleAgentCreate is the Huma-typed handler for POST /v0/agents.
 // Body validation (Name and Provider required with minLength:"1") is
 // enforced by the framework from AgentCreateInput's struct tags.
-func (s *Server) humaHandleAgentCreate(_ context.Context, input *AgentCreateInput) (*AgentCreatedOutput, error) {
+func (s *Server) humaHandleAgentCreate(ctx context.Context, input *AgentCreateInput) (*AgentCreatedOutput, error) {
 	sm, ok := s.state.(StateMutator)
 	if !ok {
 		return nil, errMutationsNotSupported
@@ -252,12 +255,42 @@ func (s *Server) humaHandleAgentCreate(_ context.Context, input *AgentCreateInpu
 	if err := sm.CreateAgent(a); err != nil {
 		return nil, mutationError(err)
 	}
+	// Block until the new agent is reachable through findAgent, so the
+	// 201 response is a strict read-after-write signal: a follow-up
+	// POST /sling against the same target will not race a stale runtime
+	// config snapshot. This is intentionally scoped to agents because sling
+	// target resolution reads the agent projection immediately after create.
+	qualifiedName := a.QualifiedName()
+	if waiter, ok := s.state.(AgentVisibilityWaiter); ok {
+		waitCtx, cancel := context.WithTimeout(ctx, s.agentCreateVisibilityWaitTimeout())
+		err := waiter.WaitForAgentVisibility(waitCtx, qualifiedName)
+		cancel()
+		if err != nil {
+			log.Printf("api: agent %s visibility confirmation failed after create: %v", qualifiedName, err)
+			return nil, agentVisibilityWaitHTTPError(err)
+		}
+	}
 	resp := &AgentCreatedOutput{}
 	resp.Body.Status = "created"
-	resp.Body.Agent = a.QualifiedName()
+	resp.Body.Agent = qualifiedName
 	return resp, nil
 }
 
+func agentVisibilityWaitHTTPError(err error) error {
+	switch {
+	case errors.Is(err, context.Canceled):
+		return agentVisibilityRetryableError(huma.Error503ServiceUnavailable("agent was created, but visibility confirmation was canceled"))
+	case errors.Is(err, context.DeadlineExceeded):
+		return agentVisibilityRetryableError(huma.Error504GatewayTimeout("agent was created, but visibility was not confirmed before timeout"))
+	default:
+		return huma.Error500InternalServerError("agent was created, but visibility confirmation failed")
+	}
+}
+
+func agentVisibilityRetryableError(err error) error {
+	return huma.ErrorWithHeaders(err, http.Header{"Retry-After": []string{"1"}})
+}
+
 // humaHandleAgentUpdate is the Huma-typed handler for
 // PATCH /v0/city/{cityName}/agent/{base}.
 func (s *Server) humaHandleAgentUpdate(_ context.Context, input *AgentUpdateInput) (*OKResponse, error) {
@@ -503,6 +536,7 @@ func (s *Server) doStreamAgentOutput(hctx huma.Context, name string, send sse.Se
 	if !state.running {
 		hctx.SetHeader("GC-Agent-Status", "stopped")
 	}
+	flushSSEHeaders(hctx)
 	ctx := hctx.Context()
 	workerOps := s.watchAgentWorkerOperationSignals(ctx, state.name, state.cfg)
 	if state.logPath != "" {
diff --git a/internal/api/huma_handlers_beads.go b/internal/api/huma_handlers_beads.go
index f64461eb22..2ed3df9d41 100644
--- a/internal/api/huma_handlers_beads.go
+++ b/internal/api/huma_handlers_beads.go
@@ -58,10 +58,16 @@ func (s *Server) humaHandleBeadList(ctx context.Context, input *BeadListInput) (
 			pa.attempt()
 			list, err := store.List(query)
 			if err != nil {
-				pa.record("rig "+rigName, err)
-				continue
+				if beads.IsPartialResult(err) && len(list) > 0 {
+					pa.record("rig "+rigName, err)
+					pa.success()
+				} else {
+					pa.record("rig "+rigName, err)
+					continue
+				}
+			} else {
+				pa.success()
 			}
-			pa.success()
 			for _, b := range list {
 				dedupeKey := rigName + "\x00" + b.ID
 				if dedupe && seen[dedupeKey] {
@@ -130,10 +136,16 @@ func (s *Server) humaHandleBeadReady(ctx context.Context, input *BeadReadyInput)
 		pa.attempt()
 		ready, err := beads.ReadyLive(stores[rigName])
 		if err != nil {
-			pa.record("rig "+rigName, err)
-			continue
+			if beads.IsPartialResult(err) && len(ready) > 0 {
+				pa.record("rig "+rigName, err)
+				pa.success()
+			} else {
+				pa.record("rig "+rigName, err)
+				continue
+			}
+		} else {
+			pa.success()
 		}
-		pa.success()
 		all = append(all, ready...)
 	}
 	if pa.totalOutage() {
@@ -330,12 +342,18 @@ func (s *Server) humaHandleBeadCreate(ctx context.Context, input *BeadCreateInpu
 func (s *Server) humaHandleBeadClose(_ context.Context, input *BeadCloseInput) (*OKResponse, error) {
 	id := input.ID
 	for _, store := range s.beadStoresForID(id) {
-		if err := store.Close(id); err != nil {
+		if _, err := store.Get(id); err != nil {
 			if errors.Is(err, beads.ErrNotFound) {
 				continue
 			}
 			return nil, huma.Error500InternalServerError(err.Error())
 		}
+		if err := store.Close(id); err != nil {
+			if errors.Is(err, beads.ErrNotFound) {
+				return nil, huma.Error409Conflict("conflict: bead " + id + " was deleted concurrently")
+			}
+			return nil, huma.Error500InternalServerError(err.Error())
+		}
 		resp := &OKResponse{}
 		resp.Body.Status = "closed"
 		return resp, nil
@@ -346,7 +364,6 @@ func (s *Server) humaHandleBeadClose(_ context.Context, input *BeadCloseInput) (
 // humaHandleBeadReopen is the Huma-typed handler for POST /v0/bead/{id}/reopen.
 func (s *Server) humaHandleBeadReopen(_ context.Context, input *BeadReopenInput) (*OKResponse, error) {
 	id := input.ID
-	status := "open"
 
 	for _, store := range s.beadStoresForID(id) {
 		b, err := store.Get(id)
@@ -359,7 +376,7 @@ func (s *Server) humaHandleBeadReopen(_ context.Context, input *BeadReopenInput)
 		if b.Status != "closed" {
 			return nil, huma.Error409Conflict("conflict: bead " + id + " is not closed (status: " + b.Status + ")")
 		}
-		if err := store.Update(id, beads.UpdateOpts{Status: &status}); err != nil {
+		if err := store.Reopen(id); err != nil {
 			return nil, huma.Error500InternalServerError(err.Error())
 		}
 		resp := &OKResponse{}
@@ -435,7 +452,8 @@ func (s *Server) humaHandleBeadUpdate(ctx context.Context, input *BeadUpdateInpu
 	}
 
 	for _, store := range s.beadStoresForID(id) {
-		if _, err := store.Get(id); err != nil {
+		current, err := store.Get(id)
+		if err != nil {
 			if errors.Is(err, beads.ErrNotFound) {
 				continue
 			}
@@ -448,6 +466,10 @@ func (s *Server) humaHandleBeadUpdate(ctx context.Context, input *BeadUpdateInpu
 			}
 			opts.Assignee = &assignee
 		}
+		waitStatus := current.Status
+		if opts.Status != nil {
+			waitStatus = *opts.Status
+		}
 		// Once Get succeeded in this store, treat Update-ErrNotFound as a
 		// concurrent-delete race (409) rather than iterating to the next
 		// store — otherwise a delete racing with update silently applies
@@ -458,6 +480,16 @@ func (s *Server) humaHandleBeadUpdate(ctx context.Context, input *BeadUpdateInpu
 			}
 			return nil, huma.Error500InternalServerError(err.Error())
 		}
+		if opts.ParentID != nil && current.ParentID != *opts.ParentID && waitStatus != "closed" {
+			if waiter, ok := store.(beads.ParentProjectionWaiter); ok {
+				if err := waiter.WaitForParentProjection(ctx, id, current.ParentID, *opts.ParentID); err != nil {
+					if errors.Is(err, beads.ErrParentProjectionSuperseded) {
+						return nil, huma.Error409Conflict("conflict: bead " + id + " was reparented concurrently")
+					}
+					return nil, huma.Error500InternalServerError(err.Error())
+				}
+			}
+		}
 		resp := &OKResponse{}
 		resp.Body.Status = "updated"
 		return resp, nil
@@ -472,12 +504,18 @@ func (s *Server) humaHandleBeadUpdate(ctx context.Context, input *BeadUpdateInpu
 func (s *Server) humaHandleBeadDelete(_ context.Context, input *BeadDeleteInput) (*OKResponse, error) {
 	id := input.ID
 	for _, store := range s.beadStoresForID(id) {
-		if err := store.Close(id); err != nil {
+		if _, err := store.Get(id); err != nil {
 			if errors.Is(err, beads.ErrNotFound) {
 				continue
 			}
 			return nil, huma.Error500InternalServerError(err.Error())
 		}
+		if err := store.Close(id); err != nil {
+			if errors.Is(err, beads.ErrNotFound) {
+				return nil, huma.Error409Conflict("conflict: bead " + id + " was deleted concurrently")
+			}
+			return nil, huma.Error500InternalServerError(err.Error())
+		}
 		resp := &OKResponse{}
 		resp.Body.Status = "closed"
 		return resp, nil
diff --git a/internal/api/huma_handlers_events.go b/internal/api/huma_handlers_events.go
index 6151699804..9ab76f2559 100644
--- a/internal/api/huma_handlers_events.go
+++ b/internal/api/huma_handlers_events.go
@@ -138,12 +138,21 @@ func (s *Server) streamEvents(hctx huma.Context, input *EventStreamInput, send s
 	ctx := hctx.Context()
 	ep := s.state.EventProvider()
 	afterSeq := input.resolveAfterSeq()
+	if strings.TrimSpace(input.LastEventID) == "" && strings.TrimSpace(input.AfterSeq) == "" {
+		seq, err := ep.LatestSeq()
+		if err != nil {
+			log.Printf("api: events-stream: latest seq failed: %v", err)
+		} else {
+			afterSeq = seq
+		}
+	}
 	watcher, err := ep.Watch(ctx, afterSeq)
 	if err != nil {
 		log.Printf("api: events-stream: Watch failed after_seq=%d: %v", afterSeq, err)
 		return
 	}
 	defer watcher.Close() //nolint:errcheck
+	flushSSEHeaders(hctx)
 
 	keepalive := time.NewTicker(sseKeepalive)
 	defer keepalive.Stop()
diff --git a/internal/api/huma_handlers_formulas.go b/internal/api/huma_handlers_formulas.go
index 9cc0c5ab68..6f33927a95 100644
--- a/internal/api/huma_handlers_formulas.go
+++ b/internal/api/huma_handlers_formulas.go
@@ -13,6 +13,7 @@ import (
 // FormulaListBody is the response body for GET /v0/formulas.
 type FormulaListBody struct {
 	Items   []formulaSummaryResponse `json:"items" doc:"Formula summaries."`
+	Total   int                      `json:"total" doc:"Total number of formulas in the list."`
 	Partial bool                     `json:"partial" doc:"Whether the list is partial."`
 }
 
@@ -46,6 +47,7 @@ func (s *Server) humaHandleFormulaList(_ context.Context, input *FormulaListInpu
 
 	out := &FormulaListOutput{}
 	out.Body.Items = items
+	out.Body.Total = len(items)
 	out.Body.Partial = false
 	return out, nil
 }
diff --git a/internal/api/huma_handlers_mail.go b/internal/api/huma_handlers_mail.go
index 62cefe358e..69b315087c 100644
--- a/internal/api/huma_handlers_mail.go
+++ b/internal/api/huma_handlers_mail.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"strings"
+	"time"
 
 	"github.com/danielgtaylor/huma/v2"
 	"github.com/gastownhall/gascity/internal/beads"
@@ -263,7 +264,7 @@ func (s *Server) humaHandleMailSend(ctx context.Context, input *MailSendInput) (
 	}
 	msg.Rig = input.Body.Rig
 	s.idem.storeResponse(idemKey, bodyHash, msg)
-	s.recordMailEvent(events.MailSent, input.Body.From, msg.ID, input.Body.Rig, &msg)
+	s.recordMailEvent(events.MailSent, msg.From, msg.ID, input.Body.Rig, &msg)
 
 	return &IndexOutput[mail.Message]{
 		Index: s.latestIndex(),
@@ -372,7 +373,7 @@ func (s *Server) humaHandleMailThread(_ context.Context, input *MailThreadInput)
 }
 
 // humaHandleMailRead is the Huma-typed handler for POST /v0/mail/{id}/read.
-func (s *Server) humaHandleMailRead(_ context.Context, input *MailReadInput) (*OKResponse, error) {
+func (s *Server) humaHandleMailRead(ctx context.Context, input *MailReadInput) (*OKResponse, error) {
 	id := input.ID
 	rig := input.Rig
 	mp, resolvedRig, err := s.findMailProviderForMessage(id, rig)
@@ -385,6 +386,9 @@ func (s *Server) humaHandleMailRead(_ context.Context, input *MailReadInput) (*O
 	if err := mp.MarkRead(id); err != nil {
 		return nil, huma.Error500InternalServerError(err.Error())
 	}
+	if err := waitForMailReadState(ctx, mp, id, true); err != nil {
+		return nil, huma.Error500InternalServerError(err.Error())
+	}
 	s.recordMailEvent(events.MailMarkedRead, "api", id, resolvedRig, nil)
 	resp := &OKResponse{}
 	resp.Body.Status = "read"
@@ -392,7 +396,7 @@ func (s *Server) humaHandleMailRead(_ context.Context, input *MailReadInput) (*O
 }
 
 // humaHandleMailMarkUnread is the Huma-typed handler for POST /v0/mail/{id}/mark-unread.
-func (s *Server) humaHandleMailMarkUnread(_ context.Context, input *MailMarkUnreadInput) (*OKResponse, error) {
+func (s *Server) humaHandleMailMarkUnread(ctx context.Context, input *MailMarkUnreadInput) (*OKResponse, error) {
 	id := input.ID
 	rig := input.Rig
 	mp, resolvedRig, err := s.findMailProviderForMessage(id, rig)
@@ -405,12 +409,39 @@ func (s *Server) humaHandleMailMarkUnread(_ context.Context, input *MailMarkUnre
 	if err := mp.MarkUnread(id); err != nil {
 		return nil, huma.Error500InternalServerError(err.Error())
 	}
+	if err := waitForMailReadState(ctx, mp, id, false); err != nil {
+		return nil, huma.Error500InternalServerError(err.Error())
+	}
 	s.recordMailEvent(events.MailMarkedUnread, "api", id, resolvedRig, nil)
 	resp := &OKResponse{}
 	resp.Body.Status = "unread"
 	return resp, nil
 }
 
+func waitForMailReadState(ctx context.Context, mp mail.Provider, id string, want bool) error {
+	deadline := time.NewTimer(2 * time.Second)
+	defer deadline.Stop()
+	tick := time.NewTicker(20 * time.Millisecond)
+	defer tick.Stop()
+
+	for {
+		msg, err := mp.Get(id)
+		if err != nil {
+			return err
+		}
+		if msg.Read == want {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-deadline.C:
+			return errors.New("mail read state did not become visible")
+		case <-tick.C:
+		}
+	}
+}
+
 // humaHandleMailArchive is the Huma-typed handler for POST /v0/mail/{id}/archive.
 func (s *Server) humaHandleMailArchive(_ context.Context, input *MailArchiveInput) (*OKResponse, error) {
 	id := input.ID
@@ -449,7 +480,7 @@ func (s *Server) humaHandleMailReply(_ context.Context, input *MailReplyInput) (
 		return nil, huma.Error500InternalServerError(err.Error())
 	}
 	msg.Rig = resolvedRig
-	s.recordMailEvent(events.MailReplied, input.Body.From, msg.ID, resolvedRig, &msg)
+	s.recordMailEvent(events.MailReplied, msg.From, msg.ID, resolvedRig, &msg)
 
 	return &IndexOutput[mail.Message]{
 		Index: s.latestIndex(),
@@ -472,6 +503,11 @@ func (s *Server) humaHandleMailDelete(_ context.Context, input *MailDeleteInput)
 		if errors.Is(err, mail.ErrNotFound) || errors.Is(err, beads.ErrNotFound) {
 			return nil, huma.Error404NotFound("message " + id + " not found")
 		}
+		if errors.Is(err, mail.ErrAlreadyArchived) {
+			resp := &OKResponse{}
+			resp.Body.Status = "deleted"
+			return resp, nil
+		}
 		return nil, huma.Error500InternalServerError(err.Error())
 	}
 	s.recordMailEvent(events.MailDeleted, "api", id, resolvedRig, nil)
diff --git a/internal/api/huma_handlers_orders.go b/internal/api/huma_handlers_orders.go
index 75883376c8..7a1a72c264 100644
--- a/internal/api/huma_handlers_orders.go
+++ b/internal/api/huma_handlers_orders.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/danielgtaylor/huma/v2"
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/events"
 	"github.com/gastownhall/gascity/internal/orders"
 )
 
@@ -64,11 +65,20 @@ type OrderCheckListOutput struct {
 }
 
 // humaHandleOrderCheck is the Huma-typed handler for GET /v0/orders/check.
-func (s *Server) humaHandleOrderCheck(_ context.Context, _ *OrderCheckInput) (*OrderCheckListOutput, error) {
+func (s *Server) humaHandleOrderCheck(_ context.Context, input *OrderCheckInput) (*OrderCheckListOutput, error) {
 	aa := s.state.Orders()
 
 	ep := s.state.EventProvider()
 
+	index := s.latestIndex()
+	cacheKey := cacheKeyFor("orders-check", input)
+	useResponseCache := !input.Fresh && !hasConditionOrder(aa)
+	if useResponseCache {
+		if body, ok := cachedResponseAs[OrderCheckListBody](s, cacheKey, index); ok {
+			return &OrderCheckListOutput{Body: body}, nil
+		}
+	}
+
 	now := time.Now()
 	checks := make([]orderCheckResponse, 0, len(aa))
 	for _, a := range aa {
@@ -76,8 +86,8 @@ func (s *Server) humaHandleOrderCheck(_ context.Context, _ *OrderCheckInput) (*O
 		if err != nil {
 			storeInfos = nil
 		}
-		stores := storesFromWorkflowInfos(storeInfos)
-		result := orders.CheckTrigger(a, now, orders.LastRunAcrossStores(stores...), ep, orders.CursorAcrossStores(stores...))
+		history, _ := orderHistoryBeadsAcrossStoreInfosForCheck(storeInfos, a.ScopedName(), 1, time.Time{}, input.Fresh)
+		result := checkOrderTriggerForAPI(a, now, history, storeInfos, ep, input.Fresh)
 		cr := orderCheckResponse{
 			Name:       a.Name,
 			ScopedName: a.ScopedName(),
@@ -89,8 +99,8 @@ func (s *Server) humaHandleOrderCheck(_ context.Context, _ *OrderCheckInput) (*O
 			ts := result.LastRun.Format(time.RFC3339)
 			cr.LastRun = &ts
 		}
-		if results, err := orderHistoryBeadsAcrossStoreInfos(storeInfos, a.ScopedName(), 1, time.Time{}); err == nil && len(results) > 0 {
-			outcome := lastRunOutcomeFromLabels(results[0].bead.Labels)
+		if len(history) > 0 {
+			outcome := lastRunOutcomeFromLabels(history[0].bead.Labels)
 			if outcome != "" {
 				cr.LastRunOutcome = &outcome
 			}
@@ -104,9 +114,44 @@ func (s *Server) humaHandleOrderCheck(_ context.Context, _ *OrderCheckInput) (*O
 
 	out := &OrderCheckListOutput{}
 	out.Body.Checks = checks
+	if useResponseCache {
+		s.storeResponse(cacheKey, index, out.Body)
+	}
 	return out, nil
 }
 
+func hasConditionOrder(aa []orders.Order) bool {
+	for _, a := range aa {
+		if a.Trigger == "condition" {
+			return true
+		}
+	}
+	return false
+}
+
+func checkOrderTriggerForAPI(a orders.Order, now time.Time, history []orderHistoryStoreBead, infos []workflowStoreInfo, ep events.Provider, fresh bool) orders.TriggerResult {
+	lastRunFn := func(string) (time.Time, error) {
+		if len(history) == 0 {
+			return time.Time{}, nil
+		}
+		return history[0].bead.CreatedAt, nil
+	}
+	var cursorFn orders.CursorFunc
+	if a.Trigger == "event" {
+		if fresh {
+			cursorFn = orders.CursorAcrossStores(storesFromWorkflowInfos(infos)...)
+		} else {
+			labelSets := make([][]string, 0, len(history))
+			for _, row := range history {
+				labelSets = append(labelSets, row.bead.Labels)
+			}
+			cursor := orders.MaxSeqFromLabels(labelSets)
+			cursorFn = func(string) uint64 { return cursor }
+		}
+	}
+	return orders.CheckTrigger(a, now, lastRunFn, ep, cursorFn)
+}
+
 // orderCheckResponse is the response item for GET /v0/orders/check.
 type orderCheckResponse struct {
 	Name           string  `json:"name"`
@@ -212,7 +257,7 @@ func (s *Server) humaHandleOrderHistory(_ context.Context, input *OrderHistoryIn
 			}
 		}
 
-		entry.HasOutput = entry.CaptureOutput
+		entry.HasOutput = entry.CaptureOutput || orderRunHasOutput(b)
 
 		entries = append(entries, entry)
 		if len(entries) >= limit {
@@ -225,6 +270,13 @@ func (s *Server) humaHandleOrderHistory(_ context.Context, input *OrderHistoryIn
 	return out, nil
 }
 
+func orderRunHasOutput(b beads.Bead) bool {
+	if b.Metadata == nil {
+		return false
+	}
+	return b.Metadata["convergence.gate_stdout"] != "" || b.Metadata["convergence.gate_stderr"] != ""
+}
+
 // orderHistoryEntry is a single entry in the order history response.
 type orderHistoryEntry struct {
 	BeadID        string   `json:"bead_id"`
@@ -345,6 +397,74 @@ func storesFromWorkflowInfos(infos []workflowStoreInfo) []beads.Store {
 	return stores
 }
 
+func orderHistoryBeadsAcrossStoreInfosForCheck(infos []workflowStoreInfo, scopedName string, limit int, beforeTime time.Time, fresh bool) ([]orderHistoryStoreBead, error) {
+	if fresh {
+		return orderHistoryBeadsAcrossStoreInfos(infos, scopedName, limit, beforeTime)
+	}
+	return orderHistoryBeadsAcrossStoreInfosCachedFirst(infos, scopedName, limit, beforeTime)
+}
+
+func orderHistoryBeadsAcrossStoreInfosCachedFirst(infos []workflowStoreInfo, scopedName string, limit int, beforeTime time.Time) ([]orderHistoryStoreBead, error) {
+	if len(infos) == 0 {
+		return nil, errNoOrderStores
+	}
+
+	label := "order-run:" + scopedName
+	seen := make(map[string]bool)
+	results := make([]orderHistoryStoreBead, 0)
+	for i, info := range infos {
+		if info.store == nil {
+			continue
+		}
+		query := beads.ListQuery{
+			Label:         label,
+			CreatedBefore: beforeTime,
+			Limit:         limit,
+			IncludeClosed: true,
+			Sort:          beads.SortCreatedDesc,
+		}
+		var (
+			rows []beads.Bead
+			err  error
+		)
+		if cached, ok := info.store.(cachedListStore); ok {
+			var cacheOK bool
+			rows, cacheOK = cached.CachedList(query)
+			if !cacheOK {
+				rows, err = info.store.List(query)
+			}
+		} else {
+			rows, err = info.store.List(query)
+		}
+		if err != nil {
+			if i == 0 {
+				return nil, err
+			}
+			log.Printf("api: order history list failed for %s: %v", info.ref, err)
+			continue
+		}
+		for _, row := range rows {
+			if !beforeTime.IsZero() && !row.CreatedAt.Before(beforeTime) {
+				continue
+			}
+			key := info.ref + "\x00" + row.ID
+			if seen[key] {
+				continue
+			}
+			seen[key] = true
+			results = append(results, orderHistoryStoreBead{storeRef: info.ref, bead: row})
+		}
+	}
+
+	sort.SliceStable(results, func(i, j int) bool {
+		return results[i].bead.CreatedAt.After(results[j].bead.CreatedAt)
+	})
+	if limit > 0 && len(results) > limit {
+		results = results[:limit]
+	}
+	return results, nil
+}
+
 func orderHistoryBeadsAcrossStoreInfos(infos []workflowStoreInfo, scopedName string, limit int, beforeTime time.Time) ([]orderHistoryStoreBead, error) {
 	if len(infos) == 0 {
 		return nil, errNoOrderStores
diff --git a/internal/api/huma_handlers_rigs.go b/internal/api/huma_handlers_rigs.go
index fec52db8c6..ee88867128 100644
--- a/internal/api/huma_handlers_rigs.go
+++ b/internal/api/huma_handlers_rigs.go
@@ -19,12 +19,11 @@ func (s *Server) humaHandleRigList(ctx context.Context, input *RigListInput) (*L
 	cfg := s.state.Config()
 	sp := s.state.SessionProvider()
 	cityName := s.state.CityName()
-	store := s.state.CityBeadStore()
 	wantGit := input.Git
 
 	rigs := make([]rigResponse, 0, len(cfg.Rigs))
 	for _, rig := range cfg.Rigs {
-		resp := s.buildRigResponse(cfg, rig, store, sp, cityName, s.state.CityPath())
+		resp := s.buildRigResponse(cfg, rig, sp, cityName, s.state.CityPath())
 		if wantGit {
 			resp.Git = fetchGitStatus(rig.Path)
 		}
@@ -41,12 +40,11 @@ func (s *Server) humaHandleRigGet(_ context.Context, input *RigGetInput) (*Index
 	name := input.Name
 	cfg := s.state.Config()
 	sp := s.state.SessionProvider()
-	store := s.state.CityBeadStore()
 	wantGit := input.Git
 
 	for _, rig := range cfg.Rigs {
 		if rig.Name == name {
-			resp := s.buildRigResponse(cfg, rig, store, sp, s.state.CityName(), s.state.CityPath())
+			resp := s.buildRigResponse(cfg, rig, sp, s.state.CityName(), s.state.CityPath())
 			if wantGit {
 				resp.Git = fetchGitStatus(rig.Path)
 			}
diff --git a/internal/api/huma_handlers_sessions_command.go b/internal/api/huma_handlers_sessions_command.go
index fb2ba5ec41..f3b49e2ffd 100644
--- a/internal/api/huma_handlers_sessions_command.go
+++ b/internal/api/huma_handlers_sessions_command.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/danielgtaylor/huma/v2"
@@ -24,6 +25,15 @@ import (
 // respond, suspend, close, wake, rename). Split out of huma_handlers_sessions.go
 // to isolate mutation logic from reads and streaming.
 
+var (
+	sessionMessageAsyncTimeout      = sessionMessageTimeout
+	sessionCreateCommandableTimeout = 120 * time.Second
+)
+
+type sessionCommandableWaiter interface {
+	WaitForSessionCommandable(context.Context, string) (session.Info, error)
+}
+
 func (s *Server) humaHandleSessionCreate(ctx context.Context, input *SessionCreateInput) (*SessionCreateOutput, error) {
 	store := s.state.CityBeadStore()
 	if store == nil {
@@ -102,39 +112,33 @@ func (s *Server) humaHandleSessionCreate(ctx context.Context, input *SessionCrea
 	}
 	command := launchCommand.Command
 	extraMeta := sessionTemplateOverridesMetadata(body.Options, body.Message)
+	if extraMeta == nil {
+		extraMeta = make(map[string]string)
+	}
+	extraMeta["agent_name"] = workDirQualifiedName
+	extraMeta["session_origin"] = "manual"
 	mcpServers, err := s.sessionMCPServers(template, resolved.Name, workDirQualifiedName, workDir, transport, kind)
 	if err != nil {
 		return nil, huma.Error500InternalServerError(err.Error())
 	}
 
-	var info session.Info
-	reservationIDs := []string{alias, explicitName}
-	reserveConcreteIdentity := agentCfg.SupportsMultipleSessions() && strings.TrimSpace(workDirQualifiedName) != ""
-	if reserveConcreteIdentity {
-		reservationIDs = append(reservationIDs, workDirQualifiedName)
+	reqID, reqIDErr := newRequestID()
+	if reqIDErr != nil {
+		return nil, huma.Error500InternalServerError(reqIDErr.Error())
 	}
-	err = session.WithCitySessionIdentifierLocks(s.state.CityPath(), reservationIDs, func() error {
-		if aliasErr := session.EnsureAliasAvailableWithConfig(store, s.state.Config(), alias, ""); aliasErr != nil {
-			return aliasErr
-		}
-		if reserveConcreteIdentity && workDirQualifiedName != alias {
-			if aliasErr := session.EnsureAliasAvailableWithConfig(store, s.state.Config(), workDirQualifiedName, ""); aliasErr != nil {
-				return aliasErr
-			}
-		}
-		if nameErr := session.EnsureSessionNameAvailableWithConfig(store, s.state.Config(), explicitName, ""); nameErr != nil {
-			return nameErr
-		}
-		if extraMeta == nil {
-			extraMeta = make(map[string]string)
-		}
-		extraMeta["agent_name"] = workDirQualifiedName
-		extraMeta["session_origin"] = "manual"
+	eventCursor, cursorErr := s.currentCityEventCursor()
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
+	}
+
+	go func() {
+		defer s.recoverAsRequestFailed(reqID, RequestOperationSessionCreate)
 		if transport == "acp" {
 			var mcpMetaErr error
 			extraMeta, mcpMetaErr = session.WithStoredMCPMetadata(extraMeta, workDirQualifiedName, mcpServers)
 			if mcpMetaErr != nil {
-				return mcpMetaErr
+				s.emitSessionCreateFailed(reqID, "mcp_metadata_failed", mcpMetaErr.Error())
+				return
 			}
 		}
 		resolvedCfg, cfgErr := resolvedSessionConfigForProvider(
@@ -150,43 +154,80 @@ func (s *Server) humaHandleSessionCreate(ctx context.Context, input *SessionCrea
 			mcpServers,
 		)
 		if cfgErr != nil {
-			return cfgErr
+			s.emitSessionCreateFailed(reqID, "create_failed", cfgErr.Error())
+			return
 		}
 		handle, handleErr := s.newResolvedWorkerSessionHandle(store, resolvedCfg)
 		if handleErr != nil {
-			return handleErr
+			s.emitSessionCreateFailed(reqID, "create_failed", handleErr.Error())
+			return
+		}
+		var info session.Info
+		createMode := worker.CreateModeStarted
+		waiter, waitForCommandable := s.state.(sessionCommandableWaiter)
+		if waitForCommandable {
+			createMode = worker.CreateModeDeferred
+		}
+		reservationIDs := []string{alias, explicitName}
+		reserveConcreteIdentity := agentCfg.SupportsMultipleSessions() && strings.TrimSpace(workDirQualifiedName) != ""
+		if reserveConcreteIdentity {
+			reservationIDs = append(reservationIDs, workDirQualifiedName)
+		}
+		createErr := session.WithCitySessionIdentifierLocks(s.state.CityPath(), reservationIDs, func() error {
+			if aliasErr := session.EnsureAliasAvailableWithConfig(store, s.state.Config(), alias, ""); aliasErr != nil {
+				return aliasErr
+			}
+			if reserveConcreteIdentity && workDirQualifiedName != alias {
+				if aliasErr := session.EnsureAliasAvailableWithConfig(store, s.state.Config(), workDirQualifiedName, ""); aliasErr != nil {
+					return aliasErr
+				}
+			}
+			if nameErr := session.EnsureSessionNameAvailableWithConfig(store, s.state.Config(), explicitName, ""); nameErr != nil {
+				return nameErr
+			}
+			var err error
+			info, err = handle.Create(context.Background(), createMode)
+			return err
+		})
+		if createErr != nil {
+			s.emitSessionCreateFailed(reqID, "create_failed", createErr.Error())
+			return
+		}
+		if waitForCommandable {
+			s.state.Poke()
+			waitCtx, cancel := context.WithTimeout(context.Background(), sessionCreateCommandableTimeout)
+			info, createErr = waiter.WaitForSessionCommandable(waitCtx, info.ID)
+			cancel()
+			if createErr != nil {
+				s.emitSessionCreateFailed(reqID, "create_failed", createErr.Error())
+				return
+			}
 		}
-		var createErr error
-		info, createErr = handle.Create(ctx, worker.CreateModeDeferred)
-		return createErr
-	})
-	if err != nil {
-		return nil, humaSessionManagerError(err)
-	}
-
-	s.persistSessionMeta(store, info.ID, "agent", body.ProjectID, nil)
-	s.state.Poke()
 
-	titleProvider := s.resolveTitleProvider()
-	MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
-		fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
-	})
+		resp := sessionToResponse(info, s.state.Config())
+		resp.Kind = "agent"
+		s.emitSessionCreateSucceeded(reqID, resp)
+		s.persistSessionMeta(store, info.ID, "agent", body.ProjectID, nil)
+		if !waitForCommandable {
+			s.state.Poke()
+		}
 
-	resp := sessionToResponse(info, s.state.Config())
-	resp.Kind = "agent"
-	if caps, capErr := s.sessionManager(store).SubmissionCapabilities(info.ID); capErr == nil {
-		resp.SubmissionCapabilities = caps
-	}
-	s.enrichSessionResponse(&resp, info, s.state.Config(), s.state.SessionProvider(), false, true)
+		titleProvider := s.resolveTitleProvider()
+		MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
+			fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
+		})
+	}()
 
 	out := &SessionCreateOutput{Status: http.StatusAccepted}
-	out.Body = resp
+	out.Body.Status = "accepted"
+	out.Body.RequestID = reqID
+	out.Body.EventCursor = eventCursor
 	return out, nil
 }
 
 // humaCreateProviderSession handles the "provider" kind session creation.
 
-func (s *Server) humaCreateProviderSession(ctx context.Context, store beads.Store, body sessionCreateBody, providerName string) (*SessionCreateOutput, error) {
+func (s *Server) humaCreateProviderSession(_ context.Context, store beads.Store, body sessionCreateBody, providerName string) (*SessionCreateOutput, error) {
 	cfg := s.state.Config()
 	if cfg == nil {
 		return nil, huma.Error503ServiceUnavailable("city config not loaded yet")
@@ -236,12 +277,6 @@ func (s *Server) humaCreateProviderSession(ctx context.Context, store beads.Stor
 
 	workDir := s.state.CityPath()
 
-	resume := session.ProviderResume{
-		ResumeFlag:    resolved.ResumeFlag,
-		ResumeStyle:   resolved.ResumeStyle,
-		ResumeCommand: resolved.ResumeCommand,
-		SessionIDFlag: resolved.SessionIDFlag,
-	}
 	alias, err := session.ValidateAlias(body.Alias)
 	if err != nil {
 		return nil, humaSessionManagerError(err)
@@ -274,63 +309,64 @@ func (s *Server) humaCreateProviderSession(ctx context.Context, store beads.Stor
 		}
 	}
 
-	mgr := s.sessionManager(store)
-	hints := sessionCreateHints(resolved, mcpServers)
-	var info session.Info
-	err = session.WithCitySessionAliasLock(s.state.CityPath(), alias, func() error {
-		if aliasErr := session.EnsureAliasAvailableWithConfig(store, s.state.Config(), alias, ""); aliasErr != nil {
-			return aliasErr
-		}
-		var createErr error
-		info, createErr = mgr.CreateAliasedNamedWithTransportAndMetadata(
-			ctx,
-			alias,
-			"",
-			template,
-			title,
-			command,
-			workDir,
-			resolved.Name,
-			transport,
-			resolved.Env,
-			resume,
-			hints,
-			extraMeta,
-		)
-		return createErr
-	})
-	if err != nil {
-		return nil, humaSessionManagerError(err)
+	reqID, reqIDErr := newRequestID()
+	if reqIDErr != nil {
+		return nil, huma.Error500InternalServerError(reqIDErr.Error())
 	}
-
-	s.persistSessionMeta(store, info.ID, "provider", body.ProjectID, optMeta)
-
-	titleProvider := s.resolveTitleProvider()
-	MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
-		fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
-	})
-
-	if msg := strings.TrimSpace(body.Message); msg != "" {
-		if _, sendErr := s.submitMessageToSession(ctx, store, info.ID, msg, session.SubmitIntentDefault); sendErr != nil {
-			log.Printf("session %s: initial message delivery failed: %v", info.ID, sendErr)
-			if rollbackErr := s.rollbackCreatedSession(store, info.ID); rollbackErr != nil {
-				return nil, huma.Error500InternalServerError(
-					fmt.Sprintf("initial message delivery failed: %v (rollback failed: %v)", sendErr, rollbackErr))
+	eventCursor, cursorErr := s.currentCityEventCursor()
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
+	}
+	go func() {
+		defer s.recoverAsRequestFailed(reqID, RequestOperationSessionCreate)
+		resolvedCfg, cfgErr := resolvedSessionConfigForProvider(alias, "", template, title, transport, extraMeta, resolved, command, workDir, mcpServers)
+		if cfgErr != nil {
+			s.emitSessionCreateFailed(reqID, "create_failed", cfgErr.Error())
+			return
+		}
+		handle, handleErr := s.newResolvedWorkerSessionHandle(store, resolvedCfg)
+		if handleErr != nil {
+			s.emitSessionCreateFailed(reqID, "create_failed", handleErr.Error())
+			return
+		}
+		var info session.Info
+		createErr := session.WithCitySessionAliasLock(s.state.CityPath(), alias, func() error {
+			if aliasErr := session.EnsureAliasAvailableWithConfig(store, s.state.Config(), alias, ""); aliasErr != nil {
+				return aliasErr
 			}
-			return nil, huma.Error500InternalServerError(
-				fmt.Sprintf("initial message delivery failed: %v", sendErr))
+			var err error
+			info, err = handle.Create(context.Background(), worker.CreateModeStarted)
+			return err
+		})
+		if createErr != nil {
+			s.emitSessionCreateFailed(reqID, "create_failed", createErr.Error())
+			return
 		}
-	}
-
-	resp := sessionToResponse(info, s.state.Config())
-	resp.Kind = "provider"
-	if caps, capErr := s.sessionManager(store).SubmissionCapabilities(info.ID); capErr == nil {
-		resp.SubmissionCapabilities = caps
-	}
-	s.enrichSessionResponse(&resp, info, s.state.Config(), s.state.SessionProvider(), false, true)
+		if msg := strings.TrimSpace(body.Message); msg != "" {
+			if _, sendErr := s.submitMessageToSession(context.Background(), store, info.ID, msg, session.SubmitIntentDefault); sendErr != nil {
+				if rollbackErr := s.rollbackCreatedSession(store, info.ID); rollbackErr != nil {
+					s.emitSessionCreateFailed(reqID, "message_delivery_failed",
+						fmt.Sprintf("initial message delivery failed: %v (rollback failed: %v)", sendErr, rollbackErr))
+					return
+				}
+				s.emitSessionCreateFailed(reqID, "message_delivery_failed", fmt.Sprintf("initial message delivery failed: %v", sendErr))
+				return
+			}
+		}
+		resp := sessionToResponse(info, s.state.Config())
+		resp.Kind = "provider"
+		s.emitSessionCreateSucceeded(reqID, resp)
+		s.persistSessionMeta(store, info.ID, "provider", body.ProjectID, optMeta)
+		titleProvider := s.resolveTitleProvider()
+		MaybeGenerateTitleAsync(store, info.ID, body.Title, body.Message, titleProvider, info.WorkDir, func(format string, args ...any) {
+			fmt.Fprintf(os.Stderr, "session %s: "+format+"\n", append([]any{info.ID}, args...)...)
+		})
+	}()
 
-	out := &SessionCreateOutput{Status: http.StatusCreated}
-	out.Body = resp
+	out := &SessionCreateOutput{Status: http.StatusAccepted}
+	out.Body.Status = "accepted"
+	out.Body.RequestID = reqID
+	out.Body.EventCursor = eventCursor
 	return out, nil
 }
 
@@ -422,34 +458,46 @@ func (s *Server) humaHandleSessionPatch(_ context.Context, input *SessionPatchIn
 
 // humaHandleSessionSubmit is the Huma-typed handler for POST /v0/session/{id}/submit.
 
-func (s *Server) humaHandleSessionSubmit(ctx context.Context, input *SessionSubmitInput) (*SessionSubmitOutput, error) {
+func (s *Server) humaHandleSessionSubmit(_ context.Context, input *SessionSubmitInput) (*SessionSubmitOutput, error) {
 	store := s.state.CityBeadStore()
 	if store == nil {
 		return nil, huma.Error503ServiceUnavailable("no bead store configured")
 	}
 
-	// Huma validates Body.Message (minLength:1) and Body.Intent (enum).
-	// Handler-side guards are redundant; keep only the default-intent fill.
 	intent := input.Body.Intent
 	if intent == "" {
 		intent = session.SubmitIntentDefault
 	}
 
-	id, err := s.resolveSessionIDMaterializingNamedWithContext(ctx, store, input.ID)
-	if err != nil {
-		return nil, humaResolveError(err)
+	reqID, reqIDErr := newRequestID()
+	if reqIDErr != nil {
+		return nil, huma.Error500InternalServerError(reqIDErr.Error())
 	}
-
-	outcome, err := s.submitMessageToSession(ctx, store, id, input.Body.Message, intent)
-	if err != nil {
-		return nil, humaSessionManagerError(err)
+	eventCursor, cursorErr := s.currentCityEventCursor()
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
 	}
+	message := input.Body.Message
+	sessionTarget := input.ID
+	go func() {
+		defer s.recoverAsRequestFailed(reqID, RequestOperationSessionSubmit)
+		id, err := s.resolveSessionIDMaterializingNamedWithContext(context.Background(), store, sessionTarget)
+		if err != nil {
+			s.emitSessionSubmitFailed(reqID, "resolve_failed", err.Error())
+			return
+		}
+		outcome, submitErr := s.submitMessageToSession(context.Background(), store, id, message, intent)
+		if submitErr != nil {
+			s.emitSessionSubmitFailed(reqID, "submit_failed", submitErr.Error())
+		} else {
+			s.emitSessionSubmitSucceeded(reqID, id, outcome.Queued, string(intent))
+		}
+	}()
 
 	out := &SessionSubmitOutput{}
 	out.Body.Status = "accepted"
-	out.Body.ID = id
-	out.Body.Queued = outcome.Queued
-	out.Body.Intent = string(intent)
+	out.Body.RequestID = reqID
+	out.Body.EventCursor = eventCursor
 	return out, nil
 }
 
@@ -457,25 +505,100 @@ func (s *Server) humaHandleSessionSubmit(ctx context.Context, input *SessionSubm
 
 // humaHandleSessionMessage is the Huma-typed handler for POST /v0/session/{id}/messages.
 
-func (s *Server) humaHandleSessionMessage(ctx context.Context, input *SessionMessageInput) (*SessionMessageOutput, error) {
+func (s *Server) humaHandleSessionMessage(_ context.Context, input *SessionMessageInput) (*SessionMessageOutput, error) {
 	store := s.state.CityBeadStore()
 	if store == nil {
 		return nil, huma.Error503ServiceUnavailable("no bead store configured")
 	}
 
-	// Huma validates Body.Message (minLength:1); no handler guard needed.
-	id, err := s.resolveSessionIDMaterializingNamedWithContext(ctx, store, input.ID)
-	if err != nil {
-		return nil, humaResolveError(err)
+	reqID, reqIDErr := newRequestID()
+	if reqIDErr != nil {
+		return nil, huma.Error500InternalServerError(reqIDErr.Error())
 	}
-
-	if err := s.sendUserMessageToSession(ctx, store, id, input.Body.Message); err != nil {
-		return nil, humaSessionManagerError(err)
+	eventCursor, cursorErr := s.currentCityEventCursor()
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
 	}
+	message := input.Body.Message
+	sessionTarget := input.ID
+	go func() {
+		defer s.recoverAsRequestFailed(reqID, RequestOperationSessionMessage)
+
+		type messageResult struct {
+			sessionID string
+			errorCode string
+			err       error
+		}
+
+		resultCh := make(chan messageResult, 1)
+		var terminalEmitted atomic.Bool
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		sendResult := func(result messageResult) {
+			if terminalEmitted.Load() {
+				if result.err != nil {
+					log.Printf("api: late session.message result after timeout request_id=%s target=%s error_code=%s err=%v", reqID, sessionTarget, result.errorCode, result.err)
+				} else {
+					log.Printf("api: late session.message result after timeout request_id=%s target=%s session_id=%s", reqID, sessionTarget, result.sessionID)
+				}
+				return
+			}
+			resultCh <- result
+		}
+		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					sendResult(messageResult{errorCode: "internal_error", err: fmt.Errorf("panic: %v", r)})
+				}
+			}()
+			id, err := s.resolveSessionIDMaterializingNamedWithContext(ctx, store, sessionTarget)
+			if err != nil {
+				sendResult(messageResult{errorCode: "resolve_failed", err: err})
+				return
+			}
+			if err := s.sendUserMessageToSession(ctx, store, id, message); err != nil {
+				code := "message_failed"
+				if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+					code = "timeout"
+				}
+				sendResult(messageResult{sessionID: id, errorCode: code, err: err})
+				return
+			}
+			sendResult(messageResult{sessionID: id})
+		}()
+
+		timer := time.NewTimer(sessionMessageAsyncTimeout)
+		defer timer.Stop()
+		select {
+		case result := <-resultCh:
+			terminalEmitted.Store(true)
+			if result.err != nil {
+				s.emitSessionMessageFailed(reqID, result.errorCode, result.err.Error())
+				return
+			}
+			s.emitSessionMessageSucceeded(reqID, result.sessionID)
+		case <-timer.C:
+			cancel()
+			select {
+			case result := <-resultCh:
+				terminalEmitted.Store(true)
+				if result.err != nil {
+					s.emitSessionMessageFailed(reqID, result.errorCode, result.err.Error())
+					return
+				}
+				s.emitSessionMessageSucceeded(reqID, result.sessionID)
+				return
+			default:
+			}
+			terminalEmitted.Store(true)
+			s.emitSessionMessageFailed(reqID, "timeout", fmt.Sprintf("session.message timed out after %s", sessionMessageAsyncTimeout))
+		}
+	}()
 
 	out := &SessionMessageOutput{}
 	out.Body.Status = "accepted"
-	out.Body.ID = id
+	out.Body.RequestID = reqID
+	out.Body.EventCursor = eventCursor
 	return out, nil
 }
 
@@ -521,6 +644,12 @@ func (s *Server) humaHandleSessionKill(_ context.Context, input *SessionIDInput)
 
 	mgr := s.sessionManager(store)
 	if err := mgr.Kill(id); err != nil {
+		if errors.Is(err, session.ErrSessionClosed) {
+			out := &OKWithIDResponse{}
+			out.Body.Status = "ok"
+			out.Body.ID = id
+			return out, nil
+		}
 		return nil, humaSessionManagerError(err)
 	}
 	out := &OKWithIDResponse{}
@@ -619,7 +748,7 @@ func (s *Server) humaHandleSessionClose(_ context.Context, input *SessionCloseIn
 
 	// Optional: permanently delete the bead after closing.
 	if input.Delete {
-		if err := store.Delete(id); err != nil {
+		if err := deleteSessionBeadAfterClose(store, id); err != nil {
 			log.Printf("gc api: deleting bead after close %s: %v", id, err)
 			return nil, huma.Error500InternalServerError("closed but delete failed: " + err.Error())
 		}
@@ -668,6 +797,15 @@ func (s *Server) humaHandleSessionWake(ctx context.Context, input *SessionIDInpu
 	if sessionName != "" {
 		s.state.ClearCrashHistory(sessionName)
 	}
+	handle, err := s.workerHandleForSession(store, id)
+	if err != nil {
+		return nil, humaSessionManagerError(err)
+	}
+	go func() {
+		if err := handle.Start(context.Background()); err != nil {
+			log.Printf("gc api: waking session %s: %v", id, err)
+		}
+	}()
 
 	out := &OKWithIDResponse{}
 	out.Body.Status = "ok"
diff --git a/internal/api/huma_handlers_sessions_query.go b/internal/api/huma_handlers_sessions_query.go
index 6d588046b3..eb1a8bfb4f 100644
--- a/internal/api/huma_handlers_sessions_query.go
+++ b/internal/api/huma_handlers_sessions_query.go
@@ -24,19 +24,18 @@ func (s *Server) humaHandleSessionList(_ context.Context, input *SessionListInpu
 	}
 	mgr := s.sessionManager(store)
 	cfg := s.state.Config()
-	sp := s.state.SessionProvider()
 
-	sessions, err := mgr.List(input.State, input.Template)
+	all, partialErrors, err := sessionReadModelRows(store)
 	if err != nil {
 		return nil, huma.Error500InternalServerError(err.Error())
 	}
+	listResult := mgr.ListFullFromBeads(all, input.State, input.Template)
+	sessions := listResult.Sessions
 
 	// Build bead index for reason enrichment.
 	beadIndex := make(map[string]*beads.Bead)
-	if all, listErr := store.List(beads.ListQuery{Label: session.LabelSession}); listErr == nil {
-		for i := range all {
-			beadIndex[all[i].ID] = &all[i]
-		}
+	for i := range listResult.Beads {
+		beadIndex[listResult.Beads[i].ID] = &listResult.Beads[i]
 	}
 
 	wantPeek := input.Peek
@@ -44,7 +43,7 @@ func (s *Server) humaHandleSessionList(_ context.Context, input *SessionListInpu
 	items := make([]sessionResponse, len(sessions))
 	for i, sess := range sessions {
 		items[i] = sessionResponseWithReason(sess, beadIndex[sess.ID], cfg, hasDeferredQueue)
-		s.enrichSessionResponse(&items[i], sess, cfg, sp, wantPeek, false)
+		s.enrichSessionResponse(&items[i], sess, cfg, s.runtimeSessionResponseHandle(sess), wantPeek, false, false)
 	}
 
 	// Pagination support.
@@ -71,7 +70,12 @@ func (s *Server) humaHandleSessionList(_ context.Context, input *SessionListInpu
 		}
 		return &ListOutput[sessionResponse]{
 			Index: s.latestIndex(),
-			Body:  ListBody[sessionResponse]{Items: items, Total: total},
+			Body: ListBody[sessionResponse]{
+				Items:         items,
+				Total:         total,
+				Partial:       len(partialErrors) > 0,
+				PartialErrors: partialErrors,
+			},
 		}, nil
 	}
 
@@ -81,7 +85,13 @@ func (s *Server) humaHandleSessionList(_ context.Context, input *SessionListInpu
 	}
 	return &ListOutput[sessionResponse]{
 		Index: s.latestIndex(),
-		Body:  ListBody[sessionResponse]{Items: page, Total: total, NextCursor: nextCursor},
+		Body: ListBody[sessionResponse]{
+			Items:         page,
+			Total:         total,
+			NextCursor:    nextCursor,
+			Partial:       len(partialErrors) > 0,
+			PartialErrors: partialErrors,
+		},
 	}, nil
 }
 
@@ -109,7 +119,7 @@ func (s *Server) humaHandleSessionGet(_ context.Context, input *SessionGetInput)
 	b, _ := store.Get(id)
 	wantPeek := input.Peek
 	resp := sessionResponseWithReason(info, &b, cfg, strings.TrimSpace(s.state.CityPath()) != "")
-	s.enrichSessionResponse(&resp, info, cfg, sp, wantPeek, true)
+	s.enrichSessionResponse(&resp, info, cfg, sp, wantPeek, true, true)
 	return &IndexOutput[sessionResponse]{
 		Index: s.latestIndex(),
 		Body:  resp,
@@ -151,12 +161,20 @@ func (s *Server) humaHandleSessionTranscript(_ context.Context, input *SessionTr
 		// sentinel) rather than 1 compaction.
 		tail, _ := input.Compactions()
 		before := input.Before
+		after := input.After
+
+		if before != "" && after != "" {
+			return nil, huma.Error422UnprocessableEntity("before and after are mutually exclusive")
+		}
 
 		if wantRaw {
 			var rawSess *sessionlog.Session
-			if before != "" {
+			switch {
+			case before != "":
 				rawSess, err = sessionlog.ReadProviderFileRawOlder(info.Provider, path, tail, before)
-			} else {
+			case after != "":
+				rawSess, err = sessionlog.ReadProviderFileRawNewer(info.Provider, path, tail, after)
+			default:
 				rawSess, err = sessionlog.ReadProviderFileRaw(info.Provider, path, tail)
 			}
 			if err != nil {
@@ -176,9 +194,12 @@ func (s *Server) humaHandleSessionTranscript(_ context.Context, input *SessionTr
 		}
 
 		var sess *sessionlog.Session
-		if before != "" {
+		switch {
+		case before != "":
 			sess, err = sessionlog.ReadProviderFileOlder(info.Provider, path, tail, before)
-		} else {
+		case after != "":
+			sess, err = sessionlog.ReadProviderFileNewer(info.Provider, path, tail, after)
+		default:
 			sess, err = sessionlog.ReadProviderFile(info.Provider, path, tail)
 		}
 		if err != nil {
@@ -267,6 +288,13 @@ func (s *Server) humaHandleSessionPending(_ context.Context, input *SessionIDInp
 		return nil, humaResolveError(err)
 	}
 
+	if b, bErr := store.Get(id); bErr == nil && b.Metadata["state"] == "creating" {
+		return &IndexOutput[sessionPendingResponse]{
+			Index: s.latestIndex(),
+			Body:  sessionPendingResponse{Supported: false},
+		}, nil
+	}
+
 	mgr := s.sessionManager(store)
 	pending, supported, err := mgr.Pending(id)
 	if err != nil {
diff --git a/internal/api/huma_handlers_sessions_stream.go b/internal/api/huma_handlers_sessions_stream.go
index d733de15ee..d434996b53 100644
--- a/internal/api/huma_handlers_sessions_stream.go
+++ b/internal/api/huma_handlers_sessions_stream.go
@@ -87,9 +87,9 @@ func (s *Server) streamSession(hctx huma.Context, input *SessionStreamInput, sen
 		if err != nil {
 			// Invariant violation: precheck passed, body resolve failed.
 			// Session vanished between precheck and streaming start, or a
-			// race we didn't anticipate. Headers are already committed so
-			// we can't return an HTTP error — log so the next debugger has
-			// a starting point instead of a mute disconnect.
+			// race we didn't anticipate. The SSE body callback cannot
+			// return a typed HTTP error at this point, so log before the
+			// response closes without events.
 			log.Printf("api: session-stream: resolve failed after precheck city=%s id=%s: %v",
 				input.CityName, input.ID, err)
 			return
@@ -110,6 +110,7 @@ func (s *Server) streamSession(hctx huma.Context, input *SessionStreamInput, sen
 	if !running {
 		hctx.SetHeader("GC-Session-Status", "stopped")
 	}
+	flushSSEHeaders(hctx)
 
 	if info.Closed {
 		if format == "raw" {
@@ -119,6 +120,15 @@ func (s *Server) streamSession(hctx huma.Context, input *SessionStreamInput, sen
 		}
 		return
 	}
+	if format == "raw" {
+		_ = send(sse.Message{ID: 0, Data: SessionStreamRawMessageEvent{
+			ID:       info.ID,
+			Template: info.Template,
+			Provider: info.Provider,
+			Format:   "raw",
+			Messages: []SessionRawMessageFrame{},
+		}})
+	}
 	switch {
 	case hasHistory:
 		if format == "raw" {
@@ -127,17 +137,7 @@ func (s *Server) streamSession(hctx huma.Context, input *SessionStreamInput, sen
 			s.streamSessionTranscriptLogHuma(reqCtx, send, info, handle, history)
 		}
 	case format == "raw":
-		if running {
-			s.streamSessionPeekRawHuma(reqCtx, send, info)
-		} else {
-			_ = send(sse.Message{ID: 1, Data: SessionStreamRawMessageEvent{
-				ID:       info.ID,
-				Template: info.Template,
-				Provider: info.Provider,
-				Format:   "raw",
-				Messages: []SessionRawMessageFrame{},
-			}})
-		}
+		s.streamSessionPeekRawHuma(reqCtx, send, info)
 	default:
 		s.streamSessionPeekHuma(reqCtx, send, info)
 	}
diff --git a/internal/api/huma_handlers_sling.go b/internal/api/huma_handlers_sling.go
index 34a48017ee..306cf21820 100644
--- a/internal/api/huma_handlers_sling.go
+++ b/internal/api/huma_handlers_sling.go
@@ -9,8 +9,7 @@ import (
 )
 
 // SlingOutput is the Huma response for POST /v0/sling.
-// The HTTP status code varies (200 for direct sling, 201 for workflow launch),
-// so we use a custom status field.
+// The HTTP status code is supplied by the domain sling result.
 type SlingOutput struct {
 	Status int `header:"_status" doc:"HTTP status code."`
 	Body   slingResponse
diff --git a/internal/api/huma_handlers_supervisor.go b/internal/api/huma_handlers_supervisor.go
index dbb6a8c4bf..3d514f5cf5 100644
--- a/internal/api/huma_handlers_supervisor.go
+++ b/internal/api/huma_handlers_supervisor.go
@@ -73,25 +73,20 @@ type SupervisorProviderReadinessOutput struct {
 // cityCreateRequest is the body for POST /v0/city.
 type cityCreateRequest struct {
 	Dir              string `json:"dir" minLength:"1" doc:"Directory to create the city in. Absolute or relative to $HOME."`
-	Provider         string `json:"provider" minLength:"1" doc:"Provider name for the city's default session template."`
+	Provider         string `json:"provider,omitempty" minLength:"1" doc:"Provider name for the city's default session template. Mutually exclusive with start_command."`
+	StartCommand     string `json:"start_command,omitempty" doc:"Custom workspace start command for the city's default session template. Mutually exclusive with provider."`
 	BootstrapProfile string `json:"bootstrap_profile,omitempty" enum:"k8s-cell,kubernetes,kubernetes-cell,single-host-compat" doc:"Optional bootstrap profile."`
 }
 
 // cityCreateResponse is the response body for POST /v0/city. This
-// endpoint is asynchronous: a 202 response means the city was
-// scaffolded on disk and registered with the supervisor, but the
-// supervisor reconciler still has to run the slow finalize work
-// (pack materialization, bead store startup, formula resolution,
-// agent validation). Clients observe completion by subscribing to
-// /v0/events/stream and waiting for a city.ready event (payload
-// CityReadyPayload.Name == this response's Name) or a
-// city.init_failed event (CityInitFailedPayload.Name == this
-// response's Name; Error field explains the failure). Polling is
-// unnecessary.
-type cityCreateResponse struct {
-	OK   bool   `json:"ok" doc:"True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready."`
-	Name string `json:"name" doc:"Resolved city name as persisted in city.toml. Use this to filter the event stream for completion."`
-	Path string `json:"path" doc:"Resolved absolute path of the created city directory."`
+// endpoint is asynchronous: a 202 response means the city was scaffolded
+// on disk and registered with the supervisor. Clients observe request
+// completion by subscribing to /v0/events/stream and waiting for
+// request.result.city.create or request.failed with the returned
+// request_id. Polling is unnecessary.
+type asyncAcceptedResponse struct {
+	RequestID   string `json:"request_id" doc:"Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id."`
+	EventCursor string `json:"event_cursor" doc:"Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty."`
 }
 
 // SupervisorCityCreateInput is the input for POST /v0/city.
@@ -99,13 +94,10 @@ type SupervisorCityCreateInput struct {
 	Body cityCreateRequest
 }
 
-// SupervisorCityCreateOutput is the response for POST /v0/city. The
-// Status field carries 202 Accepted to tell Huma to emit the async
-// status code; see humaHandleCityCreate for the rationale and event
-// contract.
+// SupervisorCityCreateOutput is the response for POST /v0/city.
 type SupervisorCityCreateOutput struct {
 	Status int `json:"-"`
-	Body   cityCreateResponse
+	Body   asyncAcceptedResponse
 }
 
 // cityUnregisterResponse is the response body for
@@ -113,14 +105,10 @@ type SupervisorCityCreateOutput struct {
 // a 202 response means the city's registry entry was removed and the
 // supervisor was signaled to reconcile, but the city's controller is
 // not yet stopped. Clients observe completion by subscribing to
-// /v0/events/stream and waiting for a city.unregistered event (or
-// city.unregister_failed if the reconciler cannot stop the
-// controller).
-type cityUnregisterResponse struct {
-	OK   bool   `json:"ok" doc:"True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered."`
-	Name string `json:"name" doc:"Resolved registry name. Filter the event stream by this to observe completion."`
-	Path string `json:"path" doc:"Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry."`
-}
+// /v0/events/stream and waiting for request.result.city.unregister or
+// request.failed with the returned request_id.
+// cityUnregisterResponse is the same as asyncAcceptedResponse.
+type cityUnregisterResponse = asyncAcceptedResponse
 
 // SupervisorCityUnregisterInput is the input for
 // POST /v0/city/{cityName}/unregister.
@@ -147,15 +135,16 @@ type SupervisorEventListInput struct {
 // SupervisorEventListOutput is the response for GET /v0/events (supervisor scope).
 type SupervisorEventListOutput struct {
 	Body struct {
-		Items []WireTaggedEvent `json:"items"`
-		Total int               `json:"total"`
+		EventCursor string            `json:"event_cursor" doc:"Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog."`
+		Items       []WireTaggedEvent `json:"items"`
+		Total       int               `json:"total"`
 	}
 }
 
 // SupervisorEventStreamInput is the input for GET /v0/events/stream (supervisor scope).
 type SupervisorEventStreamInput struct {
-	LastEventID string `header:"Last-Event-ID" required:"false" doc:"Reconnect cursor (composite per-city cursor)."`
-	AfterCursor string `query:"after_cursor" required:"false" doc:"Alternative to Last-Event-ID for browsers that can't set custom headers."`
+	LastEventID string `header:"Last-Event-ID" required:"false" doc:"Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head."`
+	AfterCursor string `query:"after_cursor" required:"false" doc:"Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head."`
 }
 
 // --- Huma API setup ---
@@ -215,14 +204,13 @@ func (sm *SupervisorMux) registerSupervisorRoutes() {
 	huma.Get(sm.humaAPI, "/v0/readiness", sm.humaHandleReadiness)
 	huma.Get(sm.humaAPI, "/v0/provider-readiness", sm.humaHandleProviderReadiness)
 	// Async mutation: returns 202 Accepted after scaffold + register;
-	// completion signaled via city.ready / city.init_failed events.
+	// completion is signaled via request.result.city.create or request.failed.
 	huma.Post(sm.humaAPI, "/v0/city", sm.humaHandleCityCreate, addMutationCSRFParam, func(op *huma.Operation) {
 		op.DefaultStatus = http.StatusAccepted
 	})
-	// Async unregister: returns 202 after the registry entry is
-	// removed and the supervisor is signaled. city.unregistered /
-	// city.unregister_failed events signal completion on the event
-	// stream.
+	// Async unregister: returns 202 after the registry entry is removed
+	// and the supervisor is signaled. request.result.city.unregister or
+	// request.failed signals completion on the event stream.
 	huma.Post(sm.humaAPI, "/v0/city/{cityName}/unregister", sm.humaHandleCityUnregister, addMutationCSRFParam, func(op *huma.Operation) {
 		op.DefaultStatus = http.StatusAccepted
 	})
@@ -233,6 +221,7 @@ func (sm *SupervisorMux) registerSupervisorRoutes() {
 		Method:      http.MethodGet,
 		Path:        "/v0/events/stream",
 		Summary:     "Stream tagged events from all running cities.",
+		Description: "Server-Sent Events stream of supervisor-tagged events. Supports reconnection via Last-Event-ID header or after_cursor query param; omitting both starts at the current supervisor event head.",
 	}, map[string]any{
 		"tagged_event": sseEventContract{
 			runtimeSample: &taggedEventStreamEnvelope{},
@@ -327,22 +316,18 @@ func (sm *SupervisorMux) humaHandleProviderReadiness(ctx context.Context, input
 }
 
 // humaHandleCityCreate handles POST /v0/city asynchronously. Calls
-// Initializer.Scaffold in-process to write the on-disk shape and
-// register the city with the supervisor, then returns 202 Accepted
-// immediately. The supervisor reconciler runs the slow finalize
-// (prepareCityForSupervisor: pack materialization, bead store
-// startup, formula resolution, agent validation) on its next tick
-// and emits city.ready / city.init_failed events on the supervisor
-// event bus when done. Clients observe completion via
-// /v0/events/stream — no polling required.
+// the city initializer in-process to write the on-disk shape and
+// register the city with the supervisor, stores request_id correlation
+// for the reconciler, then returns 202 Accepted. The supervisor
+// reconciler emits request.result.city.create after the city runtime
+// starts. Clients observe request completion via /v0/events/stream —
+// no polling required.
 //
-// Rationale: full city init takes minutes (dolt startup,
-// provider-readiness probes, pack fetch). Blocking the HTTP request
-// until finalize completes exceeds reasonable client timeouts
-// (MC's harness hit 120s). The fast scaffold+register path takes
-// seconds; the async completion contract via SSE is the right shape
-// for a long-running operation. See engdocs/architecture/api-control-plane.md §1–§2 on
-// the object model + typed events; §4 on the event registry.
+// Rationale: full city startup can exceed reasonable HTTP client
+// timeouts. The POST returns once scaffold+register succeeds, while
+// the terminal request-result event is held until the reconciler has
+// started the city runtime. See engdocs/architecture/api-control-plane.md
+// §1-§2 on the object model + typed events; §4 on the event registry.
 func (sm *SupervisorMux) humaHandleCityCreate(ctx context.Context, input *SupervisorCityCreateInput) (*SupervisorCityCreateOutput, error) {
 	dir := input.Body.Dir
 	if !filepath.IsAbs(dir) {
@@ -353,11 +338,11 @@ func (sm *SupervisorMux) humaHandleCityCreate(ctx context.Context, input *Superv
 		dir = filepath.Join(home, dir)
 	}
 
-	// Cheap pre-check that does not require an Initializer: if the
+	// Cheap pre-check that does not require a city initializer: if the
 	// target directory already looks like an initialized city on disk,
 	// return 409 before we try to scaffold. Keeps the API well-behaved
 	// in test configurations that build a SupervisorMux without an
-	// Initializer.
+	// initializer.
 	if cityDirAlreadyInitialized(dir) {
 		return nil, huma.Error409Conflict("conflict: city already initialized at " + dir)
 	}
@@ -366,42 +351,147 @@ func (sm *SupervisorMux) humaHandleCityCreate(ctx context.Context, input *Superv
 		return nil, huma.Error501NotImplemented("city creation is not available in this supervisor (no initializer wired)")
 	}
 
-	result, err := sm.initializer.Scaffold(ctx, cityinit.InitRequest{
-		Dir:              dir,
-		Provider:         input.Body.Provider,
-		BootstrapProfile: input.Body.BootstrapProfile,
-		// The async API defers dependency/provider blockers to the
-		// reconciler's terminal city.init_failed event instead of
-		// failing POST synchronously.
+	reqID, err := newRequestID()
+	if err != nil {
+		return nil, huma.Error500InternalServerError(fmt.Sprintf("generating request ID: %v", err))
+	}
+	eventCursor, cursorErr := sm.currentSupervisorEventCursor()
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
+	}
+	pendingStored := false
+	if store, ok := sm.resolver.(PendingRequestStore); ok {
+		if err := store.StorePendingRequestID(dir, reqID); err != nil {
+			if errors.Is(err, ErrPendingRequestExists) {
+				return nil, huma.Error409Conflict("conflict: city initialization already in progress at " + dir)
+			}
+			return nil, huma.Error500InternalServerError(fmt.Sprintf("storing pending request ID: %v", err))
+		}
+		pendingStored = true
+	}
+
+	result, scaffoldErr := sm.initializer.Scaffold(ctx, cityinit.InitRequest{
+		Dir:                   dir,
+		Provider:              input.Body.Provider,
+		StartCommand:          input.Body.StartCommand,
+		BootstrapProfile:      input.Body.BootstrapProfile,
 		SkipProviderReadiness: true,
 	})
+	postRegisterFailed := false
 	switch {
-	case errors.Is(err, cityinit.ErrAlreadyInitialized):
+	case errors.Is(scaffoldErr, cityinit.ErrAlreadyInitialized):
+		sm.clearPendingCityRequestID(dir, pendingStored)
 		return nil, huma.Error409Conflict("conflict: city already initialized at " + dir)
-	case errors.Is(err, cityinit.ErrInvalidProvider),
-		errors.Is(err, cityinit.ErrInvalidBootstrapProfile):
-		return nil, huma.Error422UnprocessableEntity(err.Error())
-	case err != nil:
-		return nil, huma.Error500InternalServerError(err.Error())
+	case errors.Is(scaffoldErr, cityinit.ErrInvalidDirectory),
+		errors.Is(scaffoldErr, cityinit.ErrInvalidProvider),
+		errors.Is(scaffoldErr, cityinit.ErrInvalidBootstrapProfile):
+		sm.clearPendingCityRequestID(dir, pendingStored)
+		return nil, huma.Error422UnprocessableEntity(scaffoldErr.Error())
+	case errors.Is(scaffoldErr, cityinit.ErrPostRegisterFailure):
+		failureReqID := reqID
+		if consumedReqID, ok := sm.consumePendingCityRequestID(dir, pendingStored); ok {
+			failureReqID = consumedReqID
+		}
+		emitCityCreateFailed(sm.resolver, failureReqID, result, dir, "city_init_failed", scaffoldErr)
+		postRegisterFailed = true
+	case scaffoldErr != nil:
+		sm.clearPendingCityRequestID(dir, pendingStored)
+		return nil, huma.Error500InternalServerError(scaffoldErr.Error())
+	}
+
+	if !pendingStored && !postRegisterFailed {
+		emitCityCreateSucceeded(sm.resolver, reqID, result, dir)
 	}
 
 	out := &SupervisorCityCreateOutput{
 		Status: http.StatusAccepted,
 	}
-	out.Body = cityCreateResponse{
-		OK:   true,
-		Name: result.CityName,
-		Path: result.CityPath,
-	}
+	out.Body = asyncAcceptedResponse{RequestID: reqID, EventCursor: eventCursor}
 	return out, nil
 }
 
+func (sm *SupervisorMux) clearPendingCityRequestID(cityPath string, stored bool) {
+	sm.consumePendingCityRequestID(cityPath, stored)
+}
+
+func (sm *SupervisorMux) consumePendingCityRequestID(cityPath string, stored bool) (string, bool) {
+	if !stored {
+		return "", false
+	}
+	store, ok := sm.resolver.(PendingRequestStore)
+	if !ok {
+		return "", false
+	}
+	reqID, found, err := store.ConsumePendingRequestID(cityPath)
+	if err != nil {
+		log.Printf("api: consume pending city create request ID for %s: %v", cityPath, err)
+		return "", false
+	}
+	return reqID, found
+}
+
+func emitCityCreateSucceeded(resolver CityResolver, requestID string, result *cityinit.InitResult, fallbackPath string) {
+	supSrc, ok := resolver.(SupervisorEventSource)
+	if !ok {
+		log.Printf("api: no supervisor event recorder for city.create result %s", requestID)
+		return
+	}
+	rec := supSrc.SupervisorEventRecorder()
+	if rec == nil {
+		log.Printf("api: nil supervisor event recorder for city.create result %s", requestID)
+		return
+	}
+
+	cityPath := fallbackPath
+	cityName := filepath.Base(fallbackPath)
+	if result != nil {
+		if result.CityPath != "" {
+			cityPath = result.CityPath
+		}
+		if result.CityName != "" {
+			cityName = result.CityName
+		}
+	}
+
+	EmitTypedEvent(rec, events.RequestResultCityCreate, cityName, CityCreateSucceededPayload{
+		RequestID: requestID,
+		Name:      cityName,
+		Path:      cityPath,
+	})
+}
+
+func emitCityCreateFailed(resolver CityResolver, requestID string, result *cityinit.InitResult, fallbackPath, errorCode string, err error) {
+	supSrc, ok := resolver.(SupervisorEventSource)
+	if !ok {
+		log.Printf("api: no supervisor event recorder for city.create failure %s", requestID)
+		return
+	}
+	rec := supSrc.SupervisorEventRecorder()
+	if rec == nil {
+		log.Printf("api: nil supervisor event recorder for city.create failure %s", requestID)
+		return
+	}
+
+	cityName := filepath.Base(fallbackPath)
+	if result != nil {
+		if result.CityName != "" {
+			cityName = result.CityName
+		}
+	}
+	EmitTypedEvent(rec, events.RequestFailed, cityName, RequestFailedPayload{
+		RequestID:    requestID,
+		Operation:    RequestOperationCityCreate,
+		ErrorCode:    errorCode,
+		ErrorMessage: err.Error(),
+	})
+}
+
 // humaHandleCityUnregister handles POST /v0/city/{cityName}/unregister
-// asynchronously. Calls Initializer.Unregister in-process to remove
+// asynchronously. Calls the city initializer in-process to remove
 // the city from the supervisor's registry and signal reconcile, then
 // returns 202 Accepted immediately. The supervisor reconciler stops
-// the city's controller on its next tick and emits city.unregistered
-// (or city.unregister_failed on stop failure) on the supervisor
+// the city's controller on its next tick and emits
+// request.result.city.unregister or request.failed on the supervisor
 // event bus. Clients observe completion via /v0/events/stream — no
 // polling required.
 //
@@ -420,23 +510,80 @@ func (sm *SupervisorMux) humaHandleCityUnregister(ctx context.Context, input *Su
 		return nil, huma.Error400BadRequest("city_name is required")
 	}
 
-	result, err := sm.initializer.Unregister(ctx, cityinit.UnregisterRequest{CityName: name})
+	reqID, err := newRequestID()
+	if err != nil {
+		return nil, huma.Error500InternalServerError(fmt.Sprintf("generating request ID: %v", err))
+	}
+	eventCursor, cursorErr := sm.currentSupervisorEventCursor()
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
+	}
+
+	// Store the pending request_id BEFORE Unregister triggers a
+	// reconciler reload, so the reconciler can correlate the
+	// terminal request.result event. Look up the city path from
+	// the resolver first; if the city isn't known, Unregister will
+	// return ErrNotRegistered anyway.
+	var cityPath string
+	if store, ok := sm.resolver.(PendingRequestStore); ok {
+		var pathErr error
+		cityPath, pathErr = sm.cityPathForPendingRequest(ctx, name)
+		if pathErr != nil {
+			return nil, huma.Error500InternalServerError(fmt.Sprintf("resolving city path: %v", pathErr))
+		}
+		if cityPath != "" {
+			if err := store.StorePendingRequestID(cityPath, reqID); err != nil {
+				if errors.Is(err, ErrPendingRequestExists) {
+					return nil, huma.Error409Conflict("conflict: city operation already in progress at " + cityPath)
+				}
+				return nil, huma.Error500InternalServerError(fmt.Sprintf("storing pending request ID: %v", err))
+			}
+		}
+	}
+
+	_, unregErr := sm.initializer.Unregister(ctx, cityinit.UnregisterRequest{CityName: name})
 	switch {
-	case errors.Is(err, cityinit.ErrNotRegistered):
-		return nil, huma.Error404NotFound("not_found: " + err.Error())
-	case err != nil:
-		return nil, huma.Error500InternalServerError(err.Error())
+	case errors.Is(unregErr, cityinit.ErrNotRegistered):
+		if store, ok := sm.resolver.(PendingRequestStore); ok && cityPath != "" {
+			if _, _, err := store.ConsumePendingRequestID(cityPath); err != nil {
+				log.Printf("api: consume pending city unregister request ID for %s: %v", cityPath, err)
+			}
+		}
+		return nil, huma.Error404NotFound("not_found: " + unregErr.Error())
+	case unregErr != nil:
+		if store, ok := sm.resolver.(PendingRequestStore); ok && cityPath != "" {
+			if _, _, err := store.ConsumePendingRequestID(cityPath); err != nil {
+				log.Printf("api: consume pending city unregister request ID for %s: %v", cityPath, err)
+			}
+		}
+		return nil, huma.Error500InternalServerError(unregErr.Error())
 	}
 
 	out := &SupervisorCityUnregisterOutput{Status: http.StatusAccepted}
-	out.Body = cityUnregisterResponse{
-		OK:   true,
-		Name: result.CityName,
-		Path: result.CityPath,
-	}
+	out.Body = cityUnregisterResponse{RequestID: reqID, EventCursor: eventCursor}
 	return out, nil
 }
 
+func (sm *SupervisorMux) cityPathForPendingRequest(ctx context.Context, name string) (string, error) {
+	for _, c := range sm.resolver.ListCities() {
+		if c.Name == name {
+			return c.Path, nil
+		}
+	}
+	finder, ok := sm.initializer.(registeredCityFinder)
+	if !ok {
+		return "", nil
+	}
+	city, err := finder.FindRegisteredCity(ctx, name)
+	if err != nil {
+		if errors.Is(err, cityinit.ErrNotRegistered) {
+			return "", nil
+		}
+		return "", err
+	}
+	return city.Path, nil
+}
+
 func cityDirAlreadyInitialized(dir string) bool {
 	requiredDirs := []string{
 		filepath.Join(dir, citylayout.RuntimeRoot),
@@ -456,13 +603,24 @@ func cityDirAlreadyInitialized(dir string) bool {
 
 func (sm *SupervisorMux) humaHandleEventList(_ context.Context, input *SupervisorEventListInput) (*SupervisorEventListOutput, error) {
 	mux := sm.buildMultiplexer()
+	eventCursor, cursorErr := supervisorEventCursorFromMux(mux)
+	if cursorErr != nil {
+		return nil, huma.Error500InternalServerError(cursorErr.Error())
+	}
 	filter := events.Filter{Type: input.Type, Actor: input.Actor}
 	if d, ok, err := parseEventSince(input.Since); err != nil {
 		return nil, err
 	} else if ok {
 		filter.Since = time.Now().Add(-d)
 	}
-	evts, err := mux.ListAll(filter)
+	var evts []events.TaggedEvent
+	var err error
+	optimizedTail := input.Limit > 0 && supervisorEventListFilterIsEmpty(filter)
+	if optimizedTail {
+		evts, err = mux.ListTail(filter, input.Limit)
+	} else {
+		evts, err = mux.ListAll(filter)
+	}
 	if err != nil {
 		return nil, huma.Error500InternalServerError("internal: " + err.Error())
 	}
@@ -475,19 +633,66 @@ func (sm *SupervisorMux) humaHandleEventList(_ context.Context, input *Superviso
 		wires = append(wires, w)
 	}
 	out := &SupervisorEventListOutput{}
+	out.Body.EventCursor = eventCursor
 	// Total is the full match count so clients can distinguish "limit
 	// truncated" from "the server only had N events."
 	out.Body.Total = len(wires)
+	if optimizedTail {
+		out.Body.Total = sm.currentSupervisorEventTotal()
+	}
 	// Limit clamp: take the N most recent events (wires is already
 	// chronologically ordered). Critical for `gc events --seq` which
 	// computes the head cursor from the last event only.
-	if input.Limit > 0 && input.Limit < len(wires) {
+	if !optimizedTail && input.Limit > 0 && input.Limit < len(wires) {
 		wires = wires[len(wires)-input.Limit:]
 	}
 	out.Body.Items = wires
 	return out, nil
 }
 
+func supervisorEventListFilterIsEmpty(filter events.Filter) bool {
+	return filter == (events.Filter{})
+}
+
+func (sm *SupervisorMux) currentSupervisorEventTotal() int {
+	mux := sm.buildMultiplexer()
+	cursors, err := mux.LatestCursor()
+	if err != nil {
+		log.Printf("api: supervisor events total: %v", err)
+	}
+	// This optimized unfiltered total treats LatestSeq as an event count because
+	// event logs are append-only, gap-free, and unpruned today. Any future
+	// retention/pruning/compaction must replace this path with an explicit count
+	// API.
+	const maxInt = int(^uint(0) >> 1)
+	total := 0
+	for _, seq := range cursors {
+		if seq > uint64(maxInt-total) {
+			return maxInt
+		}
+		total += int(seq)
+	}
+	return total
+}
+
+func (sm *SupervisorMux) currentSupervisorEventCursor() (string, error) {
+	return supervisorEventCursorFromMux(sm.buildMultiplexer())
+}
+
+func supervisorEventCursorFromMux(mux *events.Multiplexer) (string, error) {
+	cursors, err := mux.LatestCursor()
+	if err != nil {
+		// Async writes and history-to-SSE handoffs need a complete cursor for
+		// all cities. Fail before accepting the request or returning history so
+		// clients never wait from an ambiguous cursor.
+		return "", fmt.Errorf("capturing supervisor event cursor: %w", err)
+	}
+	if cursor := events.FormatCursor(cursors); cursor != "" {
+		return cursor, nil
+	}
+	return "0", nil
+}
+
 // --- Supervisor global events stream (Fix 3g final wiring) ---
 
 // precheckGlobalEventStream validates that the global event stream
@@ -521,28 +726,36 @@ func (sm *SupervisorMux) precheckGlobalEventStream(ctx context.Context, _ *Super
 	return nil
 }
 
-// streamGlobalEvents emits tagged events with composite per-city cursor
-// IDs. Called after headers commit; failures terminate the stream cleanly
-// (there's no way to return an HTTP error at this point). This is the
-// final wiring of Fix 3g — it replaces the raw writeSSEWithStringID loop
-// that previously lived in streamProjectedGlobalEvents.
+// streamGlobalEvents emits tagged events with composite per-city cursor IDs.
+// Once the stream is prepared and headers are committed, failures terminate
+// the stream cleanly because there is no way to return an HTTP error.
 func (sm *SupervisorMux) streamGlobalEvents(hctx huma.Context, input *SupervisorEventStreamInput, send StringIDSender) {
 	cursor := strings.TrimSpace(input.LastEventID)
 	if cursor == "" {
 		cursor = strings.TrimSpace(input.AfterCursor)
 	}
-	cursors := events.ParseCursor(cursor)
+
+	mux := sm.buildMultiplexer()
+	var cursors map[string]uint64
+	if cursor == "" {
+		var err error
+		cursors, err = mux.LatestCursor()
+		if err != nil {
+			log.Printf("api: supervisor events-stream: latest cursor failed: %v", err)
+		}
+	} else {
+		cursors = events.ParseCursor(cursor)
+	}
 	if cursors == nil {
 		cursors = make(map[string]uint64)
 	}
-
-	mux := sm.buildMultiplexer()
 	mw, err := mux.Watch(hctx.Context(), cursors)
 	if err != nil {
 		log.Printf("api: supervisor events-stream: Watch failed cursors=%v: %v", cursors, err)
 		return
 	}
 	defer mw.Close() //nolint:errcheck
+	flushSSEHeaders(hctx)
 
 	keepalive := time.NewTicker(sseKeepalive)
 	defer keepalive.Stop()
diff --git a/internal/api/huma_handlers_supervisor_test.go b/internal/api/huma_handlers_supervisor_test.go
index f604464964..910a6574e2 100644
--- a/internal/api/huma_handlers_supervisor_test.go
+++ b/internal/api/huma_handlers_supervisor_test.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"net/http/httptest"
@@ -13,6 +14,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/cityinit"
 	"github.com/gastownhall/gascity/internal/citylayout"
+	"github.com/gastownhall/gascity/internal/events"
 )
 
 type fakeInitializer struct {
@@ -20,6 +22,10 @@ type fakeInitializer struct {
 	scaffoldResult *cityinit.InitResult
 	scaffoldErr    error
 
+	findName   string
+	findResult cityinit.RegisteredCity
+	findErr    error
+
 	unregisterReq    cityinit.UnregisterRequest
 	unregisterResult *cityinit.UnregisterResult
 	unregisterErr    error
@@ -32,11 +38,22 @@ func (f *fakeInitializer) Init(context.Context, cityinit.InitRequest) (*cityinit
 func (f *fakeInitializer) Scaffold(_ context.Context, req cityinit.InitRequest) (*cityinit.InitResult, error) {
 	f.scaffoldReq = req
 	if f.scaffoldErr != nil {
-		return nil, f.scaffoldErr
+		return f.scaffoldResult, f.scaffoldErr
 	}
 	return f.scaffoldResult, nil
 }
 
+func (f *fakeInitializer) FindRegisteredCity(_ context.Context, name string) (cityinit.RegisteredCity, error) {
+	f.findName = name
+	if f.findErr != nil {
+		return cityinit.RegisteredCity{}, f.findErr
+	}
+	if f.findResult.Name == "" && f.findResult.Path == "" {
+		return cityinit.RegisteredCity{}, cityinit.ErrNotRegistered
+	}
+	return f.findResult, nil
+}
+
 func (f *fakeInitializer) Unregister(_ context.Context, req cityinit.UnregisterRequest) (*cityinit.UnregisterResult, error) {
 	f.unregisterReq = req
 	if f.unregisterErr != nil {
@@ -45,9 +62,12 @@ func (f *fakeInitializer) Unregister(_ context.Context, req cityinit.UnregisterR
 	return f.unregisterResult, nil
 }
 
-func newTestSupervisorMuxWithInitializer(t *testing.T, init cityinit.Initializer) *SupervisorMux {
+func newTestSupervisorMuxWithInitializer(t *testing.T, init cityInitializer) *SupervisorMux {
 	t.Helper()
-	return NewSupervisorMux(&fakeCityResolver{cities: map[string]*fakeState{}}, init, false, "test", time.Now())
+	return NewSupervisorMux(&fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: events.NewFake(),
+	}, init, false, "test", time.Now())
 }
 
 func TestSupervisorCityCreateConflictsWhenTargetAlreadyInitialized(t *testing.T) {
@@ -105,9 +125,10 @@ func TestSupervisorCityCreateScaffoldsViaInitializer(t *testing.T) {
 	cityPath := filepath.Join(home, "mc-city")
 	init := &fakeInitializer{
 		scaffoldResult: &cityinit.InitResult{
-			CityName:     "mc-city",
-			CityPath:     cityPath,
-			ProviderUsed: "codex",
+			CityName:      "mc-city",
+			CityPath:      cityPath,
+			ProviderUsed:  "codex",
+			ReloadWarning: "reload failed",
 		},
 	}
 	sm := newTestSupervisorMuxWithInitializer(t, init)
@@ -135,9 +156,314 @@ func TestSupervisorCityCreateScaffoldsViaInitializer(t *testing.T) {
 	if !init.scaffoldReq.SkipProviderReadiness {
 		t.Fatal("Scaffold request should skip provider readiness for API callers")
 	}
-	if body := rec.Body.String(); !strings.Contains(body, `"name":"mc-city"`) || !strings.Contains(body, `"path":"`+cityPath+`"`) {
-		t.Fatalf("body = %s, want name and path", body)
+	if body := rec.Body.String(); !strings.Contains(body, `"request_id"`) {
+		t.Fatalf("body = %s, want request_id", body)
+	}
+}
+
+func TestSupervisorCityCreateScaffoldsWithStartCommand(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	cityPath := filepath.Join(home, "mc-city")
+	init := &fakeInitializer{
+		scaffoldResult: &cityinit.InitResult{
+			CityName:     "mc-city",
+			CityPath:     cityPath,
+			ProviderUsed: "",
+		},
+	}
+	sm := newTestSupervisorMuxWithInitializer(t, init)
+
+	req := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{
+		"dir":"mc-city",
+		"start_command":"bash /tmp/hermetic-agent.sh"
+	}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	if init.scaffoldReq.Dir != cityPath {
+		t.Fatalf("Scaffold Dir = %q, want %q", init.scaffoldReq.Dir, cityPath)
+	}
+	if init.scaffoldReq.Provider != "" || init.scaffoldReq.StartCommand != "bash /tmp/hermetic-agent.sh" {
+		t.Fatalf("Scaffold request = %+v, want start_command without provider", init.scaffoldReq)
+	}
+	if !init.scaffoldReq.SkipProviderReadiness {
+		t.Fatal("Scaffold request should skip provider readiness for API callers")
+	}
+}
+
+func TestSupervisorCityCreateReturnsRequestID(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	cityPath := filepath.Join(home, "mc-city")
+	init := &fakeInitializer{
+		scaffoldResult: &cityinit.InitResult{
+			CityName:     "mc-city",
+			CityPath:     cityPath,
+			ProviderUsed: "codex",
+		},
+	}
+	sm := newTestSupervisorMuxWithInitializer(t, init)
+
+	req := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{
+		"dir":"mc-city",
+		"provider":"codex",
+		"bootstrap_profile":"single-host-compat"
+	}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, `"request_id"`) {
+		t.Fatalf("response must include request_id for async correlation; body=%s", body)
+	}
+}
+
+func TestSupervisorCityCreateReturnsCurrentEventCursor(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	cityPath := filepath.Join(home, "mc-city")
+	recorder := events.NewFake()
+	recorder.Record(events.Event{Type: events.SessionWoke, Actor: "seed"})
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: recorder,
+	}
+	init := &fakeInitializer{
+		scaffoldResult: &cityinit.InitResult{
+			CityName:     "mc-city",
+			CityPath:     cityPath,
+			ProviderUsed: "codex",
+		},
+	}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+
+	req := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{"dir":"mc-city","provider":"codex"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	if accepted.EventCursor != "__supervisor__:1" {
+		t.Fatalf("event_cursor = %q, want __supervisor__:1", accepted.EventCursor)
+	}
+}
+
+func TestSupervisorCityCreateStoresPendingRequestForReconciler(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	cityPath := filepath.Join(home, "mc-city")
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: events.NewFake(),
+	}
+	init := &fakeInitializer{
+		scaffoldResult: &cityinit.InitResult{
+			CityName:     "mc-city",
+			CityPath:     cityPath,
+			ProviderUsed: "claude",
+		},
+	}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+
+	postReq := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{"dir":"mc-city","provider":"claude"}`))
+	postReq.Header.Set("Content-Type", "application/json")
+	postReq.Header.Set("X-GC-Request", "test")
+	postRec := httptest.NewRecorder()
+
+	sm.ServeHTTP(postRec, postReq)
+
+	if postRec.Code != http.StatusAccepted {
+		t.Fatalf("POST /v0/city status = %d, want %d; body=%s", postRec.Code, http.StatusAccepted, postRec.Body.String())
+	}
+	var createResp struct {
+		RequestID string `json:"request_id"`
+	}
+	if err := json.Unmarshal(postRec.Body.Bytes(), &createResp); err != nil {
+		t.Fatalf("decode create response: %v; body=%s", err, postRec.Body.String())
+	}
+	if createResp.RequestID == "" {
+		t.Fatalf("empty request_id in response; body=%s", postRec.Body.String())
 	}
+	if got := resolver.pending[cityPath]; got != createResp.RequestID {
+		t.Fatalf("pending request_id = %q, want %q", got, createResp.RequestID)
+	}
+	if got := len(resolver.supervisorRecorder.(*events.Fake).Events); got != 0 {
+		t.Fatalf("supervisor events = %d, want 0 before reconciler starts city", got)
+	}
+}
+
+func TestSupervisorCityCreateRejectsDuplicatePendingRequest(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "mc-city")
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		pending:            map[string]string{cityPath: "req-existing"},
+		supervisorRecorder: events.NewFake(),
+	}
+	init := &fakeInitializer{
+		scaffoldResult: &cityinit.InitResult{
+			CityName:     "mc-city",
+			CityPath:     cityPath,
+			ProviderUsed: "claude",
+		},
+	}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+
+	req := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{"dir":"`+cityPath+`","provider":"claude"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusConflict, rec.Body.String())
+	}
+	if got := resolver.pending[cityPath]; got != "req-existing" {
+		t.Fatalf("pending request_id = %q, want req-existing", got)
+	}
+	if init.scaffoldReq.Dir != "" {
+		t.Fatalf("Scaffold was called despite duplicate pending request: %+v", init.scaffoldReq)
+	}
+}
+
+func TestSupervisorCityCreateEmitsFailedEventForPostRegisterFailure(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "mc-city")
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: events.NewFake(),
+	}
+	lifecycleErr := errors.New("record city created event: disk full")
+	init := &fakeInitializer{
+		scaffoldResult: &cityinit.InitResult{
+			CityName:     "mc-city",
+			CityPath:     cityPath,
+			ProviderUsed: "claude",
+		},
+		scaffoldErr: cityinit.NewPostRegisterFailure(lifecycleErr),
+	}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+
+	req := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{"dir":"`+cityPath+`","provider":"claude"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	if _, ok, err := resolver.ConsumePendingRequestID(cityPath); err != nil {
+		t.Fatal(err)
+	} else if ok {
+		t.Fatal("pending request_id survived post-register failure")
+	}
+	recorded := resolver.supervisorRecorder.(*events.Fake).Events
+	if len(recorded) != 1 {
+		t.Fatalf("recorded %d events, want 1", len(recorded))
+	}
+	if recorded[0].Type != events.RequestFailed {
+		t.Fatalf("event type = %q, want %q", recorded[0].Type, events.RequestFailed)
+	}
+	var payload RequestFailedPayload
+	if err := json.Unmarshal(recorded[0].Payload, &payload); err != nil {
+		t.Fatalf("decode payload: %v", err)
+	}
+	if payload.RequestID != accepted.RequestID {
+		t.Fatalf("request_id = %q, want %q", payload.RequestID, accepted.RequestID)
+	}
+	if payload.Operation != RequestOperationCityCreate {
+		t.Fatalf("operation = %q, want %q", payload.Operation, RequestOperationCityCreate)
+	}
+	if payload.ErrorCode != "city_init_failed" {
+		t.Fatalf("error_code = %q, want city_init_failed", payload.ErrorCode)
+	}
+	if !strings.Contains(payload.ErrorMessage, lifecycleErr.Error()) {
+		t.Fatalf("error_message = %q, want %q", payload.ErrorMessage, lifecycleErr.Error())
+	}
+}
+
+func TestSupervisorCityRequestResultUsesCityTagOnSupervisorStream(t *testing.T) {
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: events.NewFake(),
+	}
+	sm := NewSupervisorMux(resolver, nil, false, "test", time.Now())
+
+	streamCtx, cancelStream := context.WithCancel(context.Background())
+	defer cancelStream()
+	streamReq := httptest.NewRequest(http.MethodGet, "/v0/events/stream?after_cursor=0", nil).WithContext(streamCtx)
+	streamReq.Header.Set("Accept", "text/event-stream")
+	streamRec := httptest.NewRecorder()
+	streamDone := make(chan struct{})
+	go func() {
+		defer close(streamDone)
+		sm.ServeHTTP(streamRec, streamReq)
+	}()
+
+	time.Sleep(50 * time.Millisecond)
+	EmitTypedEvent(resolver.supervisorRecorder, events.RequestResultCityCreate, "mc-city", CityCreateSucceededPayload{
+		RequestID: "req-test",
+		Name:      "mc-city",
+		Path:      "/tmp/mc-city",
+	})
+
+	time.Sleep(250 * time.Millisecond)
+	cancelStream()
+	<-streamDone
+
+	if streamRec.Code != http.StatusOK {
+		t.Fatalf("GET /v0/events/stream status = %d, want %d; body=%s", streamRec.Code, http.StatusOK, streamRec.Body.String())
+	}
+
+	frames := parseSSETestFrames(streamRec.Body.String())
+	observed := make([]string, 0, len(frames))
+	for _, frame := range frames {
+		if frame.Data == "" {
+			continue
+		}
+		var env struct {
+			Type    string         `json:"type"`
+			City    string         `json:"city"`
+			Payload map[string]any `json:"payload"`
+		}
+		if err := json.Unmarshal([]byte(frame.Data), &env); err != nil {
+			t.Fatalf("decode SSE data: %v; data=%s", err, frame.Data)
+		}
+		observed = append(observed, env.Type)
+		if env.Payload["request_id"] != "req-test" {
+			continue
+		}
+		switch env.Type {
+		case events.RequestResultCityCreate:
+			if env.City != "mc-city" {
+				t.Fatalf("city tag = %q, want mc-city; frame=%s", env.City, frame.Data)
+			}
+			return
+		case events.RequestFailed:
+			t.Fatalf("city create emitted request.failed for request_id req-test: %s", frame.Data)
+		}
+	}
+	t.Fatalf("stream did not emit request.result.city.create for request_id req-test; observed event types=%v body=%s", observed, streamRec.Body.String())
 }
 
 func TestSupervisorCityCreateMapsInitializerErrors(t *testing.T) {
@@ -148,6 +474,7 @@ func TestSupervisorCityCreateMapsInitializerErrors(t *testing.T) {
 		want int
 	}{
 		{name: "already initialized", err: cityinit.ErrAlreadyInitialized, want: http.StatusConflict},
+		{name: "invalid directory", err: cityinit.ErrInvalidDirectory, want: http.StatusUnprocessableEntity},
 		{name: "invalid provider", err: cityinit.ErrInvalidProvider, want: http.StatusUnprocessableEntity},
 		{name: "invalid bootstrap", err: cityinit.ErrInvalidBootstrapProfile, want: http.StatusUnprocessableEntity},
 		{name: "generic", err: errors.New("boom"), want: http.StatusInternalServerError},
@@ -171,6 +498,28 @@ func TestSupervisorCityCreateMapsInitializerErrors(t *testing.T) {
 	}
 }
 
+func TestSupervisorCityCreateClearsPendingRequestOnScaffoldError(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "mc-city")
+	resolver := &fakeCityResolver{cities: map[string]*fakeState{}, supervisorRecorder: events.NewFake()}
+	init := &fakeInitializer{scaffoldErr: errors.New("scaffold failed")}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+	req := httptest.NewRequest(http.MethodPost, "/v0/city", strings.NewReader(`{"dir":"`+cityPath+`","provider":"codex"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusInternalServerError, rec.Body.String())
+	}
+	if _, ok, err := resolver.ConsumePendingRequestID(cityPath); err != nil {
+		t.Fatal(err)
+	} else if ok {
+		t.Fatalf("pending request_id for %q survived synchronous scaffold failure", cityPath)
+	}
+}
+
 func TestSupervisorCityCreateWithoutInitializerReturns501(t *testing.T) {
 	sm := newTestSupervisorMux(t, map[string]*fakeState{})
 	cityPath := filepath.Join(t.TempDir(), "mc-city")
@@ -189,8 +538,9 @@ func TestSupervisorCityCreateWithoutInitializerReturns501(t *testing.T) {
 func TestSupervisorCityUnregisterUsesInitializer(t *testing.T) {
 	init := &fakeInitializer{
 		unregisterResult: &cityinit.UnregisterResult{
-			CityName: "mc-city",
-			CityPath: "/tmp/mc-city",
+			CityName:      "mc-city",
+			CityPath:      "/tmp/mc-city",
+			ReloadWarning: "reload failed",
 		},
 	}
 	sm := newTestSupervisorMuxWithInitializer(t, init)
@@ -206,8 +556,71 @@ func TestSupervisorCityUnregisterUsesInitializer(t *testing.T) {
 	if init.unregisterReq.CityName != "mc-city" {
 		t.Fatalf("Unregister CityName = %q, want mc-city", init.unregisterReq.CityName)
 	}
-	if body := rec.Body.String(); !strings.Contains(body, `"name":"mc-city"`) || !strings.Contains(body, `"path":"/tmp/mc-city"`) {
-		t.Fatalf("body = %s, want name and path", body)
+	if body := rec.Body.String(); !strings.Contains(body, `"request_id"`) {
+		t.Fatalf("body = %s, want request_id", body)
+	}
+}
+
+func TestSupervisorCityUnregisterReturnsCurrentEventCursor(t *testing.T) {
+	recorder := events.NewFake()
+	recorder.Record(events.Event{Type: events.SessionWoke, Actor: "seed"})
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: recorder,
+	}
+	init := &fakeInitializer{
+		unregisterResult: &cityinit.UnregisterResult{
+			CityName: "mc-city",
+			CityPath: "/tmp/mc-city",
+		},
+	}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+	req := httptest.NewRequest(http.MethodPost, "/v0/city/mc-city/unregister", nil)
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	if accepted.EventCursor != "__supervisor__:1" {
+		t.Fatalf("event_cursor = %q, want __supervisor__:1", accepted.EventCursor)
+	}
+}
+
+func TestSupervisorCityUnregisterStoresPendingRequestFromRegistryWhenSnapshotMissing(t *testing.T) {
+	const cityPath = "/tmp/mc-city"
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: events.NewFake(),
+	}
+	init := &fakeInitializer{
+		findResult: cityinit.RegisteredCity{
+			Name: "mc-city",
+			Path: cityPath,
+		},
+		unregisterResult: &cityinit.UnregisterResult{
+			CityName: "mc-city",
+			CityPath: cityPath,
+		},
+	}
+	sm := NewSupervisorMux(resolver, init, false, "test", time.Now())
+	req := httptest.NewRequest(http.MethodPost, "/v0/city/mc-city/unregister", nil)
+	req.Header.Set("X-GC-Request", "test")
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusAccepted, rec.Body.String())
+	}
+	if init.findName != "mc-city" {
+		t.Fatalf("FindRegisteredCity name = %q, want mc-city", init.findName)
+	}
+	if got := resolver.pending[cityPath]; got == "" {
+		t.Fatalf("pending request_id for %q was not stored", cityPath)
 	}
 }
 
diff --git a/internal/api/huma_sse_test.go b/internal/api/huma_sse_test.go
index 3278ffb521..89fe6aa130 100644
--- a/internal/api/huma_sse_test.go
+++ b/internal/api/huma_sse_test.go
@@ -288,6 +288,11 @@ func assertTypedEventEnvelopeUnion(t *testing.T, spec map[string]any, schemaName
 		if !ok {
 			t.Fatalf("%s variant %s type property missing", schemaName, ref)
 		}
+		if _, ok := typeProperty["not"].(map[string]any); ok {
+			assertCustomEventEnvelopeVariant(t, schemaName, ref, cityField, properties, variant, typeProperty)
+			seen[""]++
+			continue
+		}
 		eventType := constOrSingleEnum(t, typeProperty)
 		wantPayloadRef, ok := expectedPayloadRefs[eventType]
 		if !ok {
@@ -335,6 +340,9 @@ func assertTypedEventEnvelopeUnion(t *testing.T, spec map[string]any, schemaName
 	if len(discriminator) != len(events.KnownEventTypes) {
 		t.Fatalf("%s discriminator mapping count = %d, want %d", schemaName, len(discriminator), len(events.KnownEventTypes))
 	}
+	if seen[""] != 1 {
+		t.Fatalf("%s custom event branch count = %d, want 1", schemaName, seen[""])
+	}
 	for eventType := range discriminator {
 		if seen[eventType] == 0 {
 			t.Fatalf("%s discriminator maps unknown event type %q", schemaName, eventType)
@@ -342,6 +350,62 @@ func assertTypedEventEnvelopeUnion(t *testing.T, spec map[string]any, schemaName
 	}
 }
 
+func assertCustomEventEnvelopeVariant(
+	t *testing.T,
+	schemaName string,
+	ref string,
+	cityField bool,
+	properties map[string]any,
+	variant map[string]any,
+	typeProperty map[string]any,
+) {
+	t.Helper()
+
+	notSchema, ok := typeProperty["not"].(map[string]any)
+	if !ok {
+		t.Fatalf("%s custom variant %s missing type.not schema", schemaName, ref)
+	}
+	rawEnum, ok := notSchema["enum"].([]any)
+	if !ok {
+		t.Fatalf("%s custom variant %s type.not.enum missing", schemaName, ref)
+	}
+	blocked := make(map[string]bool, len(rawEnum))
+	for _, raw := range rawEnum {
+		eventType, ok := raw.(string)
+		if !ok {
+			t.Fatalf("%s custom variant %s type.not.enum contains non-string %#v", schemaName, ref, raw)
+		}
+		blocked[eventType] = true
+	}
+	for _, eventType := range events.KnownEventTypes {
+		if !blocked[eventType] {
+			t.Fatalf("%s custom variant %s does not exclude known event type %q", schemaName, ref, eventType)
+		}
+	}
+	if _, ok := typeProperty["const"]; ok {
+		t.Fatalf("%s custom variant %s type schema must not have const", schemaName, ref)
+	}
+	if _, ok := typeProperty["enum"]; ok {
+		t.Fatalf("%s custom variant %s type schema must not have enum", schemaName, ref)
+	}
+	payloadProperty, ok := properties["payload"].(map[string]any)
+	if !ok {
+		t.Fatalf("%s custom variant %s payload property missing", schemaName, ref)
+	}
+	if len(payloadProperty) != 0 {
+		t.Fatalf("%s custom variant %s payload schema = %#v, want unconstrained custom JSON", schemaName, ref, payloadProperty)
+	}
+
+	wantRequired := []string{"seq", "type", "ts", "actor", "payload"}
+	wantProperties := []string{"seq", "type", "ts", "actor", "subject", "message", "workflow", "payload"}
+	if cityField {
+		wantRequired = append(wantRequired, "city")
+		wantProperties = append(wantProperties, "city")
+	}
+	assertProperties(t, schemaName, "custom", properties, wantProperties)
+	assertRequiredFields(t, schemaName, "custom", variant, wantRequired)
+}
+
 func typedEventDiscriminatorMapping(t *testing.T, union map[string]any, schemaName string) map[string]string {
 	t.Helper()
 
diff --git a/internal/api/huma_types_events.go b/internal/api/huma_types_events.go
index 227a3b6444..4e3650a634 100644
--- a/internal/api/huma_types_events.go
+++ b/internal/api/huma_types_events.go
@@ -44,8 +44,8 @@ type EventEmitOutput struct {
 // EventStreamInput is the Huma input for GET /v0/city/{cityName}/events/stream.
 type EventStreamInput struct {
 	CityScope
-	AfterSeq    string `query:"after_seq" required:"false" doc:"Reconnect position: only deliver events after this sequence number."`
-	LastEventID string `header:"Last-Event-ID" required:"false" doc:"SSE reconnect position from the last received event ID."`
+	AfterSeq    string `query:"after_seq" required:"false" doc:"Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head."`
+	LastEventID string `header:"Last-Event-ID" required:"false" doc:"SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head."`
 }
 
 // HeartbeatEvent is an empty event emitted periodically on SSE streams to keep
diff --git a/internal/api/huma_types_mail.go b/internal/api/huma_types_mail.go
index fd61c6238a..0a5b303dd9 100644
--- a/internal/api/huma_types_mail.go
+++ b/internal/api/huma_types_mail.go
@@ -107,7 +107,7 @@ type MailDeleteInput struct {
 // MailThreadInput is the Huma input for GET /v0/city/{cityName}/mail/thread/{id}.
 type MailThreadInput struct {
 	CityScope
-	ID  string `path:"id" doc:"Thread ID."`
+	ID  string `path:"id" doc:"Thread ID, or any message ID in the thread."`
 	Rig string `query:"rig" required:"false" doc:"Filter by rig."`
 }
 
diff --git a/internal/api/huma_types_orders.go b/internal/api/huma_types_orders.go
index 85e8429e4c..3af423a3ee 100644
--- a/internal/api/huma_types_orders.go
+++ b/internal/api/huma_types_orders.go
@@ -28,6 +28,7 @@ type OrderGetInput struct {
 // OrderCheckInput is the Huma input for GET /v0/city/{cityName}/orders/check.
 type OrderCheckInput struct {
 	CityScope
+	Fresh bool `query:"fresh" required:"false" doc:"Bypass cached order-check responses and cached order history."`
 }
 
 // OrderHistoryInput is the Huma input for GET /v0/city/{cityName}/orders/history.
diff --git a/internal/api/huma_types_patches.go b/internal/api/huma_types_patches.go
index d4215cb132..2a4b90cf67 100644
--- a/internal/api/huma_types_patches.go
+++ b/internal/api/huma_types_patches.go
@@ -149,18 +149,20 @@ type PatchDeletedResponse struct {
 
 // StatusBody is the response body for GET /v0/status.
 type StatusBody struct {
-	Name       string            `json:"name" doc:"City name."`
-	Path       string            `json:"path" doc:"City directory path."`
-	Version    string            `json:"version,omitempty" doc:"Server version."`
-	UptimeSec  int               `json:"uptime_sec" doc:"Server uptime in seconds."`
-	Suspended  bool              `json:"suspended" doc:"Whether the city is suspended."`
-	AgentCount int               `json:"agent_count" doc:"Total agent count (deprecated, use agents.total)."`
-	RigCount   int               `json:"rig_count" doc:"Total rig count (deprecated, use rigs.total)."`
-	Running    int               `json:"running" doc:"Number of running agent processes."`
-	Agents     StatusAgentCounts `json:"agents" doc:"Agent state counts."`
-	Rigs       StatusRigCounts   `json:"rigs" doc:"Rig state counts."`
-	Work       StatusWorkCounts  `json:"work" doc:"Work item counts."`
-	Mail       StatusMailCounts  `json:"mail" doc:"Mail counts."`
+	Name          string            `json:"name" doc:"City name."`
+	Path          string            `json:"path" doc:"City directory path."`
+	Version       string            `json:"version,omitempty" doc:"Server version."`
+	UptimeSec     int               `json:"uptime_sec" doc:"Server uptime in seconds."`
+	Suspended     bool              `json:"suspended" doc:"Whether the city is suspended."`
+	AgentCount    int               `json:"agent_count" doc:"Total agent count (deprecated, use agents.total)."`
+	RigCount      int               `json:"rig_count" doc:"Total rig count (deprecated, use rigs.total)."`
+	Running       int               `json:"running" doc:"Number of running agent processes."`
+	Agents        StatusAgentCounts `json:"agents" doc:"Agent state counts."`
+	Rigs          StatusRigCounts   `json:"rigs" doc:"Rig state counts."`
+	Work          StatusWorkCounts  `json:"work" doc:"Work item counts."`
+	Mail          StatusMailCounts  `json:"mail" doc:"Mail counts."`
+	Partial       bool              `json:"partial,omitempty" doc:"True when one or more status backing reads returned incomplete data."`
+	PartialErrors []string          `json:"partial_errors,omitempty" doc:"Human-readable errors from incomplete status backing reads."`
 }
 
 // Session types moved to huma_types_sessions.go.
diff --git a/internal/api/huma_types_sessions.go b/internal/api/huma_types_sessions.go
index 2789f860a1..04374a49ab 100644
--- a/internal/api/huma_types_sessions.go
+++ b/internal/api/huma_types_sessions.go
@@ -58,12 +58,17 @@ type SessionCreateInput struct {
 	Body sessionCreateBody
 }
 
+// asyncAcceptedBody is the response body for all async session 202 responses.
+type asyncAcceptedBody struct {
+	Status      string `json:"status" doc:"Async request status." example:"accepted"`
+	RequestID   string `json:"request_id" doc:"Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id."`
+	EventCursor string `json:"event_cursor" doc:"City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty."`
+}
+
 // SessionCreateOutput is the Huma output for POST /v0/sessions.
-// Status allows the handler to return different HTTP status codes:
-// 201 Created for provider sessions, 202 Accepted for agent sessions.
 type SessionCreateOutput struct {
 	Status int `json:"-"`
-	Body   sessionResponse
+	Body   asyncAcceptedBody
 }
 
 // SessionIDInput is a generic Huma input for session endpoints that only need {cityName}+{id}.
@@ -79,6 +84,7 @@ type SessionTranscriptInput struct {
 	ID     string `path:"id" doc:"Session ID, alias, or runtime session_name."`
 	Format string `query:"format" required:"false" doc:"Transcript format: conversation (default) or raw."`
 	Before string `query:"before" required:"false" doc:"Pagination cursor: return entries before this UUID."`
+	After  string `query:"after" required:"false" doc:"Pagination cursor: return entries after this UUID."`
 }
 
 // SessionStreamInput is the Huma input for GET /v0/city/{cityName}/session/{id}/stream.
@@ -133,12 +139,7 @@ type SessionSubmitInput struct {
 
 // SessionSubmitOutput is the Huma output for POST /v0/session/{id}/submit.
 type SessionSubmitOutput struct {
-	Body struct {
-		Status string `json:"status" doc:"Operation result." example:"accepted"`
-		ID     string `json:"id" doc:"Session ID."`
-		Queued bool   `json:"queued" doc:"Whether the message was queued."`
-		Intent string `json:"intent" doc:"Resolved submit intent."`
-	}
+	Body asyncAcceptedBody
 }
 
 // SessionMessageInput is the Huma input for POST /v0/city/{cityName}/session/{id}/messages.
@@ -154,10 +155,7 @@ type SessionMessageInput struct {
 
 // SessionMessageOutput is the Huma output for POST /v0/session/{id}/messages.
 type SessionMessageOutput struct {
-	Body struct {
-		Status string `json:"status" doc:"Operation result." example:"accepted"`
-		ID     string `json:"id" doc:"Session ID."`
-	}
+	Body asyncAcceptedBody
 }
 
 // SessionRespondInput is the Huma input for POST /v0/city/{cityName}/session/{id}/respond.
diff --git a/internal/api/middleware.go b/internal/api/middleware.go
index 04b466e227..ed6272a69d 100644
--- a/internal/api/middleware.go
+++ b/internal/api/middleware.go
@@ -105,7 +105,7 @@ func withCORS(next http.Handler) http.Handler {
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
 			w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Last-Event-ID, X-GC-Request")
-			w.Header().Set("Access-Control-Expose-Headers", "X-GC-Index, X-GC-Request-Id")
+			w.Header().Set("Access-Control-Expose-Headers", "X-GC-Index, X-GC-Request-Id, Retry-After")
 		}
 		if r.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusNoContent)
diff --git a/internal/api/openapi.json b/internal/api/openapi.json
index dcac755149..422f30da13 100644
--- a/internal/api/openapi.json
+++ b/internal/api/openapi.json
@@ -724,6 +724,50 @@
         ],
         "type": "object"
       },
+      "AsyncAcceptedBody": {
+        "additionalProperties": false,
+        "properties": {
+          "event_cursor": {
+            "description": "City event-stream sequence captured before the async request was accepted. Pass this value as after_seq to /v0/city/{cityName}/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or the event log is empty.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID. Watch the city event stream for request.result.session.create, request.result.session.message, request.result.session.submit, or request.failed with this request_id.",
+            "type": "string"
+          },
+          "status": {
+            "description": "Async request status.",
+            "examples": [
+              "accepted"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "status",
+          "request_id",
+          "event_cursor"
+        ],
+        "type": "object"
+      },
+      "AsyncAcceptedResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "event_cursor": {
+            "description": "Supervisor event-stream cursor captured before the async request was accepted. Pass this value as after_cursor to /v0/events/stream to receive the request result without replaying unrelated historical backlog. A value of 0 can also mean no event provider is configured or every event log is empty.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID. Watch /v0/events/stream for request.result.city.create, request.result.city.unregister, or request.failed with this request_id.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "request_id",
+          "event_cursor"
+        ],
+        "type": "object"
+      },
       "Bead": {
         "additionalProperties": false,
         "properties": {
@@ -1045,35 +1089,38 @@
             "type": "string"
           },
           "provider": {
-            "description": "Provider name for the city's default session template.",
+            "description": "Provider name for the city's default session template. Mutually exclusive with start_command.",
             "minLength": 1,
             "type": "string"
+          },
+          "start_command": {
+            "description": "Custom workspace start command for the city's default session template. Mutually exclusive with provider.",
+            "type": "string"
           }
         },
         "required": [
-          "dir",
-          "provider"
+          "dir"
         ],
         "type": "object"
       },
-      "CityCreateResponse": {
+      "CityCreateSucceededPayload": {
         "additionalProperties": false,
         "properties": {
           "name": {
-            "description": "Resolved city name as persisted in city.toml. Use this to filter the event stream for completion.",
+            "description": "Resolved city name.",
             "type": "string"
           },
-          "ok": {
-            "description": "True when scaffolding + registration succeeded. Does not imply the city is ready yet; watch /v0/events/stream for city.ready.",
-            "type": "boolean"
-          },
           "path": {
-            "description": "Resolved absolute path of the created city directory.",
+            "description": "Resolved absolute city directory path.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           }
         },
         "required": [
-          "ok",
+          "request_id",
           "name",
           "path"
         ],
@@ -1161,23 +1208,11 @@
       "CityLifecyclePayload": {
         "additionalProperties": false,
         "properties": {
-          "error": {
-            "type": "string"
-          },
           "name": {
             "type": "string"
           },
           "path": {
             "type": "string"
-          },
-          "phases_completed": {
-            "items": {
-              "type": "string"
-            },
-            "type": [
-              "array",
-              "null"
-            ]
           }
         },
         "required": [
@@ -1196,24 +1231,24 @@
         },
         "type": "object"
       },
-      "CityUnregisterResponse": {
+      "CityUnregisterSucceededPayload": {
         "additionalProperties": false,
         "properties": {
           "name": {
-            "description": "Resolved registry name. Filter the event stream by this to observe completion.",
+            "description": "City name that was unregistered.",
             "type": "string"
           },
-          "ok": {
-            "description": "True when the registry entry was removed and the supervisor was signaled. Does not imply the city's controller has stopped yet; watch /v0/events/stream for city.unregistered.",
-            "type": "boolean"
-          },
           "path": {
-            "description": "Resolved absolute city directory. The directory itself is not modified; unregister only affects the supervisor's registry.",
+            "description": "Absolute city directory path.",
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           }
         },
         "required": [
-          "ok",
+          "request_id",
           "name",
           "path"
         ],
@@ -1957,9 +1992,15 @@
           {
             "$ref": "#/components/schemas/BoundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/CityLifecyclePayload"
           },
+          {
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
@@ -1975,6 +2016,18 @@
           {
             "$ref": "#/components/schemas/OutboundEventPayload"
           },
+          {
+            "$ref": "#/components/schemas/RequestFailedPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
+          },
+          {
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
+          },
           {
             "$ref": "#/components/schemas/UnboundEventPayload"
           },
@@ -2562,10 +2615,16 @@
           "partial": {
             "description": "Whether the list is partial.",
             "type": "boolean"
+          },
+          "total": {
+            "description": "Total number of formulas in the list.",
+            "format": "int64",
+            "type": "integer"
           }
         },
         "required": [
           "items",
+          "total",
           "partial"
         ],
         "type": "object"
@@ -3546,7 +3605,7 @@
           "items": {
             "description": "The list of items.",
             "items": {
-              "$ref": "#/components/schemas/WireEvent"
+              "$ref": "#/components/schemas/TypedEventStreamEnvelope"
             },
             "type": [
               "array",
@@ -5150,6 +5209,41 @@
         ],
         "type": "object"
       },
+      "RequestFailedPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "error_code": {
+            "description": "Machine-readable error code.",
+            "type": "string"
+          },
+          "error_message": {
+            "description": "Human-readable error description.",
+            "type": "string"
+          },
+          "operation": {
+            "description": "Which operation failed.",
+            "enum": [
+              "city.create",
+              "city.unregister",
+              "session.create",
+              "session.message",
+              "session.submit"
+            ],
+            "type": "string"
+          },
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "request_id",
+          "operation",
+          "error_code",
+          "error_message"
+        ],
+        "type": "object"
+      },
       "RigActionBody": {
         "additionalProperties": false,
         "properties": {
@@ -5539,6 +5633,24 @@
         },
         "type": "object"
       },
+      "SessionCreateSucceededPayload": {
+        "additionalProperties": false,
+        "properties": {
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          },
+          "session": {
+            "$ref": "#/components/schemas/SessionResponse",
+            "description": "Full session state as returned by GET /session/{id}. For session.create, this result is emitted only after the session has left creating and can accept normal metadata and lifecycle commands."
+          }
+        },
+        "required": [
+          "request_id",
+          "session"
+        ],
+        "type": "object"
+      },
       "SessionInfo": {
         "additionalProperties": false,
         "properties": {
@@ -5574,24 +5686,21 @@
         ],
         "type": "object"
       },
-      "SessionMessageOutputBody": {
+      "SessionMessageSucceededPayload": {
         "additionalProperties": false,
         "properties": {
-          "id": {
-            "description": "Session ID.",
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
             "type": "string"
           },
-          "status": {
-            "description": "Operation result.",
-            "examples": [
-              "accepted"
-            ],
+          "session_id": {
+            "description": "Session ID that received the message.",
             "type": "string"
           }
         },
         "required": [
-          "status",
-          "id"
+          "request_id",
+          "session_id"
         ],
         "type": "object"
       },
@@ -5912,32 +6021,29 @@
         ],
         "type": "object"
       },
-      "SessionSubmitOutputBody": {
+      "SessionSubmitSucceededPayload": {
         "additionalProperties": false,
         "properties": {
-          "id": {
-            "description": "Session ID.",
-            "type": "string"
-          },
           "intent": {
-            "description": "Resolved submit intent.",
+            "description": "Resolved submit intent (default, follow_up, interrupt_now).",
             "type": "string"
           },
           "queued": {
-            "description": "Whether the message was queued.",
+            "description": "Whether the message was queued for later delivery.",
             "type": "boolean"
           },
-          "status": {
-            "description": "Operation result.",
-            "examples": [
-              "accepted"
-            ],
+          "request_id": {
+            "description": "Correlation ID from the 202 response.",
+            "type": "string"
+          },
+          "session_id": {
+            "description": "Session ID that received the submission.",
             "type": "string"
           }
         },
         "required": [
-          "status",
-          "id",
+          "request_id",
+          "session_id",
           "queued",
           "intent"
         ],
@@ -6201,6 +6307,20 @@
             "description": "City name.",
             "type": "string"
           },
+          "partial": {
+            "description": "True when one or more status backing reads returned incomplete data.",
+            "type": "boolean"
+          },
+          "partial_errors": {
+            "description": "Human-readable errors from incomplete status backing reads.",
+            "items": {
+              "type": "string"
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          },
           "path": {
             "description": "City directory path.",
             "type": "string"
@@ -6371,9 +6491,13 @@
       "SupervisorEventListOutputBody": {
         "additionalProperties": false,
         "properties": {
+          "event_cursor": {
+            "description": "Supervisor event-stream cursor captured before the history snapshot was listed. Pass this value as after_cursor to /v0/events/stream to receive events emitted after the snapshot boundary without replaying unrelated historical backlog.",
+            "type": "string"
+          },
           "items": {
             "items": {
-              "$ref": "#/components/schemas/WireTaggedEvent"
+              "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelope"
             },
             "type": [
               "array",
@@ -6386,6 +6510,7 @@
           }
         },
         "required": [
+          "event_cursor",
           "items",
           "total"
         ],
@@ -6525,13 +6650,9 @@
             "bead.created": "#/components/schemas/TypedEventStreamEnvelopeBeadCreated",
             "bead.updated": "#/components/schemas/TypedEventStreamEnvelopeBeadUpdated",
             "city.created": "#/components/schemas/TypedEventStreamEnvelopeCityCreated",
-            "city.init_failed": "#/components/schemas/TypedEventStreamEnvelopeCityInitFailed",
-            "city.ready": "#/components/schemas/TypedEventStreamEnvelopeCityReady",
             "city.resumed": "#/components/schemas/TypedEventStreamEnvelopeCityResumed",
             "city.suspended": "#/components/schemas/TypedEventStreamEnvelopeCitySuspended",
-            "city.unregister_failed": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterFailed",
             "city.unregister_requested": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterRequested",
-            "city.unregistered": "#/components/schemas/TypedEventStreamEnvelopeCityUnregistered",
             "controller.started": "#/components/schemas/TypedEventStreamEnvelopeControllerStarted",
             "controller.stopped": "#/components/schemas/TypedEventStreamEnvelopeControllerStopped",
             "convoy.closed": "#/components/schemas/TypedEventStreamEnvelopeConvoyClosed",
@@ -6554,6 +6675,12 @@
             "order.failed": "#/components/schemas/TypedEventStreamEnvelopeOrderFailed",
             "order.fired": "#/components/schemas/TypedEventStreamEnvelopeOrderFired",
             "provider.swapped": "#/components/schemas/TypedEventStreamEnvelopeProviderSwapped",
+            "request.failed": "#/components/schemas/TypedEventStreamEnvelopeRequestFailed",
+            "request.result.city.create": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityCreate",
+            "request.result.city.unregister": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityUnregister",
+            "request.result.session.create": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionCreate",
+            "request.result.session.message": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionMessage",
+            "request.result.session.submit": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionSubmit",
             "session.crashed": "#/components/schemas/TypedEventStreamEnvelopeSessionCrashed",
             "session.draining": "#/components/schemas/TypedEventStreamEnvelopeSessionDraining",
             "session.idle_killed": "#/components/schemas/TypedEventStreamEnvelopeSessionIdleKilled",
@@ -6580,27 +6707,15 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityCreated"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityInitFailed"
-          },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityReady"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityResumed"
           },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCitySuspended"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterFailed"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregisterRequested"
           },
-          {
-            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCityUnregistered"
-          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeControllerStarted"
           },
@@ -6667,6 +6782,24 @@
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeProviderSwapped"
           },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestFailed"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultCityUnregister"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionMessage"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeRequestResultSessionSubmit"
+          },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeSessionCrashed"
           },
@@ -6696,6 +6829,9 @@
           },
           {
             "$ref": "#/components/schemas/TypedEventStreamEnvelopeWorkerOperation"
+          },
+          {
+            "$ref": "#/components/schemas/TypedEventStreamEnvelopeCustom"
           }
         ],
         "title": "Typed city event stream envelope"
@@ -6868,7 +7004,7 @@
         "title": "TypedEventStreamEnvelope city.created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityInitFailed": {
+      "TypedEventStreamEnvelopeCityResumed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6878,7 +7014,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -6893,7 +7029,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.init_failed",
+            "const": "city.resumed",
             "type": "string"
           },
           "workflow": {
@@ -6907,10 +7043,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.init_failed",
+        "title": "TypedEventStreamEnvelope city.resumed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityReady": {
+      "TypedEventStreamEnvelopeCitySuspended": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6920,7 +7056,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -6935,7 +7071,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.ready",
+            "const": "city.suspended",
             "type": "string"
           },
           "workflow": {
@@ -6949,10 +7085,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.ready",
+        "title": "TypedEventStreamEnvelope city.suspended",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityResumed": {
+      "TypedEventStreamEnvelopeCityUnregisterRequested": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -6962,7 +7098,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityLifecyclePayload"
           },
           "seq": {
             "format": "int64",
@@ -6977,7 +7113,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.resumed",
+            "const": "city.unregister_requested",
             "type": "string"
           },
           "workflow": {
@@ -6991,10 +7127,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.resumed",
+        "title": "TypedEventStreamEnvelope city.unregister_requested",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCitySuspended": {
+      "TypedEventStreamEnvelopeControllerStarted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7019,7 +7155,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.suspended",
+            "const": "controller.started",
             "type": "string"
           },
           "workflow": {
@@ -7033,10 +7169,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.suspended",
+        "title": "TypedEventStreamEnvelope controller.started",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregisterFailed": {
+      "TypedEventStreamEnvelopeControllerStopped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7046,7 +7182,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7061,7 +7197,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_failed",
+            "const": "controller.stopped",
             "type": "string"
           },
           "workflow": {
@@ -7075,10 +7211,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregister_failed",
+        "title": "TypedEventStreamEnvelope controller.stopped",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregisterRequested": {
+      "TypedEventStreamEnvelopeConvoyClosed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7088,7 +7224,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7103,7 +7239,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_requested",
+            "const": "convoy.closed",
             "type": "string"
           },
           "workflow": {
@@ -7117,10 +7253,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregister_requested",
+        "title": "TypedEventStreamEnvelope convoy.closed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeCityUnregistered": {
+      "TypedEventStreamEnvelopeConvoyCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7130,7 +7266,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7145,7 +7281,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregistered",
+            "const": "convoy.created",
             "type": "string"
           },
           "workflow": {
@@ -7159,10 +7295,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope city.unregistered",
+        "title": "TypedEventStreamEnvelope convoy.created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeControllerStarted": {
+      "TypedEventStreamEnvelopeCustom": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7171,9 +7307,7 @@
           "message": {
             "type": "string"
           },
-          "payload": {
-            "$ref": "#/components/schemas/NoPayload"
-          },
+          "payload": {},
           "seq": {
             "format": "int64",
             "minimum": 0,
@@ -7187,7 +7321,55 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.started",
+            "not": {
+              "enum": [
+                "session.woke",
+                "session.stopped",
+                "session.crashed",
+                "session.draining",
+                "session.undrained",
+                "session.quarantined",
+                "session.idle_killed",
+                "session.suspended",
+                "session.updated",
+                "bead.created",
+                "bead.closed",
+                "bead.updated",
+                "mail.sent",
+                "mail.read",
+                "mail.archived",
+                "mail.marked_read",
+                "mail.marked_unread",
+                "mail.replied",
+                "mail.deleted",
+                "convoy.created",
+                "convoy.closed",
+                "controller.started",
+                "controller.stopped",
+                "city.suspended",
+                "city.resumed",
+                "request.result.city.create",
+                "request.result.city.unregister",
+                "request.result.session.create",
+                "request.result.session.message",
+                "request.result.session.submit",
+                "request.failed",
+                "city.created",
+                "city.unregister_requested",
+                "order.fired",
+                "order.completed",
+                "order.failed",
+                "provider.swapped",
+                "worker.operation",
+                "extmsg.bound",
+                "extmsg.unbound",
+                "extmsg.group_created",
+                "extmsg.adapter_added",
+                "extmsg.adapter_removed",
+                "extmsg.inbound",
+                "extmsg.outbound"
+              ]
+            },
             "type": "string"
           },
           "workflow": {
@@ -7201,10 +7383,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope controller.started",
+        "title": "TypedEventStreamEnvelope custom",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeControllerStopped": {
+      "TypedEventStreamEnvelopeExtmsgAdapterAdded": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7214,7 +7396,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7229,7 +7411,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.stopped",
+            "const": "extmsg.adapter_added",
             "type": "string"
           },
           "workflow": {
@@ -7243,10 +7425,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope controller.stopped",
+        "title": "TypedEventStreamEnvelope extmsg.adapter_added",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeConvoyClosed": {
+      "TypedEventStreamEnvelopeExtmsgAdapterRemoved": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7256,7 +7438,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7271,7 +7453,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.closed",
+            "const": "extmsg.adapter_removed",
             "type": "string"
           },
           "workflow": {
@@ -7285,10 +7467,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope convoy.closed",
+        "title": "TypedEventStreamEnvelope extmsg.adapter_removed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeConvoyCreated": {
+      "TypedEventStreamEnvelopeExtmsgBound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7298,7 +7480,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/BoundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7313,7 +7495,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.created",
+            "const": "extmsg.bound",
             "type": "string"
           },
           "workflow": {
@@ -7327,10 +7509,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope convoy.created",
+        "title": "TypedEventStreamEnvelope extmsg.bound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgAdapterAdded": {
+      "TypedEventStreamEnvelopeExtmsgGroupCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7340,7 +7522,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7355,7 +7537,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_added",
+            "const": "extmsg.group_created",
             "type": "string"
           },
           "workflow": {
@@ -7369,10 +7551,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.adapter_added",
+        "title": "TypedEventStreamEnvelope extmsg.group_created",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgAdapterRemoved": {
+      "TypedEventStreamEnvelopeExtmsgInbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7382,7 +7564,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/InboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7397,7 +7579,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_removed",
+            "const": "extmsg.inbound",
             "type": "string"
           },
           "workflow": {
@@ -7411,10 +7593,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.adapter_removed",
+        "title": "TypedEventStreamEnvelope extmsg.inbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgBound": {
+      "TypedEventStreamEnvelopeExtmsgOutbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7424,7 +7606,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/BoundEventPayload"
+            "$ref": "#/components/schemas/OutboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7439,7 +7621,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.bound",
+            "const": "extmsg.outbound",
             "type": "string"
           },
           "workflow": {
@@ -7453,10 +7635,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.bound",
+        "title": "TypedEventStreamEnvelope extmsg.outbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgGroupCreated": {
+      "TypedEventStreamEnvelopeExtmsgUnbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7466,7 +7648,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/GroupCreatedEventPayload"
+            "$ref": "#/components/schemas/UnboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7481,7 +7663,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.group_created",
+            "const": "extmsg.unbound",
             "type": "string"
           },
           "workflow": {
@@ -7495,10 +7677,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.group_created",
+        "title": "TypedEventStreamEnvelope extmsg.unbound",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgInbound": {
+      "TypedEventStreamEnvelopeMailArchived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7508,7 +7690,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/InboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7523,7 +7705,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.inbound",
+            "const": "mail.archived",
             "type": "string"
           },
           "workflow": {
@@ -7537,10 +7719,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.inbound",
+        "title": "TypedEventStreamEnvelope mail.archived",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgOutbound": {
+      "TypedEventStreamEnvelopeMailDeleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7550,7 +7732,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/OutboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7565,7 +7747,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.outbound",
+            "const": "mail.deleted",
             "type": "string"
           },
           "workflow": {
@@ -7579,10 +7761,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.outbound",
+        "title": "TypedEventStreamEnvelope mail.deleted",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeExtmsgUnbound": {
+      "TypedEventStreamEnvelopeMailMarkedRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7592,7 +7774,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/UnboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -7607,7 +7789,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.unbound",
+            "const": "mail.marked_read",
             "type": "string"
           },
           "workflow": {
@@ -7621,10 +7803,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope extmsg.unbound",
+        "title": "TypedEventStreamEnvelope mail.marked_read",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailArchived": {
+      "TypedEventStreamEnvelopeMailMarkedUnread": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7649,7 +7831,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.archived",
+            "const": "mail.marked_unread",
             "type": "string"
           },
           "workflow": {
@@ -7663,10 +7845,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.archived",
+        "title": "TypedEventStreamEnvelope mail.marked_unread",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailDeleted": {
+      "TypedEventStreamEnvelopeMailRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7691,7 +7873,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.deleted",
+            "const": "mail.read",
             "type": "string"
           },
           "workflow": {
@@ -7705,10 +7887,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.deleted",
+        "title": "TypedEventStreamEnvelope mail.read",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailMarkedRead": {
+      "TypedEventStreamEnvelopeMailReplied": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7733,7 +7915,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_read",
+            "const": "mail.replied",
             "type": "string"
           },
           "workflow": {
@@ -7747,10 +7929,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.marked_read",
+        "title": "TypedEventStreamEnvelope mail.replied",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailMarkedUnread": {
+      "TypedEventStreamEnvelopeMailSent": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7775,7 +7957,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_unread",
+            "const": "mail.sent",
             "type": "string"
           },
           "workflow": {
@@ -7789,10 +7971,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.marked_unread",
+        "title": "TypedEventStreamEnvelope mail.sent",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailRead": {
+      "TypedEventStreamEnvelopeOrderCompleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7802,7 +7984,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7817,7 +7999,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.read",
+            "const": "order.completed",
             "type": "string"
           },
           "workflow": {
@@ -7831,10 +8013,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.read",
+        "title": "TypedEventStreamEnvelope order.completed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailReplied": {
+      "TypedEventStreamEnvelopeOrderFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7844,7 +8026,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7859,7 +8041,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.replied",
+            "const": "order.failed",
             "type": "string"
           },
           "workflow": {
@@ -7873,10 +8055,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.replied",
+        "title": "TypedEventStreamEnvelope order.failed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeMailSent": {
+      "TypedEventStreamEnvelopeOrderFired": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7886,7 +8068,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -7901,7 +8083,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.sent",
+            "const": "order.fired",
             "type": "string"
           },
           "workflow": {
@@ -7915,10 +8097,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope mail.sent",
+        "title": "TypedEventStreamEnvelope order.fired",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderCompleted": {
+      "TypedEventStreamEnvelopeProviderSwapped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7943,7 +8125,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.completed",
+            "const": "provider.swapped",
             "type": "string"
           },
           "workflow": {
@@ -7957,10 +8139,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.completed",
+        "title": "TypedEventStreamEnvelope provider.swapped",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderFailed": {
+      "TypedEventStreamEnvelopeRequestFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -7970,7 +8152,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/RequestFailedPayload"
           },
           "seq": {
             "format": "int64",
@@ -7985,7 +8167,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.failed",
+            "const": "request.failed",
             "type": "string"
           },
           "workflow": {
@@ -7999,10 +8181,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.failed",
+        "title": "TypedEventStreamEnvelope request.failed",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeOrderFired": {
+      "TypedEventStreamEnvelopeRequestResultCityCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8012,7 +8194,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -8027,7 +8209,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.fired",
+            "const": "request.result.city.create",
             "type": "string"
           },
           "workflow": {
@@ -8041,10 +8223,10 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope order.fired",
+        "title": "TypedEventStreamEnvelope request.result.city.create",
         "type": "object"
       },
-      "TypedEventStreamEnvelopeProviderSwapped": {
+      "TypedEventStreamEnvelopeRequestResultCityUnregister": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8054,7 +8236,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -8069,7 +8251,7 @@
             "type": "string"
           },
           "type": {
-            "const": "provider.swapped",
+            "const": "request.result.city.unregister",
             "type": "string"
           },
           "workflow": {
@@ -8083,7 +8265,133 @@
           "actor",
           "payload"
         ],
-        "title": "TypedEventStreamEnvelope provider.swapped",
+        "title": "TypedEventStreamEnvelope request.result.city.unregister",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionCreate": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.create",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.create",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionMessage": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.message",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.message",
+        "type": "object"
+      },
+      "TypedEventStreamEnvelopeRequestResultSessionSubmit": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "request.result.session.submit",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload"
+        ],
+        "title": "TypedEventStreamEnvelope request.result.session.submit",
         "type": "object"
       },
       "TypedEventStreamEnvelopeSessionCrashed": {
@@ -8514,13 +8822,9 @@
             "bead.created": "#/components/schemas/TypedTaggedEventStreamEnvelopeBeadCreated",
             "bead.updated": "#/components/schemas/TypedTaggedEventStreamEnvelopeBeadUpdated",
             "city.created": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityCreated",
-            "city.init_failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityInitFailed",
-            "city.ready": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityReady",
             "city.resumed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityResumed",
             "city.suspended": "#/components/schemas/TypedTaggedEventStreamEnvelopeCitySuspended",
-            "city.unregister_failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterFailed",
             "city.unregister_requested": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterRequested",
-            "city.unregistered": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregistered",
             "controller.started": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStarted",
             "controller.stopped": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStopped",
             "convoy.closed": "#/components/schemas/TypedTaggedEventStreamEnvelopeConvoyClosed",
@@ -8543,6 +8847,12 @@
             "order.failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeOrderFailed",
             "order.fired": "#/components/schemas/TypedTaggedEventStreamEnvelopeOrderFired",
             "provider.swapped": "#/components/schemas/TypedTaggedEventStreamEnvelopeProviderSwapped",
+            "request.failed": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestFailed",
+            "request.result.city.create": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityCreate",
+            "request.result.city.unregister": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityUnregister",
+            "request.result.session.create": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionCreate",
+            "request.result.session.message": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionMessage",
+            "request.result.session.submit": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit",
             "session.crashed": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionCrashed",
             "session.draining": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionDraining",
             "session.idle_killed": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionIdleKilled",
@@ -8569,27 +8879,15 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityCreated"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityInitFailed"
-          },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityReady"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityResumed"
           },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCitySuspended"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterFailed"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregisterRequested"
           },
-          {
-            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCityUnregistered"
-          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeControllerStarted"
           },
@@ -8656,6 +8954,24 @@
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeProviderSwapped"
           },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestFailed"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultCityUnregister"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionCreate"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionMessage"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit"
+          },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeSessionCrashed"
           },
@@ -8685,6 +9001,9 @@
           },
           {
             "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeWorkerOperation"
+          },
+          {
+            "$ref": "#/components/schemas/TypedTaggedEventStreamEnvelopeCustom"
           }
         ],
         "title": "Typed supervisor event stream envelope"
@@ -8873,7 +9192,7 @@
         "title": "TypedTaggedEventStreamEnvelope city.created",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityInitFailed": {
+      "TypedTaggedEventStreamEnvelopeCityResumed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8886,7 +9205,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -8901,7 +9220,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.init_failed",
+            "const": "city.resumed",
             "type": "string"
           },
           "workflow": {
@@ -8916,10 +9235,56 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.init_failed",
+        "title": "TypedTaggedEventStreamEnvelope city.resumed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityReady": {
+      "TypedTaggedEventStreamEnvelopeCitySuspended": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "city.suspended",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope city.suspended",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeCityUnregisterRequested": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8947,7 +9312,53 @@
             "type": "string"
           },
           "type": {
-            "const": "city.ready",
+            "const": "city.unregister_requested",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope city.unregister_requested",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeControllerStarted": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "payload": {
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "controller.started",
             "type": "string"
           },
           "workflow": {
@@ -8962,10 +9373,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.ready",
+        "title": "TypedTaggedEventStreamEnvelope controller.started",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityResumed": {
+      "TypedTaggedEventStreamEnvelopeControllerStopped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -8993,7 +9404,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.resumed",
+            "const": "controller.stopped",
             "type": "string"
           },
           "workflow": {
@@ -9008,10 +9419,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.resumed",
+        "title": "TypedTaggedEventStreamEnvelope controller.stopped",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCitySuspended": {
+      "TypedTaggedEventStreamEnvelopeConvoyClosed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9039,7 +9450,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.suspended",
+            "const": "convoy.closed",
             "type": "string"
           },
           "workflow": {
@@ -9054,10 +9465,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.suspended",
+        "title": "TypedTaggedEventStreamEnvelope convoy.closed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregisterFailed": {
+      "TypedTaggedEventStreamEnvelopeConvoyCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9070,8 +9481,52 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/NoPayload"
+          },
+          "seq": {
+            "format": "int64",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "subject": {
+            "type": "string"
+          },
+          "ts": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "type": {
+            "const": "convoy.created",
+            "type": "string"
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/WorkflowEventProjection"
+          }
+        },
+        "required": [
+          "seq",
+          "type",
+          "ts",
+          "actor",
+          "payload",
+          "city"
+        ],
+        "title": "TypedTaggedEventStreamEnvelope convoy.created",
+        "type": "object"
+      },
+      "TypedTaggedEventStreamEnvelopeCustom": {
+        "additionalProperties": false,
+        "properties": {
+          "actor": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
           },
+          "payload": {},
           "seq": {
             "format": "int64",
             "minimum": 0,
@@ -9085,7 +9540,55 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_failed",
+            "not": {
+              "enum": [
+                "session.woke",
+                "session.stopped",
+                "session.crashed",
+                "session.draining",
+                "session.undrained",
+                "session.quarantined",
+                "session.idle_killed",
+                "session.suspended",
+                "session.updated",
+                "bead.created",
+                "bead.closed",
+                "bead.updated",
+                "mail.sent",
+                "mail.read",
+                "mail.archived",
+                "mail.marked_read",
+                "mail.marked_unread",
+                "mail.replied",
+                "mail.deleted",
+                "convoy.created",
+                "convoy.closed",
+                "controller.started",
+                "controller.stopped",
+                "city.suspended",
+                "city.resumed",
+                "request.result.city.create",
+                "request.result.city.unregister",
+                "request.result.session.create",
+                "request.result.session.message",
+                "request.result.session.submit",
+                "request.failed",
+                "city.created",
+                "city.unregister_requested",
+                "order.fired",
+                "order.completed",
+                "order.failed",
+                "provider.swapped",
+                "worker.operation",
+                "extmsg.bound",
+                "extmsg.unbound",
+                "extmsg.group_created",
+                "extmsg.adapter_added",
+                "extmsg.adapter_removed",
+                "extmsg.inbound",
+                "extmsg.outbound"
+              ]
+            },
             "type": "string"
           },
           "workflow": {
@@ -9100,10 +9603,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregister_failed",
+        "title": "TypedTaggedEventStreamEnvelope custom",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregisterRequested": {
+      "TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9116,7 +9619,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9131,7 +9634,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregister_requested",
+            "const": "extmsg.adapter_added",
             "type": "string"
           },
           "workflow": {
@@ -9146,10 +9649,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregister_requested",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_added",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeCityUnregistered": {
+      "TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9162,7 +9665,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/CityLifecyclePayload"
+            "$ref": "#/components/schemas/AdapterEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9177,7 +9680,7 @@
             "type": "string"
           },
           "type": {
-            "const": "city.unregistered",
+            "const": "extmsg.adapter_removed",
             "type": "string"
           },
           "workflow": {
@@ -9192,10 +9695,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope city.unregistered",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_removed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeControllerStarted": {
+      "TypedTaggedEventStreamEnvelopeExtmsgBound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9208,7 +9711,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/BoundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9223,7 +9726,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.started",
+            "const": "extmsg.bound",
             "type": "string"
           },
           "workflow": {
@@ -9238,10 +9741,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope controller.started",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.bound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeControllerStopped": {
+      "TypedTaggedEventStreamEnvelopeExtmsgGroupCreated": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9254,7 +9757,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/GroupCreatedEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9269,7 +9772,7 @@
             "type": "string"
           },
           "type": {
-            "const": "controller.stopped",
+            "const": "extmsg.group_created",
             "type": "string"
           },
           "workflow": {
@@ -9284,10 +9787,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope controller.stopped",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.group_created",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeConvoyClosed": {
+      "TypedTaggedEventStreamEnvelopeExtmsgInbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9300,7 +9803,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/InboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9315,7 +9818,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.closed",
+            "const": "extmsg.inbound",
             "type": "string"
           },
           "workflow": {
@@ -9330,10 +9833,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope convoy.closed",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.inbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeConvoyCreated": {
+      "TypedTaggedEventStreamEnvelopeExtmsgOutbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9346,7 +9849,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/OutboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9361,7 +9864,7 @@
             "type": "string"
           },
           "type": {
-            "const": "convoy.created",
+            "const": "extmsg.outbound",
             "type": "string"
           },
           "workflow": {
@@ -9376,10 +9879,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope convoy.created",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.outbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgAdapterAdded": {
+      "TypedTaggedEventStreamEnvelopeExtmsgUnbound": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9392,7 +9895,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/UnboundEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9407,7 +9910,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_added",
+            "const": "extmsg.unbound",
             "type": "string"
           },
           "workflow": {
@@ -9422,10 +9925,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_added",
+        "title": "TypedTaggedEventStreamEnvelope extmsg.unbound",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgAdapterRemoved": {
+      "TypedTaggedEventStreamEnvelopeMailArchived": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9438,7 +9941,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/AdapterEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9453,7 +9956,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.adapter_removed",
+            "const": "mail.archived",
             "type": "string"
           },
           "workflow": {
@@ -9468,10 +9971,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.adapter_removed",
+        "title": "TypedTaggedEventStreamEnvelope mail.archived",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgBound": {
+      "TypedTaggedEventStreamEnvelopeMailDeleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9484,7 +9987,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/BoundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9499,7 +10002,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.bound",
+            "const": "mail.deleted",
             "type": "string"
           },
           "workflow": {
@@ -9514,10 +10017,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.bound",
+        "title": "TypedTaggedEventStreamEnvelope mail.deleted",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgGroupCreated": {
+      "TypedTaggedEventStreamEnvelopeMailMarkedRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9530,7 +10033,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/GroupCreatedEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9545,7 +10048,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.group_created",
+            "const": "mail.marked_read",
             "type": "string"
           },
           "workflow": {
@@ -9560,10 +10063,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.group_created",
+        "title": "TypedTaggedEventStreamEnvelope mail.marked_read",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgInbound": {
+      "TypedTaggedEventStreamEnvelopeMailMarkedUnread": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9576,7 +10079,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/InboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9591,7 +10094,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.inbound",
+            "const": "mail.marked_unread",
             "type": "string"
           },
           "workflow": {
@@ -9606,10 +10109,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.inbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.marked_unread",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgOutbound": {
+      "TypedTaggedEventStreamEnvelopeMailRead": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9622,7 +10125,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/OutboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9637,7 +10140,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.outbound",
+            "const": "mail.read",
             "type": "string"
           },
           "workflow": {
@@ -9652,10 +10155,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.outbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.read",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeExtmsgUnbound": {
+      "TypedTaggedEventStreamEnvelopeMailReplied": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9668,7 +10171,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/UnboundEventPayload"
+            "$ref": "#/components/schemas/MailEventPayload"
           },
           "seq": {
             "format": "int64",
@@ -9683,7 +10186,7 @@
             "type": "string"
           },
           "type": {
-            "const": "extmsg.unbound",
+            "const": "mail.replied",
             "type": "string"
           },
           "workflow": {
@@ -9698,10 +10201,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope extmsg.unbound",
+        "title": "TypedTaggedEventStreamEnvelope mail.replied",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailArchived": {
+      "TypedTaggedEventStreamEnvelopeMailSent": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9729,7 +10232,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.archived",
+            "const": "mail.sent",
             "type": "string"
           },
           "workflow": {
@@ -9744,10 +10247,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.archived",
+        "title": "TypedTaggedEventStreamEnvelope mail.sent",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailDeleted": {
+      "TypedTaggedEventStreamEnvelopeOrderCompleted": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9760,7 +10263,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9775,7 +10278,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.deleted",
+            "const": "order.completed",
             "type": "string"
           },
           "workflow": {
@@ -9790,10 +10293,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.deleted",
+        "title": "TypedTaggedEventStreamEnvelope order.completed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailMarkedRead": {
+      "TypedTaggedEventStreamEnvelopeOrderFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9806,7 +10309,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9821,7 +10324,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_read",
+            "const": "order.failed",
             "type": "string"
           },
           "workflow": {
@@ -9836,10 +10339,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.marked_read",
+        "title": "TypedTaggedEventStreamEnvelope order.failed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailMarkedUnread": {
+      "TypedTaggedEventStreamEnvelopeOrderFired": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9852,7 +10355,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9867,7 +10370,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.marked_unread",
+            "const": "order.fired",
             "type": "string"
           },
           "workflow": {
@@ -9882,10 +10385,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.marked_unread",
+        "title": "TypedTaggedEventStreamEnvelope order.fired",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailRead": {
+      "TypedTaggedEventStreamEnvelopeProviderSwapped": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9898,7 +10401,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/NoPayload"
           },
           "seq": {
             "format": "int64",
@@ -9913,7 +10416,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.read",
+            "const": "provider.swapped",
             "type": "string"
           },
           "workflow": {
@@ -9928,10 +10431,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.read",
+        "title": "TypedTaggedEventStreamEnvelope provider.swapped",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailReplied": {
+      "TypedTaggedEventStreamEnvelopeRequestFailed": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9944,7 +10447,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/RequestFailedPayload"
           },
           "seq": {
             "format": "int64",
@@ -9959,7 +10462,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.replied",
+            "const": "request.failed",
             "type": "string"
           },
           "workflow": {
@@ -9974,10 +10477,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.replied",
+        "title": "TypedTaggedEventStreamEnvelope request.failed",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeMailSent": {
+      "TypedTaggedEventStreamEnvelopeRequestResultCityCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -9990,7 +10493,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/MailEventPayload"
+            "$ref": "#/components/schemas/CityCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10005,7 +10508,7 @@
             "type": "string"
           },
           "type": {
-            "const": "mail.sent",
+            "const": "request.result.city.create",
             "type": "string"
           },
           "workflow": {
@@ -10020,10 +10523,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope mail.sent",
+        "title": "TypedTaggedEventStreamEnvelope request.result.city.create",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderCompleted": {
+      "TypedTaggedEventStreamEnvelopeRequestResultCityUnregister": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10036,7 +10539,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/CityUnregisterSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10051,7 +10554,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.completed",
+            "const": "request.result.city.unregister",
             "type": "string"
           },
           "workflow": {
@@ -10066,10 +10569,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.completed",
+        "title": "TypedTaggedEventStreamEnvelope request.result.city.unregister",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderFailed": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionCreate": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10082,7 +10585,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionCreateSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10097,7 +10600,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.failed",
+            "const": "request.result.session.create",
             "type": "string"
           },
           "workflow": {
@@ -10112,10 +10615,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.failed",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.create",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeOrderFired": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionMessage": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10128,7 +10631,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionMessageSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10143,7 +10646,7 @@
             "type": "string"
           },
           "type": {
-            "const": "order.fired",
+            "const": "request.result.session.message",
             "type": "string"
           },
           "workflow": {
@@ -10158,10 +10661,10 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope order.fired",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.message",
         "type": "object"
       },
-      "TypedTaggedEventStreamEnvelopeProviderSwapped": {
+      "TypedTaggedEventStreamEnvelopeRequestResultSessionSubmit": {
         "additionalProperties": false,
         "properties": {
           "actor": {
@@ -10174,7 +10677,7 @@
             "type": "string"
           },
           "payload": {
-            "$ref": "#/components/schemas/NoPayload"
+            "$ref": "#/components/schemas/SessionSubmitSucceededPayload"
           },
           "seq": {
             "format": "int64",
@@ -10189,7 +10692,7 @@
             "type": "string"
           },
           "type": {
-            "const": "provider.swapped",
+            "const": "request.result.session.submit",
             "type": "string"
           },
           "workflow": {
@@ -10204,7 +10707,7 @@
           "payload",
           "city"
         ],
-        "title": "TypedTaggedEventStreamEnvelope provider.swapped",
+        "title": "TypedTaggedEventStreamEnvelope request.result.session.submit",
         "type": "object"
       },
       "TypedTaggedEventStreamEnvelopeSessionCrashed": {
@@ -10684,82 +11187,6 @@
         ],
         "type": "object"
       },
-      "WireEvent": {
-        "additionalProperties": false,
-        "properties": {
-          "actor": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
-          },
-          "payload": {
-            "$ref": "#/components/schemas/EventPayload"
-          },
-          "seq": {
-            "format": "int64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "subject": {
-            "type": "string"
-          },
-          "ts": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "seq",
-          "type",
-          "ts",
-          "actor"
-        ],
-        "type": "object"
-      },
-      "WireTaggedEvent": {
-        "additionalProperties": false,
-        "properties": {
-          "actor": {
-            "type": "string"
-          },
-          "city": {
-            "type": "string"
-          },
-          "message": {
-            "type": "string"
-          },
-          "payload": {
-            "$ref": "#/components/schemas/EventPayload"
-          },
-          "seq": {
-            "format": "int64",
-            "minimum": 0,
-            "type": "integer"
-          },
-          "subject": {
-            "type": "string"
-          },
-          "ts": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "city",
-          "seq",
-          "type",
-          "ts",
-          "actor"
-        ],
-        "type": "object"
-      },
       "WorkerOperationEventPayload": {
         "additionalProperties": false,
         "properties": {
@@ -11279,7 +11706,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CityCreateResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedResponse"
                 }
               }
             },
@@ -12654,6 +13081,7 @@
         "summary": "Get v0 city by city name agents"
       },
       "post": {
+        "description": "Creates an agent and waits until it is visible to immediate follow-up operations. If the agent is durably created but visibility confirmation is canceled or times out, the retryable 503/504 response includes a Retry-After header.",
         "operationId": "create-agent",
         "parameters": [
           {
@@ -14738,7 +15166,7 @@
     },
     "/v0/city/{cityName}/events/stream": {
       "get": {
-        "description": "Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param.",
+        "description": "Server-Sent Events stream of city events with optional workflow projections. Supports reconnection via Last-Event-ID header or after_seq query param; omitting both starts at the current city event head.",
         "operationId": "stream-events",
         "parameters": [
           {
@@ -14754,21 +15182,21 @@
             }
           },
           {
-            "description": "Reconnect position: only deliver events after this sequence number.",
+            "description": "Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.",
             "explode": false,
             "in": "query",
             "name": "after_seq",
             "schema": {
-              "description": "Reconnect position: only deliver events after this sequence number.",
+              "description": "Reconnect position: only deliver events after this sequence number. Omit after_seq and Last-Event-ID to start at the current city event head.",
               "type": "string"
             }
           },
           {
-            "description": "SSE reconnect position from the last received event ID.",
+            "description": "SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.",
             "in": "header",
             "name": "Last-Event-ID",
             "schema": {
-              "description": "SSE reconnect position from the last received event ID.",
+              "description": "SSE reconnect position from the last received event ID. Omit Last-Event-ID and after_seq to start at the current city event head.",
               "type": "string"
             }
           }
@@ -16822,12 +17250,12 @@
             }
           },
           {
-            "description": "Thread ID.",
+            "description": "Thread ID, or any message ID in the thread.",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Thread ID.",
+              "description": "Thread ID, or any message ID in the thread.",
               "type": "string"
             }
           },
@@ -17743,6 +18171,16 @@
               "pattern": "\\S",
               "type": "string"
             }
+          },
+          {
+            "description": "Bypass cached order-check responses and cached order history.",
+            "explode": false,
+            "in": "query",
+            "name": "fresh",
+            "schema": {
+              "description": "Bypass cached order-check responses and cached order history.",
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -20743,7 +21181,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionMessageOutputBody"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -21365,7 +21803,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionSubmitOutputBody"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -21523,6 +21961,16 @@
               "description": "Pagination cursor: return entries before this UUID.",
               "type": "string"
             }
+          },
+          {
+            "description": "Pagination cursor: return entries after this UUID.",
+            "explode": false,
+            "in": "query",
+            "name": "after",
+            "schema": {
+              "description": "Pagination cursor: return entries after this UUID.",
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -21794,7 +22242,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SessionResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedBody"
                 }
               }
             },
@@ -22008,7 +22456,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CityUnregisterResponse"
+                  "$ref": "#/components/schemas/AsyncAcceptedResponse"
                 }
               }
             },
@@ -22313,24 +22761,25 @@
     },
     "/v0/events/stream": {
       "get": {
+        "description": "Server-Sent Events stream of supervisor-tagged events. Supports reconnection via Last-Event-ID header or after_cursor query param; omitting both starts at the current supervisor event head.",
         "operationId": "stream-supervisor-events",
         "parameters": [
           {
-            "description": "Reconnect cursor (composite per-city cursor).",
+            "description": "Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.",
             "in": "header",
             "name": "Last-Event-ID",
             "schema": {
-              "description": "Reconnect cursor (composite per-city cursor).",
+              "description": "Reconnect cursor (composite per-city cursor). Omit Last-Event-ID and after_cursor to start at the current supervisor event head.",
               "type": "string"
             }
           },
           {
-            "description": "Alternative to Last-Event-ID for browsers that can't set custom headers.",
+            "description": "Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.",
             "explode": false,
             "in": "query",
             "name": "after_cursor",
             "schema": {
-              "description": "Alternative to Last-Event-ID for browsers that can't set custom headers.",
+              "description": "Alternative to Last-Event-ID for browsers that can't set custom headers. Omit after_cursor and Last-Event-ID to start at the current supervisor event head.",
               "type": "string"
             }
           }
diff --git a/internal/api/openapi_sync_test.go b/internal/api/openapi_sync_test.go
index 97fd3955c6..640eca5aa1 100644
--- a/internal/api/openapi_sync_test.go
+++ b/internal/api/openapi_sync_test.go
@@ -95,8 +95,8 @@ func TestEventsSchemaPublished(t *testing.T) {
 	}
 
 	wantRefs := []string{
-		"openapi.json#/components/schemas/WireEvent",
-		"openapi.json#/components/schemas/WireTaggedEvent",
+		"openapi.json#/components/schemas/TypedEventStreamEnvelope",
+		"openapi.json#/components/schemas/TypedTaggedEventStreamEnvelope",
 		"openapi.json#/components/schemas/EventStreamEnvelope",
 		"openapi.json#/components/schemas/TaggedEventStreamEnvelope",
 	}
@@ -125,13 +125,66 @@ func TestEventsSchemaPublished(t *testing.T) {
 	if err := json.Unmarshal(openAPIData, &openAPI); err != nil {
 		t.Fatalf("parse openapi.json: %v", err)
 	}
-	for _, component := range []string{"WireEvent", "WireTaggedEvent", "EventStreamEnvelope", "TaggedEventStreamEnvelope"} {
+	for _, component := range []string{"TypedEventStreamEnvelope", "TypedTaggedEventStreamEnvelope", "EventStreamEnvelope", "TaggedEventStreamEnvelope"} {
 		if _, ok := openAPI.Components.Schemas[component]; !ok {
 			t.Errorf("events schema references missing OpenAPI component %q", component)
 		}
 	}
 }
 
+func TestAsyncAcceptedRequestIDDescriptionsNameTypedResultEvents(t *testing.T) {
+	sm := api.NewSupervisorMux(emptyTestResolver{}, nil, false, "", time.Time{})
+	req := httptest.NewRequest(http.MethodGet, "/openapi.json", nil)
+	rec := httptest.NewRecorder()
+	sm.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("GET /openapi.json returned %d: %s", rec.Code, rec.Body.String())
+	}
+
+	var openAPI struct {
+		Components struct {
+			Schemas map[string]struct {
+				Properties map[string]struct {
+					Description string `json:"description"`
+				} `json:"properties"`
+			} `json:"schemas"`
+		} `json:"components"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &openAPI); err != nil {
+		t.Fatalf("parse openapi: %v", err)
+	}
+
+	assertDescription := func(schema, want string) {
+		t.Helper()
+		got := openAPI.Components.Schemas[schema].Properties["request_id"].Description
+		if !bytes.Contains([]byte(got), []byte(want)) {
+			t.Fatalf("%s request_id description = %q, want to mention %q", schema, got, want)
+		}
+	}
+	assertDescription("AsyncAcceptedBody", "request.result.session.create")
+	assertDescription("AsyncAcceptedBody", "request.result.session.message")
+	assertDescription("AsyncAcceptedBody", "request.result.session.submit")
+	assertDescription("AsyncAcceptedResponse", "request.result.city.create")
+	assertDescription("AsyncAcceptedResponse", "request.result.city.unregister")
+
+	assertCursorDescription := func(schema, want string) {
+		t.Helper()
+		got := openAPI.Components.Schemas[schema].Properties["event_cursor"].Description
+		if !bytes.Contains([]byte(got), []byte(want)) {
+			t.Fatalf("%s event_cursor description = %q, want to mention %q", schema, got, want)
+		}
+	}
+	assertCursorDescription("AsyncAcceptedBody", "after_seq")
+	assertCursorDescription("AsyncAcceptedResponse", "after_cursor")
+	assertCursorDescription("AsyncAcceptedBody", "no event provider")
+	assertCursorDescription("AsyncAcceptedResponse", "no event provider")
+
+	got := openAPI.Components.Schemas["SessionCreateSucceededPayload"].Properties["session"].Description
+	if !bytes.Contains([]byte(got), []byte("lifecycle commands")) {
+		t.Fatalf("SessionCreateSucceededPayload session description = %q, want to mention lifecycle commands", got)
+	}
+}
+
 func TestOrderResponseSchemaKeepsMigrationFieldsOptional(t *testing.T) {
 	sm := api.NewSupervisorMux(emptyTestResolver{}, nil, false, "", time.Time{})
 	req := httptest.NewRequest(http.MethodGet, "/openapi.json", nil)
diff --git a/internal/api/read_model_no_get_test.go b/internal/api/read_model_no_get_test.go
new file mode 100644
index 0000000000..c658567895
--- /dev/null
+++ b/internal/api/read_model_no_get_test.go
@@ -0,0 +1,98 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/runtime"
+)
+
+type getCountingStore struct {
+	beads.Store
+	gets atomic.Int64
+}
+
+func (s *getCountingStore) Get(id string) (beads.Bead, error) {
+	s.gets.Add(1)
+	return s.Store.Get(id)
+}
+
+func TestSessionListUsesLoadedSessionBeadsWithoutPerSessionGet(t *testing.T) {
+	fs := newSessionFakeState(t)
+	createTestSession(t, fs.cityBeadStore, fs.sp, "Session A")
+	createTestSession(t, fs.cityBeadStore, fs.sp, "Session B")
+	counting := &getCountingStore{Store: fs.cityBeadStore}
+	fs.cityBeadStore = counting
+
+	h := newTestCityHandler(t, fs)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, cityURL(fs, "/sessions"), nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if got := counting.gets.Load(); got != 0 {
+		t.Fatalf("store.Get calls = %d, want 0 for session list read model", got)
+	}
+}
+
+func TestSessionListDoesNotProbePendingInteractions(t *testing.T) {
+	fs := newSessionFakeState(t)
+	createTestSession(t, fs.cityBeadStore, fs.sp, "Session A")
+	createTestSession(t, fs.cityBeadStore, fs.sp, "Session B")
+	fs.sp.Calls = nil
+
+	h := newTestCityHandler(t, fs)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, cityURL(fs, "/sessions"), nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	for _, call := range fs.sp.Calls {
+		if call.Method == "Pending" {
+			t.Fatalf("session list called Pending for %s; calls=%#v", call.Name, fs.sp.Calls)
+		}
+	}
+}
+
+func TestRigListUsesProviderStateWithoutSessionStoreGet(t *testing.T) {
+	state := newFakeState(t)
+	counting := &getCountingStore{Store: beads.NewMemStore()}
+	state.cityBeadStore = counting
+	if err := state.sp.Start(context.Background(), "myrig--worker", runtime.Config{}); err != nil {
+		t.Fatalf("start provider session: %v", err)
+	}
+
+	h := newTestCityHandler(t, state)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, cityURL(state, "/rigs"), nil)
+	h.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	var resp struct {
+		Items []rigResponse `json:"items"`
+		Total int           `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 1 || len(resp.Items) != 1 {
+		t.Fatalf("rig response total/items = %d/%d, want 1/1", resp.Total, len(resp.Items))
+	}
+	if resp.Items[0].RunningCount != 1 {
+		t.Fatalf("RunningCount = %d, want 1", resp.Items[0].RunningCount)
+	}
+	if got := counting.gets.Load(); got != 0 {
+		t.Fatalf("store.Get calls = %d, want 0 for rig list read model", got)
+	}
+}
diff --git a/internal/api/request_id.go b/internal/api/request_id.go
new file mode 100644
index 0000000000..fa4fdd9442
--- /dev/null
+++ b/internal/api/request_id.go
@@ -0,0 +1,141 @@
+package api
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"log"
+	"strconv"
+
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+func newRequestID() (string, error) {
+	b := make([]byte, 12)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("generating request ID: %w", err)
+	}
+	return "req-" + hex.EncodeToString(b), nil
+}
+
+func (s *Server) currentCityEventCursor() (string, error) {
+	ep := s.state.EventProvider()
+	if ep == nil {
+		return "0", nil
+	}
+	seq, err := ep.LatestSeq()
+	if err != nil {
+		return "", fmt.Errorf("capturing city event cursor: %w", err)
+	}
+	return strconv.FormatUint(seq, 10), nil
+}
+
+// EmitTypedEvent records a typed async result event to the given recorder.
+func EmitTypedEvent(rec events.Recorder, eventType, subject string, payload events.Payload) {
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		log.Printf("api: marshal %s: %v", eventType, err)
+		return
+	}
+	rec.Record(events.Event{
+		Type:    eventType,
+		Actor:   "api",
+		Subject: subject,
+		Payload: raw,
+	})
+}
+
+// EmitRequestFailed records a request.failed event to the given recorder.
+func EmitRequestFailed(rec events.Recorder, requestID, operation, errorCode, errorMessage string) {
+	EmitTypedEvent(rec, events.RequestFailed, "", RequestFailedPayload{
+		RequestID:    requestID,
+		Operation:    operation,
+		ErrorCode:    errorCode,
+		ErrorMessage: errorMessage,
+	})
+}
+
+func (s *Server) emitAsyncResult(eventType, subject string, payload events.Payload) {
+	rec := s.state.EventProvider()
+	if rec == nil {
+		log.Printf("api: no event provider for %s result %s", eventType, requestIDFromPayload(payload))
+		return
+	}
+	EmitTypedEvent(rec, eventType, subject, payload)
+}
+
+func (s *Server) emitRequestFailed(requestID, operation, errorCode, errorMessage string) {
+	s.emitAsyncResult(events.RequestFailed, "", RequestFailedPayload{
+		RequestID:    requestID,
+		Operation:    operation,
+		ErrorCode:    errorCode,
+		ErrorMessage: errorMessage,
+	})
+}
+
+func (s *Server) recoverAsRequestFailed(requestID, operation string) {
+	if r := recover(); r != nil {
+		s.emitRequestFailed(requestID, operation, "internal_error", fmt.Sprintf("panic: %v", r))
+	}
+}
+
+func requestIDFromPayload(payload events.Payload) string {
+	switch p := payload.(type) {
+	case CityCreateSucceededPayload:
+		return p.RequestID
+	case CityUnregisterSucceededPayload:
+		return p.RequestID
+	case SessionCreateSucceededPayload:
+		return p.RequestID
+	case SessionMessageSucceededPayload:
+		return p.RequestID
+	case SessionSubmitSucceededPayload:
+		return p.RequestID
+	case RequestFailedPayload:
+		return p.RequestID
+	default:
+		return ""
+	}
+}
+
+// emitSessionCreateSucceeded records a request.result.session.create event.
+func (s *Server) emitSessionCreateSucceeded(requestID string, resp sessionResponse) {
+	s.emitAsyncResult(events.RequestResultSessionCreate, resp.ID, SessionCreateSucceededPayload{
+		RequestID: requestID,
+		Session:   resp,
+	})
+}
+
+// emitSessionCreateFailed records a request.failed event for session.create.
+func (s *Server) emitSessionCreateFailed(requestID, errorCode, errorMessage string) {
+	s.emitRequestFailed(requestID, RequestOperationSessionCreate, errorCode, errorMessage)
+}
+
+// emitSessionMessageSucceeded records a request.result.session.message event.
+func (s *Server) emitSessionMessageSucceeded(requestID, sessionID string) {
+	s.emitAsyncResult(events.RequestResultSessionMessage, sessionID, SessionMessageSucceededPayload{
+		RequestID: requestID,
+		SessionID: sessionID,
+	})
+}
+
+// emitSessionMessageFailed records a request.failed event for session.message.
+func (s *Server) emitSessionMessageFailed(requestID, errorCode, errorMessage string) {
+	s.emitRequestFailed(requestID, RequestOperationSessionMessage, errorCode, errorMessage)
+}
+
+// emitSessionSubmitSucceeded records a request.result.session.submit event.
+func (s *Server) emitSessionSubmitSucceeded(requestID, sessionID string, queued bool, intent string) {
+	s.emitAsyncResult(events.RequestResultSessionSubmit, sessionID, SessionSubmitSucceededPayload{
+		RequestID: requestID,
+		SessionID: sessionID,
+		Queued:    queued,
+		Intent:    intent,
+	})
+}
+
+// emitSessionSubmitFailed records a request.failed event for session.submit.
+func (s *Server) emitSessionSubmitFailed(requestID, errorCode, errorMessage string) {
+	s.emitRequestFailed(requestID, RequestOperationSessionSubmit, errorCode, errorMessage)
+}
diff --git a/internal/api/request_id_test.go b/internal/api/request_id_test.go
new file mode 100644
index 0000000000..1d191034eb
--- /dev/null
+++ b/internal/api/request_id_test.go
@@ -0,0 +1,214 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/cityinit"
+	"github.com/gastownhall/gascity/internal/events"
+)
+
+func TestRequestIDFromPayloadCoversAsyncPayloads(t *testing.T) {
+	tests := []struct {
+		name    string
+		payload events.Payload
+		want    string
+	}{
+		{
+			name: "city create",
+			payload: CityCreateSucceededPayload{
+				RequestID: "req-city-create",
+			},
+			want: "req-city-create",
+		},
+		{
+			name: "city unregister",
+			payload: CityUnregisterSucceededPayload{
+				RequestID: "req-city-unregister",
+			},
+			want: "req-city-unregister",
+		},
+		{
+			name: "session create",
+			payload: SessionCreateSucceededPayload{
+				RequestID: "req-session-create",
+				Session:   sessionResponse{ID: "session-1"},
+			},
+			want: "req-session-create",
+		},
+		{
+			name: "session message",
+			payload: SessionMessageSucceededPayload{
+				RequestID: "req-session-message",
+			},
+			want: "req-session-message",
+		},
+		{
+			name: "session submit",
+			payload: SessionSubmitSucceededPayload{
+				RequestID: "req-session-submit",
+			},
+			want: "req-session-submit",
+		},
+		{
+			name: "request failed",
+			payload: RequestFailedPayload{
+				RequestID: "req-failed",
+			},
+			want: "req-failed",
+		},
+		{
+			name:    "unknown payload",
+			payload: events.NoPayload{},
+			want:    "",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := requestIDFromPayload(tc.payload); got != tc.want {
+				t.Fatalf("requestIDFromPayload() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestCurrentCityEventCursor(t *testing.T) {
+	t.Run("no provider", func(t *testing.T) {
+		fs := newFakeState(t)
+		fs.eventProv = nil
+		srv := &Server{state: fs}
+		got, err := srv.currentCityEventCursor()
+		if err != nil {
+			t.Fatalf("currentCityEventCursor() error = %v", err)
+		}
+		if got != "0" {
+			t.Fatalf("currentCityEventCursor() = %q, want 0", got)
+		}
+	})
+
+	t.Run("latest seq", func(t *testing.T) {
+		fs := newFakeState(t)
+		ep := fs.eventProv.(*events.Fake)
+		ep.Record(events.Event{Type: events.SessionWoke, Actor: "test"})
+		ep.Record(events.Event{Type: events.SessionStopped, Actor: "test"})
+		srv := &Server{state: fs}
+		got, err := srv.currentCityEventCursor()
+		if err != nil {
+			t.Fatalf("currentCityEventCursor() error = %v", err)
+		}
+		if got != "2" {
+			t.Fatalf("currentCityEventCursor() = %q, want 2", got)
+		}
+	})
+
+	t.Run("provider error", func(t *testing.T) {
+		fs := newFakeState(t)
+		fs.eventProv = events.NewFailFake()
+		srv := &Server{state: fs}
+		if got, err := srv.currentCityEventCursor(); err == nil {
+			t.Fatalf("currentCityEventCursor() = %q, nil error; want provider error", got)
+		}
+	})
+}
+
+func TestEmitRequestFailedRecordsTypedPayload(t *testing.T) {
+	rec := events.NewFake()
+
+	EmitRequestFailed(rec, "req-1", RequestOperationCityCreate, "bad_dir", "directory is invalid")
+
+	if len(rec.Events) != 1 {
+		t.Fatalf("recorded %d events, want 1", len(rec.Events))
+	}
+	ev := rec.Events[0]
+	if ev.Type != events.RequestFailed {
+		t.Fatalf("event type = %q, want %q", ev.Type, events.RequestFailed)
+	}
+	if ev.Actor != "api" {
+		t.Fatalf("actor = %q, want api", ev.Actor)
+	}
+	var payload RequestFailedPayload
+	if err := json.Unmarshal(ev.Payload, &payload); err != nil {
+		t.Fatalf("decode payload: %v", err)
+	}
+	if payload.RequestID != "req-1" || payload.Operation != RequestOperationCityCreate ||
+		payload.ErrorCode != "bad_dir" || payload.ErrorMessage != "directory is invalid" {
+		t.Fatalf("payload = %#v, want city.create failure for req-1", payload)
+	}
+}
+
+func TestEmitCityCreateSucceededRecordsSupervisorResult(t *testing.T) {
+	rec := events.NewFake()
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: rec,
+	}
+
+	emitCityCreateSucceeded(resolver, "req-city", &cityinit.InitResult{
+		CityName: "mc-city",
+		CityPath: "/tmp/mc-city",
+	}, "/tmp/fallback")
+
+	if len(rec.Events) != 1 {
+		t.Fatalf("recorded %d events, want 1", len(rec.Events))
+	}
+	ev := rec.Events[0]
+	if ev.Type != events.RequestResultCityCreate {
+		t.Fatalf("event type = %q, want %q", ev.Type, events.RequestResultCityCreate)
+	}
+	if ev.Subject != "mc-city" {
+		t.Fatalf("subject = %q, want mc-city", ev.Subject)
+	}
+	var payload CityCreateSucceededPayload
+	if err := json.Unmarshal(ev.Payload, &payload); err != nil {
+		t.Fatalf("decode payload: %v", err)
+	}
+	if payload.RequestID != "req-city" || payload.Name != "mc-city" || payload.Path != "/tmp/mc-city" {
+		t.Fatalf("payload = %#v, want mc-city city.create result", payload)
+	}
+}
+
+func TestEmitCityCreateSucceededFallsBackToDirectory(t *testing.T) {
+	rec := events.NewFake()
+	resolver := &fakeCityResolver{
+		cities:             map[string]*fakeState{},
+		supervisorRecorder: rec,
+	}
+
+	emitCityCreateSucceeded(resolver, "req-city", nil, "/tmp/fallback-city")
+
+	if len(rec.Events) != 1 {
+		t.Fatalf("recorded %d events, want 1", len(rec.Events))
+	}
+	ev := rec.Events[0]
+	if ev.Subject != "fallback-city" {
+		t.Fatalf("subject = %q, want fallback-city", ev.Subject)
+	}
+	var payload CityCreateSucceededPayload
+	if err := json.Unmarshal(ev.Payload, &payload); err != nil {
+		t.Fatalf("decode payload: %v", err)
+	}
+	if payload.RequestID != "req-city" || payload.Name != "fallback-city" || payload.Path != "/tmp/fallback-city" {
+		t.Fatalf("payload = %#v, want fallback city.create result", payload)
+	}
+}
+
+func TestClearPendingCityRequestIDOnlyConsumesStoredRequests(t *testing.T) {
+	resolver := &fakeCityResolver{cities: map[string]*fakeState{}}
+	sm := NewSupervisorMux(resolver, nil, false, "test", time.Now())
+	const cityPath = "/tmp/mc-city"
+
+	if err := resolver.StorePendingRequestID(cityPath, "req-1"); err != nil {
+		t.Fatal(err)
+	}
+	sm.clearPendingCityRequestID(cityPath, false)
+	if got := resolver.pending[cityPath]; got != "req-1" {
+		t.Fatalf("pending after stored=false = %q, want req-1", got)
+	}
+
+	sm.clearPendingCityRequestID(cityPath, true)
+	if _, ok := resolver.pending[cityPath]; ok {
+		t.Fatalf("pending request for %q was not consumed", cityPath)
+	}
+}
diff --git a/internal/api/runtime_observation.go b/internal/api/runtime_observation.go
new file mode 100644
index 0000000000..e9f2741e90
--- /dev/null
+++ b/internal/api/runtime_observation.go
@@ -0,0 +1,74 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/runtime"
+	"github.com/gastownhall/gascity/internal/session"
+	"github.com/gastownhall/gascity/internal/worker"
+)
+
+func observeProviderSession(sp runtime.Provider, sessionName string, processNames []string) worker.LiveObservation {
+	sessionName = strings.TrimSpace(sessionName)
+	obs := worker.LiveObservation{SessionName: sessionName}
+	if sp == nil || sessionName == "" {
+		return obs
+	}
+	obs.Running = sp.IsRunning(sessionName)
+	if suspended, err := sp.GetMeta(sessionName, "suspended"); err == nil && strings.TrimSpace(suspended) == "true" {
+		obs.Suspended = true
+	}
+	if sessionID, err := sp.GetMeta(sessionName, "GC_SESSION_ID"); err == nil {
+		obs.RuntimeSessionID = strings.TrimSpace(sessionID)
+	}
+	if !obs.Running {
+		return obs
+	}
+	obs.Alive = sp.ProcessAlive(sessionName, processNames)
+	obs.Attached = sp.IsAttached(sessionName)
+	if lastActive, err := sp.GetLastActivity(sessionName); err == nil && !lastActive.IsZero() {
+		last := lastActive
+		obs.LastActivity = &last
+	}
+	return obs
+}
+
+type providerSessionResponseHandle struct {
+	provider     runtime.Provider
+	sessionName  string
+	providerName string
+}
+
+func newProviderSessionResponseHandle(sp runtime.Provider, sessionName, providerName string) sessionResponseHandle {
+	sessionName = strings.TrimSpace(sessionName)
+	if sp == nil || sessionName == "" {
+		return nil
+	}
+	return providerSessionResponseHandle{
+		provider:     sp,
+		sessionName:  sessionName,
+		providerName: strings.TrimSpace(providerName),
+	}
+}
+
+func (h providerSessionResponseHandle) State(context.Context) (worker.State, error) {
+	state := worker.State{
+		SessionName: h.sessionName,
+		Provider:    h.providerName,
+	}
+	if h.provider == nil || !h.provider.IsRunning(h.sessionName) {
+		state.Phase = worker.PhaseStopped
+		return state, nil
+	}
+	state.Phase = worker.PhaseReady
+	return state, nil
+}
+
+func (h providerSessionResponseHandle) Peek(_ context.Context, lines int) (string, error) {
+	if h.provider == nil || !h.provider.IsRunning(h.sessionName) {
+		return "", fmt.Errorf("%w: %s", session.ErrSessionInactive, h.sessionName)
+	}
+	return h.provider.Peek(h.sessionName, lines)
+}
diff --git a/internal/api/server.go b/internal/api/server.go
index 0ba278792a..354a9c8583 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -65,6 +65,10 @@ type Server struct {
 	lookPathMu      sync.Mutex
 	lookPathEntries map[string]lookPathEntry
 
+	// agentVisibilityWaitTimeout overrides the POST /agents visibility wait
+	// in tests. Zero uses defaultAgentVisibilityWaitTimeout.
+	agentVisibilityWaitTimeout time.Duration
+
 	// responseCache memoizes expensive read responses for a short TTL so
 	// repeated UI polls do not re-run the same bead-store subprocesses when
 	// nothing material has changed.
diff --git a/internal/api/server_test.go b/internal/api/server_test.go
index 28cf8c4864..ea7fd51a89 100644
--- a/internal/api/server_test.go
+++ b/internal/api/server_test.go
@@ -49,8 +49,8 @@ func TestCORSOnRegularRequest(t *testing.T) {
 	if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "http://127.0.0.1:8080" {
 		t.Errorf("CORS origin = %q, want %q", got, "http://127.0.0.1:8080")
 	}
-	if got := rec.Header().Get("Access-Control-Expose-Headers"); got != "X-GC-Index, X-GC-Request-Id" {
-		t.Errorf("CORS expose = %q, want %q", got, "X-GC-Index, X-GC-Request-Id")
+	if got := rec.Header().Get("Access-Control-Expose-Headers"); got != "X-GC-Index, X-GC-Request-Id, Retry-After" {
+		t.Errorf("CORS expose = %q, want %q", got, "X-GC-Index, X-GC-Request-Id, Retry-After")
 	}
 }
 
diff --git a/internal/api/session_model_phase0_interface_spec_test.go b/internal/api/session_model_phase0_interface_spec_test.go
index 4f8bd141e8..81b4ecfc3a 100644
--- a/internal/api/session_model_phase0_interface_spec_test.go
+++ b/internal/api/session_model_phase0_interface_spec_test.go
@@ -11,6 +11,18 @@ import (
 	"github.com/gastownhall/gascity/internal/session"
 )
 
+type noBroadAPISessionListStore struct {
+	beads.Store
+	t *testing.T
+}
+
+func (s noBroadAPISessionListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == session.LabelSession && len(query.Metadata) == 0 {
+		s.t.Fatalf("API mail used broad session label scan: %+v", query)
+	}
+	return s.Store.List(query)
+}
+
 // Phase 0 spec coverage from engdocs/design/session-model-unification.md:
 // - Surface matrix / session-targeting API
 // - template: scope is factory-targeting only
@@ -54,6 +66,7 @@ func TestPhase0APISessionTargetingSurfaces_RejectTemplateFactoryTargets(t *testi
 		},
 	}
 
+	asyncOps := map[string]bool{"POST /messages": true, "POST /submit": true}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			fs := newPhase0APIOrdinaryWorkerState(t)
@@ -63,11 +76,14 @@ func TestPhase0APISessionTargetingSurfaces_RejectTemplateFactoryTargets(t *testi
 			rec := httptest.NewRecorder()
 			h.ServeHTTP(rec, tt.req(fs))
 
-			if rec.Code < 400 {
-				t.Fatalf("%s accepted template:worker with status %d; body=%s", tt.name, rec.Code, rec.Body.String())
-			}
-			if count := phase0APISessionCount(t, fs.cityBeadStore); count != 0 {
-				t.Fatalf("%s materialized %d session(s) for template:worker; body=%s", tt.name, count, rec.Body.String())
+			if asyncOps[tt.name] {
+				if rec.Code != http.StatusAccepted {
+					t.Fatalf("%s status = %d, want 202; body=%s", tt.name, rec.Code, rec.Body.String())
+				}
+			} else {
+				if rec.Code < 400 {
+					t.Fatalf("%s accepted template:worker with status %d; body=%s", tt.name, rec.Code, rec.Body.String())
+				}
 			}
 		})
 	}
@@ -110,6 +126,7 @@ func TestPhase0APISessionTargetingSurfaces_BareConfigNameDoesNotCreateOrdinarySe
 		},
 	}
 
+	asyncOps := map[string]bool{"POST /messages": true, "POST /submit": true}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			fs := newPhase0APIOrdinaryWorkerState(t)
@@ -119,11 +136,14 @@ func TestPhase0APISessionTargetingSurfaces_BareConfigNameDoesNotCreateOrdinarySe
 			rec := httptest.NewRecorder()
 			h.ServeHTTP(rec, tt.req(fs))
 
-			if rec.Code < 400 {
-				t.Fatalf("%s accepted ordinary config name worker with status %d; body=%s", tt.name, rec.Code, rec.Body.String())
-			}
-			if count := phase0APISessionCount(t, fs.cityBeadStore); count != 0 {
-				t.Fatalf("%s materialized %d session(s) for ordinary config worker; body=%s", tt.name, count, rec.Body.String())
+			if asyncOps[tt.name] {
+				if rec.Code != http.StatusAccepted {
+					t.Fatalf("%s status = %d, want 202; body=%s", tt.name, rec.Code, rec.Body.String())
+				}
+			} else {
+				if rec.Code < 400 {
+					t.Fatalf("%s accepted ordinary config name worker with status %d; body=%s", tt.name, rec.Code, rec.Body.String())
+				}
 			}
 		})
 	}
@@ -240,6 +260,88 @@ func TestPhase0APIMailSend_BareNamedSessionUsesExistingLiveMailboxWithoutMateria
 	}
 }
 
+func TestPhase0APIMailSend_BareNamedSessionUsesTargetedLiveMailboxLookup(t *testing.T) {
+	fs := newPhase0APINamedWorkerState(t)
+	baseStore := fs.cityBeadStore
+	if _, err := baseStore.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			apiNamedSessionMetadataKey: "true",
+			apiNamedSessionIdentityKey: "myrig/worker",
+			apiNamedSessionModeKey:     "always",
+			"alias":                    "live-worker",
+			"session_name":             "s-gc-test-city-worker",
+			"state":                    "asleep",
+		},
+	}); err != nil {
+		t.Fatalf("create live named session: %v", err)
+	}
+	fs.cityBeadStore = noBroadAPISessionListStore{Store: baseStore, t: t}
+	srv := New(fs)
+	h := newTestCityHandlerWith(t, fs, srv)
+
+	body := `{"from":"human","to":"worker","subject":"hello","body":"test"}`
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, newPostRequest(cityURL(fs, "/mail"), strings.NewReader(body)))
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("POST /v0/mail status = %d, want %d; body=%s", rec.Code, http.StatusCreated, rec.Body.String())
+	}
+	msgs, err := fs.cityMailProv.Inbox("live-worker")
+	if err != nil {
+		t.Fatalf("Inbox(live-worker): %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("live named mailbox got %d message(s), want 1", len(msgs))
+	}
+}
+
+func TestPhase0APIMailQuery_BareNamedSessionUsesTargetedRecipientLookup(t *testing.T) {
+	fs := newPhase0APINamedWorkerState(t)
+	baseStore := fs.cityBeadStore
+	live, err := baseStore.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			apiNamedSessionMetadataKey: "true",
+			apiNamedSessionIdentityKey: "myrig/worker",
+			apiNamedSessionModeKey:     "always",
+			"alias":                    "live-worker",
+			"session_name":             "s-gc-test-city-worker",
+			"state":                    "asleep",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create live named session: %v", err)
+	}
+	closed, err := baseStore.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			apiNamedSessionMetadataKey: "true",
+			apiNamedSessionIdentityKey: "myrig/worker",
+			apiNamedSessionModeKey:     "always",
+			"session_name":             "s-gc-test-city-worker-old",
+			"state":                    "closed",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create closed named session: %v", err)
+	}
+	if err := baseStore.Close(closed.ID); err != nil {
+		t.Fatalf("close named session: %v", err)
+	}
+	fs.cityBeadStore = noBroadAPISessionListStore{Store: baseStore, t: t}
+	srv := New(fs)
+
+	recipients := srv.resolveMailQueryRecipientsWithContext(t.Context(), "worker")
+	want := []string{live.ID, closed.ID, "worker"}
+	if strings.Join(recipients, ",") != strings.Join(want, ",") {
+		t.Fatalf("recipients = %#v, want %#v", recipients, want)
+	}
+}
+
 func TestPhase0APIResolver_BareConfigNameDoesNotMaterializeOrdinarySession(t *testing.T) {
 	fs := newPhase0APIOrdinaryWorkerState(t)
 	srv := New(fs)
diff --git a/internal/api/session_model_phase0_lifecycle_spec_test.go b/internal/api/session_model_phase0_lifecycle_spec_test.go
index c5e1f11df4..2937e97305 100644
--- a/internal/api/session_model_phase0_lifecycle_spec_test.go
+++ b/internal/api/session_model_phase0_lifecycle_spec_test.go
@@ -11,9 +11,22 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/extmsg"
+	"github.com/gastownhall/gascity/internal/runtime"
 	"github.com/gastownhall/gascity/internal/session"
 )
 
+type noBroadAPISessionRetireStore struct {
+	*beads.MemStore
+	t *testing.T
+}
+
+func (s *noBroadAPISessionRetireStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == session.LabelSession && len(query.Metadata) == 0 {
+		s.t.Fatalf("continuity retirement used broad session label scan: %+v", query)
+	}
+	return s.MemStore.List(query)
+}
+
 // Phase 0 spec coverage from engdocs/design/session-model-unification.md:
 // - Materialization contract
 // - Wake, Suspend, and Pin
@@ -275,9 +288,11 @@ func TestPhase0HandleSessionWake_NamedIdentitySkipsContinuityIneligibleHistorica
 
 func TestPhase0RetireContinuityIneligibleNamedSessionIdentifiersDoesNotRestampRetiredHistory(t *testing.T) {
 	fs := newSessionFakeState(t)
+	store := &noBroadAPISessionRetireStore{MemStore: beads.NewMemStore(), t: t}
+	fs.cityBeadStore = store
 	srv := New(fs)
 	archivedAt := "2026-03-01T12:00:00Z"
-	historical, err := fs.cityBeadStore.Create(beads.Bead{
+	historical, err := store.Create(beads.Bead{
 		Type:   session.BeadType,
 		Labels: []string{session.LabelSession},
 		Metadata: map[string]string{
@@ -296,7 +311,7 @@ func TestPhase0RetireContinuityIneligibleNamedSessionIdentifiersDoesNotRestampRe
 		t.Fatalf("Create(historical): %v", err)
 	}
 
-	retired, err := srv.retireContinuityIneligibleNamedSessionIdentifiers(fs.cityBeadStore, apiNamedSessionSpec{Identity: "worker"})
+	retired, err := srv.retireContinuityIneligibleNamedSessionIdentifiers(store, apiNamedSessionSpec{Identity: "worker"})
 	if err != nil {
 		t.Fatalf("retireContinuityIneligibleNamedSessionIdentifiers: %v", err)
 	}
@@ -318,7 +333,6 @@ func TestPhase0RetireContinuityIneligibleNamedSessionIdentifiersDoesNotRestampRe
 func TestPhase0HandleSessionWake_ContinuityEligibleArchivedBeadRequestsStart(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
-	h := newTestCityHandlerWith(t, fs, srv)
 	id := phase0MaterializeCityScopedNamedWorker(t, srv, fs)
 	if err := fs.cityBeadStore.SetMetadataBatch(id, map[string]string{
 		"state":               "archived",
@@ -328,6 +342,13 @@ func TestPhase0HandleSessionWake_ContinuityEligibleArchivedBeadRequestsStart(t *
 		t.Fatalf("SetMetadataBatch(archived): %v", err)
 	}
 
+	unblockStart := make(chan struct{})
+	provider := &blockingStartProvider{Fake: runtime.NewFake(), unblock: unblockStart}
+	wrappedState := &stateWithSessionProvider{fakeState: fs, provider: provider}
+	t.Cleanup(func() { close(unblockStart) })
+
+	srv = New(wrappedState)
+	h := newTestCityHandlerWith(t, wrappedState, srv)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, newPostRequest(cityURL(fs, "/session/"+id+"/wake"), nil))
 	if rec.Code != http.StatusOK {
@@ -338,11 +359,23 @@ func TestPhase0HandleSessionWake_ContinuityEligibleArchivedBeadRequestsStart(t *
 	if err != nil {
 		t.Fatalf("Get(%s): %v", id, err)
 	}
-	if got := updated.Metadata["state"]; got != "creating" {
-		t.Fatalf("state = %q, want creating", got)
+	switch got := updated.Metadata["state"]; got {
+	case "creating":
+		if claim := updated.Metadata["pending_create_claim"]; claim != "true" {
+			t.Fatalf("pending_create_claim = %q, want true while creating", claim)
+		}
+	case "active":
+		if claim := updated.Metadata["pending_create_claim"]; claim != "" {
+			t.Fatalf("pending_create_claim = %q, want cleared after active", claim)
+		}
+	default:
+		t.Fatalf("state = %q, want creating or active", got)
 	}
-	if got := updated.Metadata["pending_create_claim"]; got != "true" {
-		t.Fatalf("pending_create_claim = %q, want true", got)
+	if got := updated.Metadata["archived_at"]; got != "" {
+		t.Fatalf("archived_at = %q, want cleared after continuity wake", got)
+	}
+	if got := updated.Metadata["continuity_eligible"]; got != "true" {
+		t.Fatalf("continuity_eligible = %q, want true", got)
 	}
 }
 
@@ -469,17 +502,18 @@ func TestPhase0ProviderCompatibility_CreateWritesManualOrigin(t *testing.T) {
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
-	bead, err := fs.cityBeadStore.Get(resp.ID)
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", resp.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
 	if got := bead.Metadata["session_origin"]; got != "manual" {
 		t.Fatalf("session_origin = %q, want manual", got)
diff --git a/internal/api/session_model_phase0_spec_test.go b/internal/api/session_model_phase0_spec_test.go
index c74b36910e..c5edf8c659 100644
--- a/internal/api/session_model_phase0_spec_test.go
+++ b/internal/api/session_model_phase0_spec_test.go
@@ -1,7 +1,6 @@
 package api
 
 import (
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -21,23 +20,21 @@ func TestPhase0ProviderCompatibility_CreateKeepsResponseKindButDoesNotPersistSpe
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 
-	if rec.Code != http.StatusCreated {
-		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusCreated, rec.Body.String())
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusAccepted, rec.Body.String())
 	}
 
-	var resp sessionResponse
-	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode: %v", err)
-	}
-	if resp.Kind != "provider" {
-		t.Fatalf("resp.Kind = %q, want provider", resp.Kind)
+	accepted := decodeAsyncAccepted(t, rec.Body)
+	success, failure := waitForSessionCreateResult(t, fs.eventProv, accepted.RequestID)
+	if success == nil {
+		t.Fatalf("session create failed: %s: %s", failure.ErrorCode, failure.ErrorMessage)
 	}
 
-	bead, err := fs.cityBeadStore.Get(resp.ID)
+	bead, err := fs.cityBeadStore.Get(success.Session.ID)
 	if err != nil {
-		t.Fatalf("Get(%s): %v", resp.ID, err)
+		t.Fatalf("Get(%s): %v", success.Session.ID, err)
 	}
-	if got := bead.Metadata["mc_session_kind"]; got != "" {
-		t.Fatalf("mc_session_kind = %q, want empty", got)
+	if got := bead.Metadata["real_world_app_session_kind"]; got != "" {
+		t.Fatalf("real_world_app_session_kind = %q, want empty", got)
 	}
 }
diff --git a/internal/api/session_resolution.go b/internal/api/session_resolution.go
index 4540e6f639..13f91ddf07 100644
--- a/internal/api/session_resolution.go
+++ b/internal/api/session_resolution.go
@@ -136,13 +136,10 @@ func (s *Server) findCanonicalNamedSession(store beads.Store, spec apiNamedSessi
 	if store == nil {
 		return beads.Bead{}, false, nil
 	}
-	all, err := store.List(beads.ListQuery{
-		Label: session.LabelSession,
-	})
+	bead, ok, err := session.FindCanonicalConfiguredNamedSessionBead(store, spec)
 	if err != nil {
-		return beads.Bead{}, false, fmt.Errorf("listing sessions: %w", err)
+		return beads.Bead{}, false, fmt.Errorf("looking up canonical named session: %w", err)
 	}
-	bead, ok := session.FindCanonicalNamedSessionBead(all, spec)
 	return bead, ok, nil
 }
 
@@ -150,9 +147,11 @@ func (s *Server) retireContinuityIneligibleNamedSessionIdentifiers(store beads.S
 	if store == nil {
 		return nil, nil
 	}
-	all, err := store.List(beads.ListQuery{Label: session.LabelSession})
+	all, err := session.ExactMetadataSessionCandidates(store, false, map[string]string{
+		session.NamedSessionIdentityMetadata: spec.Identity,
+	})
 	if err != nil {
-		return nil, fmt.Errorf("listing sessions: %w", err)
+		return nil, fmt.Errorf("listing named session candidates: %w", err)
 	}
 	retired := make([]beads.Bead, 0)
 	now := time.Now().UTC()
@@ -227,22 +226,15 @@ func (s *Server) resolveConfiguredNamedSessionIDWithContext(ctx context.Context,
 	if !ok {
 		return "", false, fmt.Errorf("%w: %q", session.ErrSessionNotFound, identifier)
 	}
-	bead, hasCanonical, err := s.findCanonicalNamedSession(store, spec)
+	lookup, err := session.LookupConfiguredNamedSession(store, spec)
 	if err != nil {
-		return "", true, err
-	}
-	if hasCanonical {
-		return bead.ID, true, nil
+		return "", true, fmt.Errorf("looking up configured named session: %w", err)
 	}
-
-	all, err := store.List(beads.ListQuery{
-		Label: session.LabelSession,
-	})
-	if err != nil {
-		return "", true, fmt.Errorf("listing sessions: %w", err)
+	if lookup.HasCanonical {
+		return lookup.Canonical.ID, true, nil
 	}
-	if bead, conflict := session.FindNamedSessionConflict(all, spec); conflict {
-		return "", true, fmt.Errorf("%w: %q conflicts with configured named session %q via live bead %s", errConfiguredNamedSessionConflict, identifier, spec.Identity, bead.ID)
+	if lookup.HasConflict {
+		return "", true, fmt.Errorf("%w: %q conflicts with configured named session %q via live bead %s", errConfiguredNamedSessionConflict, identifier, spec.Identity, lookup.Conflict.ID)
 	}
 
 	if !opts.materialize {
diff --git a/internal/api/session_runtime.go b/internal/api/session_runtime.go
index d13088c191..830fa5ea41 100644
--- a/internal/api/session_runtime.go
+++ b/internal/api/session_runtime.go
@@ -542,7 +542,7 @@ func (s *Server) resolveSessionRuntimeWithMetadata(info session.Info, metadata m
 	return resolved, workDir, transport, transport == "" && legacyACPTransportAmbiguous(resolved, configuredTransport, info.Command, metadata)
 }
 
-// sessionKind reads the persisted mc_session_kind from bead metadata.
+// sessionKind reads the persisted real_world_app_session_kind from bead metadata.
 func (s *Server) sessionKind(sessionID string) string {
 	store := s.state.CityBeadStore()
 	if store == nil {
@@ -552,7 +552,7 @@ func (s *Server) sessionKind(sessionID string) string {
 	if err != nil {
 		return ""
 	}
-	return b.Metadata["mc_session_kind"]
+	return b.Metadata["real_world_app_session_kind"]
 }
 
 // resolveBareProvider resolves a provider by name without an agent template.
diff --git a/internal/api/session_transport.go b/internal/api/session_transport.go
index 301b73e2f5..b26fce59d4 100644
--- a/internal/api/session_transport.go
+++ b/internal/api/session_transport.go
@@ -14,8 +14,21 @@ type acpRoutingProvider interface {
 
 func validateSessionTransport(resolved *config.ResolvedProvider, transport string, sp runtime.Provider) (string, error) {
 	transport = strings.TrimSpace(transport)
-	if transport != "acp" {
+	switch transport {
+	case "":
 		return transport, nil
+	case config.SessionTransportTmux:
+		if transportSupportsTmux(sp) {
+			return transport, nil
+		}
+		providerName := transport
+		if resolved != nil && resolved.Name != "" {
+			providerName = resolved.Name
+		}
+		return "", fmt.Errorf("provider %q requires tmux transport but the session provider cannot route tmux sessions", providerName)
+	case config.SessionTransportACP:
+	default:
+		return "", fmt.Errorf("unknown session transport %q", transport)
 	}
 	providerName := ""
 	if resolved != nil {
@@ -48,10 +61,17 @@ func transportSupportsACP(sp runtime.Provider) bool {
 		return false
 	}
 	if provider, ok := sp.(runtime.TransportCapabilityProvider); ok {
-		return provider.SupportsTransport("acp")
+		return provider.SupportsTransport(config.SessionTransportACP)
 	}
 	if _, ok := sp.(acpRoutingProvider); ok {
 		return true
 	}
 	return false
 }
+
+func transportSupportsTmux(sp runtime.Provider) bool {
+	if provider, ok := sp.(runtime.TransportCapabilityProvider); ok {
+		return provider.SupportsTransport(config.SessionTransportTmux)
+	}
+	return true
+}
diff --git a/internal/api/session_transport_test.go b/internal/api/session_transport_test.go
index 0edce90b34..8bccd31d5d 100644
--- a/internal/api/session_transport_test.go
+++ b/internal/api/session_transport_test.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/config"
@@ -43,6 +44,36 @@ func TestProviderSessionTransportSupportsACPAloneStaysDefault(t *testing.T) {
 	}
 }
 
+func TestValidateSessionTransportAcceptsTmuxTransport(t *testing.T) {
+	transport, err := validateSessionTransport(&config.ResolvedProvider{
+		Name: "custom",
+	}, config.SessionTransportTmux, runtime.NewFake())
+	if err != nil {
+		t.Fatalf("validateSessionTransport: %v", err)
+	}
+	if transport != config.SessionTransportTmux {
+		t.Fatalf("validateSessionTransport() = %q, want %q", transport, config.SessionTransportTmux)
+	}
+}
+
+func TestValidateSessionTransportRejectsTmuxWhenSessionProviderIsACPOnly(t *testing.T) {
+	_, err := validateSessionTransport(&config.ResolvedProvider{
+		Name: "custom",
+	}, config.SessionTransportTmux, &createTransportCapableProvider{Fake: runtime.NewFake()})
+	if err == nil || !strings.Contains(err.Error(), "requires tmux transport") {
+		t.Fatalf("validateSessionTransport() error = %v, want tmux routing error", err)
+	}
+}
+
+func TestValidateSessionTransportRejectsUnknownTransport(t *testing.T) {
+	_, err := validateSessionTransport(&config.ResolvedProvider{
+		Name: "custom",
+	}, "stdio", runtime.NewFake())
+	if err == nil {
+		t.Fatal("validateSessionTransport() error = nil, want unknown transport error")
+	}
+}
+
 func TestResolveSessionTemplateForCreateUsesProviderACPDefault(t *testing.T) {
 	fs := newSessionFakeState(t)
 	supportsACP := true
diff --git a/internal/api/sse.go b/internal/api/sse.go
index 61d5b4e09a..8c5d0f6de3 100644
--- a/internal/api/sse.go
+++ b/internal/api/sse.go
@@ -320,13 +320,25 @@ func sseContractSamples(v any) (any, any) {
 
 // beginSSEStream sets the standard SSE headers on the huma response and
 // returns the underlying writer + JSON encoder + flusher the send
-// function will use per frame.
+// function will use per frame. It intentionally does not flush: stream
+// callbacks that emit custom headers must set them before committing the
+// response with flushSSEHeaders or the first SSE frame.
 func beginSSEStream(hctx huma.Context) (bw any, encoder *json.Encoder, flusher http.Flusher) {
 	hctx.SetHeader("Content-Type", "text/event-stream")
 	hctx.SetHeader("Cache-Control", "no-cache")
 	hctx.SetHeader("Connection", "keep-alive")
 	body := hctx.BodyWriter()
-	return body, json.NewEncoder(body), findFlusher(body)
+	flusher = findFlusher(body)
+	return body, json.NewEncoder(body), flusher
+}
+
+// flushSSEHeaders commits the current header set without writing an SSE frame.
+// Stream callbacks call this after setting stream-specific response headers
+// and before any wait that could delay the first event.
+func flushSSEHeaders(hctx huma.Context) {
+	if flusher := findFlusher(hctx.BodyWriter()); flusher != nil {
+		flusher.Flush()
+	}
 }
 
 // writeSSEFrame emits one SSE frame (id/event/data/blank line) to bw and
diff --git a/internal/api/state.go b/internal/api/state.go
index 9646ac2ce2..8d8a40bb5d 100644
--- a/internal/api/state.go
+++ b/internal/api/state.go
@@ -6,6 +6,7 @@
 package api
 
 import (
+	"context"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -140,6 +141,21 @@ type RawConfigProvider interface {
 	RawConfig() *config.City
 }
 
+// AgentVisibilityWaiter is an optional capability for states whose Config()
+// snapshot may briefly lag a successful agent mutation. Callers that need
+// strict read-after-write semantics for agent target resolution can type-assert
+// this interface after CreateAgent to ensure the new agent is visible through
+// findAgent before returning a success response. The interface is deliberately
+// agent-scoped because POST /sling resolves targets through the agent
+// projection immediately after create; rig and provider create endpoints do not
+// currently expose the same follow-up target-resolution contract.
+type AgentVisibilityWaiter interface {
+	// WaitForAgentVisibility blocks until findAgent in the current Config()
+	// resolves the given qualified agent name, or returns an error if the
+	// projection does not converge before ctx is done.
+	WaitForAgentVisibility(ctx context.Context, qualifiedName string) error
+}
+
 // StateMutator extends State with write operations for mutation endpoints.
 type StateMutator interface {
 	State
diff --git a/internal/api/supervisor.go b/internal/api/supervisor.go
index e60a07538d..a82f138733 100644
--- a/internal/api/supervisor.go
+++ b/internal/api/supervisor.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"errors"
 	"log"
 	"net"
 	"net/http"
@@ -34,15 +35,36 @@ type CityResolver interface {
 	CityState(name string) State
 }
 
+// ErrPendingRequestExists indicates that a matching async request is already
+// waiting for a terminal request-result event.
+var ErrPendingRequestExists = errors.New("pending request already exists")
+
+// PendingRequestStore is an optional CityResolver extension that
+// lets async handlers store correlation request IDs for later
+// retrieval by the reconciler when emitting request.result events.
+type PendingRequestStore interface {
+	StorePendingRequestID(cityPath, requestID string) error
+	ConsumePendingRequestID(cityPath string) (string, bool, error)
+}
+
+// SupervisorEventSource is an optional CityResolver extension that
+// provides a supervisor-level event recorder for city lifecycle events
+// (create/unregister completion). These events belong on the supervisor
+// scope because the city doesn't exist during create and goes away
+// during unregister.
+type SupervisorEventSource interface {
+	SupervisorEventRecorder() events.Recorder
+}
+
 // TransientCityEventSource is an optional CityResolver extension
 // that lets the supervisor-scope event multiplexer include event
 // providers for cities that are registered but not yet (or no
 // longer) in the Running set — newly scaffolded cities whose
 // reconciler hasn't picked them up, cities currently running
 // prepareCityForSupervisor, and cities whose init failed. Without
-// this, /v0/events/stream subscribers can't observe city.created,
-// city.ready, or city.init_failed for cities that aren't yet
-// reporting Running=true through ListCities.
+// this, /v0/events/stream subscribers can't observe diagnostic
+// city.created/city.unregister_requested events for cities that aren't
+// yet reporting Running=true through ListCities.
 //
 // Resolvers that implement this return one entry per transient
 // city; the key is the city name, the value is an event provider
@@ -53,6 +75,15 @@ type TransientCityEventSource interface {
 	TransientCityEventProviders() map[string]events.Provider
 }
 
+type cityInitializer interface {
+	Scaffold(context.Context, cityinit.InitRequest) (*cityinit.InitResult, error)
+	Unregister(context.Context, cityinit.UnregisterRequest) (*cityinit.UnregisterResult, error)
+}
+
+type registeredCityFinder interface {
+	FindRegisteredCity(context.Context, string) (cityinit.RegisteredCity, error)
+}
+
 // cachedCityServer pairs a State with its pre-built Server for caching.
 type cachedCityServer struct {
 	state State
@@ -74,7 +105,7 @@ type cachedCityServer struct {
 // contracts and are explicitly excluded from the typed control plane.
 type SupervisorMux struct {
 	resolver    CityResolver
-	initializer cityinit.Initializer
+	initializer cityInitializer
 	readOnly    bool
 	version     string
 	startedAt   time.Time
@@ -101,7 +132,7 @@ type SupervisorMux struct {
 // POST /v0/city handler to scaffold new cities in-process; passing nil
 // is allowed for tests that don't exercise city creation (the handler
 // returns 501 Not Implemented in that case).
-func NewSupervisorMux(resolver CityResolver, initializer cityinit.Initializer, readOnly bool, version string, startedAt time.Time) *SupervisorMux {
+func NewSupervisorMux(resolver CityResolver, initializer cityInitializer, readOnly bool, version string, startedAt time.Time) *SupervisorMux {
 	humaMux := http.NewServeMux()
 	sm := &SupervisorMux{
 		resolver:    resolver,
@@ -271,11 +302,10 @@ func (sm *SupervisorMux) getCityServer(name string, state State) *Server {
 // buildMultiplexer creates a Multiplexer from all running cities'
 // event providers plus any transient-city providers surfaced by a
 // resolver that implements TransientCityEventSource. Including
-// transient (pending init, in-progress, or failed) cities matters
-// for clients that POST /v0/city and wait for city.created /
-// city.ready / city.init_failed events on /v0/events/stream without
-// polling — the city's own events.jsonl exists from Scaffold
-// onward, but the city isn't in Running=true yet.
+// transient (pending init, in-progress, or failed) cities matters for
+// clients that POST /v0/city and watch diagnostics on
+// /v0/events/stream without polling — the city's own events.jsonl
+// exists from Scaffold onward, but the city isn't in Running=true yet.
 func (sm *SupervisorMux) buildMultiplexer() *events.Multiplexer {
 	mux := events.NewMultiplexer()
 	cities := sm.resolver.ListCities()
@@ -301,6 +331,13 @@ func (sm *SupervisorMux) buildMultiplexer() *events.Multiplexer {
 			mux.Add(name, ep)
 		}
 	}
+	if supSrc, ok := sm.resolver.(SupervisorEventSource); ok {
+		if rec := supSrc.SupervisorEventRecorder(); rec != nil {
+			if prov, ok := rec.(events.Provider); ok {
+				mux.Add("__supervisor__", prov)
+			}
+		}
+	}
 	return mux
 }
 
diff --git a/internal/api/supervisor_city_routes.go b/internal/api/supervisor_city_routes.go
index eeb61a8949..647b40edac 100644
--- a/internal/api/supervisor_city_routes.go
+++ b/internal/api/supervisor_city_routes.go
@@ -61,6 +61,7 @@ func (sm *SupervisorMux) registerCityRoutes() {
 		Method:        http.MethodPost,
 		Path:          "/agents",
 		Summary:       "Create an agent",
+		Description:   "Creates an agent and waits until it is visible to immediate follow-up operations. If the agent is durably created but visibility confirmation is canceled or times out, the retryable 503/504 response includes a Retry-After header.",
 		DefaultStatus: http.StatusCreated,
 	}, (*Server).humaHandleAgentCreate)
 	cityPatch(sm, "/agent/{dir}/{base}", (*Server).humaHandleAgentUpdateQualified)
@@ -310,7 +311,7 @@ func (sm *SupervisorMux) registerCityRoutes() {
 		Path:        cityScopePrefix + "/events/stream",
 		Summary:     "Stream city events in real time",
 		Description: "Server-Sent Events stream of city events with optional workflow projections. " +
-			"Supports reconnection via Last-Event-ID header or after_seq query param.",
+			"Supports reconnection via Last-Event-ID header or after_seq query param; omitting both starts at the current city event head.",
 	}, map[string]any{
 		"event": sseEventContract{
 			runtimeSample: eventStreamEnvelope{},
diff --git a/internal/api/supervisor_test.go b/internal/api/supervisor_test.go
index 88176aebcf..657d582ede 100644
--- a/internal/api/supervisor_test.go
+++ b/internal/api/supervisor_test.go
@@ -19,11 +19,14 @@ import (
 
 // fakeCityResolver implements CityResolver for testing.
 type fakeCityResolver struct {
-	cities map[string]*fakeState // keyed by city name
+	cities             map[string]*fakeState // keyed by city name
+	listed             []CityInfo
+	pending            map[string]string
+	supervisorRecorder events.Recorder
 }
 
 func (f *fakeCityResolver) ListCities() []CityInfo {
-	var out []CityInfo
+	out := append([]CityInfo(nil), f.listed...)
 	for name := range f.cities {
 		s := f.cities[name]
 		out = append(out, CityInfo{
@@ -42,6 +45,27 @@ func (f *fakeCityResolver) CityState(name string) State {
 	return nil
 }
 
+func (f *fakeCityResolver) StorePendingRequestID(cityPath, requestID string) error {
+	if f.pending == nil {
+		f.pending = make(map[string]string)
+	}
+	if _, exists := f.pending[cityPath]; exists {
+		return ErrPendingRequestExists
+	}
+	f.pending[cityPath] = requestID
+	return nil
+}
+
+func (f *fakeCityResolver) ConsumePendingRequestID(cityPath string) (string, bool, error) {
+	id, ok := f.pending[cityPath]
+	delete(f.pending, cityPath)
+	return id, ok, nil
+}
+
+func (f *fakeCityResolver) SupervisorEventRecorder() events.Recorder {
+	return f.supervisorRecorder
+}
+
 func newTestSupervisorMux(t *testing.T, cities map[string]*fakeState) *SupervisorMux {
 	t.Helper()
 	resolver := &fakeCityResolver{cities: cities}
@@ -83,6 +107,22 @@ func TestSupervisorCitiesList(t *testing.T) {
 	}
 }
 
+func TestSupervisorCityServiceProxy404sUntilCityRunning(t *testing.T) {
+	sm := newTestSupervisorMux(t, map[string]*fakeState{})
+	req := httptest.NewRequest(http.MethodGet, "/v0/city/starting/svc/review-intake/healthz", nil)
+	rec := httptest.NewRecorder()
+
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNotFound)
+	}
+	const want = `{"status":404,"title":"Not Found","detail":"not_found: city not found or not running"}`
+	if strings.TrimSpace(rec.Body.String()) != want {
+		t.Fatalf("body = %s, want %s", rec.Body.String(), want)
+	}
+}
+
 func TestSupervisorProviderReadinessRoute(t *testing.T) {
 	homeDir := t.TempDir()
 	binDir := filepath.Join(homeDir, "bin")
@@ -199,6 +239,30 @@ func TestSupervisorCityNamespacedRoute(t *testing.T) {
 	}
 }
 
+func TestSupervisorCityScopedRoute404sUntilCityRunning(t *testing.T) {
+	resolver := &fakeCityResolver{
+		cities: map[string]*fakeState{},
+		listed: []CityInfo{{
+			Name:    "bright-lights",
+			Path:    "/tmp/bright-lights",
+			Running: false,
+			Status:  "starting_agents",
+		}},
+	}
+	sm := NewSupervisorMux(resolver, nil, false, "test", time.Now())
+
+	req := httptest.NewRequest("GET", "/v0/city/bright-lights/agents", nil)
+	rec := httptest.NewRecorder()
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want %d; body: %s", rec.Code, http.StatusNotFound, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), CityNotFoundOrNotRunningDetail("bright-lights")) {
+		t.Fatalf("body missing not-running detail: %s", rec.Body.String())
+	}
+}
+
 func TestSupervisorCityDetail(t *testing.T) {
 	s := newFakeState(t)
 	s.cityName = "bright-lights"
@@ -387,6 +451,46 @@ func TestSupervisorPerCityEventStream(t *testing.T) {
 	}
 }
 
+func TestSupervisorEventStreamsFlushHeadersBeforeFirstEvent(t *testing.T) {
+	s := newFakeState(t)
+	s.cityName = "gc-work"
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"gc-work": s,
+	})
+	srv := httptest.NewServer(sm)
+	t.Cleanup(srv.Close)
+
+	for _, path := range []string{
+		"/v0/events/stream",
+		"/v0/city/gc-work/events/stream",
+	} {
+		t.Run(path, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			defer cancel()
+
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+path, nil)
+			if err != nil {
+				t.Fatalf("build request: %v", err)
+			}
+			req.Header.Set("Accept", "text/event-stream")
+
+			resp, err := srv.Client().Do(req)
+			if err != nil {
+				t.Fatalf("GET %s: %v", path, err)
+			}
+			defer resp.Body.Close() //nolint:errcheck
+
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusOK)
+			}
+			if ct := resp.Header.Get("Content-Type"); ct != "text/event-stream" {
+				t.Fatalf("Content-Type = %q, want text/event-stream", ct)
+			}
+		})
+	}
+}
+
 func TestSupervisorPerCityEventStreamEmitsTypedEnvelopePayloadObject(t *testing.T) {
 	s := newFakeState(t)
 	s.cityName = "gc-work"
@@ -468,6 +572,28 @@ func TestSupervisorPerCityEventStreamEmitsNoPayloadObject(t *testing.T) {
 	}
 }
 
+func TestSupervisorPerCityEventStreamWithoutCursorStartsAtHead(t *testing.T) {
+	s := newFakeState(t)
+	s.cityName = "gc-work"
+	ep := s.eventProv.(*events.Fake)
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "tester", Subject: "old"})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"gc-work": s,
+	})
+
+	frame := firstSSEFrameAfterRecord(t, sm, "/v0/city/gc-work/events/stream", "event", func() {
+		ep.Record(events.Event{Type: events.SessionWoke, Actor: "tester", Subject: "new"})
+	})
+	if frame.ID != "2" {
+		t.Fatalf("SSE id = %q, want 2; body=%s", frame.ID, frame.Data)
+	}
+	data := decodeSSETestData(t, frame)
+	if data["subject"] != "new" {
+		t.Fatalf("data.subject = %v, want new; data=%v", data["subject"], data)
+	}
+}
+
 func TestSupervisorGlobalEventList(t *testing.T) {
 	s1 := newFakeState(t)
 	s1.cityName = "alpha"
@@ -492,8 +618,9 @@ func TestSupervisorGlobalEventList(t *testing.T) {
 	}
 
 	var resp struct {
-		Items []events.TaggedEvent `json:"items"`
-		Total int                  `json:"total"`
+		EventCursor string               `json:"event_cursor"`
+		Items       []events.TaggedEvent `json:"items"`
+		Total       int                  `json:"total"`
 	}
 	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
 		t.Fatalf("decode: %v", err)
@@ -501,6 +628,9 @@ func TestSupervisorGlobalEventList(t *testing.T) {
 	if resp.Total != 2 {
 		t.Errorf("total = %d, want 2", resp.Total)
 	}
+	if resp.EventCursor != "alpha:1,beta:1" {
+		t.Fatalf("event_cursor = %q, want alpha:1,beta:1", resp.EventCursor)
+	}
 
 	// Verify events are tagged with city names.
 	cities := make(map[string]bool)
@@ -577,6 +707,68 @@ func TestSupervisorEventListsEmitTypedPayloadObjects(t *testing.T) {
 	}
 }
 
+func TestSupervisorEventListsIncludeCustomEventTypes(t *testing.T) {
+	s := newFakeState(t)
+	s.cityName = "alpha"
+	s.eventProv.(*events.Fake).Record(events.Event{Type: "custom.untyped", Actor: "tester", Payload: json.RawMessage(`{"source":"test"}`)})
+	s.eventProv.(*events.Fake).Record(events.Event{Type: events.SessionWoke, Actor: "tester"})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{"alpha": s})
+
+	req := httptest.NewRequest("GET", "/v0/events", nil)
+	rec := httptest.NewRecorder()
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []map[string]any `json:"items"`
+		Total int              `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 2 || len(resp.Items) != 2 {
+		t.Fatalf("response = %+v, want custom and registered events", resp)
+	}
+	custom := eventListItemByType(t, resp.Items, "custom.untyped")
+	if custom["city"] != "alpha" {
+		t.Fatalf("custom city = %v, want alpha; item=%v", custom["city"], custom)
+	}
+	payload := assertJSONPayloadObject(t, custom["payload"])
+	if payload["source"] != "test" {
+		t.Fatalf("custom payload = %v, want source=test", payload)
+	}
+}
+
+func TestSupervisorEventListFilterIsEmptyMatchesEventsFilterZeroValue(t *testing.T) {
+	if !supervisorEventListFilterIsEmpty(events.Filter{}) {
+		t.Fatal("zero-value filter reported non-empty")
+	}
+
+	tests := []struct {
+		name   string
+		filter events.Filter
+	}{
+		{name: "type", filter: events.Filter{Type: events.BeadCreated}},
+		{name: "actor", filter: events.Filter{Actor: "human"}},
+		{name: "subject", filter: events.Filter{Subject: "gc-1"}},
+		{name: "since", filter: events.Filter{Since: time.Unix(1, 0)}},
+		{name: "until", filter: events.Filter{Until: time.Unix(1, 0)}},
+		{name: "after_seq", filter: events.Filter{AfterSeq: 1}},
+		{name: "limit", filter: events.Filter{Limit: 1}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if supervisorEventListFilterIsEmpty(tt.filter) {
+				t.Fatalf("filter %+v reported empty", tt.filter)
+			}
+		})
+	}
+}
+
 func TestSupervisorGlobalEventListWithFilter(t *testing.T) {
 	s1 := newFakeState(t)
 	s1.cityName = "alpha"
@@ -608,6 +800,123 @@ func TestSupervisorGlobalEventListWithFilter(t *testing.T) {
 	}
 }
 
+func TestSupervisorGlobalEventListLimitReturnsTail(t *testing.T) {
+	s1 := newFakeState(t)
+	s1.cityName = "alpha"
+	ep := s1.eventProv.(*events.Fake)
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "a1", Subject: "old"})
+	ep.Record(events.Event{Type: events.SessionStopped, Actor: "a1", Subject: "middle"})
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "a1", Subject: "new"})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{"alpha": s1})
+
+	req := httptest.NewRequest("GET", "/v0/events?limit=1", nil)
+	rec := httptest.NewRecorder()
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []events.TaggedEvent `json:"items"`
+		Total int                  `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 3 {
+		t.Fatalf("total = %d, want 3", resp.Total)
+	}
+	if len(resp.Items) != 1 {
+		t.Fatalf("items len = %d, want 1", len(resp.Items))
+	}
+	if resp.Items[0].Subject != "new" {
+		t.Fatalf("subject = %q, want new", resp.Items[0].Subject)
+	}
+}
+
+func TestSupervisorGlobalEventListLimitReturnsTailAcrossCitiesWithHeadTotal(t *testing.T) {
+	s1 := newFakeState(t)
+	s1.cityName = "alpha"
+	alpha := s1.eventProv.(*events.Fake)
+	alpha.Record(events.Event{Type: events.SessionWoke, Actor: "a1", Subject: "alpha-old", Ts: time.Unix(1, 0)})
+	alpha.Record(events.Event{Type: events.SessionWoke, Actor: "a1", Subject: "alpha-new", Ts: time.Unix(4, 0)})
+
+	s2 := newFakeState(t)
+	s2.cityName = "beta"
+	beta := s2.eventProv.(*events.Fake)
+	beta.Record(events.Event{Type: events.SessionWoke, Actor: "b1", Subject: "beta-old", Ts: time.Unix(2, 0)})
+	beta.Record(events.Event{Type: events.SessionStopped, Actor: "b1", Subject: "beta-middle", Ts: time.Unix(3, 0)})
+	beta.Record(events.Event{Type: events.SessionWoke, Actor: "b1", Subject: "beta-new", Ts: time.Unix(5, 0)})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"alpha": s1,
+		"beta":  s2,
+	})
+
+	req := httptest.NewRequest("GET", "/v0/events?limit=2", nil)
+	rec := httptest.NewRecorder()
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []events.TaggedEvent `json:"items"`
+		Total int                  `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 5 {
+		t.Fatalf("total = %d, want 5", resp.Total)
+	}
+	if len(resp.Items) != 2 {
+		t.Fatalf("items len = %d, want 2", len(resp.Items))
+	}
+	if resp.Items[0].Subject != "alpha-new" || resp.Items[1].Subject != "beta-new" {
+		t.Fatalf("subjects = [%s %s], want [alpha-new beta-new]", resp.Items[0].Subject, resp.Items[1].Subject)
+	}
+}
+
+func TestSupervisorGlobalEventListLimitWithFilterReportsFilteredTotal(t *testing.T) {
+	s1 := newFakeState(t)
+	s1.cityName = "alpha"
+	ep := s1.eventProv.(*events.Fake)
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "a1", Subject: "old", Ts: time.Unix(1, 0)})
+	ep.Record(events.Event{Type: events.SessionStopped, Actor: "a1", Subject: "ignored", Ts: time.Unix(2, 0)})
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "a1", Subject: "new", Ts: time.Unix(3, 0)})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{"alpha": s1})
+
+	req := httptest.NewRequest("GET", "/v0/events?type=session.woke&limit=1", nil)
+	rec := httptest.NewRecorder()
+	sm.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+
+	var resp struct {
+		Items []events.TaggedEvent `json:"items"`
+		Total int                  `json:"total"`
+	}
+	if err := json.NewDecoder(rec.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Total != 2 {
+		t.Fatalf("total = %d, want 2 filtered matches", resp.Total)
+	}
+	if len(resp.Items) != 1 {
+		t.Fatalf("items len = %d, want 1", len(resp.Items))
+	}
+	if resp.Items[0].Subject != "new" {
+		t.Fatalf("subject = %q, want new", resp.Items[0].Subject)
+	}
+}
+
 func TestSupervisorGlobalEventListRejectsInvalidSince(t *testing.T) {
 	sm := newTestSupervisorMux(t, map[string]*fakeState{})
 
@@ -832,6 +1141,91 @@ func TestSupervisorGlobalEventStreamEmitsNoPayloadObject(t *testing.T) {
 	}
 }
 
+func TestSupervisorGlobalEventStreamWithoutCursorStartsAtHead(t *testing.T) {
+	s := newFakeState(t)
+	s.cityName = "alpha"
+	ep := s.eventProv.(*events.Fake)
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "tester", Subject: "old"})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"alpha": s,
+	})
+
+	frame := firstSSEFrameAfterRecord(t, sm, "/v0/events/stream", "tagged_event", func() {
+		ep.Record(events.Event{Type: events.SessionWoke, Actor: "tester", Subject: "new"})
+	})
+	if frame.ID != "alpha:2" {
+		t.Fatalf("SSE id = %q, want alpha:2; body=%s", frame.ID, frame.Data)
+	}
+	data := decodeSSETestData(t, frame)
+	if data["subject"] != "new" {
+		t.Fatalf("data.subject = %v, want new; data=%v", data["subject"], data)
+	}
+}
+
+func TestSupervisorGlobalEventStreamAfterCursorReplaysFromCursor(t *testing.T) {
+	s := newFakeState(t)
+	s.cityName = "alpha"
+	ep := s.eventProv.(*events.Fake)
+	ep.Record(events.Event{Type: events.SessionWoke, Actor: "tester", Subject: "old"})
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"alpha": s,
+	})
+
+	frame := firstSSEFrameAfterRecord(t, sm, "/v0/events/stream?after_cursor=alpha:0", "tagged_event", func() {})
+	if frame.ID != "alpha:1" {
+		t.Fatalf("SSE id = %q, want alpha:1; body=%s", frame.ID, frame.Data)
+	}
+	data := decodeSSETestData(t, frame)
+	if data["subject"] != "old" {
+		t.Fatalf("data.subject = %v, want old; data=%v", data["subject"], data)
+	}
+}
+
+func TestCurrentSupervisorEventCursorReturnsProviderErrors(t *testing.T) {
+	s := newFakeState(t)
+	s.cityName = "alpha"
+	s.eventProv = events.NewFailFake()
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"alpha": s,
+	})
+
+	if got, err := sm.currentSupervisorEventCursor(); err == nil {
+		t.Fatalf("currentSupervisorEventCursor() = %q, nil error; want provider error", got)
+	}
+}
+
+func TestCurrentSupervisorEventCursorIsStrictOnPartialProviderFailure(t *testing.T) {
+	healthy := newFakeState(t)
+	healthy.cityName = "alpha"
+	healthy.eventProv.(*events.Fake).Record(events.Event{
+		Type:    events.SessionWoke,
+		Actor:   "tester",
+		Subject: "healthy",
+	})
+	broken := newFakeState(t)
+	broken.cityName = "bravo"
+	broken.eventProv = events.NewFailFake()
+
+	sm := newTestSupervisorMux(t, map[string]*fakeState{
+		"alpha": healthy,
+		"bravo": broken,
+	})
+
+	got, err := sm.currentSupervisorEventCursor()
+	if err == nil {
+		t.Fatalf("currentSupervisorEventCursor() = %q, nil error; want strict partial-provider failure", got)
+	}
+	if got != "" {
+		t.Fatalf("currentSupervisorEventCursor() returned partial cursor %q with error; want empty cursor", got)
+	}
+	if !strings.Contains(err.Error(), "bravo") {
+		t.Fatalf("currentSupervisorEventCursor() error = %v, want broken city name", err)
+	}
+}
+
 func TestSupervisorGlobalEventStreamProjectsWorkflowMetadata(t *testing.T) {
 	s1 := newFakeState(t)
 	s1.cityName = "alpha"
diff --git a/internal/api/title_generate_test.go b/internal/api/title_generate_test.go
index e18960edaa..982b2077d1 100644
--- a/internal/api/title_generate_test.go
+++ b/internal/api/title_generate_test.go
@@ -166,7 +166,7 @@ func TestTitleModelFlagArgs(t *testing.T) {
 			{
 				Key: "model",
 				Choices: []config.OptionChoice{
-					{Value: "opus", FlagArgs: []string{"--model", "claude-opus-4-6"}},
+					{Value: "opus", FlagArgs: []string{"--model", "claude-opus-4-7"}},
 					{Value: "haiku", FlagArgs: []string{"--model", "claude-haiku-4-5-20251001"}},
 				},
 			},
diff --git a/internal/api/worker_capability_guardrail_test.go b/internal/api/worker_capability_guardrail_test.go
index 16ab93dfc0..8f6ba37e28 100644
--- a/internal/api/worker_capability_guardrail_test.go
+++ b/internal/api/worker_capability_guardrail_test.go
@@ -53,7 +53,7 @@ func TestEnrichSessionResponseAcceptsStateAndPeekCapability(t *testing.T) {
 	}, nil, sessionResponseCapabilityHandle{
 		state:  worker.State{Phase: worker.PhaseReady},
 		output: "peek output",
-	}, true, false)
+	}, true, false, false)
 
 	if !resp.Running {
 		t.Fatal("Running = false, want true")
diff --git a/internal/beads/bdstore.go b/internal/beads/bdstore.go
index 78b2a81402..8df7bd5aa6 100644
--- a/internal/beads/bdstore.go
+++ b/internal/beads/bdstore.go
@@ -18,10 +18,16 @@ import (
 	"github.com/gastownhall/gascity/internal/telemetry"
 )
 
+const (
+	bdParentProjectionPollInterval = 50 * time.Millisecond
+)
+
 // CommandRunner executes a command in the given directory and returns stdout bytes.
 // The dir argument sets the working directory; name and args specify the command.
 type CommandRunner func(dir, name string, args ...string) ([]byte, error)
 
+var bdCommandTimeout = 120 * time.Second
+
 // ExecCommandRunner returns a CommandRunner that uses os/exec to run commands.
 // Captures stdout for parsing and stderr for error diagnostics.
 // When the command is "bd", records telemetry (duration, status, output).
@@ -53,11 +59,15 @@ func ExecCommandRunnerWithEnv(env map[string]string) CommandRunner {
 				time.Now().UTC().Format(time.RFC3339Nano), status, time.Since(start), dir, name, args, msg)
 		}
 		trace("start", nil)
-		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+		ctx, cancel := context.WithTimeout(context.Background(), bdCommandTimeout)
 		defer cancel()
 		cmd := exec.CommandContext(ctx, name, args...)
 		cmd.WaitDelay = 2 * time.Second
+		prepareCommandForTimeout(cmd)
 		cmd.Dir = dir
+		cmd.Cancel = func() error {
+			return killCommandTree(cmd)
+		}
 		if len(env) > 0 {
 			cmd.Env = mergeEnv(os.Environ(), env)
 		}
@@ -70,22 +80,51 @@ func ExecCommandRunnerWithEnv(env map[string]string) CommandRunner {
 				err, out, stderr.String())
 		}
 		if ctx.Err() == context.DeadlineExceeded {
-			timeoutErr := fmt.Errorf("timed out after 120s")
+			timeoutErr := fmt.Errorf("timed out after %s", bdCommandTimeout)
 			trace("timeout", timeoutErr)
 			if stderr.Len() > 0 {
 				return out, fmt.Errorf("%w: %s", timeoutErr, stderr.String())
 			}
 			return out, timeoutErr
 		}
-		if err != nil && stderr.Len() > 0 {
-			trace("error", err)
-			return out, fmt.Errorf("%w: %s", err, stderr.String())
+		if err != nil {
+			// bd writes structured errors to stdout (JSON envelope) when
+			// invoked with --json, while stderr is often empty. Surface
+			// whichever stream has content so supervisor logs become
+			// actionable instead of bare "exit status 1".
+			detail := strings.TrimSpace(stderr.String())
+			if detail == "" && name == "bd" {
+				detail = bdStdoutErrorDetail(out)
+			}
+			if detail != "" {
+				trace("error", err)
+				return out, fmt.Errorf("%w: %s", err, detail)
+			}
 		}
 		trace("done", err)
 		return out, err
 	}
 }
 
+// bdStdoutErrorDetail extracts a human-readable error description from
+// bd's JSON error envelope on stdout. bd writes structured errors as
+// {"error": "...", "schema_version": N} on stdout when invoked with
+// --json, while stderr is often empty. Returns "" when the output does
+// not look like a bd error envelope so callers can fall through.
+func bdStdoutErrorDetail(out []byte) string {
+	trimmed := bytes.TrimSpace(extractJSON(out))
+	if len(trimmed) == 0 || trimmed[0] != '{' {
+		return ""
+	}
+	var env struct {
+		Error string `json:"error"`
+	}
+	if err := json.Unmarshal(trimmed, &env); err != nil {
+		return ""
+	}
+	return strings.TrimSpace(env.Error)
+}
+
 // PurgeRunnerFunc executes a bd purge command with custom dir and env.
 // Unlike CommandRunner, this supports environment variable manipulation
 // needed by bd purge (BEADS_DIR override).
@@ -102,11 +141,27 @@ type BdStore struct {
 	dir         string          // city root directory (where .beads/ lives)
 	runner      CommandRunner   // injectable for testing
 	purgeRunner PurgeRunnerFunc // injectable for testing; nil uses exec default
+	idPrefix    string          // bead ID prefix owned by this store, without trailing "-"
 }
 
+const bdTransientWriteAttempts = 3
+
 // NewBdStore creates a BdStore rooted at dir using the given runner.
 func NewBdStore(dir string, runner CommandRunner) *BdStore {
-	return &BdStore{dir: dir, runner: runner}
+	return NewBdStoreWithPrefix(dir, runner, "")
+}
+
+// NewBdStoreWithPrefix creates a BdStore with an explicit owned bead ID prefix.
+func NewBdStoreWithPrefix(dir string, runner CommandRunner, idPrefix string) *BdStore {
+	return &BdStore{dir: dir, runner: runner, idPrefix: normalizeIDPrefix(idPrefix)}
+}
+
+// IDPrefix returns the bead ID prefix owned by this store, without trailing "-".
+func (s *BdStore) IDPrefix() string {
+	if s == nil {
+		return ""
+	}
+	return s.idPrefix
 }
 
 // Init initializes a beads database via bd init --server. This is an admin
@@ -315,6 +370,42 @@ type bdIssueDep struct {
 	DependencyType string `json:"dependency_type"`
 }
 
+// PartialResultError indicates that a list-style bd command returned at least
+// one usable entry but also included entries that failed to parse. The
+// successful entries are still returned alongside this error; callers that can
+// surface partial data may proceed with those rows, while callers that require
+// a complete picture should treat this as a hard failure.
+type PartialResultError struct {
+	// Op identifies the bd subcommand that produced the partial result
+	// (e.g. "bd list", "bd ready").
+	Op string
+	// Err wraps the joined per-entry parse errors from parseIssuesTolerant.
+	Err error
+}
+
+// Error reports the operation and underlying parse failures.
+func (e *PartialResultError) Error() string {
+	if e == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("%s: %v", e.Op, e.Err)
+}
+
+// Unwrap returns the joined parse error so errors.Is / errors.As traversal
+// continues into the underlying causes.
+func (e *PartialResultError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	return e.Err
+}
+
+// IsPartialResult reports whether err wraps a PartialResultError.
+func IsPartialResult(err error) bool {
+	var partial *PartialResultError
+	return errors.As(err, &partial)
+}
+
 // parseIssuesTolerant unmarshals a JSON array of bdIssue objects, skipping
 // any entries that fail to parse (e.g. corrupt metadata with non-string values).
 // This prevents a single bad bead from breaking all list operations.
@@ -588,9 +679,80 @@ func (s *BdStore) Update(id string, opts UpdateOpts) error {
 	return nil
 }
 
+// WaitForParentProjection blocks until bd's parent-child listing projection
+// reflects a successful reparent from oldParentID to newParentID for id.
+func (s *BdStore) WaitForParentProjection(ctx context.Context, id, oldParentID, newParentID string) error {
+	return s.waitForParentProjection(ctx, id, oldParentID, newParentID)
+}
+
+func (s *BdStore) waitForParentProjection(ctx context.Context, id, oldParentID, newParentID string) error {
+	ticker := time.NewTicker(bdParentProjectionPollInterval)
+	defer ticker.Stop()
+
+	var lastErr error
+	for {
+		current, err := s.Get(id)
+		if err == nil {
+			switch current.ParentID {
+			case newParentID:
+				matches, matchErr := s.parentProjectionMatches(id, oldParentID, newParentID)
+				if matchErr == nil && matches {
+					return nil
+				}
+				lastErr = matchErr
+			case oldParentID:
+				lastErr = nil
+			default:
+				return fmt.Errorf("updating bead %q: %w", id, ErrParentProjectionSuperseded)
+			}
+		} else {
+			lastErr = err
+		}
+		select {
+		case <-ctx.Done():
+			if lastErr != nil {
+				return fmt.Errorf("updating bead %q: waiting for parent projection from %q to %q: %w (last check error: %w)", id, oldParentID, newParentID, ctx.Err(), lastErr)
+			}
+			return fmt.Errorf("updating bead %q: waiting for parent projection from %q to %q: %w", id, oldParentID, newParentID, ctx.Err())
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *BdStore) parentProjectionMatches(id, oldParentID, newParentID string) (bool, error) {
+	if oldParentID != "" {
+		oldChildren, err := s.List(ListQuery{ParentID: oldParentID})
+		if err != nil {
+			return false, fmt.Errorf("listing old parent %q children: %w", oldParentID, err)
+		}
+		if beadSliceContains(oldChildren, id) {
+			return false, nil
+		}
+	}
+	if newParentID != "" {
+		newChildren, err := s.List(ListQuery{ParentID: newParentID})
+		if err != nil {
+			return false, fmt.Errorf("listing new parent %q children: %w", newParentID, err)
+		}
+		if !beadSliceContains(newChildren, id) {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+func beadSliceContains(items []Bead, id string) bool {
+	for _, item := range items {
+		if item.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
 // SetMetadata sets a key-value metadata pair on a bead via bd update.
 func (s *BdStore) SetMetadata(id, key, value string) error {
-	_, err := s.runner(s.dir, "bd", "update", "--json", id,
+	err := s.runBDTransientWrite("update", "--json", id,
 		"--set-metadata", key+"="+value)
 	if err != nil {
 		if isBdNotFound(err) {
@@ -617,7 +779,7 @@ func (s *BdStore) SetMetadataBatch(id string, kvs map[string]string) error {
 	for _, k := range keys {
 		args = append(args, "--set-metadata", k+"="+kvs[k])
 	}
-	_, err := s.runner(s.dir, "bd", args...)
+	err := s.runBDTransientWrite(args...)
 	if err != nil {
 		if isBdNotFound(err) {
 			return fmt.Errorf("setting metadata on %q: %w", id, ErrNotFound)
@@ -627,6 +789,27 @@ func (s *BdStore) SetMetadataBatch(id string, kvs map[string]string) error {
 	return nil
 }
 
+func (s *BdStore) runBDTransientWrite(args ...string) error {
+	var err error
+	for attempt := 1; attempt <= bdTransientWriteAttempts; attempt++ {
+		_, err = s.runner(s.dir, "bd", args...)
+		if err == nil || !isBdTransientWriteConflict(err) || attempt == bdTransientWriteAttempts {
+			return err
+		}
+		time.Sleep(time.Duration(attempt) * 25 * time.Millisecond)
+	}
+	return err
+}
+
+func isBdTransientWriteConflict(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "Error 1213 (40001): serialization failure") ||
+		strings.Contains(msg, "this transaction conflicts with a committed transaction")
+}
+
 // Ping verifies the bd binary is accessible by running a no-op command.
 func (s *BdStore) Ping() error {
 	_, err := s.runner(s.dir, "bd", "list", "--json", "--limit", "0")
@@ -654,7 +837,7 @@ func (s *BdStore) CloseAll(ids []string, metadata map[string]string) (int, error
 	}
 
 	// Batch close: bd close id1 id2 id3 ...
-	args := append([]string{"close", "--json"}, ids...)
+	args := append([]string{"close", "--force", "--json"}, ids...)
 	_, err := s.runner(s.dir, "bd", args...)
 	if err != nil {
 		// Fall back to individual closes on batch failure.
@@ -678,7 +861,7 @@ func (s *BdStore) CloseAll(ids []string, metadata map[string]string) (int, error
 // Close sets a bead's status to closed via bd close.
 // Idempotent: closing an already-closed bead returns nil.
 func (s *BdStore) Close(id string) error {
-	_, err := s.runner(s.dir, "bd", "close", "--json", id)
+	_, err := s.runner(s.dir, "bd", "close", "--force", "--json", id)
 	if err != nil {
 		// Some bd error paths collapse to a bare exit status without a helpful
 		// not-found string. Re-read the bead to distinguish "already closed" from
@@ -693,6 +876,18 @@ func (s *BdStore) Close(id string) error {
 	return nil
 }
 
+// Reopen sets a closed bead's status to open via bd reopen.
+func (s *BdStore) Reopen(id string) error {
+	_, err := s.runner(s.dir, "bd", "reopen", "--json", id)
+	if err != nil {
+		if isBdNotFound(err) {
+			return fmt.Errorf("reopening bead %q: %w", id, ErrNotFound)
+		}
+		return fmt.Errorf("reopening bead %q: %w", id, err)
+	}
+	return nil
+}
+
 // Delete permanently removes a bead from the store via bd delete.
 func (s *BdStore) Delete(id string) error {
 	_, err := s.runner(s.dir, "bd", "delete", "--force", "--json", id)
@@ -760,10 +955,15 @@ func (s *BdStore) List(query ListQuery) ([]Bead, error) {
 	}
 	filtered := applyListQuery(result, query)
 	if parseErr != nil {
-		if len(filtered) > 0 {
-			return filtered, nil
+		if len(filtered) == 0 {
+			return nil, fmt.Errorf("bd list: %w", parseErr)
 		}
-		return filtered, fmt.Errorf("bd list: %w", parseErr)
+		// Surface partial-parse outcomes so callers can distinguish a complete
+		// list from one that silently dropped entries. Treating a partial list
+		// as authoritative has driven a runaway cache-reconcile loop in the
+		// past (synthesizing bead.closed for beads that were merely dropped
+		// by parseIssuesTolerant).
+		return filtered, &PartialResultError{Op: "bd list", Err: parseErr}
 	}
 	return filtered, nil
 }
@@ -822,9 +1022,19 @@ func (s *BdStore) Children(parentID string, opts ...QueryOpt) ([]Bead, error) {
 	})
 }
 
-// Ready returns all open beads via bd ready.
-func (s *BdStore) Ready() ([]Bead, error) {
-	out, err := s.runner(s.dir, "bd", "ready", "--json", "--limit", "0")
+// Ready returns open ready beads via bd ready.
+func (s *BdStore) Ready(query ...ReadyQuery) ([]Bead, error) {
+	q := readyQueryFromArgs(query)
+	args := []string{"ready", "--json"}
+	if q.Assignee != "" {
+		args = append(args, "--assignee", q.Assignee)
+	}
+	if q.Limit > 0 {
+		args = append(args, "--limit", strconv.Itoa(q.Limit))
+	} else {
+		args = append(args, "--limit", "0")
+	}
+	out, err := s.runner(s.dir, "bd", args...)
 	if err != nil {
 		return nil, fmt.Errorf("bd ready: %w", err)
 	}
@@ -835,13 +1045,16 @@ func (s *BdStore) Ready() ([]Bead, error) {
 		if IsReadyExcludedType(bead.Type) {
 			continue
 		}
+		if q.Assignee != "" && bead.Assignee != q.Assignee {
+			continue
+		}
 		result = append(result, bead)
 	}
 	if parseErr != nil {
-		if len(result) > 0 {
-			return result, nil
+		if len(result) == 0 {
+			return nil, fmt.Errorf("bd ready: %w", parseErr)
 		}
-		return result, fmt.Errorf("bd ready: %w", parseErr)
+		return result, &PartialResultError{Op: "bd ready", Err: parseErr}
 	}
 	return result, nil
 }
diff --git a/internal/beads/bdstore_exec_internal_test.go b/internal/beads/bdstore_exec_internal_test.go
new file mode 100644
index 0000000000..82bee1d891
--- /dev/null
+++ b/internal/beads/bdstore_exec_internal_test.go
@@ -0,0 +1,68 @@
+//go:build !windows
+
+package beads
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestExecCommandRunnerTimeoutKillsChildProcess(t *testing.T) {
+	if _, err := exec.LookPath("sh"); err != nil {
+		t.Skip("sh unavailable")
+	}
+
+	oldTimeout := bdCommandTimeout
+	bdCommandTimeout = 50 * time.Millisecond
+	t.Cleanup(func() { bdCommandTimeout = oldTimeout })
+
+	dir := t.TempDir()
+	pidFile := filepath.Join(dir, "child.pid")
+	script := filepath.Join(dir, "spawn-child.sh")
+	if err := os.WriteFile(script, []byte(`#!/bin/sh
+sleep 30 &
+echo "$!" > "$1"
+wait
+`), 0o755); err != nil {
+		t.Fatalf("write script: %v", err)
+	}
+
+	runner := ExecCommandRunner()
+	_, err := runner(dir, script, pidFile)
+	if err == nil {
+		t.Fatal("runner unexpectedly succeeded")
+	}
+	if !strings.Contains(err.Error(), "timed out after") {
+		t.Fatalf("error = %v, want timeout", err)
+	}
+
+	pidBytes, readErr := os.ReadFile(pidFile)
+	if readErr != nil {
+		t.Fatalf("read child pid: %v", readErr)
+	}
+	pid := strings.TrimSpace(string(pidBytes))
+	if pid == "" {
+		t.Fatal("child pid was empty")
+	}
+
+	for range 20 {
+		if err := exec.Command("kill", "-0", pid).Run(); err != nil {
+			return
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+
+	_ = exec.Command("kill", "-KILL", pid).Run()
+	t.Fatalf("child process %s survived command timeout", pid)
+}
+
+func TestKillCommandTreeHandlesNilCommand(t *testing.T) {
+	if err := killCommandTree(nil); err != nil && !errors.Is(err, os.ErrProcessDone) {
+		t.Fatalf("killCommandTree(nil): %v", err)
+	}
+}
diff --git a/internal/beads/bdstore_internal_test.go b/internal/beads/bdstore_internal_test.go
new file mode 100644
index 0000000000..3ceafee802
--- /dev/null
+++ b/internal/beads/bdstore_internal_test.go
@@ -0,0 +1,60 @@
+package beads
+
+import "testing"
+
+func TestBdStdoutErrorDetail(t *testing.T) {
+	tests := []struct {
+		name string
+		out  string
+		want string
+	}{
+		{
+			name: "empty",
+			out:  "",
+			want: "",
+		},
+		{
+			name: "non json",
+			out:  "bd failed",
+			want: "",
+		},
+		{
+			name: "malformed json",
+			out:  `{"error":`,
+			want: "",
+		},
+		{
+			name: "missing error",
+			out:  `{"schema_version":1}`,
+			want: "",
+		},
+		{
+			name: "null error",
+			out:  `{"error":null,"schema_version":1}`,
+			want: "",
+		},
+		{
+			name: "blank error",
+			out:  `{"error":"   ","schema_version":1}`,
+			want: "",
+		},
+		{
+			name: "error envelope",
+			out:  `{"error":" no issue found bd-42 ","schema_version":1}`,
+			want: "no issue found bd-42",
+		},
+		{
+			name: "preamble before envelope",
+			out:  "bd warning before json\n{\"error\":\"resolving dependency: no issue found bd-42\",\"schema_version\":1}",
+			want: "resolving dependency: no issue found bd-42",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := bdStdoutErrorDetail([]byte(tt.out)); got != tt.want {
+				t.Fatalf("bdStdoutErrorDetail() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/beads/bdstore_test.go b/internal/beads/bdstore_test.go
index 8f49b14f5a..5763f7c4ed 100644
--- a/internal/beads/bdstore_test.go
+++ b/internal/beads/bdstore_test.go
@@ -1,12 +1,14 @@
 package beads_test
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -318,7 +320,7 @@ func TestBdStoreClose(t *testing.T) {
 		out []byte
 		err error
 	}{
-		`bd close --json bd-abc-123`: {
+		`bd close --force --json bd-abc-123`: {
 			out: []byte(`[{"id":"bd-abc-123","title":"test","status":"closed","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`),
 		},
 	})
@@ -328,6 +330,21 @@ func TestBdStoreClose(t *testing.T) {
 	}
 }
 
+func TestBdStoreReopenUsesReopenCommand(t *testing.T) {
+	runner := fakeRunner(map[string]struct {
+		out []byte
+		err error
+	}{
+		`bd reopen --json bd-abc-123`: {
+			out: []byte(`{"id":"bd-abc-123","status":"open"}`),
+		},
+	})
+	s := beads.NewBdStore("/city", runner)
+	if err := s.Reopen("bd-abc-123"); err != nil {
+		t.Fatalf("Reopen() error = %v", err)
+	}
+}
+
 func TestBdStoreCloseNotFound(t *testing.T) {
 	// Generic CLI error without "not found" should NOT be ErrNotFound.
 	runner := func(_, _ string, _ ...string) ([]byte, error) {
@@ -404,6 +421,146 @@ func TestBdStoreUpdatePassesPriority(t *testing.T) {
 	}
 }
 
+func TestBdStoreWaitForParentProjection(t *testing.T) {
+	var mu sync.Mutex
+	showCalls := 0
+	parentListCalls := 0
+
+	runner := func(_, _ string, args ...string) ([]byte, error) {
+		cmd := strings.Join(args, " ")
+
+		mu.Lock()
+		defer mu.Unlock()
+
+		switch cmd {
+		case "show --json bd-child":
+			showCalls++
+			if showCalls == 1 {
+				return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`), nil
+			}
+			return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-parent"}]`), nil
+		case "list --json --include-infra --include-gates --limit 0 --parent bd-parent":
+			parentListCalls++
+			if parentListCalls == 1 {
+				return []byte(`[]`), nil
+			}
+			return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-parent"}]`), nil
+		default:
+			return nil, fmt.Errorf("unexpected command: bd %s", cmd)
+		}
+	}
+
+	s := beads.NewBdStore("/city", runner)
+	if err := s.WaitForParentProjection(context.Background(), "bd-child", "", "bd-parent"); err != nil {
+		t.Fatalf("WaitForParentProjection: %v", err)
+	}
+	if parentListCalls < 2 {
+		t.Fatalf("parentListCalls = %d, want at least 2", parentListCalls)
+	}
+}
+
+func TestBdStoreWaitForParentRemovalProjection(t *testing.T) {
+	var mu sync.Mutex
+	showCalls := 0
+	oldParentListCalls := 0
+
+	runner := func(_, _ string, args ...string) ([]byte, error) {
+		cmd := strings.Join(args, " ")
+
+		mu.Lock()
+		defer mu.Unlock()
+
+		switch cmd {
+		case "show --json bd-child":
+			showCalls++
+			if showCalls == 1 {
+				return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-parent"}]`), nil
+			}
+			return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`), nil
+		case "list --json --include-infra --include-gates --limit 0 --parent bd-parent":
+			oldParentListCalls++
+			if oldParentListCalls == 1 {
+				return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-parent"}]`), nil
+			}
+			return []byte(`[]`), nil
+		default:
+			return nil, fmt.Errorf("unexpected command: bd %s", cmd)
+		}
+	}
+
+	s := beads.NewBdStore("/city", runner)
+	if err := s.WaitForParentProjection(context.Background(), "bd-child", "bd-parent", ""); err != nil {
+		t.Fatalf("WaitForParentProjection: %v", err)
+	}
+	if oldParentListCalls < 2 {
+		t.Fatalf("oldParentListCalls = %d, want at least 2", oldParentListCalls)
+	}
+}
+
+func TestBdStoreWaitForParentProjectionDetectsSupersededParent(t *testing.T) {
+	runner := func(_, _ string, args ...string) ([]byte, error) {
+		cmd := strings.Join(args, " ")
+		switch cmd {
+		case "list --json --include-infra --include-gates --limit 0 --parent bd-new":
+			return []byte(`[]`), nil
+		case "list --json --include-infra --include-gates --limit 0 --parent bd-old":
+			return []byte(`[]`), nil
+		case "show --json bd-child":
+			return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-other"}]`), nil
+		default:
+			return nil, fmt.Errorf("unexpected command: bd %s", cmd)
+		}
+	}
+
+	s := beads.NewBdStore("/city", runner)
+	err := s.WaitForParentProjection(context.Background(), "bd-child", "bd-old", "bd-new")
+	if !errors.Is(err, beads.ErrParentProjectionSuperseded) {
+		t.Fatalf("err = %v, want ErrParentProjectionSuperseded", err)
+	}
+}
+
+func TestBdStoreWaitForParentProjectionGetsBeforeListing(t *testing.T) {
+	var mu sync.Mutex
+	showCalls := 0
+	listedBeforeCurrentParentChanged := false
+
+	runner := func(_, _ string, args ...string) ([]byte, error) {
+		cmd := strings.Join(args, " ")
+
+		mu.Lock()
+		defer mu.Unlock()
+
+		switch cmd {
+		case "show --json bd-child":
+			showCalls++
+			if showCalls == 1 {
+				return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-old"}]`), nil
+			}
+			return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-new"}]`), nil
+		case "list --json --include-infra --include-gates --limit 0 --parent bd-old":
+			if showCalls < 2 {
+				listedBeforeCurrentParentChanged = true
+			}
+			return []byte(`[]`), nil
+		case "list --json --include-infra --include-gates --limit 0 --parent bd-new":
+			if showCalls < 2 {
+				listedBeforeCurrentParentChanged = true
+			}
+			return []byte(`[{"id":"bd-child","title":"child","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z","parent":"bd-new"}]`), nil
+		default:
+			return nil, fmt.Errorf("unexpected command: bd %s", cmd)
+		}
+	}
+
+	s := beads.NewBdStore("/city", runner)
+	if err := s.WaitForParentProjection(context.Background(), "bd-child", "bd-old", "bd-new"); err != nil {
+		t.Fatalf("WaitForParentProjection: %v", err)
+	}
+	if listedBeforeCurrentParentChanged {
+		t.Fatal("WaitForParentProjection listed parent children before Get observed the new parent")
+	}
+}
+
 func TestBdStoreCloseCLIError(t *testing.T) {
 	// CLI error should NOT be wrapped as ErrNotFound.
 	runner := func(_, _ string, _ ...string) ([]byte, error) {
@@ -431,7 +588,7 @@ func TestBdStoreCloseAllReturnsMetadataWriteFailure(t *testing.T) {
 		`bd update --json bd-abc-123 --set-metadata source=wave1`: {
 			err: metadataErr,
 		},
-		`bd close --json bd-abc-123`: {
+		`bd close --force --json bd-abc-123`: {
 			out: []byte(`[{"id":"bd-abc-123","title":"test","status":"closed","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`),
 		},
 	})
@@ -459,13 +616,13 @@ func TestBdStoreCloseAllReturnsPartialCountAndErrorOnFallbackFailure(t *testing.
 		out []byte
 		err error
 	}{
-		`bd close --json bd-1 bd-2`: {
+		`bd close --force --json bd-1 bd-2`: {
 			err: batchErr,
 		},
-		`bd close --json bd-1`: {
+		`bd close --force --json bd-1`: {
 			out: []byte(`[{"id":"bd-1","title":"one","status":"closed","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`),
 		},
-		`bd close --json bd-2`: {
+		`bd close --force --json bd-2`: {
 			err: individualErr,
 		},
 		`bd show --json bd-2`: {
@@ -498,13 +655,13 @@ func TestBdStoreCloseAllFallbackSuccessReturnsNil(t *testing.T) {
 		out []byte
 		err error
 	}{
-		`bd close --json bd-1 bd-2`: {
+		`bd close --force --json bd-1 bd-2`: {
 			err: batchErr,
 		},
-		`bd close --json bd-1`: {
+		`bd close --force --json bd-1`: {
 			out: []byte(`[{"id":"bd-1","title":"one","status":"closed","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`),
 		},
-		`bd close --json bd-2`: {
+		`bd close --force --json bd-2`: {
 			out: []byte(`[{"id":"bd-2","title":"two","status":"closed","issue_type":"task","created_at":"2025-01-15T10:30:00Z"}]`),
 		},
 	})
@@ -612,8 +769,116 @@ func TestBdStoreListReturnsPartialResultsOnCorruptEntries(t *testing.T) {
 	if len(got) != 1 || got[0].ID != "bd-good" {
 		t.Fatalf("ListOpen() = %v, want only bd-good", got)
 	}
-	if err != nil {
-		t.Fatalf("ListOpen() error = %v, want nil with usable partial results", err)
+	var partial *beads.PartialResultError
+	if !errors.As(err, &partial) {
+		t.Fatalf("ListOpen() error = %v, want *beads.PartialResultError so callers can distinguish complete from partial results", err)
+	}
+	if partial.Op != "bd list" {
+		t.Errorf("PartialResultError.Op = %q, want %q", partial.Op, "bd list")
+	}
+	if partial.Err == nil {
+		t.Errorf("PartialResultError.Err is nil; want wrapped parse error")
+	}
+}
+
+func TestBdStoreListReturnsHardErrorWithoutUsableSurvivors(t *testing.T) {
+	tests := []struct {
+		name string
+		out  []byte
+	}{
+		{
+			name: "malformed top-level json",
+			out:  []byte(`{not-json`),
+		},
+		{
+			name: "all entries corrupt",
+			out: []byte(`[
+				{"id":"bd-bad","title":"bad","status":"open","issue_type":"task","created_at":"not-a-time"}
+			]`),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			runner := fakeRunner(map[string]struct {
+				out []byte
+				err error
+			}{
+				`bd list --json --include-infra --include-gates --limit 0`: {out: tc.out},
+			})
+
+			s := beads.NewBdStore("/city", runner)
+			got, err := s.ListOpen()
+			if err == nil {
+				t.Fatal("ListOpen() error = nil, want hard parse error")
+			}
+			if len(got) != 0 {
+				t.Fatalf("ListOpen() returned %v, want no usable survivors", got)
+			}
+			var partial *beads.PartialResultError
+			if errors.As(err, &partial) {
+				t.Fatalf("ListOpen() error = %v, want hard parse error not *PartialResultError", err)
+			}
+			if !strings.Contains(err.Error(), "bd list") {
+				t.Fatalf("ListOpen() error = %q, want bd list context", err)
+			}
+		})
+	}
+}
+
+func TestBdStoreReadyReturnsPartialResultErrorOnCorruptEntries(t *testing.T) {
+	runner := fakeRunner(map[string]struct {
+		out []byte
+		err error
+	}{
+		`bd ready --json --limit 0`: {
+			out: []byte(`[
+				{"id":"bd-good","title":"good","status":"open","issue_type":"task","created_at":"2025-01-15T10:30:00Z"},
+				{"id":"bd-bad","title":"bad","status":"open","issue_type":"task","created_at":"not-a-time"}
+			]`),
+		},
+	})
+
+	s := beads.NewBdStore("/city", runner)
+	got, err := s.Ready()
+	if len(got) != 1 || got[0].ID != "bd-good" {
+		t.Fatalf("Ready() = %v, want only bd-good", got)
+	}
+	var partial *beads.PartialResultError
+	if !errors.As(err, &partial) {
+		t.Fatalf("Ready() error = %v, want *beads.PartialResultError", err)
+	}
+	if partial.Op != "bd ready" {
+		t.Errorf("PartialResultError.Op = %q, want %q", partial.Op, "bd ready")
+	}
+}
+
+func TestBdStoreReadyReturnsHardErrorWithoutUsableSurvivors(t *testing.T) {
+	runner := fakeRunner(map[string]struct {
+		out []byte
+		err error
+	}{
+		`bd ready --json --limit 0`: {
+			out: []byte(`[
+				{"id":"bd-bad","title":"bad","status":"open","issue_type":"task","created_at":"not-a-time"}
+			]`),
+		},
+	})
+
+	s := beads.NewBdStore("/city", runner)
+	got, err := s.Ready()
+	if err == nil {
+		t.Fatal("Ready() error = nil, want hard parse error")
+	}
+	if len(got) != 0 {
+		t.Fatalf("Ready() returned %v, want no usable survivors", got)
+	}
+	var partial *beads.PartialResultError
+	if errors.As(err, &partial) {
+		t.Fatalf("Ready() error = %v, want hard parse error not *PartialResultError", err)
+	}
+	if !strings.Contains(err.Error(), "bd ready") {
+		t.Fatalf("Ready() error = %q, want bd ready context", err)
 	}
 }
 
@@ -656,6 +921,31 @@ func TestBdStoreReady(t *testing.T) {
 	}
 }
 
+func TestBdStoreReadyWithAssigneeAndLimit(t *testing.T) {
+	runner := fakeRunner(map[string]struct {
+		out []byte
+		err error
+	}{
+		`bd ready --json --assignee worker-1 --limit 3`: {
+			out: []byte(`[
+				{"id":"bd-worker","title":"ready one","status":"open","issue_type":"task","assignee":"worker-1","created_at":"2025-01-15T10:30:00Z"},
+				{"id":"bd-other","title":"wrong assignee","status":"open","issue_type":"task","assignee":"worker-2","created_at":"2025-01-15T10:31:00Z"}
+			]`),
+		},
+	})
+	s := beads.NewBdStore("/city", runner)
+	got, err := s.Ready(beads.ReadyQuery{Assignee: "worker-1", Limit: 3})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("Ready(assignee) returned %d beads, want 1", len(got))
+	}
+	if got[0].ID != "bd-worker" {
+		t.Fatalf("Ready(assignee)[0].ID = %q, want bd-worker", got[0].ID)
+	}
+}
+
 func TestBdStoreReadyFiltersInfraTypes(t *testing.T) {
 	runner := fakeRunner(map[string]struct {
 		out []byte
@@ -1134,7 +1424,7 @@ func TestBdStoreListInfersParentFromParentChildDependency(t *testing.T) {
 		out []byte
 		err error
 	}{
-		`bd list --json --label=mc-live-contract --include-infra --include-gates --limit 50`: {
+		`bd list --json --label=real-world-app-contract --include-infra --include-gates --limit 50`: {
 			out: []byte(`[
 				{
 					"id":"bd-child",
@@ -1142,7 +1432,7 @@ func TestBdStoreListInfersParentFromParentChildDependency(t *testing.T) {
 					"status":"open",
 					"issue_type":"task",
 					"created_at":"2025-01-15T10:30:00Z",
-					"labels":["mc-live-contract"],
+					"labels":["real-world-app-contract"],
 					"dependencies":[
 						{
 							"issue_id":"bd-child",
@@ -1156,7 +1446,7 @@ func TestBdStoreListInfersParentFromParentChildDependency(t *testing.T) {
 	})
 	s := beads.NewBdStore("/city", runner)
 
-	got, err := s.List(beads.ListQuery{Label: "mc-live-contract", Limit: 50})
+	got, err := s.List(beads.ListQuery{Label: "real-world-app-contract", Limit: 50})
 	if err != nil {
 		t.Fatalf("List: %v", err)
 	}
@@ -1261,6 +1551,25 @@ func TestBdStoreSetMetadataError(t *testing.T) {
 	}
 }
 
+func TestBdStoreSetMetadataBatchRetriesDoltSerializationFailure(t *testing.T) {
+	calls := 0
+	runner := func(_, _ string, _ ...string) ([]byte, error) {
+		calls++
+		if calls == 1 {
+			return nil, fmt.Errorf("exit status 1: Error updating bd-42: dolt commit: Error 1213 (40001): serialization failure: this transaction conflicts with a committed transaction from another client, try restarting transaction")
+		}
+		return []byte(`{"id":"bd-42"}`), nil
+	}
+	s := beads.NewBdStore("/city", runner)
+	err := s.SetMetadataBatch("bd-42", map[string]string{"state": "active"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if calls != 2 {
+		t.Fatalf("calls = %d, want 2", calls)
+	}
+}
+
 func TestBdStoreSetMetadataCLINotFound(t *testing.T) {
 	runner := func(_, _ string, _ ...string) ([]byte, error) {
 		return nil, fmt.Errorf("exit status 1: Error updating x: issue not found: bd-42")
@@ -1647,6 +1956,35 @@ func TestExecCommandRunnerWithEnvOverridesInheritedValues(t *testing.T) {
 	}
 }
 
+func TestExecCommandRunnerWithEnvSurfacesBdJSONErrorFromStdout(t *testing.T) {
+	binDir := t.TempDir()
+	bdPath := filepath.Join(binDir, "bd")
+	script := `#!/bin/sh
+printf '%s\n' 'bd warning before json'
+printf '%s\n' '{"error":"resolving dependency: no issue found bd-missing","schema_version":1}'
+exit 1
+`
+	if err := os.WriteFile(bdPath, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	runner := beads.ExecCommandRunnerWithEnv(map[string]string{
+		"GC_CITY_PATH": "/city",
+	})
+
+	out, err := runner(t.TempDir(), "bd", "dep", "list", "bd-missing", "--json")
+	if err == nil {
+		t.Fatal("runner error = nil, want bd exit error")
+	}
+	if !strings.Contains(err.Error(), "resolving dependency: no issue found bd-missing") {
+		t.Fatalf("runner error = %q, want stdout JSON error detail", err.Error())
+	}
+	if !strings.Contains(string(out), `"schema_version":1`) {
+		t.Fatalf("runner stdout = %q, want original bd stdout preserved", string(out))
+	}
+}
+
 func TestBdStoreApplyGraphPlan(t *testing.T) {
 	dir := t.TempDir()
 	var capturedPlan beads.GraphApplyPlan
diff --git a/internal/beads/beads.go b/internal/beads/beads.go
index b82aea01dc..43aaeb7f92 100644
--- a/internal/beads/beads.go
+++ b/internal/beads/beads.go
@@ -3,6 +3,7 @@
 package beads
 
 import (
+	"context"
 	"errors"
 	"time"
 )
@@ -10,6 +11,10 @@ import (
 // ErrNotFound is returned when a bead ID does not exist in the store.
 var ErrNotFound = errors.New("bead not found")
 
+// ErrParentProjectionSuperseded reports that a parent update was overtaken by a
+// concurrent reparent before the caller's projection wait could converge.
+var ErrParentProjectionSuperseded = errors.New("parent projection superseded by concurrent update")
+
 // Bead is a single unit of work in Gas City. Everything is a bead: tasks,
 // mail, molecules, convoys.
 type Bead struct {
@@ -148,6 +153,10 @@ type Store interface {
 	// does not exist. Closing an already-closed bead is a no-op.
 	Close(id string) error
 
+	// Reopen sets a closed bead's status back to "open". Returns ErrNotFound
+	// if the ID does not exist.
+	Reopen(id string) error
+
 	// CloseAll closes multiple beads in a single batch operation and sets
 	// the given metadata on each. Already-closed beads are skipped.
 	// Returns the number of beads actually closed.
@@ -167,8 +176,8 @@ type Store interface {
 	// Ready returns open, unblocked beads representing actionable work.
 	// Infrastructure types (molecule, message, gate, etc.) are excluded
 	// to match the bd CLI's GetReadyWork semantics. Same ordering note
-	// as List.
-	Ready() ([]Bead, error)
+	// as List. Pass ReadyQuery to constrain the ready lookup.
+	Ready(query ...ReadyQuery) ([]Bead, error)
 
 	// Legacy helper; prefer List with ListQuery in new code.
 	// Children returns all beads whose ParentID matches the given ID,
@@ -226,3 +235,14 @@ type Store interface {
 	// "up" returns what depends on this bead.
 	DepList(id, direction string) ([]Dep, error)
 }
+
+// ParentProjectionWaiter is an optional capability for stores whose
+// parent-child listing path may lag a successful parent update. Callers that
+// need strict read-after-write semantics for parent projections can type-assert
+// this interface after a successful Update.
+type ParentProjectionWaiter interface {
+	// WaitForParentProjection blocks until the store's parent-child listing
+	// view reflects a reparent from oldParentID to newParentID for id, or
+	// returns an error if the projection does not converge.
+	WaitForParentProjection(ctx context.Context, id, oldParentID, newParentID string) error
+}
diff --git a/internal/beads/caching_store.go b/internal/beads/caching_store.go
index 2cc9a46ebb..eacc3fb9d5 100644
--- a/internal/beads/caching_store.go
+++ b/internal/beads/caching_store.go
@@ -3,8 +3,10 @@ package beads
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -22,17 +24,21 @@ import (
 //
 // Only wraps BdStore because the event hook path requires dolt/bd.
 type CachingStore struct {
-	backing Store // runtime: always *BdStore; tests may use MemStore
-
-	mu          sync.RWMutex
-	beads       map[string]Bead
-	deps        map[string][]Dep
-	dirty       map[string]struct{}
-	beadSeq     map[string]uint64
-	deletedSeq  map[string]uint64
-	state       cacheState
-	lastFreshAt time.Time
-	mutationSeq uint64
+	backing  Store // runtime: always *BdStore; tests may use MemStore
+	idPrefix string
+
+	mu              sync.RWMutex
+	beads           map[string]Bead
+	deps            map[string][]Dep
+	depsComplete    bool
+	dirty           map[string]struct{}
+	beadSeq         map[string]uint64
+	localBeadAt     map[string]time.Time
+	deletedSeq      map[string]uint64
+	state           cacheState
+	lastFreshAt     time.Time
+	mutationSeq     uint64
+	primePartialErr error
 
 	reconciling  atomic.Bool
 	syncFailures int
@@ -40,6 +46,8 @@ type CachingStore struct {
 	onChange     func(eventType, beadID string, payload json.RawMessage)
 	cancelFn     context.CancelFunc
 	problemf     func(string)
+
+	applyEventBeforeCommitForTest func()
 }
 
 type cacheState int
@@ -53,19 +61,21 @@ const (
 
 // CacheStats exposes cache freshness, reconciliation, and problem state.
 type CacheStats struct {
-	TotalBeads      int
-	TotalDeps       int
-	LastFreshAt     time.Time
-	LastReconcileAt time.Time
-	LastReconcileMs float64
-	Adds            int64
-	Removes         int64
-	Updates         int64
-	SyncFailures    int
-	ProblemCount    int64
-	LastProblemAt   time.Time
-	LastProblem     string
-	State           string
+	TotalBeads              int
+	TotalDeps               int
+	LastFreshAt             time.Time
+	LastReconcileAt         time.Time
+	LastReconcileMs         float64
+	Adds                    int64
+	Removes                 int64
+	Updates                 int64
+	ReconcileRecoveries     int64
+	ReconcileCloseDeferrals int64
+	SyncFailures            int
+	ProblemCount            int64
+	LastProblemAt           time.Time
+	LastProblem             string
+	State                   string
 }
 
 const (
@@ -84,30 +94,68 @@ const (
 // Only BdStore is supported because the event hook path (bd hooks ->
 // gc event emit -> event bus -> ApplyEvent) requires dolt infrastructure.
 func NewCachingStore(backing *BdStore, onChange func(eventType, beadID string, payload json.RawMessage)) *CachingStore {
-	return newCachingStore(backing, onChange)
+	prefix := ""
+	if backing != nil {
+		prefix = backing.IDPrefix()
+	}
+	cs := newCachingStore(backing, prefix, onChange)
+	if cs.idPrefix == "" {
+		cs.recordProblem("bd cache ownership", errors.New("missing issue prefix; foreign bead event filtering disabled"))
+	}
+	return cs
 }
 
 // NewCachingStoreForTest wraps any Store for testing. Production code
 // must use NewCachingStore with a *BdStore.
 func NewCachingStoreForTest(backing Store, onChange func(eventType, beadID string, payload json.RawMessage)) *CachingStore {
-	return newCachingStore(backing, onChange)
+	return newCachingStore(backing, "", onChange)
+}
+
+// NewCachingStoreForTestWithPrefix wraps any Store for tests that need
+// production-style bead ID ownership filtering.
+func NewCachingStoreForTestWithPrefix(backing Store, idPrefix string, onChange func(eventType, beadID string, payload json.RawMessage)) *CachingStore {
+	return newCachingStore(backing, idPrefix, onChange)
 }
 
-func newCachingStore(backing Store, onChange func(eventType, beadID string, payload json.RawMessage)) *CachingStore {
+func newCachingStore(backing Store, idPrefix string, onChange func(eventType, beadID string, payload json.RawMessage)) *CachingStore {
 	return &CachingStore{
-		backing:    backing,
-		beads:      make(map[string]Bead),
-		deps:       make(map[string][]Dep),
-		dirty:      make(map[string]struct{}),
-		beadSeq:    make(map[string]uint64),
-		deletedSeq: make(map[string]uint64),
-		onChange:   onChange,
+		backing:     backing,
+		idPrefix:    normalizeIDPrefix(idPrefix),
+		beads:       make(map[string]Bead),
+		deps:        make(map[string][]Dep),
+		dirty:       make(map[string]struct{}),
+		beadSeq:     make(map[string]uint64),
+		localBeadAt: make(map[string]time.Time),
+		deletedSeq:  make(map[string]uint64),
+		onChange:    onChange,
 		problemf: func(msg string) {
 			log.Printf("beads cache: %s", msg)
 		},
 	}
 }
 
+func normalizeIDPrefix(prefix string) string {
+	return strings.Trim(strings.ToLower(strings.TrimSpace(prefix)), "-")
+}
+
+func (c *CachingStore) ownsBeadID(id string) bool {
+	if c.idPrefix == "" {
+		return true
+	}
+	id = strings.ToLower(strings.TrimSpace(id))
+	return strings.HasPrefix(id, c.idPrefix+"-")
+}
+
+// WaitForParentProjection forwards the optional parent-projection wait
+// capability to the backing store when available.
+func (c *CachingStore) WaitForParentProjection(ctx context.Context, id, oldParentID, newParentID string) error {
+	waiter, ok := c.backing.(ParentProjectionWaiter)
+	if !ok {
+		return nil
+	}
+	return waiter.WaitForParentProjection(ctx, id, oldParentID, newParentID)
+}
+
 func (c *CachingStore) noteMutationLocked(ids ...string) uint64 {
 	c.mutationSeq++
 	seq := c.mutationSeq
@@ -120,6 +168,18 @@ func (c *CachingStore) noteMutationLocked(ids ...string) uint64 {
 	return seq
 }
 
+func (c *CachingStore) noteLocalMutationLocked(ids ...string) uint64 {
+	seq := c.noteMutationLocked(ids...)
+	now := time.Now()
+	for _, id := range ids {
+		if id == "" {
+			continue
+		}
+		c.localBeadAt[id] = now
+	}
+	return seq
+}
+
 // PrimeActive loads all non-closed beads (open + in_progress) into the
 // cache. These are fast indexed queries that populate enough data for
 // startup paths without waiting for a full scan. The cache enters
@@ -131,16 +191,32 @@ func (c *CachingStore) PrimeActive() error {
 	c.mu.RUnlock()
 
 	var all []Bead
+	var partialErr error
 	for _, status := range []string{"open", "in_progress"} {
 		beads, err := c.backing.List(ListQuery{Status: status})
 		if err != nil {
-			return fmt.Errorf("prime active (%s): %w", status, err)
+			if !IsPartialResult(err) {
+				return fmt.Errorf("prime active (%s): %w", status, err)
+			}
+			partialErr = errors.Join(partialErr, err)
+			c.recordProblem(fmt.Sprintf("prime active (%s)", status), err)
 		}
 		all = append(all, beads...)
 	}
 
+	beadMap := make(map[string]Bead, len(all))
+	for _, b := range all {
+		beadMap[b.ID] = cloneBead(b)
+	}
+	depMap, depsComplete, depErr := c.fetchDepsForIDs(beadIDs(beadMap))
+	if depErr != nil {
+		partialErr = errors.Join(partialErr, depErr)
+		c.recordProblem("prime active dep cache", depErr)
+	}
+
 	c.mu.Lock()
 	defer c.mu.Unlock()
+	now := time.Now()
 	for _, b := range all {
 		if c.mutationSeq != startSeq {
 			if c.deletedSeq[b.ID] > startSeq {
@@ -150,13 +226,26 @@ func (c *CachingStore) PrimeActive() error {
 				continue
 			}
 		}
+		if _, keep := c.recentLocalBeadConflictLocked(b.ID, b, now); keep {
+			continue
+		}
 		c.beads[b.ID] = cloneBead(b)
+		if depsComplete && depErr == nil {
+			c.deps[b.ID] = cloneDeps(depMap[b.ID])
+		} else {
+			c.deps[b.ID] = depsFromBeadFields(b)
+		}
 		delete(c.deletedSeq, b.ID)
+		if !recentLocalMutation(c.localBeadAt[b.ID], now) {
+			delete(c.beadSeq, b.ID)
+			delete(c.localBeadAt, b.ID)
+		}
 	}
 	if c.state == cacheUninitialized {
 		c.state = cachePartial
 	}
-	c.markFreshLocked(time.Now())
+	c.primePartialErr = partialErr
+	c.markFreshLocked(now)
 	c.updateStatsLocked()
 	return nil
 }
@@ -171,11 +260,18 @@ func (c *CachingStore) Prime(_ context.Context) error {
 
 	var all []Bead
 	var err error
+	var partialErr error
 	for attempt := 1; attempt <= 3; attempt++ {
 		all, err = c.backing.List(ListQuery{AllowScan: true}) // active beads only (default)
 		if err == nil {
 			break
 		}
+		if IsPartialResult(err) {
+			c.recordProblem("prime cache: partial list", err)
+			partialErr = err
+			err = nil
+			break
+		}
 		c.recordProblem(fmt.Sprintf("prime cache attempt %d/3", attempt), err)
 		if attempt < 3 {
 			time.Sleep(time.Duration(attempt*5) * time.Second)
@@ -190,7 +286,7 @@ func (c *CachingStore) Prime(_ context.Context) error {
 		beadMap[b.ID] = cloneBead(b)
 	}
 
-	depMap, depErr := c.fetchDepsForIDs(beadIDs(beadMap))
+	depMap, depsComplete, depErr := c.fetchDepsForIDs(beadIDs(beadMap))
 	if depErr != nil {
 		c.recordProblem("prime dep cache", depErr)
 	}
@@ -199,10 +295,38 @@ func (c *CachingStore) Prime(_ context.Context) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	if c.mutationSeq == startSeq {
-		c.beads = beadMap
-		c.deps = depMap
-		c.dirty = make(map[string]struct{})
-		c.beadSeq = make(map[string]uint64)
+		nextBeads := beadMap
+		nextDeps := depsFromBeads(beadMap, depMap, depsComplete && depErr == nil)
+		nextDirty := make(map[string]struct{})
+		nextBeadSeq := make(map[string]uint64)
+		nextLocalBeadAt := make(map[string]time.Time)
+		for id, current := range c.beads {
+			if fresh, exists := beadMap[id]; exists {
+				if recentLocalMutation(c.localBeadAt[id], now) {
+					c.carryRecentLocalMutationLocked(id, nextDirty, nextBeadSeq, nextLocalBeadAt)
+				}
+				if _, keep := c.recentLocalBeadConflictLocked(id, fresh, now); keep {
+					nextBeads[id] = cloneBead(current)
+					if deps, ok := c.deps[id]; ok {
+						nextDeps[id] = cloneDeps(deps)
+					}
+				}
+				continue
+			}
+			if current.Status != "closed" && recentLocalMutation(c.localBeadAt[id], now) {
+				nextBeads[id] = cloneBead(current)
+				if deps, ok := c.deps[id]; ok {
+					nextDeps[id] = cloneDeps(deps)
+				}
+				c.carryRecentLocalMutationLocked(id, nextDirty, nextBeadSeq, nextLocalBeadAt)
+			}
+		}
+		c.beads = nextBeads
+		c.deps = nextDeps
+		c.depsComplete = depsComplete && depErr == nil
+		c.dirty = nextDirty
+		c.beadSeq = nextBeadSeq
+		c.localBeadAt = nextLocalBeadAt
 		c.deletedSeq = make(map[string]uint64)
 	} else {
 		for id, b := range beadMap {
@@ -215,14 +339,18 @@ func (c *CachingStore) Prime(_ context.Context) error {
 			c.beads[id] = b
 			delete(c.deletedSeq, id)
 			delete(c.beadSeq, id)
-			if deps, ok := depMap[id]; ok {
-				c.deps[id] = deps
+			if depsComplete && depErr == nil {
+				c.deps[id] = cloneDeps(depMap[id])
+			} else {
+				c.deps[id] = depsFromBeadFields(b)
 			}
 		}
+		c.depsComplete = false
 	}
 	c.state = cacheLive
 	c.syncFailures = 0
 	c.stats.SyncFailures = 0
+	c.primePartialErr = partialErr
 	c.markFreshLocked(now)
 	c.updateStatsLocked()
 	return nil
@@ -316,31 +444,62 @@ func beadIDs(beadMap map[string]Bead) []string {
 	return ids
 }
 
-func (c *CachingStore) fetchDepsForIDs(ids []string) (map[string][]Dep, error) {
+func (c *CachingStore) fetchDepsForIDs(ids []string) (map[string][]Dep, bool, error) {
 	depMap := make(map[string][]Dep)
 	if len(ids) == 0 {
-		return depMap, nil
+		return depMap, true, nil
 	}
 
-	if bdStore, ok := c.backing.(*BdStore); ok {
-		batchDeps, err := bdStore.DepListBatch(ids)
-		if err != nil {
-			return depMap, err
-		}
-		for id, deps := range batchDeps {
-			depMap[id] = cloneDeps(deps)
-		}
-		return depMap, nil
+	if _, ok := c.backing.(*BdStore); ok {
+		return depMap, false, nil
 	}
 
 	for _, id := range ids {
 		deps, err := c.backing.DepList(id, "down")
 		if err != nil {
-			return depMap, fmt.Errorf("listing deps for %s: %w", id, err)
+			return depMap, false, fmt.Errorf("listing deps for %s: %w", id, err)
 		}
 		depMap[id] = cloneDeps(deps)
 	}
-	return depMap, nil
+	return depMap, true, nil
+}
+
+func depsFromBeads(beadMap map[string]Bead, depMap map[string][]Dep, useDepMap bool) map[string][]Dep {
+	deps := make(map[string][]Dep, len(beadMap))
+	for id, b := range beadMap {
+		if useDepMap {
+			deps[id] = cloneDeps(depMap[id])
+			continue
+		}
+		deps[id] = depsFromBeadFields(b)
+	}
+	return deps
+}
+
+func depsFromBeadFields(b Bead) []Dep {
+	// Structured dependencies are the authoritative bead representation when
+	// present; Needs is the legacy shorthand used when no dependency objects
+	// were carried on the bead payload.
+	if len(b.Dependencies) > 0 {
+		return cloneDeps(b.Dependencies)
+	}
+	if len(b.Needs) == 0 {
+		return nil
+	}
+	deps := make([]Dep, 0, len(b.Needs))
+	for _, need := range b.Needs {
+		depType := "blocks"
+		dependsOnID := need
+		if strings.Contains(need, ":") {
+			parts := strings.SplitN(need, ":", 2)
+			if parts[0] != "" && parts[1] != "" {
+				depType = parts[0]
+				dependsOnID = parts[1]
+			}
+		}
+		deps = append(deps, Dep{IssueID: b.ID, DependsOnID: dependsOnID, Type: depType})
+	}
+	return deps
 }
 
 func cloneDeps(deps []Dep) []Dep {
diff --git a/internal/beads/caching_store_events.go b/internal/beads/caching_store_events.go
index 8ef6a0d4d4..2e2f7678e4 100644
--- a/internal/beads/caching_store_events.go
+++ b/internal/beads/caching_store_events.go
@@ -23,30 +23,120 @@ func (c *CachingStore) ApplyEvent(eventType string, payload json.RawMessage) {
 		c.recordProblem(fmt.Sprintf("apply %s event", eventType), err)
 		return
 	}
+	if !c.ownsBeadID(patch.ID) {
+		return
+	}
 
+	now := time.Now()
 	c.mu.RLock()
-	if c.state != cacheLive {
+	if c.state != cacheLive && c.state != cachePartial {
 		c.mu.RUnlock()
 		return
 	}
-	_, cached := c.beads[patch.ID]
+	current, cached := c.beads[patch.ID]
+	currentDeps, depsKnown := c.deps[patch.ID]
+	if !depsKnown && c.depsComplete {
+		depsKnown = true
+	}
+	currentDeps = cloneDeps(currentDeps)
+	_, locallyMutated := c.beadSeq[patch.ID]
+	localBeadAt := c.localBeadAt[patch.ID]
+	recentlyLocal := recentLocalMutation(localBeadAt, now)
+	_, locallyDeleted := c.deletedSeq[patch.ID]
+	fieldConflictCached := cached && cacheEventConflictsCurrent(current, patch, fields)
+	dependencyConflictCached := cached && cacheEventDependencyConflict(currentDeps, depsKnown, patch, fields)
+	conflictsCached := fieldConflictCached || dependencyConflictCached
+	var conflictBase Bead
+	if conflictsCached {
+		conflictBase = cloneBead(current)
+	}
 	c.mu.RUnlock()
 
+	verifiedConflict := false
+	var verifiedClosedBase Bead
+	verifiedRecentLocal := false
+	var verifiedRecentLocalBase Bead
+	if conflictsCached && eventType == "bead.closed" {
+		matchesBacking, verifyErr := c.cacheClosedEventMatchesBacking(patch.ID)
+		if verifyErr != nil {
+			c.recordProblem(fmt.Sprintf("verify %s event", eventType), verifyErr)
+			// Drop destructive close events on verification failure; reconciliation
+			// can catch up without overwriting a local reopen with a stale close.
+			return
+		}
+		if !matchesBacking {
+			return
+		}
+		verifiedConflict = true
+		verifiedClosedBase = conflictBase
+	}
+	if fieldConflictCached && eventType != "bead.closed" && locallyMutated && !verifiedConflict {
+		return
+	}
+	if dependencyConflictCached && eventType != "bead.closed" && locallyMutated && !verifiedConflict {
+		return
+	}
+	if conflictsCached && recentlyLocal && !verifiedConflict {
+		verifiedRecentLocal = true
+		verifiedRecentLocalBase = conflictBase
+		matchesBacking, verifyErr := c.cacheEventMatchesBacking(patch.ID, patch, fields)
+		if verifyErr == nil && !matchesBacking {
+			return
+		}
+		if verifyErr != nil {
+			c.recordProblem(fmt.Sprintf("verify %s event", eventType), verifyErr)
+		}
+	}
+
 	b := patch
+	refreshedFromBacking := false
 	if !cached {
 		if fresh, err := c.backing.Get(patch.ID); err == nil {
 			b = fresh
+			refreshedFromBacking = true
+		} else if errors.Is(err, ErrNotFound) {
+			if eventType != "bead.created" && locallyDeleted {
+				return
+			}
 		} else if !errors.Is(err, ErrNotFound) {
 			c.recordProblem(fmt.Sprintf("refresh %s event", eventType), err)
 		}
 	}
 
+	if c.applyEventBeforeCommitForTest != nil {
+		c.applyEventBeforeCommitForTest()
+	}
+
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	if c.state != cacheLive {
+	if c.state != cacheLive && c.state != cachePartial {
 		return
 	}
 	if current, ok := c.beads[patch.ID]; ok {
+		currentDeps, depsKnown := c.deps[patch.ID]
+		if !depsKnown && c.depsComplete {
+			depsKnown = true
+		}
+		fieldConflict := cacheEventConflictsCurrent(current, patch, fields)
+		dependencyConflict := cacheEventDependencyConflict(currentDeps, depsKnown, patch, fields)
+		if fieldConflict || dependencyConflict {
+			if eventType == "bead.closed" {
+				if !verifiedConflict || beadChanged(current, verifiedClosedBase) {
+					return
+				}
+			} else {
+				if _, locallyMutated := c.beadSeq[patch.ID]; fieldConflict && locallyMutated {
+					return
+				}
+				if _, locallyMutated := c.beadSeq[patch.ID]; dependencyConflict && locallyMutated {
+					return
+				}
+				if recentLocalMutation(c.localBeadAt[patch.ID], time.Now()) &&
+					(!verifiedRecentLocal || beadChanged(current, verifiedRecentLocalBase)) {
+					return
+				}
+			}
+		}
 		b = mergeCacheEventPatch(current, patch, fields)
 	}
 
@@ -56,6 +146,7 @@ func (c *CachingStore) ApplyEvent(eventType string, payload json.RawMessage) {
 		if _, exists := c.beads[b.ID]; !exists {
 			c.noteMutationLocked(b.ID)
 			c.beads[b.ID] = cloneBead(b)
+			c.updateEventDepsLocked(eventType, b, fields, refreshedFromBacking)
 			delete(c.dirty, b.ID)
 			delete(c.deletedSeq, b.ID)
 		}
@@ -64,6 +155,7 @@ func (c *CachingStore) ApplyEvent(eventType string, payload json.RawMessage) {
 	case "bead.updated":
 		c.noteMutationLocked(b.ID)
 		c.beads[b.ID] = cloneBead(b)
+		c.updateEventDepsLocked(eventType, b, fields, refreshedFromBacking)
 		delete(c.dirty, b.ID)
 		delete(c.deletedSeq, b.ID)
 		mutated = true
@@ -73,6 +165,7 @@ func (c *CachingStore) ApplyEvent(eventType string, payload json.RawMessage) {
 			c.updateStatsLocked()
 		}
 		c.beads[b.ID] = cloneBead(b)
+		c.updateEventDepsLocked(eventType, b, fields, refreshedFromBacking)
 		delete(c.dirty, b.ID)
 		delete(c.deletedSeq, b.ID)
 		mutated = true
@@ -85,12 +178,46 @@ func (c *CachingStore) ApplyEvent(eventType string, payload json.RawMessage) {
 	}
 }
 
-// ApplyDepEvent updates the dep cache for a bead. Call after dep
-// mutations are detected via events or write-through.
+func (c *CachingStore) updateEventDepsLocked(eventType string, b Bead, fields map[string]json.RawMessage, refreshedFromBacking bool) {
+	if hasCacheEventField(fields, "dependencies") || hasCacheEventField(fields, "needs") {
+		c.deps[b.ID] = depsFromBeadFields(b)
+		return
+	}
+	if eventType == "bead.created" && cacheEventLooksComplete(fields) {
+		c.deps[b.ID] = depsFromBeadFields(b)
+		return
+	}
+	if eventType == "bead.updated" && cacheEventLooksComplete(fields) {
+		if refreshedFromBacking {
+			c.deps[b.ID] = depsFromBeadFields(b)
+			return
+		}
+		// bd dependency mutations arrive through the same on_update hook as
+		// field changes, and the hook payload omits dependencies after removals.
+		// Treat the bead's dependency coverage as unknown until the backing
+		// store or reconciliation supplies an explicit dependency snapshot.
+		delete(c.deps, b.ID)
+		c.depsComplete = false
+		return
+	}
+	if _, ok := c.deps[b.ID]; ok {
+		return
+	}
+	if eventType == "bead.updated" && c.depsComplete {
+		c.depsComplete = false
+		c.recordProblemLocked("apply bead.updated event", fmt.Errorf("dependency cache marked complete but missing deps for %s", b.ID))
+		return
+	}
+	c.depsComplete = false
+}
+
+// ApplyDepEvent updates the dep cache for callers that have an authoritative
+// dependency snapshot. bd hook payloads that omit dependency fields still flow
+// through ApplyEvent and fall back to reconciliation.
 func (c *CachingStore) ApplyDepEvent(beadID string, deps []Dep) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	if c.state != cacheLive {
+	if c.state != cacheLive && c.state != cachePartial {
 		return
 	}
 	c.noteMutationLocked(beadID)
@@ -148,14 +275,134 @@ func mergeCacheEventPatch(base, patch Bead, fields map[string]json.RawMessage) B
 	return merged
 }
 
+func cacheEventConflictsCurrent(current, patch Bead, fields map[string]json.RawMessage) bool {
+	if hasCacheEventField(fields, "title") && current.Title != patch.Title {
+		return true
+	}
+	if hasCacheEventField(fields, "status") && current.Status != patch.Status {
+		return true
+	}
+	if (hasCacheEventField(fields, "issue_type") || hasCacheEventField(fields, "type")) && current.Type != patch.Type {
+		return true
+	}
+	if hasCacheEventField(fields, "priority") {
+		if (current.Priority == nil) != (patch.Priority == nil) {
+			return true
+		}
+		if current.Priority != nil && patch.Priority != nil && *current.Priority != *patch.Priority {
+			return true
+		}
+	}
+	if hasCacheEventField(fields, "assignee") && current.Assignee != patch.Assignee {
+		return true
+	}
+	if hasCacheEventField(fields, "description") && current.Description != patch.Description {
+		return true
+	}
+	if hasCacheEventField(fields, "parent") && current.ParentID != patch.ParentID {
+		return true
+	}
+	if hasCacheEventField(fields, "parent_id") && current.ParentID != patch.ParentID {
+		return true
+	}
+	if hasCacheEventField(fields, "metadata") && !maps.Equal(current.Metadata, patch.Metadata) {
+		return true
+	}
+	if hasCacheEventField(fields, "labels") && !slices.Equal(current.Labels, patch.Labels) {
+		return true
+	}
+	return false
+}
+
+func cacheEventConflictsCached(current Bead, currentDeps []Dep, depsKnown bool, patch Bead, fields map[string]json.RawMessage) bool {
+	if cacheEventConflictsCurrent(current, patch, fields) {
+		return true
+	}
+	return cacheEventDependencyConflict(currentDeps, depsKnown, patch, fields)
+}
+
+func cacheEventDependencyConflict(currentDeps []Dep, depsKnown bool, patch Bead, fields map[string]json.RawMessage) bool {
+	return cacheEventHasDependencyField(fields) && depsKnown && depsChanged(currentDeps, depsFromBeadFields(patch))
+}
+
+func (c *CachingStore) cacheEventMatchesBacking(id string, patch Bead, fields map[string]json.RawMessage) (bool, error) {
+	fresh, err := c.backing.Get(id)
+	if err != nil {
+		return false, err
+	}
+	return cacheEventPatchMatchesBead(fresh, patch, fields), nil
+}
+
+func (c *CachingStore) cacheClosedEventMatchesBacking(id string) (bool, error) {
+	fresh, err := c.backing.Get(id)
+	if err != nil {
+		return false, err
+	}
+	return fresh.Status == "closed", nil
+}
+
+func cacheEventPatchMatchesBead(current, patch Bead, fields map[string]json.RawMessage) bool {
+	return !cacheEventConflictsCached(current, depsFromBeadFields(current), true, patch, fields)
+}
+
+func recentLocalMutation(mutatedAt time.Time, now time.Time) bool {
+	return !mutatedAt.IsZero() && now.Sub(mutatedAt) <= 5*time.Second
+}
+
+func (c *CachingStore) recentLocalBeadConflictLocked(id string, fresh Bead, now time.Time) (Bead, bool) {
+	current, ok := c.beads[id]
+	if !ok {
+		return Bead{}, false
+	}
+	if !recentLocalMutation(c.localBeadAt[id], now) {
+		return Bead{}, false
+	}
+	if !beadChanged(current, fresh) {
+		return Bead{}, false
+	}
+	return cloneBead(current), true
+}
+
+func (c *CachingStore) carryRecentLocalMutationLocked(id string, nextDirty map[string]struct{}, nextBeadSeq map[string]uint64, nextLocalBeadAt map[string]time.Time) {
+	if _, dirty := c.dirty[id]; dirty {
+		nextDirty[id] = struct{}{}
+	}
+	if seq, ok := c.beadSeq[id]; ok {
+		nextBeadSeq[id] = seq
+	}
+	if mutatedAt, ok := c.localBeadAt[id]; ok {
+		nextLocalBeadAt[id] = mutatedAt
+	}
+}
+
 func hasCacheEventField(fields map[string]json.RawMessage, name string) bool {
 	_, ok := fields[name]
 	return ok
 }
 
+func cacheEventHasDependencyField(fields map[string]json.RawMessage) bool {
+	return hasCacheEventField(fields, "dependencies") || hasCacheEventField(fields, "needs")
+}
+
+func cacheEventLooksComplete(fields map[string]json.RawMessage) bool {
+	return hasCacheEventField(fields, "title") &&
+		hasCacheEventField(fields, "status") &&
+		hasCacheEventField(fields, "created_at") &&
+		(hasCacheEventField(fields, "issue_type") || hasCacheEventField(fields, "type"))
+}
+
 func decodeCacheEvent(payload json.RawMessage) (Bead, map[string]json.RawMessage, error) {
+	eventPayload := payload
+	var envelope map[string]json.RawMessage
+	if err := json.Unmarshal(payload, &envelope); err != nil {
+		return Bead{}, nil, err
+	}
+	if beadPayload, ok := envelope["bead"]; ok {
+		eventPayload = beadPayload
+	}
+
 	var fields map[string]json.RawMessage
-	if err := json.Unmarshal(payload, &fields); err != nil {
+	if err := json.Unmarshal(eventPayload, &fields); err != nil {
 		return Bead{}, nil, err
 	}
 	var wire struct {
@@ -163,7 +410,7 @@ func decodeCacheEvent(payload json.RawMessage) (Bead, map[string]json.RawMessage
 		Metadata   StringMap `json:"metadata,omitempty"`
 		TypeCompat string    `json:"type,omitempty"`
 	}
-	if err := json.Unmarshal(payload, &wire); err != nil {
+	if err := json.Unmarshal(eventPayload, &wire); err != nil {
 		return Bead{}, nil, err
 	}
 	b := wire.Bead
diff --git a/internal/beads/caching_store_internal_test.go b/internal/beads/caching_store_internal_test.go
index 30b47bc771..78a138b07d 100644
--- a/internal/beads/caching_store_internal_test.go
+++ b/internal/beads/caching_store_internal_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -103,6 +104,221 @@ func TestCachingStoreListLiveBypassesCache(t *testing.T) {
 	}
 }
 
+func TestCachingStoreApplyEventRecordsBackingVerificationErrorAndAppliesUpdate(t *testing.T) {
+	t.Parallel()
+
+	backing := &cacheEventVerificationFailStore{Store: NewMemStore()}
+	bead, err := backing.Create(Bead{Title: "original"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	localTitle := "local"
+	if err := cache.Update(bead.ID, UpdateOpts{Title: &localTitle}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	cache.mu.Lock()
+	delete(cache.beadSeq, bead.ID)
+	cache.mu.Unlock()
+	backing.failNextGet = true
+
+	cache.ApplyEvent("bead.updated", json.RawMessage(`{"id":"`+bead.ID+`","title":"external"}`))
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Title != "external" {
+		t.Fatalf("Title after verification error = %q, want external", got.Title)
+	}
+	stats := cache.Stats()
+	if stats.ProblemCount == 0 {
+		t.Fatal("ProblemCount = 0, want verification error recorded")
+	}
+	if !strings.Contains(stats.LastProblem, "verify bead.updated event") {
+		t.Fatalf("LastProblem = %q, want verify bead.updated event", stats.LastProblem)
+	}
+}
+
+func TestCachingStoreIgnoresStaleClosedEventAfterLocalReopenBeyondRecentWindow(t *testing.T) {
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{Title: "reopen me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := backing.Close(bead.ID); err != nil {
+		t.Fatalf("Close backing: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cache.Reopen(bead.ID); err != nil {
+		t.Fatalf("Reopen: %v", err)
+	}
+
+	cache.mu.Lock()
+	cache.localBeadAt[bead.ID] = time.Now().Add(-10 * time.Second)
+	cache.mu.Unlock()
+
+	cache.ApplyEvent("bead.closed", json.RawMessage(`{"id":"`+bead.ID+`","status":"closed"}`))
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("Status after stale closed event = %q, want open", got.Status)
+	}
+}
+
+func TestCachingStoreIgnoresStaleClosedEventAfterLocalReopenAndLiveRefresh(t *testing.T) {
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{Title: "reopen me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := backing.Close(bead.ID); err != nil {
+		t.Fatalf("Close backing: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cache.Reopen(bead.ID); err != nil {
+		t.Fatalf("Reopen: %v", err)
+	}
+
+	cache.mu.Lock()
+	cache.localBeadAt[bead.ID] = time.Now().Add(-10 * time.Second)
+	cache.mu.Unlock()
+	if got, err := cache.List(ListQuery{Status: "open", Live: true}); err != nil {
+		t.Fatalf("Live List: %v", err)
+	} else if len(got) != 1 || got[0].ID != bead.ID {
+		t.Fatalf("Live List = %+v, want reopened bead %s", got, bead.ID)
+	}
+	cache.mu.RLock()
+	_, locallyMutated := cache.beadSeq[bead.ID]
+	recentlyLocal := recentLocalMutation(cache.localBeadAt[bead.ID], time.Now())
+	cache.mu.RUnlock()
+	if locallyMutated || recentlyLocal {
+		t.Fatalf("local markers after live refresh: locallyMutated=%v recentlyLocal=%v, want both false", locallyMutated, recentlyLocal)
+	}
+
+	cache.ApplyEvent("bead.closed", json.RawMessage(`{"id":"`+bead.ID+`","status":"closed"}`))
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("Status after stale closed event = %q, want open", got.Status)
+	}
+}
+
+func TestCachingStoreClosedEventRechecksLocalReopenBeforeCommit(t *testing.T) {
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{Title: "reopen me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := backing.Close(bead.ID); err != nil {
+		t.Fatalf("Close backing: %v", err)
+	}
+	payload := json.RawMessage(`{"id":"` + bead.ID + `","status":"closed"}`)
+	cache.ApplyEvent("bead.closed", payload)
+
+	beforeCommit := make(chan struct{})
+	releaseCommit := make(chan struct{})
+	cache.applyEventBeforeCommitForTest = func() {
+		close(beforeCommit)
+		<-releaseCommit
+	}
+
+	done := make(chan struct{})
+	go func() {
+		cache.ApplyEvent("bead.closed", payload)
+		close(done)
+	}()
+
+	<-beforeCommit
+	if err := cache.Reopen(bead.ID); err != nil {
+		t.Fatalf("Reopen: %v", err)
+	}
+	close(releaseCommit)
+	<-done
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("Status after stale closed event race = %q, want open", got.Status)
+	}
+}
+
+func TestCachingStoreRecordsClosedEventVerificationErrorAndPreservesLocalReopen(t *testing.T) {
+	backing := &cacheEventVerificationFailStore{Store: NewMemStore()}
+	bead, err := backing.Create(Bead{Title: "reopen me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := backing.Close(bead.ID); err != nil {
+		t.Fatalf("Close backing: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cache.Reopen(bead.ID); err != nil {
+		t.Fatalf("Reopen: %v", err)
+	}
+	backing.failNextGet = true
+
+	cache.ApplyEvent("bead.closed", json.RawMessage(`{"id":"`+bead.ID+`","status":"closed"}`))
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("Status after verification error = %q, want open", got.Status)
+	}
+	stats := cache.Stats()
+	if stats.ProblemCount == 0 {
+		t.Fatal("ProblemCount = 0, want verification error recorded")
+	}
+	if !strings.Contains(stats.LastProblem, "verify bead.closed event") {
+		t.Fatalf("LastProblem = %q, want verify bead.closed event", stats.LastProblem)
+	}
+}
+
+type cacheEventVerificationFailStore struct {
+	Store
+	failNextGet bool
+}
+
+func (s *cacheEventVerificationFailStore) Get(id string) (Bead, error) {
+	if s.failNextGet {
+		s.failNextGet = false
+		return Bead{}, errors.New("backing verification failed")
+	}
+	return s.Store.Get(id)
+}
+
 func TestCachingStoreRunReconciliationDetectsPriorityChanges(t *testing.T) {
 	t.Parallel()
 
@@ -345,59 +561,585 @@ func TestCachingStoreDepListUpFallsThroughToBackingTruth(t *testing.T) {
 	}
 }
 
-func TestCachingStoreApplyEventRecordsProblemOnMalformedPayload(t *testing.T) {
+func TestCachingStoreApplyEventRecordsProblemOnMalformedPayload(t *testing.T) {
+	t.Parallel()
+
+	cache := NewCachingStoreForTest(NewMemStore(), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	cache.ApplyEvent("bead.updated", []byte(`{`))
+
+	stats := cache.Stats()
+	if stats.ProblemCount != 1 {
+		t.Fatalf("ProblemCount = %d, want 1", stats.ProblemCount)
+	}
+	if !strings.Contains(stats.LastProblem, "apply bead.updated event") {
+		t.Fatalf("LastProblem = %q, want apply-event context", stats.LastProblem)
+	}
+	if stats.LastProblemAt.IsZero() {
+		t.Fatal("LastProblemAt should be set")
+	}
+}
+
+func TestCachingStoreSparseUpdatedEventFallsBackWhenCompleteCoverageIsMissingDeps(t *testing.T) {
+	t.Parallel()
+
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{Title: "target"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.mu.Lock()
+	delete(cache.deps, bead.ID)
+	cache.depsComplete = true
+	cache.mu.Unlock()
+
+	cache.ApplyEvent("bead.updated", json.RawMessage(`{"id":"`+bead.ID+`","title":"target"}`))
+
+	cache.mu.RLock()
+	depsComplete := cache.depsComplete
+	lastProblem := cache.stats.LastProblem
+	cache.mu.RUnlock()
+	if depsComplete {
+		t.Fatal("depsComplete = true, want incomplete coverage after missing deps invariant break")
+	}
+	if !strings.Contains(lastProblem, "missing deps for "+bead.ID) {
+		t.Fatalf("LastProblem = %q, want missing deps diagnostic for %s", lastProblem, bead.ID)
+	}
+	if _, ok := cache.CachedReady(); ok {
+		t.Fatal("CachedReady answered from cache after dependency coverage became incomplete")
+	}
+}
+
+func TestCachingStoreApplyEventRechecksLocalMutationBeforeCommit(t *testing.T) {
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{
+		Title:    "mail",
+		Type:     "message",
+		Labels:   []string{"thread:abc"},
+		Metadata: map[string]string{"mail.read": "false"},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cache.Update(bead.ID, UpdateOpts{
+		Labels:   []string{"read"},
+		Metadata: map[string]string{"mail.read": "true"},
+	}); err != nil {
+		t.Fatalf("Mark read update: %v", err)
+	}
+	staleRead, err := backing.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get stale read payload: %v", err)
+	}
+	payload, err := json.Marshal(staleRead)
+	if err != nil {
+		t.Fatalf("Marshal stale read payload: %v", err)
+	}
+
+	beforeCommit := make(chan struct{})
+	releaseCommit := make(chan struct{})
+	cache.applyEventBeforeCommitForTest = func() {
+		close(beforeCommit)
+		<-releaseCommit
+	}
+
+	done := make(chan struct{})
+	go func() {
+		cache.ApplyEvent("bead.updated", payload)
+		close(done)
+	}()
+
+	<-beforeCommit
+	if err := cache.Update(bead.ID, UpdateOpts{
+		RemoveLabels: []string{"read"},
+		Metadata:     map[string]string{"mail.read": "false"},
+	}); err != nil {
+		t.Fatalf("Mark unread update: %v", err)
+	}
+	close(releaseCommit)
+	<-done
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get after stale event race: %v", err)
+	}
+	for _, label := range got.Labels {
+		if label == "read" {
+			t.Fatalf("labels after stale event race = %#v, want read removed", got.Labels)
+		}
+	}
+	if got.Metadata["mail.read"] != "false" {
+		t.Fatalf("mail.read after stale event race = %q, want false; metadata=%v", got.Metadata["mail.read"], got.Metadata)
+	}
+}
+
+func TestCachingStoreApplyEventRechecksRecentLocalAfterGetRefresh(t *testing.T) {
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{Title: "base"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	localTitle := "local"
+	if err := cache.Update(bead.ID, UpdateOpts{Title: &localTitle}); err != nil {
+		t.Fatalf("Update local title: %v", err)
+	}
+	cache.mu.Lock()
+	cache.dirty[bead.ID] = struct{}{}
+	cache.mu.Unlock()
+	if _, err := cache.Get(bead.ID); err != nil {
+		t.Fatalf("Get refresh after local update: %v", err)
+	}
+
+	cache.mu.RLock()
+	_, locallyMutated := cache.beadSeq[bead.ID]
+	recentlyLocal := recentLocalMutation(cache.localBeadAt[bead.ID], time.Now())
+	cache.mu.RUnlock()
+	if locallyMutated || !recentlyLocal {
+		t.Fatalf("markers after Get refresh: locallyMutated=%v recentlyLocal=%v, want false/true", locallyMutated, recentlyLocal)
+	}
+
+	externalTitle := "external"
+	if err := backing.Update(bead.ID, UpdateOpts{Title: &externalTitle}); err != nil {
+		t.Fatalf("Update backing external title: %v", err)
+	}
+	payload := json.RawMessage(fmt.Sprintf(`{"id":%q,"title":%q}`, bead.ID, externalTitle))
+
+	beforeCommit := make(chan struct{})
+	releaseCommit := make(chan struct{})
+	cache.applyEventBeforeCommitForTest = func() {
+		close(beforeCommit)
+		<-releaseCommit
+	}
+
+	done := make(chan struct{})
+	go func() {
+		cache.ApplyEvent("bead.updated", payload)
+		close(done)
+	}()
+
+	<-beforeCommit
+	newerTitle := "newer local cache"
+	if err := backing.Update(bead.ID, UpdateOpts{Title: &newerTitle}); err != nil {
+		t.Fatalf("Update backing newer title: %v", err)
+	}
+	cache.mu.Lock()
+	cache.dirty[bead.ID] = struct{}{}
+	cache.mu.Unlock()
+	if _, err := cache.Get(bead.ID); err != nil {
+		t.Fatalf("Get refresh before event commit: %v", err)
+	}
+	close(releaseCommit)
+	<-done
+
+	got, err := cache.Get(bead.ID)
+	if err != nil {
+		t.Fatalf("Get after stale event race: %v", err)
+	}
+	if got.Title != newerTitle {
+		t.Fatalf("Title after stale event race = %q, want %q", got.Title, newerTitle)
+	}
+}
+
+func TestCachingStoreRunReconciliationRecordsProblemAndDegrades(t *testing.T) {
+	t.Parallel()
+
+	backing := &listFailingStore{Store: NewMemStore()}
+	if _, err := backing.Create(Bead{Title: "Task"}); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	backing.failList = true
+	for i := 0; i < maxCacheSyncFailures; i++ {
+		cache.runReconciliation()
+	}
+
+	if cache.state != cacheDegraded {
+		t.Fatalf("state = %v, want degraded", cache.state)
+	}
+
+	stats := cache.Stats()
+	if stats.SyncFailures != maxCacheSyncFailures {
+		t.Fatalf("SyncFailures = %d, want %d", stats.SyncFailures, maxCacheSyncFailures)
+	}
+	if stats.ProblemCount != int64(maxCacheSyncFailures) {
+		t.Fatalf("ProblemCount = %d, want %d", stats.ProblemCount, maxCacheSyncFailures)
+	}
+	if !strings.Contains(stats.LastProblem, "reconcile cache") {
+		t.Fatalf("LastProblem = %q, want reconcile context", stats.LastProblem)
+	}
+}
+
+func TestCachingStorePrimeActiveUsesPartialResultRows(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{
+		Store:           NewMemStore(),
+		partialStatuses: map[string]bool{"open": true},
+	}
+	open, err := backing.Create(Bead{Title: "open survivor"})
+	if err != nil {
+		t.Fatalf("Create(open): %v", err)
+	}
+	inProgress, err := backing.Create(Bead{Title: "in progress survivor"})
+	if err != nil {
+		t.Fatalf("Create(in_progress): %v", err)
+	}
+	status := "in_progress"
+	if err := backing.Update(inProgress.ID, UpdateOpts{Status: &status}); err != nil {
+		t.Fatalf("Update(in_progress): %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.mu.RLock()
+	_, hasOpen := cache.beads[open.ID]
+	_, hasInProgress := cache.beads[inProgress.ID]
+	cache.mu.RUnlock()
+	if !hasOpen || !hasInProgress {
+		t.Fatalf("cache.beads has open=%v in_progress=%v, want both partial rows retained", hasOpen, hasInProgress)
+	}
+	stats := cache.Stats()
+	if stats.ProblemCount != 1 {
+		t.Fatalf("ProblemCount = %d, want 1", stats.ProblemCount)
+	}
+	if !strings.Contains(stats.LastProblem, "prime active (open)") {
+		t.Fatalf("LastProblem = %q, want prime active context", stats.LastProblem)
+	}
+	if cache.state != cachePartial {
+		t.Fatalf("state = %v, want cachePartial", cache.state)
+	}
+}
+
+func TestCachingStorePrimeUsesPartialResultRows(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{
+		Store:            NewMemStore(),
+		partialAllowScan: true,
+	}
+	survivor, err := backing.Create(Bead{Title: "prime survivor"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	cache.mu.RLock()
+	_, hasSurvivor := cache.beads[survivor.ID]
+	cache.mu.RUnlock()
+	if !hasSurvivor {
+		t.Fatalf("cache.beads missing partial survivor %s", survivor.ID)
+	}
+	stats := cache.Stats()
+	if stats.ProblemCount != 1 {
+		t.Fatalf("ProblemCount = %d, want 1", stats.ProblemCount)
+	}
+	if !strings.Contains(stats.LastProblem, "prime cache") {
+		t.Fatalf("LastProblem = %q, want prime cache context", stats.LastProblem)
+	}
+	if cache.state != cacheLive {
+		t.Fatalf("state = %v, want cacheLive", cache.state)
+	}
+}
+
+func TestCachingStoreCachedListRejectsPartialPrime(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{
+		Store:            NewMemStore(),
+		partialAllowScan: true,
+	}
+	survivor, err := backing.Create(Bead{Title: "survives partial prime"})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	if _, err := backing.Create(Bead{Title: "dropped by bd parse"}); err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	backing.partialRows = []Bead{survivor}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	items, ok := cache.CachedList(ListQuery{AllowScan: true})
+	if ok {
+		t.Fatalf("CachedList ok = true with items %+v, want ok=false while primePartialErr is set", items)
+	}
+}
+
+func TestCachingStorePrimePartialDoesNotServeActiveListAsComplete(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{
+		Store:            NewMemStore(),
+		partialAllowScan: true,
+	}
+	survivor, err := backing.Create(Bead{Title: "survives partial prime"})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	dropped, err := backing.Create(Bead{Title: "dropped by bd parse"})
+	if err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	backing.partialRows = []Bead{survivor}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	items, err := cache.List(ListQuery{AllowScan: true})
+	var partial *PartialResultError
+	if !errors.As(err, &partial) {
+		t.Fatalf("List() error = %v, want *PartialResultError after partial prime", err)
+	}
+	if hasBead(items, dropped.ID) {
+		t.Fatalf("List() returned dropped bead %s despite backing partial rows: %+v", dropped.ID, items)
+	}
+	if !hasBead(items, survivor.ID) {
+		t.Fatalf("List() = %+v, want partial survivor %s", items, survivor.ID)
+	}
+}
+
+func TestCachingStorePrimeActivePartialFallsBackForActiveList(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{
+		Store:           NewMemStore(),
+		partialStatuses: map[string]bool{"open": true},
+	}
+	survivor, err := backing.Create(Bead{Title: "survives partial active prime"})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	dropped, err := backing.Create(Bead{Title: "dropped from primed status"})
+	if err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	backing.partialRows = []Bead{survivor}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	items, err := cache.List(ListQuery{AllowScan: true})
+	if err != nil {
+		t.Fatalf("List() error = %v, want clean backing fallback", err)
+	}
+	if !hasBead(items, survivor.ID) || !hasBead(items, dropped.ID) {
+		t.Fatalf("List() = %+v, want backing fallback to return survivor %s and dropped %s", items, survivor.ID, dropped.ID)
+	}
+}
+
+func TestCachingStoreReadyFallsBackAfterPartialPrime(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{
+		Store:            NewMemStore(),
+		partialAllowScan: true,
+	}
+	survivor, err := backing.Create(Bead{Title: "survives partial prime"})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	dropped, err := backing.Create(Bead{Title: "dropped by bd parse"})
+	if err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	backing.partialRows = []Bead{survivor}
+
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	items, err := cache.Ready()
+	if err != nil {
+		t.Fatalf("Ready() error = %v, want backing fallback success", err)
+	}
+	if !hasBead(items, survivor.ID) || !hasBead(items, dropped.ID) {
+		t.Fatalf("Ready() = %+v, want backing fallback to include survivor %s and dropped %s", items, survivor.ID, dropped.ID)
+	}
+}
+
+func TestCachingStoreRunReconciliationDoesNotTreatPartialResultAsAuthoritative(t *testing.T) {
+	t.Parallel()
+
+	backing := &partialListErrorStore{Store: NewMemStore()}
+	survivor, err := backing.Create(Bead{Title: "survives partial list"})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	dropped, err := backing.Create(Bead{Title: "dropped by bd parse"})
+	if err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	backing.partialAllowScan = true
+	claimedStatus := "in_progress"
+	if err := backing.Update(survivor.ID, UpdateOpts{Status: &claimedStatus}); err != nil {
+		t.Fatalf("Update(survivor): %v", err)
+	}
+	updatedSurvivor, err := backing.Get(survivor.ID)
+	if err != nil {
+		t.Fatalf("Get(updated survivor): %v", err)
+	}
+	backing.partialRows = []Bead{updatedSurvivor}
+	cache.runReconciliation()
+	for i := 1; i < maxCacheSyncFailures; i++ {
+		cache.runReconciliation()
+	}
+
+	for _, event := range events {
+		if event == "bead.closed:"+dropped.ID {
+			t.Fatalf("partial reconcile emitted synthetic close for dropped row: %v", events)
+		}
+		if event == "bead.updated:"+survivor.ID {
+			t.Fatalf("partial reconcile emitted update for survivor row: %v", events)
+		}
+	}
+	cache.mu.RLock()
+	_, stillCached := cache.beads[dropped.ID]
+	cachedSurvivor := cache.beads[survivor.ID]
+	state := cache.state
+	syncFailures := cache.syncFailures
+	cache.mu.RUnlock()
+	if !stillCached {
+		t.Fatalf("dropped row %s was evicted from cache after partial reconcile", dropped.ID)
+	}
+	if cachedSurvivor.Status == claimedStatus {
+		t.Fatalf("survivor status = %q, want partial reconcile to leave cached status non-authoritative", cachedSurvivor.Status)
+	}
+	if state != cacheDegraded {
+		t.Fatalf("state = %v, want cacheDegraded after repeated partial list failures", state)
+	}
+	if syncFailures != maxCacheSyncFailures {
+		t.Fatalf("syncFailures = %d, want %d", syncFailures, maxCacheSyncFailures)
+	}
+	stats := cache.Stats()
+	if stats.ProblemCount != int64(maxCacheSyncFailures) {
+		t.Fatalf("ProblemCount = %d, want %d", stats.ProblemCount, maxCacheSyncFailures)
+	}
+}
+
+func TestCachingStoreRunReconciliationDegradesImmediatelyOnPartialResult(t *testing.T) {
 	t.Parallel()
 
-	cache := NewCachingStoreForTest(NewMemStore(), nil)
+	backing := &readyCountingPartialListStore{
+		partialListErrorStore: &partialListErrorStore{
+			Store:           NewMemStore(),
+			partialStatuses: map[string]bool{"open": true},
+		},
+	}
+	survivor, err := backing.Create(Bead{Title: "survives partial list"})
+	if err != nil {
+		t.Fatalf("Create(survivor): %v", err)
+	}
+	if _, err := backing.Create(Bead{Title: "dropped by bd parse"}); err != nil {
+		t.Fatalf("Create(dropped): %v", err)
+	}
+	cache := NewCachingStoreForTest(backing, nil)
 	if err := cache.Prime(context.Background()); err != nil {
 		t.Fatalf("Prime: %v", err)
 	}
 
-	cache.ApplyEvent("bead.updated", []byte(`{`))
+	backing.partialAllowScan = true
+	backing.partialRows = []Bead{survivor}
+	cache.runReconciliation()
 
-	stats := cache.Stats()
-	if stats.ProblemCount != 1 {
-		t.Fatalf("ProblemCount = %d, want 1", stats.ProblemCount)
+	cache.mu.RLock()
+	state := cache.state
+	cache.mu.RUnlock()
+	if state != cacheDegraded {
+		t.Fatalf("state = %v, want cacheDegraded after one partial reconcile", state)
 	}
-	if !strings.Contains(stats.LastProblem, "apply bead.updated event") {
-		t.Fatalf("LastProblem = %q, want apply-event context", stats.LastProblem)
+	items, err := cache.List(ListQuery{Status: "open"})
+	if !IsPartialResult(err) {
+		t.Fatalf("List() error = %v, want PartialResultError", err)
 	}
-	if stats.LastProblemAt.IsZero() {
-		t.Fatal("LastProblemAt should be set")
+	if !hasBead(items, survivor.ID) {
+		t.Fatalf("List() = %+v, want survivor %s from backing fallback", items, survivor.ID)
+	}
+	if cached, ok := cache.CachedList(ListQuery{Status: "open"}); ok {
+		t.Fatalf("CachedList() = %+v, true; want unavailable after partial reconcile", cached)
+	}
+	readyCalls := backing.readyCalls
+	if _, err := cache.Ready(); err != nil {
+		t.Fatalf("Ready(): %v", err)
+	}
+	if backing.readyCalls == readyCalls {
+		t.Fatalf("Ready() did not fall back to backing store after partial reconcile")
 	}
 }
 
-func TestCachingStoreRunReconciliationRecordsProblemAndDegrades(t *testing.T) {
+func TestCachingStoreRunReconciliationDegradesPartialCache(t *testing.T) {
 	t.Parallel()
 
-	backing := &listFailingStore{Store: NewMemStore()}
-	if _, err := backing.Create(Bead{Title: "Task"}); err != nil {
+	backing := &partialListErrorStore{Store: NewMemStore()}
+	if _, err := backing.Create(Bead{Title: "active bead"}); err != nil {
 		t.Fatalf("Create: %v", err)
 	}
-
 	cache := NewCachingStoreForTest(backing, nil)
-	if err := cache.Prime(context.Background()); err != nil {
-		t.Fatalf("Prime: %v", err)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
 	}
 
-	backing.failList = true
+	backing.partialAllowScan = true
 	for i := 0; i < maxCacheSyncFailures; i++ {
 		cache.runReconciliation()
 	}
 
-	if cache.state != cacheDegraded {
-		t.Fatalf("state = %v, want degraded", cache.state)
-	}
-
-	stats := cache.Stats()
-	if stats.SyncFailures != maxCacheSyncFailures {
-		t.Fatalf("SyncFailures = %d, want %d", stats.SyncFailures, maxCacheSyncFailures)
+	cache.mu.RLock()
+	state := cache.state
+	syncFailures := cache.syncFailures
+	cache.mu.RUnlock()
+	if state != cacheDegraded {
+		t.Fatalf("state = %v, want cacheDegraded after repeated partial reconcile failures from cachePartial", state)
 	}
-	if stats.ProblemCount != int64(maxCacheSyncFailures) {
-		t.Fatalf("ProblemCount = %d, want %d", stats.ProblemCount, maxCacheSyncFailures)
-	}
-	if !strings.Contains(stats.LastProblem, "reconcile cache") {
-		t.Fatalf("LastProblem = %q, want reconcile context", stats.LastProblem)
+	if syncFailures != maxCacheSyncFailures {
+		t.Fatalf("syncFailures = %d, want %d", syncFailures, maxCacheSyncFailures)
 	}
 }
 
@@ -598,6 +1340,37 @@ func TestCachingStoreCloseAllMarksRefreshFailuresDirty(t *testing.T) {
 	}
 }
 
+func TestCachingStoreCachedListReturnsSnapshotWithDirtyEntries(t *testing.T) {
+	t.Parallel()
+
+	backing := &refreshFailingStore{Store: NewMemStore()}
+	bead, err := backing.Create(Bead{Title: "active work"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cache := NewCachingStoreForTest(backing, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	title := "updated while refresh fails"
+	backing.failNextGet = true
+	if err := cache.Update(bead.ID, UpdateOpts{Title: &title}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	rows, ok := cache.CachedList(ListQuery{Status: "open"})
+	if !ok {
+		t.Fatal("CachedList returned ok=false for dirty cache, want snapshot")
+	}
+	if len(rows) != 1 || rows[0].ID != bead.ID {
+		t.Fatalf("CachedList = %#v, want dirty snapshot row %s", rows, bead.ID)
+	}
+	if rows[0].Title == title {
+		t.Fatalf("CachedList returned refreshed title %q; test setup did not create a dirty stale snapshot", rows[0].Title)
+	}
+}
+
 type refreshFailingStore struct {
 	Store
 	failNextGet bool
@@ -623,6 +1396,52 @@ func (s *listFailingStore) List(query ListQuery) ([]Bead, error) {
 	return s.Store.List(query)
 }
 
+type partialListErrorStore struct {
+	Store
+	partialStatuses  map[string]bool
+	partialAllowScan bool
+	partialRows      []Bead
+}
+
+func (s *partialListErrorStore) List(query ListQuery) ([]Bead, error) {
+	items, err := s.Store.List(query)
+	if err != nil {
+		return nil, err
+	}
+	if s.partialStatuses[query.Status] || (s.partialAllowScan && query.AllowScan) {
+		if s.partialRows != nil {
+			items = make([]Bead, len(s.partialRows))
+			for i := range s.partialRows {
+				items[i] = cloneBead(s.partialRows[i])
+			}
+		}
+		return items, &PartialResultError{
+			Op:  "bd list",
+			Err: errors.New("skipped 1 corrupt bead"),
+		}
+	}
+	return items, nil
+}
+
+type readyCountingPartialListStore struct {
+	*partialListErrorStore
+	readyCalls int
+}
+
+func (s *readyCountingPartialListStore) Ready(query ...ReadyQuery) ([]Bead, error) {
+	s.readyCalls++
+	return s.partialListErrorStore.Ready(query...)
+}
+
+func hasBead(items []Bead, id string) bool {
+	for _, item := range items {
+		if item.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
 type partialCloseAllStore struct {
 	Store
 }
@@ -702,3 +1521,433 @@ func (s *closeAllRefreshFailingStore) List(query ListQuery) ([]Bead, error) {
 	s.listCalls++
 	return s.Store.List(query)
 }
+
+// Reconciliation must not re-emit bead.closed for a cache entry whose status
+// is already "closed". When ApplyEvent ingests an external bead.closed event
+// (from the bus), it stores the closed bead in c.beads. List({AllowScan:true})
+// filters out closed beads, so the next reconcile sees the entry as missing
+// from the fresh DB read and would re-emit a duplicate close notification.
+// Routed back through the event bus, that notification re-applies into every
+// caching store and reconciles into another spurious close — the storm.
+func TestCachingStoreRunReconciliationDoesNotEmitBeadClosedForAlreadyClosedCacheEntry(t *testing.T) {
+	t.Parallel()
+
+	backing := NewMemStore()
+	bead, err := backing.Create(Bead{Title: "task"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	// External writer closes the bead in the backing store, then the close
+	// event is delivered through the bus and applied to this cache.
+	if err := backing.Close(bead.ID); err != nil {
+		t.Fatalf("backing Close: %v", err)
+	}
+	closed := bead
+	closed.Status = "closed"
+	payload, err := json.Marshal(closed)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	cache.ApplyEvent("bead.closed", payload)
+	events = nil // ignore notifications from prime/apply; only assert on reconcile output
+
+	cache.runReconciliation()
+
+	for _, e := range events {
+		if e == "bead.closed:"+bead.ID {
+			t.Fatalf("reconciler emitted duplicate bead.closed for an already-closed cache entry; events=%v", events)
+		}
+	}
+}
+
+func TestCachingStoreBdPrimeAndReconcileSkipFullDepScan(t *testing.T) {
+	t.Parallel()
+
+	var depListCalls int
+	var readyCalls int
+	issueJSON := []byte(`[{
+		"id":"bd-1",
+		"title":"task",
+		"status":"open",
+		"issue_type":"task",
+		"created_at":"2026-01-01T00:00:00Z",
+		"labels":["task"],
+		"metadata":{}
+	}]`)
+	runner := func(_, name string, args ...string) ([]byte, error) {
+		if name != "bd" {
+			t.Fatalf("command name = %q, want bd", name)
+		}
+		if len(args) > 0 && args[0] == "dep" {
+			depListCalls++
+			t.Fatalf("unexpected dep scan command: %v", args)
+		}
+		if len(args) > 0 && args[0] == "ready" {
+			readyCalls++
+			return issueJSON, nil
+		}
+		if len(args) > 0 && args[0] == "list" {
+			return issueJSON, nil
+		}
+		return []byte(`[]`), nil
+	}
+	cache := NewCachingStore(NewBdStore("/city", runner), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	cache.runReconciliation()
+	if depListCalls != 0 {
+		t.Fatalf("dep list calls = %d, want 0", depListCalls)
+	}
+	if _, err := cache.Ready(); err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	if readyCalls != 1 {
+		t.Fatalf("Ready calls = %d, want backing Ready fallback when deps are incomplete", readyCalls)
+	}
+}
+
+func TestCachingStoreBdPrimeActiveUsesListDependenciesForCachedReady(t *testing.T) {
+	t.Parallel()
+
+	var depListCalls int
+	runner := func(_, name string, args ...string) ([]byte, error) {
+		if name != "bd" {
+			t.Fatalf("command name = %q, want bd", name)
+		}
+		if len(args) > 0 && args[0] == "dep" {
+			depListCalls++
+			t.Fatalf("unexpected dep scan command: %v", args)
+		}
+		if len(args) > 0 && args[0] == "list" {
+			argLine := strings.Join(args, " ")
+			if strings.Contains(argLine, "--status=open") {
+				return []byte(`[
+					{"id":"bd-blocker","title":"blocker","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z","labels":["task"],"metadata":{}},
+					{"id":"bd-blocked","title":"blocked","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:01Z","labels":["task"],"metadata":{},"dependencies":[{"issue_id":"bd-blocked","depends_on_id":"bd-blocker","type":"blocks"}]}
+				]`), nil
+			}
+			if strings.Contains(argLine, "--status=in_progress") {
+				return []byte(`[]`), nil
+			}
+		}
+		return []byte(`[]`), nil
+	}
+	cache := NewCachingStoreForTest(NewBdStore("/city", runner), nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
+	}
+	ids := map[string]bool{}
+	for _, b := range ready {
+		ids[b.ID] = true
+	}
+	if !ids["bd-blocker"] || ids["bd-blocked"] {
+		t.Fatalf("CachedReady ids = %v, want blocker ready and blocked excluded", ids)
+	}
+	if depListCalls != 0 {
+		t.Fatalf("dep list calls = %d, want 0", depListCalls)
+	}
+}
+
+func TestCachingStoreBdReconcileRefreshesListDependenciesForCachedReady(t *testing.T) {
+	t.Parallel()
+
+	runner := newCachingStoreBdDepRunner(t)
+	cache := NewCachingStore(NewBdStore("/city", runner.run), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	assertCachedReadyContains := func(wantReady bool) {
+		t.Helper()
+		ready, ok := cache.CachedReady()
+		if !ok {
+			t.Fatal("CachedReady reported cache unavailable")
+		}
+		readyByID := make(map[string]bool, len(ready))
+		for _, bead := range ready {
+			readyByID[bead.ID] = true
+		}
+		if readyByID["bd-1"] != wantReady {
+			t.Fatalf("CachedReady includes bd-1 = %v, want %v; ready=%v", readyByID["bd-1"], wantReady, readyByID)
+		}
+	}
+
+	assertCachedReadyContains(true)
+
+	runner.deps["bd-1"] = []Dep{{IssueID: "bd-1", DependsOnID: "bd-2", Type: "blocks"}}
+	cache.runReconciliation()
+	assertCachedReadyContains(false)
+
+	runner.deps["bd-1"] = nil
+	cache.runReconciliation()
+	assertCachedReadyContains(true)
+
+	if runner.depScanCalls != 0 {
+		t.Fatalf("dep scan calls = %d, want 0", runner.depScanCalls)
+	}
+}
+
+func TestCachingStoreBdReconcileClearsCachedDepsWhenListOmitsDependencies(t *testing.T) {
+	t.Parallel()
+
+	runner := newCachingStoreBdDepRunner(t)
+	runner.deps["bd-1"] = []Dep{{IssueID: "bd-1", DependsOnID: "bd-2", Type: "blocks"}}
+	cache := NewCachingStore(NewBdStore("/city", runner.run), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	runner.deps["bd-1"] = nil
+	cache.runReconciliation()
+
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
+	}
+	readyByID := make(map[string]bool, len(ready))
+	for _, bead := range ready {
+		readyByID[bead.ID] = true
+	}
+	if !readyByID["bd-1"] {
+		t.Fatalf("CachedReady excludes bd-1 after omitted deps, ready=%v", readyByID)
+	}
+}
+
+func TestCachingStoreBdIncompleteDepsUseBackingForDownDepList(t *testing.T) {
+	t.Parallel()
+
+	runner := newCachingStoreBdDepRunner(t)
+	cache := NewCachingStore(NewBdStore("/city", runner.run), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	deps, err := cache.DepList("bd-1", "down")
+	if err != nil {
+		t.Fatalf("initial DepList: %v", err)
+	}
+	if len(deps) != 0 {
+		t.Fatalf("initial deps = %v, want empty", deps)
+	}
+
+	runner.deps["bd-1"] = []Dep{{IssueID: "bd-1", DependsOnID: "bd-2", Type: "blocks"}}
+	cache.runReconciliation()
+
+	deps, err = cache.DepList("bd-1", "down")
+	if err != nil {
+		t.Fatalf("DepList after external dep add: %v", err)
+	}
+	if !hasDep(deps, "bd-2") {
+		t.Fatalf("deps after external dep add = %v, want bd-1 -> bd-2 from backing store", deps)
+	}
+	if runner.depScanCalls != 0 {
+		t.Fatalf("dep scan calls = %d, want 0", runner.depScanCalls)
+	}
+}
+
+func TestCachingStoreBdIncompleteDepsDepAddDoesNotDropExistingBackingDeps(t *testing.T) {
+	t.Parallel()
+
+	runner := newCachingStoreBdDepRunner(t)
+	runner.deps["bd-1"] = []Dep{{IssueID: "bd-1", DependsOnID: "bd-2", Type: "blocks"}}
+	cache := NewCachingStore(NewBdStore("/city", runner.run), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cache.DepAdd("bd-1", "bd-3", "blocks"); err != nil {
+		t.Fatalf("DepAdd: %v", err)
+	}
+
+	deps, err := cache.DepList("bd-1", "down")
+	if err != nil {
+		t.Fatalf("DepList after DepAdd: %v", err)
+	}
+	if !hasDep(deps, "bd-2") || !hasDep(deps, "bd-3") {
+		t.Fatalf("deps after DepAdd = %v, want existing bd-2 and added bd-3", deps)
+	}
+}
+
+func TestCachingStoreBdIncompleteDepsDepRemoveDoesNotDropExternalBackingDeps(t *testing.T) {
+	t.Parallel()
+
+	runner := newCachingStoreBdDepRunner(t)
+	runner.deps["bd-1"] = []Dep{
+		{IssueID: "bd-1", DependsOnID: "bd-2", Type: "blocks"},
+		{IssueID: "bd-1", DependsOnID: "bd-3", Type: "blocks"},
+	}
+	cache := NewCachingStore(NewBdStore("/city", runner.run), nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if _, err := cache.DepList("bd-1", "down"); err != nil {
+		t.Fatalf("DepList before external add: %v", err)
+	}
+	runner.deps["bd-1"] = append(runner.deps["bd-1"], Dep{IssueID: "bd-1", DependsOnID: "bd-4", Type: "blocks"})
+
+	if err := cache.DepRemove("bd-1", "bd-3"); err != nil {
+		t.Fatalf("DepRemove: %v", err)
+	}
+
+	deps, err := cache.DepList("bd-1", "down")
+	if err != nil {
+		t.Fatalf("DepList after DepRemove: %v", err)
+	}
+	if hasDep(deps, "bd-3") {
+		t.Fatalf("deps after DepRemove = %v, still contains removed bd-3", deps)
+	}
+	if !hasDep(deps, "bd-2") || !hasDep(deps, "bd-4") {
+		t.Fatalf("deps after DepRemove = %v, want retained bd-2 and external bd-4", deps)
+	}
+}
+
+type cachingStoreBdDepRunner struct {
+	t            *testing.T
+	deps         map[string][]Dep
+	depScanCalls int
+}
+
+func newCachingStoreBdDepRunner(t *testing.T) *cachingStoreBdDepRunner {
+	t.Helper()
+	return &cachingStoreBdDepRunner{
+		t:    t,
+		deps: make(map[string][]Dep),
+	}
+}
+
+func (r *cachingStoreBdDepRunner) run(_, name string, args ...string) ([]byte, error) {
+	r.t.Helper()
+	if name != "bd" {
+		r.t.Fatalf("command name = %q, want bd", name)
+	}
+	if len(args) == 0 {
+		r.t.Fatal("empty bd command")
+	}
+	switch args[0] {
+	case "list":
+		return r.listOutput(), nil
+	case "ready":
+		return []byte(`[]`), nil
+	case "dep":
+		return r.runDep(args[1:]...)
+	default:
+		return []byte(`[]`), nil
+	}
+}
+
+func (r *cachingStoreBdDepRunner) runDep(args ...string) ([]byte, error) {
+	r.t.Helper()
+	if len(args) == 0 {
+		r.t.Fatal("empty bd dep command")
+	}
+	switch args[0] {
+	case "list":
+		if len(args) > 1 && args[1] == "bd-1" {
+			return r.depListOutput("bd-1"), nil
+		}
+		r.depScanCalls++
+		r.t.Fatalf("unexpected dep scan command: %v", args)
+	case "add":
+		if len(args) < 5 || args[3] != "--type" {
+			r.t.Fatalf("unexpected dep add args: %v", args)
+		}
+		r.addDep(args[1], args[2], args[4])
+		return []byte(`[]`), nil
+	case "remove":
+		if len(args) < 3 {
+			r.t.Fatalf("unexpected dep remove args: %v", args)
+		}
+		r.removeDep(args[1], args[2])
+		return []byte(`[]`), nil
+	}
+	r.t.Fatalf("unexpected dep command: %v", args)
+	return nil, nil
+}
+
+func (r *cachingStoreBdDepRunner) listOutput() []byte {
+	var b strings.Builder
+	ids := []string{"bd-1", "bd-2", "bd-3", "bd-4"}
+	b.WriteByte('[')
+	for i, id := range ids {
+		if i > 0 {
+			b.WriteByte(',')
+		}
+		fmt.Fprintf(&b, `{"id":%q,"title":%q,"status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z","labels":["task"],"metadata":{}`, id, "dep "+strings.TrimPrefix(id, "bd-"))
+		if deps := r.deps[id]; len(deps) > 0 {
+			b.WriteString(`,"dependencies":[`)
+			for depIdx, dep := range deps {
+				if depIdx > 0 {
+					b.WriteByte(',')
+				}
+				fmt.Fprintf(&b, `{"issue_id":%q,"depends_on_id":%q,"type":%q}`, dep.IssueID, dep.DependsOnID, dep.Type)
+			}
+			b.WriteByte(']')
+		}
+		b.WriteByte('}')
+	}
+	b.WriteByte(']')
+	return []byte(b.String())
+}
+
+func (r *cachingStoreBdDepRunner) depListOutput(issueID string) []byte {
+	deps := r.deps[issueID]
+	if len(deps) == 0 {
+		return []byte(`[]`)
+	}
+	var b strings.Builder
+	b.WriteByte('[')
+	for i, dep := range deps {
+		if i > 0 {
+			b.WriteByte(',')
+		}
+		fmt.Fprintf(&b, `{"id":%q,"title":"dep","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z","dependency_type":%q}`, dep.DependsOnID, dep.Type)
+	}
+	b.WriteByte(']')
+	return []byte(b.String())
+}
+
+func (r *cachingStoreBdDepRunner) addDep(issueID, dependsOnID, depType string) {
+	deps := r.deps[issueID]
+	for i, dep := range deps {
+		if dep.DependsOnID == dependsOnID {
+			deps[i].Type = depType
+			r.deps[issueID] = deps
+			return
+		}
+	}
+	r.deps[issueID] = append(deps, Dep{IssueID: issueID, DependsOnID: dependsOnID, Type: depType})
+}
+
+func (r *cachingStoreBdDepRunner) removeDep(issueID, dependsOnID string) {
+	deps := r.deps[issueID]
+	for i, dep := range deps {
+		if dep.DependsOnID == dependsOnID {
+			r.deps[issueID] = append(deps[:i], deps[i+1:]...)
+			return
+		}
+	}
+}
+
+func hasDep(deps []Dep, dependsOnID string) bool {
+	for _, dep := range deps {
+		if dep.IssueID == "bd-1" && dep.DependsOnID == dependsOnID {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/beads/caching_store_reads.go b/internal/beads/caching_store_reads.go
index 3413e3e988..4707899a2d 100644
--- a/internal/beads/caching_store_reads.go
+++ b/internal/beads/caching_store_reads.go
@@ -8,8 +8,9 @@ import (
 
 // List returns beads matching the query. Active-bead queries are served from
 // cache when available. IncludeClosed queries merge cached active results with
-// backing-store history when possible so callers keep the old best-effort
-// behavior from ListByLabel/ListByMetadata during transient bd failures.
+// backing-store history when possible, preserving partial backing rows when bd
+// reports corrupt entries and retaining cache-only fallback for transient
+// non-partial bd failures.
 func (c *CachingStore) List(query ListQuery) ([]Bead, error) {
 	if !query.HasFilter() && !query.AllowScan {
 		return nil, fmt.Errorf("listing beads: %w", ErrQueryRequiresScan)
@@ -28,9 +29,14 @@ func (c *CachingStore) List(query ListQuery) ([]Bead, error) {
 	c.mu.RLock()
 	state := c.state
 	if state == cacheLive || state == cachePartial {
+		primePartialErr := c.primePartialErr
 		if len(c.dirty) > 0 {
 			c.mu.RUnlock()
-			return c.backing.List(query)
+			return c.backing.List(liveListQuery(query))
+		}
+		if primePartialErr != nil {
+			c.mu.RUnlock()
+			return c.backing.List(liveListQuery(query))
 		}
 		// PrimeActive loads the full active set (open + in_progress), so
 		// active-only queries are complete even before the history prime finishes.
@@ -43,27 +49,29 @@ func (c *CachingStore) List(query ListQuery) ([]Bead, error) {
 		}
 		c.mu.RUnlock()
 
-		finish := func(items []Bead) ([]Bead, error) {
+		finish := func(items []Bead, err error) ([]Bead, error) {
 			sortBeadsForQuery(items, query.Sort)
 			if query.Limit > 0 && len(items) > query.Limit {
 				items = items[:query.Limit]
 			}
-			return items, nil
+			return items, err
 		}
 
 		if !query.IncludesClosed() {
-			return finish(cached)
+			return finish(cached, nil)
 		}
 
 		// The cache never has a complete closed-only or parent-history view, so
 		// preserve the old backing-store behavior for those query shapes.
 		if query.Status == "closed" || query.ParentID != "" {
-			return c.backing.List(query)
+			return c.backing.List(liveListQuery(query))
 		}
 
-		all, err := c.backing.List(query)
+		all, err := c.backing.List(liveListQuery(query))
 		if err != nil {
-			return finish(cached)
+			if !IsPartialResult(err) {
+				return finish(cached, nil)
+			}
 		}
 
 		seen := make(map[string]bool, len(cached))
@@ -77,10 +85,43 @@ func (c *CachingStore) List(query ListQuery) ([]Bead, error) {
 			cached = append(cached, b)
 			seen[b.ID] = true
 		}
-		return finish(cached)
+		return finish(cached, err)
 	}
 	c.mu.RUnlock()
-	return c.backing.List(query)
+	return c.backing.List(liveListQuery(query))
+}
+
+func liveListQuery(query ListQuery) ListQuery {
+	query.Live = true
+	return query
+}
+
+// CachedList returns query results from the in-memory cache only. The boolean
+// reports whether the cache was initialized enough to answer without touching
+// the backing store. Dirty entries are returned from the last observed
+// snapshot; callers must treat this as a read model that may lag writes or
+// reconciliation by one tick.
+func (c *CachingStore) CachedList(query ListQuery) ([]Bead, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if c.state != cacheLive && c.state != cachePartial {
+		return nil, false
+	}
+	if c.primePartialErr != nil {
+		return nil, false
+	}
+	cached := make([]Bead, 0, len(c.beads))
+	for _, b := range c.beads {
+		if !query.Matches(b) {
+			continue
+		}
+		cached = append(cached, cloneBead(b))
+	}
+	sortBeadsForQuery(cached, query.Sort)
+	if query.Limit > 0 && len(cached) > query.Limit {
+		cached = cached[:query.Limit]
+	}
+	return cached, true
 }
 
 func (c *CachingStore) refreshCachedBeads(query ListQuery, startSeq uint64, items []Bead) []Bead {
@@ -105,22 +146,39 @@ func (c *CachingStore) refreshCachedBeads(query ListQuery, startSeq uint64, item
 	if c.state != cacheLive && c.state != cachePartial {
 		return items
 	}
+	now := time.Now()
 	refreshed := make([]Bead, 0, len(items))
 	for _, item := range items {
-		switch {
-		case c.deletedSeq[item.ID] > startSeq:
+		if c.deletedSeq[item.ID] > startSeq {
 			continue
-		case c.beadSeq[item.ID] > startSeq:
+		}
+		if c.beadSeq[item.ID] > startSeq {
 			current, ok := c.beads[item.ID]
 			if ok && query.Matches(current) {
 				refreshed = append(refreshed, cloneBead(current))
 			}
 			continue
 		}
+		if current, keep := c.recentLocalBeadConflictLocked(item.ID, item, now); keep {
+			if query.Matches(current) {
+				refreshed = append(refreshed, current)
+			}
+			continue
+		}
+		if c.beadSeq[item.ID] == startSeq {
+			current, ok := c.beads[item.ID]
+			if ok && current.Status == "closed" && item.Status != "closed" {
+				continue
+			}
+		}
 		c.beads[item.ID] = cloneBead(item)
+		c.deps[item.ID] = depsFromBeadFields(item)
 		delete(c.dirty, item.ID)
 		delete(c.deletedSeq, item.ID)
-		delete(c.beadSeq, item.ID)
+		if !recentLocalMutation(c.localBeadAt[item.ID], now) {
+			delete(c.beadSeq, item.ID)
+			delete(c.localBeadAt, item.ID)
+		}
 		if query.Matches(item) {
 			refreshed = append(refreshed, cloneBead(item))
 		}
@@ -129,20 +187,31 @@ func (c *CachingStore) refreshCachedBeads(query ListQuery, startSeq uint64, item
 		if c.deletedSeq[id] > startSeq || c.beadSeq[id] > startSeq {
 			continue
 		}
+		if _, keep := c.recentLocalBeadConflictLocked(id, bead, now); keep {
+			continue
+		}
 		c.beads[id] = bead
+		c.deps[id] = depsFromBeadFields(bead)
 		delete(c.dirty, id)
 		delete(c.deletedSeq, id)
-		delete(c.beadSeq, id)
+		if !recentLocalMutation(c.localBeadAt[id], now) {
+			delete(c.beadSeq, id)
+			delete(c.localBeadAt, id)
+		}
 	}
 	for id := range removedParents {
 		if c.deletedSeq[id] > startSeq || c.beadSeq[id] > startSeq {
 			continue
 		}
+		if current, ok := c.beads[id]; ok && current.Status != "closed" && recentLocalMutation(c.localBeadAt[id], now) {
+			continue
+		}
 		delete(c.beads, id)
 		delete(c.deps, id)
 		delete(c.dirty, id)
 		delete(c.deletedSeq, id)
 		delete(c.beadSeq, id)
+		delete(c.localBeadAt, id)
 	}
 	c.markFreshLocked(time.Now())
 	c.updateStatsLocked()
@@ -190,6 +259,18 @@ func (c *CachingStore) ListOpen(status ...string) ([]Bead, error) {
 // Get returns a single bead by ID from the cache or backing store.
 func (c *CachingStore) Get(id string) (Bead, error) {
 	c.mu.RLock()
+	if _, deleted := c.deletedSeq[id]; deleted {
+		c.mu.RUnlock()
+		return Bead{}, ErrNotFound
+	}
+	if _, mutated := c.beadSeq[id]; mutated {
+		if _, dirty := c.dirty[id]; !dirty {
+			if b, ok := c.beads[id]; ok {
+				c.mu.RUnlock()
+				return cloneBead(b), nil
+			}
+		}
+	}
 	if c.state == cacheLive || c.state == cachePartial {
 		if _, ok := c.dirty[id]; ok {
 			startSeq := c.mutationSeq
@@ -220,6 +301,7 @@ func (c *CachingStore) Get(id string) (Bead, error) {
 				return Bead{}, ErrNotFound
 			}
 			c.beads[id] = cloneBead(fresh)
+			c.deps[id] = depsFromBeadFields(fresh)
 			delete(c.dirty, id)
 			delete(c.deletedSeq, id)
 			delete(c.beadSeq, id)
@@ -240,17 +322,23 @@ func (c *CachingStore) Get(id string) (Bead, error) {
 }
 
 // Ready returns open beads whose blocking deps are all closed.
-func (c *CachingStore) Ready() ([]Bead, error) {
+func (c *CachingStore) Ready(query ...ReadyQuery) ([]Bead, error) {
+	if readyQueryFromArgs(query) != (ReadyQuery{}) {
+		return c.backing.Ready(query...)
+	}
 	c.mu.RLock()
-	if c.state == cacheLive {
+	if c.state == cacheLive && c.depsComplete {
 		if len(c.dirty) > 0 {
 			c.mu.RUnlock()
-			return c.backing.Ready()
+			return c.backing.Ready(query...)
+		}
+		if c.primePartialErr != nil {
+			c.mu.RUnlock()
+			return c.backing.Ready(query...)
 		}
 		statusByID := make(map[string]string, len(c.beads))
 		depsByID := make(map[string][]Dep, len(c.deps))
 		openBeads := make([]Bead, 0, len(c.beads))
-		missingDepIDs := make(map[string]struct{})
 		for _, b := range c.beads {
 			statusByID[b.ID] = b.Status
 			if b.Status == "open" && !IsReadyExcludedType(b.Type) {
@@ -260,30 +348,9 @@ func (c *CachingStore) Ready() ([]Bead, error) {
 		for _, b := range openBeads {
 			deps := cloneDeps(c.deps[b.ID])
 			depsByID[b.ID] = deps
-			for _, dep := range deps {
-				switch dep.Type {
-				case "blocks", "waits-for", "conditional-blocks":
-				default:
-					continue
-				}
-				if _, ok := statusByID[dep.DependsOnID]; !ok {
-					missingDepIDs[dep.DependsOnID] = struct{}{}
-				}
-			}
 		}
 		c.mu.RUnlock()
 
-		for depID := range missingDepIDs {
-			dep, err := c.backing.Get(depID)
-			if err != nil {
-				if errors.Is(err, ErrNotFound) {
-					continue
-				}
-				return nil, err
-			}
-			statusByID[depID] = dep.Status
-		}
-
 		var result []Bead
 		for _, b := range openBeads {
 			blocked := false
@@ -293,7 +360,7 @@ func (c *CachingStore) Ready() ([]Bead, error) {
 				default:
 					continue
 				}
-				if statusByID[dep.DependsOnID] != "closed" {
+				if status, ok := statusByID[dep.DependsOnID]; ok && status != "closed" {
 					blocked = true
 					break
 				}
@@ -305,7 +372,61 @@ func (c *CachingStore) Ready() ([]Bead, error) {
 		return result, nil
 	}
 	c.mu.RUnlock()
-	return c.backing.Ready()
+	return c.backing.Ready(query...)
+}
+
+// CachedReady returns ready beads from the in-memory active read model.
+// The boolean reports whether the cache was initialized enough to answer
+// without touching the backing store. Unlike Ready, this can answer from a
+// partial active cache only when each open bead has known dependency coverage.
+func (c *CachingStore) CachedReady() ([]Bead, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if c.state != cacheLive && c.state != cachePartial {
+		return nil, false
+	}
+	if c.primePartialErr != nil || len(c.dirty) > 0 {
+		return nil, false
+	}
+
+	statusByID := make(map[string]string, len(c.beads))
+	openBeads := make([]Bead, 0, len(c.beads))
+	for _, b := range c.beads {
+		statusByID[b.ID] = b.Status
+		if b.Status == "open" && !IsReadyExcludedType(b.Type) {
+			openBeads = append(openBeads, cloneBead(b))
+		}
+	}
+
+	result := make([]Bead, 0, len(openBeads))
+	for _, b := range openBeads {
+		deps, ok := c.deps[b.ID]
+		switch {
+		case ok:
+		case c.depsComplete:
+			deps = nil
+		default:
+			return nil, false
+		}
+		if cachedBeadReady(statusByID, deps) {
+			result = append(result, cloneBead(b))
+		}
+	}
+	return result, true
+}
+
+func cachedBeadReady(statusByID map[string]string, deps []Dep) bool {
+	for _, dep := range deps {
+		switch dep.Type {
+		case "blocks", "waits-for", "conditional-blocks":
+		default:
+			continue
+		}
+		if status, ok := statusByID[dep.DependsOnID]; ok && status != "closed" {
+			return false
+		}
+	}
+	return true
 }
 
 // Children returns beads with the given parent ID.
@@ -365,6 +486,10 @@ func (c *CachingStore) DepList(id, direction string) ([]Dep, error) {
 	c.mu.RLock()
 	if c.state == cacheLive {
 		if direction == "down" || direction == "" {
+			if !c.depsComplete {
+				c.mu.RUnlock()
+				return c.backing.DepList(id, direction)
+			}
 			if deps, ok := c.deps[id]; ok {
 				c.mu.RUnlock()
 				return cloneDeps(deps), nil
diff --git a/internal/beads/caching_store_reconcile.go b/internal/beads/caching_store_reconcile.go
index 227187a44c..95c49fc35b 100644
--- a/internal/beads/caching_store_reconcile.go
+++ b/internal/beads/caching_store_reconcile.go
@@ -2,6 +2,8 @@ package beads
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"time"
 )
 
@@ -71,7 +73,7 @@ func (c *CachingStore) runReconciliation() {
 	if err != nil {
 		c.mu.Lock()
 		c.syncFailures++
-		if c.syncFailures >= maxCacheSyncFailures && c.state == cacheLive {
+		if (IsPartialResult(err) || c.syncFailures >= maxCacheSyncFailures) && (c.state == cacheLive || c.state == cachePartial) {
 			c.state = cacheDegraded
 		}
 		c.recordProblemLocked("reconcile cache", err)
@@ -85,12 +87,16 @@ func (c *CachingStore) runReconciliation() {
 		freshByID[b.ID] = cloneBead(b)
 	}
 
-	depMap, depErr := c.fetchDepsForIDs(beadIDs(freshByID))
+	c.recoverMissingFromList(freshByID)
+
+	depMap, depsComplete, depErr := c.fetchDepsForIDs(beadIDs(freshByID))
 	if depErr != nil {
 		c.recordProblem("refresh dep cache during reconcile", depErr)
 	}
+	useFreshDeps := depsComplete && depErr == nil
 
 	c.mu.Lock()
+	now := time.Now()
 	if c.mutationSeq != startSeq {
 		var adds, removes, updates int64
 		notifications := make([]cacheNotification, 0, len(freshByID))
@@ -99,6 +105,10 @@ func (c *CachingStore) runReconciliation() {
 			if c.deletedSeq[id] > startSeq || c.beadSeq[id] > startSeq {
 				continue
 			}
+			if _, keep := c.recentLocalBeadConflictLocked(id, freshBead, now); keep {
+				continue
+			}
+			freshDeps := c.depsForReconcileLocked(id, freshBead, depMap, useFreshDeps)
 
 			old, exists := c.beads[id]
 			switch {
@@ -114,7 +124,7 @@ func (c *CachingStore) runReconciliation() {
 					eventType: "bead.updated",
 					bead:      cloneBead(freshBead),
 				})
-			case depErr == nil && depsChanged(c.deps[id], depMap[id]):
+			case depsChanged(c.deps[id], freshDeps):
 				updates++
 				notifications = append(notifications, cacheNotification{
 					eventType: "bead.updated",
@@ -123,12 +133,13 @@ func (c *CachingStore) runReconciliation() {
 			}
 
 			c.beads[id] = cloneBead(freshBead)
-			if depErr == nil {
-				c.deps[id] = cloneDeps(depMap[id])
-			}
+			c.deps[id] = cloneDeps(freshDeps)
 			delete(c.dirty, id)
 			delete(c.deletedSeq, id)
-			delete(c.beadSeq, id)
+			if !recentLocalMutation(c.localBeadAt[id], now) {
+				delete(c.beadSeq, id)
+				delete(c.localBeadAt, id)
+			}
 		}
 
 		for id, old := range c.beads {
@@ -138,25 +149,32 @@ func (c *CachingStore) runReconciliation() {
 			if c.deletedSeq[id] > startSeq || c.beadSeq[id] > startSeq {
 				continue
 			}
+			if old.Status != "closed" && recentLocalMutation(c.localBeadAt[id], now) {
+				continue
+			}
 			removes++
-			closed := cloneBead(old)
-			closed.Status = "closed"
-			notifications = append(notifications, cacheNotification{
-				eventType: "bead.closed",
-				bead:      closed,
-			})
+			if old.Status != "closed" {
+				closed := cloneBead(old)
+				closed.Status = "closed"
+				notifications = append(notifications, cacheNotification{
+					eventType: "bead.closed",
+					bead:      closed,
+				})
+			}
 			delete(c.beads, id)
 			delete(c.deps, id)
 			delete(c.dirty, id)
 			delete(c.deletedSeq, id)
 			delete(c.beadSeq, id)
+			delete(c.localBeadAt, id)
 		}
 
 		c.syncFailures = 0
+		c.depsComplete = useFreshDeps
+		c.primePartialErr = nil
 		if c.state == cacheDegraded {
 			c.state = cacheLive
 		}
-		now := time.Now()
 		durMs := float64(time.Since(start).Microseconds()) / 1000.0
 		c.stats.LastReconcileAt = now
 		c.stats.LastReconcileMs = durMs
@@ -172,14 +190,25 @@ func (c *CachingStore) runReconciliation() {
 
 	var adds, removes, updates int64
 	notifications := make([]cacheNotification, 0, len(freshByID))
+	nextBeads := make(map[string]Bead, len(freshByID))
 	nextDeps := make(map[string][]Dep, len(freshByID))
+	nextDirty := make(map[string]struct{})
+	nextBeadSeq := make(map[string]uint64)
+	nextLocalBeadAt := make(map[string]time.Time)
 
 	for id, freshBead := range freshByID {
-		if depErr == nil {
-			nextDeps[id] = cloneDeps(depMap[id])
-		} else if deps, ok := c.deps[id]; ok {
-			nextDeps[id] = cloneDeps(deps)
+		beadForCache := freshBead
+		preservedRecentLocal := false
+		if recentLocalMutation(c.localBeadAt[id], now) {
+			c.carryRecentLocalMutationLocked(id, nextDirty, nextBeadSeq, nextLocalBeadAt)
+		}
+		if current, keep := c.recentLocalBeadConflictLocked(id, freshBead, now); keep {
+			beadForCache = current
+			preservedRecentLocal = true
 		}
+		freshDeps := c.depsForReconcileLocked(id, freshBead, depMap, useFreshDeps)
+		nextBeads[id] = cloneBead(beadForCache)
+		nextDeps[id] = cloneDeps(freshDeps)
 
 		old, exists := c.beads[id]
 		switch {
@@ -187,15 +216,15 @@ func (c *CachingStore) runReconciliation() {
 			adds++
 			notifications = append(notifications, cacheNotification{
 				eventType: "bead.created",
-				bead:      cloneBead(freshBead),
+				bead:      cloneBead(beadForCache),
 			})
-		case beadChanged(old, freshBead):
+		case !preservedRecentLocal && beadChanged(old, freshBead):
 			updates++
 			notifications = append(notifications, cacheNotification{
 				eventType: "bead.updated",
 				bead:      cloneBead(freshBead),
 			})
-		case depErr == nil && depsChanged(c.deps[id], depMap[id]):
+		case !preservedRecentLocal && depsChanged(c.deps[id], freshDeps):
 			updates++
 			notifications = append(notifications, cacheNotification{
 				eventType: "bead.updated",
@@ -206,7 +235,18 @@ func (c *CachingStore) runReconciliation() {
 
 	for id, old := range c.beads {
 		if _, exists := freshByID[id]; !exists {
+			if old.Status != "closed" && recentLocalMutation(c.localBeadAt[id], now) {
+				nextBeads[id] = cloneBead(old)
+				if deps, ok := c.deps[id]; ok {
+					nextDeps[id] = cloneDeps(deps)
+				}
+				c.carryRecentLocalMutationLocked(id, nextDirty, nextBeadSeq, nextLocalBeadAt)
+				continue
+			}
 			removes++
+			if old.Status == "closed" {
+				continue
+			}
 			closed := cloneBead(old)
 			closed.Status = "closed"
 			notifications = append(notifications, cacheNotification{
@@ -216,17 +256,19 @@ func (c *CachingStore) runReconciliation() {
 		}
 	}
 
-	c.beads = freshByID
+	c.beads = nextBeads
 	c.deps = nextDeps
-	c.dirty = make(map[string]struct{})
-	c.beadSeq = make(map[string]uint64)
+	c.depsComplete = useFreshDeps
+	c.dirty = nextDirty
+	c.beadSeq = nextBeadSeq
+	c.localBeadAt = nextLocalBeadAt
 	c.deletedSeq = make(map[string]uint64)
 	c.syncFailures = 0
+	c.primePartialErr = nil
 	if c.state == cacheDegraded {
 		c.state = cacheLive
 	}
 
-	now := time.Now()
 	durMs := float64(time.Since(start).Microseconds()) / 1000.0
 	c.stats.LastReconcileAt = now
 	c.stats.LastReconcileMs = durMs
@@ -238,3 +280,84 @@ func (c *CachingStore) runReconciliation() {
 	c.mu.Unlock()
 	c.notifyChanges(notifications)
 }
+
+func (c *CachingStore) depsForReconcileLocked(id string, freshBead Bead, depMap map[string][]Dep, useFreshDeps bool) []Dep {
+	if useFreshDeps {
+		return cloneDeps(depMap[id])
+	}
+	freshDeps := depsFromBeadFields(freshBead)
+	if _, ok := c.backing.(*BdStore); ok {
+		return freshDeps
+	}
+	if len(freshDeps) == 0 {
+		if cachedDeps, ok := c.deps[id]; ok && len(cachedDeps) > 0 {
+			return cloneDeps(cachedDeps)
+		}
+	}
+	return freshDeps
+}
+
+// recoverMissingFromList re-fetches any cached active bead that didn't appear
+// in freshByID and merges verified-alive ones back. This guards against
+// cleanly incomplete List results: a List that drops an active bead must not
+// synthesize a spurious bead.closed event for it.
+//
+// On ErrNotFound the bead is left absent so the diff path can emit
+// bead.closed as before. On any other error the cached entry is merged
+// back conservatively, deferring the close to a later scan when the
+// backing store's state is unambiguous. Callers must own freshByID and not
+// access it concurrently while recovery is running.
+func (c *CachingStore) recoverMissingFromList(freshByID map[string]Bead) {
+	c.mu.RLock()
+	candidates := make(map[string]Bead)
+	for id, b := range c.beads {
+		if _, ok := freshByID[id]; ok {
+			continue
+		}
+		if b.Status == "closed" {
+			continue
+		}
+		candidates[id] = cloneBead(b)
+	}
+	c.mu.RUnlock()
+	if len(candidates) == 0 {
+		return
+	}
+	var recoveredAlive int64
+	var deferredClose int64
+	for id, cached := range candidates {
+		bead, err := c.backing.Get(id)
+		switch {
+		case err == nil:
+			if bead.ID != id {
+				c.recordProblem(
+					"verify missing bead before close",
+					fmt.Errorf("%s: backing returned bead %q", id, bead.ID),
+				)
+				freshByID[id] = cached
+				deferredClose++
+				continue
+			}
+			if bead.Status == "closed" {
+				continue
+			}
+			freshByID[id] = cloneBead(bead)
+			recoveredAlive++
+		case errors.Is(err, ErrNotFound):
+			// Confirmed gone; let the diff path emit bead.closed.
+		default:
+			c.recordProblem(
+				"verify missing bead before close",
+				fmt.Errorf("%s: %w", id, err),
+			)
+			freshByID[id] = cached
+			deferredClose++
+		}
+	}
+	if recoveredAlive != 0 || deferredClose != 0 {
+		c.mu.Lock()
+		c.stats.ReconcileRecoveries += recoveredAlive
+		c.stats.ReconcileCloseDeferrals += deferredClose
+		c.mu.Unlock()
+	}
+}
diff --git a/internal/beads/caching_store_reconcile_internal_test.go b/internal/beads/caching_store_reconcile_internal_test.go
index eb39a91fb0..7c9b80823b 100644
--- a/internal/beads/caching_store_reconcile_internal_test.go
+++ b/internal/beads/caching_store_reconcile_internal_test.go
@@ -3,6 +3,7 @@ package beads
 import (
 	"context"
 	"encoding/json"
+	"strings"
 	"sync"
 	"testing"
 )
@@ -132,6 +133,123 @@ func TestCachingStoreReconciliationPreservesConcurrentEvent(t *testing.T) {
 	}
 }
 
+func TestCachingStoreReconciliationSkipsReemitForAlreadyClosedBead(t *testing.T) {
+	mem := NewMemStore()
+	bead, err := mem.Create(Bead{Title: "to be closed"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	var events []string
+	cs := NewCachingStoreForTest(mem, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cs.Close(bead.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+	wantClose := "bead.closed:" + bead.ID
+	closeSeen := false
+	for _, e := range events {
+		if e == wantClose {
+			closeSeen = true
+			break
+		}
+	}
+	if !closeSeen {
+		t.Fatalf("events after Close = %v, want to include %q", events, wantClose)
+	}
+	events = nil
+
+	cs.runReconciliation()
+
+	for _, e := range events {
+		if strings.HasPrefix(e, "bead.closed:") {
+			t.Fatalf("reconciliation re-emitted close event: %v", events)
+		}
+	}
+
+	cs.mu.RLock()
+	_, stillCached := cs.beads[bead.ID]
+	cs.mu.RUnlock()
+	if stillCached {
+		t.Fatalf("closed bead %s should be evicted from cache after reconcile", bead.ID)
+	}
+}
+
+func TestCachingStoreReconciliationSkipsReemitForAlreadyClosedBeadWithConcurrentMutation(t *testing.T) {
+	mem := NewMemStore()
+	closedBead, err := mem.Create(Bead{Title: "closed before reconcile"})
+	if err != nil {
+		t.Fatalf("Create(closed): %v", err)
+	}
+	other, err := mem.Create(Bead{Title: "concurrent target"})
+	if err != nil {
+		t.Fatalf("Create(other): %v", err)
+	}
+
+	backing := &reconcileRaceStore{
+		Store:   mem,
+		started: make(chan struct{}),
+		release: make(chan struct{}),
+		stale:   []Bead{other},
+	}
+
+	var events []string
+	var eventsMu sync.Mutex
+	cs := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		eventsMu.Lock()
+		defer eventsMu.Unlock()
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cs.Close(closedBead.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+	eventsMu.Lock()
+	events = nil
+	eventsMu.Unlock()
+
+	backing.mu.Lock()
+	backing.block = true
+	backing.mu.Unlock()
+
+	done := make(chan struct{})
+	go func() {
+		cs.runReconciliation()
+		close(done)
+	}()
+
+	<-backing.started
+	title := "after concurrent update"
+	if err := cs.Update(other.ID, UpdateOpts{Title: &title}); err != nil {
+		t.Fatalf("Update(other): %v", err)
+	}
+	close(backing.release)
+	<-done
+
+	eventsMu.Lock()
+	defer eventsMu.Unlock()
+	for _, e := range events {
+		if strings.HasPrefix(e, "bead.closed:") {
+			t.Fatalf("reconciliation re-emitted close event in race path: %v", events)
+		}
+	}
+
+	cs.mu.RLock()
+	_, stillCached := cs.beads[closedBead.ID]
+	cs.mu.RUnlock()
+	if stillCached {
+		t.Fatalf("closed bead %s should be evicted from cache after reconcile", closedBead.ID)
+	}
+}
+
 func TestCachingStoreReconciliationMergesFreshDataWithConcurrentMutation(t *testing.T) {
 	mem := NewMemStore()
 	mutated, err := mem.Create(Bead{Title: "before mutate"})
diff --git a/internal/beads/caching_store_reconcile_recovery_internal_test.go b/internal/beads/caching_store_reconcile_recovery_internal_test.go
new file mode 100644
index 0000000000..11d595d7dc
--- /dev/null
+++ b/internal/beads/caching_store_reconcile_recovery_internal_test.go
@@ -0,0 +1,290 @@
+package beads
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"testing"
+)
+
+// droppingListStore wraps a Store and silently omits selected bead IDs from
+// List results, simulating a cleanly parsed but incomplete List under backend
+// stress.
+type droppingListStore struct {
+	Store
+	dropFromList map[string]struct{}
+	getOverride  map[string]Bead
+	getErr       map[string]error
+}
+
+func (s *droppingListStore) List(query ListQuery) ([]Bead, error) {
+	all, err := s.Store.List(query)
+	if err != nil || len(s.dropFromList) == 0 {
+		return all, err
+	}
+	filtered := make([]Bead, 0, len(all))
+	for _, b := range all {
+		if _, drop := s.dropFromList[b.ID]; drop {
+			continue
+		}
+		filtered = append(filtered, b)
+	}
+	return filtered, nil
+}
+
+func (s *droppingListStore) Get(id string) (Bead, error) {
+	if err, ok := s.getErr[id]; ok {
+		return Bead{}, err
+	}
+	if b, ok := s.getOverride[id]; ok {
+		return cloneBead(b), nil
+	}
+	return s.Store.Get(id)
+}
+
+func assertNotCached(t *testing.T, cache *CachingStore, id string) {
+	t.Helper()
+	cache.mu.RLock()
+	_, ok := cache.beads[id]
+	cache.mu.RUnlock()
+	if ok {
+		t.Fatalf("cache still has bead %q after confirmed close", id)
+	}
+}
+
+// TestReconcileSkipsCloseWhenListDropsAliveBead reproduces the cache-thrash
+// scenario where a cleanly incomplete List omits an alive bead. Before the
+// fix, the reconciler would synthesize bead.closed every cycle and
+// re-introduction via other paths would re-trigger it.
+func TestReconcileSkipsCloseWhenListDropsAliveBead(t *testing.T) {
+	t.Parallel()
+
+	mem := NewMemStore()
+	survivor, err := mem.Create(Bead{Title: "Survivor"})
+	if err != nil {
+		t.Fatalf("Create survivor: %v", err)
+	}
+	dropped, err := mem.Create(Bead{Title: "Dropped by tolerant parser"})
+	if err != nil {
+		t.Fatalf("Create dropped: %v", err)
+	}
+
+	backing := &droppingListStore{Store: mem}
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	backing.dropFromList = map[string]struct{}{dropped.ID: {}}
+	events = events[:0]
+
+	cache.runReconciliation()
+
+	for _, e := range events {
+		if e == "bead.closed:"+dropped.ID {
+			t.Fatalf("emitted bead.closed for an alive bead dropped by List; events = %v", events)
+		}
+	}
+
+	got, err := cache.Get(dropped.ID)
+	if err != nil {
+		t.Fatalf("Get(dropped) after reconcile: %v", err)
+	}
+	if got.Status == "closed" {
+		t.Fatalf("Get(dropped) returned status=closed; cache should still see it as alive")
+	}
+	if _, err := cache.Get(survivor.ID); err != nil {
+		t.Fatalf("Get(survivor) after reconcile: %v", err)
+	}
+	stats := cache.Stats()
+	if stats.ReconcileRecoveries != 1 {
+		t.Fatalf("ReconcileRecoveries = %d, want 1", stats.ReconcileRecoveries)
+	}
+	if stats.ReconcileCloseDeferrals != 0 {
+		t.Fatalf("ReconcileCloseDeferrals = %d, want 0", stats.ReconcileCloseDeferrals)
+	}
+}
+
+// TestReconcileEmitsCloseWhenBackingConfirmsNotFound verifies that a genuine
+// closure (List omits the bead AND backing.Get reports ErrNotFound) still
+// produces a bead.closed event.
+func TestReconcileEmitsCloseWhenBackingConfirmsNotFound(t *testing.T) {
+	t.Parallel()
+
+	mem := NewMemStore()
+	gone, err := mem.Create(Bead{Title: "Truly gone"})
+	if err != nil {
+		t.Fatalf("Create gone: %v", err)
+	}
+
+	backing := &droppingListStore{Store: mem}
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	backing.dropFromList = map[string]struct{}{gone.ID: {}}
+	backing.getErr = map[string]error{
+		gone.ID: fmt.Errorf("getting bead %q: %w", gone.ID, ErrNotFound),
+	}
+	events = events[:0]
+
+	cache.runReconciliation()
+
+	want := "bead.closed:" + gone.ID
+	found := false
+	for _, e := range events {
+		if e == want {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("events = %v, want %s when backing confirmed not-found", events, want)
+	}
+	if _, err := cache.Get(gone.ID); err == nil {
+		t.Fatalf("Get(gone) succeeded after confirmed close; cache should evict it")
+	}
+	assertNotCached(t, cache, gone.ID)
+}
+
+// TestReconcileEmitsCloseWhenGetReturnsClosed verifies that a real open-to-
+// closed transition still emits bead.closed when the closed bead is absent
+// from normal List results.
+func TestReconcileEmitsCloseWhenGetReturnsClosed(t *testing.T) {
+	t.Parallel()
+
+	mem := NewMemStore()
+	closing, err := mem.Create(Bead{Title: "Closing"})
+	if err != nil {
+		t.Fatalf("Create closing: %v", err)
+	}
+
+	backing := &droppingListStore{Store: mem}
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := mem.Close(closing.ID); err != nil {
+		t.Fatalf("Close backing bead: %v", err)
+	}
+	events = events[:0]
+
+	cache.runReconciliation()
+
+	want := "bead.closed:" + closing.ID
+	found := false
+	for _, e := range events {
+		if e == want {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("events = %v, want %s when backing returned closed bead", events, want)
+	}
+	assertNotCached(t, cache, closing.ID)
+}
+
+// TestReconcileDefersCloseOnBackingError verifies that a transient backing
+// failure (List omits the bead, Get returns a non-NotFound error) does NOT
+// produce a bead.closed event — the close is deferred until a later scan.
+func TestReconcileDefersCloseOnBackingError(t *testing.T) {
+	t.Parallel()
+
+	mem := NewMemStore()
+	uncertain, err := mem.Create(Bead{Title: "Uncertain"})
+	if err != nil {
+		t.Fatalf("Create uncertain: %v", err)
+	}
+
+	backing := &droppingListStore{Store: mem}
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	backing.dropFromList = map[string]struct{}{uncertain.ID: {}}
+	backing.getErr = map[string]error{uncertain.ID: errors.New("dolt: connection reset")}
+	events = events[:0]
+
+	cache.runReconciliation()
+
+	for _, e := range events {
+		if e == "bead.closed:"+uncertain.ID {
+			t.Fatalf("emitted bead.closed despite backing.Get error; events = %v", events)
+		}
+	}
+	if _, err := cache.Get(uncertain.ID); err != nil {
+		t.Fatalf("Get(uncertain) after reconcile: %v", err)
+	}
+	stats := cache.Stats()
+	if stats.ReconcileRecoveries != 0 {
+		t.Fatalf("ReconcileRecoveries = %d, want 0", stats.ReconcileRecoveries)
+	}
+	if stats.ReconcileCloseDeferrals != 1 {
+		t.Fatalf("ReconcileCloseDeferrals = %d, want 1", stats.ReconcileCloseDeferrals)
+	}
+}
+
+// TestReconcileDefersCloseWhenGetReturnsWrongID verifies recovery does not
+// merge a successful but invalid Get result under the requested ID.
+func TestReconcileDefersCloseWhenGetReturnsWrongID(t *testing.T) {
+	t.Parallel()
+
+	mem := NewMemStore()
+	uncertain, err := mem.Create(Bead{Title: "Uncertain"})
+	if err != nil {
+		t.Fatalf("Create uncertain: %v", err)
+	}
+
+	backing := &droppingListStore{Store: mem}
+	var events []string
+	cache := NewCachingStoreForTest(backing, func(eventType, beadID string, _ json.RawMessage) {
+		events = append(events, eventType+":"+beadID)
+	})
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	backing.dropFromList = map[string]struct{}{uncertain.ID: {}}
+	backing.getOverride = map[string]Bead{
+		uncertain.ID: {ID: "wrong-id", Title: "Wrong bead", Status: "open"},
+	}
+	events = events[:0]
+
+	cache.runReconciliation()
+
+	for _, e := range events {
+		if e == "bead.closed:"+uncertain.ID {
+			t.Fatalf("emitted bead.closed despite wrong backing.Get ID; events = %v", events)
+		}
+	}
+	got, err := cache.Get(uncertain.ID)
+	if err != nil {
+		t.Fatalf("Get(uncertain) after reconcile: %v", err)
+	}
+	if got.ID != uncertain.ID || got.Title != uncertain.Title {
+		t.Fatalf("Get(uncertain) = %#v, want cached bead %#v", got, uncertain)
+	}
+	stats := cache.Stats()
+	if stats.ReconcileRecoveries != 0 {
+		t.Fatalf("ReconcileRecoveries = %d, want 0", stats.ReconcileRecoveries)
+	}
+	if stats.ReconcileCloseDeferrals != 1 {
+		t.Fatalf("ReconcileCloseDeferrals = %d, want 1", stats.ReconcileCloseDeferrals)
+	}
+}
diff --git a/internal/beads/caching_store_test.go b/internal/beads/caching_store_test.go
index efb98c681e..e52bc7831a 100644
--- a/internal/beads/caching_store_test.go
+++ b/internal/beads/caching_store_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -171,6 +172,169 @@ func TestCachingStoreCreateRefreshesSparseBead(t *testing.T) {
 	}
 }
 
+func TestCachingStoreCloseGetReturnsWriteThroughStatusBeforePrime(t *testing.T) {
+	backing := &staleAfterCloseStore{MemStore: beads.NewMemStore()}
+	created, err := backing.Create(beads.Bead{Title: "close me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := backing.Update(created.ID, beads.UpdateOpts{Status: strPtr("in_progress")}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Close(created.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+	got, err := cs.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("Status = %q, want closed", got.Status)
+	}
+}
+
+func TestCachingStoreIgnoresStaleUpdateEventAfterLocalClose(t *testing.T) {
+	backing := beads.NewMemStore()
+	created, err := backing.Create(beads.Bead{Title: "close me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := backing.Update(created.ID, beads.UpdateOpts{Status: strPtr("in_progress")}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cs.Close(created.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	cs.ApplyEvent("bead.updated", json.RawMessage(`{"id":"`+created.ID+`","status":"in_progress"}`))
+
+	got, err := cs.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("Status after stale update event = %q, want closed", got.Status)
+	}
+}
+
+func TestCachingStoreIgnoresStaleUpdateEventAfterLocalUpdate(t *testing.T) {
+	backing := &staleReadsAfterUpdateStore{Store: beads.NewMemStore(), staleReadCount: 2}
+	created, err := backing.Create(beads.Bead{Title: "update me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	backing.stale = created
+
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cs.Update(created.ID, beads.UpdateOpts{
+		Status:   strPtr("in_progress"),
+		Metadata: map[string]string{"verified": "true"},
+	}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	cs.ApplyEvent("bead.updated", json.RawMessage(`{"id":"`+created.ID+`","status":"open"}`))
+
+	got, err := cs.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "in_progress" || got.Metadata["verified"] != "true" {
+		t.Fatalf("bead after stale update event = %+v, want local update preserved", got)
+	}
+}
+
+func TestCachingStoreIgnoresStaleClosedEventAfterLocalReopen(t *testing.T) {
+	mem := beads.NewMemStore()
+	created, err := mem.Create(beads.Bead{Title: "reopen me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := mem.Close(created.ID); err != nil {
+		t.Fatalf("Close backing: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(mem, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cs.Reopen(created.ID); err != nil {
+		t.Fatalf("Reopen: %v", err)
+	}
+
+	cs.ApplyEvent("bead.closed", json.RawMessage(`{"id":"`+created.ID+`","status":"closed"}`))
+
+	got, err := cs.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "open" {
+		t.Fatalf("Status after stale closed event = %q, want open", got.Status)
+	}
+}
+
+func TestCachingStoreIgnoresStaleUpdateEventAfterLocalDelete(t *testing.T) {
+	mem := beads.NewMemStore()
+	created, err := mem.Create(beads.Bead{Title: "delete me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(mem, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cs.Delete(created.ID); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+
+	cs.ApplyEvent("bead.updated", json.RawMessage(`{"id":"`+created.ID+`","title":"stale","status":"open"}`))
+
+	if got, err := cs.Get(created.ID); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("Get after stale update event = %+v, %v; want ErrNotFound", got, err)
+	}
+}
+
+func TestCachingStoreLiveListDoesNotOverwriteLocalCloseWithStaleActiveRow(t *testing.T) {
+	backing := &staleAfterCloseStore{MemStore: beads.NewMemStore()}
+	created, err := backing.Create(beads.Bead{Title: "close me"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := backing.Update(created.ID, beads.UpdateOpts{Status: strPtr("in_progress")}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if err := cs.Close(created.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+	if _, err := cs.List(beads.ListQuery{Status: "in_progress", Live: true}); err != nil {
+		t.Fatalf("List: %v", err)
+	}
+
+	got, err := cs.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("Status after stale live list = %q, want closed", got.Status)
+	}
+}
+
 func TestCachingStoreParentListUsesBackingStore(t *testing.T) {
 	mem := beads.NewMemStore()
 	parent, err := mem.Create(beads.Bead{Title: "parent"})
@@ -201,7 +365,7 @@ func TestCachingStoreParentListRefreshesCachedChildren(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Create(parent): %v", err)
 	}
-	child, err := mem.Create(beads.Bead{Title: "child", Labels: []string{"mc-live-contract"}})
+	child, err := mem.Create(beads.Bead{Title: "child", Labels: []string{"real-world-app-contract"}})
 	if err != nil {
 		t.Fatalf("Create(child): %v", err)
 	}
@@ -221,7 +385,7 @@ func TestCachingStoreParentListRefreshesCachedChildren(t *testing.T) {
 		t.Fatalf("children = %#v, want refreshed parent %s", children, parent.ID)
 	}
 
-	labeled, err := cs.List(beads.ListQuery{Label: "mc-live-contract"})
+	labeled, err := cs.List(beads.ListQuery{Label: "real-world-app-contract"})
 	if err != nil {
 		t.Fatalf("List(label): %v", err)
 	}
@@ -240,7 +404,7 @@ func TestCachingStoreParentListRefreshesReparentedChildren(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Create(new parent): %v", err)
 	}
-	child, err := mem.Create(beads.Bead{Title: "child", ParentID: oldParent.ID, Labels: []string{"mc-live-contract"}})
+	child, err := mem.Create(beads.Bead{Title: "child", ParentID: oldParent.ID, Labels: []string{"real-world-app-contract"}})
 	if err != nil {
 		t.Fatalf("Create(child): %v", err)
 	}
@@ -261,7 +425,7 @@ func TestCachingStoreParentListRefreshesReparentedChildren(t *testing.T) {
 		t.Fatalf("old parent children = %#v, want empty after reparent", children)
 	}
 
-	labeled, err := cs.List(beads.ListQuery{Label: "mc-live-contract"})
+	labeled, err := cs.List(beads.ListQuery{Label: "real-world-app-contract"})
 	if err != nil {
 		t.Fatalf("List(label): %v", err)
 	}
@@ -462,7 +626,7 @@ func TestCachingStoreUpdateReflectsWriteIntentWhenImmediateReadIsStale(t *testin
 	original, err := mem.Create(beads.Bead{
 		Title:    "root",
 		Labels:   []string{"root", "needs-update"},
-		Metadata: map[string]string{"mc.contract.run_id": "r1"},
+		Metadata: map[string]string{"real_world_app.contract.run_id": "r1"},
 	})
 	if err != nil {
 		t.Fatalf("Create: %v", err)
@@ -482,7 +646,51 @@ func TestCachingStoreUpdateReflectsWriteIntentWhenImmediateReadIsStale(t *testin
 		Labels:       []string{"verified"},
 		RemoveLabels: []string{"needs-update"},
 		Metadata: map[string]string{
-			"mc.contract.metadata_update": "true",
+			"real_world_app.contract.metadata_update": "true",
+		},
+	}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	got, err := cs.Get(original.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.Status != "in_progress" {
+		t.Fatalf("status = %q, want in_progress", got.Status)
+	}
+	if got.Metadata["real_world_app.contract.metadata_update"] != "true" || got.Metadata["real_world_app.contract.run_id"] != "r1" {
+		t.Fatalf("metadata = %#v, want original plus update", got.Metadata)
+	}
+	if !containsString(got.Labels, "verified") || containsString(got.Labels, "needs-update") {
+		t.Fatalf("labels = %#v, want verified without needs-update", got.Labels)
+	}
+}
+
+func TestCachingStoreUpdateReflectsWriteIntentWhenRefreshFails(t *testing.T) {
+	mem := beads.NewMemStore()
+	original, err := mem.Create(beads.Bead{
+		Title:    "root",
+		Status:   "open",
+		Labels:   []string{"root", "needs-update"},
+		Metadata: map[string]string{"real_world_app.contract.run_id": "r1"},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	backing := &getFailsAfterUpdateStore{Store: mem}
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	status := "in_progress"
+	if err := cs.Update(original.ID, beads.UpdateOpts{
+		Status:       &status,
+		Labels:       []string{"verified"},
+		RemoveLabels: []string{"needs-update"},
+		Metadata: map[string]string{
+			"real_world_app.contract.metadata_update": "true",
 		},
 	}); err != nil {
 		t.Fatalf("Update: %v", err)
@@ -495,7 +703,7 @@ func TestCachingStoreUpdateReflectsWriteIntentWhenImmediateReadIsStale(t *testin
 	if got.Status != "in_progress" {
 		t.Fatalf("status = %q, want in_progress", got.Status)
 	}
-	if got.Metadata["mc.contract.metadata_update"] != "true" || got.Metadata["mc.contract.run_id"] != "r1" {
+	if got.Metadata["real_world_app.contract.metadata_update"] != "true" || got.Metadata["real_world_app.contract.run_id"] != "r1" {
 		t.Fatalf("metadata = %#v, want original plus update", got.Metadata)
 	}
 	if !containsString(got.Labels, "verified") || containsString(got.Labels, "needs-update") {
@@ -503,6 +711,153 @@ func TestCachingStoreUpdateReflectsWriteIntentWhenImmediateReadIsStale(t *testin
 	}
 }
 
+func TestCachingStoreLocalWriteIgnoresDelayedStaleEvent(t *testing.T) {
+	mem := beads.NewMemStore()
+	original, err := mem.Create(beads.Bead{
+		Title:  "mail",
+		Type:   "message",
+		Labels: []string{"thread:abc"},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cs := beads.NewCachingStoreForTest(mem, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cs.Update(original.ID, beads.UpdateOpts{Labels: []string{"read"}}); err != nil {
+		t.Fatalf("Mark read update: %v", err)
+	}
+	staleReadEvent, err := mem.Get(original.ID)
+	if err != nil {
+		t.Fatalf("Get stale read event: %v", err)
+	}
+	if err := cs.Update(original.ID, beads.UpdateOpts{RemoveLabels: []string{"read"}}); err != nil {
+		t.Fatalf("Mark unread update: %v", err)
+	}
+
+	payload, err := json.Marshal(staleReadEvent)
+	if err != nil {
+		t.Fatalf("Marshal stale read event: %v", err)
+	}
+	cs.ApplyEvent("bead.updated", payload)
+
+	got, err := cs.Get(original.ID)
+	if err != nil {
+		t.Fatalf("Get after delayed stale event: %v", err)
+	}
+	if containsString(got.Labels, "read") {
+		t.Fatalf("labels after delayed stale event = %#v, want read label removed", got.Labels)
+	}
+	if !containsString(got.Labels, "thread:abc") {
+		t.Fatalf("labels after delayed stale event = %#v, want thread label preserved", got.Labels)
+	}
+}
+
+func TestCachingStoreLocalWriteIgnoresDelayedStaleEventAfterLiveRefresh(t *testing.T) {
+	mem := beads.NewMemStore()
+	original, err := mem.Create(beads.Bead{
+		Title:  "mail",
+		Type:   "message",
+		Labels: []string{"thread:abc"},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	cs := beads.NewCachingStoreForTest(mem, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cs.Update(original.ID, beads.UpdateOpts{
+		Labels:   []string{"read"},
+		Metadata: map[string]string{"mail.read": "true"},
+	}); err != nil {
+		t.Fatalf("Mark read update: %v", err)
+	}
+	staleReadEvent, err := mem.Get(original.ID)
+	if err != nil {
+		t.Fatalf("Get stale read event: %v", err)
+	}
+	if err := cs.Update(original.ID, beads.UpdateOpts{
+		RemoveLabels: []string{"read"},
+		Metadata:     map[string]string{"mail.read": "false"},
+	}); err != nil {
+		t.Fatalf("Mark unread update: %v", err)
+	}
+
+	if _, err := cs.List(beads.ListQuery{Live: true, Type: "message", AllowScan: true}); err != nil {
+		t.Fatalf("Live list refresh: %v", err)
+	}
+
+	payload, err := json.Marshal(staleReadEvent)
+	if err != nil {
+		t.Fatalf("Marshal stale read event: %v", err)
+	}
+	cs.ApplyEvent("bead.updated", payload)
+
+	got, err := cs.Get(original.ID)
+	if err != nil {
+		t.Fatalf("Get after delayed stale event: %v", err)
+	}
+	if containsString(got.Labels, "read") {
+		t.Fatalf("labels after delayed stale event = %#v, want read label removed", got.Labels)
+	}
+	if got.Metadata["mail.read"] != "false" {
+		t.Fatalf("mail.read after delayed stale event = %q, want false; metadata=%v", got.Metadata["mail.read"], got.Metadata)
+	}
+}
+
+func TestCachingStoreLiveListDoesNotOverwriteRecentLocalWriteWithStaleBackingRows(t *testing.T) {
+	mem := beads.NewMemStore()
+	original, err := mem.Create(beads.Bead{
+		Title:  "mail",
+		Status: "open",
+		Type:   "message",
+		Labels: []string{"thread:abc"},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	store := &staleListAfterUpdateStore{
+		Store: mem,
+		stale: []beads.Bead{original},
+	}
+	cs := beads.NewCachingStoreForTest(store, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	if err := cs.Update(original.ID, beads.UpdateOpts{
+		Labels:   []string{"read"},
+		Metadata: map[string]string{"mail.read": "true"},
+	}); err != nil {
+		t.Fatalf("Mark read update: %v", err)
+	}
+	store.setStaleListCount(1)
+
+	items, err := cs.List(beads.ListQuery{Live: true, Type: "message", Status: "open", AllowScan: true})
+	if err != nil {
+		t.Fatalf("Live list refresh: %v", err)
+	}
+	got, ok := findTestBead(items, original.ID)
+	if !ok {
+		t.Fatalf("Live list did not return %s: %#v", original.ID, items)
+	}
+	if !containsString(got.Labels, "read") || got.Metadata["mail.read"] != "true" {
+		t.Fatalf("live list stale row overwrote local read state: labels=%#v metadata=%#v", got.Labels, got.Metadata)
+	}
+
+	cached, err := cs.Get(original.ID)
+	if err != nil {
+		t.Fatalf("Get after stale live list: %v", err)
+	}
+	if !containsString(cached.Labels, "read") || cached.Metadata["mail.read"] != "true" {
+		t.Fatalf("cached read state after stale live list = labels=%#v metadata=%#v, want read=true", cached.Labels, cached.Metadata)
+	}
+}
+
 func TestCachingStoreUpdateDoesNotDuplicateAuthoritativeLabels(t *testing.T) {
 	mem := beads.NewMemStore()
 	original, err := mem.Create(beads.Bead{
@@ -546,31 +901,58 @@ type staleReadAfterUpdateStore struct {
 	returnOld bool
 }
 
-type sparseCreateStore struct {
+type getFailsAfterUpdateStore struct {
 	beads.Store
+	mu      sync.Mutex
+	failGet bool
 }
 
-func (s *sparseCreateStore) Create(b beads.Bead) (beads.Bead, error) {
-	created, err := s.Store.Create(b)
-	if err != nil {
-		return beads.Bead{}, err
-	}
-	return beads.Bead{ID: created.ID, Title: created.Title}, nil
-}
-
-func (s *staleReadAfterUpdateStore) Update(id string, opts beads.UpdateOpts) error {
+func (s *getFailsAfterUpdateStore) Update(id string, opts beads.UpdateOpts) error {
 	if err := s.Store.Update(id, opts); err != nil {
 		return err
 	}
 	s.mu.Lock()
-	s.returnOld = true
+	s.failGet = true
 	s.mu.Unlock()
 	return nil
 }
 
-func (s *staleReadAfterUpdateStore) Get(id string) (beads.Bead, error) {
+func (s *getFailsAfterUpdateStore) Get(id string) (beads.Bead, error) {
 	s.mu.Lock()
-	if s.returnOld && id == s.stale.ID {
+	if s.failGet {
+		s.failGet = false
+		s.mu.Unlock()
+		return beads.Bead{}, errors.New("refresh failed")
+	}
+	s.mu.Unlock()
+	return s.Store.Get(id)
+}
+
+type sparseCreateStore struct {
+	beads.Store
+}
+
+func (s *sparseCreateStore) Create(b beads.Bead) (beads.Bead, error) {
+	created, err := s.Store.Create(b)
+	if err != nil {
+		return beads.Bead{}, err
+	}
+	return beads.Bead{ID: created.ID, Title: created.Title}, nil
+}
+
+func (s *staleReadAfterUpdateStore) Update(id string, opts beads.UpdateOpts) error {
+	if err := s.Store.Update(id, opts); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	s.returnOld = true
+	s.mu.Unlock()
+	return nil
+}
+
+func (s *staleReadAfterUpdateStore) Get(id string) (beads.Bead, error) {
+	s.mu.Lock()
+	if s.returnOld && id == s.stale.ID {
 		s.returnOld = false
 		stale := s.stale
 		s.mu.Unlock()
@@ -580,6 +962,54 @@ func (s *staleReadAfterUpdateStore) Get(id string) (beads.Bead, error) {
 	return s.Store.Get(id)
 }
 
+type staleReadsAfterUpdateStore struct {
+	beads.Store
+	mu             sync.Mutex
+	stale          beads.Bead
+	staleReadCount int
+}
+
+func (s *staleReadsAfterUpdateStore) Update(id string, opts beads.UpdateOpts) error {
+	return s.Store.Update(id, opts)
+}
+
+func (s *staleReadsAfterUpdateStore) Get(id string) (beads.Bead, error) {
+	s.mu.Lock()
+	if s.staleReadCount > 0 && id == s.stale.ID {
+		s.staleReadCount--
+		stale := s.stale
+		s.mu.Unlock()
+		return stale, nil
+	}
+	s.mu.Unlock()
+	return s.Store.Get(id)
+}
+
+type staleListAfterUpdateStore struct {
+	beads.Store
+	mu             sync.Mutex
+	stale          []beads.Bead
+	staleListCount int
+}
+
+func (s *staleListAfterUpdateStore) setStaleListCount(count int) {
+	s.mu.Lock()
+	s.staleListCount = count
+	s.mu.Unlock()
+}
+
+func (s *staleListAfterUpdateStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.mu.Lock()
+	if s.staleListCount > 0 && query.Live {
+		s.staleListCount--
+		stale := append([]beads.Bead(nil), s.stale...)
+		s.mu.Unlock()
+		return stale, nil
+	}
+	s.mu.Unlock()
+	return s.Store.List(query)
+}
+
 type primeRaceStore struct {
 	beads.Store
 	started chan struct{}
@@ -619,97 +1049,595 @@ func (s *parentListRaceStore) List(query beads.ListQuery) ([]beads.Bead, error)
 	return append([]beads.Bead(nil), s.stale...), nil
 }
 
-type dirtyGetRaceStore struct {
-	beads.Store
-	mu           sync.Mutex
-	failNextGet  bool
-	blockNextGet bool
-	started      chan struct{}
-	release      chan struct{}
-	stale        beads.Bead
+type dirtyGetRaceStore struct {
+	beads.Store
+	mu           sync.Mutex
+	failNextGet  bool
+	blockNextGet bool
+	started      chan struct{}
+	release      chan struct{}
+	stale        beads.Bead
+}
+
+func (s *dirtyGetRaceStore) Get(id string) (beads.Bead, error) {
+	s.mu.Lock()
+	switch {
+	case s.failNextGet:
+		s.failNextGet = false
+		s.mu.Unlock()
+		return beads.Bead{}, errors.New("transient get failure")
+	case s.blockNextGet && id == s.stale.ID:
+		s.blockNextGet = false
+		started := s.started
+		release := s.release
+		stale := s.stale
+		s.mu.Unlock()
+		close(started)
+		<-release
+		return stale, nil
+	default:
+		s.mu.Unlock()
+		return s.Store.Get(id)
+	}
+}
+
+type updateRefreshStore struct {
+	beads.Store
+	fresh map[string]beads.Bead
+}
+
+func (s *updateRefreshStore) Get(id string) (beads.Bead, error) {
+	if b, ok := s.fresh[id]; ok {
+		return b, nil
+	}
+	return s.Store.Get(id)
+}
+
+func TestCachingStoreGetFallsBackForClosedBeadsAfterPrime(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	closed, err := mem.Create(beads.Bead{Title: "Closed"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := mem.Close(closed.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(mem, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	if items, err := cs.ListOpen(); err != nil {
+		t.Fatalf("ListOpen: %v", err)
+	} else if len(items) != 0 {
+		t.Fatalf("ListOpen len = %d, want 0 active items", len(items))
+	}
+
+	got, err := cs.Get(closed.ID)
+	if err != nil {
+		t.Fatalf("Get(closed): %v", err)
+	}
+	if got.Status != "closed" {
+		t.Fatalf("status = %q, want closed", got.Status)
+	}
+}
+
+type countingGetStore struct {
+	beads.Store
+	mu   sync.Mutex
+	gets int
+}
+
+func (s *countingGetStore) Get(id string) (beads.Bead, error) {
+	s.mu.Lock()
+	s.gets++
+	s.mu.Unlock()
+	return s.Store.Get(id)
+}
+
+func (s *countingGetStore) resetGets() {
+	s.mu.Lock()
+	s.gets = 0
+	s.mu.Unlock()
+}
+
+func (s *countingGetStore) getCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.gets
+}
+
+func TestCachingStoreReadyTreatsMissingDepTargetAsClosedWithoutBackingGet(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	blocker, err := mem.Create(beads.Bead{Title: "Closed blocker"})
+	if err != nil {
+		t.Fatalf("Create(blocker): %v", err)
+	}
+	if err := mem.Close(blocker.ID); err != nil {
+		t.Fatalf("Close(blocker): %v", err)
+	}
+	ready, err := mem.Create(beads.Bead{Title: "Ready after closed blocker"})
+	if err != nil {
+		t.Fatalf("Create(ready): %v", err)
+	}
+	if err := mem.DepAdd(ready.ID, blocker.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd: %v", err)
+	}
+
+	backing := &countingGetStore{Store: mem}
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	backing.resetGets()
+
+	got, err := cs.Ready()
+	if err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	if len(got) != 1 || got[0].ID != ready.ID {
+		t.Fatalf("Ready() = %v, want only %s", got, ready.ID)
+	}
+	if gets := backing.getCount(); gets != 0 {
+		t.Fatalf("Ready() performed %d backing Get calls, want 0", gets)
+	}
+}
+
+func TestCachingStoreCachedReadyUsesPrimedDependencies(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+	if err != nil {
+		t.Fatalf("Create(blocker): %v", err)
+	}
+	blocked, err := mem.Create(beads.Bead{Title: "Blocked"})
+	if err != nil {
+		t.Fatalf("Create(blocked): %v", err)
+	}
+	ready, err := mem.Create(beads.Bead{Title: "Ready"})
+	if err != nil {
+		t.Fatalf("Create(ready): %v", err)
+	}
+	if err := mem.DepAdd(blocked.ID, blocker.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd: %v", err)
+	}
+
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+	got, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
+	}
+	ids := map[string]bool{}
+	for _, b := range got {
+		ids[b.ID] = true
+	}
+	if !ids[blocker.ID] || !ids[ready.ID] || ids[blocked.ID] {
+		t.Fatalf("CachedReady ids = %v, want blocker and ready only", ids)
+	}
+}
+
+func TestCachingStoreCachedReadyUsesWriteThroughDependencies(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+	if err != nil {
+		t.Fatalf("Create(blocker): %v", err)
+	}
+	blocked, err := mem.Create(beads.Bead{Title: "Blocked"})
+	if err != nil {
+		t.Fatalf("Create(blocked): %v", err)
+	}
+
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+	if err := cache.DepAdd(blocked.ID, blocker.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd: %v", err)
+	}
+
+	got, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
+	}
+	ids := map[string]bool{}
+	for _, b := range got {
+		ids[b.ID] = true
+	}
+	if !ids[blocker.ID] || ids[blocked.ID] {
+		t.Fatalf("CachedReady ids = %v, want blocker only", ids)
+	}
+}
+
+func TestCachingStoreReadyFallsBackAfterDependencyOmittingUpdateEvent(t *testing.T) {
+	t.Parallel()
+
+	t.Run("external dep add", func(t *testing.T) {
+		mem := beads.NewMemStore()
+		blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+		if err != nil {
+			t.Fatalf("Create(blocker): %v", err)
+		}
+		target, err := mem.Create(beads.Bead{Title: "Target"})
+		if err != nil {
+			t.Fatalf("Create(target): %v", err)
+		}
+		cache := beads.NewCachingStoreForTest(mem, nil)
+		if err := cache.Prime(context.Background()); err != nil {
+			t.Fatalf("Prime: %v", err)
+		}
+
+		if err := mem.DepAdd(target.ID, blocker.ID, "blocks"); err != nil {
+			t.Fatalf("backing DepAdd: %v", err)
+		}
+		cache.ApplyEvent("bead.updated", dependencyOmittingUpdatePayload(t, target))
+
+		if ready, ok := cache.CachedReady(); ok {
+			t.Fatalf("CachedReady remained authoritative after dependency-omitting dep-add event: %v", ready)
+		}
+		ready, err := cache.Ready()
+		if err != nil {
+			t.Fatalf("Ready: %v", err)
+		}
+		if containsBeadID(ready, target.ID) {
+			t.Fatalf("Ready = %v, want backing dependency add to block %s", ready, target.ID)
+		}
+	})
+
+	t.Run("external dep remove", func(t *testing.T) {
+		mem := beads.NewMemStore()
+		blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+		if err != nil {
+			t.Fatalf("Create(blocker): %v", err)
+		}
+		target, err := mem.Create(beads.Bead{Title: "Target"})
+		if err != nil {
+			t.Fatalf("Create(target): %v", err)
+		}
+		if err := mem.DepAdd(target.ID, blocker.ID, "blocks"); err != nil {
+			t.Fatalf("DepAdd: %v", err)
+		}
+		cache := beads.NewCachingStoreForTest(mem, nil)
+		if err := cache.Prime(context.Background()); err != nil {
+			t.Fatalf("Prime: %v", err)
+		}
+		cache.ApplyEvent("bead.updated", dependencySnapshotUpdatePayload(t, target, []beads.Dep{{
+			IssueID:     target.ID,
+			DependsOnID: blocker.ID,
+			Type:        "blocks",
+		}}))
+
+		if err := mem.DepRemove(target.ID, blocker.ID); err != nil {
+			t.Fatalf("backing DepRemove: %v", err)
+		}
+		cache.ApplyEvent("bead.updated", dependencyOmittingUpdatePayload(t, target))
+
+		if ready, ok := cache.CachedReady(); ok {
+			t.Fatalf("CachedReady remained authoritative after dependency-omitting dep-remove event: %v", ready)
+		}
+		ready, err := cache.Ready()
+		if err != nil {
+			t.Fatalf("Ready: %v", err)
+		}
+		if !containsBeadID(ready, target.ID) {
+			t.Fatalf("Ready = %v, want backing dependency removal to unblock %s", ready, target.ID)
+		}
+	})
+}
+
+func TestCachingStoreUpdatedEventForNewBeadDoesNotTreatUnknownDepsAsEmpty(t *testing.T) {
+	t.Parallel()
+
+	mem := beads.NewMemStore()
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+	if err != nil {
+		t.Fatalf("Create(blocker): %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	target, err := mem.Create(beads.Bead{Title: "Target", Needs: []string{blocker.ID}})
+	if err != nil {
+		t.Fatalf("Create(target): %v", err)
+	}
+	cache.ApplyEvent("bead.updated", dependencyOmittingUpdatePayload(t, target))
+
+	ready, ok := cache.CachedReady()
+	if ok && containsBeadID(ready, target.ID) {
+		t.Fatalf("CachedReady = %v, want new bead dependency coverage not treated as empty", ready)
+	}
+}
+
+func TestCachingStoreCachedReadyIgnoresStaleDependencyEventsAfterLocalMutation(t *testing.T) {
+	t.Parallel()
+
+	t.Run("dep add", func(t *testing.T) {
+		mem := beads.NewMemStore()
+		blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+		if err != nil {
+			t.Fatalf("Create(blocker): %v", err)
+		}
+		target, err := mem.Create(beads.Bead{Title: "Target"})
+		if err != nil {
+			t.Fatalf("Create(target): %v", err)
+		}
+		cache := beads.NewCachingStoreForTest(mem, nil)
+		if err := cache.PrimeActive(); err != nil {
+			t.Fatalf("PrimeActive: %v", err)
+		}
+		if err := cache.DepAdd(target.ID, blocker.ID, "blocks"); err != nil {
+			t.Fatalf("DepAdd: %v", err)
+		}
+
+		cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Target","status":"open","issue_type":"task","dependencies":[]}`))
+
+		ready, ok := cache.CachedReady()
+		if !ok {
+			t.Fatal("CachedReady reported cache unavailable")
+		}
+		ids := map[string]bool{}
+		for _, b := range ready {
+			ids[b.ID] = true
+		}
+		if ids[target.ID] {
+			t.Fatalf("CachedReady ids = %v, want stale event to leave target blocked", ids)
+		}
+	})
+
+	t.Run("dep remove", func(t *testing.T) {
+		mem := beads.NewMemStore()
+		blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+		if err != nil {
+			t.Fatalf("Create(blocker): %v", err)
+		}
+		target, err := mem.Create(beads.Bead{Title: "Target", Needs: []string{blocker.ID}})
+		if err != nil {
+			t.Fatalf("Create(target): %v", err)
+		}
+		cache := beads.NewCachingStoreForTest(mem, nil)
+		if err := cache.PrimeActive(); err != nil {
+			t.Fatalf("PrimeActive: %v", err)
+		}
+		if err := cache.DepRemove(target.ID, blocker.ID); err != nil {
+			t.Fatalf("DepRemove: %v", err)
+		}
+
+		cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Target","status":"open","issue_type":"task","needs":["`+blocker.ID+`"]}`))
+
+		ready, ok := cache.CachedReady()
+		if !ok {
+			t.Fatal("CachedReady reported cache unavailable")
+		}
+		ids := map[string]bool{}
+		for _, b := range ready {
+			ids[b.ID] = true
+		}
+		if !ids[target.ID] {
+			t.Fatalf("CachedReady ids = %v, want stale event to leave target ready", ids)
+		}
+	})
+}
+
+func TestCachingStoreCachedReadyIgnoresStaleDependencyEventsAfterEventMutation(t *testing.T) {
+	t.Parallel()
+
+	mem := beads.NewMemStore()
+	closedBlocker, err := mem.Create(beads.Bead{Title: "Closed blocker"})
+	if err != nil {
+		t.Fatalf("Create(closed blocker): %v", err)
+	}
+	closed := "closed"
+	if err := mem.Update(closedBlocker.ID, beads.UpdateOpts{Status: &closed}); err != nil {
+		t.Fatalf("Update(closed blocker): %v", err)
+	}
+	openBlocker, err := mem.Create(beads.Bead{Title: "Open blocker"})
+	if err != nil {
+		t.Fatalf("Create(open blocker): %v", err)
+	}
+	target, err := mem.Create(beads.Bead{Title: "Target"})
+	if err != nil {
+		t.Fatalf("Create(target): %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Target","status":"open","issue_type":"task","dependencies":[{"issue_id":"`+target.ID+`","depends_on_id":"`+closedBlocker.ID+`","type":"blocks"},{"issue_id":"`+target.ID+`","depends_on_id":"`+openBlocker.ID+`","type":"blocks"}]}`))
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Target","status":"open","issue_type":"task","dependencies":[{"issue_id":"`+target.ID+`","depends_on_id":"`+closedBlocker.ID+`","type":"blocks"}]}`))
+
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
+	}
+	ids := map[string]bool{}
+	for _, b := range ready {
+		ids[b.ID] = true
+	}
+	if ids[target.ID] {
+		t.Fatalf("CachedReady ids = %v, want stale dependency event to leave target blocked by %s", ids, openBlocker.ID)
+	}
+}
+
+func TestCachingStoreCachedReadyUsesCompleteCreatedEventDependencies(t *testing.T) {
+	t.Parallel()
+	cache := beads.NewCachingStoreForTest(beads.NewMemStore(), nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.ApplyEvent("bead.created", []byte(`{"id":"gc-1","title":"Event task","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z"}`))
+
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
+	}
+	if len(ready) != 1 || ready[0].ID != "gc-1" {
+		t.Fatalf("CachedReady = %#v, want event-created bead", ready)
+	}
+}
+
+func TestCachingStoreCachedReadyUsesCompleteUpdatedEventDependencies(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
+	if err != nil {
+		t.Fatalf("Create(blocker): %v", err)
+	}
+	target, err := mem.Create(beads.Bead{Title: "Event target"})
+	if err != nil {
+		t.Fatalf("Create(target): %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Event target","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z","dependencies":[{"issue_id":"`+target.ID+`","depends_on_id":"`+blocker.ID+`","type":"blocks"}]}`))
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable after dependency update")
+	}
+	ids := map[string]bool{}
+	for _, b := range ready {
+		ids[b.ID] = true
+	}
+	if ids[target.ID] {
+		t.Fatalf("CachedReady ids = %v, want target blocked by updated dependencies", ids)
+	}
+
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Event target","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z"}`))
+	if ready, ok = cache.CachedReady(); ok {
+		t.Fatalf("CachedReady remained authoritative after dependency-omitting update: %v", ready)
+	}
 }
 
-func (s *dirtyGetRaceStore) Get(id string) (beads.Bead, error) {
-	s.mu.Lock()
-	switch {
-	case s.failNextGet:
-		s.failNextGet = false
-		s.mu.Unlock()
-		return beads.Bead{}, errors.New("transient get failure")
-	case s.blockNextGet && id == s.stale.ID:
-		s.blockNextGet = false
-		started := s.started
-		release := s.release
-		stale := s.stale
-		s.mu.Unlock()
-		close(started)
-		<-release
-		return stale, nil
-	default:
-		s.mu.Unlock()
-		return s.Store.Get(id)
+func TestCachingStoreCachedReadyUnavailableForPartialEventDependencies(t *testing.T) {
+	t.Parallel()
+	cache := beads.NewCachingStoreForTest(beads.NewMemStore(), nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.ApplyEvent("bead.created", []byte(`{"id":"gc-1","status":"open"}`))
+
+	if ready, ok := cache.CachedReady(); ok {
+		t.Fatalf("CachedReady ok with unknown event dependency coverage, ready=%v", ready)
 	}
 }
 
-func TestCachingStoreGetFallsBackForClosedBeadsAfterPrime(t *testing.T) {
+func TestCachingStoreCachedReadyRefreshesEventNeedsDependencies(t *testing.T) {
 	t.Parallel()
 	mem := beads.NewMemStore()
-	closed, err := mem.Create(beads.Bead{Title: "Closed"})
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
 	if err != nil {
-		t.Fatalf("Create: %v", err)
+		t.Fatalf("Create(blocker): %v", err)
 	}
-	if err := mem.Close(closed.ID); err != nil {
-		t.Fatalf("Close: %v", err)
+	target, err := mem.Create(beads.Bead{Title: "Event target"})
+	if err != nil {
+		t.Fatalf("Create(target): %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
 	}
 
-	cs := beads.NewCachingStoreForTest(mem, nil)
-	if err := cs.Prime(context.Background()); err != nil {
-		t.Fatalf("Prime: %v", err)
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Event target","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z","needs":["`+blocker.ID+`"]}`))
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable after needs add")
 	}
-	if items, err := cs.ListOpen(); err != nil {
-		t.Fatalf("ListOpen: %v", err)
-	} else if len(items) != 0 {
-		t.Fatalf("ListOpen len = %d, want 0 active items", len(items))
+	ids := map[string]bool{}
+	for _, b := range ready {
+		ids[b.ID] = true
+	}
+	if ids[target.ID] {
+		t.Fatalf("CachedReady ids = %v, want target blocked by event needs", ids)
 	}
 
-	got, err := cs.Get(closed.ID)
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Event target","status":"open","issue_type":"task","created_at":"2026-01-01T00:00:00Z"}`))
+	if ready, ok = cache.CachedReady(); ok {
+		t.Fatalf("CachedReady remained authoritative after dependency-omitting update: %v", ready)
+	}
+}
+
+func TestCachingStoreCachedReadyClearsExplicitEventNeeds(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
 	if err != nil {
-		t.Fatalf("Get(closed): %v", err)
+		t.Fatalf("Create(blocker): %v", err)
 	}
-	if got.Status != "closed" {
-		t.Fatalf("status = %q, want closed", got.Status)
+	target, err := mem.Create(beads.Bead{Title: "Event target", Needs: []string{blocker.ID}})
+	if err != nil {
+		t.Fatalf("Create(target): %v", err)
+	}
+	cache := beads.NewCachingStoreForTest(mem, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+
+	cache.ApplyEvent("bead.updated", []byte(`{"id":"`+target.ID+`","title":"Event target","status":"open","issue_type":"task","needs":[]}`))
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable after explicit needs clear")
+	}
+	ids := map[string]bool{}
+	for _, b := range ready {
+		ids[b.ID] = true
+	}
+	if !ids[target.ID] {
+		t.Fatalf("CachedReady ids = %v, want target ready after explicit needs clear", ids)
 	}
 }
 
-func TestCachingStoreReadyFallsBackForClosedBlockingDepsAfterPrime(t *testing.T) {
+func TestCachingStoreUpdateClearsCachedDependenciesFromFreshBead(t *testing.T) {
 	t.Parallel()
 	mem := beads.NewMemStore()
-	blocker, err := mem.Create(beads.Bead{Title: "Closed blocker"})
+	blocker, err := mem.Create(beads.Bead{Title: "Blocker"})
 	if err != nil {
 		t.Fatalf("Create(blocker): %v", err)
 	}
-	if err := mem.Close(blocker.ID); err != nil {
-		t.Fatalf("Close(blocker): %v", err)
-	}
-	ready, err := mem.Create(beads.Bead{Title: "Ready after closed blocker"})
+	blocked, err := mem.Create(beads.Bead{Title: "Blocked", Needs: []string{blocker.ID}})
 	if err != nil {
-		t.Fatalf("Create(ready): %v", err)
+		t.Fatalf("Create(blocked): %v", err)
 	}
-	if err := mem.DepAdd(ready.ID, blocker.ID, "blocks"); err != nil {
-		t.Fatalf("DepAdd: %v", err)
+	backing := &updateRefreshStore{
+		Store: beads.NewMemStoreFrom(2, []beads.Bead{blocker, blocked}, nil),
+		fresh: make(map[string]beads.Bead),
+	}
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
 	}
 
-	cs := beads.NewCachingStoreForTest(mem, nil)
-	if err := cs.Prime(context.Background()); err != nil {
-		t.Fatalf("Prime: %v", err)
+	fresh := blocked
+	fresh.Title = "Cleared"
+	fresh.Needs = nil
+	fresh.Dependencies = nil
+	backing.fresh[blocked.ID] = fresh
+	title := "Cleared"
+	if err := cache.Update(blocked.ID, beads.UpdateOpts{Title: &title}); err != nil {
+		t.Fatalf("Update(blocked): %v", err)
 	}
 
-	got, err := cs.Ready()
-	if err != nil {
-		t.Fatalf("Ready: %v", err)
+	ready, ok := cache.CachedReady()
+	if !ok {
+		t.Fatal("CachedReady reported cache unavailable")
 	}
-	if len(got) != 1 || got[0].ID != ready.ID {
-		t.Fatalf("Ready() = %v, want only %s", got, ready.ID)
+	ids := map[string]bool{}
+	for _, b := range ready {
+		ids[b.ID] = true
+	}
+	if !ids[blocked.ID] {
+		t.Fatalf("CachedReady ids = %v, want update refresh to clear stale deps", ids)
 	}
 }
 
@@ -881,6 +1809,63 @@ func TestCachingStoreCloseNotifiesWhenBeadIsMissingFromCache(t *testing.T) {
 	}
 }
 
+func TestCachingStoreListByLabelSeesCreatedBeadAfterMetadataWrite(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name  string
+		prime func(*beads.CachingStore) error
+	}{
+		{
+			name:  "partial",
+			prime: func(cs *beads.CachingStore) error { return cs.PrimeActive() },
+		},
+		{
+			name:  "live",
+			prime: func(cs *beads.CachingStore) error { return cs.Prime(context.Background()) },
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			mem := beads.NewMemStore()
+			cs := beads.NewCachingStoreForTest(mem, nil)
+			if err := tc.prime(cs); err != nil {
+				t.Fatalf("prime: %v", err)
+			}
+
+			created, err := cs.Create(beads.Bead{
+				Title:  "worker",
+				Type:   "session",
+				Labels: []string{"gc.session", "agent:worker"},
+			})
+			if err != nil {
+				t.Fatalf("Create: %v", err)
+			}
+			if err := cs.SetMetadata(created.ID, "session_name", "s-"+created.ID); err != nil {
+				t.Fatalf("SetMetadata(session_name): %v", err)
+			}
+
+			got, err := cs.List(beads.ListQuery{
+				Label: "gc.session",
+				Sort:  beads.SortCreatedAsc,
+			})
+			if err != nil {
+				t.Fatalf("List(label): %v", err)
+			}
+			if len(got) != 1 {
+				t.Fatalf("List(label) len = %d, want 1", len(got))
+			}
+			if got[0].ID != created.ID {
+				t.Fatalf("List(label) ID = %q, want %q", got[0].ID, created.ID)
+			}
+			if got[0].Metadata["session_name"] != "s-"+created.ID {
+				t.Fatalf("session_name = %q, want %q", got[0].Metadata["session_name"], "s-"+created.ID)
+			}
+		})
+	}
+}
+
 func TestCachingStoreApplyEvent(t *testing.T) {
 	t.Parallel()
 	mem := beads.NewMemStore()
@@ -891,12 +1876,13 @@ func TestCachingStoreApplyEvent(t *testing.T) {
 		t.Fatalf("Prime: %v", err)
 	}
 
-	// Apply a create event for a bead that doesn't exist in cache yet.
-	newBead := beads.Bead{ID: "ext-1", Title: "External", Status: "open"}
-	payload, _ := json.Marshal(newBead)
+	// Apply a create event for a bead that exists in the backing store but
+	// doesn't exist in cache yet.
+	external, _ := mem.Create(beads.Bead{Title: "External"})
+	payload, _ := json.Marshal(beads.Bead{ID: external.ID, Title: "External", Status: "open"})
 	cs.ApplyEvent("bead.created", payload)
 
-	got := requireCachedBead(t, cs, "ext-1", false)
+	got := requireCachedBead(t, cs, external.ID, false)
 	if got.Title != "External" {
 		t.Fatalf("title = %q, want External", got.Title)
 	}
@@ -907,7 +1893,7 @@ func TestCachingStoreApplyEvent(t *testing.T) {
 		Title:    &updatedTitle,
 		Metadata: map[string]string{"gc.step_ref": "mol.review"},
 	}); err != nil {
-		t.Fatalf("Update backing: %v", err)
+		t.Fatalf("Update backing before event: %v", err)
 	}
 	updated := beads.Bead{ID: b1.ID, Title: updatedTitle, Status: "open", Metadata: map[string]string{"gc.step_ref": "mol.review"}}
 	payload, _ = json.Marshal(updated)
@@ -961,6 +1947,95 @@ func TestCachingStoreApplyEvent(t *testing.T) {
 	}
 }
 
+func TestCachingStoreApplyEventIgnoresUnknownForeignBead(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	backing := &eventGetFailStore{Store: mem, failGet: true}
+	cs := beads.NewCachingStoreForTestWithPrefix(backing, "gc", nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	for _, eventType := range []string{"bead.created", "bead.updated", "bead.closed"} {
+		payload, err := json.Marshal(beads.Bead{
+			ID:     "foreign-" + eventType,
+			Title:  "belongs to another store",
+			Status: "open",
+		})
+		if err != nil {
+			t.Fatalf("Marshal: %v", err)
+		}
+		cs.ApplyEvent(eventType, payload)
+	}
+
+	items, err := cs.List(beads.ListQuery{AllowScan: true, IncludeClosed: true})
+	if err != nil {
+		t.Fatalf("List cached beads: %v", err)
+	}
+	if len(items) != 0 {
+		t.Fatalf("cached foreign beads = %#v, want none", items)
+	}
+	if stats := cs.Stats(); stats.ProblemCount != 0 {
+		t.Fatalf("ProblemCount = %d, want 0 (last problem: %s)", stats.ProblemCount, stats.LastProblem)
+	}
+}
+
+func TestCachingStoreApplyEventRefreshesOwnedUnknownBeadFromBacking(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	backing := &eventGetFailStore{Store: mem}
+	cs := beads.NewCachingStoreForTestWithPrefix(backing, "gc", nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+	created, err := mem.Create(beads.Bead{
+		Title:    "owned external bead",
+		Labels:   []string{"from-backing"},
+		Metadata: map[string]string{"gc.step_ref": "mol.review"},
+	})
+	if err != nil {
+		t.Fatalf("Create backing bead: %v", err)
+	}
+
+	payload, err := json.Marshal(map[string]any{
+		"id":     created.ID,
+		"status": "open",
+	})
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+
+	cs.ApplyEvent("bead.updated", payload)
+
+	got := requireCachedBead(t, cs, created.ID, false)
+	if got.Title != "owned external bead" {
+		t.Fatalf("title = %q, want owned external bead", got.Title)
+	}
+	if len(got.Labels) != 1 || got.Labels[0] != "from-backing" {
+		t.Fatalf("labels = %#v, want [from-backing]", got.Labels)
+	}
+	if got.Metadata["gc.step_ref"] != "mol.review" {
+		t.Fatalf("metadata = %#v, want gc.step_ref=mol.review", got.Metadata)
+	}
+}
+
+func TestNewCachingStoreRecordsProblemForMissingProductionPrefix(t *testing.T) {
+	t.Parallel()
+	backing := beads.NewBdStore(t.TempDir(), func(string, string, ...string) ([]byte, error) {
+		t.Fatal("runner should not be called")
+		return nil, nil
+	})
+	cs := beads.NewCachingStore(backing, nil)
+
+	stats := cs.Stats()
+	if stats.ProblemCount != 1 {
+		t.Fatalf("ProblemCount = %d, want 1", stats.ProblemCount)
+	}
+	if !strings.Contains(stats.LastProblem, "missing issue prefix") {
+		t.Fatalf("LastProblem = %q, want missing issue prefix", stats.LastProblem)
+	}
+}
+
 func TestCachingStoreApplyEventRefreshesPartialHookPayload(t *testing.T) {
 	t.Parallel()
 	mem := beads.NewMemStore()
@@ -971,7 +2046,7 @@ func TestCachingStoreApplyEventRefreshesPartialHookPayload(t *testing.T) {
 	child, err := mem.Create(beads.Bead{
 		Title:    "child",
 		ParentID: parent.ID,
-		Labels:   []string{"mc-live-contract"},
+		Labels:   []string{"real-world-app-contract"},
 	})
 	if err != nil {
 		t.Fatalf("Create child: %v", err)
@@ -1005,7 +2080,7 @@ func TestCachingStoreApplyEventRefreshesPartialHookPayload(t *testing.T) {
 		t.Fatalf("ProblemCount = %d, want 0 (last problem: %s)", stats.ProblemCount, stats.LastProblem)
 	}
 
-	labeled, err := cs.List(beads.ListQuery{Label: "mc-live-contract"})
+	labeled, err := cs.List(beads.ListQuery{Label: "real-world-app-contract"})
 	if err != nil {
 		t.Fatalf("List(label): %v", err)
 	}
@@ -1035,6 +2110,10 @@ func (s *eventGetFailStore) Get(id string) (beads.Bead, error) {
 func TestCachingStoreApplyEventCoercesNonStringMetadata(t *testing.T) {
 	t.Parallel()
 	mem := beads.NewMemStore()
+	created, err := mem.Create(beads.Bead{Title: "mayor"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
 
 	cs := beads.NewCachingStoreForTest(mem, nil)
 	if err := cs.Prime(context.Background()); err != nil {
@@ -1042,7 +2121,7 @@ func TestCachingStoreApplyEventCoercesNonStringMetadata(t *testing.T) {
 	}
 
 	payload, err := json.Marshal(map[string]any{
-		"id":         "ext-1",
+		"id":         created.ID,
 		"title":      "mayor",
 		"status":     "open",
 		"issue_type": "session",
@@ -1064,7 +2143,7 @@ func TestCachingStoreApplyEventCoercesNonStringMetadata(t *testing.T) {
 		t.Fatalf("ProblemCount = %d, want 0 (last problem: %s)", stats.ProblemCount, stats.LastProblem)
 	}
 
-	got := requireCachedBead(t, cs, "ext-1", false)
+	got := requireCachedBead(t, cs, created.ID, false)
 	if got.Type != "session" {
 		t.Fatalf("Type = %q, want session", got.Type)
 	}
@@ -1079,6 +2158,50 @@ func TestCachingStoreApplyEventCoercesNonStringMetadata(t *testing.T) {
 	}
 }
 
+func TestCachingStoreApplyEventAcceptsWrappedHookPayload(t *testing.T) {
+	t.Parallel()
+	mem := beads.NewMemStore()
+	created, err := mem.Create(beads.Bead{Title: "message"})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(mem, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	payload, err := json.Marshal(map[string]any{
+		"bead": map[string]any{
+			"id":         created.ID,
+			"title":      "message",
+			"status":     "open",
+			"issue_type": "message",
+			"metadata": map[string]any{
+				"mail.read": false,
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("marshal payload: %v", err)
+	}
+
+	cs.ApplyEvent("bead.updated", payload)
+
+	stats := cs.Stats()
+	if stats.ProblemCount != 0 {
+		t.Fatalf("ProblemCount = %d, want 0 (last problem: %s)", stats.ProblemCount, stats.LastProblem)
+	}
+
+	got := requireCachedBead(t, cs, created.ID, false)
+	if got.Type != "message" {
+		t.Fatalf("Type = %q, want message", got.Type)
+	}
+	if got.Metadata["mail.read"] != "false" {
+		t.Fatalf("mail.read = %q, want false; metadata=%v", got.Metadata["mail.read"], got.Metadata)
+	}
+}
+
 func requireCachedBead(t *testing.T, cs *beads.CachingStore, id string, includeClosed bool) beads.Bead {
 	t.Helper()
 	items, err := cs.List(beads.ListQuery{AllowScan: true, IncludeClosed: includeClosed})
@@ -1220,6 +2343,35 @@ func TestCachingStoreListIncludeClosedFallsBackToCachedMatches(t *testing.T) {
 	}
 }
 
+func TestCachingStoreListIncludeClosedPreservesPartialBackingRows(t *testing.T) {
+	t.Parallel()
+	backing := &partialIncludeClosedMetadataStore{MemStore: beads.NewMemStore()}
+	open, _ := backing.Create(beads.Bead{Title: "open workflow"})
+	_ = backing.SetMetadata(open.ID, "gc.kind", "workflow")
+	closed, _ := backing.Create(beads.Bead{Title: "closed workflow"})
+	_ = backing.SetMetadata(closed.ID, "gc.kind", "workflow")
+	if err := backing.Close(closed.ID); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	cs := beads.NewCachingStoreForTest(backing, nil)
+	if err := cs.Prime(context.Background()); err != nil {
+		t.Fatalf("Prime: %v", err)
+	}
+
+	results, err := cs.List(beads.ListQuery{
+		Metadata:      map[string]string{"gc.kind": "workflow"},
+		IncludeClosed: true,
+	})
+	var partial *beads.PartialResultError
+	if !errors.As(err, &partial) {
+		t.Fatalf("List(include closed) error = %v, want *PartialResultError", err)
+	}
+	if !containsBeadID(results, open.ID) || !containsBeadID(results, closed.ID) {
+		t.Fatalf("results = %+v, want cached active row and partial closed backing row", results)
+	}
+}
+
 type failingIncludeClosedMetadataStore struct {
 	*beads.MemStore
 }
@@ -1231,6 +2383,118 @@ func (s *failingIncludeClosedMetadataStore) List(query beads.ListQuery) ([]beads
 	return s.MemStore.List(query)
 }
 
+type partialIncludeClosedMetadataStore struct {
+	*beads.MemStore
+}
+
+func (s *partialIncludeClosedMetadataStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	items, err := s.MemStore.List(query)
+	if err != nil {
+		return nil, err
+	}
+	if query.IncludeClosed && len(query.Metadata) > 0 {
+		return items, &beads.PartialResultError{
+			Op:  "bd list",
+			Err: errors.New("skipped 1 corrupt bead"),
+		}
+	}
+	return items, nil
+}
+
+type staleAfterCloseStore struct {
+	*beads.MemStore
+	stale map[string]bool
+}
+
+func (s *staleAfterCloseStore) Close(id string) error {
+	if err := s.MemStore.Close(id); err != nil {
+		return err
+	}
+	if s.stale == nil {
+		s.stale = make(map[string]bool)
+	}
+	s.stale[id] = true
+	return nil
+}
+
+func (s *staleAfterCloseStore) Get(id string) (beads.Bead, error) {
+	b, err := s.MemStore.Get(id)
+	if err != nil {
+		return b, err
+	}
+	if s.stale[id] {
+		b.Status = "in_progress"
+	}
+	return b, nil
+}
+
+func (s *staleAfterCloseStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	items, err := s.MemStore.List(query)
+	if err != nil {
+		return nil, err
+	}
+	for id := range s.stale {
+		b, getErr := s.MemStore.Get(id)
+		if getErr != nil {
+			continue
+		}
+		b.Status = "in_progress"
+		if query.Matches(b) {
+			items = append(items, b)
+		}
+	}
+	return items, nil
+}
+
+func containsBeadID(items []beads.Bead, id string) bool {
+	for _, item := range items {
+		if item.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
+func dependencyOmittingUpdatePayload(t *testing.T, b beads.Bead) json.RawMessage {
+	t.Helper()
+	payload, err := json.Marshal(map[string]any{
+		"id":         b.ID,
+		"title":      b.Title,
+		"status":     b.Status,
+		"issue_type": b.Type,
+		"created_at": b.CreatedAt,
+	})
+	if err != nil {
+		t.Fatalf("Marshal event payload: %v", err)
+	}
+	return payload
+}
+
+func dependencySnapshotUpdatePayload(t *testing.T, b beads.Bead, deps []beads.Dep) json.RawMessage {
+	t.Helper()
+	payload, err := json.Marshal(map[string]any{
+		"id":           b.ID,
+		"title":        b.Title,
+		"status":       b.Status,
+		"issue_type":   b.Type,
+		"created_at":   b.CreatedAt,
+		"dependencies": deps,
+	})
+	if err != nil {
+		t.Fatalf("Marshal event payload: %v", err)
+	}
+	return payload
+}
+
+func findTestBead(items []beads.Bead, id string) (beads.Bead, bool) {
+	for _, item := range items {
+		if item.ID == id {
+			return item, true
+		}
+	}
+	return beads.Bead{}, false
+}
+
 func strPtr(s string) *string { return &s }
 
 func containsString(values []string, want string) bool {
diff --git a/internal/beads/caching_store_writes.go b/internal/beads/caching_store_writes.go
index d86409660e..d4b1180725 100644
--- a/internal/beads/caching_store_writes.go
+++ b/internal/beads/caching_store_writes.go
@@ -20,8 +20,9 @@ func (c *CachingStore) Create(b Bead) (Bead, error) {
 	}
 
 	c.mu.Lock()
-	c.noteMutationLocked(created.ID)
+	c.noteLocalMutationLocked(created.ID)
 	c.beads[created.ID] = cloneBead(created)
+	c.deps[created.ID] = depsFromBeadFields(created)
 	delete(c.dirty, created.ID)
 	delete(c.deletedSeq, created.ID)
 	c.markFreshLocked(time.Now())
@@ -50,8 +51,9 @@ func (c *CachingStore) Update(id string, opts UpdateOpts) error {
 	fresh = applyUpdateOptsToBead(fresh, opts)
 
 	c.mu.Lock()
-	c.noteMutationLocked(id)
+	c.noteLocalMutationLocked(id)
 	c.beads[id] = cloneBead(fresh)
+	c.deps[id] = depsFromBeadFields(fresh)
 	delete(c.dirty, id)
 	delete(c.deletedSeq, id)
 	c.markFreshLocked(time.Now())
@@ -79,7 +81,7 @@ func (c *CachingStore) Close(id string) error {
 	}
 
 	c.mu.Lock()
-	c.noteMutationLocked(id)
+	c.noteLocalMutationLocked(id)
 	if b, ok := c.beads[id]; ok {
 		b.Status = "closed"
 		c.beads[id] = b
@@ -104,6 +106,48 @@ func (c *CachingStore) Close(id string) error {
 	return nil
 }
 
+// Reopen marks a bead as open in the backing store and cache.
+func (c *CachingStore) Reopen(id string) error {
+	if err := c.backing.Reopen(id); err != nil {
+		return err
+	}
+
+	var reopened Bead
+	var found bool
+	if fresh, err := c.backing.Get(id); err == nil {
+		reopened = fresh
+		reopened.Status = "open"
+		found = true
+	} else if !errors.Is(err, ErrNotFound) {
+		c.recordProblem("refresh bead after reopen", fmt.Errorf("%s: %w", id, err))
+	}
+
+	c.mu.Lock()
+	c.noteLocalMutationLocked(id)
+	if b, ok := c.beads[id]; ok {
+		b.Status = "open"
+		c.beads[id] = b
+		delete(c.dirty, id)
+		delete(c.deletedSeq, id)
+		reopened = cloneBead(b)
+		found = true
+		c.markFreshLocked(time.Now())
+		c.updateStatsLocked()
+	} else if found {
+		c.beads[id] = cloneBead(reopened)
+		delete(c.dirty, id)
+		delete(c.deletedSeq, id)
+		c.markFreshLocked(time.Now())
+		c.updateStatsLocked()
+	}
+	c.mu.Unlock()
+
+	if found {
+		c.notifyChange("bead.updated", reopened)
+	}
+	return nil
+}
+
 // CloseAll closes multiple beads and sets metadata on each.
 func (c *CachingStore) CloseAll(ids []string, metadata map[string]string) (int, error) {
 	n, err := c.backing.CloseAll(ids, metadata)
@@ -130,7 +174,7 @@ func (c *CachingStore) CloseAll(ids []string, metadata map[string]string) (int,
 
 	notifications := make([]cacheNotification, 0, len(refreshed))
 	c.mu.Lock()
-	c.noteMutationLocked(ids...)
+	c.noteLocalMutationLocked(ids...)
 	if refreshErr != nil {
 		c.recordProblemLocked("close-all refresh", refreshErr)
 	}
@@ -166,7 +210,7 @@ func (c *CachingStore) SetMetadata(id, key, value string) error {
 	}
 
 	c.mu.Lock()
-	c.noteMutationLocked(id)
+	c.noteLocalMutationLocked(id)
 	if b, ok := c.beads[id]; ok {
 		if b.Metadata == nil {
 			b.Metadata = make(map[string]string)
@@ -189,7 +233,7 @@ func (c *CachingStore) SetMetadataBatch(id string, kvs map[string]string) error
 	}
 
 	c.mu.Lock()
-	c.noteMutationLocked(id)
+	c.noteLocalMutationLocked(id)
 	if b, ok := c.beads[id]; ok {
 		if b.Metadata == nil {
 			b.Metadata = make(map[string]string, len(kvs))
@@ -214,7 +258,17 @@ func (c *CachingStore) DepAdd(issueID, dependsOnID, depType string) error {
 	}
 
 	c.mu.Lock()
-	c.noteMutationLocked(issueID)
+	c.noteLocalMutationLocked(issueID)
+	if !c.depsComplete {
+		if _, known := c.deps[issueID]; !known {
+			delete(c.dirty, issueID)
+			delete(c.deletedSeq, issueID)
+			c.markFreshLocked(time.Now())
+			c.updateStatsLocked()
+			c.mu.Unlock()
+			return nil
+		}
+	}
 	deps := c.deps[issueID]
 	for i, d := range deps {
 		if d.DependsOnID == dependsOnID {
@@ -244,7 +298,17 @@ func (c *CachingStore) DepRemove(issueID, dependsOnID string) error {
 	}
 
 	c.mu.Lock()
-	c.noteMutationLocked(issueID)
+	c.noteLocalMutationLocked(issueID)
+	if !c.depsComplete {
+		if _, known := c.deps[issueID]; !known {
+			delete(c.dirty, issueID)
+			delete(c.deletedSeq, issueID)
+			c.markFreshLocked(time.Now())
+			c.updateStatsLocked()
+			c.mu.Unlock()
+			return nil
+		}
+	}
 	deps := c.deps[issueID]
 	for i, d := range deps {
 		if d.DependsOnID == dependsOnID {
@@ -267,11 +331,12 @@ func (c *CachingStore) Delete(id string) error {
 	}
 
 	c.mu.Lock()
-	seq := c.noteMutationLocked(id)
+	seq := c.noteLocalMutationLocked(id)
 	delete(c.beads, id)
 	delete(c.deps, id)
 	delete(c.dirty, id)
 	delete(c.beadSeq, id)
+	delete(c.localBeadAt, id)
 	c.deletedSeq[id] = seq
 	c.markFreshLocked(time.Now())
 	c.updateStatsLocked()
diff --git a/internal/beads/exec/exec.go b/internal/beads/exec/exec.go
index 84d4c29418..98675151e5 100644
--- a/internal/beads/exec/exec.go
+++ b/internal/beads/exec/exec.go
@@ -255,6 +255,18 @@ func (s *Store) Close(id string) error {
 	return nil
 }
 
+// Reopen sets a bead's status to "open": script reopen <id>
+func (s *Store) Reopen(id string) error {
+	_, err := s.run(nil, "reopen", id)
+	if err != nil {
+		if isNotFoundError(err) {
+			return fmt.Errorf("reopening bead %q: %w", id, beads.ErrNotFound)
+		}
+		return fmt.Errorf("reopening bead %q: %w", id, err)
+	}
+	return nil
+}
+
 // CloseAll closes multiple beads and sets metadata on each.
 func (s *Store) CloseAll(ids []string, metadata map[string]string) (int, error) {
 	closed := 0
@@ -323,7 +335,7 @@ func (s *Store) ListOpen(status ...string) ([]beads.Bead, error) {
 
 // Ready returns actionable open beads (excluding infrastructure types):
 // script ready
-func (s *Store) Ready() ([]beads.Bead, error) {
+func (s *Store) Ready(query ...beads.ReadyQuery) ([]beads.Bead, error) {
 	out, err := s.run(nil, "ready")
 	if err != nil {
 		return nil, fmt.Errorf("exec beads ready: %w", err)
@@ -338,7 +350,11 @@ func (s *Store) Ready() ([]beads.Bead, error) {
 			result = append(result, b)
 		}
 	}
-	return result, nil
+	if len(query) == 0 {
+		return result, nil
+	}
+	q := query[0]
+	return beads.ApplyListQuery(result, beads.ListQuery{Assignee: q.Assignee, Limit: q.Limit}), nil
 }
 
 // Children returns non-closed beads whose ParentID matches by default:
diff --git a/internal/beads/exec/exec_test.go b/internal/beads/exec/exec_test.go
index f487582b97..1b56c9dfbe 100644
--- a/internal/beads/exec/exec_test.go
+++ b/internal/beads/exec/exec_test.go
@@ -450,6 +450,36 @@ esac
 	}
 }
 
+func TestUpdate_typeReachesScript(t *testing.T) {
+	dir := t.TempDir()
+	outFile := filepath.Join(dir, "stdin.json")
+
+	script := writeScript(t, dir, `
+op="$1"
+case "$op" in
+  update)
+    cat > "`+outFile+`"
+    ;;
+  *) exit 2 ;;
+esac
+`)
+	s := NewStore(script)
+
+	beadType := "bug"
+	if err := s.Update("EX-1", beads.UpdateOpts{Type: &beadType}); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+
+	data, err := os.ReadFile(outFile)
+	if err != nil {
+		t.Fatalf("read captured stdin: %v", err)
+	}
+	stdin := string(data)
+	if !strings.Contains(stdin, `"type":"bug"`) {
+		t.Errorf("stdin missing type, got: %s", stdin)
+	}
+}
+
 func TestGet(t *testing.T) {
 	dir := t.TempDir()
 	script := writeScript(t, dir, allOpsScript())
diff --git a/internal/beads/exec/json.go b/internal/beads/exec/json.go
index eb7341e4f0..39c02e18e9 100644
--- a/internal/beads/exec/json.go
+++ b/internal/beads/exec/json.go
@@ -32,6 +32,7 @@ type createRequest struct {
 type updateRequest struct {
 	Title        *string           `json:"title,omitempty"`
 	Status       *string           `json:"status,omitempty"`
+	Type         *string           `json:"type,omitempty"`
 	Priority     *int              `json:"priority,omitempty"`
 	Description  *string           `json:"description,omitempty"`
 	ParentID     *string           `json:"parent_id,omitempty"`
@@ -87,6 +88,7 @@ func marshalUpdate(opts beads.UpdateOpts) ([]byte, error) {
 	r := updateRequest{
 		Title:        opts.Title,
 		Status:       opts.Status,
+		Type:         opts.Type,
 		Priority:     opts.Priority,
 		Description:  opts.Description,
 		ParentID:     opts.ParentID,
diff --git a/internal/beads/exec_timeout_unix.go b/internal/beads/exec_timeout_unix.go
new file mode 100644
index 0000000000..f472320579
--- /dev/null
+++ b/internal/beads/exec_timeout_unix.go
@@ -0,0 +1,31 @@
+//go:build !windows
+
+package beads
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+func prepareCommandForTimeout(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+}
+
+func killCommandTree(cmd *exec.Cmd) error {
+	if cmd == nil || cmd.Process == nil {
+		return nil
+	}
+	pgid, err := syscall.Getpgid(cmd.Process.Pid)
+	if err == nil {
+		if killErr := syscall.Kill(-pgid, syscall.SIGKILL); killErr != nil && !errors.Is(killErr, os.ErrProcessDone) && !errors.Is(killErr, syscall.ESRCH) {
+			return killErr
+		}
+		return nil
+	}
+	if killErr := cmd.Process.Kill(); killErr != nil && !errors.Is(killErr, os.ErrProcessDone) {
+		return killErr
+	}
+	return nil
+}
diff --git a/internal/beads/exec_timeout_windows.go b/internal/beads/exec_timeout_windows.go
new file mode 100644
index 0000000000..8166101095
--- /dev/null
+++ b/internal/beads/exec_timeout_windows.go
@@ -0,0 +1,14 @@
+//go:build windows
+
+package beads
+
+import "os/exec"
+
+func prepareCommandForTimeout(_ *exec.Cmd) {}
+
+func killCommandTree(cmd *exec.Cmd) error {
+	if cmd == nil || cmd.Process == nil {
+		return nil
+	}
+	return cmd.Process.Kill()
+}
diff --git a/internal/beads/filestore.go b/internal/beads/filestore.go
index 2042d6d72c..0a5e28374d 100644
--- a/internal/beads/filestore.go
+++ b/internal/beads/filestore.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+	"time"
 
 	"github.com/gastownhall/gascity/internal/fsys"
 )
@@ -22,10 +23,31 @@ type fileData struct {
 // write. Fine for Tutorial 01 volumes.
 type FileStore struct {
 	*MemStore
-	fmu    sync.Mutex // guards mutate-then-save atomicity
-	fs     fsys.FS
-	path   string
-	locker Locker // cross-process file lock; nopLocker when unset
+	fmu       sync.Mutex // guards mutate-then-save atomicity
+	fs        fsys.FS
+	path      string
+	locker    Locker // cross-process file lock; nopLocker when unset
+	freshness fileFreshness
+}
+
+type fileFreshness struct {
+	known   bool
+	exists  bool
+	size    int64
+	modTime time.Time
+}
+
+func (f fileFreshness) same(other fileFreshness) bool {
+	if !f.known || !other.known {
+		return false
+	}
+	if f.exists != other.exists {
+		return false
+	}
+	if !f.exists {
+		return true
+	}
+	return f.size == other.size && f.modTime.Equal(other.modTime)
 }
 
 // OpenFileStore opens or creates a file-backed bead store at path. All file
@@ -45,7 +67,13 @@ func OpenFileStore(fs fsys.FS, path string) (*FileStore, error) {
 	data, err := fs.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return &FileStore{MemStore: NewMemStore(), fs: fs, path: path, locker: locker}, nil
+			return &FileStore{
+				MemStore:  NewMemStore(),
+				fs:        fs,
+				path:      path,
+				locker:    locker,
+				freshness: fileFreshness{known: true},
+			}, nil
 		}
 		return nil, fmt.Errorf("opening file store: %w", err)
 	}
@@ -54,7 +82,17 @@ func OpenFileStore(fs fsys.FS, path string) (*FileStore, error) {
 	if err := json.Unmarshal(data, &fd); err != nil {
 		return nil, fmt.Errorf("opening file store: %w", err)
 	}
-	return &FileStore{MemStore: NewMemStoreFrom(fd.Seq, fd.Beads, fd.Deps), fs: fs, path: path, locker: locker}, nil
+	store := &FileStore{
+		MemStore: NewMemStoreFrom(fd.Seq, fd.Beads, fd.Deps),
+		fs:       fs,
+		path:     path,
+		locker:   locker,
+	}
+	// The JSON we just loaded and the file's current freshness can diverge if
+	// another handle rewrites the store between ReadFile and a follow-up Stat.
+	// Leave the cache unknown so the first read revalidates against disk.
+	store.freshness = fileFreshness{}
+	return store, nil
 }
 
 // SetLocker sets a cross-process Locker (typically a FileFlock). When set,
@@ -84,6 +122,61 @@ func (fs *FileStore) reloadFromDisk() error {
 	return nil
 }
 
+func (fs *FileStore) currentFreshness() (fileFreshness, error) {
+	fi, err := fs.fs.Stat(fs.path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return fileFreshness{known: true}, nil
+		}
+		return fileFreshness{}, fmt.Errorf("stating file store: %w", err)
+	}
+	return fileFreshness{
+		known:   true,
+		exists:  true,
+		size:    fi.Size(),
+		modTime: fi.ModTime(),
+	}, nil
+}
+
+func (fs *FileStore) refreshFreshnessCache() {
+	current, err := fs.currentFreshness()
+	if err != nil {
+		fs.freshness = fileFreshness{}
+		return
+	}
+	fs.freshness = current
+}
+
+// refreshReadStateLocked favors cross-process correctness for long-lived
+// readers, but uses an mtime+size fast path to avoid full JSON reloads on
+// every read. The remaining per-read Stat cost is acceptable for now; if
+// polling latency becomes measurable, we can replace it with a lighter seq hint.
+// Read wrappers intentionally skip the cross-process locker because writers
+// publish complete JSON files with temp-file-plus-rename atomic replacement.
+func (fs *FileStore) refreshReadStateLocked() error {
+	current, err := fs.currentFreshness()
+	if err != nil {
+		if err := fs.reloadFromDisk(); err != nil {
+			return err
+		}
+		fs.freshness = fileFreshness{}
+		return nil
+	}
+	if fs.freshness.same(current) {
+		return nil
+	}
+	if !current.exists {
+		fs.restoreFrom(0, nil, nil)
+		fs.freshness = current
+		return nil
+	}
+	if err := fs.reloadFromDisk(); err != nil {
+		return err
+	}
+	fs.freshness = current
+	return nil
+}
+
 // Create delegates to MemStore.Create and flushes to disk.
 // If the disk flush fails, the in-memory mutation is rolled back to keep
 // the MemStore and file in sync.
@@ -155,6 +248,52 @@ func (fs *FileStore) Close(id string) error {
 	return nil
 }
 
+// Reopen delegates to MemStore.Reopen and flushes to disk.
+// If the disk flush fails, the in-memory mutation is rolled back.
+func (fs *FileStore) Reopen(id string) error {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.locker.Lock(); err != nil {
+		return err
+	}
+	defer fs.locker.Unlock() //nolint:errcheck // best-effort unlock
+	if err := fs.reloadFromDisk(); err != nil {
+		return err
+	}
+	snap := fs.snapshotLocked()
+	if err := fs.MemStore.Reopen(id); err != nil {
+		return err
+	}
+	if err := fs.save(); err != nil {
+		fs.restoreFrom(snap.seq, snap.beads, snap.deps)
+		return err
+	}
+	return nil
+}
+
+// Delete delegates to MemStore.Delete and flushes to disk.
+// If the disk flush fails, the in-memory mutation is rolled back.
+func (fs *FileStore) Delete(id string) error {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.locker.Lock(); err != nil {
+		return err
+	}
+	defer fs.locker.Unlock() //nolint:errcheck // best-effort unlock
+	if err := fs.reloadFromDisk(); err != nil {
+		return err
+	}
+	snap := fs.snapshotLocked()
+	if err := fs.MemStore.Delete(id); err != nil {
+		return err
+	}
+	if err := fs.save(); err != nil {
+		fs.restoreFrom(snap.seq, snap.beads, snap.deps)
+		return err
+	}
+	return nil
+}
+
 // CloseAll closes multiple beads and sets metadata, then flushes once.
 func (fs *FileStore) CloseAll(ids []string, metadata map[string]string) (int, error) {
 	fs.fmu.Lock()
@@ -226,27 +365,84 @@ func (fs *FileStore) SetMetadataBatch(id string, kvs map[string]string) error {
 	return nil
 }
 
-// Delete delegates to MemStore.Delete and flushes to disk.
-// If the disk flush fails, the in-memory mutation is rolled back.
-func (fs *FileStore) Delete(id string) error {
+// Get reloads the on-disk store before reading a bead by ID.
+func (fs *FileStore) Get(id string) (Bead, error) {
 	fs.fmu.Lock()
 	defer fs.fmu.Unlock()
-	if err := fs.locker.Lock(); err != nil {
-		return err
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return Bead{}, err
 	}
-	defer fs.locker.Unlock() //nolint:errcheck // best-effort unlock
-	if err := fs.reloadFromDisk(); err != nil {
-		return err
+	return fs.MemStore.Get(id)
+}
+
+// List reloads the on-disk store before listing beads that match the query.
+func (fs *FileStore) List(query ListQuery) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
 	}
-	snap := fs.snapshotLocked()
-	if err := fs.MemStore.Delete(id); err != nil {
-		return err
+	return fs.MemStore.List(query)
+}
+
+// ListOpen reloads the on-disk store before listing open beads.
+func (fs *FileStore) ListOpen(status ...string) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
 	}
-	if err := fs.save(); err != nil {
-		fs.restoreFrom(snap.seq, snap.beads, snap.deps)
-		return err
+	return fs.MemStore.ListOpen(status...)
+}
+
+// Ready reloads the on-disk store before listing ready beads.
+func (fs *FileStore) Ready(query ...ReadyQuery) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
 	}
-	return nil
+	return fs.MemStore.Ready(query...)
+}
+
+// Children reloads the on-disk store before listing child beads.
+func (fs *FileStore) Children(parentID string, opts ...QueryOpt) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
+	}
+	return fs.MemStore.Children(parentID, opts...)
+}
+
+// ListByLabel reloads the on-disk store before listing beads for a label.
+func (fs *FileStore) ListByLabel(label string, limit int, opts ...QueryOpt) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
+	}
+	return fs.MemStore.ListByLabel(label, limit, opts...)
+}
+
+// ListByAssignee reloads the on-disk store before listing beads for an assignee.
+func (fs *FileStore) ListByAssignee(assignee, status string, limit int) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
+	}
+	return fs.MemStore.ListByAssignee(assignee, status, limit)
+}
+
+// ListByMetadata reloads the on-disk store before listing beads by metadata.
+func (fs *FileStore) ListByMetadata(filters map[string]string, limit int, opts ...QueryOpt) ([]Bead, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
+	}
+	return fs.MemStore.ListByMetadata(filters, limit, opts...)
 }
 
 // Ping checks that the store file is accessible.
@@ -306,6 +502,16 @@ func (fs *FileStore) DepRemove(issueID, dependsOnID string) error {
 	return nil
 }
 
+// DepList reloads the on-disk store before listing dependencies.
+func (fs *FileStore) DepList(id, direction string) ([]Dep, error) {
+	fs.fmu.Lock()
+	defer fs.fmu.Unlock()
+	if err := fs.refreshReadStateLocked(); err != nil {
+		return nil, err
+	}
+	return fs.MemStore.DepList(id, direction)
+}
+
 // memSnapshot holds a snapshot of MemStore state for rollback.
 type memSnapshot struct {
 	seq   int
@@ -342,5 +548,6 @@ func (fs *FileStore) save() error {
 	if err := fs.fs.Rename(tmp, fs.path); err != nil {
 		return fmt.Errorf("saving file store: %w", err)
 	}
+	fs.refreshFreshnessCache()
 	return nil
 }
diff --git a/internal/beads/filestore_test.go b/internal/beads/filestore_test.go
index 66723f9d8c..4ab24e4b6b 100644
--- a/internal/beads/filestore_test.go
+++ b/internal/beads/filestore_test.go
@@ -15,6 +15,67 @@ import (
 	"github.com/gastownhall/gascity/internal/fsys"
 )
 
+type statRaceFS struct {
+	fsys.FS
+	path            string
+	beforeFirstStat func()
+	fired           bool
+}
+
+func (f *statRaceFS) Stat(name string) (os.FileInfo, error) {
+	if name == f.path && !f.fired {
+		f.fired = true
+		if f.beforeFirstStat != nil {
+			f.beforeFirstStat()
+		}
+	}
+	return f.FS.Stat(name)
+}
+
+type toggledErrorFS struct {
+	fsys.FS
+	path    string
+	statErr error
+	readErr error
+}
+
+func (f *toggledErrorFS) Stat(name string) (os.FileInfo, error) {
+	if name == f.path && f.statErr != nil {
+		return nil, f.statErr
+	}
+	return f.FS.Stat(name)
+}
+
+func (f *toggledErrorFS) ReadFile(name string) ([]byte, error) {
+	if name == f.path && f.readErr != nil {
+		return nil, f.readErr
+	}
+	return f.FS.ReadFile(name)
+}
+
+type oneShotStatErrorFS struct {
+	fsys.FS
+	path  string
+	err   error
+	fired bool
+}
+
+func (f *oneShotStatErrorFS) Stat(name string) (os.FileInfo, error) {
+	if name == f.path && !f.fired {
+		f.fired = true
+		return nil, f.err
+	}
+	return f.FS.Stat(name)
+}
+
+type errLocker struct {
+	lockErr   error
+	unlockErr error
+}
+
+func (l errLocker) Lock() error   { return l.lockErr }
+func (l errLocker) Unlock() error { return l.unlockErr }
+
 func TestFileStore(t *testing.T) {
 	factory := func() beads.Store {
 		path := filepath.Join(t.TempDir(), "beads.json")
@@ -140,6 +201,859 @@ func TestFileStoreMetadataPersistence(t *testing.T) {
 	}
 }
 
+func TestFileStoreRefreshesReadsAcrossOpenInstances(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "beads.json")
+
+	s1, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, err := s1.Create(beads.Bead{
+		Title:  "manual session",
+		Type:   "session",
+		Labels: []string{"gc:session"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s1.SetMetadata(created.ID, "state", "creating"); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := s2.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get(%q) from second handle: %v", created.ID, err)
+	}
+	if got.Metadata["state"] != "creating" {
+		t.Fatalf("Get(%q) metadata[state] = %q, want %q", created.ID, got.Metadata["state"], "creating")
+	}
+
+	sessions, err := s2.List(beads.ListQuery{Label: "gc:session"})
+	if err != nil {
+		t.Fatalf("List(session label) from second handle: %v", err)
+	}
+	if len(sessions) != 1 || sessions[0].ID != created.ID {
+		t.Fatalf("List(session label) = %+v, want only %s", sessions, created.ID)
+	}
+}
+
+func TestFileStoreReadyRefreshesAcrossOpenInstances(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "beads.json")
+
+	s1, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	blocker, err := s1.Create(beads.Bead{Title: "blocker"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	target, err := s1.Create(beads.Bead{Title: "target"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ready, err := s2.Ready()
+	if err != nil {
+		t.Fatalf("Ready() before dep add: %v", err)
+	}
+	if !hasBeadID(ready, blocker.ID) || !hasBeadID(ready, target.ID) {
+		t.Fatalf("Ready() before dep add = %+v, want %s and %s", ready, blocker.ID, target.ID)
+	}
+
+	if err := s1.DepAdd(target.ID, blocker.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd(%s, %s): %v", target.ID, blocker.ID, err)
+	}
+
+	ready, err = s2.Ready()
+	if err != nil {
+		t.Fatalf("Ready() after dep add: %v", err)
+	}
+	if !hasBeadID(ready, blocker.ID) {
+		t.Fatalf("Ready() after dep add = %+v, want blocker %s", ready, blocker.ID)
+	}
+	if hasBeadID(ready, target.ID) {
+		t.Fatalf("Ready() after dep add still contains blocked bead %s: %+v", target.ID, ready)
+	}
+}
+
+func TestFileStoreChildrenRefreshesAcrossOpenInstances(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "beads.json")
+
+	s1, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	parent, err := s1.Create(beads.Bead{Title: "parent"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	children, err := s2.Children(parent.ID)
+	if err != nil {
+		t.Fatalf("Children(%q) before child create: %v", parent.ID, err)
+	}
+	if len(children) != 0 {
+		t.Fatalf("Children(%q) before child create = %+v, want empty", parent.ID, children)
+	}
+
+	child, err := s1.Create(beads.Bead{Title: "child", ParentID: parent.ID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	children, err = s2.Children(parent.ID)
+	if err != nil {
+		t.Fatalf("Children(%q) after child create: %v", parent.ID, err)
+	}
+	if len(children) != 1 || children[0].ID != child.ID {
+		t.Fatalf("Children(%q) after child create = %+v, want only %s", parent.ID, children, child.ID)
+	}
+}
+
+func TestFileStoreDepListRefreshesAcrossOpenInstances(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "beads.json")
+
+	s1, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	a, err := s1.Create(beads.Bead{Title: "a"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := s1.Create(beads.Bead{Title: "b"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	deps, err := s2.DepList(a.ID, "down")
+	if err != nil {
+		t.Fatalf("DepList(%q, down) before dep add: %v", a.ID, err)
+	}
+	if len(deps) != 0 {
+		t.Fatalf("DepList(%q, down) before dep add = %+v, want empty", a.ID, deps)
+	}
+
+	if err := s1.DepAdd(a.ID, b.ID, "blocks"); err != nil {
+		t.Fatalf("DepAdd(%s, %s): %v", a.ID, b.ID, err)
+	}
+
+	deps, err = s2.DepList(a.ID, "down")
+	if err != nil {
+		t.Fatalf("DepList(%q, down) after dep add: %v", a.ID, err)
+	}
+	if len(deps) != 1 || deps[0].DependsOnID != b.ID {
+		t.Fatalf("DepList(%q, down) after dep add = %+v, want one dep on %s", a.ID, deps, b.ID)
+	}
+}
+
+func TestFileStoreListByAssigneeRefreshesAcrossOpenInstances(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "beads.json")
+
+	s1, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	assigned, err := s2.ListByAssignee("mayor", "open", 0)
+	if err != nil {
+		t.Fatalf("ListByAssignee before create: %v", err)
+	}
+	if len(assigned) != 0 {
+		t.Fatalf("ListByAssignee before create = %+v, want empty", assigned)
+	}
+
+	created, err := s1.Create(beads.Bead{Title: "owned", Assignee: "mayor"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	assigned, err = s2.ListByAssignee("mayor", "open", 0)
+	if err != nil {
+		t.Fatalf("ListByAssignee after create: %v", err)
+	}
+	if len(assigned) != 1 || assigned[0].ID != created.ID {
+		t.Fatalf("ListByAssignee after create = %+v, want only %s", assigned, created.ID)
+	}
+}
+
+func TestFileStoreRefreshesAfterOpenRace(t *testing.T) {
+	path := "/city/.gc/beads.json"
+	base := fsys.NewFake()
+
+	s1, err := beads.OpenFileStore(base, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, err := s1.Create(beads.Bead{Title: "alpha"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	racyFS := &statRaceFS{
+		FS:   base,
+		path: path,
+		beforeFirstStat: func() {
+			if err := s1.Update(created.ID, beads.UpdateOpts{Title: ptr("bravo")}); err != nil {
+				t.Fatalf("Update(%q) during open race: %v", created.ID, err)
+			}
+		},
+	}
+
+	s2, err := beads.OpenFileStore(racyFS, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := s2.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get(%q) after open race: %v", created.ID, err)
+	}
+	if got.Title != "bravo" {
+		t.Fatalf("Title after open race = %q, want bravo", got.Title)
+	}
+}
+
+func TestFileStoreSkipsReadReloadWhenFileIsUnchanged(t *testing.T) {
+	f := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	s1, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, err := s1.Create(beads.Bead{Title: "cached bead"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f.Calls = nil
+	for i := 0; i < 2; i++ {
+		if _, err := s2.Get(created.ID); err != nil {
+			t.Fatalf("Get(%q) #%d: %v", created.ID, i+1, err)
+		}
+	}
+
+	var statCalls, readCalls int
+	for _, call := range f.Calls {
+		if call.Path != path {
+			continue
+		}
+		switch call.Method {
+		case "Stat":
+			statCalls++
+		case "ReadFile":
+			readCalls++
+		}
+	}
+	if statCalls != 2 {
+		t.Fatalf("Stat(%s) calls = %d, want 2", path, statCalls)
+	}
+	if readCalls != 1 {
+		t.Fatalf("ReadFile(%s) calls = %d, want 1 after cache warmup", path, readCalls)
+	}
+}
+
+func TestFileStoreRefreshesSameSizeExternalRewrite(t *testing.T) {
+	f := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	s1, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, err := s1.Create(beads.Bead{Title: "alpha"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s2.Get(created.ID); err != nil {
+		t.Fatalf("initial Get(%q): %v", created.ID, err)
+	}
+
+	beforeLen := len(f.Files[path])
+	if err := s1.Update(created.ID, beads.UpdateOpts{Title: ptr("bravo")}); err != nil {
+		t.Fatal(err)
+	}
+	afterLen := len(f.Files[path])
+	if beforeLen != afterLen {
+		t.Fatalf("expected same-size rewrite, got %d -> %d bytes", beforeLen, afterLen)
+	}
+
+	f.Calls = nil
+	got, err := s2.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get(%q) after same-size update: %v", created.ID, err)
+	}
+	if got.Title != "bravo" {
+		t.Fatalf("Title after same-size update = %q, want bravo", got.Title)
+	}
+
+	var readCalls int
+	for _, call := range f.Calls {
+		if call.Method == "ReadFile" && call.Path == path {
+			readCalls++
+		}
+	}
+	if readCalls != 1 {
+		t.Fatalf("ReadFile(%s) calls = %d, want 1 after same-size rewrite", path, readCalls)
+	}
+}
+
+func TestFileStoreMutatorReloadsSameSizeExternalRewriteWithUnchangedFreshness(t *testing.T) {
+	f := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	stale, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writer, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, err := stale.Create(beads.Bead{Title: "alpha"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	originalModTime := f.ModTimes[path]
+	originalLen := len(f.Files[path])
+
+	if err := writer.Update(created.ID, beads.UpdateOpts{Title: ptr("bravo")}); err != nil {
+		t.Fatalf("Update(%q) from second handle: %v", created.ID, err)
+	}
+	if gotLen := len(f.Files[path]); gotLen != originalLen {
+		t.Fatalf("expected same-size external rewrite, got %d -> %d bytes", originalLen, gotLen)
+	}
+	f.ModTimes[path] = originalModTime
+
+	if err := stale.SetMetadata(created.ID, "owner", "controller"); err != nil {
+		t.Fatalf("SetMetadata(%q) from stale handle: %v", created.ID, err)
+	}
+
+	fresh, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := fresh.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get(%q) after stale-handle mutator: %v", created.ID, err)
+	}
+	if got.Title != "bravo" {
+		t.Fatalf("Title after stale-handle mutator = %q, want bravo", got.Title)
+	}
+	if got.Metadata["owner"] != "controller" {
+		t.Fatalf("metadata[owner] after stale-handle mutator = %q, want controller", got.Metadata["owner"])
+	}
+}
+
+func TestFileStoreRefreshFallbackReloadsWhenStatFails(t *testing.T) {
+	base := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	writer, err := beads.OpenFileStore(base, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, err := writer.Create(beads.Bead{Title: "alpha"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	readerFS := &oneShotStatErrorFS{
+		FS:   base,
+		path: path,
+		err:  fmt.Errorf("stat unavailable"),
+	}
+	reader, err := beads.OpenFileStore(readerFS, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := reader.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get(%q) after Stat failure fallback: %v", created.ID, err)
+	}
+	if got.Title != "alpha" {
+		t.Fatalf("Get(%q) title = %q, want alpha", created.ID, got.Title)
+	}
+}
+
+func TestFileStoreRefreshPropagatesReloadErrorAfterExternalRewrite(t *testing.T) {
+	base := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	writer, err := beads.OpenFileStore(base, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, err := writer.Create(beads.Bead{Title: "alpha"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	readerFS := &toggledErrorFS{FS: base, path: path}
+	reader, err := beads.OpenFileStore(readerFS, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reader.Get(created.ID); err != nil {
+		t.Fatalf("initial Get(%q): %v", created.ID, err)
+	}
+
+	if err := writer.Update(created.ID, beads.UpdateOpts{Title: ptr("bravo")}); err != nil {
+		t.Fatalf("Update(%q): %v", created.ID, err)
+	}
+	readerFS.readErr = fmt.Errorf("read boom")
+
+	if _, err := reader.Get(created.ID); err == nil {
+		t.Fatalf("Get(%q) after external rewrite err = nil, want read boom", created.ID)
+	} else if !strings.Contains(err.Error(), "read boom") {
+		t.Fatalf("Get(%q) after external rewrite err = %v, want read boom", created.ID, err)
+	}
+}
+
+func TestFileStoreCreateRewarmsAfterFreshnessStatFailure(t *testing.T) {
+	base := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+	fs := &toggledErrorFS{
+		FS:      base,
+		path:    path,
+		statErr: fmt.Errorf("stat unavailable"),
+	}
+
+	s, err := beads.OpenFileStore(fs, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, err := s.Create(beads.Bead{Title: "alpha"})
+	if err != nil {
+		t.Fatalf("Create() with post-save Stat failure: %v", err)
+	}
+
+	fs.statErr = nil
+	base.Calls = nil
+
+	got, err := s.Get(created.ID)
+	if err != nil {
+		t.Fatalf("Get(%q) after clearing Stat failure: %v", created.ID, err)
+	}
+	if got.Title != "alpha" {
+		t.Fatalf("Get(%q) title = %q, want alpha", created.ID, got.Title)
+	}
+
+	var readCalls int
+	for _, call := range base.Calls {
+		if call.Method == "ReadFile" && call.Path == path {
+			readCalls++
+		}
+	}
+	if readCalls == 0 {
+		t.Fatalf("expected Get(%q) to re-read %s after freshness cache was cleared", created.ID, path)
+	}
+}
+
+func TestFileStoreReadWrappersPropagateRefreshErrors(t *testing.T) {
+	base := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+	fs := &toggledErrorFS{FS: base, path: path}
+
+	s, err := beads.OpenFileStore(fs, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fs.statErr = fmt.Errorf("stat boom")
+	fs.readErr = fmt.Errorf("read boom")
+
+	tests := []struct {
+		name string
+		call func() error
+	}{
+		{
+			name: "Get",
+			call: func() error {
+				_, err := s.Get("gc-1")
+				return err
+			},
+		},
+		{
+			name: "List",
+			call: func() error {
+				_, err := s.List(beads.ListQuery{})
+				return err
+			},
+		},
+		{
+			name: "ListOpen",
+			call: func() error {
+				_, err := s.ListOpen()
+				return err
+			},
+		},
+		{
+			name: "Ready",
+			call: func() error {
+				_, err := s.Ready()
+				return err
+			},
+		},
+		{
+			name: "Children",
+			call: func() error {
+				_, err := s.Children("gc-1")
+				return err
+			},
+		},
+		{
+			name: "ListByLabel",
+			call: func() error {
+				_, err := s.ListByLabel("x", 0)
+				return err
+			},
+		},
+		{
+			name: "ListByAssignee",
+			call: func() error {
+				_, err := s.ListByAssignee("mayor", "open", 0)
+				return err
+			},
+		},
+		{
+			name: "ListByMetadata",
+			call: func() error {
+				_, err := s.ListByMetadata(map[string]string{"k": "v"}, 0)
+				return err
+			},
+		},
+		{
+			name: "DepList",
+			call: func() error {
+				_, err := s.DepList("gc-1", "down")
+				return err
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.call()
+			if err == nil {
+				t.Fatalf("%s() err = nil, want refresh error", tc.name)
+			}
+			if !strings.Contains(err.Error(), "read boom") {
+				t.Fatalf("%s() err = %v, want read boom", tc.name, err)
+			}
+		})
+	}
+}
+
+func TestFileStoreMutatorsPropagateRefreshErrors(t *testing.T) {
+	base := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+	fs := &toggledErrorFS{FS: base, path: path}
+
+	s, err := beads.OpenFileStore(fs, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fs.statErr = fmt.Errorf("stat boom")
+	fs.readErr = fmt.Errorf("read boom")
+
+	tests := []struct {
+		name string
+		call func() error
+	}{
+		{
+			name: "Create",
+			call: func() error {
+				_, err := s.Create(beads.Bead{Title: "x"})
+				return err
+			},
+		},
+		{
+			name: "Update",
+			call: func() error {
+				return s.Update("gc-1", beads.UpdateOpts{Title: ptr("updated")})
+			},
+		},
+		{
+			name: "Close",
+			call: func() error {
+				return s.Close("gc-1")
+			},
+		},
+		{
+			name: "Delete",
+			call: func() error {
+				return s.Delete("gc-1")
+			},
+		},
+		{
+			name: "CloseAll",
+			call: func() error {
+				_, err := s.CloseAll([]string{"gc-1"}, map[string]string{"phase": "done"})
+				return err
+			},
+		},
+		{
+			name: "SetMetadata",
+			call: func() error {
+				return s.SetMetadata("gc-1", "k", "v")
+			},
+		},
+		{
+			name: "SetMetadataBatch",
+			call: func() error {
+				return s.SetMetadataBatch("gc-1", map[string]string{"k": "v"})
+			},
+		},
+		{
+			name: "DepAdd",
+			call: func() error {
+				return s.DepAdd("gc-1", "gc-2", "blocks")
+			},
+		},
+		{
+			name: "DepRemove",
+			call: func() error {
+				return s.DepRemove("gc-1", "gc-2")
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.call()
+			if err == nil {
+				t.Fatalf("%s() err = nil, want refresh error", tc.name)
+			}
+			if !strings.Contains(err.Error(), "read boom") {
+				t.Fatalf("%s() err = %v, want read boom", tc.name, err)
+			}
+		})
+	}
+}
+
+func TestFileStoreCloseAllRefreshesAcrossOpenInstances(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "beads.json")
+
+	s1, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(fsys.OSFS{}, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	first, err := s1.Create(beads.Bead{Title: "first", Labels: []string{"x"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := s1.Create(beads.Bead{Title: "second", Labels: []string{"x"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	closed, err := s1.CloseAll([]string{first.ID, second.ID}, map[string]string{"gc.batch": "done"})
+	if err != nil {
+		t.Fatalf("CloseAll(): %v", err)
+	}
+	if closed != 2 {
+		t.Fatalf("CloseAll() closed = %d, want 2", closed)
+	}
+
+	open, err := s2.ListOpen()
+	if err != nil {
+		t.Fatalf("ListOpen() after CloseAll: %v", err)
+	}
+	if len(open) != 0 {
+		t.Fatalf("ListOpen() after CloseAll = %+v, want empty", open)
+	}
+
+	got, err := s2.ListByMetadata(map[string]string{"gc.batch": "done"}, 0, beads.IncludeClosed)
+	if err != nil {
+		t.Fatalf("ListByMetadata() after CloseAll: %v", err)
+	}
+	if len(got) != 2 || !hasBeadID(got, first.ID) || !hasBeadID(got, second.ID) {
+		t.Fatalf("ListByMetadata() after CloseAll = %+v, want %s and %s", got, first.ID, second.ID)
+	}
+}
+
+func TestFileStoreClearsCacheWhenBackingFileDisappears(t *testing.T) {
+	f := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	s1, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, err := s1.Create(beads.Bead{Title: "ephemeral"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s2.Get(created.ID); err != nil {
+		t.Fatalf("initial Get(%q): %v", created.ID, err)
+	}
+
+	if err := f.Remove(path); err != nil {
+		t.Fatalf("Remove(%s): %v", path, err)
+	}
+
+	if _, err := s2.Get(created.ID); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("Get(%q) after external delete err = %v, want ErrNotFound", created.ID, err)
+	}
+
+	got, err := s2.ListOpen()
+	if err != nil {
+		t.Fatalf("ListOpen() after external delete: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("ListOpen() after external delete = %+v, want empty", got)
+	}
+}
+
+func TestFileStoreDeletePersistsAcrossOpenInstances(t *testing.T) {
+	f := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	s1, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created, err := s1.Create(beads.Bead{Title: "ephemeral"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s2.Get(created.ID); err != nil {
+		t.Fatalf("initial Get(%q): %v", created.ID, err)
+	}
+
+	if err := s1.Delete(created.ID); err != nil {
+		t.Fatalf("Delete(%q): %v", created.ID, err)
+	}
+
+	if _, err := s2.Get(created.ID); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("Get(%q) after persisted delete err = %v, want ErrNotFound", created.ID, err)
+	}
+
+	got, err := s2.ListOpen()
+	if err != nil {
+		t.Fatalf("ListOpen() after persisted delete: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("ListOpen() after persisted delete = %+v, want empty", got)
+	}
+}
+
+func TestFileStoreDeletePropagatesLockError(t *testing.T) {
+	f := fsys.NewFake()
+	s, err := beads.OpenFileStore(f, "/city/.gc/beads.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.SetLocker(errLocker{lockErr: fmt.Errorf("lock boom")})
+
+	if err := s.Delete("gc-1"); err == nil {
+		t.Fatal("Delete(gc-1) err = nil, want lock boom")
+	} else if !strings.Contains(err.Error(), "lock boom") {
+		t.Fatalf("Delete(gc-1) err = %v, want lock boom", err)
+	}
+}
+
+func TestFileStoreDeletePropagatesMemStoreError(t *testing.T) {
+	f := fsys.NewFake()
+	s, err := beads.OpenFileStore(f, "/city/.gc/beads.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := s.Delete("gc-404"); !errors.Is(err, beads.ErrNotFound) {
+		t.Fatalf("Delete(gc-404) err = %v, want ErrNotFound", err)
+	}
+}
+
+func TestFileStoreDeleteRollsBackWhenSaveFails(t *testing.T) {
+	f := fsys.NewFake()
+	path := "/city/.gc/beads.json"
+
+	s1, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created, err := s1.Create(beads.Bead{Title: "keep me"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f.Errors[path+".tmp"] = fmt.Errorf("disk full")
+
+	err = s1.Delete(created.ID)
+	if err == nil {
+		t.Fatalf("Delete(%q) err = nil, want disk full", created.ID)
+	}
+	if !strings.Contains(err.Error(), "disk full") {
+		t.Fatalf("Delete(%q) err = %v, want disk full", created.ID, err)
+	}
+
+	delete(f.Errors, path+".tmp")
+
+	if _, err := s1.Get(created.ID); err != nil {
+		t.Fatalf("Get(%q) after rollback: %v", created.ID, err)
+	}
+
+	s2, err := beads.OpenFileStore(f, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s2.Get(created.ID); err != nil {
+		t.Fatalf("Get(%q) after reopen: %v", created.ID, err)
+	}
+}
+
 func TestFileStoreDeletePersistence(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "beads.json")
 
@@ -166,6 +1080,19 @@ func TestFileStoreDeletePersistence(t *testing.T) {
 	}
 }
 
+func ptr[T any](v T) *T {
+	return &v
+}
+
+func hasBeadID(beadsList []beads.Bead, id string) bool {
+	for _, b := range beadsList {
+		if b.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
 func TestFileStoreChildrenExcludeClosedByDefault(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "beads.json")
 	s, err := beads.OpenFileStore(fsys.OSFS{}, path)
diff --git a/internal/beads/live_ready.go b/internal/beads/live_ready.go
index 9b0d201fd8..884a51cbae 100644
--- a/internal/beads/live_ready.go
+++ b/internal/beads/live_ready.go
@@ -3,12 +3,12 @@ package beads
 // ReadyLive returns ready beads using the backing store when a caching layer is
 // present. Other Store implementations ignore the live-read intent and fall
 // back to their normal Ready behavior.
-func ReadyLive(store Store) ([]Bead, error) {
+func ReadyLive(store Store, query ...ReadyQuery) ([]Bead, error) {
 	type backingStore interface {
 		Backing() Store
 	}
 	if cached, ok := store.(backingStore); ok && cached.Backing() != nil {
-		return cached.Backing().Ready()
+		return cached.Backing().Ready(query...)
 	}
-	return store.Ready()
+	return store.Ready(query...)
 }
diff --git a/internal/beads/live_ready_test.go b/internal/beads/live_ready_test.go
index a87dd79a04..42831ccece 100644
--- a/internal/beads/live_ready_test.go
+++ b/internal/beads/live_ready_test.go
@@ -11,11 +11,11 @@ type flakyReadyStore struct {
 	failReady error
 }
 
-func (s *flakyReadyStore) Ready() ([]Bead, error) {
+func (s *flakyReadyStore) Ready(query ...ReadyQuery) ([]Bead, error) {
 	if s.failReady != nil {
 		return nil, s.failReady
 	}
-	return s.MemStore.Ready()
+	return s.MemStore.Ready(query...)
 }
 
 func TestReadyLiveBypassesCachingStore(t *testing.T) {
diff --git a/internal/beads/memstore.go b/internal/beads/memstore.go
index 2cbb85c765..edb4616d6b 100644
--- a/internal/beads/memstore.go
+++ b/internal/beads/memstore.go
@@ -174,6 +174,20 @@ func (m *MemStore) Close(id string) error {
 	return fmt.Errorf("closing bead %q: %w", id, ErrNotFound)
 }
 
+// Reopen sets a bead's status to "open". Returns a wrapped ErrNotFound if the
+// ID does not exist.
+func (m *MemStore) Reopen(id string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for i := range m.beads {
+		if m.beads[i].ID == id {
+			m.beads[i].Status = "open"
+			return nil
+		}
+	}
+	return fmt.Errorf("reopening bead %q: %w", id, ErrNotFound)
+}
+
 // CloseAll closes multiple beads in a single batch and sets metadata on each.
 func (m *MemStore) CloseAll(ids []string, metadata map[string]string) (int, error) {
 	m.mu.Lock()
@@ -231,7 +245,8 @@ func (m *MemStore) ListOpen(status ...string) ([]Bead, error) {
 
 // Ready returns all open beads with no open blocking dependencies, in
 // creation order.
-func (m *MemStore) Ready() ([]Bead, error) {
+func (m *MemStore) Ready(query ...ReadyQuery) ([]Bead, error) {
+	q := readyQueryFromArgs(query)
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -248,6 +263,9 @@ func (m *MemStore) Ready() ([]Bead, error) {
 		if IsReadyExcludedType(b.Type) {
 			continue
 		}
+		if q.Assignee != "" && b.Assignee != q.Assignee {
+			continue
+		}
 		blocked := false
 		for _, dep := range m.deps {
 			if dep.IssueID != b.ID {
@@ -265,6 +283,9 @@ func (m *MemStore) Ready() ([]Bead, error) {
 		}
 		if !blocked {
 			result = append(result, cloneBead(b))
+			if q.Limit > 0 && len(result) >= q.Limit {
+				break
+			}
 		}
 	}
 	return result, nil
diff --git a/internal/beads/query.go b/internal/beads/query.go
index 591daf4561..814f2be20e 100644
--- a/internal/beads/query.go
+++ b/internal/beads/query.go
@@ -43,6 +43,21 @@ type ListQuery struct {
 	Sort SortOrder
 }
 
+// ReadyQuery describes optional filters for ready-work lookup. A zero-value
+// query preserves Ready's historical behavior: all open, unblocked actionable
+// work.
+type ReadyQuery struct {
+	Assignee string
+	Limit    int
+}
+
+func readyQueryFromArgs(queries []ReadyQuery) ReadyQuery {
+	if len(queries) == 0 {
+		return ReadyQuery{}
+	}
+	return queries[0]
+}
+
 // HasFilter reports whether the query includes at least one indexed selector.
 func (q ListQuery) HasFilter() bool {
 	return q.Status != "" ||
diff --git a/internal/bootstrap/packs/core/assets/prompts/graph-worker.md b/internal/bootstrap/packs/core/assets/prompts/graph-worker.md
index 65407ef8e5..3ae25b149c 100644
--- a/internal/bootstrap/packs/core/assets/prompts/graph-worker.md
+++ b/internal/bootstrap/packs/core/assets/prompts/graph-worker.md
@@ -22,6 +22,12 @@ bd ready --assignee="$GC_SESSION_NAME" --json --limit=1
 
 # Step 3: If still nothing, check the routed queue (multi-session configs only)
 gc hook
+
+# Step 4: If gc hook returned an unassigned routed bead, claim it atomically
+bd update <id> --claim
+
+# Step 5: Verify the claim before doing work
+bd show <id> --json
 ```
 
 If you have no work after all three checks, run:
@@ -33,14 +39,20 @@ gc runtime drain-ack
 ## How To Work
 
 1. Find your assigned bead (see Startup above).
-2. Read it with `bd show <id>`.
-3. **Claim continuation group** (see below).
-4. Execute exactly that bead's description.
-5. On success, close it:
+2. If the bead came from `gc hook`, claim it with `bd update <id> --claim`
+   before doing any work. Do not start work with `bd update --status in_progress`;
+   only `--claim` sets both assignee and in-progress state atomically.
+3. Verify the claimed bead is assigned to `$GC_SESSION_NAME` and routed to
+   `$GC_TEMPLATE`. If either check fails, do not work that bead; run `gc hook`
+   again or drain if no valid work is available.
+4. Read it with `bd show <id>`.
+5. **Claim continuation group** (see below).
+6. Execute exactly that bead's description.
+7. On success, close it:
    ```bash
    bd update <id> --set-metadata gc.outcome=pass --status closed
    ```
-6. On transient failure, mark it transient and close it:
+8. On transient failure, mark it transient and close it:
    ```bash
    bd update <id> \
      --set-metadata gc.outcome=fail \
@@ -48,7 +60,7 @@ gc runtime drain-ack
      --set-metadata gc.failure_reason=<short_reason> \
      --status closed
    ```
-7. On unrecoverable failure, mark it hard-failed and close it:
+9. On unrecoverable failure, mark it hard-failed and close it:
    ```bash
    bd update <id> \
      --set-metadata gc.outcome=fail \
@@ -56,11 +68,11 @@ gc runtime drain-ack
      --set-metadata gc.failure_reason=<short_reason> \
      --status closed
    ```
-8. After closing, check for more assigned work:
+10. After closing, check for more assigned work:
    ```bash
    bd ready --assignee="$GC_SESSION_NAME" --json --limit=1
    ```
-9. If more work exists, go to step 2. If not, poll briefly (see below).
+11. If more work exists, go to step 2. If not, poll briefly (see below).
 
 ## Continuation Group — Session Affinity
 
diff --git a/internal/bootstrap/packs/core/assets/prompts/pool-worker.md b/internal/bootstrap/packs/core/assets/prompts/pool-worker.md
index ce82068bae..f939e9609e 100644
--- a/internal/bootstrap/packs/core/assets/prompts/pool-worker.md
+++ b/internal/bootstrap/packs/core/assets/prompts/pool-worker.md
@@ -20,17 +20,23 @@ bd list --assignee="$GC_SESSION_NAME" --status=in_progress
 # Step 2: If nothing in-progress, check for assigned ready work
 bd ready --assignee="$GC_SESSION_NAME"
 
-# Step 3: If still nothing, check the pool queue
-bd ready --metadata-field gc.routed_to=$GC_TEMPLATE --unassigned
+# Step 3: If still nothing, check the routed queue
+gc hook
 
 # Step 4: Claim it
 bd update <id> --claim
 
-# Step 5: Read the bead and check for molecule_id in METADATA
+# Step 5: Verify the claim before doing work
+bd show <id> --json
+
+# Step 6: Read the bead and check for molecule_id in METADATA
 bd show <id>
 ```
 
 If nothing is available, run `gc runtime drain-ack` to end your session.
+After claiming, verify `assignee` is `$GC_SESSION_NAME` and
+`metadata.gc.routed_to` is `$GC_TEMPLATE`. If either check fails, do not work
+that bead; run `gc hook` again or drain if no valid work is available.
 
 ## Following Your Formula
 
@@ -72,7 +78,7 @@ the bead description directly.
 ## Your Tools
 
 - `bd ready --assignee="$GC_SESSION_NAME"` — find pre-assigned work
-- `bd ready --metadata-field gc.routed_to=$GC_TEMPLATE --unassigned` — find pool work
+- `gc hook` — find routed pool work through the configured hook
 - `bd update <id> --claim` — claim a work item
 - `bd show <id>` — see details of a work item or step
 - `bd mol current <molecule-id>` — show position in molecule workflow
@@ -83,13 +89,14 @@ the bead description directly.
 
 ## How to Work
 
-1. Find work: `bd list --assignee="$GC_SESSION_NAME" --status=in_progress` or `bd ready --assignee="$GC_SESSION_NAME"` or `bd ready --metadata-field gc.routed_to=$GC_TEMPLATE --unassigned`
+1. Find work: `bd list --assignee="$GC_SESSION_NAME" --status=in_progress` or `bd ready --assignee="$GC_SESSION_NAME"` or `gc hook`
 2. Claim if unclaimed: `bd update <id> --claim`
-3. **Check for molecule:** `bd show <id>` — look for `molecule_id` in METADATA
-4. **If molecule exists:** `bd mol current <mol-id>` → work each step in order (show → do → close → repeat)
-5. **If no molecule:** execute the work directly from the bead description
-6. When all work is done, close the bead: `bd close <id>`
-7. **MANDATORY — run this exact command as your final action:**
+3. Verify the claimed bead is assigned to `$GC_SESSION_NAME` and routed to `$GC_TEMPLATE`
+4. **Check for molecule:** `bd show <id>` — look for `molecule_id` in METADATA
+5. **If molecule exists:** `bd mol current <mol-id>` → work each step in order (show → do → close → repeat)
+6. **If no molecule:** execute the work directly from the bead description
+7. When all work is done, close the bead: `bd close <id>`
+8. **MANDATORY — run this exact command as your final action:**
    ```bash
    gc runtime drain-ack
    ```
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/codex/.codex/hooks.json b/internal/bootstrap/packs/core/overlay/per-provider/codex/.codex/hooks.json
index bce9dc4b6e..21ce034fd2 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/codex/.codex/hooks.json
+++ b/internal/bootstrap/packs/core/overlay/per-provider/codex/.codex/hooks.json
@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc prime --hook"
+            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc prime --hook --hook-format codex"
           }
         ]
       }
@@ -17,22 +17,11 @@
         "hooks": [
           {
             "type": "command",
-            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc nudge drain --inject"
+            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc nudge drain --inject --hook-format codex"
           },
           {
             "type": "command",
-            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc mail check --inject"
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc hook --inject"
+            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc mail check --inject --hook-format codex"
           }
         ]
       }
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/copilot-instructions.md b/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/copilot-instructions.md
index c7a4515a7e..4a88624474 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/copilot-instructions.md
+++ b/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/copilot-instructions.md
@@ -17,14 +17,21 @@ check for new messages from other agents or the controller.
 
 ## Work pickup
 
-When you finish your current task or have no active work, run
-`gc hook --inject` to check for and claim new work from the queue.
+Session startup should include the claim protocol for assigned work. When you
+finish your current task or have no active work mid-session, run `gc hook` to
+check for routed work, then claim exactly one returned bead with
+`bd update <id> --claim` before working it.
+
+`gc hook --inject` is legacy compatibility for older Stop/session-end hook
+files. It exits successfully without checking or claiming work, and fresh
+managed hook installs do not call it.
 
 ## Key commands
 
 - `gc prime` — load/reload agent context
 - `gc mail check --inject` — check for inter-agent messages
-- `gc hook --inject` — check for and claim available work
+- `gc hook` — check for available routed work
+- `bd update <id> --claim` — claim one bead before working it
 - `bd ready` — list ready beads (tasks)
 - `bd show <id>` — show bead details
 - `bd close <id>` — mark a bead as done
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/hooks/gascity.json b/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/hooks/gascity.json
index 0d758f0b99..da72529e86 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/hooks/gascity.json
+++ b/internal/bootstrap/packs/core/overlay/per-provider/copilot/.github/hooks/gascity.json
@@ -19,13 +19,6 @@
         "bash": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc mail check --inject",
         "timeoutSec": 10
       }
-    ],
-    "sessionEnd": [
-      {
-        "type": "command",
-        "bash": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc hook --inject",
-        "timeoutSec": 10
-      }
     ]
   }
 }
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/cursor/.cursor/hooks.json b/internal/bootstrap/packs/core/overlay/per-provider/cursor/.cursor/hooks.json
index 498ead1f44..36ff9aa657 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/cursor/.cursor/hooks.json
+++ b/internal/bootstrap/packs/core/overlay/per-provider/cursor/.cursor/hooks.json
@@ -8,7 +8,7 @@
     ],
     "preCompact": [
       {
-        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc handoff \"context cycle\""
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc handoff --auto \"context cycle\""
       }
     ],
     "beforeSubmitPrompt": [
@@ -18,11 +18,6 @@
       {
         "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc mail check --inject"
       }
-    ],
-    "stop": [
-      {
-        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc hook --inject"
-      }
     ]
   }
 }
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/gemini/.gemini/settings.json b/internal/bootstrap/packs/core/overlay/per-provider/gemini/.gemini/settings.json
index a1d0c0b742..a1cb071dfa 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/gemini/.gemini/settings.json
+++ b/internal/bootstrap/packs/core/overlay/per-provider/gemini/.gemini/settings.json
@@ -38,21 +38,6 @@
           {
             "type": "command",
             "command": "gc mail check --inject --hook-format gemini"
-          },
-          {
-            "type": "command",
-            "command": "gc hook --inject --hook-format gemini"
-          }
-        ]
-      }
-    ],
-    "SessionEnd": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "gc hook --inject --hook-format gemini"
           }
         ]
       }
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/omp/.omp/hooks/gc-hook.ts b/internal/bootstrap/packs/core/overlay/per-provider/omp/.omp/hooks/gc-hook.ts
index d33ef1e703..9eaf8a481d 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/omp/.omp/hooks/gc-hook.ts
+++ b/internal/bootstrap/packs/core/overlay/per-provider/omp/.omp/hooks/gc-hook.ts
@@ -4,7 +4,6 @@
 // Events:
 //   session.created    → gc prime (load context)
 //   session.compacted  → gc prime (reload after compaction)
-//   session.deleted    → gc hook --inject (pick up work on exit)
 //   chat.system.transform → gc nudge drain --inject + gc mail check --inject
 
 import { execSync } from "child_process";
@@ -30,7 +29,6 @@ export default {
   events: {
     "session.created": () => run("gc prime --hook"),
     "session.compacted": () => run("gc prime --hook"),
-    "session.deleted": () => run("gc hook --inject"),
   },
 
   hooks: {
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/opencode/.opencode/plugins/gascity.js b/internal/bootstrap/packs/core/overlay/per-provider/opencode/.opencode/plugins/gascity.js
index 80ae2d69fd..9bc3e98d98 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/opencode/.opencode/plugins/gascity.js
+++ b/internal/bootstrap/packs/core/overlay/per-provider/opencode/.opencode/plugins/gascity.js
@@ -8,11 +8,12 @@
 // Gas City uses:
 //   - session.created / session.compacted → gc prime --hook (side effects such
 //     as session-id persistence and poller bootstrap)
-//   - session.deleted → gc hook --inject (pick up newly queued work on exit)
 //   - experimental.chat.system.transform → inject gc prime --hook, queued
 //     nudges, and unread mail into the system prompt for each turn
 
 import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
@@ -33,7 +34,54 @@ async function run(directory, ...args) {
   }
 }
 
-export default async function gascityPlugin({ directory }) {
+function unwrapData(result) {
+  if (result && typeof result === "object" && "data" in result) {
+    return result.data;
+  }
+  return result;
+}
+
+function safeSessionID(sessionID) {
+  return String(sessionID || "").replace(/[^A-Za-z0-9_.-]/g, "_");
+}
+
+function sessionIDFromEvent(event) {
+  return (
+    event?.properties?.sessionID ||
+    event?.properties?.info?.sessionID ||
+    event?.properties?.message?.info?.sessionID ||
+    ""
+  );
+}
+
+async function mirrorTranscript(directory, client, sessionID) {
+  const exportDir = process.env.GC_OPENCODE_TRANSCRIPT_DIR || "";
+  const safeID = safeSessionID(sessionID);
+  if (!exportDir || !safeID || !client?.session) {
+    return;
+  }
+
+  try {
+    const [infoResult, messagesResult] = await Promise.all([
+      client.session.get({ path: { id: sessionID } }),
+      client.session.messages({ path: { id: sessionID } }),
+    ]);
+    const info = unwrapData(infoResult) || {};
+    const messages = unwrapData(messagesResult) || [];
+    if (!info.directory) {
+      info.directory = directory;
+    }
+    await fs.mkdir(exportDir, { recursive: true });
+    const dst = path.join(exportDir, `${safeID}.json`);
+    const tmp = `${dst}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify({ info, messages }, null, 2));
+    await fs.rename(tmp, dst);
+  } catch {
+    return;
+  }
+}
+
+export default async function gascityPlugin({ directory, client }) {
   let cachedPrime = null;
 
   async function readPrime(force = false) {
@@ -60,9 +108,11 @@ export default async function gascityPlugin({ directory }) {
         case "session.created":
         case "session.compacted":
           await readPrime(true);
+          await mirrorTranscript(directory, client, sessionIDFromEvent(event));
           return;
-        case "session.deleted":
-          await run(directory, "hook", "--inject");
+        case "session.idle":
+        case "message.updated":
+          await mirrorTranscript(directory, client, sessionIDFromEvent(event));
           return;
         default:
           return;
diff --git a/internal/bootstrap/packs/core/overlay/per-provider/pi/.pi/extensions/gc-hooks.js b/internal/bootstrap/packs/core/overlay/per-provider/pi/.pi/extensions/gc-hooks.js
index cfda921966..721d62c510 100644
--- a/internal/bootstrap/packs/core/overlay/per-provider/pi/.pi/extensions/gc-hooks.js
+++ b/internal/bootstrap/packs/core/overlay/per-provider/pi/.pi/extensions/gc-hooks.js
@@ -1,20 +1,23 @@
 // Gas City hooks for Pi Coding Agent.
 // Installed by gc into {workDir}/.pi/extensions/gc-hooks.js
 //
+// Pi 0.70+ extension API uses a factory function and pi.on(...)
+// subscriptions. Keep this file as .js for existing Gas City provider args
+// and auto-discovery paths.
+//
 // Events:
-//   session.created    → gc prime (load context)
-//   session.compacted  → gc prime (reload after compaction)
-//   session.deleted    → gc hook --inject (pick up work on exit)
-//   chat.system.transform → gc nudge drain --inject + gc mail check --inject
+//   session_start    → gc prime --hook (load context side effects)
+//   session_compact  → gc prime --hook (reload after compaction)
+//   before_agent_start → gc nudge drain --inject + gc mail check --inject
 
-const { execSync } = require("child_process");
+const { execFileSync } = require("node:child_process");
 
-const PATH_PREFIX =
-  `${process.env.HOME}/go/bin:${process.env.HOME}/.local/bin:`;
+const PATH_PREFIX = `${process.env.HOME}/go/bin:${process.env.HOME}/.local/bin:`;
 
-function run(cmd) {
+function run(args, cwd) {
   try {
-    return execSync(cmd, {
+    return execFileSync("gc", args, {
+      cwd: cwd || process.cwd(),
       encoding: "utf-8",
       timeout: 30000,
       env: { ...process.env, PATH: PATH_PREFIX + (process.env.PATH || "") },
@@ -24,24 +27,29 @@ function run(cmd) {
   }
 }
 
-module.exports = {
-  name: "gascity",
+function appendSystemPrompt(systemPrompt, additions) {
+  const extras = additions.filter(Boolean);
+  if (extras.length === 0) {
+    return systemPrompt;
+  }
+  return [systemPrompt, ...extras].filter(Boolean).join("\n\n");
+}
+
+module.exports = function gascityPiExtension(pi) {
+  pi.on("session_start", (_event, ctx) => {
+    run(["prime", "--hook"], ctx.cwd);
+  });
 
-  events: {
-    "session.created": () => run("gc prime --hook"),
-    "session.compacted": () => run("gc prime --hook"),
-    "session.deleted": () => run("gc hook --inject"),
-  },
+  pi.on("session_compact", (_event, ctx) => {
+    run(["prime", "--hook"], ctx.cwd);
+  });
 
-  hooks: {
-    "experimental.chat.system.transform": (system) => {
-      const nudges = run("gc nudge drain --inject");
-      const mail = run("gc mail check --inject");
-      const extras = [nudges, mail].filter(Boolean);
-      if (extras.length > 0) {
-        return system + "\n\n" + extras.join("\n\n");
-      }
-      return system;
-    },
-  },
+  pi.on("before_agent_start", (event, ctx) => {
+    const nudges = run(["nudge", "drain", "--inject"], ctx.cwd);
+    const mail = run(["mail", "check", "--inject"], ctx.cwd);
+    const systemPrompt = appendSystemPrompt(event.systemPrompt, [nudges, mail]);
+    if (systemPrompt !== event.systemPrompt) {
+      return { systemPrompt };
+    }
+  });
 };
diff --git a/internal/cityinit/cityinit.go b/internal/cityinit/cityinit.go
index 903dc68df7..8d39a9e979 100644
--- a/internal/cityinit/cityinit.go
+++ b/internal/cityinit/cityinit.go
@@ -1,27 +1,19 @@
-// Package cityinit is the domain contract for city scaffolding and
-// finalization. It defines the typed request, result, and sentinel
-// errors that both projections — the CLI (cmd/gc/cmd_init.go) and the
-// HTTP API (internal/api/huma_handlers_supervisor.go:humaHandleCityCreate) —
-// use when creating a new city.
+// Package cityinit owns the typed city scaffolding/finalization service
+// used by the CLI and HTTP API projections.
 //
-// The Initializer interface is implemented in cmd/gc (where the
-// scaffold + finalize body currently lives) and injected into the
-// HTTP supervisor at construction. The HTTP handler calls
-// Initializer.Init in-process; there is no subprocess, no
-// 30-second deadline, no stderr-scraping for error dispatch.
+// The scaffold + finalize bodies are still being split out of cmd/gc,
+// so Service receives those side-effecting operations as dependencies.
+// The orchestration, validation, rollback, and lifecycle event emission
+// now live here instead of in the transport layers.
 //
-// A follow-up refactor will physically move the scaffold/finalize
-// body into this package so the domain logic lives in internal/
-// (per engdocs/architecture/api-control-plane.md §1). Until then, injecting the
-// implementation from cmd/gc at startup preserves the architectural
-// intent that "the CLI and the HTTP API are projections over the
-// shared object model" — both surfaces drive the same code path via
-// the same typed contract.
+// The HTTP handler calls Service.Scaffold in-process; there is no
+// subprocess, no 30-second deadline, and no stderr-scraping for error
+// dispatch.
 package cityinit
 
 import (
-	"context"
 	"errors"
+	"fmt"
 )
 
 // Typed sentinel errors. Both projections map them to their own
@@ -35,9 +27,13 @@ var (
 	// surface, depending on flags.
 	ErrAlreadyInitialized = errors.New("city already initialized")
 
+	// ErrInvalidDirectory indicates the requested city directory is
+	// missing or not absolute. The HTTP API maps this to 422
+	// Unprocessable Entity.
+	ErrInvalidDirectory = errors.New("invalid city directory")
+
 	// ErrInvalidProvider indicates an unknown builtin provider. The
-	// HTTP API maps this to 400 Bad Request (or 422 Unprocessable
-	// Entity at the typed-input layer).
+	// HTTP API maps this to 422 Unprocessable Entity.
 	ErrInvalidProvider = errors.New("invalid provider")
 
 	// ErrInvalidBootstrapProfile indicates an unrecognized
@@ -63,11 +59,16 @@ var (
 	// Usually a bug in the scaffold step; maps to 500.
 	ErrConfigLoad = errors.New("loading city config")
 
-	// ErrNotWired indicates the HTTP handler was called before a
-	// concrete Initializer was injected into the supervisor. This
-	// is a programmer-bug tripwire: every SupervisorMux constructed
-	// at runtime must have a non-nil Initializer.
-	ErrNotWired = errors.New("cityinit: no Initializer wired into supervisor")
+	// ErrPostRegisterFailure indicates the city was committed to the
+	// supervisor registry before a later scaffold-side effect failed.
+	// HTTP callers keep the 202 request_id contract and receive the
+	// failure through request.failed instead of a synchronous error.
+	ErrPostRegisterFailure = errors.New("post-register city init failure")
+
+	// ErrNotWired indicates the service was constructed without a
+	// required dependency. This is a programmer-bug tripwire for
+	// process wiring.
+	ErrNotWired = errors.New("cityinit: service dependency not wired")
 
 	// ErrNotRegistered indicates Unregister was called for a city
 	// that is not in the supervisor registry. Maps to 404 Not Found
@@ -75,9 +76,17 @@ var (
 	ErrNotRegistered = errors.New("city not registered with supervisor")
 )
 
+// NewPostRegisterFailure wraps err with ErrPostRegisterFailure.
+func NewPostRegisterFailure(err error) error {
+	if err == nil {
+		return nil
+	}
+	return fmt.Errorf("%w: %w", ErrPostRegisterFailure, err)
+}
+
 // InitRequest is the typed input. Both projections populate it from
 // their own surface (CLI flags, HTTP request body) and hand it to
-// Initializer.Init; neither duplicates validation or logic.
+// Service.Init or Service.Scaffold; neither duplicates validation or logic.
 type InitRequest struct {
 	// Dir is the absolute path of the new city directory. Callers
 	// resolve relative paths before invoking Init (the CLI uses
@@ -104,10 +113,9 @@ type InitRequest struct {
 
 	// SkipProviderReadiness skips the provider-auth preflight when
 	// true. The async HTTP create handler defaults to true and
-	// surfaces dependency/provider blockers later via the terminal
-	// city.init_failed event on /v0/events/stream. The CLI defaults
-	// to false so first-time users see auth-needed errors
-	// immediately.
+	// surfaces dependency/provider blockers later via request.failed
+	// on /v0/events/stream. The CLI defaults to false so first-time
+	// users see auth-needed errors immediately.
 	SkipProviderReadiness bool
 
 	// ConfigName selects the scaffold template. One of "tutorial"
@@ -134,62 +142,13 @@ type InitResult struct {
 	// Resumed is true when Init detected an existing scaffold and
 	// skipped to finalization only.
 	Resumed bool
-}
 
-// Initializer is the domain contract for city lifecycle on the
-// supervisor: scaffolding, finalization, and unregistration. Exactly
-// one implementation exists per process, supplied at supervisor
-// construction (see internal/api.NewSupervisorMux). Both projections
-// — CLI and HTTP API — drive the same code path via this interface.
-type Initializer interface {
-	// Init scaffolds + finalizes a new city.
-	//
-	// Preconditions: req.Dir is an absolute path; exactly one of
-	// req.Provider / req.StartCommand is set; req.BootstrapProfile
-	// is a known value.
-	//
-	// Postconditions on nil error: the directory contains a
-	// complete city scaffold; the bead provider is initialized; the
-	// city is registered with any running supervisor.
-	//
-	// Errors returned wrap one of the ErrXxx sentinels in this
-	// package so callers can dispatch via errors.Is.
-	Init(ctx context.Context, req InitRequest) (*InitResult, error)
-
-	// Scaffold writes the new city's on-disk shape and registers it
-	// with the supervisor — the fast portion of Init. Used by the
-	// HTTP API handler behind POST /v0/city so it can return 202
-	// Accepted immediately instead of blocking on the slow finalize
-	// work. The supervisor reconciler takes over from there; city
-	// readiness is signaled via city.ready / city.init_failed
-	// events on the supervisor event bus, not via the handler's
-	// response body.
-	//
-	// The implementation emits a city.created event before
-	// returning so subscribers of /v0/events/stream observe the
-	// new city before Finalize begins.
-	Scaffold(ctx context.Context, req InitRequest) (*InitResult, error)
-
-	// Unregister removes the city from the supervisor's registry
-	// and signals the supervisor to reconcile. Used by the HTTP API
-	// handler behind POST /v0/city/{cityName}/unregister so it can
-	// return 202 Accepted immediately while the reconciler stops
-	// the controller asynchronously.
-	//
-	// Returns ErrNotRegistered if the named city is not in the
-	// registry. On nil error, emits a city.unregister_requested
-	// event to the city's event log so subscribers of
-	// /v0/events/stream observe the start of the teardown. The
-	// terminal completion event (city.unregistered or
-	// city.unregister_failed) is emitted by the supervisor
-	// reconciler once the city's controller finishes stopping.
-	//
-	// The city directory itself is NOT touched. Users that want to
-	// purge the directory remove it separately.
-	Unregister(ctx context.Context, req UnregisterRequest) (*UnregisterResult, error)
+	// ReloadWarning is non-empty when the supervisor reload after
+	// scaffold succeeded but returned a best-effort error.
+	ReloadWarning string
 }
 
-// UnregisterRequest is the typed input for Initializer.Unregister.
+// UnregisterRequest is the typed input for Service.Unregister.
 type UnregisterRequest struct {
 	// CityName is the supervisor-registered name (effective name,
 	// e.g. workspace.name from city.toml, or directory basename if
@@ -207,4 +166,8 @@ type UnregisterResult struct {
 	// removed from the registry. Useful for clients that want to
 	// filter completion events by path as well as name.
 	CityPath string
+
+	// ReloadWarning is non-empty when the supervisor reload after
+	// unregister succeeded but returned a best-effort error.
+	ReloadWarning string
 }
diff --git a/internal/cityinit/config.go b/internal/cityinit/config.go
new file mode 100644
index 0000000000..69a2efd74c
--- /dev/null
+++ b/internal/cityinit/config.go
@@ -0,0 +1,49 @@
+package cityinit
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/config"
+)
+
+const (
+	// BootstrapProfileK8sCell applies hosted/container-friendly API defaults.
+	BootstrapProfileK8sCell = "k8s-cell"
+
+	// BootstrapProfileSingleHostCompat preserves local single-host defaults.
+	BootstrapProfileSingleHostCompat = "single-host-compat"
+)
+
+// NormalizeBootstrapProfile returns the canonical bootstrap profile name.
+func NormalizeBootstrapProfile(profile string) (string, error) {
+	switch strings.TrimSpace(profile) {
+	case "":
+		return "", nil
+	case BootstrapProfileK8sCell, "kubernetes", "kubernetes-cell":
+		return BootstrapProfileK8sCell, nil
+	case BootstrapProfileSingleHostCompat:
+		return BootstrapProfileSingleHostCompat, nil
+	default:
+		return "", fmt.Errorf("unknown bootstrap profile %q", profile)
+	}
+}
+
+// IsBuiltinProvider reports whether provider names one of Gas City's built-in
+// provider presets.
+func IsBuiltinProvider(provider string) bool {
+	_, ok := config.BuiltinProviders()[provider]
+	return ok
+}
+
+// ResolveCityName returns the workspace name to use during init.
+func ResolveCityName(nameOverride, sourceName, cityPath string) string {
+	if n := strings.TrimSpace(nameOverride); n != "" {
+		return n
+	}
+	if n := strings.TrimSpace(sourceName); n != "" {
+		return n
+	}
+	return strings.TrimSpace(filepath.Base(cityPath))
+}
diff --git a/internal/cityinit/layout.go b/internal/cityinit/layout.go
new file mode 100644
index 0000000000..4399890e79
--- /dev/null
+++ b/internal/cityinit/layout.go
@@ -0,0 +1,113 @@
+package cityinit
+
+import (
+	"errors"
+	"fmt"
+	iofs "io/fs"
+	"path/filepath"
+
+	"github.com/gastownhall/gascity/internal/citylayout"
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// InitConventionDirs returns the convention-discovered directories created by
+// city init.
+func InitConventionDirs() []string {
+	return []string{
+		"agents",
+		"commands",
+		"doctor",
+		citylayout.FormulasRoot,
+		citylayout.OrdersRoot,
+		"template-fragments",
+		"overlays",
+		"assets",
+	}
+}
+
+// ManagedScaffoldPaths returns the city-init-owned paths that can be restored
+// or removed during rollback.
+func ManagedScaffoldPaths() []string {
+	seen := make(map[string]struct{}, len(InitConventionDirs())+5)
+	paths := make([]string, 0, len(InitConventionDirs())+5)
+	add := func(rel string) {
+		if rel == "" {
+			return
+		}
+		if _, ok := seen[rel]; ok {
+			return
+		}
+		seen[rel] = struct{}{}
+		paths = append(paths, rel)
+	}
+	add(citylayout.RuntimeRoot)
+	add("hooks")
+	add(citylayout.CityConfigFile)
+	add("pack.toml")
+	add(".gitignore")
+	for _, rel := range InitConventionDirs() {
+		add(rel)
+	}
+	return paths
+}
+
+// EnsureCityScaffoldFS creates the runtime scaffold required for a city.
+func EnsureCityScaffoldFS(fs fsys.FS, cityPath string) error {
+	for _, rel := range []string{
+		citylayout.RuntimeRoot,
+		citylayout.CacheRoot,
+		citylayout.SystemRoot,
+		filepath.Join(citylayout.RuntimeRoot, "runtime"),
+	} {
+		path := filepath.Join(cityPath, rel)
+		if err := fs.MkdirAll(path, 0o755); err != nil {
+			return fmt.Errorf("creating city scaffold directory %q: %w", path, err)
+		}
+	}
+	eventsPath := filepath.Join(cityPath, citylayout.RuntimeRoot, "events.jsonl")
+	if _, err := fs.Stat(eventsPath); err == nil {
+		return nil
+	} else if !errors.Is(err, iofs.ErrNotExist) {
+		return fmt.Errorf("checking city event log %q: %w", eventsPath, err)
+	}
+	if err := fs.WriteFile(eventsPath, nil, 0o644); err != nil {
+		return fmt.Errorf("creating city event log %q: %w", eventsPath, err)
+	}
+	return nil
+}
+
+// CityAlreadyInitializedFS reports whether cityPath already has init output.
+func CityAlreadyInitializedFS(fs fsys.FS, cityPath string) bool {
+	if fi, err := fs.Stat(filepath.Join(cityPath, citylayout.CityConfigFile)); err == nil && !fi.IsDir() {
+		return true
+	}
+	return CityHasScaffoldFS(fs, cityPath)
+}
+
+// CityHasScaffoldFS reports whether cityPath has the runtime scaffold.
+func CityHasScaffoldFS(fs fsys.FS, cityPath string) bool {
+	requiredDirs := []string{
+		filepath.Join(cityPath, citylayout.RuntimeRoot),
+		filepath.Join(cityPath, citylayout.RuntimeRoot, "cache"),
+		filepath.Join(cityPath, citylayout.RuntimeRoot, "runtime"),
+		filepath.Join(cityPath, citylayout.RuntimeRoot, "system"),
+	}
+	for _, dir := range requiredDirs {
+		fi, err := fs.Stat(dir)
+		if err != nil || !fi.IsDir() {
+			return false
+		}
+	}
+	fi, err := fs.Stat(filepath.Join(cityPath, citylayout.RuntimeRoot, "events.jsonl"))
+	return err == nil && !fi.IsDir()
+}
+
+// CityCanResumeInitFS reports whether cityPath has enough scaffold to resume
+// startup checks after a previous init stopped during finalization.
+func CityCanResumeInitFS(fs fsys.FS, cityPath string) bool {
+	fi, err := fs.Stat(filepath.Join(cityPath, citylayout.CityConfigFile))
+	if err != nil || fi.IsDir() {
+		return false
+	}
+	return CityHasScaffoldFS(fs, cityPath)
+}
diff --git a/internal/cityinit/layout_test.go b/internal/cityinit/layout_test.go
new file mode 100644
index 0000000000..4f189d762d
--- /dev/null
+++ b/internal/cityinit/layout_test.go
@@ -0,0 +1,67 @@
+package cityinit
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/citylayout"
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+func TestEnsureCityScaffoldFSReturnsEventLogWriteError(t *testing.T) {
+	eventsPath := filepath.Join("/city", citylayout.RuntimeRoot, "events.jsonl")
+	writeErr := errors.New("read-only filesystem")
+	f := writeErrorFS{
+		Fake: fsys.NewFake(),
+		path: eventsPath,
+		err:  writeErr,
+	}
+
+	err := EnsureCityScaffoldFS(f, "/city")
+	if !errors.Is(err, writeErr) {
+		t.Fatalf("EnsureCityScaffoldFS error = %v, want %v", err, writeErr)
+	}
+}
+
+func TestEnsureCityScaffoldFSReturnsEventLogStatError(t *testing.T) {
+	eventsPath := filepath.Join("/city", citylayout.RuntimeRoot, "events.jsonl")
+	statErr := errors.New("permission denied")
+	f := statErrorFS{
+		Fake: fsys.NewFake(),
+		path: eventsPath,
+		err:  statErr,
+	}
+
+	err := EnsureCityScaffoldFS(f, "/city")
+	if !errors.Is(err, statErr) {
+		t.Fatalf("EnsureCityScaffoldFS error = %v, want %v", err, statErr)
+	}
+}
+
+type writeErrorFS struct {
+	*fsys.Fake
+	path string
+	err  error
+}
+
+func (f writeErrorFS) WriteFile(name string, data []byte, perm os.FileMode) error {
+	if name == f.path {
+		return f.err
+	}
+	return f.Fake.WriteFile(name, data, perm)
+}
+
+type statErrorFS struct {
+	*fsys.Fake
+	path string
+	err  error
+}
+
+func (f statErrorFS) Stat(name string) (os.FileInfo, error) {
+	if name == f.path {
+		return nil, f.err
+	}
+	return f.Fake.Stat(name)
+}
diff --git a/internal/cityinit/no_io_boundary_test.go b/internal/cityinit/no_io_boundary_test.go
new file mode 100644
index 0000000000..0885d24576
--- /dev/null
+++ b/internal/cityinit/no_io_boundary_test.go
@@ -0,0 +1,104 @@
+package cityinit
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestPackageDoesNotExposeInputOutputWriters(t *testing.T) {
+	for _, file := range packageGoFiles(t) {
+		name := filepath.Base(file)
+		fset := token.NewFileSet()
+		parsed, err := parser.ParseFile(fset, file, nil, parser.ImportsOnly)
+		if err != nil {
+			t.Fatalf("ParseFile(%q): %v", file, err)
+		}
+		for _, imp := range parsed.Imports {
+			if imp.Path.Value == `"io"` {
+				t.Fatalf("%s imports io; keep user-facing input/output at cmd/api edges", name)
+			}
+		}
+
+		parsed, err = parser.ParseFile(fset, file, nil, 0)
+		if err != nil {
+			t.Fatalf("ParseFile(%q): %v", file, err)
+		}
+		ast.Inspect(parsed, func(n ast.Node) bool {
+			sel, ok := n.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			ident, ok := sel.X.(*ast.Ident)
+			if ok && ident.Name == "io" {
+				t.Fatalf("%s references io.%s; keep input/output wiring outside internal/cityinit", name, sel.Sel.Name)
+			}
+			return true
+		})
+	}
+}
+
+func TestPackageBoundary_NoDataIO(t *testing.T) {
+	for _, file := range packageGoFiles(t) {
+		name := filepath.Base(file)
+		fset := token.NewFileSet()
+		parsed, err := parser.ParseFile(fset, file, nil, parser.ImportsOnly)
+		if err != nil {
+			t.Fatalf("ParseFile(%q): %v", file, err)
+		}
+		for _, imp := range parsed.Imports {
+			if imp.Path.Value == `"os"` {
+				t.Fatalf("%s imports os; route filesystem I/O through ScaffoldFS port", name)
+			}
+		}
+
+		parsed, err = parser.ParseFile(fset, file, nil, 0)
+		if err != nil {
+			t.Fatalf("ParseFile(%q): %v", file, err)
+		}
+		ast.Inspect(parsed, func(n ast.Node) bool {
+			sel, ok := n.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			ident, ok := sel.X.(*ast.Ident)
+			if !ok {
+				return true
+			}
+			if ident.Name == "filepath" && sel.Sel.Name == "Walk" {
+				t.Fatalf("%s references filepath.Walk; use ScaffoldFS.Walk instead", name)
+			}
+			return true
+		})
+	}
+}
+
+func packageGoFiles(t *testing.T) []string {
+	t.Helper()
+	_, caller, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed")
+	}
+	dir := filepath.Dir(caller)
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("ReadDir(%q): %v", dir, err)
+	}
+	var files []string
+	for _, entry := range entries {
+		name := entry.Name()
+		if entry.IsDir() || filepath.Ext(name) != ".go" {
+			continue
+		}
+		if strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		files = append(files, filepath.Join(dir, name))
+	}
+	return files
+}
diff --git a/internal/cityinit/ports.go b/internal/cityinit/ports.go
new file mode 100644
index 0000000000..ce291aad93
--- /dev/null
+++ b/internal/cityinit/ports.go
@@ -0,0 +1,38 @@
+package cityinit
+
+import (
+	"context"
+	"path/filepath"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+// ScaffoldFS extends [fsys.FS] with tree-walking, symlink, and
+// recursive-remove operations needed by scaffold rollback.
+type ScaffoldFS interface {
+	fsys.FS
+	Walk(root string, fn filepath.WalkFunc) error
+	Readlink(name string) (string, error)
+	Symlink(oldname, newname string) error
+	RemoveAll(path string) error
+}
+
+// Registry manages the supervisor city registry.
+type Registry interface {
+	Register(ctx context.Context, dir, nameOverride string) error
+	Find(ctx context.Context, name string) (RegisteredCity, error)
+	Unregister(ctx context.Context, city RegisteredCity) error
+}
+
+// SupervisorReloader triggers supervisor configuration reloads.
+type SupervisorReloader interface {
+	Reload() error
+	ReloadAfterUnregister() error
+}
+
+// Initializer performs the scaffold and finalize steps of city
+// initialization. Implementations live at the process edge (CLI/API).
+type Initializer interface {
+	Scaffold(ctx context.Context, req InitRequest) error
+	Finalize(ctx context.Context, req InitRequest) error
+}
diff --git a/internal/cityinit/rollback.go b/internal/cityinit/rollback.go
new file mode 100644
index 0000000000..c6e73e6877
--- /dev/null
+++ b/internal/cityinit/rollback.go
@@ -0,0 +1,212 @@
+package cityinit
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/fs"
+	"path/filepath"
+	"sort"
+	"syscall"
+)
+
+func rollbackScaffoldFailure(sfs ScaffoldFS, dir string, dirExisted bool, rollbackState *scaffoldRollbackState, err error) error {
+	if dirExisted && rollbackState != nil {
+		if markErr := rollbackState.markScaffoldState(sfs); markErr != nil {
+			return errors.Join(err, fmt.Errorf("snapshot scaffold state for rollback: %w", markErr))
+		}
+		if cleanupErr := rollbackState.restore(sfs); cleanupErr != nil {
+			return errors.Join(err, fmt.Errorf("restoring existing directory after scaffold failure: %w", cleanupErr))
+		}
+		return err
+	}
+	if !dirExisted {
+		if cleanupErr := sfs.RemoveAll(dir); cleanupErr != nil {
+			return errors.Join(err, fmt.Errorf("cleaning scaffold after failure: %w", cleanupErr))
+		}
+	}
+	return err
+}
+
+type scaffoldRollbackEntry struct {
+	mode       fs.FileMode
+	data       []byte
+	linkTarget string
+}
+
+type scaffoldSnapshot struct {
+	root    string
+	paths   []string
+	entries map[string]scaffoldRollbackEntry
+}
+
+type scaffoldRollbackState struct {
+	root   string
+	paths  []string
+	before map[string]scaffoldRollbackEntry
+	after  map[string]scaffoldRollbackEntry
+}
+
+func newScaffoldRollbackState(sfs ScaffoldFS, root string, paths []string) (*scaffoldRollbackState, error) {
+	snapshot, err := captureScaffoldSnapshot(sfs, root, paths)
+	if err != nil {
+		return nil, err
+	}
+	return &scaffoldRollbackState{
+		root:   root,
+		paths:  append([]string(nil), paths...),
+		before: snapshot.entries,
+	}, nil
+}
+
+func captureScaffoldSnapshot(sfs ScaffoldFS, root string, paths []string) (*scaffoldSnapshot, error) {
+	snapshot := &scaffoldSnapshot{
+		root:    root,
+		paths:   append([]string(nil), paths...),
+		entries: make(map[string]scaffoldRollbackEntry),
+	}
+	for _, rel := range paths {
+		if err := snapshot.capture(sfs, rel); err != nil {
+			return nil, err
+		}
+	}
+	return snapshot, nil
+}
+
+func (s *scaffoldSnapshot) capture(sfs ScaffoldFS, rel string) error {
+	abs := filepath.Join(s.root, rel)
+	_, err := sfs.Lstat(abs)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("snapshot %q: %w", abs, err)
+	}
+	return sfs.Walk(abs, func(path string, info fs.FileInfo, walkErr error) error {
+		if walkErr != nil {
+			return fmt.Errorf("snapshot %q: %w", path, walkErr)
+		}
+		relPath, err := filepath.Rel(s.root, path)
+		if err != nil {
+			return fmt.Errorf("relative path for %q: %w", path, err)
+		}
+		entry := scaffoldRollbackEntry{mode: info.Mode()}
+		if info.Mode()&fs.ModeSymlink != 0 {
+			target, err := sfs.Readlink(path)
+			if err != nil {
+				return fmt.Errorf("readlink %q: %w", path, err)
+			}
+			entry.linkTarget = target
+		} else if !info.IsDir() {
+			data, err := sfs.ReadFile(path)
+			if err != nil {
+				return fmt.Errorf("read %q: %w", path, err)
+			}
+			entry.data = data
+		}
+		s.entries[filepath.Clean(relPath)] = entry
+		return nil
+	})
+}
+
+func (s *scaffoldRollbackState) markScaffoldState(sfs ScaffoldFS) error {
+	snapshot, err := captureScaffoldSnapshot(sfs, s.root, s.paths)
+	if err != nil {
+		return err
+	}
+	s.after = snapshot.entries
+	return nil
+}
+
+func rollbackEntryEqual(a, b scaffoldRollbackEntry) bool {
+	return a.mode == b.mode && a.linkTarget == b.linkTarget && bytes.Equal(a.data, b.data)
+}
+
+func restoreRollbackEntry(sfs ScaffoldFS, abs string, entry scaffoldRollbackEntry) error {
+	switch {
+	case entry.mode.IsDir():
+		return sfs.MkdirAll(abs, entry.mode.Perm())
+	case entry.mode&fs.ModeSymlink != 0:
+		if err := sfs.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+			return err
+		}
+		if err := sfs.Remove(abs); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return err
+		}
+		return sfs.Symlink(entry.linkTarget, abs)
+	default:
+		if err := sfs.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+			return err
+		}
+		return sfs.WriteFile(abs, entry.data, entry.mode.Perm())
+	}
+}
+
+func (s *scaffoldRollbackState) restore(sfs ScaffoldFS) error {
+	current, err := captureScaffoldSnapshot(sfs, s.root, s.paths)
+	if err != nil {
+		return err
+	}
+
+	var errs []error
+	var createdDirs []string
+	for rel, after := range s.after {
+		before, hadBefore := s.before[rel]
+		currentEntry, existsNow := current.entries[rel]
+		switch {
+		case !hadBefore:
+			if after.mode.IsDir() {
+				createdDirs = append(createdDirs, rel)
+				continue
+			}
+			if existsNow && rollbackEntryEqual(currentEntry, after) {
+				if err := sfs.Remove(filepath.Join(s.root, rel)); err != nil && !errors.Is(err, fs.ErrNotExist) {
+					errs = append(errs, fmt.Errorf("remove %q: %w", filepath.Join(s.root, rel), err))
+				}
+			}
+		case rollbackEntryEqual(before, after):
+			continue
+		default:
+			if after.mode.IsDir() {
+				continue
+			}
+			if existsNow && rollbackEntryEqual(currentEntry, after) {
+				if err := restoreRollbackEntry(sfs, filepath.Join(s.root, rel), before); err != nil {
+					errs = append(errs, fmt.Errorf("restore %q: %w", filepath.Join(s.root, rel), err))
+				}
+			}
+		}
+	}
+
+	for rel, before := range s.before {
+		if _, hadAfter := s.after[rel]; hadAfter {
+			continue
+		}
+		if before.mode.IsDir() {
+			continue
+		}
+		if _, existsNow := current.entries[rel]; existsNow {
+			continue
+		}
+		if err := restoreRollbackEntry(sfs, filepath.Join(s.root, rel), before); err != nil {
+			errs = append(errs, fmt.Errorf("restore %q: %w", filepath.Join(s.root, rel), err))
+		}
+	}
+
+	sort.Slice(createdDirs, func(i, j int) bool {
+		return len(createdDirs[i]) > len(createdDirs[j])
+	})
+	for _, rel := range createdDirs {
+		if err := sfs.Remove(filepath.Join(s.root, rel)); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			if errors.Is(err, syscall.ENOTEMPTY) {
+				continue
+			}
+			errs = append(errs, fmt.Errorf("remove %q: %w", filepath.Join(s.root, rel), err))
+		}
+	}
+
+	if len(errs) > 0 {
+		return errors.Join(errs...)
+	}
+	return nil
+}
diff --git a/internal/cityinit/scaffold_fs_test.go b/internal/cityinit/scaffold_fs_test.go
new file mode 100644
index 0000000000..a1b705cf76
--- /dev/null
+++ b/internal/cityinit/scaffold_fs_test.go
@@ -0,0 +1,112 @@
+package cityinit
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+var (
+	_ ScaffoldFS = fsys.OSScaffoldFS{}
+	_ ScaffoldFS = (*fakeScaffoldFS)(nil)
+)
+
+type fakeScaffoldFS struct {
+	*fsys.Fake
+}
+
+func (f *fakeScaffoldFS) Walk(root string, fn filepath.WalkFunc) error {
+	root = filepath.Clean(root)
+	var paths []string
+	collectPaths := func(m map[string]bool) {
+		for p := range m {
+			if p == root || strings.HasPrefix(p, root+string(filepath.Separator)) {
+				paths = append(paths, p)
+			}
+		}
+	}
+	collectFiles := func(m map[string][]byte) {
+		for p := range m {
+			if p == root || strings.HasPrefix(p, root+string(filepath.Separator)) {
+				paths = append(paths, p)
+			}
+		}
+	}
+	collectSymlinks := func(m map[string]string) {
+		for p := range m {
+			if p == root || strings.HasPrefix(p, root+string(filepath.Separator)) {
+				paths = append(paths, p)
+			}
+		}
+	}
+	collectPaths(f.Dirs)
+	collectFiles(f.Files)
+	collectSymlinks(f.Symlinks)
+
+	seen := make(map[string]bool, len(paths))
+	var unique []string
+	for _, p := range paths {
+		if !seen[p] {
+			seen[p] = true
+			unique = append(unique, p)
+		}
+	}
+	sort.Strings(unique)
+
+	for _, p := range unique {
+		info, err := f.Lstat(p)
+		if err != nil {
+			if walkErr := fn(p, nil, err); walkErr != nil {
+				return walkErr
+			}
+			continue
+		}
+		if walkErr := fn(p, info, nil); walkErr != nil {
+			if errors.Is(walkErr, filepath.SkipDir) {
+				continue
+			}
+			return walkErr
+		}
+	}
+	return nil
+}
+
+func (f *fakeScaffoldFS) Readlink(name string) (string, error) {
+	if target, ok := f.Symlinks[name]; ok {
+		return target, nil
+	}
+	return "", &os.PathError{Op: "readlink", Path: name, Err: os.ErrNotExist}
+}
+
+func (f *fakeScaffoldFS) Symlink(oldname, newname string) error {
+	if f.Symlinks == nil {
+		f.Symlinks = make(map[string]string)
+	}
+	f.Symlinks[newname] = oldname
+	return nil
+}
+
+func (f *fakeScaffoldFS) RemoveAll(path string) error {
+	path = filepath.Clean(path)
+	prefix := path + string(filepath.Separator)
+	for p := range f.Dirs {
+		if p == path || strings.HasPrefix(p, prefix) {
+			delete(f.Dirs, p)
+		}
+	}
+	for p := range f.Files {
+		if p == path || strings.HasPrefix(p, prefix) {
+			delete(f.Files, p)
+		}
+	}
+	for p := range f.Symlinks {
+		if p == path || strings.HasPrefix(p, prefix) {
+			delete(f.Symlinks, p)
+		}
+	}
+	return nil
+}
diff --git a/internal/cityinit/service.go b/internal/cityinit/service.go
new file mode 100644
index 0000000000..1c33aca1f9
--- /dev/null
+++ b/internal/cityinit/service.go
@@ -0,0 +1,262 @@
+package cityinit
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"path/filepath"
+	"strings"
+)
+
+// ServiceDeps contains the side-effecting operations Service needs from
+// the binary layer while the scaffold/finalize body is still being split
+// out of cmd/gc.
+type ServiceDeps struct {
+	FS              ScaffoldFS
+	Initializer     Initializer
+	Registry        Registry
+	Reloader        SupervisorReloader
+	LifecycleEvents LifecycleEvents
+}
+
+// RegisteredCity is the minimal registry view Service needs for
+// asynchronous unregister.
+type RegisteredCity struct {
+	Name string
+	Path string
+}
+
+// LifecycleEvents records durable city lifecycle events required by async
+// clients. Implementations live at process edges so this package does not own
+// stdout/stderr or event-log output sinks.
+type LifecycleEvents interface {
+	EnsureCityLog(cityPath string) error
+	CityCreated(cityPath, name string) error
+	CityUnregisterRequested(city RegisteredCity) error
+}
+
+// Service owns city scaffolding/finalization orchestration for both the
+// CLI and HTTP projections.
+type Service struct {
+	deps ServiceDeps
+}
+
+// NewService constructs the concrete city-init service. Returns
+// ErrNotWired if the universally required FS dependency is nil.
+func NewService(deps ServiceDeps) (*Service, error) {
+	if deps.FS == nil {
+		return nil, fmt.Errorf("%w: FS is required", ErrNotWired)
+	}
+	return &Service{deps: deps}, nil
+}
+
+// FindRegisteredCity returns the registry entry for name.
+func (s *Service) FindRegisteredCity(ctx context.Context, name string) (RegisteredCity, error) {
+	if s.deps.Registry == nil {
+		return RegisteredCity{}, ErrNotWired
+	}
+	return s.deps.Registry.Find(ctx, name)
+}
+
+// ValidateInitRequest validates a city init request before side effects.
+func (s *Service) ValidateInitRequest(req InitRequest) error {
+	if req.Dir == "" {
+		return fmt.Errorf("%w: dir is required", ErrInvalidDirectory)
+	}
+	if !filepath.IsAbs(req.Dir) {
+		return fmt.Errorf("%w: dir must be absolute: %q", ErrInvalidDirectory, req.Dir)
+	}
+	if req.Provider == "" && req.StartCommand == "" {
+		return fmt.Errorf("%w: provider or start_command required", ErrInvalidProvider)
+	}
+	if req.Provider != "" && req.StartCommand != "" {
+		return fmt.Errorf("%w: provider and start_command are mutually exclusive", ErrInvalidProvider)
+	}
+	if req.Provider != "" {
+		if !IsBuiltinProvider(req.Provider) {
+			return fmt.Errorf("%w: unknown provider %q", ErrInvalidProvider, req.Provider)
+		}
+	}
+	if req.BootstrapProfile != "" {
+		if _, err := NormalizeBootstrapProfile(req.BootstrapProfile); err != nil {
+			return fmt.Errorf("%w: %w", ErrInvalidBootstrapProfile, err)
+		}
+	}
+	return nil
+}
+
+// Init scaffolds and finalizes a city synchronously.
+func (s *Service) Init(ctx context.Context, req InitRequest) (*InitResult, error) {
+	req = s.normalizeRequest(req)
+	if err := s.ValidateInitRequest(req); err != nil {
+		return nil, err
+	}
+	if err := s.validateInitDeps(); err != nil {
+		return nil, err
+	}
+	if err := s.deps.FS.MkdirAll(req.Dir, 0o755); err != nil {
+		return nil, fmt.Errorf("creating directory %q: %w", req.Dir, err)
+	}
+	if s.hasScaffold(req.Dir) {
+		return nil, ErrAlreadyInitialized
+	}
+	if err := s.deps.Initializer.Scaffold(ctx, req); err != nil {
+		return nil, err
+	}
+	if err := s.deps.Initializer.Finalize(ctx, req); err != nil {
+		return nil, err
+	}
+	return &InitResult{
+		CityName:     s.resolveCityName(req.NameOverride, "", req.Dir),
+		CityPath:     req.Dir,
+		ProviderUsed: req.Provider,
+	}, nil
+}
+
+// Scaffold writes the fast city scaffold, registers it with the
+// supervisor, emits city.created, and returns without finalization.
+func (s *Service) Scaffold(ctx context.Context, req InitRequest) (*InitResult, error) {
+	req = s.normalizeRequest(req)
+	if err := s.ValidateInitRequest(req); err != nil {
+		return nil, err
+	}
+	if err := s.validateScaffoldDeps(); err != nil {
+		return nil, err
+	}
+	dirExisted := false
+	var rollbackState *scaffoldRollbackState
+	if _, err := s.deps.FS.Stat(req.Dir); err == nil {
+		dirExisted = true
+		var snapshotErr error
+		rollbackState, snapshotErr = newScaffoldRollbackState(s.deps.FS, req.Dir, s.managedPaths())
+		if snapshotErr != nil {
+			return nil, fmt.Errorf("snapshot rollback state for %q: %w", req.Dir, snapshotErr)
+		}
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return nil, fmt.Errorf("stat directory %q: %w", req.Dir, err)
+	}
+	if err := s.deps.FS.MkdirAll(req.Dir, 0o755); err != nil {
+		return nil, fmt.Errorf("creating directory %q: %w", req.Dir, err)
+	}
+	if s.hasScaffold(req.Dir) {
+		return nil, ErrAlreadyInitialized
+	}
+	if err := s.deps.Initializer.Scaffold(ctx, req); err != nil {
+		return nil, rollbackScaffoldFailure(s.deps.FS, req.Dir, dirExisted, rollbackState, err)
+	}
+
+	cityName := s.resolveCityName(req.NameOverride, "", req.Dir)
+	if err := s.lifecycleEvents().EnsureCityLog(req.Dir); err != nil {
+		return nil, rollbackScaffoldFailure(s.deps.FS, req.Dir, dirExisted, rollbackState, fmt.Errorf("creating city event log: %w", err))
+	}
+	if dirExisted && rollbackState != nil {
+		if err := rollbackState.markScaffoldState(s.deps.FS); err != nil {
+			return nil, fmt.Errorf("snapshot scaffold state for %q: %w", req.Dir, err)
+		}
+	}
+
+	if err := s.deps.Registry.Register(ctx, req.Dir, req.NameOverride); err != nil {
+		if dirExisted {
+			if rollbackState != nil {
+				if cleanupErr := rollbackState.restore(s.deps.FS); cleanupErr != nil {
+					return nil, errors.Join(fmt.Errorf("register with supervisor: %w", err), fmt.Errorf("restoring existing directory after failed registration: %w", cleanupErr))
+				}
+			}
+		} else if cleanupErr := s.deps.FS.RemoveAll(req.Dir); cleanupErr != nil {
+			return nil, errors.Join(fmt.Errorf("register with supervisor: %w", err), fmt.Errorf("cleaning scaffold after failed registration: %w", cleanupErr))
+		}
+		return nil, fmt.Errorf("register with supervisor: %w", err)
+	}
+	result := &InitResult{
+		CityName:     cityName,
+		CityPath:     req.Dir,
+		ProviderUsed: req.Provider,
+	}
+	if err := s.lifecycleEvents().CityCreated(req.Dir, cityName); err != nil {
+		return result, NewPostRegisterFailure(fmt.Errorf("record city created event: %w", err))
+	}
+	if s.deps.Reloader != nil {
+		if err := s.deps.Reloader.Reload(); err != nil {
+			result.ReloadWarning = err.Error()
+		}
+	}
+	return result, nil
+}
+
+// Unregister removes a city from the supervisor registry and emits the
+// start event used by async clients.
+func (s *Service) Unregister(ctx context.Context, req UnregisterRequest) (*UnregisterResult, error) {
+	name := strings.TrimSpace(req.CityName)
+	if name == "" {
+		return nil, fmt.Errorf("%w: city_name is required", ErrNotRegistered)
+	}
+	if s.deps.Registry == nil || s.deps.LifecycleEvents == nil {
+		return nil, ErrNotWired
+	}
+	city, err := s.deps.Registry.Find(ctx, name)
+	if err != nil {
+		if errors.Is(err, ErrNotRegistered) {
+			return nil, err
+		}
+		return nil, fmt.Errorf("reading supervisor registry: %w", err)
+	}
+	if err := s.deps.Registry.Unregister(ctx, city); err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, fmt.Errorf("%w: %q: %w", ErrNotRegistered, name, err)
+		}
+		return nil, fmt.Errorf("removing %q from supervisor registry: %w", name, err)
+	}
+	if err := s.lifecycleEvents().CityUnregisterRequested(city); err != nil {
+		return nil, fmt.Errorf("record city unregister requested event: %w", err)
+	}
+	result := &UnregisterResult{
+		CityName: city.Name,
+		CityPath: city.Path,
+	}
+	if s.deps.Reloader != nil {
+		if err := s.deps.Reloader.ReloadAfterUnregister(); err != nil {
+			result.ReloadWarning = err.Error()
+		}
+	}
+	return result, nil
+}
+
+func (s *Service) normalizeRequest(req InitRequest) InitRequest {
+	if req.ConfigName == "" {
+		req.ConfigName = "tutorial"
+	}
+	return req
+}
+
+func (s *Service) hasScaffold(dir string) bool {
+	return CityHasScaffoldFS(s.deps.FS, dir)
+}
+
+func (s *Service) validateInitDeps() error {
+	if s.deps.Initializer == nil {
+		return ErrNotWired
+	}
+	return nil
+}
+
+func (s *Service) validateScaffoldDeps() error {
+	if s.deps.Initializer == nil ||
+		s.deps.Registry == nil ||
+		s.deps.LifecycleEvents == nil {
+		return ErrNotWired
+	}
+	return nil
+}
+
+func (s *Service) resolveCityName(nameOverride, sourceName, dir string) string {
+	return ResolveCityName(nameOverride, sourceName, dir)
+}
+
+func (s *Service) managedPaths() []string {
+	return ManagedScaffoldPaths()
+}
+
+func (s *Service) lifecycleEvents() LifecycleEvents {
+	return s.deps.LifecycleEvents
+}
diff --git a/internal/cityinit/service_test.go b/internal/cityinit/service_test.go
new file mode 100644
index 0000000000..2934d2dcbe
--- /dev/null
+++ b/internal/cityinit/service_test.go
@@ -0,0 +1,478 @@
+package cityinit
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/citylayout"
+	"github.com/gastownhall/gascity/internal/fsys"
+)
+
+type recordingLifecycleEvents struct {
+	ensureErr     error
+	createdErr    error
+	unregisterErr error
+	ensured       []string
+	created       []struct {
+		path string
+		name string
+	}
+	unregistered []RegisteredCity
+}
+
+func (r *recordingLifecycleEvents) EnsureCityLog(cityPath string) error {
+	r.ensured = append(r.ensured, cityPath)
+	return r.ensureErr
+}
+
+func (r *recordingLifecycleEvents) CityCreated(cityPath, name string) error {
+	r.created = append(r.created, struct {
+		path string
+		name string
+	}{path: cityPath, name: name})
+	return r.createdErr
+}
+
+func (r *recordingLifecycleEvents) CityUnregisterRequested(city RegisteredCity) error {
+	r.unregistered = append(r.unregistered, city)
+	return r.unregisterErr
+}
+
+type mockRegistry struct {
+	registerFn   func(ctx context.Context, dir, nameOverride string) error
+	findFn       func(ctx context.Context, name string) (RegisteredCity, error)
+	unregisterFn func(ctx context.Context, city RegisteredCity) error
+}
+
+func (m *mockRegistry) Register(ctx context.Context, dir, nameOverride string) error {
+	if m.registerFn != nil {
+		return m.registerFn(ctx, dir, nameOverride)
+	}
+	return nil
+}
+
+func (m *mockRegistry) Find(ctx context.Context, name string) (RegisteredCity, error) {
+	if m.findFn != nil {
+		return m.findFn(ctx, name)
+	}
+	return RegisteredCity{}, ErrNotRegistered
+}
+
+func (m *mockRegistry) Unregister(ctx context.Context, city RegisteredCity) error {
+	if m.unregisterFn != nil {
+		return m.unregisterFn(ctx, city)
+	}
+	return nil
+}
+
+type mockReloader struct {
+	reloadFn           func() error
+	reloadAfterUnregFn func() error
+}
+
+func (m *mockReloader) Reload() error {
+	if m.reloadFn != nil {
+		return m.reloadFn()
+	}
+	return nil
+}
+
+func (m *mockReloader) ReloadAfterUnregister() error {
+	if m.reloadAfterUnregFn != nil {
+		return m.reloadAfterUnregFn()
+	}
+	return nil
+}
+
+type mockInitializer struct {
+	scaffoldFn func(ctx context.Context, req InitRequest) error
+	finalizeFn func(ctx context.Context, req InitRequest) error
+}
+
+func (m *mockInitializer) Scaffold(ctx context.Context, req InitRequest) error {
+	if m.scaffoldFn != nil {
+		return m.scaffoldFn(ctx, req)
+	}
+	return nil
+}
+
+func (m *mockInitializer) Finalize(ctx context.Context, req InitRequest) error {
+	if m.finalizeFn != nil {
+		return m.finalizeFn(ctx, req)
+	}
+	return nil
+}
+
+func mustNewService(t *testing.T, deps ServiceDeps) *Service {
+	t.Helper()
+	svc, err := NewService(deps)
+	if err != nil {
+		t.Fatalf("NewService: %v", err)
+	}
+	return svc
+}
+
+func TestServiceValidateInitRequest(t *testing.T) {
+	absDir := filepath.Join(t.TempDir(), "city")
+	svc := mustNewService(t, ServiceDeps{FS: fsys.OSScaffoldFS{}})
+
+	tests := []struct {
+		name    string
+		req     InitRequest
+		wantErr error
+	}{
+		{
+			name:    "missing dir",
+			req:     InitRequest{Provider: "codex"},
+			wantErr: ErrInvalidDirectory,
+		},
+		{
+			name:    "relative dir",
+			req:     InitRequest{Dir: "relative", Provider: "codex"},
+			wantErr: ErrInvalidDirectory,
+		},
+		{
+			name:    "provider or start command required",
+			req:     InitRequest{Dir: absDir},
+			wantErr: ErrInvalidProvider,
+		},
+		{
+			name:    "provider and start command conflict",
+			req:     InitRequest{Dir: absDir, Provider: "codex", StartCommand: "custom-agent"},
+			wantErr: ErrInvalidProvider,
+		},
+		{
+			name:    "unknown provider",
+			req:     InitRequest{Dir: absDir, Provider: "not-a-provider"},
+			wantErr: ErrInvalidProvider,
+		},
+		{
+			name:    "unknown bootstrap",
+			req:     InitRequest{Dir: absDir, Provider: "codex", BootstrapProfile: "moon-base"},
+			wantErr: ErrInvalidBootstrapProfile,
+		},
+		{
+			name: "valid provider",
+			req:  InitRequest{Dir: absDir, Provider: "codex"},
+		},
+		{
+			name: "valid custom command",
+			req:  InitRequest{Dir: absDir, StartCommand: "custom-agent"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := svc.ValidateInitRequest(tt.req)
+			if !errors.Is(err, tt.wantErr) {
+				t.Fatalf("ValidateInitRequest error = %v, want %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestServiceValidateInitRequestUsesInternalProviderValidation(t *testing.T) {
+	absDir := filepath.Join(t.TempDir(), "city")
+	svc := mustNewService(t, ServiceDeps{FS: fsys.OSScaffoldFS{}})
+
+	if err := svc.ValidateInitRequest(InitRequest{
+		Dir:              absDir,
+		Provider:         "codex",
+		BootstrapProfile: "kubernetes",
+	}); err != nil {
+		t.Fatalf("ValidateInitRequest valid provider/profile error = %v, want nil", err)
+	}
+
+	err := svc.ValidateInitRequest(InitRequest{Dir: absDir, Provider: "not-a-provider"})
+	if !errors.Is(err, ErrInvalidProvider) {
+		t.Fatalf("ValidateInitRequest unknown provider error = %v, want ErrInvalidProvider", err)
+	}
+
+	err = svc.ValidateInitRequest(InitRequest{Dir: absDir, Provider: "codex", BootstrapProfile: "moon-base"})
+	if !errors.Is(err, ErrInvalidBootstrapProfile) {
+		t.Fatalf("ValidateInitRequest unknown bootstrap error = %v, want ErrInvalidBootstrapProfile", err)
+	}
+}
+
+func TestServiceInitScaffoldsAndFinalizes(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "init-city")
+	var calls []string
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{
+			scaffoldFn: func(_ context.Context, req InitRequest) error {
+				calls = append(calls, "do-init:"+req.Dir+":"+req.Provider)
+				if err := os.MkdirAll(filepath.Join(req.Dir, citylayout.RuntimeRoot), 0o755); err != nil {
+					return err
+				}
+				return os.WriteFile(filepath.Join(req.Dir, citylayout.CityConfigFile), []byte("[workspace]\nname = \"init-city\"\n"), 0o644)
+			},
+			finalizeFn: func(_ context.Context, req InitRequest) error {
+				calls = append(calls, "finalize:"+req.Dir)
+				return nil
+			},
+		},
+	})
+
+	result, err := svc.Init(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if err != nil {
+		t.Fatalf("Init: %v", err)
+	}
+	if result.CityName != "init-city" || result.CityPath != cityPath || result.ProviderUsed != "codex" {
+		t.Fatalf("Init result = %+v", result)
+	}
+	wantCalls := []string{"do-init:" + cityPath + ":codex", "finalize:" + cityPath}
+	if !reflect.DeepEqual(calls, wantCalls) {
+		t.Fatalf("calls = %v, want %v", calls, wantCalls)
+	}
+}
+
+func TestServiceInitRequiresInitializerBeforeSideEffects(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "init-city")
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+	})
+
+	_, err := svc.Init(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if !errors.Is(err, ErrNotWired) {
+		t.Fatalf("Init error = %v, want ErrNotWired", err)
+	}
+	if _, statErr := os.Stat(cityPath); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("city path after unwired Init = %v, want removed/not created", statErr)
+	}
+}
+
+func TestServiceScaffoldRegistersAndEmitsCreated(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+	var registered bool
+	var reloaded bool
+	lifecycleEvents := &recordingLifecycleEvents{}
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{scaffoldFn: func(_ context.Context, req InitRequest) error {
+			if err := os.MkdirAll(filepath.Join(req.Dir, citylayout.RuntimeRoot), 0o755); err != nil {
+				return err
+			}
+			return os.WriteFile(filepath.Join(req.Dir, citylayout.CityConfigFile), []byte("[workspace]\nname = \"api-city\"\n"), 0o644)
+		}},
+		Registry: &mockRegistry{registerFn: func(_ context.Context, dir, nameOverride string) error {
+			if dir != cityPath || nameOverride != "" {
+				t.Fatalf("Register(%q, %q), want (%q, \"\")", dir, nameOverride, cityPath)
+			}
+			registered = true
+			return nil
+		}},
+		Reloader:        &mockReloader{reloadFn: func() error { reloaded = true; return nil }},
+		LifecycleEvents: lifecycleEvents,
+	})
+
+	result, err := svc.Scaffold(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if err != nil {
+		t.Fatalf("Scaffold: %v", err)
+	}
+	if result.CityName != "api-city" || result.CityPath != cityPath || result.ProviderUsed != "codex" {
+		t.Fatalf("Scaffold result = %+v", result)
+	}
+	if !registered {
+		t.Fatal("RegisterCity was not called")
+	}
+	if !reloaded {
+		t.Fatal("ReloadSupervisor was not called")
+	}
+	if !reflect.DeepEqual(lifecycleEvents.ensured, []string{cityPath}) {
+		t.Fatalf("ensured event logs = %v, want [%s]", lifecycleEvents.ensured, cityPath)
+	}
+	if len(lifecycleEvents.created) != 1 || lifecycleEvents.created[0].name != "api-city" || lifecycleEvents.created[0].path != cityPath {
+		t.Fatalf("created lifecycle events = %+v, want api-city/%s", lifecycleEvents.created, cityPath)
+	}
+}
+
+func TestServiceScaffoldReturnsPostRegisterErrorWithResultWhenCityCreatedFails(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+	lifecycleErr := errors.New("event log unavailable")
+	var registered bool
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{scaffoldFn: func(_ context.Context, req InitRequest) error {
+			if err := os.MkdirAll(filepath.Join(req.Dir, citylayout.RuntimeRoot), 0o755); err != nil {
+				return err
+			}
+			return os.WriteFile(filepath.Join(req.Dir, citylayout.CityConfigFile), []byte("[workspace]\nname = \"api-city\"\n"), 0o644)
+		}},
+		Registry: &mockRegistry{registerFn: func(context.Context, string, string) error {
+			registered = true
+			return nil
+		}},
+		LifecycleEvents: &recordingLifecycleEvents{createdErr: lifecycleErr},
+	})
+
+	result, err := svc.Scaffold(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if !errors.Is(err, ErrPostRegisterFailure) {
+		t.Fatalf("Scaffold error = %v, want ErrPostRegisterFailure", err)
+	}
+	if !errors.Is(err, lifecycleErr) {
+		t.Fatalf("Scaffold error = %v, want wrapped lifecycle error %v", err, lifecycleErr)
+	}
+	if result == nil {
+		t.Fatal("Scaffold result = nil, want committed city result")
+	}
+	if result.CityName != "api-city" || result.CityPath != cityPath {
+		t.Fatalf("Scaffold result = %+v, want api-city/%s", result, cityPath)
+	}
+	if !registered {
+		t.Fatal("Register was not called before post-register error")
+	}
+}
+
+func TestServiceScaffoldUsesInternalScaffoldDetection(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+	if err := EnsureCityScaffoldFS(fsys.OSFS{}, cityPath); err != nil {
+		t.Fatalf("EnsureCityScaffoldFS: %v", err)
+	}
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{scaffoldFn: func(context.Context, InitRequest) error {
+			t.Fatal("Scaffold should not run for an already scaffolded city")
+			return nil
+		}},
+		Registry: &mockRegistry{registerFn: func(context.Context, string, string) error {
+			t.Fatal("Register should not run for an already scaffolded city")
+			return nil
+		}},
+		LifecycleEvents: &recordingLifecycleEvents{},
+	})
+
+	_, err := svc.Scaffold(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if !errors.Is(err, ErrAlreadyInitialized) {
+		t.Fatalf("Scaffold error = %v, want ErrAlreadyInitialized", err)
+	}
+}
+
+func TestServiceScaffoldRequiresRegisterBeforeSideEffects(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+	scaffoldCalled := false
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{scaffoldFn: func(_ context.Context, req InitRequest) error {
+			scaffoldCalled = true
+			return os.MkdirAll(filepath.Join(req.Dir, citylayout.RuntimeRoot), 0o755)
+		}},
+	})
+
+	_, err := svc.Scaffold(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if !errors.Is(err, ErrNotWired) {
+		t.Fatalf("Scaffold error = %v, want ErrNotWired", err)
+	}
+	if scaffoldCalled {
+		t.Fatal("Initializer.Scaffold was called before Registry was wired")
+	}
+	if _, statErr := os.Stat(cityPath); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("city path after unwired Scaffold = %v, want removed/not created", statErr)
+	}
+}
+
+func TestServiceScaffoldFailsBeforeRegisterWhenEventLogCannotBeCreated(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+	var registered bool
+	eventErr := errors.New("event log unavailable")
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{scaffoldFn: func(_ context.Context, req InitRequest) error {
+			if err := os.MkdirAll(filepath.Join(req.Dir, citylayout.RuntimeRoot), 0o755); err != nil {
+				return err
+			}
+			return os.WriteFile(filepath.Join(req.Dir, citylayout.CityConfigFile), []byte("[workspace]\nname = \"api-city\"\n"), 0o644)
+		}},
+		Registry: &mockRegistry{registerFn: func(context.Context, string, string) error {
+			registered = true
+			return nil
+		}},
+		LifecycleEvents: &recordingLifecycleEvents{ensureErr: eventErr},
+	})
+
+	_, err := svc.Scaffold(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if !errors.Is(err, eventErr) {
+		t.Fatalf("Scaffold error = %v, want %v", err, eventErr)
+	}
+	if registered {
+		t.Fatal("RegisterCity was called after event log creation failed")
+	}
+	if _, statErr := os.Stat(cityPath); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("city path after failed scaffold = %v, want removed", statErr)
+	}
+}
+
+func TestServiceScaffoldRollbackUsesInternalManagedPaths(t *testing.T) {
+	cityPath := filepath.Join(t.TempDir(), "api-city")
+	keepPath := filepath.Join(cityPath, "keep.txt")
+	customAgentPath := filepath.Join(cityPath, "agents", "custom.txt")
+	generatedAgentPath := filepath.Join(cityPath, "agents", "generated.txt")
+	if err := os.MkdirAll(filepath.Dir(customAgentPath), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(keepPath, []byte("keep"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(customAgentPath, []byte("custom"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	svc := mustNewService(t, ServiceDeps{
+		FS: fsys.OSScaffoldFS{},
+		Initializer: &mockInitializer{scaffoldFn: func(_ context.Context, req InitRequest) error {
+			if err := os.WriteFile(generatedAgentPath, []byte("generated"), 0o644); err != nil {
+				return err
+			}
+			if err := os.MkdirAll(filepath.Join(req.Dir, citylayout.RuntimeRoot), 0o755); err != nil {
+				return err
+			}
+			return os.WriteFile(filepath.Join(req.Dir, citylayout.CityConfigFile), []byte("[workspace]\nname = \"api-city\"\n"), 0o644)
+		}},
+		Registry: &mockRegistry{registerFn: func(context.Context, string, string) error {
+			return errors.New("registry unavailable")
+		}},
+		LifecycleEvents: &recordingLifecycleEvents{},
+	})
+
+	_, err := svc.Scaffold(context.Background(), InitRequest{
+		Dir:      cityPath,
+		Provider: "codex",
+	})
+	if err == nil {
+		t.Fatal("Scaffold error = nil, want registration failure")
+	}
+	if _, statErr := os.Stat(generatedAgentPath); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("generated managed file stat = %v, want removed", statErr)
+	}
+	if data, readErr := os.ReadFile(customAgentPath); readErr != nil || string(data) != "custom" {
+		t.Fatalf("custom agent file = %q/%v, want preserved", string(data), readErr)
+	}
+	if data, readErr := os.ReadFile(keepPath); readErr != nil || string(data) != "keep" {
+		t.Fatalf("keep file = %q/%v, want preserved", string(data), readErr)
+	}
+}
diff --git a/internal/cityinit/testenv_import_test.go b/internal/cityinit/testenv_import_test.go
new file mode 100644
index 0000000000..3fc86686c8
--- /dev/null
+++ b/internal/cityinit/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package cityinit
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/citylayout/runtime.go b/internal/citylayout/runtime.go
index aca364d883..4e701c76a2 100644
--- a/internal/citylayout/runtime.go
+++ b/internal/citylayout/runtime.go
@@ -1,6 +1,12 @@
 package citylayout
 
-import "path/filepath"
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/pathutil"
+)
 
 const (
 	// RuntimeDataRoot is the canonical hidden runtime root for mutable city state.
@@ -18,6 +24,22 @@ func RuntimeDataDir(cityRoot string) string {
 	return RuntimePath(cityRoot, "runtime")
 }
 
+// ControlDispatcherTraceDefaultPath returns the default control-dispatcher
+// workflow trace file under the canonical runtime root.
+func ControlDispatcherTraceDefaultPath(cityRoot string) string {
+	return filepath.Join(RuntimeDataDir(cityRoot), "control-dispatcher-trace.log")
+}
+
+// ControlDispatcherTraceDefaultPathForRuntimeDir returns the default
+// control-dispatcher workflow trace file for the provided runtime root. Runtime
+// dirs inside the city but outside .gc/runtime are coerced back to the
+// canonical hidden runtime root to avoid watcher-visible trace writes. Runtime
+// dirs outside the city are preserved as explicit operator overrides.
+func ControlDispatcherTraceDefaultPathForRuntimeDir(cityRoot, runtimeDir string) string {
+	runtimeDir = normalizeRuntimeDir(cityRoot, runtimeDir)
+	return filepath.Join(runtimeDir, "control-dispatcher-trace.log")
+}
+
 // RuntimePacksDir returns the canonical root for pack-owned runtime state.
 func RuntimePacksDir(cityRoot string) string {
 	return RuntimePath(cityRoot, "runtime", "packs")
@@ -54,23 +76,45 @@ func PackStateDir(cityRoot, packName string) string {
 	return filepath.Join(RuntimePacksDir(cityRoot), packName)
 }
 
-// CityRuntimeEnv returns canonical city runtime env vars.
+// CityRuntimeEnv returns city runtime env vars rooted at the canonical runtime
+// directory for cityRoot.
 func CityRuntimeEnv(cityRoot string) []string {
-	runtimeDir := RuntimeDataDir(cityRoot)
+	return CityRuntimeEnvForRuntimeDir(cityRoot, "")
+}
+
+// CityRuntimeEnvForRuntimeDir returns city runtime env vars for cityRoot using
+// runtimeDir when it is a trusted override.
+func CityRuntimeEnvForRuntimeDir(cityRoot, runtimeDir string) []string {
+	runtimeDir = strings.TrimSpace(runtimeDir)
+	if runtimeDir == "" {
+		runtimeDir = RuntimeDataDir(cityRoot)
+	}
 	return []string{
 		"GC_CITY=" + cityRoot,
 		"GC_CITY_PATH=" + cityRoot,
 		"GC_CITY_RUNTIME_DIR=" + runtimeDir,
+		"GC_CONTROL_DISPATCHER_TRACE_DEFAULT=" + ControlDispatcherTraceDefaultPathForRuntimeDir(cityRoot, runtimeDir),
 	}
 }
 
-// CityRuntimeEnvMap returns canonical city runtime env vars.
+// CityRuntimeEnvMap returns city runtime env vars rooted at the canonical
+// runtime directory for cityRoot.
 func CityRuntimeEnvMap(cityRoot string) map[string]string {
-	runtimeDir := RuntimeDataDir(cityRoot)
+	return CityRuntimeEnvMapForRuntimeDir(cityRoot, "")
+}
+
+// CityRuntimeEnvMapForRuntimeDir returns city runtime env vars for cityRoot
+// using runtimeDir when it is a trusted override.
+func CityRuntimeEnvMapForRuntimeDir(cityRoot, runtimeDir string) map[string]string {
+	runtimeDir = strings.TrimSpace(runtimeDir)
+	if runtimeDir == "" {
+		runtimeDir = RuntimeDataDir(cityRoot)
+	}
 	return map[string]string{
-		"GC_CITY":             cityRoot,
-		"GC_CITY_PATH":        cityRoot,
-		"GC_CITY_RUNTIME_DIR": runtimeDir,
+		"GC_CITY":                             cityRoot,
+		"GC_CITY_PATH":                        cityRoot,
+		"GC_CITY_RUNTIME_DIR":                 runtimeDir,
+		"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": ControlDispatcherTraceDefaultPathForRuntimeDir(cityRoot, runtimeDir),
 	}
 }
 
@@ -91,3 +135,45 @@ func PackRuntimeEnvMap(cityRoot, packName string) map[string]string {
 	}
 	return env
 }
+
+// TrustedAmbientCityRuntimeDir returns GC_CITY_RUNTIME_DIR only when the
+// ambient process env is already anchored to cityRoot via GC_CITY,
+// GC_CITY_PATH, or GC_CITY_ROOT. Paths outside the city tree are preserved
+// intentionally: they cannot wake the city watcher and let operators relocate
+// runtime artifacts explicitly.
+func TrustedAmbientCityRuntimeDir(cityRoot string) string {
+	runtimeDir := strings.TrimSpace(os.Getenv("GC_CITY_RUNTIME_DIR"))
+	if runtimeDir == "" {
+		return ""
+	}
+	for _, key := range []string{"GC_CITY_PATH", "GC_CITY", "GC_CITY_ROOT"} {
+		if pathutil.SamePath(strings.TrimSpace(os.Getenv(key)), cityRoot) {
+			return pathutil.NormalizePathForCompare(runtimeDir)
+		}
+	}
+	return ""
+}
+
+func normalizeRuntimeDir(cityRoot, runtimeDir string) string {
+	canonicalRuntimeDir := RuntimeDataDir(cityRoot)
+	hiddenRoot := filepath.Join(cityRoot, ".gc")
+	if pathutil.PathWithin(cityRoot, runtimeDir) && !pathutil.PathWithin(hiddenRoot, runtimeDir) {
+		runtimeDir = canonicalRuntimeDir
+	}
+	return runtimeDir
+}
+
+// PublicServiceMountPath returns the supervisor-routable public path for a
+// workspace service: /v0/city/<cityName>/svc/<serviceName>. This is the
+// path the supervisor's public listener actually mounts;
+// internal/api/supervisor.go strips the /v0/city/<cityName> prefix before
+// forwarding the remaining /svc/... segment to the per-city router.
+//
+// Use this when composing a URL that an external service or out-of-process
+// adapter will hit inbound (e.g. as a registered CallbackURL). For paths
+// inside the per-city router (where the /v0/city/<name> prefix is already
+// stripped), use the per-city-relative form returned by
+// config.Service.MountPathOrDefault instead.
+func PublicServiceMountPath(cityName, serviceName string) string {
+	return "/v0/city/" + cityName + "/svc/" + serviceName
+}
diff --git a/internal/citylayout/runtime_test.go b/internal/citylayout/runtime_test.go
index 2f37f96d47..9019fb56c2 100644
--- a/internal/citylayout/runtime_test.go
+++ b/internal/citylayout/runtime_test.go
@@ -1,18 +1,48 @@
 package citylayout
 
 import (
+	"path/filepath"
 	"testing"
 )
 
+func TestCityRuntimeEnv(t *testing.T) {
+	cityRoot := "/city"
+
+	got := CityRuntimeEnv(cityRoot)
+	want := map[string]string{
+		"GC_CITY":                             cityRoot,
+		"GC_CITY_PATH":                        cityRoot,
+		"GC_CITY_RUNTIME_DIR":                 "/city/.gc/runtime",
+		"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": "/city/.gc/runtime/control-dispatcher-trace.log",
+	}
+
+	lookup := make(map[string]string, len(got))
+	for _, entry := range got {
+		for i := 0; i < len(entry); i++ {
+			if entry[i] == '=' {
+				lookup[entry[:i]] = entry[i+1:]
+				break
+			}
+		}
+	}
+
+	for key, expected := range want {
+		if lookup[key] != expected {
+			t.Fatalf("%s = %q, want %q", key, lookup[key], expected)
+		}
+	}
+}
+
 func TestPackRuntimeEnv(t *testing.T) {
 	cityRoot := "/city"
 
 	got := PackRuntimeEnv(cityRoot, "rlm")
 	want := map[string]string{
-		"GC_CITY":             cityRoot,
-		"GC_CITY_PATH":        cityRoot,
-		"GC_CITY_RUNTIME_DIR": "/city/.gc/runtime",
-		"GC_PACK_STATE_DIR":   "/city/.gc/runtime/packs/rlm",
+		"GC_CITY":                             cityRoot,
+		"GC_CITY_PATH":                        cityRoot,
+		"GC_CITY_RUNTIME_DIR":                 "/city/.gc/runtime",
+		"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": "/city/.gc/runtime/control-dispatcher-trace.log",
+		"GC_PACK_STATE_DIR":                   "/city/.gc/runtime/packs/rlm",
 	}
 
 	lookup := make(map[string]string, len(got))
@@ -37,11 +67,55 @@ func TestPackRuntimeEnvMapWithoutPackName(t *testing.T) {
 	if got["GC_CITY_RUNTIME_DIR"] != "/city/.gc/runtime" {
 		t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q", got["GC_CITY_RUNTIME_DIR"], "/city/.gc/runtime")
 	}
+	if got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != "/city/.gc/runtime/control-dispatcher-trace.log" {
+		t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q", got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"], "/city/.gc/runtime/control-dispatcher-trace.log")
+	}
 	if _, ok := got["GC_PACK_STATE_DIR"]; ok {
 		t.Fatal("GC_PACK_STATE_DIR should be omitted when pack name is empty")
 	}
 }
 
+func TestCityRuntimeEnvForRuntimeDir(t *testing.T) {
+	t.Run("preserves external runtime root", func(t *testing.T) {
+		cityRoot := "/city"
+		runtimeDir := "/var/tmp/gascity-runtime"
+		got := CityRuntimeEnvMapForRuntimeDir(cityRoot, runtimeDir)
+		if got["GC_CITY_RUNTIME_DIR"] != runtimeDir {
+			t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q", got["GC_CITY_RUNTIME_DIR"], runtimeDir)
+		}
+		wantTrace := filepath.Join(runtimeDir, "control-dispatcher-trace.log")
+		if got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != wantTrace {
+			t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q", got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"], wantTrace)
+		}
+	})
+
+	t.Run("coerces watcher-visible in-city root", func(t *testing.T) {
+		cityRoot := "/city"
+		runtimeDir := "/city/rigs/alpha"
+		got := CityRuntimeEnvMapForRuntimeDir(cityRoot, runtimeDir)
+		if got["GC_CITY_RUNTIME_DIR"] != runtimeDir {
+			t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q", got["GC_CITY_RUNTIME_DIR"], runtimeDir)
+		}
+		if got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != "/city/.gc/runtime/control-dispatcher-trace.log" {
+			t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q", got["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"], "/city/.gc/runtime/control-dispatcher-trace.log")
+		}
+	})
+}
+
+func TestTrustedAmbientCityRuntimeDirAcceptsLegacyCityRootAnchor(t *testing.T) {
+	cityRoot := t.TempDir()
+	runtimeDir := filepath.Join(cityRoot, ".gc", "runtime")
+
+	t.Setenv("GC_CITY", "")
+	t.Setenv("GC_CITY_PATH", "")
+	t.Setenv("GC_CITY_ROOT", cityRoot)
+	t.Setenv("GC_CITY_RUNTIME_DIR", runtimeDir)
+
+	if got := TrustedAmbientCityRuntimeDir(cityRoot); got != runtimeDir {
+		t.Fatalf("TrustedAmbientCityRuntimeDir() = %q, want %q", got, runtimeDir)
+	}
+}
+
 func TestPublishedServicesDir(t *testing.T) {
 	if got := PublishedServicesDir("/city"); got != "/city/.gc/services/.published" {
 		t.Fatalf("PublishedServicesDir = %q, want %q", got, "/city/.gc/services/.published")
@@ -53,3 +127,34 @@ func TestSessionNameLocksDir(t *testing.T) {
 		t.Fatalf("SessionNameLocksDir = %q, want %q", got, "/city/.gc/session-name-locks")
 	}
 }
+
+func TestPublicServiceMountPath(t *testing.T) {
+	tests := []struct {
+		name        string
+		cityName    string
+		serviceName string
+		want        string
+	}{
+		{
+			name:        "happy path",
+			cityName:    "test-city",
+			serviceName: "slack",
+			want:        "/v0/city/test-city/svc/slack",
+		},
+		{
+			name:        "city with hyphens",
+			cityName:    "demo-app",
+			serviceName: "bridge",
+			want:        "/v0/city/demo-app/svc/bridge",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := PublicServiceMountPath(tt.cityName, tt.serviceName); got != tt.want {
+				t.Errorf("PublicServiceMountPath(%q, %q) = %q, want %q",
+					tt.cityName, tt.serviceName, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/config/chain.go b/internal/config/chain.go
index 69985d519b..80b47496bd 100644
--- a/internal/config/chain.go
+++ b/internal/config/chain.go
@@ -20,7 +20,7 @@ type chainResolveContext struct {
 	builtins   map[string]ProviderSpec
 	visited    map[HopIdentity]bool
 	chain      []HopIdentity
-	chainSpecs []ProviderSpec // raw spec per hop, parallel to chain
+	chainSpecs []ProviderSpec // normalized spec per hop, parallel to chain
 	chainPath  []string       // human-readable chain names for error messages
 }
 
@@ -42,6 +42,10 @@ type chainResolveContext struct {
 // The returned ResolvedProvider carries the fully merged ProviderSpec
 // (via embedded fields), BuiltinAncestor, and Chain (leaf → root).
 func ResolveProviderChain(leafName string, leaf ProviderSpec, customProviders map[string]ProviderSpec) (ResolvedProvider, error) {
+	return resolveProviderChain(leafName, leaf, customProviders, true)
+}
+
+func resolveProviderChain(leafName string, leaf ProviderSpec, customProviders map[string]ProviderSpec, completeResumeDefaults bool) (ResolvedProvider, error) {
 	ctx := &chainResolveContext{
 		all:       customProviders,
 		builtins:  BuiltinProviders(),
@@ -59,7 +63,7 @@ func ResolveProviderChain(leafName string, leaf ProviderSpec, customProviders ma
 	ctx.chainSpecs = append(ctx.chainSpecs, leaf)
 	ctx.chainPath = append(ctx.chainPath, leafName)
 
-	merged, err := ctx.walkFromLeaf(leafName, leaf)
+	merged, err := ctx.walkFromLeaf(leafName, leaf, 0)
 	if err != nil {
 		return ResolvedProvider{}, err
 	}
@@ -84,6 +88,9 @@ func ResolveProviderChain(leafName string, leaf ProviderSpec, customProviders ma
 	}
 
 	resolvedPtr := specToResolved(leafName, &merged)
+	if completeResumeDefaults {
+		completeResolvedProviderResumeCommand(resolvedPtr)
+	}
 	resolvedPtr.BuiltinAncestor = ancestor
 	resolvedPtr.Chain = ctx.chain
 	resolvedPtr.Provenance = buildProviderProvenance(ctx, customProviders)
@@ -96,15 +103,19 @@ func ResolveProviderChain(leafName string, leaf ProviderSpec, customProviders ma
 
 // walkFromLeaf does the recursive merge: resolve parent (if any), then
 // merge leaf over parent.
-func (ctx *chainResolveContext) walkFromLeaf(name string, spec ProviderSpec) (ProviderSpec, error) {
+func (ctx *chainResolveContext) walkFromLeaf(name string, spec ProviderSpec, chainIndex int) (ProviderSpec, error) {
 	if spec.Base == nil {
 		// No base declared — this is a chain root. Return as-is.
-		return spec, nil
+		normalized := normalizeProviderLayerArgsForSchema(spec, spec.OptionsSchema)
+		ctx.chainSpecs[chainIndex] = normalized
+		return normalized, nil
 	}
 	baseValue := strings.TrimSpace(*spec.Base)
 	if baseValue == "" {
 		// Explicit empty opt-out — no inheritance.
-		return spec, nil
+		normalized := normalizeProviderLayerArgsForSchema(spec, spec.OptionsSchema)
+		ctx.chainSpecs[chainIndex] = normalized
+		return normalized, nil
 	}
 
 	parentKind, parentName, err := classifyBase(baseValue)
@@ -137,15 +148,19 @@ func (ctx *chainResolveContext) walkFromLeaf(name string, spec ProviderSpec) (Pr
 	ctx.chain = append(ctx.chain, parentID)
 	ctx.chainSpecs = append(ctx.chainSpecs, parentSpec)
 	ctx.chainPath = append(ctx.chainPath, formatHopName(parentID))
+	parentIndex := len(ctx.chain) - 1
 
 	// Recurse: resolve the parent's own chain first.
-	parentMerged, err := ctx.walkFromLeaf(parentName, parentSpec)
+	parentMerged, err := ctx.walkFromLeaf(parentName, parentSpec, parentIndex)
 	if err != nil {
 		return ProviderSpec{}, err
 	}
 
 	// Merge leaf over parent (parent is the "base", leaf is the "city").
-	return MergeProviderOverBuiltin(parentMerged, spec), nil
+	layerSchema := providerSchemaForLayerArgs(parentMerged, spec)
+	child := normalizeProviderLayerArgsForSchema(spec, layerSchema)
+	ctx.chainSpecs[chainIndex] = child
+	return MergeProviderOverBuiltin(parentMerged, child), nil
 }
 
 // lookupBase resolves a base reference to a ProviderSpec and confirms its
@@ -316,7 +331,9 @@ func buildProviderProvenance(ctx *chainResolveContext, customProviders map[strin
 		MapKeyLayer: make(map[string]map[string]string),
 	}
 	// Walk leaf → root; record the FIRST layer (leaf-most) that sets
-	// each scalar field. For additive maps, record per-key leaf-most.
+	// each scalar field. For additive maps, record per-key leaf-most. Specs are
+	// post-normalization so option_defaults inferred from args can be attributed to
+	// the layer that declared those args.
 	for i, hop := range ctx.chain {
 		spec := ctx.chainSpecs[i]
 		layer := provenanceSource(hop)
diff --git a/internal/config/compose.go b/internal/config/compose.go
index 577b4114e6..7295a06dd0 100644
--- a/internal/config/compose.go
+++ b/internal/config/compose.go
@@ -31,6 +31,9 @@ type Provenance struct {
 	Workspace map[string]string
 	// Warnings collects non-fatal collision warnings from composition.
 	Warnings []string
+
+	sourceContents   map[string][]byte
+	revisionSnapshot *revisionSnapshot
 }
 
 // LoadOptions controls optional config-loading behavior.
@@ -62,6 +65,7 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 	}
 	cityRoot := filepath.Dir(path)
 	prov := newProvenance(path)
+	prov.recordSource(path, data)
 	prov.Warnings = append(prov.Warnings, rootWarnings...)
 	cityAgentsForProvenance := root.Agents
 
@@ -176,6 +180,7 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 		// Track pack.toml agents in provenance.
 		trackAgents(prov, pc.Agents, packPath)
 		prov.Sources = append(prov.Sources, packPath)
+		prov.recordSource(packPath, packData)
 
 		packCommands, err := DiscoverPackCommands(fs, cityRoot, pc.Pack.Name)
 		if err != nil {
@@ -294,6 +299,7 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 		// Merge fragment into root.
 		mergeFragment(root, frag, fragMeta, fragPath, prov)
 		prov.Sources = append(prov.Sources, fragPath)
+		prov.recordSource(fragPath, fragData)
 	}
 
 	// Inject system pack includes into Workspace.Includes. These are
@@ -318,7 +324,7 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 	// Resolve named pack references to cache paths before any expansion.
 	resolveNamedPacks(root, cityRoot)
 
-	implicitImports, implicitPath, implicitErr := ReadImplicitImports()
+	implicitImports, implicitPath, implicitData, implicitErr := readImplicitImportsWithData()
 	if implicitErr != nil {
 		return nil, nil, implicitErr
 	}
@@ -370,6 +376,9 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 		}
 		if addedImplicit && implicitPath != "" {
 			prov.Sources = append(prov.Sources, implicitPath)
+			if implicitData != nil {
+				prov.recordSource(implicitPath, implicitData)
+			}
 		}
 	}
 
@@ -495,6 +504,16 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 		return nil, nil, fmt.Errorf("%s: provider cache build failed: %w", path, err)
 	}
 
+	// v0.15.1: enrich every agent with its convention-discovered
+	// agent-local asset paths (agents/<name>/skills/, agents/<name>/mcp/).
+	// DiscoverPackAgents only does this for agents it creates — it skips
+	// names already present in pack.toml [[agent]] or city.toml
+	// [[agent]] entries, so those agents leave the discovery pass with
+	// empty SkillsDir/MCPDir even when agents/<name>/skills/ exists on
+	// disk. The materializer and collision validator both key off
+	// SkillsDir, so that gap silently loses agent-local skills for every
+	// explicitly-declared agent. Populate the fields here so the
+	// convention works uniformly.
 	populateAgentLocalAssetDirs(fs, root, cityRoot)
 
 	// Load namepool files for pool agents.
@@ -513,16 +532,10 @@ func LoadWithIncludesOptions(fs fsys.FS, path string, opts LoadOptions, extraInc
 		prov.Warnings = append(prov.Warnings, warning)
 	}
 
-	// v0.15.1: enrich every agent with its convention-discovered
-	// agent-local asset paths (agents/<name>/skills/, agents/<name>/mcp/).
-	// DiscoverPackAgents only does this for agents it creates — it skips
-	// names already present in pack.toml [[agent]] or city.toml
-	// [[agent]] entries, so those agents leave the discovery pass with
-	// empty SkillsDir/MCPDir even when agents/<name>/skills/ exists on
-	// disk. The materializer and collision validator both key off
-	// SkillsDir, so that gap silently loses agent-local skills for every
-	// explicitly-declared agent. Populate the fields here so the
-	// convention works uniformly.
+	// Capture revision inputs after all config and pack discovery so callers
+	// can compare the loaded snapshot to future reloads without re-reading
+	// mutable files from disk.
+	prov.captureRevisionSnapshot(fs, root, cityRoot)
 	return root, prov, nil
 }
 
@@ -1203,6 +1216,15 @@ func newProvenance(rootPath string) *Provenance {
 	}
 }
 
+func (p *Provenance) recordSource(path string, data []byte) {
+	if p.sourceContents == nil {
+		p.sourceContents = make(map[string][]byte)
+	}
+	cp := make([]byte, len(data))
+	copy(cp, data)
+	p.sourceContents[path] = cp
+}
+
 func trackAgents(prov *Provenance, agents []Agent, source string) {
 	for _, a := range agents {
 		prov.Agents[a.QualifiedName()] = source
diff --git a/internal/config/config.go b/internal/config/config.go
index 7fe378b474..dd4cf77b48 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 	"unicode"
@@ -14,6 +15,7 @@ import (
 	"github.com/BurntSushi/toml"
 	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/orders"
 )
 
 // validAgentName matches names safe for use in session identifiers.
@@ -30,17 +32,43 @@ const (
 	// ControlDispatcherAgentName is the built-in deterministic control lane for
 	// graph.v2 workflow control beads.
 	ControlDispatcherAgentName = "control-dispatcher"
+	// controlDispatcherDefaultTracePathExpr is the watcher-safe default trace
+	// target for the control-dispatcher. The controller ignores the hidden .gc
+	// subtree recursively, so defaults must stay under it to avoid self-triggered
+	// config-watch churn. The trace intentionally stays a flat, well-known file
+	// under .gc/runtime because operators and tests tail a single canonical path.
+	controlDispatcherDefaultTracePathExpr = `${GC_CONTROL_DISPATCHER_TRACE_DEFAULT:-${GC_CITY}/` + citylayout.RuntimeDataRoot + `/control-dispatcher-trace.log}`
+	// controlDispatcherTraceInit exports the resolved trace path. Explicit
+	// GC_WORKFLOW_TRACE overrides win first; otherwise the runtime injects a
+	// precomputed watcher-safe default trace path for the current city/session.
+	controlDispatcherTraceInit = `export GC_WORKFLOW_TRACE="${GC_WORKFLOW_TRACE:-` + controlDispatcherDefaultTracePathExpr + `}"`
+	// controlDispatcherTraceDirInit creates the parent directory for the
+	// resolved trace path. This preserves explicit GC_WORKFLOW_TRACE overrides
+	// instead of unconditionally depending on the default runtime root.
+	controlDispatcherTraceDirInit = `trace_dir="${GC_WORKFLOW_TRACE%/*}"; if [ "$trace_dir" = "$GC_WORKFLOW_TRACE" ]; then trace_dir="."; elif [ -z "$trace_dir" ]; then trace_dir="/"; fi; mkdir -p "$trace_dir"`
 	// ControlDispatcherStartCommand runs the built-in control-dispatcher worker.
 	// Wrapped in `sh -c` so any appended prompt suffix is ignored as $0.
 	// The control lane is kept resident and blocks on workflow-relevant city
 	// events instead of exiting after each one-shot drain.
-	ControlDispatcherStartCommand = `sh -c 'export GC_WORKFLOW_TRACE="${GC_WORKFLOW_TRACE:-${GC_CITY}/control-dispatcher-trace.log}"; exec "${GC_BIN:-gc}" convoy control --serve --follow ` + ControlDispatcherAgentName + `'`
+	//
+	// The trace log default is under .gc/runtime/ so it sits inside the
+	// controller's fsnotify exclusion (cmd/gc/controller.go shouldIgnoreConfigWatchEvent
+	// excludes the .gc and .beads path segments). Placing it at city root
+	// caused every append to fire markDirty() through the watcher debouncer,
+	// which kept the patrol loop in continuous reconciliation and blew patrol
+	// cycle duration well past the configured patrol_interval. See
+	// engdocs/design/session-reconciler-tracing.md for the canonical
+	// .gc/runtime/ convention for trace data.
+	ControlDispatcherStartCommand = `sh -c '` + controlDispatcherTraceInit + `; ` + controlDispatcherTraceDirInit + `; exec "${GC_BIN:-gc}" convoy control --serve --follow ` + ControlDispatcherAgentName + `'`
 )
 
 // ControlDispatcherStartCommandFor returns the start command for a
-// control-dispatcher agent with the given qualified name.
+// control-dispatcher agent with the given qualified name. The trace log
+// default lives under .gc/runtime/ to stay inside the controller's
+// fsnotify exclusion; see ControlDispatcherStartCommand for the full
+// rationale.
 func ControlDispatcherStartCommandFor(qualifiedName string) string {
-	return `sh -c 'export GC_WORKFLOW_TRACE="${GC_WORKFLOW_TRACE:-${GC_CITY}/control-dispatcher-trace.log}"; exec "${GC_BIN:-gc}" convoy control --serve --follow ` + qualifiedName + `'`
+	return `sh -c '` + controlDispatcherTraceInit + `; ` + controlDispatcherTraceDirInit + `; exec "${GC_BIN:-gc}" convoy control --serve --follow ` + qualifiedName + `'`
 }
 
 // BindingQualifiedName returns the binding-qualified agent identity without a
@@ -52,6 +80,16 @@ func (a *Agent) BindingQualifiedName() string {
 	return a.BindingName + "." + a.Name
 }
 
+// BindingPrefix returns the import binding prefix for route/template
+// interpolation, including the trailing dot when a binding is present.
+func (a *Agent) BindingPrefix() string {
+	bindingName := strings.TrimSpace(a.BindingName)
+	if bindingName == "" {
+		return ""
+	}
+	return bindingName + "."
+}
+
 // QualifiedName returns the agent's canonical identity, including the rig
 // prefix when present. Examples: "mayor", "gastown.mayor",
 // "hello-world/polecat", and "hello-world/gastown.polecat".
@@ -161,6 +199,9 @@ type City struct {
 	SessionSleep SessionSleepConfig `toml:"session_sleep,omitempty"`
 	// Convergence configures convergence loop limits.
 	Convergence ConvergenceConfig `toml:"convergence,omitempty"`
+	// Doctor configures gc doctor thresholds and policy toggles
+	// (worktree size warnings, nested-worktree auto-prune).
+	Doctor DoctorConfig `toml:"doctor,omitempty"`
 	// Services declares workspace-owned HTTP services mounted on the
 	// controller edge under /svc/{name}.
 	Services []Service `toml:"service,omitempty"`
@@ -469,7 +510,7 @@ type AgentOverride struct {
 	// PromptTemplate overrides the prompt template path.
 	// Relative paths resolve against the city directory.
 	PromptTemplate *string `toml:"prompt_template,omitempty"`
-	// Session overrides the session transport ("acp").
+	// Session overrides the session transport ("acp" or "tmux").
 	Session *string `toml:"session,omitempty"`
 	// Provider overrides the provider name.
 	Provider *string `toml:"provider,omitempty"`
@@ -547,7 +588,8 @@ type AgentOverride struct {
 	MaxActiveSessions *int `toml:"max_active_sessions,omitempty"`
 	// MinActiveSessions overrides the minimum number of sessions to keep alive.
 	MinActiveSessions *int `toml:"min_active_sessions,omitempty"`
-	// ScaleCheck overrides the shell command whose output determines desired session count.
+	// ScaleCheck overrides the shell command whose output reports new
+	// unassigned session demand for bead-backed reconciliation.
 	ScaleCheck *string `toml:"scale_check,omitempty"`
 	// OptionDefaults adds or overrides provider option defaults for this agent.
 	// Keys are option keys, values are choice values. Merges additively
@@ -1047,6 +1089,11 @@ type DoltConfig struct {
 	Port int `toml:"port,omitempty" jsonschema:"default=0"`
 	// Host is the dolt server hostname. Defaults to localhost.
 	Host string `toml:"host,omitempty" jsonschema:"default=localhost"`
+	// ArchiveLevel controls Dolt's auto_gc archive aggressiveness.
+	// 0 disables archive compaction (lower CPU on startup).
+	// 1 enables archive compaction (higher CPU on startup).
+	// nil (omitted) defaults to 0.
+	ArchiveLevel *int `toml:"archive_level,omitempty" jsonschema:"default=0"`
 }
 
 // FormulasConfig holds formula directory settings.
@@ -1073,8 +1120,13 @@ type OrdersConfig struct {
 type OrderOverride struct {
 	// Name is the order name to target (required).
 	Name string `toml:"name" jsonschema:"required"`
-	// Rig scopes the override to a specific rig's order.
-	// Empty matches city-level orders.
+	// Rig scopes the override to a specific rig's order. Empty matches
+	// ONLY city-level orders (those with no rig); it does NOT match
+	// per-rig instances of the same name — those expand at scan time
+	// and require an explicit rig. Use rig = "*" as a wildcard to match
+	// every instance of the named order (city-level + every rig-scoped
+	// copy). The literal "*" is reserved and rejected as a real rig
+	// name by config validation.
 	Rig string `toml:"rig,omitempty"`
 	// Enabled overrides whether the order is active.
 	Enabled *bool `toml:"enabled,omitempty"`
@@ -1180,6 +1232,95 @@ func (c ChatSessionsConfig) IdleTimeoutDuration() time.Duration {
 	return d
 }
 
+// DoctorConfig holds settings for the gc doctor surface. Operator-tunable
+// thresholds and policy toggles live here; mechanical structural checks
+// (broken-worktree pointers, missing files) remain hardcoded since they
+// cannot be operator-tuned in any meaningful sense.
+type DoctorConfig struct {
+	// WorktreeRigWarnSize is the per-rig warning threshold for the total
+	// disk footprint under .gc/worktrees/<rig>/. Reported by the
+	// worktree-disk-size check. Go-style human size string ("10GB", "500MB").
+	// Empty or unparseable falls back to the default (10 GB).
+	WorktreeRigWarnSize string `toml:"worktree_rig_warn_size,omitempty" jsonschema:"default=10GB"`
+
+	// WorktreeRigErrorSize is the per-rig error threshold. When any rig
+	// exceeds this, the worktree-disk-size check reports an error rather
+	// than a warning. Empty or unparseable falls back to the default
+	// (50 GB).
+	WorktreeRigErrorSize string `toml:"worktree_rig_error_size,omitempty" jsonschema:"default=50GB"`
+
+	// NestedWorktreePrune escalates the nested-worktree-prune check
+	// from warning to error severity when safely-prunable nested
+	// worktrees are present, so CI / scripted doctor runs fail until
+	// the operator runs `gc doctor --fix`. Actual removal still
+	// requires --fix; this flag does not auto-prune. Safety is
+	// enforced by mechanical checks (no uncommitted changes, no
+	// unpushed commits, no stashes) — never by role identity.
+	NestedWorktreePrune bool `toml:"nested_worktree_prune,omitempty" jsonschema:"default=false"`
+}
+
+const (
+	defaultWorktreeRigWarnBytes  = int64(10) * 1024 * 1024 * 1024 // 10 GB
+	defaultWorktreeRigErrorBytes = int64(50) * 1024 * 1024 * 1024 // 50 GB
+)
+
+// WorktreeRigWarnBytes returns the warning threshold in bytes. Falls
+// back to defaultWorktreeRigWarnBytes when unset, unparseable, or
+// non-positive.
+func (c DoctorConfig) WorktreeRigWarnBytes() int64 {
+	if n, ok := parseHumanSize(c.WorktreeRigWarnSize); ok && n > 0 {
+		return n
+	}
+	return defaultWorktreeRigWarnBytes
+}
+
+// WorktreeRigErrorBytes returns the error threshold in bytes. Falls
+// back to defaultWorktreeRigErrorBytes when unset, unparseable, or
+// non-positive. The error threshold is clamped to at least the warn
+// threshold to keep the two-tier semantics monotonic; if the operator
+// configures error < warn, the warn value wins.
+func (c DoctorConfig) WorktreeRigErrorBytes() int64 {
+	warn := c.WorktreeRigWarnBytes()
+	n, ok := parseHumanSize(c.WorktreeRigErrorSize)
+	if !ok || n <= 0 {
+		n = defaultWorktreeRigErrorBytes
+	}
+	if n < warn {
+		return warn
+	}
+	return n
+}
+
+// parseHumanSize parses sizes like "10GB", "500 MB", "1024" (bytes
+// implied) into a byte count. Whitespace tolerant, case-insensitive.
+// Returns ok=false when the string is empty or unparseable so callers
+// can apply their own default.
+func parseHumanSize(s string) (int64, bool) {
+	s = strings.TrimSpace(strings.ToUpper(s))
+	if s == "" {
+		return 0, false
+	}
+	var unit int64 = 1
+	switch {
+	case strings.HasSuffix(s, "GB"):
+		unit = 1024 * 1024 * 1024
+		s = strings.TrimSpace(strings.TrimSuffix(s, "GB"))
+	case strings.HasSuffix(s, "MB"):
+		unit = 1024 * 1024
+		s = strings.TrimSpace(strings.TrimSuffix(s, "MB"))
+	case strings.HasSuffix(s, "KB"):
+		unit = 1024
+		s = strings.TrimSpace(strings.TrimSuffix(s, "KB"))
+	case strings.HasSuffix(s, "B"):
+		s = strings.TrimSpace(strings.TrimSuffix(s, "B"))
+	}
+	n, err := strconv.ParseInt(s, 10, 64)
+	if err != nil {
+		return 0, false
+	}
+	return n * unit, true
+}
+
 // ConvergenceConfig holds convergence loop limits.
 type ConvergenceConfig struct {
 	// MaxPerAgent is the maximum number of active convergence loops per agent.
@@ -1226,6 +1367,20 @@ type DaemonConfig struct {
 	// RestartWindow is the sliding time window for counting restarts.
 	// Duration string (e.g., "30s", "5m", "1h"). Defaults to "1h".
 	RestartWindow string `toml:"restart_window,omitempty" jsonschema:"default=1h"`
+	// SessionCircuitBreaker enables the named-session respawn circuit breaker.
+	// When enabled, the controller suppresses no-progress named-session respawns
+	// after the configured restart threshold is exceeded.
+	SessionCircuitBreaker bool `toml:"session_circuit_breaker,omitempty"`
+	// SessionCircuitBreakerMaxRestarts overrides MaxRestarts for the
+	// named-session respawn circuit breaker. Nil reuses MaxRestartsOrDefault.
+	// 0 disables the circuit breaker even when SessionCircuitBreaker is true.
+	SessionCircuitBreakerMaxRestarts *int `toml:"session_circuit_breaker_max_restarts,omitempty" jsonschema:"default=5"`
+	// SessionCircuitBreakerWindow overrides RestartWindow for the named-session
+	// respawn circuit breaker. Empty reuses RestartWindowDuration.
+	SessionCircuitBreakerWindow string `toml:"session_circuit_breaker_window,omitempty" jsonschema:"default=1h"`
+	// SessionCircuitBreakerResetAfter is the cooldown before an open named-session
+	// breaker resets automatically. Empty defaults to 2 * SessionCircuitBreakerWindowDuration.
+	SessionCircuitBreakerResetAfter string `toml:"session_circuit_breaker_reset_after,omitempty"`
 	// ShutdownTimeout is the time to wait after sending Ctrl-C before force-killing
 	// agents during shutdown. Duration string (e.g., "5s", "30s"). Set to "0s"
 	// for immediate kill. Defaults to "5s".
@@ -1293,6 +1448,42 @@ func (d *DaemonConfig) RestartWindowDuration() time.Duration {
 	return dur
 }
 
+// SessionCircuitBreakerMaxRestartsOrDefault returns the named-session respawn
+// circuit-breaker threshold. Nil reuses MaxRestartsOrDefault; zero disables it.
+func (d *DaemonConfig) SessionCircuitBreakerMaxRestartsOrDefault() int {
+	if d.SessionCircuitBreakerMaxRestarts == nil {
+		return d.MaxRestartsOrDefault()
+	}
+	return *d.SessionCircuitBreakerMaxRestarts
+}
+
+// SessionCircuitBreakerWindowDuration returns the named-session respawn
+// circuit-breaker rolling window. Empty reuses RestartWindowDuration.
+func (d *DaemonConfig) SessionCircuitBreakerWindowDuration() time.Duration {
+	if d.SessionCircuitBreakerWindow == "" {
+		return d.RestartWindowDuration()
+	}
+	dur, err := time.ParseDuration(d.SessionCircuitBreakerWindow)
+	if err != nil {
+		return d.RestartWindowDuration()
+	}
+	return dur
+}
+
+// SessionCircuitBreakerResetAfterDuration returns the named-session respawn
+// circuit-breaker cooldown. Empty or invalid values default to 2 * window.
+func (d *DaemonConfig) SessionCircuitBreakerResetAfterDuration() time.Duration {
+	window := d.SessionCircuitBreakerWindowDuration()
+	if d.SessionCircuitBreakerResetAfter == "" {
+		return 2 * window
+	}
+	dur, err := time.ParseDuration(d.SessionCircuitBreakerResetAfter)
+	if err != nil {
+		return 2 * window
+	}
+	return dur
+}
+
 // ShutdownTimeoutDuration returns the shutdown timeout as a time.Duration.
 // Defaults to 5s if empty or unparseable. Zero means immediate kill.
 func (d *DaemonConfig) ShutdownTimeoutDuration() time.Duration {
@@ -1477,7 +1668,7 @@ func normalizeAgentDefaultsAlias(cfg *City, meta toml.MetaData) {
 type Agent struct {
 	// Name is the unique identifier for this agent.
 	Name string `toml:"name" jsonschema:"required"`
-	// Description is a human-readable description shown in MC's session creation UI.
+	// Description is a human-readable description shown in a real-world app's session creation UI.
 	Description string `toml:"description,omitempty"`
 	// Dir is the identity prefix for rig-scoped agents and the default
 	// working directory when WorkDir is not set.
@@ -1503,10 +1694,11 @@ type Agent struct {
 	// Used for CLI agents that don't accept command-line prompts.
 	Nudge string `toml:"nudge,omitempty"`
 	// Session overrides the session transport for this agent.
-	// "" (default) uses the city-level session provider (typically tmux).
-	// "acp" uses the Agent Client Protocol (JSON-RPC over stdio).
-	// The agent's resolved provider must have supports_acp = true.
-	Session string `toml:"session,omitempty" jsonschema:"enum=acp"`
+	// "" (default) uses the provider default.
+	// "tmux" uses the tmux-backed CLI path even when the provider supports ACP.
+	// "acp" uses the Agent Client Protocol (JSON-RPC over stdio); the agent's
+	// resolved provider must have supports_acp = true.
+	Session string `toml:"session,omitempty" jsonschema:"enum=acp,enum=tmux"`
 	// Provider names the provider preset to use for this agent.
 	Provider string `toml:"provider,omitempty"`
 	// StartCommand overrides the provider's command for this agent.
@@ -1539,12 +1731,15 @@ type Agent struct {
 	// MinActiveSessions is the minimum number of sessions to keep alive.
 	// Agent-level only. Counts against rig/workspace caps. Replaces pool.min.
 	MinActiveSessions *int `toml:"min_active_sessions,omitempty"`
-	// ScaleCheck is a shell command template whose output determines desired
-	// session count. Optional override — when set, its output is the desired
-	// count (still clamped by all cap levels). If it contains Go template
-	// placeholders, gc expands them using the same PathContext fields as
-	// work_dir and session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot,
-	// CityName) before running the command.
+	// ScaleCheck is a shell command template whose output reports new
+	// unassigned session demand. In bead-backed reconciliation this is
+	// additive: assigned work is resumed separately, and ScaleCheck reports
+	// only how many new generic sessions to start, still bounded by all cap
+	// levels. Legacy no-store evaluation continues to treat the output as
+	// the desired session count. If it contains Go template placeholders, gc
+	// expands them using the same PathContext fields as work_dir and
+	// session_setup (Agent, AgentBase, Rig, RigRoot, CityRoot, CityName)
+	// before running the command.
 	ScaleCheck string `toml:"scale_check,omitempty"`
 	// DrainTimeout is the maximum time to wait for a session to finish its
 	// current work before force-killing it during scale-down. Duration string
@@ -1771,6 +1966,8 @@ func (a *Agent) AttachEnabled() bool {
 //
 // State priority: in_progress+assigned (crash recovery) >
 // ready+assigned (pre-assigned) > ready+unassigned+routed_to (pool).
+// Formula roots that are themselves executable must be represented as ready()
+// work (for example type=wisp); molecule containers are not routable demand.
 //
 // When the reconciler runs the query for demand detection (no session
 // context), all identity vars are empty → assignee tiers skip → only
@@ -1807,10 +2004,7 @@ func (a *Agent) EffectiveWorkQuery() string {
 			`r=$(bd ready --metadata-field gc.routed_to=` + target +
 			` --unassigned --json --limit=1 2>/dev/null); ` +
 			`[ -n "$r" ] && [ "$r" != "[]" ] && printf "%s" "$r" && exit 0; ` +
-			// Tier 4: open routed molecule roots. scale_check already counts
-			// these, so startup must be able to see them too.
-			`bd list --metadata-field gc.routed_to=` + target +
-			` --status=open --type=molecule --no-assignee --json --limit=1 2>/dev/null'`
+			`printf "[]"'`
 	}
 	return `sh -c '` +
 		// Tier 1: in_progress assigned to any of my identifiers (crash recovery).
@@ -1909,22 +2103,16 @@ func (a *Agent) DrainTimeoutDuration() time.Duration {
 
 // EffectiveScaleCheck returns the scale check command for this agent.
 // If ScaleCheck is set, returns it. Otherwise returns a default that
-// counts actionable work routed to this agent's template, including
-// standalone formula-dispatched molecule beads (which bd ready excludes).
-// Attached formulas contribute demand through the routed source bead in the
-// ready/in_progress tiers instead of through the molecule count.
+// counts new unassigned work routed to this agent's template via ready().
+// Assigned in-progress work is resumed from session beads, so it must not
+// create additional generic pool demand here.
 func (a *Agent) EffectiveScaleCheck() string {
 	if a.ScaleCheck != "" {
 		return a.ScaleCheck
 	}
 	template := a.QualifiedName()
-	return `ready=$(bd ready --metadata-field gc.routed_to=` + template +
-		` --unassigned --json 2>/dev/null | jq 'length' 2>/dev/null); ` +
-		`active=$(bd list --metadata-field gc.routed_to=` + template +
-		` --status=in_progress --no-assignee --json 2>/dev/null | jq 'length' 2>/dev/null); ` +
-		`molecules=$(bd list --metadata-field gc.routed_to=` + template +
-		` --status=open --type=molecule --no-assignee --json 2>/dev/null | jq 'length' 2>/dev/null); ` +
-		`echo "$(( ${ready:-0} + ${active:-0} + ${molecules:-0} ))" || echo 0`
+	return `ready_json=$(bd ready --metadata-field gc.routed_to=` + template +
+		` --unassigned --limit 0 --json) && printf '%s\n' "$ready_json" | jq 'length'`
 }
 
 // EffectiveMaxActiveSessions returns the agent's max active sessions.
@@ -2022,10 +2210,26 @@ func (a *Agent) EffectiveOnDeath() string {
 	if a.OnDeath != "" {
 		return a.OnDeath
 	}
+	route := a.QualifiedName()
+	if a.PoolName != "" {
+		route = a.PoolName
+	}
+	// Reset both assignee and status: clearing assignee alone leaves the bead
+	// invisible to every work_query tier (Tier 1 needs assignee match, Tiers
+	// 2/3 only match "ready" status). The next worker re-claims via Tier 3
+	// (gc.routed_to + --unassigned). If routed metadata is missing entirely,
+	// backfill the fallback route so reopened direct-assigned work does not
+	// stay invisible.
 	return `bd list --assignee=` + a.QualifiedName() +
 		` --status=in_progress --json 2>/dev/null | ` +
-		`jq -r '.[].id' 2>/dev/null | ` +
-		`xargs -rI{} bd update {} --assignee "" 2>/dev/null`
+		`jq -r '.[] | [.id, (.metadata["gc.routed_to"] // "")] | @tsv' 2>/dev/null | ` +
+		`while IFS="$(printf '\t')" read -r id current_route; do ` +
+		`[ -z "$id" ] && continue; ` +
+		`if [ -n "$current_route" ]; then ` +
+		`bd update "$id" --assignee "" --status open 2>/dev/null; ` +
+		`else bd update "$id" --assignee "" --status open --set-metadata gc.routed_to=` + route + ` 2>/dev/null; ` +
+		`fi; ` +
+		`done`
 }
 
 // EffectiveOnBoot returns the on_boot command for this agent.
@@ -2040,9 +2244,9 @@ func (a *Agent) EffectiveOnBoot() string {
 		template = a.PoolName
 	}
 	return `bd list --metadata-field gc.routed_to=` + template +
-		` --status=in_progress --json 2>/dev/null | ` +
+		` --status=in_progress --no-assignee --json 2>/dev/null | ` +
 		`jq -r '.[].id' 2>/dev/null | ` +
-		`xargs -rI{} bd update {} --assignee "" 2>/dev/null`
+		`xargs -rI{} bd update {} --status open 2>/dev/null`
 }
 
 // InjectImplicitAgents adds on-demand agents for each configured provider at
@@ -2600,6 +2804,11 @@ func ValidateRigs(rigs []Rig, hqPrefix string) error {
 		if r.Name == "" {
 			return fmt.Errorf("rig[%d]: name is required", i)
 		}
+		// orders.RigWildcard is reserved as the [[orders.overrides]]
+		// token; a real rig with that name would be silently shadowed.
+		if r.Name == orders.RigWildcard {
+			return fmt.Errorf("rig[%d]: name %q is reserved as the [[orders.overrides]] wildcard", i, r.Name)
+		}
 		if r.Path == "" {
 			return fmt.Errorf("rig %q: path is required", r.Name)
 		}
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index b1e840f005..574ddd6971 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/gastownhall/gascity/internal/citylayout"
 	"github.com/gastownhall/gascity/internal/fsys"
 )
 
@@ -1320,8 +1321,8 @@ func TestEffectiveWorkQueryPoolDefault(t *testing.T) {
 	if !strings.Contains(got, "bd ready --metadata-field gc.routed_to=hello-world/polecat --unassigned --json --limit=1") {
 		t.Errorf("EffectiveWorkQuery() missing tier 3 routed_to: %q", got)
 	}
-	if !strings.Contains(got, "bd list --metadata-field gc.routed_to=hello-world/polecat --status=open --type=molecule --no-assignee --json --limit=1") {
-		t.Errorf("EffectiveWorkQuery() missing tier 4 molecule route: %q", got)
+	if strings.Contains(got, "--type=molecule") {
+		t.Errorf("EffectiveWorkQuery() should not route molecule containers: %q", got)
 	}
 }
 
@@ -1373,8 +1374,8 @@ func TestEffectiveWorkQueryPoolNameOverride(t *testing.T) {
 	if !strings.Contains(got, "bd ready --metadata-field gc.routed_to=hello-world/dog --unassigned --json --limit=1") {
 		t.Errorf("EffectiveWorkQuery() missing tier 3 routed_to with pool name: %q", got)
 	}
-	if !strings.Contains(got, "bd list --metadata-field gc.routed_to=hello-world/dog --status=open --type=molecule --no-assignee --json --limit=1") {
-		t.Errorf("EffectiveWorkQuery() missing tier 4 molecule route with pool name: %q", got)
+	if strings.Contains(got, "--type=molecule") {
+		t.Errorf("EffectiveWorkQuery() should not route molecule containers with pool name: %q", got)
 	}
 }
 
@@ -1489,11 +1490,11 @@ func TestDefaultPoolCheckUsesBdReady(t *testing.T) {
 	if !strings.Contains(check, "bd ready") {
 		t.Errorf("EffectiveScaleCheck() = %q, want bd ready for blocker-aware counting", check)
 	}
-	if !strings.Contains(check, "--status=in_progress") {
-		t.Errorf("EffectiveScaleCheck() = %q, want --status=in_progress for active work", check)
+	if strings.Contains(check, "--type=molecule") {
+		t.Errorf("EffectiveScaleCheck() = %q, should not count molecule containers as demand", check)
 	}
-	if !strings.Contains(check, "--type=molecule") {
-		t.Errorf("EffectiveScaleCheck() = %q, want --type=molecule for formula-dispatched work", check)
+	if strings.Contains(check, "--status=in_progress") || strings.Contains(check, "${active:-0}") {
+		t.Errorf("EffectiveScaleCheck() = %q, should not count in-progress work as new demand", check)
 	}
 }
 
@@ -1587,21 +1588,18 @@ func TestEffectiveScaleCheckDefaults(t *testing.T) {
 		MinActiveSessions: ptrInt(0), MaxActiveSessions: ptrInt(1),
 	}
 	check := a.EffectiveScaleCheck()
-	// Default check uses bd ready (blocker-aware) + in_progress count + molecule count via gc.routed_to.
+	// Default check uses bd ready for blocker-aware routed demand.
 	if !strings.Contains(check, "gc.routed_to=refinery") {
 		t.Errorf("EffectiveScaleCheck = %q, want gc.routed_to=refinery", check)
 	}
-	if !strings.Contains(check, "--status=in_progress") {
-		t.Errorf("EffectiveScaleCheck = %q, want --status=in_progress for active work", check)
+	if !strings.Contains(check, "--unassigned") {
+		t.Errorf("EffectiveScaleCheck = %q, want --unassigned for new unassigned demand", check)
 	}
-	if !strings.Contains(check, "--no-assignee") {
-		t.Errorf("EffectiveScaleCheck = %q, want --no-assignee for active unassigned work", check)
+	if strings.Contains(check, "--type=molecule") || strings.Contains(check, "${molecules:-0}") {
+		t.Errorf("EffectiveScaleCheck = %q, should not count molecule containers as demand", check)
 	}
-	if !strings.Contains(check, "--type=molecule") {
-		t.Errorf("EffectiveScaleCheck = %q, want --type=molecule for formula-dispatched work", check)
-	}
-	if !strings.Contains(check, "${molecules:-0}") {
-		t.Errorf("EffectiveScaleCheck = %q, want ${molecules:-0} in arithmetic sum", check)
+	if strings.Contains(check, "--status=in_progress") || strings.Contains(check, "${active:-0}") {
+		t.Errorf("EffectiveScaleCheck = %q, should not count in-progress work as new demand", check)
 	}
 }
 
@@ -1616,20 +1614,20 @@ func TestEffectiveScaleCheckDefaultsQualified(t *testing.T) {
 	if !strings.Contains(check, "gc.routed_to=myproject/polecat") {
 		t.Errorf("EffectiveScaleCheck = %q, want gc.routed_to=myproject/polecat", check)
 	}
-	if !strings.Contains(check, "--status=in_progress") {
-		t.Errorf("EffectiveScaleCheck = %q, want --status=in_progress for active work", check)
+	if !strings.Contains(check, "--unassigned") {
+		t.Errorf("EffectiveScaleCheck = %q, want --unassigned for new unassigned demand", check)
 	}
-	if !strings.Contains(check, "--no-assignee") {
-		t.Errorf("EffectiveScaleCheck = %q, want --no-assignee for active unassigned work", check)
+	if strings.Contains(check, "--type=molecule") {
+		t.Errorf("EffectiveScaleCheck = %q, should not count molecule containers as demand", check)
 	}
-	if !strings.Contains(check, "--type=molecule") {
-		t.Errorf("EffectiveScaleCheck = %q, want --type=molecule for formula-dispatched work", check)
+	if strings.Contains(check, "--status=in_progress") || strings.Contains(check, "${active:-0}") {
+		t.Errorf("EffectiveScaleCheck = %q, should not count in-progress work as new demand", check)
 	}
 }
 
-func TestEffectiveScaleCheckMoleculeQuery(t *testing.T) {
-	// Regression test for GH #505: default scale check must detect
-	// formula-dispatched molecule beads that bd ready excludes.
+func TestEffectiveScaleCheckUsesReadyOnly(t *testing.T) {
+	// Formula-dispatched executable roots must be visible through ready()
+	// as runnable wisps/tasks; molecule containers are not demand.
 	a := Agent{
 		Name:              "worker",
 		Dir:               "myrig",
@@ -1637,31 +1635,27 @@ func TestEffectiveScaleCheckMoleculeQuery(t *testing.T) {
 	}
 	check := a.EffectiveScaleCheck()
 
-	// Must contain three separate queries summed together.
 	if !strings.Contains(check, "bd ready") {
 		t.Errorf("missing bd ready query for blocker-aware task counting")
 	}
-	if !strings.Contains(check, "--status=in_progress") {
-		t.Errorf("missing in_progress query for active work")
+	if strings.Contains(check, "--status=open --type=molecule") {
+		t.Errorf("unexpected molecule query in scale check: %q", check)
 	}
-	if !strings.Contains(check, "--status=open --type=molecule") {
-		t.Errorf("missing molecule query for formula-dispatched work (GH #505)")
+	if strings.Contains(check, "--status=in_progress") || strings.Contains(check, "${active:-0}") {
+		t.Errorf("EffectiveScaleCheck = %q, should not count in-progress work as new demand", check)
 	}
 
-	// All three variables must appear in the arithmetic sum.
-	if !strings.Contains(check, "${ready:-0}") {
-		t.Errorf("missing ${ready:-0} in arithmetic sum")
+	if !strings.Contains(check, "--limit 0") {
+		t.Errorf("missing --limit 0 for complete ready count")
 	}
-	if !strings.Contains(check, "${active:-0}") {
-		t.Errorf("missing ${active:-0} in arithmetic sum")
+	if strings.Contains(check, "2>/dev/null") || strings.Contains(check, "${ready:-0}") || strings.Contains(check, "|| echo 0") {
+		t.Errorf("default scale_check masks bd ready failures as zero: %q", check)
 	}
-	if !strings.Contains(check, "${molecules:-0}") {
-		t.Errorf("missing ${molecules:-0} in arithmetic sum")
+	if strings.Contains(check, "${molecules:-0}") {
+		t.Errorf("unexpected ${molecules:-0} in arithmetic sum")
 	}
-
-	// Molecule query must use the qualified name for routing.
 	if !strings.Contains(check, "gc.routed_to=myrig/worker") {
-		t.Errorf("molecule query missing gc.routed_to=myrig/worker")
+		t.Errorf("ready query missing gc.routed_to=myrig/worker")
 	}
 }
 
@@ -2102,6 +2096,41 @@ name = "mayor"
 	}
 }
 
+func TestParseDaemonSessionCircuitBreaker(t *testing.T) {
+	data := []byte(`
+[workspace]
+name = "test"
+
+[daemon]
+session_circuit_breaker = true
+session_circuit_breaker_max_restarts = 2
+session_circuit_breaker_window = "10m"
+session_circuit_breaker_reset_after = "25m"
+
+[[agent]]
+name = "worker"
+`)
+	cfg, err := Parse(data)
+	if err != nil {
+		t.Fatalf("Parse: %v", err)
+	}
+	if !cfg.Daemon.SessionCircuitBreaker {
+		t.Fatal("Daemon.SessionCircuitBreaker = false, want true")
+	}
+	if cfg.Daemon.SessionCircuitBreakerMaxRestarts == nil || *cfg.Daemon.SessionCircuitBreakerMaxRestarts != 2 {
+		t.Fatalf("Daemon.SessionCircuitBreakerMaxRestarts = %v, want 2", cfg.Daemon.SessionCircuitBreakerMaxRestarts)
+	}
+	if got := cfg.Daemon.SessionCircuitBreakerMaxRestartsOrDefault(); got != 2 {
+		t.Fatalf("SessionCircuitBreakerMaxRestartsOrDefault() = %d, want 2", got)
+	}
+	if got := cfg.Daemon.SessionCircuitBreakerWindowDuration(); got != 10*time.Minute {
+		t.Fatalf("SessionCircuitBreakerWindowDuration() = %v, want 10m", got)
+	}
+	if got := cfg.Daemon.SessionCircuitBreakerResetAfterDuration(); got != 25*time.Minute {
+		t.Fatalf("SessionCircuitBreakerResetAfterDuration() = %v, want 25m", got)
+	}
+}
+
 func TestMarshalOmitsEmptyDaemonSection(t *testing.T) {
 	c := DefaultCity("test")
 	data, err := c.Marshal()
@@ -2559,6 +2588,17 @@ func TestValidateRigs_MissingPath(t *testing.T) {
 	}
 }
 
+func TestValidateRigs_WildcardNameRejected(t *testing.T) {
+	rigs := []Rig{{Name: "*", Path: "/a"}}
+	err := ValidateRigs(rigs, "ci")
+	if err == nil {
+		t.Fatal(`expected error for rig name "*"`)
+	}
+	if !strings.Contains(err.Error(), "wildcard") {
+		t.Errorf("error = %q, want 'wildcard'", err)
+	}
+}
+
 func TestValidateRigs_DuplicateName(t *testing.T) {
 	rigs := []Rig{
 		{Name: "frontend", Path: "/a"},
@@ -3193,6 +3233,34 @@ func runEffectiveWorkQuery(t *testing.T, a Agent, env map[string]string, bdScrip
 	return string(out)
 }
 
+func runLifecycleHookCommand(t *testing.T, command string, env map[string]string, bdScript string) string {
+	t.Helper()
+
+	tmp := t.TempDir()
+	bdPath := filepath.Join(tmp, "bd")
+	if err := os.WriteFile(bdPath, []byte(bdScript), 0o755); err != nil {
+		t.Fatalf("write fake bd: %v", err)
+	}
+	logPath := filepath.Join(tmp, "bd.log")
+
+	cmd := exec.Command("sh", "-c", command)
+	cmd.Env = []string{
+		"PATH=" + tmp + ":" + os.Getenv("PATH"),
+		"BD_LOG=" + logPath,
+	}
+	for k, v := range env {
+		cmd.Env = append(cmd.Env, k+"="+v)
+	}
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("run lifecycle hook: %v\n%s", err, out)
+	}
+	data, err := os.ReadFile(logPath)
+	if err != nil {
+		t.Fatalf("read hook log: %v", err)
+	}
+	return string(data)
+}
+
 // TestEffectiveMethodsAgentRouting verifies that all agents use
 // gc.routed_to=<qualified-name> metadata routing.
 func TestEffectiveMethodsAgentRouting(t *testing.T) {
@@ -3556,7 +3624,7 @@ func TestEffectiveOnDeathDefault(t *testing.T) {
 		MinActiveSessions: ptrInt(0), MaxActiveSessions: ptrInt(5),
 	}
 	got := a.EffectiveOnDeath()
-	for _, want := range []string{"bd list --assignee=myrig/dog", "--status=in_progress", "--assignee \"\""} {
+	for _, want := range []string{"bd list --assignee=myrig/dog", "--status=in_progress", `--assignee "" --status open`, "--set-metadata gc.routed_to=myrig/dog"} {
 		if !strings.Contains(got, want) {
 			t.Errorf("EffectiveOnDeath() = %q, want %q", got, want)
 		}
@@ -3577,13 +3645,73 @@ func TestEffectiveOnDeathCustom(t *testing.T) {
 func TestEffectiveOnDeathFixedAgent(t *testing.T) {
 	a := Agent{Name: "mayor"}
 	got := a.EffectiveOnDeath()
-	for _, want := range []string{"bd list --assignee=mayor", "--status=in_progress", "--assignee \"\""} {
+	for _, want := range []string{"bd list --assignee=mayor", "--status=in_progress", `--assignee "" --status open`, "--set-metadata gc.routed_to=mayor"} {
 		if !strings.Contains(got, want) {
 			t.Errorf("EffectiveOnDeath() = %q, want %q", got, want)
 		}
 	}
 }
 
+func TestEffectiveOnDeathBackfillsMissingRouteOnReopen(t *testing.T) {
+	a := Agent{
+		Name:              "dog-1",
+		Dir:               "hello-world",
+		MinActiveSessions: ptrInt(0), MaxActiveSessions: ptrInt(5),
+		PoolName: "hello-world/dog",
+	}
+
+	log := runLifecycleHookCommand(t, a.EffectiveOnDeath(), nil, `#!/bin/sh
+set -eu
+case "$1" in
+  list)
+    printf '[{"id":"ga-missing","metadata":{}}]'
+    ;;
+  update)
+    printf '%s\n' "$*" >> "$BD_LOG"
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+`)
+	if !strings.Contains(log, "--status open") {
+		t.Fatalf("hook log = %q, want reopened status", log)
+	}
+	if !strings.Contains(log, "--set-metadata gc.routed_to=hello-world/dog") {
+		t.Fatalf("hook log = %q, want fallback route for ownerless reopened work", log)
+	}
+}
+
+func TestEffectiveOnDeathPreservesExistingRouteOnReopen(t *testing.T) {
+	a := Agent{
+		Name:              "dog-1",
+		Dir:               "hello-world",
+		MinActiveSessions: ptrInt(0), MaxActiveSessions: ptrInt(5),
+		PoolName: "hello-world/dog",
+	}
+
+	log := runLifecycleHookCommand(t, a.EffectiveOnDeath(), nil, `#!/bin/sh
+set -eu
+case "$1" in
+  list)
+    printf '[{"id":"ga-routed","metadata":{"gc.routed_to":"already/routed"}}]'
+    ;;
+  update)
+    printf '%s\n' "$*" >> "$BD_LOG"
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+`)
+	if !strings.Contains(log, "--status open") {
+		t.Fatalf("hook log = %q, want reopened status", log)
+	}
+	if strings.Contains(log, "--set-metadata") {
+		t.Fatalf("hook log = %q, want existing route preserved without overwrite", log)
+	}
+}
+
 func TestEffectiveOnBootDefault(t *testing.T) {
 	a := Agent{
 		Name:              "dog",
@@ -3591,11 +3719,14 @@ func TestEffectiveOnBootDefault(t *testing.T) {
 		MinActiveSessions: ptrInt(0), MaxActiveSessions: ptrInt(5),
 	}
 	got := a.EffectiveOnBoot()
-	for _, want := range []string{"bd list --metadata-field gc.routed_to=myrig/dog", "--status=in_progress", "--assignee \"\""} {
+	for _, want := range []string{"bd list --metadata-field gc.routed_to=myrig/dog", "--status=in_progress", "--no-assignee", "--status open"} {
 		if !strings.Contains(got, want) {
 			t.Errorf("EffectiveOnBoot() = %q, want %q", got, want)
 		}
 	}
+	if strings.Contains(got, `--assignee ""`) {
+		t.Errorf("EffectiveOnBoot() = %q, want to target only ownerless work instead of bulk-unassigning routed work", got)
+	}
 }
 
 func TestEffectiveOnBootDefaultPoolName(t *testing.T) {
@@ -3607,11 +3738,14 @@ func TestEffectiveOnBootDefaultPoolName(t *testing.T) {
 		PoolName: "myrig/dog",
 	}
 	got := a.EffectiveOnBoot()
-	for _, want := range []string{"bd list --metadata-field gc.routed_to=myrig/dog", "--status=in_progress", "--assignee \"\""} {
+	for _, want := range []string{"bd list --metadata-field gc.routed_to=myrig/dog", "--status=in_progress", "--no-assignee", "--status open"} {
 		if !strings.Contains(got, want) {
 			t.Errorf("EffectiveOnBoot() = %q, want %q", got, want)
 		}
 	}
+	if strings.Contains(got, `--assignee ""`) {
+		t.Errorf("EffectiveOnBoot() = %q, want to target only ownerless work instead of bulk-unassigning routed work", got)
+	}
 }
 
 func TestEffectiveOnBootCustom(t *testing.T) {
@@ -3628,11 +3762,14 @@ func TestEffectiveOnBootCustom(t *testing.T) {
 func TestEffectiveOnBootNonPool(t *testing.T) {
 	a := Agent{Name: "mayor"}
 	got := a.EffectiveOnBoot()
-	for _, want := range []string{"bd list --metadata-field gc.routed_to=mayor", "--status=in_progress", "--assignee \"\""} {
+	for _, want := range []string{"bd list --metadata-field gc.routed_to=mayor", "--status=in_progress", "--no-assignee", "--status open"} {
 		if !strings.Contains(got, want) {
 			t.Errorf("EffectiveOnBoot() = %q, want %q", got, want)
 		}
 	}
+	if strings.Contains(got, `--assignee ""`) {
+		t.Errorf("EffectiveOnBoot() = %q, want to target only ownerless work instead of bulk-unassigning routed work", got)
+	}
 }
 
 func TestValidateDependsOn(t *testing.T) {
@@ -4681,3 +4818,182 @@ schedule = "0 3 * * *"
 		t.Fatalf("Trigger = %#v, want cron", cfg.Orders.Overrides[0].Trigger)
 	}
 }
+
+// TestControlDispatcherStartCommandTracesUnderGCRuntime pins the trace-log
+// default location for the built-in control-dispatcher worker.
+//
+// The control-dispatcher writes to ${GC_WORKFLOW_TRACE} every few seconds
+// while serving workflow control beads. The default path must live under
+// .gc/runtime/ so that the controller's recursive fsnotify watcher
+// (cmd/gc/controller.go shouldIgnoreConfigWatchEvent) ignores writes to it
+// — that function excludes the .gc and .beads path segments. Placing the
+// default at city root caused every append to fire markDirty() through the
+// 200ms debouncer, keeping patrol cycles in continuous reconciliation and
+// driving cycle duration well past the configured patrol_interval.
+//
+// Regression guard: do not move the trace default out of .gc/runtime/
+// without a paired update to the controller's watcher exclusion list.
+func TestControlDispatcherStartCommandTracesUnderGCRuntime(t *testing.T) {
+	const (
+		wantTraceExport    = `export GC_WORKFLOW_TRACE="${GC_WORKFLOW_TRACE:-${GC_CONTROL_DISPATCHER_TRACE_DEFAULT:-${GC_CITY}/` + citylayout.RuntimeDataRoot + `/control-dispatcher-trace.log}}"`
+		wantTraceDirExpr   = `trace_dir="${GC_WORKFLOW_TRACE%/*}"`
+		wantRootTraceGuard = `elif [ -z "$trace_dir" ]; then trace_dir="/"; fi`
+		wantMkdirSnip      = `mkdir -p "$trace_dir"`
+		oldTracePath       = "${GC_CITY}/control-dispatcher-trace.log"
+		qualifiedName      = "qcore/control-dispatcher"
+	)
+
+	t.Run("city-level constant", func(t *testing.T) {
+		got := ControlDispatcherStartCommand
+		if !strings.Contains(got, "GC_CONTROL_DISPATCHER_TRACE_DEFAULT") {
+			t.Errorf("ControlDispatcherStartCommand must route through GC_CONTROL_DISPATCHER_TRACE_DEFAULT so runtime-root trust decisions happen in Go\n got: %s", got)
+		}
+		if !strings.Contains(got, wantTraceExport) {
+			t.Errorf("ControlDispatcherStartCommand missing %q\n got: %s", wantTraceExport, got)
+		}
+		if !strings.Contains(got, wantTraceDirExpr) {
+			t.Errorf("ControlDispatcherStartCommand missing %q so explicit GC_WORKFLOW_TRACE overrides create their own parent dir\n got: %s", wantTraceDirExpr, got)
+		}
+		if !strings.Contains(got, wantRootTraceGuard) {
+			t.Errorf("ControlDispatcherStartCommand missing %q so absolute root trace overrides normalize to /\n got: %s", wantRootTraceGuard, got)
+		}
+		if !strings.Contains(got, wantMkdirSnip) {
+			t.Errorf("ControlDispatcherStartCommand missing %q (needed so the resolved trace parent exists on first start)\n got: %s", wantMkdirSnip, got)
+		}
+		if strings.Contains(got, oldTracePath) {
+			t.Errorf("ControlDispatcherStartCommand still references the old city-root trace path %q\n got: %s", oldTracePath, got)
+		}
+	})
+
+	t.Run("qualified-name builder", func(t *testing.T) {
+		got := ControlDispatcherStartCommandFor(qualifiedName)
+		if !strings.Contains(got, "GC_CONTROL_DISPATCHER_TRACE_DEFAULT") {
+			t.Errorf("ControlDispatcherStartCommandFor must route through GC_CONTROL_DISPATCHER_TRACE_DEFAULT so runtime-root trust decisions happen in Go\n got: %s", got)
+		}
+		if !strings.Contains(got, wantTraceExport) {
+			t.Errorf("ControlDispatcherStartCommandFor missing %q\n got: %s", wantTraceExport, got)
+		}
+		if !strings.Contains(got, wantTraceDirExpr) {
+			t.Errorf("ControlDispatcherStartCommandFor missing %q so explicit GC_WORKFLOW_TRACE overrides create their own parent dir\n got: %s", wantTraceDirExpr, got)
+		}
+		if !strings.Contains(got, wantRootTraceGuard) {
+			t.Errorf("ControlDispatcherStartCommandFor missing %q so absolute root trace overrides normalize to /\n got: %s", wantRootTraceGuard, got)
+		}
+		if !strings.Contains(got, wantMkdirSnip) {
+			t.Errorf("ControlDispatcherStartCommandFor missing %q\n got: %s", wantMkdirSnip, got)
+		}
+		if !strings.Contains(got, "--follow "+qualifiedName) {
+			t.Errorf("ControlDispatcherStartCommandFor must --follow the qualified name %q\n got: %s", qualifiedName, got)
+		}
+	})
+}
+
+func TestControlDispatcherStartCommandExecResolvesRuntimeTracePath(t *testing.T) {
+	t.Run("default runtime root", func(t *testing.T) {
+		cityDir := t.TempDir()
+		tracePath, args := runControlDispatcherStartCommand(t, ControlDispatcherStartCommand, cityDir, nil)
+		wantTracePath := filepath.Join(cityDir, citylayout.RuntimeDataRoot, "control-dispatcher-trace.log")
+		if tracePath != wantTracePath {
+			t.Fatalf("trace path = %q, want %q", tracePath, wantTracePath)
+		}
+		if args != "convoy control --serve --follow "+ControlDispatcherAgentName {
+			t.Fatalf("args = %q, want follow command for %q", args, ControlDispatcherAgentName)
+		}
+		if _, err := os.Stat(wantTracePath); err != nil {
+			t.Fatalf("trace file %q not created: %v", wantTracePath, err)
+		}
+	})
+
+	t.Run("injected trusted default override", func(t *testing.T) {
+		cityDir := t.TempDir()
+		runtimeDir := filepath.Join(t.TempDir(), "runtime-root")
+		tracePath, args := runControlDispatcherStartCommand(t, ControlDispatcherStartCommandFor("qcore/control-dispatcher"), cityDir, map[string]string{
+			"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": filepath.Join(runtimeDir, "control-dispatcher-trace.log"),
+		})
+		wantTracePath := filepath.Join(runtimeDir, "control-dispatcher-trace.log")
+		if tracePath != wantTracePath {
+			t.Fatalf("trace path = %q, want %q", tracePath, wantTracePath)
+		}
+		if args != "convoy control --serve --follow qcore/control-dispatcher" {
+			t.Fatalf("args = %q, want qualified follow command", args)
+		}
+		if _, err := os.Stat(wantTracePath); err != nil {
+			t.Fatalf("trace file %q not created: %v", wantTracePath, err)
+		}
+	})
+
+	t.Run("explicit trace override ignores injected default", func(t *testing.T) {
+		cityDir := t.TempDir()
+		injectedDefault := filepath.Join(t.TempDir(), "runtime-root", "control-dispatcher-trace.log")
+		overrideTrace := filepath.Join(t.TempDir(), "override-runtime", "dispatcher.log")
+		tracePath, args := runControlDispatcherStartCommand(t, ControlDispatcherStartCommand, cityDir, map[string]string{
+			"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": injectedDefault,
+			"GC_WORKFLOW_TRACE":                   overrideTrace,
+		})
+		if tracePath != overrideTrace {
+			t.Fatalf("trace path = %q, want explicit override %q", tracePath, overrideTrace)
+		}
+		if args != "convoy control --serve --follow "+ControlDispatcherAgentName {
+			t.Fatalf("args = %q, want follow command for %q", args, ControlDispatcherAgentName)
+		}
+		if _, err := os.Stat(overrideTrace); err != nil {
+			t.Fatalf("override trace file %q not created: %v", overrideTrace, err)
+		}
+	})
+}
+
+func runControlDispatcherStartCommand(t *testing.T, command, cityDir string, extraEnv map[string]string) (tracePath, args string) {
+	t.Helper()
+
+	tmp := t.TempDir()
+	resultPath := filepath.Join(tmp, "gc-result")
+	gcPath := filepath.Join(tmp, "gc")
+	gcScript := fmt.Sprintf(`#!/bin/sh
+set -eu
+trace_parent=${GC_WORKFLOW_TRACE%%/*}
+if [ "$trace_parent" = "$GC_WORKFLOW_TRACE" ]; then
+  trace_parent=.
+elif [ -z "$trace_parent" ]; then
+  trace_parent=/
+fi
+[ -d "$trace_parent" ]
+: > "$GC_WORKFLOW_TRACE"
+printf 'TRACE=%%s\nARGS=%%s\n' "$GC_WORKFLOW_TRACE" "$*" > %q
+`, resultPath)
+	if err := os.WriteFile(gcPath, []byte(gcScript), 0o755); err != nil {
+		t.Fatalf("write fake gc: %v", err)
+	}
+
+	cmd := exec.Command("sh", "-c", command)
+	cmd.Env = []string{
+		"PATH=" + tmp + ":" + os.Getenv("PATH"),
+		"GC_BIN=" + gcPath,
+		"GC_CITY=" + cityDir,
+	}
+	for key, value := range extraEnv {
+		cmd.Env = append(cmd.Env, key+"="+value)
+	}
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("run control-dispatcher start command: %v\n%s", err, out)
+	}
+
+	data, err := os.ReadFile(resultPath)
+	if err != nil {
+		t.Fatalf("read fake gc result: %v", err)
+	}
+	for _, line := range strings.Split(strings.TrimSpace(string(data)), "\n") {
+		switch {
+		case strings.HasPrefix(line, "TRACE="):
+			tracePath = strings.TrimPrefix(line, "TRACE=")
+		case strings.HasPrefix(line, "ARGS="):
+			args = strings.TrimPrefix(line, "ARGS=")
+		}
+	}
+	if tracePath == "" {
+		t.Fatalf("fake gc result missing trace path:\n%s", data)
+	}
+	if args == "" {
+		t.Fatalf("fake gc result missing args:\n%s", data)
+	}
+	return tracePath, args
+}
diff --git a/internal/config/doctor_config_test.go b/internal/config/doctor_config_test.go
new file mode 100644
index 0000000000..191e12afb1
--- /dev/null
+++ b/internal/config/doctor_config_test.go
@@ -0,0 +1,159 @@
+package config
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestParseDoctorSection(t *testing.T) {
+	data := []byte(`
+[workspace]
+name = "test-city"
+
+[doctor]
+worktree_rig_warn_size = "5GB"
+worktree_rig_error_size = "30GB"
+nested_worktree_prune = true
+
+[[agent]]
+name = "mayor"
+`)
+	cfg, err := Parse(data)
+	if err != nil {
+		t.Fatalf("Parse: %v", err)
+	}
+	if cfg.Doctor.WorktreeRigWarnSize != "5GB" {
+		t.Errorf("WorktreeRigWarnSize = %q, want %q", cfg.Doctor.WorktreeRigWarnSize, "5GB")
+	}
+	if cfg.Doctor.WorktreeRigErrorSize != "30GB" {
+		t.Errorf("WorktreeRigErrorSize = %q, want %q", cfg.Doctor.WorktreeRigErrorSize, "30GB")
+	}
+	if !cfg.Doctor.NestedWorktreePrune {
+		t.Error("NestedWorktreePrune = false, want true")
+	}
+}
+
+func TestParseNoDoctorSection(t *testing.T) {
+	data := []byte(`
+[workspace]
+name = "test-city"
+
+[[agent]]
+name = "mayor"
+`)
+	cfg, err := Parse(data)
+	if err != nil {
+		t.Fatalf("Parse: %v", err)
+	}
+	if cfg.Doctor.WorktreeRigWarnSize != "" || cfg.Doctor.WorktreeRigErrorSize != "" {
+		t.Errorf("Doctor section should be zero-valued; got %+v", cfg.Doctor)
+	}
+	if cfg.Doctor.NestedWorktreePrune {
+		t.Error("NestedWorktreePrune defaults to true; want false")
+	}
+
+	// Unset Doctor must still return real defaults via accessor methods.
+	if got := cfg.Doctor.WorktreeRigWarnBytes(); got != defaultWorktreeRigWarnBytes {
+		t.Errorf("WorktreeRigWarnBytes() = %d, want %d", got, defaultWorktreeRigWarnBytes)
+	}
+	if got := cfg.Doctor.WorktreeRigErrorBytes(); got != defaultWorktreeRigErrorBytes {
+		t.Errorf("WorktreeRigErrorBytes() = %d, want %d", got, defaultWorktreeRigErrorBytes)
+	}
+}
+
+func TestMarshalOmitsEmptyDoctorSection(t *testing.T) {
+	c := DefaultCity("test")
+	data, err := c.Marshal()
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if strings.Contains(string(data), "[doctor]") {
+		t.Errorf("Marshal output should not contain '[doctor]' when empty:\n%s", data)
+	}
+}
+
+func TestDoctorConfigByteAccessors(t *testing.T) {
+	tests := []struct {
+		name      string
+		cfg       DoctorConfig
+		wantWarn  int64
+		wantError int64
+	}{
+		{
+			name:      "empty falls back to defaults",
+			cfg:       DoctorConfig{},
+			wantWarn:  defaultWorktreeRigWarnBytes,
+			wantError: defaultWorktreeRigErrorBytes,
+		},
+		{
+			name:      "explicit GB values",
+			cfg:       DoctorConfig{WorktreeRigWarnSize: "5GB", WorktreeRigErrorSize: "20GB"},
+			wantWarn:  5 * 1024 * 1024 * 1024,
+			wantError: 20 * 1024 * 1024 * 1024,
+		},
+		{
+			name:      "MB and KB units",
+			cfg:       DoctorConfig{WorktreeRigWarnSize: "500MB", WorktreeRigErrorSize: "2048MB"},
+			wantWarn:  500 * 1024 * 1024,
+			wantError: 2048 * 1024 * 1024,
+		},
+		{
+			name:      "unparseable warn falls back to default; error still parses",
+			cfg:       DoctorConfig{WorktreeRigWarnSize: "junk", WorktreeRigErrorSize: "100GB"},
+			wantWarn:  defaultWorktreeRigWarnBytes,
+			wantError: 100 * 1024 * 1024 * 1024,
+		},
+		{
+			name:      "error < warn is clamped up to warn (monotonic)",
+			cfg:       DoctorConfig{WorktreeRigWarnSize: "10GB", WorktreeRigErrorSize: "1GB"},
+			wantWarn:  10 * 1024 * 1024 * 1024,
+			wantError: 10 * 1024 * 1024 * 1024,
+		},
+		{
+			name:      "negative or zero bytes treated as unset",
+			cfg:       DoctorConfig{WorktreeRigWarnSize: "0GB", WorktreeRigErrorSize: "0"},
+			wantWarn:  defaultWorktreeRigWarnBytes,
+			wantError: defaultWorktreeRigErrorBytes,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.cfg.WorktreeRigWarnBytes(); got != tt.wantWarn {
+				t.Errorf("WorktreeRigWarnBytes() = %d, want %d", got, tt.wantWarn)
+			}
+			if got := tt.cfg.WorktreeRigErrorBytes(); got != tt.wantError {
+				t.Errorf("WorktreeRigErrorBytes() = %d, want %d", got, tt.wantError)
+			}
+		})
+	}
+}
+
+func TestParseHumanSize(t *testing.T) {
+	tests := []struct {
+		input  string
+		want   int64
+		wantOK bool
+	}{
+		{"", 0, false},
+		{"   ", 0, false},
+		{"junk", 0, false},
+		{"10", 10, true},      // bytes implied
+		{"1024B", 1024, true}, // explicit B suffix
+		{"1KB", 1024, true},
+		{"5 mb", 5 * 1024 * 1024, true}, // case-insensitive, whitespace tolerant
+		{"  10gb ", 10 * 1024 * 1024 * 1024, true},
+		{"-5GB", -5 * 1024 * 1024 * 1024, true}, // accessor treats negative as unset; parser is permissive
+	}
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			got, ok := parseHumanSize(tt.input)
+			if ok != tt.wantOK {
+				t.Errorf("ok = %v, want %v (input %q)", ok, tt.wantOK, tt.input)
+			}
+			if got != tt.want {
+				t.Errorf("value = %d, want %d (input %q)", got, tt.want, tt.input)
+			}
+		})
+	}
+}
diff --git a/internal/config/field_sync_test.go b/internal/config/field_sync_test.go
index 4fe8ad63d4..78aef3415f 100644
--- a/internal/config/field_sync_test.go
+++ b/internal/config/field_sync_test.go
@@ -19,7 +19,7 @@ func TestAgentFieldSync(t *testing.T) {
 	// Add to this list with a comment explaining why.
 	excluded := map[string]string{
 		"Name":        "identity field, not overridable",
-		"Description": "display field for MC session creation UI, not overridable via patch",
+		"Description": "display field for real-world app session creation UI, not overridable via patch",
 		// Provider-level fields: set during ResolveProvider, not typically
 		// overridden per-rig. Agent-level overrides happen in the Agent
 		// struct itself (which feeds into ResolveProvider).
diff --git a/internal/config/implicit.go b/internal/config/implicit.go
index dc6460c2d0..d4cd7d4536 100644
--- a/internal/config/implicit.go
+++ b/internal/config/implicit.go
@@ -28,29 +28,34 @@ type implicitImportFile struct {
 // ReadImplicitImports reads ~/.gc/implicit-import.toml (or $GC_HOME) and
 // returns its imports. Missing files are treated as empty.
 func ReadImplicitImports() (map[string]ImplicitImport, string, error) {
+	imports, path, _, err := readImplicitImportsWithData()
+	return imports, path, err
+}
+
+func readImplicitImportsWithData() (map[string]ImplicitImport, string, []byte, error) {
 	path := implicitImportPath()
 	if path == "" {
-		return map[string]ImplicitImport{}, "", nil
+		return map[string]ImplicitImport{}, "", nil, nil
 	}
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return map[string]ImplicitImport{}, path, nil
+			return map[string]ImplicitImport{}, path, nil, nil
 		}
-		return nil, path, fmt.Errorf("reading implicit imports: %w", err)
+		return nil, path, nil, fmt.Errorf("reading implicit imports: %w", err)
 	}
 
 	var file implicitImportFile
 	if _, err := toml.Decode(string(data), &file); err != nil {
-		return nil, path, fmt.Errorf("parsing implicit imports: %w", err)
+		return nil, path, nil, fmt.Errorf("parsing implicit imports: %w", err)
 	}
 	if file.Schema != 0 && file.Schema != implicitImportSchema {
-		return nil, path, fmt.Errorf("unsupported implicit import schema %d", file.Schema)
+		return nil, path, nil, fmt.Errorf("unsupported implicit import schema %d", file.Schema)
 	}
 	if file.Imports == nil {
 		file.Imports = make(map[string]ImplicitImport)
 	}
-	return file.Imports, path, nil
+	return file.Imports, path, data, nil
 }
 
 func implicitImportPath() string {
diff --git a/internal/config/launch_command.go b/internal/config/launch_command.go
index c9444d6a6d..8d2b889f5e 100644
--- a/internal/config/launch_command.go
+++ b/internal/config/launch_command.go
@@ -25,11 +25,14 @@ type ProviderLaunchCommand struct {
 //
 // When transport is "acp", the ACP-specific command (ACPCommand/ACPArgs) is
 // used as the base instead of the default Command/Args. Pass "" for the
-// default (tmux) transport.
+// provider default or "tmux" for the tmux-backed CLI transport.
 func BuildProviderLaunchCommand(cityPath string, resolved *ResolvedProvider, optionOverrides map[string]string, transport string) (ProviderLaunchCommand, error) {
 	if resolved == nil {
 		return ProviderLaunchCommand{}, fmt.Errorf("resolved provider is nil")
 	}
+	if !IsValidSessionTransport(transport) {
+		return ProviderLaunchCommand{}, fmt.Errorf("unknown session transport %q", strings.TrimSpace(transport))
+	}
 
 	command := providerLaunchBaseCommand(resolved, transport)
 	if len(resolved.OptionsSchema) > 0 {
@@ -67,15 +70,21 @@ func BuildProviderLaunchCommandWithoutOptions(cityPath string, resolved *Resolve
 	if resolved == nil {
 		return ProviderLaunchCommand{}, fmt.Errorf("resolved provider is nil")
 	}
+	if !IsValidSessionTransport(transport) {
+		return ProviderLaunchCommand{}, fmt.Errorf("unknown session transport %q", strings.TrimSpace(transport))
+	}
 	return appendProviderSettings(cityPath, resolved.Name, providerLaunchBaseCommand(resolved, transport)), nil
 }
 
 func providerLaunchBaseCommand(resolved *ResolvedProvider, transport string) string {
-	command := resolved.CommandString()
-	if transport == "acp" {
-		command = resolved.ACPCommandString()
+	switch strings.TrimSpace(transport) {
+	case SessionTransportACP:
+		return resolved.ACPCommandString()
+	case "", SessionTransportTmux:
+		return resolved.CommandString()
+	default:
+		return resolved.CommandString()
 	}
-	return command
 }
 
 func appendProviderSettings(cityPath, providerName, command string) ProviderLaunchCommand {
diff --git a/internal/config/launch_command_test.go b/internal/config/launch_command_test.go
index 93fe87f260..2cf23d3708 100644
--- a/internal/config/launch_command_test.go
+++ b/internal/config/launch_command_test.go
@@ -103,6 +103,24 @@ func TestBuildProviderLaunchCommandUsesACPCommand(t *testing.T) {
 			t.Fatalf("Command = %q, want %q", got.Command, want)
 		}
 	})
+
+	t.Run("tmux transport uses CommandString", func(t *testing.T) {
+		got, err := BuildProviderLaunchCommand("", rp, nil, "tmux")
+		if err != nil {
+			t.Fatalf("BuildProviderLaunchCommand: %v", err)
+		}
+		want := "custom-opencode"
+		if got.Command != want {
+			t.Fatalf("Command = %q, want %q", got.Command, want)
+		}
+	})
+
+	t.Run("unknown transport errors", func(t *testing.T) {
+		_, err := BuildProviderLaunchCommand("", rp, nil, "stdio")
+		if err == nil {
+			t.Fatal("BuildProviderLaunchCommand() error = nil, want unknown transport error")
+		}
+	})
 }
 
 func TestBuildProviderLaunchCommandWithoutOptionsSkipsDefaultsButKeepsSettings(t *testing.T) {
diff --git a/internal/config/options.go b/internal/config/options.go
index 543dd5a57e..1c66c413fc 100644
--- a/internal/config/options.go
+++ b/internal/config/options.go
@@ -144,6 +144,179 @@ func ResolveExplicitOptions(schema []ProviderOption, overrides map[string]string
 	return extraArgs, nil
 }
 
+func completeResumeCommandDefaults(command, resumeFlag, resumeStyle string, schema []ProviderOption, effectiveDefaults map[string]string) string {
+	if strings.TrimSpace(command) == "" || len(schema) == 0 || len(effectiveDefaults) == 0 {
+		return command
+	}
+	missingArgs := missingDefaultArgsForCommand(command, schema, effectiveDefaults)
+	if len(missingArgs) == 0 {
+		return command
+	}
+	tokens := shellquote.Split(command)
+	insertAt := len(tokens)
+	if resumeStyle == "subcommand" && resumeFlag != "" {
+		insertAt = subcommandResumeInsertIndex(tokens, resumeFlag)
+	}
+	out := make([]string, 0, len(tokens)+len(missingArgs))
+	out = append(out, tokens[:insertAt]...)
+	out = append(out, missingArgs...)
+	out = append(out, tokens[insertAt:]...)
+	joined := shellquote.Join(out)
+	return strings.ReplaceAll(joined, "'{{.SessionKey}}'", "{{.SessionKey}}")
+}
+
+func subcommandResumeInsertIndex(tokens []string, resumeFlag string) int {
+	sessionIndex := -1
+	for i, token := range tokens {
+		if token == "{{.SessionKey}}" {
+			sessionIndex = i
+			break
+		}
+	}
+	if sessionIndex >= 0 {
+		for i := sessionIndex - 1; i >= 0; i-- {
+			if tokens[i] == resumeFlag {
+				return i + 1
+			}
+		}
+		return sessionIndex
+	}
+	for i := len(tokens) - 1; i >= 0; i-- {
+		if tokens[i] == resumeFlag {
+			return i + 1
+		}
+	}
+	return len(tokens)
+}
+
+func missingDefaultArgsForCommand(command string, schema []ProviderOption, effectiveDefaults map[string]string) []string {
+	tokens := shellquote.Split(command)
+	var missing []string
+	for _, opt := range schema {
+		if commandContainsOption(tokens, opt) {
+			continue
+		}
+		value := effectiveDefaults[opt.Key]
+		if value == "" {
+			value = opt.Default
+		}
+		if value == "" {
+			continue
+		}
+		choice := findChoice(opt.Choices, value)
+		if choice == nil || len(choice.FlagArgs) == 0 {
+			continue
+		}
+		missing = append(missing, choice.FlagArgs...)
+	}
+	return missing
+}
+
+func commandContainsOption(tokens []string, opt ProviderOption) bool {
+	for _, choice := range opt.Choices {
+		if commandContainsChoice(tokens, choice) {
+			return true
+		}
+	}
+	return false
+}
+
+func commandContainsChoice(tokens []string, choice OptionChoice) bool {
+	for _, groups := range choiceGroupedFlagSequences(choice) {
+		if len(groups) == 0 {
+			continue
+		}
+		if len(groups) == 1 {
+			if tokenSequenceShapeContains(tokens, groups[0]) {
+				return true
+			}
+			continue
+		}
+		if tokenSequenceGroupsShapeContain(tokens, groups) {
+			return true
+		}
+	}
+	return false
+}
+
+func tokenSequenceShapeContains(tokens, seq []string) bool {
+	for i := 0; i+len(seq) <= len(tokens); i++ {
+		if tokenSequenceShapeMatchesAt(tokens, i, seq, nil) {
+			return true
+		}
+	}
+	return false
+}
+
+func tokenSequenceGroupsShapeContain(tokens []string, groups [][]string) bool {
+	used := make([]bool, len(tokens))
+	for _, group := range groups {
+		start, ok := findTokenSequenceShapeInArgs(tokens, group, used)
+		if !ok {
+			return false
+		}
+		for i := start; i < start+len(group); i++ {
+			used[i] = true
+		}
+	}
+	return true
+}
+
+func findTokenSequenceShapeInArgs(args, seq []string, used []bool) (int, bool) {
+	for i := 0; i+len(seq) <= len(args); i++ {
+		if tokenSequenceShapeMatchesAt(args, i, seq, used) {
+			return i, true
+		}
+	}
+	return 0, false
+}
+
+func tokenSequenceShapeMatchesAt(tokens []string, start int, seq []string, used []bool) bool {
+	if len(seq) == 0 || start+len(seq) > len(tokens) {
+		return false
+	}
+	for i, want := range seq {
+		if used != nil && used[start+i] {
+			return false
+		}
+		got := tokens[start+i]
+		if i == 0 || strings.HasPrefix(want, "-") {
+			if prefix, ok := assignmentPrefix(want); ok {
+				if !strings.HasPrefix(got, prefix) {
+					return false
+				}
+				continue
+			}
+			if got != want {
+				return false
+			}
+			continue
+		}
+		if prefix, ok := assignmentPrefix(want); ok {
+			if !strings.HasPrefix(got, prefix) {
+				return false
+			}
+			continue
+		}
+		if got == "" || strings.HasPrefix(got, "-") || isTemplateToken(got) {
+			return false
+		}
+	}
+	return true
+}
+
+func isTemplateToken(token string) bool {
+	return strings.HasPrefix(token, "{{") && strings.HasSuffix(token, "}}")
+}
+
+func assignmentPrefix(token string) (string, bool) {
+	idx := strings.Index(token, "=")
+	if idx <= 0 {
+		return "", false
+	}
+	return token[:idx+1], true
+}
+
 // ReplaceSchemaFlags strips all CLI flags associated with the provider's
 // OptionsSchema from the command, then appends the given override flags.
 func ReplaceSchemaFlags(command string, schema []ProviderOption, overrideArgs []string) string {
@@ -155,21 +328,36 @@ func ReplaceSchemaFlags(command string, schema []ProviderOption, overrideArgs []
 	return stripped
 }
 
-// CollectAllSchemaFlags gathers all FlagArgs from all choices across all options.
-// Multi-flag FlagArgs sequences are split at "--" boundaries so that each
-// independent flag group can be matched separately during stripping.
+// CollectAllSchemaFlags gathers all FlagArgs and FlagAliases from all choices
+// across all options. Multi-flag sequences are split at "--" boundaries so that
+// each independent flag group can be matched separately during stripping.
 func CollectAllSchemaFlags(schema []ProviderOption) [][]string {
 	var flags [][]string
+	seen := make(map[string]bool)
 	for _, opt := range schema {
 		for _, choice := range opt.Choices {
-			if len(choice.FlagArgs) > 0 {
-				flags = append(flags, splitFlagArgs(choice.FlagArgs)...)
+			for _, seq := range choiceFlagSequences(choice) {
+				key := strings.Join(seq, "\x00")
+				if seen[key] {
+					continue
+				}
+				seen[key] = true
+				flags = append(flags, cloneStrings(seq))
 			}
 		}
 	}
 	return flags
 }
 
+func choiceFlagSequences(choice OptionChoice) [][]string {
+	var sequences [][]string
+	sequences = append(sequences, splitFlagArgs(choice.FlagArgs)...)
+	for _, alias := range choice.FlagAliases {
+		sequences = append(sequences, splitFlagArgs(alias)...)
+	}
+	return sequences
+}
+
 // splitFlagArgs splits a FlagArgs slice into independent flag groups at
 // "--" prefix boundaries. For example:
 //
@@ -241,11 +429,17 @@ func StripFlags(command string, flags [][]string) string {
 // in declaration order.
 //
 // When a flag is stripped and it maps to a known choice value, if
-// inferDefaults is non-nil and the corresponding key is not already
-// present, the inferred value is set. This preserves user intent
-// during the Args-to-OptionDefaults migration (review major 3.1).
+// inferDefaults is non-nil the inferred value is set. Explicit provider args
+// are the leaf layer in provider inheritance, so they must override defaults
+// inherited from a base provider.
 func stripArgsSlice(args []string, flags [][]string, schema []ProviderOption, inferDefaults map[string]string) []string {
-	var result []string
+	if args == nil {
+		return nil
+	}
+	if inferDefaults != nil {
+		inferChoicesFromArgs(schema, args, inferDefaults)
+	}
+	result := make([]string, 0, len(args))
 	i := 0
 	for i < len(args) {
 		matched := false
@@ -264,9 +458,6 @@ func stripArgsSlice(args []string, flags [][]string, schema []ProviderOption, in
 				}
 			}
 			if match {
-				if inferDefaults != nil {
-					inferChoiceFromFlags(schema, seq, inferDefaults)
-				}
 				i += len(seq)
 				matched = true
 				break
@@ -280,30 +471,179 @@ func stripArgsSlice(args []string, flags [][]string, schema []ProviderOption, in
 	return result
 }
 
-// inferChoiceFromFlags finds which schema option+choice produced the given
-// flag sequence and, if the key is not already present in defaults, sets
-// the inferred value. Only infers from exact full-FlagArgs matches to
-// avoid ambiguity with partial multi-flag matches.
-func inferChoiceFromFlags(schema []ProviderOption, flagSeq []string, defaults map[string]string) {
+func inferChoicesFromArgs(schema []ProviderOption, args []string, defaults map[string]string) {
+	covered, groupedLastStart := inferGroupedChoicesFromArgs(schema, args, defaults)
+	for i := 0; i < len(args); {
+		if covered[i] {
+			i++
+			continue
+		}
+		match, ok := longestChoiceMatchAt(schema, args, i, covered)
+		if !ok {
+			i++
+			continue
+		}
+		if lastStart, ok := groupedLastStart[match.key]; ok && i < lastStart {
+			i += match.length
+			continue
+		}
+		defaults[match.key] = match.value
+		i += match.length
+	}
+}
+
+type tokenSpan struct {
+	start int
+	end   int
+}
+
+type groupedChoiceMatch struct {
+	key        string
+	value      string
+	spans      []tokenSpan
+	tokenCount int
+	lastStart  int
+}
+
+func inferGroupedChoicesFromArgs(schema []ProviderOption, args []string, defaults map[string]string) ([]bool, map[string]int) {
+	covered := make([]bool, len(args))
+	groupedLastStart := make(map[string]int)
 	for _, opt := range schema {
-		if _, exists := defaults[opt.Key]; exists {
+		var best groupedChoiceMatch
+		found := false
+		for _, choice := range opt.Choices {
+			for _, groups := range choiceGroupedFlagSequences(choice) {
+				if len(groups) < 2 {
+					continue
+				}
+				spans, ok := findFlagGroupsInArgs(args, groups)
+				if !ok {
+					continue
+				}
+				candidate := groupedChoiceMatch{
+					key:   opt.Key,
+					value: choice.Value,
+					spans: spans,
+				}
+				for _, span := range spans {
+					candidate.tokenCount += span.end - span.start
+					if span.start > candidate.lastStart {
+						candidate.lastStart = span.start
+					}
+				}
+				if !found || betterGroupedChoice(candidate, best) {
+					best = candidate
+					found = true
+				}
+			}
+		}
+		if !found {
 			continue
 		}
+		defaults[best.key] = best.value
+		groupedLastStart[best.key] = best.lastStart
+		for _, span := range best.spans {
+			for i := span.start; i < span.end; i++ {
+				covered[i] = true
+			}
+		}
+	}
+	return covered, groupedLastStart
+}
+
+func betterGroupedChoice(candidate, current groupedChoiceMatch) bool {
+	if candidate.tokenCount != current.tokenCount {
+		return candidate.tokenCount > current.tokenCount
+	}
+	return candidate.lastStart > current.lastStart
+}
+
+func choiceGroupedFlagSequences(choice OptionChoice) [][][]string {
+	var sequences [][][]string
+	if groups := splitFlagArgs(choice.FlagArgs); len(groups) > 0 {
+		sequences = append(sequences, groups)
+	}
+	for _, alias := range choice.FlagAliases {
+		if groups := splitFlagArgs(alias); len(groups) > 0 {
+			sequences = append(sequences, groups)
+		}
+	}
+	return sequences
+}
+
+func findFlagGroupsInArgs(args []string, groups [][]string) ([]tokenSpan, bool) {
+	used := make([]bool, len(args))
+	spans := make([]tokenSpan, 0, len(groups))
+	for _, group := range groups {
+		start, ok := findTokenSequenceInArgs(args, group, used)
+		if !ok {
+			return nil, false
+		}
+		end := start + len(group)
+		for i := start; i < end; i++ {
+			used[i] = true
+		}
+		spans = append(spans, tokenSpan{start: start, end: end})
+	}
+	return spans, true
+}
+
+func findTokenSequenceInArgs(args, seq []string, used []bool) (int, bool) {
+	for i := 0; i+len(seq) <= len(args); i++ {
+		if tokenSequenceMatchesAt(args, i, seq, used) {
+			return i, true
+		}
+	}
+	return 0, false
+}
+
+type choiceMatch struct {
+	key    string
+	value  string
+	length int
+}
+
+func longestChoiceMatchAt(schema []ProviderOption, args []string, start int, covered []bool) (choiceMatch, bool) {
+	var best choiceMatch
+	for _, opt := range schema {
 		for _, choice := range opt.Choices {
-			if flagsEqual(choice.FlagArgs, flagSeq) {
-				defaults[opt.Key] = choice.Value
-				return
+			for _, seq := range choiceFullFlagSequences(choice) {
+				if len(seq) <= best.length || !tokenSequenceMatchesAt(args, start, seq, covered) {
+					continue
+				}
+				best = choiceMatch{
+					key:    opt.Key,
+					value:  choice.Value,
+					length: len(seq),
+				}
 			}
 		}
 	}
+	return best, best.length > 0
 }
 
-func flagsEqual(a, b []string) bool {
-	if len(a) != len(b) {
+func choiceFullFlagSequences(choice OptionChoice) [][]string {
+	var sequences [][]string
+	if len(choice.FlagArgs) > 0 {
+		sequences = append(sequences, choice.FlagArgs)
+	}
+	for _, alias := range choice.FlagAliases {
+		if len(alias) > 0 {
+			sequences = append(sequences, alias)
+		}
+	}
+	return sequences
+}
+
+func tokenSequenceMatchesAt(tokens []string, start int, seq []string, covered []bool) bool {
+	if len(seq) == 0 || start+len(seq) > len(tokens) {
 		return false
 	}
-	for i := range a {
-		if a[i] != b[i] {
+	for i, want := range seq {
+		if covered != nil && covered[start+i] {
+			return false
+		}
+		if tokens[start+i] != want {
 			return false
 		}
 	}
diff --git a/internal/config/options_test.go b/internal/config/options_test.go
index 3e9faa8eaa..ec461ca31f 100644
--- a/internal/config/options_test.go
+++ b/internal/config/options_test.go
@@ -1,6 +1,7 @@
 package config
 
 import (
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -118,6 +119,101 @@ func TestResolveOptions_EffectiveDefaultsOverrideSchemaDefaults(t *testing.T) {
 	}
 }
 
+func TestReplaceSchemaFlagsStripsCodexAliases(t *testing.T) {
+	codex := BuiltinProviders()["codex"]
+	defaultArgs := []string{
+		"--dangerously-bypass-approvals-and-sandbox",
+		"--model", "gpt-5.5",
+		"-c", "model_reasoning_effort=xhigh",
+	}
+
+	got := ReplaceSchemaFlags(
+		`aimux run codex -- -m gpt-5.5 -c 'model_reasoning_effort="xhigh"'`,
+		codex.OptionsSchema,
+		defaultArgs,
+	)
+
+	if strings.Count(got, "gpt-5.5") != 1 {
+		t.Fatalf("ReplaceSchemaFlags() = %q, want one model flag", got)
+	}
+	if strings.Count(got, "model_reasoning_effort") != 1 {
+		t.Fatalf("ReplaceSchemaFlags() = %q, want one effort flag", got)
+	}
+	if !strings.Contains(got, "--model gpt-5.5") {
+		t.Fatalf("ReplaceSchemaFlags() = %q, want canonical model flag", got)
+	}
+	if strings.Contains(got, "-m gpt-5.5") || strings.Contains(got, `model_reasoning_effort=\"xhigh\"`) {
+		t.Fatalf("ReplaceSchemaFlags() = %q, retained non-canonical schema flag", got)
+	}
+}
+
+func TestCollectAllSchemaFlagsUsesDeclaredFlagAliases(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{
+					Value:       "opus",
+					FlagArgs:    []string{"--model", "opus"},
+					FlagAliases: [][]string{{"-m", "opus"}},
+				},
+			},
+		},
+	}
+
+	flags := CollectAllSchemaFlags(schema)
+	got := StripFlags("agent -m opus --other", flags)
+
+	if got != "agent --other" {
+		t.Fatalf("StripFlags() = %q, want alias stripped", got)
+	}
+}
+
+func TestCollectAllSchemaFlagsDoesNotInferUndeclaredProviderAliases(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{Value: "opus", FlagArgs: []string{"--model", "opus"}},
+			},
+		},
+	}
+
+	flags := CollectAllSchemaFlags(schema)
+	got := StripFlags("agent -m opus --other", flags)
+
+	if got != "agent -m opus --other" {
+		t.Fatalf("StripFlags() = %q, want undeclared alias preserved", got)
+	}
+}
+
+func TestStripArgsSliceInfersChoiceFromDeclaredAlias(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{
+					Value:       "opus",
+					FlagArgs:    []string{"--model", "opus"},
+					FlagAliases: [][]string{{"-m", "opus"}},
+				},
+			},
+		},
+	}
+	flags := CollectAllSchemaFlags(schema)
+	inferred := make(map[string]string)
+
+	got := stripArgsSlice([]string{"run", "-m", "opus", "--other"}, flags, schema, inferred)
+
+	want := []string{"run", "--other"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("stripArgsSlice() = %v, want %v", got, want)
+	}
+	if inferred["model"] != "opus" {
+		t.Fatalf("inferred model = %q, want opus", inferred["model"])
+	}
+}
+
 func TestResolveOptions_UserOptionOverridesEffectiveDefault(t *testing.T) {
 	schema := []ProviderOption{
 		{
@@ -234,7 +330,7 @@ func TestResolveExplicitOptions_OnlyExplicit(t *testing.T) {
 			Default: "",
 			Choices: []OptionChoice{
 				{Value: "", Label: "Default", FlagArgs: nil},
-				{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-6"}},
+				{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-7"}},
 			},
 		},
 	}
@@ -397,7 +493,7 @@ func TestResolveExplicitOptions_SubsetOfOptions(t *testing.T) {
 			Default: "",
 			Choices: []OptionChoice{
 				{Value: "", Label: "Default", FlagArgs: nil},
-				{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-6"}},
+				{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-7"}},
 			},
 		},
 	}
@@ -409,7 +505,7 @@ func TestResolveExplicitOptions_SubsetOfOptions(t *testing.T) {
 	}
 
 	// Should only return model flags, not permission_mode defaults.
-	wantArgs := []string{"--model", "claude-opus-4-6"}
+	wantArgs := []string{"--model", "claude-opus-4-7"}
 	if len(args) != len(wantArgs) {
 		t.Fatalf("got args=%v, want %v", args, wantArgs)
 	}
@@ -601,27 +697,163 @@ func TestStripArgsSlice_MultiTokenFlag(t *testing.T) {
 	}
 }
 
-func TestStripArgsSlice_ExistingDefaultNotOverridden(t *testing.T) {
+func TestStripArgsSlice_ExplicitArgsOverrideExistingDefault(t *testing.T) {
 	schema := []ProviderOption{
 		{
 			Key: "permission_mode",
 			Choices: []OptionChoice{
 				{Value: "unrestricted", FlagArgs: []string{"--dangerously-skip-permissions"}},
+				{Value: "plan", FlagArgs: []string{"--permission-mode", "plan"}},
 			},
 		},
 	}
 	flags := CollectAllSchemaFlags(schema)
 
 	args := []string{"--dangerously-skip-permissions"}
-	// Pre-populate with an existing default -- should not be overridden.
+	// Pre-populate with an inherited default. The explicit arg is the leaf
+	// provider layer and should override it.
 	inferDefaults := map[string]string{"permission_mode": "plan"}
 	result := stripArgsSlice(args, flags, schema, inferDefaults)
 
 	if len(result) != 0 {
 		t.Errorf("got %v, want []", result)
 	}
-	if inferDefaults["permission_mode"] != "plan" {
-		t.Errorf("existing default should be preserved, got %q", inferDefaults["permission_mode"])
+	if result == nil {
+		t.Fatal("stripArgsSlice returned nil; want non-nil empty slice for explicit args that strip to zero")
+	}
+	if inferDefaults["permission_mode"] != "unrestricted" {
+		t.Errorf("inferred permission_mode: got %q, want unrestricted", inferDefaults["permission_mode"])
+	}
+}
+
+func TestCompleteResumeCommandDefaultsTreatsCustomFlagValueAsPresent(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{Value: "opus", FlagArgs: []string{"--model", "claude-opus-4-7"}, FlagAliases: [][]string{{"-m", "claude-opus-4-7"}}},
+			},
+		},
+	}
+	defaults := map[string]string{"model": "opus"}
+
+	got := completeResumeCommandDefaults(
+		"claude --resume {{.SessionKey}} --model claude-future-5",
+		"--resume",
+		"flag",
+		schema,
+		defaults,
+	)
+	want := "claude --resume {{.SessionKey}} --model claude-future-5"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
+	}
+}
+
+func TestCompleteResumeCommandDefaultsTreatsCompoundFlagPrefixAsPresent(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "effort",
+			Choices: []OptionChoice{
+				{Value: "high", FlagArgs: []string{"-c", "model_reasoning_effort=high"}},
+			},
+		},
+	}
+	defaults := map[string]string{"effort": "high"}
+
+	got := completeResumeCommandDefaults(
+		"codex resume {{.SessionKey}} -c model_reasoning_effort=experimental",
+		"resume",
+		"subcommand",
+		schema,
+		defaults,
+	)
+	want := "codex resume {{.SessionKey}} -c model_reasoning_effort=experimental"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
+	}
+}
+
+func TestCompleteResumeCommandDefaultsFlagStyleAppendsDefaults(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{Value: "opus", FlagArgs: []string{"--model", "claude-opus-4-7"}},
+			},
+		},
+	}
+	defaults := map[string]string{"model": "opus"}
+
+	got := completeResumeCommandDefaults(
+		"claude --resume {{.SessionKey}} --dangerously-skip-permissions",
+		"--resume",
+		"flag",
+		schema,
+		defaults,
+	)
+	want := "claude --resume {{.SessionKey}} --dangerously-skip-permissions --model claude-opus-4-7"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
+	}
+}
+
+func TestCompleteResumeCommandDefaultsDoesNotTreatOverlappingSandboxAsPermissionMode(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "permission_mode",
+			Choices: []OptionChoice{
+				{Value: "suggest", FlagArgs: []string{"--ask-for-approval", "untrusted", "--sandbox", "read-only"}},
+				{Value: "unrestricted", FlagArgs: []string{"--dangerously-bypass-approvals-and-sandbox"}},
+			},
+		},
+		{
+			Key: "sandbox",
+			Choices: []OptionChoice{
+				{Value: "read-only", FlagArgs: []string{"--sandbox", "read-only"}},
+			},
+		},
+	}
+	defaults := map[string]string{
+		"permission_mode": "unrestricted",
+		"sandbox":         "read-only",
+	}
+
+	got := completeResumeCommandDefaults(
+		"codex resume {{.SessionKey}} --sandbox read-only",
+		"resume",
+		"subcommand",
+		schema,
+		defaults,
+	)
+	want := "codex resume --dangerously-bypass-approvals-and-sandbox {{.SessionKey}} --sandbox read-only"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
+	}
+}
+
+func TestCompleteResumeCommandDefaultsDoesNotTreatBareMultiTokenFlagAsPresent(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "permission_mode",
+			Choices: []OptionChoice{
+				{Value: "suggest", FlagArgs: []string{"--ask-for-approval", "untrusted", "--sandbox", "read-only"}},
+				{Value: "unrestricted", FlagArgs: []string{"--dangerously-bypass-approvals-and-sandbox"}},
+			},
+		},
+	}
+	defaults := map[string]string{"permission_mode": "unrestricted"}
+
+	got := completeResumeCommandDefaults(
+		"codex resume {{.SessionKey}} --ask-for-approval",
+		"resume",
+		"subcommand",
+		schema,
+		defaults,
+	)
+	want := "codex resume --dangerously-bypass-approvals-and-sandbox {{.SessionKey}} --ask-for-approval"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
 	}
 }
 
@@ -650,6 +882,177 @@ func TestStripArgsSlice_PartialOverlap_CodexSuggest(t *testing.T) {
 	}
 }
 
+func TestStripArgsSliceInfersLongestOverlappingCodexChoice(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "permission_mode",
+			Choices: []OptionChoice{
+				{Value: "suggest", FlagArgs: []string{"--ask-for-approval", "untrusted", "--sandbox", "read-only"}},
+				{Value: "unrestricted", FlagArgs: []string{"--dangerously-bypass-approvals-and-sandbox"}},
+			},
+		},
+		{
+			Key: "sandbox",
+			Choices: []OptionChoice{
+				{Value: "read-only", FlagArgs: []string{"--sandbox", "read-only"}},
+			},
+		},
+	}
+	flags := CollectAllSchemaFlags(schema)
+	inferDefaults := map[string]string{"permission_mode": "unrestricted"}
+
+	result := stripArgsSlice(
+		[]string{"run", "codex", "--", "--ask-for-approval", "untrusted", "--sandbox", "read-only", "--other"},
+		flags,
+		schema,
+		inferDefaults,
+	)
+
+	want := []string{"run", "codex", "--", "--other"}
+	if !reflect.DeepEqual(result, want) {
+		t.Fatalf("stripArgsSlice() = %v, want %v", result, want)
+	}
+	if got := inferDefaults["permission_mode"]; got != "suggest" {
+		t.Fatalf("inferred permission_mode = %q, want suggest", got)
+	}
+	if _, ok := inferDefaults["sandbox"]; ok {
+		t.Fatalf("inferred overlapping sandbox default = %q, want no separate sandbox default", inferDefaults["sandbox"])
+	}
+}
+
+func TestStripArgsSliceInfersCodexSuggestFromReversedGroups(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "permission_mode",
+			Choices: []OptionChoice{
+				{Value: "suggest", FlagArgs: []string{"--ask-for-approval", "untrusted", "--sandbox", "read-only"}},
+				{Value: "unrestricted", FlagArgs: []string{"--dangerously-bypass-approvals-and-sandbox"}},
+			},
+		},
+		{
+			Key: "sandbox",
+			Choices: []OptionChoice{
+				{Value: "read-only", FlagArgs: []string{"--sandbox", "read-only"}},
+			},
+		},
+	}
+	flags := CollectAllSchemaFlags(schema)
+	inferDefaults := map[string]string{"permission_mode": "unrestricted"}
+
+	result := stripArgsSlice(
+		[]string{"--sandbox", "read-only", "--ask-for-approval", "untrusted", "--other"},
+		flags,
+		schema,
+		inferDefaults,
+	)
+
+	want := []string{"--other"}
+	if !reflect.DeepEqual(result, want) {
+		t.Fatalf("stripArgsSlice() = %v, want %v", result, want)
+	}
+	if got := inferDefaults["permission_mode"]; got != "suggest" {
+		t.Fatalf("inferred permission_mode = %q, want suggest", got)
+	}
+	if _, ok := inferDefaults["sandbox"]; ok {
+		t.Fatalf("inferred overlapping sandbox default = %q, want no separate sandbox default", inferDefaults["sandbox"])
+	}
+}
+
+func TestStripArgsSliceInfersCodexSuggestFromSeparatedGroups(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "permission_mode",
+			Choices: []OptionChoice{
+				{Value: "suggest", FlagArgs: []string{"--ask-for-approval", "untrusted", "--sandbox", "read-only"}},
+				{Value: "unrestricted", FlagArgs: []string{"--dangerously-bypass-approvals-and-sandbox"}},
+			},
+		},
+		{
+			Key: "sandbox",
+			Choices: []OptionChoice{
+				{Value: "read-only", FlagArgs: []string{"--sandbox", "read-only"}},
+			},
+		},
+	}
+	flags := CollectAllSchemaFlags(schema)
+	inferDefaults := map[string]string{"permission_mode": "unrestricted"}
+
+	result := stripArgsSlice(
+		[]string{"--ask-for-approval", "untrusted", "--profile", "safe", "--sandbox", "read-only"},
+		flags,
+		schema,
+		inferDefaults,
+	)
+
+	want := []string{"--profile", "safe"}
+	if !reflect.DeepEqual(result, want) {
+		t.Fatalf("stripArgsSlice() = %v, want %v", result, want)
+	}
+	if got := inferDefaults["permission_mode"]; got != "suggest" {
+		t.Fatalf("inferred permission_mode = %q, want suggest", got)
+	}
+	if _, ok := inferDefaults["sandbox"]; ok {
+		t.Fatalf("inferred overlapping sandbox default = %q, want no separate sandbox default", inferDefaults["sandbox"])
+	}
+}
+
+func TestCompleteResumeCommandDefaultsSubcommandOrdersMultipleMissingDefaults(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{Value: "gpt-5.3-codex-spark", FlagArgs: []string{"--model", "gpt-5.3-codex-spark"}},
+			},
+		},
+		{
+			Key: "effort",
+			Choices: []OptionChoice{
+				{Value: "medium", FlagArgs: []string{"-c", "model_reasoning_effort=medium"}},
+			},
+		},
+	}
+	defaults := map[string]string{
+		"model":  "gpt-5.3-codex-spark",
+		"effort": "medium",
+	}
+
+	got := completeResumeCommandDefaults(
+		"codex resume {{.SessionKey}}",
+		"resume",
+		"subcommand",
+		schema,
+		defaults,
+	)
+	want := "codex resume --model gpt-5.3-codex-spark -c model_reasoning_effort=medium {{.SessionKey}}"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
+	}
+}
+
+func TestCompleteResumeCommandDefaultsSubcommandUsesSessionResumeToken(t *testing.T) {
+	schema := []ProviderOption{
+		{
+			Key: "model",
+			Choices: []OptionChoice{
+				{Value: "gpt-5.3-codex-spark", FlagArgs: []string{"--model", "gpt-5.3-codex-spark"}},
+			},
+		},
+	}
+	defaults := map[string]string{"model": "gpt-5.3-codex-spark"}
+
+	got := completeResumeCommandDefaults(
+		"aimux run resume codex -- resume {{.SessionKey}}",
+		"resume",
+		"subcommand",
+		schema,
+		defaults,
+	)
+	want := "aimux run resume codex -- resume --model gpt-5.3-codex-spark {{.SessionKey}}"
+	if got != want {
+		t.Fatalf("completeResumeCommandDefaults() = %q, want %q", got, want)
+	}
+}
+
 func TestSplitFlagArgs_MultiFlag(t *testing.T) {
 	args := []string{"--ask-for-approval", "untrusted", "--sandbox", "read-only"}
 	groups := splitFlagArgs(args)
diff --git a/internal/config/pack.go b/internal/config/pack.go
index 745de5580c..c52a84e8f0 100644
--- a/internal/config/pack.go
+++ b/internal/config/pack.go
@@ -1584,6 +1584,7 @@ func deepCopyOptionChoices(in []OptionChoice) []OptionChoice {
 	for i := range in {
 		out[i] = in[i]
 		out[i].FlagArgs = append([]string(nil), in[i].FlagArgs...)
+		out[i].FlagAliases = cloneStringSlices(in[i].FlagAliases)
 	}
 	return out
 }
@@ -2510,6 +2511,9 @@ func collectFiles(fs fsys.FS, base, prefix string, out *[]string) {
 	if prefix != "" {
 		dir = filepath.Join(base, prefix)
 	}
+	if prefix != "" && isIgnoredPackRuntimePath(prefix) {
+		return
+	}
 	entries, err := fs.ReadDir(dir)
 	if err != nil {
 		return
@@ -2519,6 +2523,9 @@ func collectFiles(fs fsys.FS, base, prefix string, out *[]string) {
 		if prefix != "" {
 			rel = prefix + "/" + e.Name()
 		}
+		if isIgnoredPackRuntimePath(rel) {
+			continue
+		}
 		if e.IsDir() {
 			collectFiles(fs, base, rel, out)
 		} else {
@@ -2527,6 +2534,23 @@ func collectFiles(fs fsys.FS, base, prefix string, out *[]string) {
 	}
 }
 
+func isIgnoredPackRuntimePath(path string) bool {
+	parts := strings.FieldsFunc(filepath.ToSlash(path), func(r rune) bool { return r == '/' })
+	if len(parts) == 0 {
+		return false
+	}
+	switch parts[0] {
+	case ".beads", ".cache", ".gc", ".git", "state", "tmp":
+		return true
+	}
+	for _, part := range parts {
+		if part == "__pycache__" {
+			return true
+		}
+	}
+	return false
+}
+
 // resolveNamedPacks translates named pack references to cache paths.
 // If a reference in workspace.includes or rig.includes matches a key
 // in cfg.Packs, it is rewritten to the local cache directory path.
diff --git a/internal/config/pack_test.go b/internal/config/pack_test.go
index 6830df5cea..c1dbf03d1f 100644
--- a/internal/config/pack_test.go
+++ b/internal/config/pack_test.go
@@ -641,6 +641,38 @@ func TestPackContentHashRecursive(t *testing.T) {
 	}
 }
 
+func TestPackContentHashRecursiveIgnoresRuntimeDirs(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, "pack.toml", "test")
+	writeFile(t, dir, "prompts/a.md", "prompt a")
+
+	h1 := PackContentHashRecursive(fsys.OSFS{}, dir)
+	writeFile(t, dir, "state/triage/runs/audit.json", `{"status":"running"}`)
+	writeFile(t, dir, "tmp/scratch.txt", "scratch")
+	writeFile(t, dir, "__pycache__/helper.pyc", "compiled")
+	writeFile(t, dir, ".gc/runtime.json", `{"pid":123}`)
+	writeFile(t, dir, ".beads/db", "runtime state")
+	writeFile(t, dir, ".cache/tool/result.json", `{"cached":true}`)
+	writeFile(t, dir, ".git/HEAD", "ref: refs/heads/main")
+	writeFile(t, dir, "nested/__pycache__/helper.pyc", "compiled")
+	h2 := PackContentHashRecursive(fsys.OSFS{}, dir)
+	if h2 != h1 {
+		t.Fatalf("hash changed after runtime output writes: %q vs %q", h1, h2)
+	}
+
+	writeFile(t, dir, "prompts/state/example.md", "state prompt")
+	hPromptState := PackContentHashRecursive(fsys.OSFS{}, dir)
+	if hPromptState == h1 {
+		t.Fatal("hash should change for config content below a non-runtime state path")
+	}
+
+	writeFile(t, dir, "prompts/a.md", "modified prompt a")
+	h3 := PackContentHashRecursive(fsys.OSFS{}, dir)
+	if h3 == h1 {
+		t.Fatal("hash should still change when config-bearing pack content changes")
+	}
+}
+
 func TestExpandPacks_ViaLoadWithIncludes(t *testing.T) {
 	dir := t.TempDir()
 
diff --git a/internal/config/patch.go b/internal/config/patch.go
index 3a84559fbd..8c9de623f2 100644
--- a/internal/config/patch.go
+++ b/internal/config/patch.go
@@ -39,7 +39,7 @@ type AgentPatch struct {
 	// PromptTemplate overrides the prompt template path.
 	// Relative paths resolve against the city directory.
 	PromptTemplate *string `toml:"prompt_template,omitempty"`
-	// Session overrides the session transport ("acp").
+	// Session overrides the session transport ("acp" or "tmux").
 	Session *string `toml:"session,omitempty"`
 	// Provider overrides the provider name.
 	Provider *string `toml:"provider,omitempty"`
@@ -122,9 +122,9 @@ type AgentPatch struct {
 	MaxActiveSessions *int `toml:"max_active_sessions,omitempty"`
 	// MinActiveSessions overrides the minimum number of sessions to keep alive.
 	MinActiveSessions *int `toml:"min_active_sessions,omitempty"`
-	// ScaleCheck overrides the command template whose output determines desired
-	// session count. Supports the same Go template placeholders as
-	// Agent.scale_check.
+	// ScaleCheck overrides the command template whose output reports new
+	// unassigned session demand for bead-backed reconciliation. Supports the
+	// same Go template placeholders as Agent.scale_check.
 	ScaleCheck *string `toml:"scale_check,omitempty"`
 	// OptionDefaults adds or overrides provider option defaults for this agent.
 	// Keys are option keys, values are choice values. Merges additively
diff --git a/internal/config/provenance_test.go b/internal/config/provenance_test.go
index 9f87364922..119de1724d 100644
--- a/internal/config/provenance_test.go
+++ b/internal/config/provenance_test.go
@@ -79,6 +79,31 @@ func TestProviderProvenance_MapKeyAttribution(t *testing.T) {
 	}
 }
 
+func TestProviderProvenance_InferredOptionDefaultsFromArgs(t *testing.T) {
+	b := "builtin:codex"
+	city := map[string]ProviderSpec{
+		"codex-mini": {
+			Base: &b,
+			Args: []string{
+				"-m",
+				"gpt-5.3-codex-spark",
+			},
+		},
+	}
+	r, err := ResolveProviderChain("codex-mini", city["codex-mini"], city)
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+
+	optKeys := r.Provenance.MapKeyLayer["option_defaults"]
+	if optKeys == nil {
+		t.Fatal("option_defaults provenance missing")
+	}
+	if got := optKeys["model"]; got != "providers.codex-mini" {
+		t.Errorf("option_defaults[model] layer = %q, want providers.codex-mini", got)
+	}
+}
+
 func TestProviderProvenance_ChainPopulated(t *testing.T) {
 	b := "builtin:codex"
 	r, err := ResolveProviderChain("foo", ProviderSpec{
diff --git a/internal/config/provider.go b/internal/config/provider.go
index e4e8521e7a..b148803b2d 100644
--- a/internal/config/provider.go
+++ b/internal/config/provider.go
@@ -29,6 +29,9 @@ type OptionChoice struct {
 	// json:"-" is intentional: FlagArgs must never appear in the public API DTO
 	// (security boundary — prevents clients from seeing internal CLI flags).
 	FlagArgs []string `toml:"flag_args" json:"-"`
+	// FlagAliases are equivalent CLI argument sequences stripped from legacy
+	// provider args. Like FlagArgs, they stay server-side only.
+	FlagAliases [][]string `toml:"flag_aliases,omitempty" json:"-"`
 }
 
 // ProviderSpec defines a named provider's startup parameters.
@@ -94,9 +97,13 @@ type ProviderSpec struct {
 	//   "subcommand" → command resume <key>
 	ResumeStyle string `toml:"resume_style,omitempty"`
 	// ResumeCommand is the full shell command to run when resuming a session.
-	// Supports {{.SessionKey}} template variable. When set, takes precedence
-	// over ResumeFlag/ResumeStyle. Example:
+	// Supports only the {{.SessionKey}} template variable. When set, takes precedence
+	// over ResumeFlag/ResumeStyle. When schema-managed defaults are inserted, the
+	// resolver tokenizes and re-emits the command; for subcommand-style resume it
+	// inserts after the ResumeFlag token that precedes {{.SessionKey}}. Example:
 	//   "claude --resume {{.SessionKey}} --dangerously-skip-permissions"
+	// Schema-managed defaults missing from a subcommand-style resume command
+	// are inserted before {{.SessionKey}} during provider resolution.
 	ResumeCommand string `toml:"resume_command,omitempty"`
 	// SessionIDFlag is the CLI flag for creating a session with a specific ID.
 	// Enables the Generate & Pass strategy for session key management.
@@ -105,7 +112,7 @@ type ProviderSpec struct {
 	// PermissionModes maps permission mode names to CLI flags.
 	// Example: {"unrestricted": "--dangerously-skip-permissions", "plan": "--permission-mode plan"}
 	// This is a config-only lookup table consumed by external clients
-	// (e.g., Mission Control) to populate permission mode dropdowns.
+	// (e.g., real-world app) to populate permission mode dropdowns.
 	// Launch-time flag substitution is planned for a follow-up PR —
 	// currently no runtime code reads this field.
 	PermissionModes map[string]string `toml:"permission_modes,omitempty"`
@@ -200,10 +207,28 @@ type ResolvedProvider struct {
 	// EffectiveDefaults is the fully-merged option default map.
 	// Computed from: schema Default -> provider OptionDefaults -> agent OptionDefaults.
 	// Used by ResolveDefaultArgs() to produce CLI flags and by the API to
-	// tell MC what pre-selections to show.
+	// tell real-world apps what pre-selections to show.
 	EffectiveDefaults map[string]string
 }
 
+const (
+	// SessionTransportACP creates sessions through the Agent Client Protocol.
+	SessionTransportACP = "acp"
+	// SessionTransportTmux creates sessions through the tmux-backed CLI path.
+	SessionTransportTmux = "tmux"
+)
+
+// IsValidSessionTransport reports whether transport is a recognized explicit
+// session transport. The empty string is valid and means provider default.
+func IsValidSessionTransport(transport string) bool {
+	switch strings.TrimSpace(transport) {
+	case "", SessionTransportACP, SessionTransportTmux:
+		return true
+	default:
+		return false
+	}
+}
+
 // CommandString returns the full command line: command followed by args.
 func (rp *ResolvedProvider) CommandString() string {
 	if len(rp.Args) == 0 {
@@ -244,7 +269,7 @@ func (rp *ResolvedProvider) DefaultSessionTransport() string {
 		family = strings.TrimSpace(rp.Name)
 	}
 	if family == "opencode" {
-		return "acp"
+		return SessionTransportACP
 	}
 	return ""
 }
@@ -259,7 +284,7 @@ func (rp *ResolvedProvider) ProviderSessionCreateTransport() string {
 		return transport
 	}
 	if strings.TrimSpace(rp.ACPCommand) != "" || rp.ACPArgs != nil {
-		return "acp"
+		return SessionTransportACP
 	}
 	return ""
 }
@@ -268,13 +293,19 @@ func (rp *ResolvedProvider) ProviderSessionCreateTransport() string {
 // fresh session from an agent/template configuration.
 func ResolveSessionCreateTransport(agentSession string, resolved *ResolvedProvider) string {
 	agentSession = strings.TrimSpace(agentSession)
-	if agentSession != "" {
+	switch agentSession {
+	case SessionTransportACP:
+		return SessionTransportACP
+	case SessionTransportTmux:
+		return SessionTransportTmux
+	case "":
+		if resolved == nil {
+			return ""
+		}
+		return strings.TrimSpace(resolved.ProviderSessionCreateTransport())
+	default:
 		return agentSession
 	}
-	if resolved == nil {
-		return ""
-	}
-	return strings.TrimSpace(resolved.ProviderSessionCreateTransport())
 }
 
 // TitleModelFlagArgs resolves the TitleModel key against the "model"
@@ -411,9 +442,10 @@ func providerChoicesFromWorker(choices []workerbuiltin.BuiltinOptionChoice) []Op
 	out := make([]OptionChoice, len(choices))
 	for i, choice := range choices {
 		out[i] = OptionChoice{
-			Value:    choice.Value,
-			Label:    choice.Label,
-			FlagArgs: cloneStrings(choice.FlagArgs),
+			Value:       choice.Value,
+			Label:       choice.Label,
+			FlagArgs:    cloneStrings(choice.FlagArgs),
+			FlagAliases: cloneStringSlices(choice.FlagAliases),
 		}
 	}
 	return out
@@ -438,3 +470,14 @@ func cloneStrings(values []string) []string {
 	copy(out, values)
 	return out
 }
+
+func cloneStringSlices(values [][]string) [][]string {
+	if values == nil {
+		return nil
+	}
+	out := make([][]string, len(values))
+	for i := range values {
+		out[i] = cloneStrings(values[i])
+	}
+	return out
+}
diff --git a/internal/config/provider_test.go b/internal/config/provider_test.go
index 8fb9b48fd3..acd986ca37 100644
--- a/internal/config/provider_test.go
+++ b/internal/config/provider_test.go
@@ -178,9 +178,8 @@ func TestBuiltinProvidersReturnsNewMap(t *testing.T) {
 }
 
 // TestBuiltinProvidersOpenCode verifies the opencode provider keeps startup
-// instructions out of argv. OpenCode treats argv prompt payloads as a normal
-// user message, so hook-enabled sessions must receive startup context through
-// gc prime --hook instead of argv.
+// instructions out of bare argv. OpenCode treats positional prompt payloads as
+// project paths in TUI mode, so tmux startup delivery must use --prompt.
 func TestBuiltinProvidersOpenCode(t *testing.T) {
 	p := BuiltinProviders()["opencode"]
 	if p.Command != "opencode" {
@@ -192,11 +191,11 @@ func TestBuiltinProvidersOpenCode(t *testing.T) {
 	if !reflect.DeepEqual(p.ACPArgs, []string{"acp"}) {
 		t.Errorf("ACPArgs = %v, want [acp]", p.ACPArgs)
 	}
-	if p.PromptMode != "none" {
-		t.Errorf("PromptMode = %q, want %q", p.PromptMode, "none")
+	if p.PromptMode != "flag" {
+		t.Errorf("PromptMode = %q, want %q", p.PromptMode, "flag")
 	}
-	if p.PromptFlag != "" {
-		t.Errorf("PromptFlag = %q, want empty", p.PromptFlag)
+	if p.PromptFlag != "--prompt" {
+		t.Errorf("PromptFlag = %q, want --prompt", p.PromptFlag)
 	}
 	if !derefBool(p.SupportsHooks) {
 		t.Error("SupportsHooks = false, want true")
@@ -207,6 +206,12 @@ func TestBuiltinProvidersOpenCode(t *testing.T) {
 	if p.InstructionsFile != "AGENTS.md" {
 		t.Errorf("InstructionsFile = %q, want %q", p.InstructionsFile, "AGENTS.md")
 	}
+	if p.ResumeFlag != "--session" {
+		t.Errorf("ResumeFlag = %q, want --session", p.ResumeFlag)
+	}
+	if p.ResumeStyle != "flag" {
+		t.Errorf("ResumeStyle = %q, want flag", p.ResumeStyle)
+	}
 	if p.ReadyDelayMs != 8000 {
 		t.Errorf("ReadyDelayMs = %d, want 8000", p.ReadyDelayMs)
 	}
@@ -214,15 +219,15 @@ func TestBuiltinProvidersOpenCode(t *testing.T) {
 
 // TestBuiltinProvidersOpenCodePromptModeRegression guards against switching
 // OpenCode back to argv-based prompt delivery. Gas City renders the startup
-// prompt as persona instructions, not as the first user task, so OpenCode must
-// not receive it through argv at startup.
+// prompt as startup material, so OpenCode must not receive it as a bare
+// positional argument at startup.
 func TestBuiltinProvidersOpenCodePromptModeRegression(t *testing.T) {
 	p := BuiltinProviders()["opencode"]
 	if p.PromptMode == "arg" {
 		t.Fatal("PromptMode must not be \"arg\" — OpenCode interprets positional prompt argv as a project path")
 	}
-	if p.PromptMode == "flag" {
-		t.Fatal("PromptMode must not be \"flag\" — OpenCode treats --prompt as the first user message instead of startup persona context")
+	if p.PromptMode != "flag" || p.PromptFlag != "--prompt" {
+		t.Fatalf("OpenCode prompt delivery = %q %q, want flag --prompt", p.PromptMode, p.PromptFlag)
 	}
 }
 
@@ -457,6 +462,17 @@ func TestResolveSessionCreateTransportPrefersAgentSessionOverride(t *testing.T)
 	}
 }
 
+func TestResolveSessionCreateTransportExplicitTmuxOverridesProviderACPDefault(t *testing.T) {
+	got := ResolveSessionCreateTransport("tmux", &ResolvedProvider{
+		Name:        "opencode",
+		SupportsACP: true,
+		ACPArgs:     []string{"acp"},
+	})
+	if got != "tmux" {
+		t.Fatalf("ResolveSessionCreateTransport() = %q, want %q", got, "tmux")
+	}
+}
+
 func TestResolveSessionCreateTransportFallsBackToProviderCreateTransport(t *testing.T) {
 	got := ResolveSessionCreateTransport("", &ResolvedProvider{
 		Name:        "custom-acp",
diff --git a/internal/config/resolve.go b/internal/config/resolve.go
index 560615d4d8..7997a1d6dd 100644
--- a/internal/config/resolve.go
+++ b/internal/config/resolve.go
@@ -76,6 +76,9 @@ func ResolveProvider(agent *Agent, ws *Workspace, cityProviders map[string]Provi
 	// §Kind / provider-family propagation.
 	resolved.BuiltinAncestor = BuiltinFamily(name, cityProviders)
 	mergeAgentOverrides(resolved, agent)
+	if agent.ResumeCommand == "" {
+		completeResolvedProviderResumeCommand(resolved)
+	}
 
 	// Step 4b: workspace.start_command overrides the resolved command when
 	// the agent doesn't set its own. Unlike the escape hatch at step 2
@@ -137,9 +140,10 @@ func lookupProvider(name string, cityProviders map[string]ProviderSpec, lookPath
 			// opt-out and must not fall through to legacy auto-inheritance.
 			if spec.Base != nil {
 				if strings.TrimSpace(*spec.Base) == "" {
-					return &spec, nil
+					standalone := normalizeProviderLayerArgsForSchema(spec, spec.OptionsSchema)
+					return &standalone, nil
 				}
-				resolved, err := ResolveProviderChain(name, spec, cityProviders)
+				resolved, err := resolveProviderChain(name, spec, cityProviders, false)
 				if err != nil {
 					return nil, err
 				}
@@ -150,14 +154,19 @@ func lookupProvider(name string, cityProviders map[string]ProviderSpec, lookPath
 			// if the provider name or command matches a known builtin.
 			builtins := BuiltinProviders()
 			if base, ok := builtins[name]; ok {
-				merged := MergeProviderOverBuiltin(base, spec)
+				base = normalizeProviderLayerArgsForSchema(base, base.OptionsSchema)
+				child := normalizeProviderLayerArgsForSchema(spec, providerSchemaForLayerArgs(base, spec))
+				merged := MergeProviderOverBuiltin(base, child)
 				return &merged, nil
 			}
 			if base, ok := builtins[spec.Command]; ok {
-				merged := MergeProviderOverBuiltin(base, spec)
+				base = normalizeProviderLayerArgsForSchema(base, base.OptionsSchema)
+				child := normalizeProviderLayerArgsForSchema(spec, providerSchemaForLayerArgs(base, spec))
+				merged := MergeProviderOverBuiltin(base, child)
 				return &merged, nil
 			}
-			return &spec, nil
+			standalone := normalizeProviderLayerArgsForSchema(spec, spec.OptionsSchema)
+			return &standalone, nil
 		}
 	}
 
@@ -386,6 +395,41 @@ func optionKeysRemovedByReplacement(base, replacement []ProviderOption) map[stri
 	return removed
 }
 
+func providerSchemaForLayerArgs(parent, child ProviderSpec) []ProviderOption {
+	if child.OptionsSchema == nil {
+		return parent.OptionsSchema
+	}
+	if child.OptionsSchemaMerge == "by_key" {
+		schema, _ := mergeOptionsSchemaByKey(parent.OptionsSchema, child.OptionsSchema)
+		return schema
+	}
+	return child.OptionsSchema
+}
+
+func normalizeProviderLayerArgsForSchema(spec ProviderSpec, schema []ProviderOption) ProviderSpec {
+	if len(schema) == 0 {
+		return spec
+	}
+	allFlags := CollectAllSchemaFlags(schema)
+	if len(allFlags) == 0 {
+		return spec
+	}
+	defaults := cloneStringMap(spec.OptionDefaults)
+	if defaults == nil {
+		defaults = make(map[string]string)
+	}
+	if spec.Args != nil {
+		spec.Args = stripArgsSlice(spec.Args, allFlags, schema, defaults)
+	}
+	if spec.ArgsAppend != nil {
+		spec.ArgsAppend = stripArgsSlice(spec.ArgsAppend, allFlags, schema, defaults)
+	}
+	if len(defaults) > 0 || spec.OptionDefaults != nil {
+		spec.OptionDefaults = defaults
+	}
+	return spec
+}
+
 // resolveProviderKind determines the canonical builtin provider name for a
 // given provider name. If the name is a builtin, it returns itself. If
 // it's a custom alias whose Command matches a builtin, it returns the
@@ -507,6 +551,9 @@ func specToResolved(name string, spec *ProviderSpec) *ResolvedProvider {
 						rp.OptionsSchema[i].Choices[j].FlagArgs = make([]string, len(c.FlagArgs))
 						copy(rp.OptionsSchema[i].Choices[j].FlagArgs, c.FlagArgs)
 					}
+					if len(c.FlagAliases) > 0 {
+						rp.OptionsSchema[i].Choices[j].FlagAliases = cloneStringSlices(c.FlagAliases)
+					}
 				}
 			}
 		}
@@ -516,7 +563,7 @@ func specToResolved(name string, spec *ProviderSpec) *ResolvedProvider {
 		rp.InstructionsFile = "AGENTS.md"
 	}
 	// Copy slices to avoid aliasing.
-	if len(spec.Args) > 0 {
+	if spec.Args != nil {
 		rp.Args = make([]string, len(spec.Args))
 		copy(rp.Args, spec.Args)
 	}
@@ -525,10 +572,11 @@ func specToResolved(name string, spec *ProviderSpec) *ResolvedProvider {
 	// if a city.toml still has schema-managed flags in args (e.g.,
 	// --dangerously-skip-permissions), they get removed because the option is
 	// covered by OptionsSchema. Inferred defaults preserve user intent.
-	if len(rp.OptionsSchema) > 0 && len(rp.Args) > 0 {
+	if len(rp.OptionsSchema) > 0 && rp.Args != nil {
 		allFlags := CollectAllSchemaFlags(rp.OptionsSchema)
 		inferredDefaults := make(map[string]string)
-		// Seed with existing OptionDefaults so they aren't overridden.
+		// Seed with existing OptionDefaults; same-layer Args override them
+		// when stripArgsSlice infers a schema-managed choice.
 		for k, v := range spec.OptionDefaults {
 			inferredDefaults[k] = v
 		}
@@ -539,7 +587,6 @@ func specToResolved(name string, spec *ProviderSpec) *ResolvedProvider {
 	} else {
 		rp.EffectiveDefaults = ComputeEffectiveDefaults(rp.OptionsSchema, spec.OptionDefaults, nil)
 	}
-
 	if len(spec.ProcessNames) > 0 {
 		rp.ProcessNames = make([]string, len(spec.ProcessNames))
 		copy(rp.ProcessNames, spec.ProcessNames)
@@ -567,6 +614,10 @@ func specToResolved(name string, spec *ProviderSpec) *ResolvedProvider {
 	return rp
 }
 
+func completeResolvedProviderResumeCommand(rp *ResolvedProvider) {
+	rp.ResumeCommand = completeResumeCommandDefaults(rp.ResumeCommand, rp.ResumeFlag, rp.ResumeStyle, rp.OptionsSchema, rp.EffectiveDefaults)
+}
+
 // AgentHasHooks reports whether an agent has provider hooks installed
 // (either auto-installed or manually). The determination considers:
 //
@@ -734,20 +785,13 @@ func resolvedChainToSpec(r ResolvedProvider, leaf ProviderSpec) ProviderSpec {
 		}
 	}
 	if r.OptionsSchema != nil {
-		out.OptionsSchema = append([]ProviderOption(nil), r.OptionsSchema...)
+		out.OptionsSchema = deepCopyProviderOptions(r.OptionsSchema)
 	}
-	// EffectiveDefaults on ResolvedProvider is the merged defaults; fold
-	// into OptionDefaults on the spec so downstream specToResolved picks
-	// it up when rebuilding.
+	// EffectiveDefaults on ResolvedProvider is the normalized merged defaults;
+	// replace OptionDefaults on the folded spec so same-layer schema-managed
+	// args cannot be shadowed again by the original stale leaf map.
 	if r.EffectiveDefaults != nil {
-		if out.OptionDefaults == nil {
-			out.OptionDefaults = make(map[string]string, len(r.EffectiveDefaults))
-		}
-		for k, v := range r.EffectiveDefaults {
-			if _, ok := out.OptionDefaults[k]; !ok {
-				out.OptionDefaults[k] = v
-			}
-		}
+		out.OptionDefaults = cloneStringMap(r.EffectiveDefaults)
 	}
 	return out
 }
diff --git a/internal/config/resolve_test.go b/internal/config/resolve_test.go
index 175270a04f..6b252feeb3 100644
--- a/internal/config/resolve_test.go
+++ b/internal/config/resolve_test.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/fsys"
@@ -630,6 +631,48 @@ func TestResolveProviderBaseChainEmitsDangerousBypass(t *testing.T) {
 	}
 }
 
+func TestResolveProviderBaseChainStripsCodexAliases(t *testing.T) {
+	b := "builtin:codex"
+	city := map[string]ProviderSpec{
+		"codex-max": {
+			Base:    &b,
+			Command: "aimux",
+			Args: []string{
+				"run", "codex", "--",
+				"--dangerously-bypass-approvals-and-sandbox",
+				"-m", "gpt-5.5",
+				"-c", "model_reasoning_effort=\"xhigh\"",
+			},
+			ResumeCommand: "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.5 resume {{.SessionKey}}",
+		},
+	}
+	agent := &Agent{Name: "codex-max", Provider: "codex-max"}
+	resolved, err := ResolveProvider(agent, nil, city, lookPathAll)
+	if err != nil {
+		t.Fatalf("ResolveProvider: %v", err)
+	}
+	wantArgs := []string{"run", "codex", "--"}
+	if !reflect.DeepEqual(resolved.Args, wantArgs) {
+		t.Fatalf("Args = %v, want %v", resolved.Args, wantArgs)
+	}
+	if got := resolved.EffectiveDefaults["model"]; got != "gpt-5.5" {
+		t.Fatalf("EffectiveDefaults[model] = %q, want gpt-5.5", got)
+	}
+	if got := resolved.EffectiveDefaults["effort"]; got != "xhigh" {
+		t.Fatalf("EffectiveDefaults[effort] = %q, want xhigh", got)
+	}
+	command := resolved.CommandString()
+	if defaultArgs := resolved.ResolveDefaultArgs(); len(defaultArgs) > 0 {
+		command = command + " " + strings.Join(defaultArgs, " ")
+	}
+	if strings.Count(command, "gpt-5.5") != 1 {
+		t.Fatalf("resolved launch command = %q, want one model flag", command)
+	}
+	if strings.Count(command, "model_reasoning_effort") != 1 {
+		t.Fatalf("resolved launch command = %q, want one effort flag", command)
+	}
+}
+
 func TestResolveProviderChainArgsAppendAffectsResolvedArgs(t *testing.T) {
 	custom := map[string]ProviderSpec{
 		"codex": {
@@ -653,6 +696,309 @@ func TestResolveProviderChainArgsAppendAffectsResolvedArgs(t *testing.T) {
 	}
 }
 
+func TestResolveProviderChainLeafArgsOverrideInheritedCodexDefaults(t *testing.T) {
+	b := "builtin:codex"
+	city := map[string]ProviderSpec{
+		"codex-mini": {
+			Base:    &b,
+			Command: "aimux",
+			Args: []string{
+				"run", "codex", "--",
+				"--dangerously-bypass-approvals-and-sandbox",
+				"-m", "gpt-5.3-codex-spark",
+				"-c", "model_reasoning_effort=\"medium\"",
+			},
+			ResumeCommand: "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume {{.SessionKey}}",
+		},
+	}
+	agent := &Agent{Name: "codex-min", Provider: "codex-mini"}
+	resolved, err := ResolveProvider(agent, nil, city, lookPathAll)
+	if err != nil {
+		t.Fatalf("ResolveProvider: %v", err)
+	}
+	wantArgs := []string{"run", "codex", "--"}
+	if !reflect.DeepEqual(resolved.Args, wantArgs) {
+		t.Fatalf("Args = %v, want %v", resolved.Args, wantArgs)
+	}
+	if got := resolved.EffectiveDefaults["model"]; got != "gpt-5.3-codex-spark" {
+		t.Fatalf("EffectiveDefaults[model] = %q, want gpt-5.3-codex-spark", got)
+	}
+	if got := resolved.EffectiveDefaults["effort"]; got != "medium" {
+		t.Fatalf("EffectiveDefaults[effort] = %q, want medium", got)
+	}
+	command := resolved.CommandString()
+	if defaultArgs := resolved.ResolveDefaultArgs(); len(defaultArgs) > 0 {
+		command = command + " " + strings.Join(defaultArgs, " ")
+	}
+	if strings.Contains(command, "model_reasoning_effort=xhigh") {
+		t.Fatalf("resolved launch command = %q, inherited max effort leaked into mini provider", command)
+	}
+	if strings.Contains(command, "gpt-5.5") {
+		t.Fatalf("resolved launch command = %q, inherited max model leaked into mini provider", command)
+	}
+	if strings.Count(command, "gpt-5.3-codex-spark") != 1 {
+		t.Fatalf("resolved launch command = %q, want one spark model flag", command)
+	}
+	if strings.Count(command, "model_reasoning_effort=medium") != 1 {
+		t.Fatalf("resolved launch command = %q, want one medium effort flag", command)
+	}
+	resumeCommand := strings.ReplaceAll(resolved.ResumeCommand, "{{.SessionKey}}", "session-123")
+	if !strings.Contains(resumeCommand, "resume -c model_reasoning_effort=medium session-123") {
+		t.Fatalf("resolved resume command = %q, missing medium effort default before session key", resumeCommand)
+	}
+}
+
+func TestResolveProviderExplicitBaseArgsOverrideSameLayerOptionDefaults(t *testing.T) {
+	builtinCodex := "builtin:codex"
+	providers := map[string]ProviderSpec{
+		"codex-mini": {
+			Base: &builtinCodex,
+			Args: []string{
+				"-m",
+				"gpt-5.3-codex-spark",
+			},
+			OptionDefaults: map[string]string{
+				"model": "gpt-5.5",
+			},
+		},
+	}
+	agent := &Agent{Name: "codex-min", Provider: "codex-mini"}
+
+	resolved, err := ResolveProvider(agent, nil, providers, lookPathOnly("codex"))
+	if err != nil {
+		t.Fatalf("ResolveProvider: %v", err)
+	}
+	if got := resolved.EffectiveDefaults["model"]; got != "gpt-5.3-codex-spark" {
+		t.Fatalf("EffectiveDefaults[model] = %q, want args-inferred gpt-5.3-codex-spark", got)
+	}
+	defaultLine := strings.Join(resolved.ResolveDefaultArgs(), " ")
+	if strings.Contains(defaultLine, "gpt-5.5") {
+		t.Fatalf("ResolveDefaultArgs() = %v, preserved stale same-layer option_defaults", resolved.ResolveDefaultArgs())
+	}
+	if !strings.Contains(defaultLine, "gpt-5.3-codex-spark") {
+		t.Fatalf("ResolveDefaultArgs() = %v, missing args-inferred model", resolved.ResolveDefaultArgs())
+	}
+}
+
+func TestResolveProviderChainChildOptionDefaultsBeatInheritedArgs(t *testing.T) {
+	builtinCodex := "builtin:codex"
+	city := map[string]ProviderSpec{
+		"codex-base": {
+			Base:    &builtinCodex,
+			Command: "aimux",
+			Args: []string{
+				"run", "codex", "--",
+				"-m", "gpt-5.5",
+			},
+			ResumeCommand: "aimux run codex -- resume {{.SessionKey}}",
+		},
+		"codex-mini": {
+			Base: basePtr("codex-base"),
+			OptionDefaults: map[string]string{
+				"model": "gpt-5.3-codex-spark",
+			},
+		},
+	}
+	resolved, err := ResolveProviderChain("codex-mini", city["codex-mini"], city)
+	if err != nil {
+		t.Fatalf("ResolveProviderChain: %v", err)
+	}
+	if got := resolved.EffectiveDefaults["model"]; got != "gpt-5.3-codex-spark" {
+		t.Fatalf("EffectiveDefaults[model] = %q, want child option default gpt-5.3-codex-spark", got)
+	}
+	if strings.Contains(strings.Join(resolved.ResolveDefaultArgs(), " "), "gpt-5.5") {
+		t.Fatalf("ResolveDefaultArgs() = %v, inherited parent arg overrode child option_defaults", resolved.ResolveDefaultArgs())
+	}
+}
+
+func TestResolveProviderChainArgsAppendInfersSchemaDefaults(t *testing.T) {
+	builtinCodex := "builtin:codex"
+	providers := map[string]ProviderSpec{
+		"codex-wrapper": {
+			Base:          &builtinCodex,
+			Command:       "aimux",
+			Args:          []string{"run", "codex", "--"},
+			ResumeCommand: "aimux run codex -- resume {{.SessionKey}}",
+		},
+		"codex-mini": {
+			Base: basePtr("codex-wrapper"),
+			ArgsAppend: []string{
+				"-m",
+				"gpt-5.3-codex-spark",
+			},
+		},
+	}
+
+	resolved, err := ResolveProviderChain("codex-mini", providers["codex-mini"], providers)
+	if err != nil {
+		t.Fatalf("ResolveProviderChain: %v", err)
+	}
+	wantArgs := []string{"run", "codex", "--"}
+	if !reflect.DeepEqual(resolved.Args, wantArgs) {
+		t.Fatalf("Args = %v, want schema-managed args_append stripped to %v", resolved.Args, wantArgs)
+	}
+	if got := resolved.EffectiveDefaults["model"]; got != "gpt-5.3-codex-spark" {
+		t.Fatalf("EffectiveDefaults[model] = %q, want gpt-5.3-codex-spark", got)
+	}
+	defaultLine := strings.Join(resolved.ResolveDefaultArgs(), " ")
+	if !strings.Contains(defaultLine, "--model gpt-5.3-codex-spark") {
+		t.Fatalf("ResolveDefaultArgs() = %v, missing args_append-inferred model", resolved.ResolveDefaultArgs())
+	}
+	optKeys := resolved.Provenance.MapKeyLayer["option_defaults"]
+	if optKeys == nil {
+		t.Fatal("option_defaults provenance missing")
+	}
+	if got := optKeys["model"]; got != "providers.codex-mini" {
+		t.Fatalf("option_defaults[model] layer = %q, want providers.codex-mini", got)
+	}
+}
+
+func TestResolveProviderChainSchemaOnlyChildArgsReplaceInheritedArgs(t *testing.T) {
+	builtinCodex := "builtin:codex"
+	providers := map[string]ProviderSpec{
+		"codex-wrapper": {
+			Base:    &builtinCodex,
+			Command: "aimux",
+			Args: []string{
+				"run",
+				"codex",
+				"--",
+				"--parent-non-schema",
+			},
+			ResumeCommand: "aimux run codex -- resume {{.SessionKey}}",
+		},
+		"codex-mini": {
+			Base: basePtr("codex-wrapper"),
+			Args: []string{
+				"-m",
+				"gpt-5.3-codex-spark",
+			},
+		},
+	}
+
+	resolved, err := ResolveProviderChain("codex-mini", providers["codex-mini"], providers)
+	if err != nil {
+		t.Fatalf("ResolveProviderChain: %v", err)
+	}
+	if resolved.Args == nil {
+		t.Fatalf("Args = nil, want non-nil empty slice to preserve child replacement")
+	}
+	if len(resolved.Args) != 0 {
+		t.Fatalf("Args = %v, want empty slice with no inherited parent args", resolved.Args)
+	}
+	if got := resolved.EffectiveDefaults["model"]; got != "gpt-5.3-codex-spark" {
+		t.Fatalf("EffectiveDefaults[model] = %q, want gpt-5.3-codex-spark", got)
+	}
+}
+
+func TestResolveProviderChainCodexSuggestArgsReplaceInheritedUnrestricted(t *testing.T) {
+	builtinCodex := "builtin:codex"
+	providers := map[string]ProviderSpec{
+		"codex-suggest": {
+			Base: &builtinCodex,
+			Args: []string{
+				"--ask-for-approval",
+				"untrusted",
+				"--sandbox",
+				"read-only",
+			},
+		},
+	}
+
+	resolved, err := ResolveProviderChain("codex-suggest", providers["codex-suggest"], providers)
+	if err != nil {
+		t.Fatalf("ResolveProviderChain: %v", err)
+	}
+	if len(resolved.Args) != 0 {
+		t.Fatalf("Args = %v, want schema-managed args stripped", resolved.Args)
+	}
+	if got := resolved.EffectiveDefaults["permission_mode"]; got != "suggest" {
+		t.Fatalf("EffectiveDefaults[permission_mode] = %q, want suggest", got)
+	}
+	defaultArgs := resolved.ResolveDefaultArgs()
+	defaultLine := strings.Join(defaultArgs, " ")
+	if strings.Contains(defaultLine, "--dangerously-bypass-approvals-and-sandbox") {
+		t.Fatalf("ResolveDefaultArgs() = %v, preserved inherited unrestricted flag", defaultArgs)
+	}
+	if !strings.Contains(defaultLine, "--ask-for-approval untrusted --sandbox read-only") {
+		t.Fatalf("ResolveDefaultArgs() = %v, missing suggest permission flags", defaultArgs)
+	}
+	if strings.Count(defaultLine, "--sandbox read-only") != 1 {
+		t.Fatalf("ResolveDefaultArgs() = %v, want one read-only sandbox flag sequence", defaultArgs)
+	}
+}
+
+func TestResolveProviderAgentOptionDefaultsUpdateWrappedResumeDefaults(t *testing.T) {
+	builtinCodex := "builtin:codex"
+	providers := map[string]ProviderSpec{
+		"codex-mini": {
+			Base:    &builtinCodex,
+			Command: "aimux",
+			Args: []string{
+				"run", "codex", "--",
+				"--dangerously-bypass-approvals-and-sandbox",
+				"-m", "gpt-5.3-codex-spark",
+				"-c", "model_reasoning_effort=\"medium\"",
+			},
+			ResumeCommand: "aimux run codex -- --dangerously-bypass-approvals-and-sandbox -m gpt-5.3-codex-spark resume {{.SessionKey}}",
+		},
+	}
+	agent := &Agent{
+		Name:     "worker",
+		Provider: "codex-mini",
+		OptionDefaults: map[string]string{
+			"effort": "high",
+		},
+	}
+	resolved, err := ResolveProvider(agent, nil, providers, lookPathOnly("aimux"))
+	if err != nil {
+		t.Fatalf("ResolveProvider: %v", err)
+	}
+	resumeCommand := strings.ReplaceAll(resolved.ResumeCommand, "{{.SessionKey}}", "session-123")
+	if !strings.Contains(resumeCommand, "resume -c model_reasoning_effort=high session-123") {
+		t.Fatalf("resolved resume command = %q, missing agent effort default before session key", resumeCommand)
+	}
+	if strings.Contains(resumeCommand, "model_reasoning_effort=medium") {
+		t.Fatalf("resolved resume command = %q, retained provider effort default after agent override", resumeCommand)
+	}
+	defaultArgs := strings.Join(resolved.ResolveDefaultArgs(), " ")
+	if !strings.Contains(defaultArgs, "model_reasoning_effort=high") {
+		t.Fatalf("ResolveDefaultArgs() = %v, missing agent effort default", resolved.ResolveDefaultArgs())
+	}
+}
+
+func TestResolveProviderFlagStyleResumeCommandAppendsDefaults(t *testing.T) {
+	agent := &Agent{Name: "worker", Provider: "custom"}
+	providers := map[string]ProviderSpec{
+		"custom": {
+			Command:       "custom-agent",
+			ResumeFlag:    "--resume",
+			ResumeStyle:   "flag",
+			ResumeCommand: "custom-agent --resume {{.SessionKey}} --safe",
+			OptionDefaults: map[string]string{
+				"model": "opus",
+			},
+			OptionsSchema: []ProviderOption{
+				{
+					Key: "model",
+					Choices: []OptionChoice{
+						{Value: "opus", FlagArgs: []string{"--model", "claude-opus-4-7"}},
+					},
+				},
+			},
+		},
+	}
+
+	resolved, err := ResolveProvider(agent, nil, providers, lookPathOnly("custom-agent"))
+	if err != nil {
+		t.Fatalf("ResolveProvider: %v", err)
+	}
+	want := "custom-agent --resume {{.SessionKey}} --safe --model claude-opus-4-7"
+	if resolved.ResumeCommand != want {
+		t.Fatalf("ResumeCommand = %q, want %q", resolved.ResumeCommand, want)
+	}
+}
+
 func TestMergeProviderOverBuiltinOptionsSchemaByKeyAndOmit(t *testing.T) {
 	base := ProviderSpec{
 		OptionsSchema: []ProviderOption{
diff --git a/internal/config/resolved_cache.go b/internal/config/resolved_cache.go
index 04c9d92a92..ac6e35eee4 100644
--- a/internal/config/resolved_cache.go
+++ b/internal/config/resolved_cache.go
@@ -183,6 +183,9 @@ func deepCopyResolvedProvider(r ResolvedProvider) ResolvedProvider {
 					if c.FlagArgs != nil {
 						nc.FlagArgs = append([]string(nil), c.FlagArgs...)
 					}
+					if c.FlagAliases != nil {
+						nc.FlagAliases = cloneStringSlices(c.FlagAliases)
+					}
 					nopt.Choices[j] = nc
 				}
 			}
diff --git a/internal/config/revision.go b/internal/config/revision.go
index d660f97ea8..3f3a1ea0b1 100644
--- a/internal/config/revision.go
+++ b/internal/config/revision.go
@@ -3,6 +3,7 @@ package config
 import (
 	"crypto/sha256"
 	"fmt"
+	"hash"
 	"os"
 	"path/filepath"
 	"sort"
@@ -12,6 +13,13 @@ import (
 	"github.com/gastownhall/gascity/internal/pathutil"
 )
 
+type revisionSnapshot struct {
+	dirHashes      map[string]string
+	fileContents   map[string][]byte
+	fileKnown      map[string]bool
+	conventionDirs []string
+}
+
 // Revision computes a deterministic bundle hash from all resolved config
 // source files. This serves as a revision identifier — if the revision
 // changes, the effective config may have changed and a reload is warranted.
@@ -27,9 +35,13 @@ func Revision(fs fsys.FS, prov *Provenance, cfg *City, cityRoot string) string {
 	copy(sources, prov.Sources)
 	sort.Strings(sources)
 	for _, path := range sources {
-		data, err := fs.ReadFile(path)
-		if err != nil {
-			continue
+		data, ok := prov.sourceContents[path]
+		if !ok {
+			var err error
+			data, err = fs.ReadFile(path)
+			if err != nil {
+				continue
+			}
 		}
 		h.Write([]byte(path)) //nolint:errcheck // hash.Write never errors
 		h.Write([]byte{0})    //nolint:errcheck // hash.Write never errors
@@ -42,22 +54,14 @@ func Revision(fs fsys.FS, prov *Provenance, cfg *City, cityRoot string) string {
 	for _, r := range rigs {
 		for _, ref := range r.Includes {
 			topoDir, _ := resolvePackRef(ref, cityRoot, cityRoot)
-			topoHash := PackContentHashRecursive(fs, topoDir)
-			h.Write([]byte("pack:" + r.Name + ":" + ref)) //nolint:errcheck // hash.Write never errors
-			h.Write([]byte{0})                            //nolint:errcheck // hash.Write never errors
-			h.Write([]byte(topoHash))                     //nolint:errcheck // hash.Write never errors
-			h.Write([]byte{0})                            //nolint:errcheck // hash.Write never errors
+			writeRevisionDirHash(h, prov, "pack:"+r.Name+":"+ref, fs, topoDir)
 		}
 	}
 
 	// Hash city-level pack directory contents.
 	for _, ref := range cfg.Workspace.Includes {
 		topoDir, _ := resolvePackRef(ref, cityRoot, cityRoot)
-		topoHash := PackContentHashRecursive(fs, topoDir)
-		h.Write([]byte("city-pack:" + ref)) //nolint:errcheck // hash.Write never errors
-		h.Write([]byte{0})                  //nolint:errcheck // hash.Write never errors
-		h.Write([]byte(topoHash))           //nolint:errcheck // hash.Write never errors
-		h.Write([]byte{0})                  //nolint:errcheck // hash.Write never errors
+		writeRevisionDirHash(h, prov, "city-pack:"+ref, fs, topoDir)
 	}
 
 	// Remote PackV2 imports resolve through packs.lock, so lockfile changes
@@ -65,7 +69,11 @@ func Revision(fs fsys.FS, prov *Provenance, cfg *City, cityRoot string) string {
 	// untouched.
 	if tracksPackV2Imports(cfg) {
 		lockPath := filepath.Join(cityRoot, "packs.lock")
-		if data, err := fs.ReadFile(lockPath); err == nil {
+		if data, known, exists := revisionSnapshotFile(prov, lockPath); known {
+			if exists {
+				writeRevisionBytes(h, lockPath, data)
+			}
+		} else if data, err := fs.ReadFile(lockPath); err == nil {
 			h.Write([]byte(lockPath)) //nolint:errcheck // hash.Write never errors
 			h.Write([]byte{0})        //nolint:errcheck // hash.Write never errors
 			h.Write(data)             //nolint:errcheck // hash.Write never errors
@@ -81,11 +89,7 @@ func Revision(fs fsys.FS, prov *Provenance, cfg *City, cityRoot string) string {
 		if strings.TrimSpace(dir) == "" {
 			continue
 		}
-		topoHash := PackContentHashRecursive(fs, dir)
-		h.Write([]byte("city-packdir:" + dir)) //nolint:errcheck // hash.Write never errors
-		h.Write([]byte{0})                     //nolint:errcheck // hash.Write never errors
-		h.Write([]byte(topoHash))              //nolint:errcheck // hash.Write never errors
-		h.Write([]byte{0})                     //nolint:errcheck // hash.Write never errors
+		writeRevisionDirHash(h, prov, "city-packdir:"+dir, fs, dir)
 	}
 	rigPackDirNames := make([]string, 0, len(cfg.RigPackDirs))
 	for name := range cfg.RigPackDirs {
@@ -97,26 +101,135 @@ func Revision(fs fsys.FS, prov *Provenance, cfg *City, cityRoot string) string {
 			if strings.TrimSpace(dir) == "" {
 				continue
 			}
-			topoHash := PackContentHashRecursive(fs, dir)
-			h.Write([]byte("rig-packdir:" + rigName + ":" + dir)) //nolint:errcheck // hash.Write never errors
-			h.Write([]byte{0})                                    //nolint:errcheck // hash.Write never errors
-			h.Write([]byte(topoHash))                             //nolint:errcheck // hash.Write never errors
-			h.Write([]byte{0})                                    //nolint:errcheck // hash.Write never errors
+			writeRevisionDirHash(h, prov, "rig-packdir:"+rigName+":"+dir, fs, dir)
 		}
 	}
 	// Hash convention-discovered city-pack trees so adding or editing
 	// agents/commands/doctor content changes the effective revision too.
-	for _, dir := range existingConventionDiscoveryDirsFS(fs, cityRoot) {
-		topoHash := PackContentHashRecursive(fs, dir)
-		h.Write([]byte("city-discovery:" + dir)) //nolint:errcheck // hash.Write never errors
-		h.Write([]byte{0})                       //nolint:errcheck // hash.Write never errors
-		h.Write([]byte(topoHash))                //nolint:errcheck // hash.Write never errors
-		h.Write([]byte{0})                       //nolint:errcheck // hash.Write never errors
+	for _, dir := range revisionConventionDirs(prov, fs, cityRoot) {
+		writeRevisionDirHash(h, prov, "city-discovery:"+dir, fs, dir)
 	}
 
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
 
+func (p *Provenance) captureRevisionSnapshot(fs fsys.FS, cfg *City, cityRoot string) {
+	if p == nil || cfg == nil {
+		return
+	}
+	p.recordMissingSourceContents(fs)
+	snap := &revisionSnapshot{
+		dirHashes:    make(map[string]string),
+		fileContents: make(map[string][]byte),
+		fileKnown:    make(map[string]bool),
+	}
+	recordDir := func(label, dir string) {
+		snap.dirHashes[label] = PackContentHashRecursive(fs, dir)
+	}
+
+	for _, r := range cfg.Rigs {
+		for _, ref := range r.Includes {
+			topoDir, _ := resolvePackRef(ref, cityRoot, cityRoot)
+			recordDir("pack:"+r.Name+":"+ref, topoDir)
+		}
+	}
+	for _, ref := range cfg.Workspace.Includes {
+		topoDir, _ := resolvePackRef(ref, cityRoot, cityRoot)
+		recordDir("city-pack:"+ref, topoDir)
+	}
+	if tracksPackV2Imports(cfg) {
+		lockPath := filepath.Join(cityRoot, "packs.lock")
+		snap.fileKnown[lockPath] = true
+		if data, err := fs.ReadFile(lockPath); err == nil {
+			snap.fileContents[lockPath] = cloneBytes(data)
+		}
+	}
+	for _, dir := range cfg.PackDirs {
+		if strings.TrimSpace(dir) == "" {
+			continue
+		}
+		recordDir("city-packdir:"+dir, dir)
+	}
+	rigPackDirNames := make([]string, 0, len(cfg.RigPackDirs))
+	for name := range cfg.RigPackDirs {
+		rigPackDirNames = append(rigPackDirNames, name)
+	}
+	sort.Strings(rigPackDirNames)
+	for _, rigName := range rigPackDirNames {
+		for _, dir := range cfg.RigPackDirs[rigName] {
+			if strings.TrimSpace(dir) == "" {
+				continue
+			}
+			recordDir("rig-packdir:"+rigName+":"+dir, dir)
+		}
+	}
+	snap.conventionDirs = existingConventionDiscoveryDirsFS(fs, cityRoot)
+	for _, dir := range snap.conventionDirs {
+		recordDir("city-discovery:"+dir, dir)
+	}
+	p.revisionSnapshot = snap
+}
+
+func (p *Provenance) recordMissingSourceContents(fs fsys.FS) {
+	if p == nil {
+		return
+	}
+	for _, path := range p.Sources {
+		if _, ok := p.sourceContents[path]; ok {
+			continue
+		}
+		data, err := fs.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		p.recordSource(path, data)
+	}
+}
+
+func writeRevisionDirHash(h hash.Hash, prov *Provenance, label string, fs fsys.FS, dir string) {
+	topoHash, ok := revisionSnapshotDirHash(prov, label)
+	if !ok {
+		topoHash = PackContentHashRecursive(fs, dir)
+	}
+	writeRevisionBytes(h, label, []byte(topoHash))
+}
+
+func writeRevisionBytes(h hash.Hash, label string, data []byte) {
+	h.Write([]byte(label)) //nolint:errcheck // hash.Write never errors
+	h.Write([]byte{0})     //nolint:errcheck // hash.Write never errors
+	h.Write(data)          //nolint:errcheck // hash.Write never errors
+	h.Write([]byte{0})     //nolint:errcheck // hash.Write never errors
+}
+
+func revisionSnapshotDirHash(prov *Provenance, label string) (string, bool) {
+	if prov == nil || prov.revisionSnapshot == nil {
+		return "", false
+	}
+	v, ok := prov.revisionSnapshot.dirHashes[label]
+	return v, ok
+}
+
+func revisionSnapshotFile(prov *Provenance, path string) ([]byte, bool, bool) {
+	if prov == nil || prov.revisionSnapshot == nil || !prov.revisionSnapshot.fileKnown[path] {
+		return nil, false, false
+	}
+	data, exists := prov.revisionSnapshot.fileContents[path]
+	return data, true, exists
+}
+
+func revisionConventionDirs(prov *Provenance, fs fsys.FS, cityRoot string) []string {
+	if prov == nil || prov.revisionSnapshot == nil {
+		return existingConventionDiscoveryDirsFS(fs, cityRoot)
+	}
+	return append([]string(nil), prov.revisionSnapshot.conventionDirs...)
+}
+
+func cloneBytes(data []byte) []byte {
+	cp := make([]byte, len(data))
+	copy(cp, data)
+	return cp
+}
+
 // WatchTarget describes a filesystem path that should be watched for config
 // changes and how much of its subtree participates in discovery.
 type WatchTarget struct {
diff --git a/internal/config/revision_test.go b/internal/config/revision_test.go
index 51d38bb9b1..606a13c251 100644
--- a/internal/config/revision_test.go
+++ b/internal/config/revision_test.go
@@ -50,6 +50,281 @@ name = "changed"
 	}
 }
 
+func TestRevision_UsesLoadedSourceSnapshot(t *testing.T) {
+	dir := t.TempDir()
+	cityPath := filepath.Join(dir, "city.toml")
+	writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+`)
+
+	cfg, prov, err := LoadWithIncludes(fsys.OSFS{}, cityPath)
+	if err != nil {
+		t.Fatalf("LoadWithIncludes: %v", err)
+	}
+	loadedRevision := Revision(fsys.OSFS{}, prov, cfg, dir)
+
+	writeFile(t, dir, "city.toml", `[workspace]
+name = "changed"
+`)
+	afterWriteRevision := Revision(fsys.OSFS{}, prov, cfg, dir)
+	if afterWriteRevision != loadedRevision {
+		t.Fatalf("revision changed after source file write; got %q, want loaded snapshot %q", afterWriteRevision, loadedRevision)
+	}
+
+	reloadedCfg, reloadedProv, err := LoadWithIncludes(fsys.OSFS{}, cityPath)
+	if err != nil {
+		t.Fatalf("reloading config: %v", err)
+	}
+	reloadedRevision := Revision(fsys.OSFS{}, reloadedProv, reloadedCfg, dir)
+	if reloadedRevision == loadedRevision {
+		t.Fatal("revision did not change after reloading changed source file")
+	}
+}
+
+func TestRevision_UsesLoadedSnapshotForResolvedInputs(t *testing.T) {
+	tests := []struct {
+		name   string
+		setup  func(t *testing.T, dir string)
+		mutate func(t *testing.T, dir string)
+	}{
+		{
+			name: "fragment",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `
+include = ["agents.toml"]
+
+[workspace]
+name = "test"
+`)
+				writeFile(t, dir, "agents.toml", `[[agent]]
+name = "builder"
+`)
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "agents.toml", `[[agent]]
+name = "builder-renamed"
+`)
+			},
+		},
+		{
+			name: "city pack.toml",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+`)
+				writeFile(t, dir, "pack.toml", `[pack]
+name = "citypack"
+schema = 1
+
+[[agent]]
+name = "builder"
+`)
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "pack.toml", `[pack]
+name = "citypack"
+schema = 1
+
+[[agent]]
+name = "builder-renamed"
+`)
+			},
+		},
+		{
+			name: "implicit imports file",
+			setup: func(t *testing.T, dir string) {
+				gcHome := filepath.Join(dir, "gc-home")
+				t.Setenv("GC_HOME", gcHome)
+				writeFile(t, gcHome, "implicit-import.toml", `schema = 1
+
+[imports.core]
+source = "github.com/gastownhall/gc-core"
+version = "0.1.0"
+`)
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+`)
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, filepath.Join(dir, "gc-home"), "implicit-import.toml", `schema = 1
+
+[imports.core]
+source = "github.com/gastownhall/gc-core"
+version = "0.1.1"
+`)
+			},
+		},
+		{
+			name: "legacy city include pack tree",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+includes = ["packs/shared"]
+`)
+				writeFile(t, dir, "packs/shared/pack.toml", `[pack]
+name = "shared"
+schema = 1
+
+[[agent]]
+name = "builder"
+prompt_template = "prompts/builder.template.md"
+`)
+				writeFile(t, dir, "packs/shared/prompts/builder.template.md", "first prompt\n")
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "packs/shared/prompts/builder.template.md", "second prompt\n")
+			},
+		},
+		{
+			name: "legacy rig include pack tree",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+
+[[rigs]]
+name = "frontend"
+path = "../frontend"
+includes = ["packs/rig"]
+`)
+				writeFile(t, dir, "packs/rig/pack.toml", `[pack]
+name = "rigpack"
+schema = 1
+
+[[agent]]
+name = "runner"
+scope = "rig"
+prompt_template = "prompts/runner.template.md"
+`)
+				writeFile(t, dir, "packs/rig/prompts/runner.template.md", "first prompt\n")
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "packs/rig/prompts/runner.template.md", "second prompt\n")
+			},
+		},
+		{
+			name: "packs.lock",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+
+[imports.shared]
+source = "./packs/shared"
+`)
+				writeFile(t, dir, "packs/shared/pack.toml", `[pack]
+name = "shared"
+schema = 1
+`)
+				writeFile(t, dir, "packs.lock", `schema = 1
+
+[packs."./packs/shared"]
+version = "1.0.0"
+commit = "aaaa"
+`)
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "packs.lock", `schema = 1
+
+[packs."./packs/shared"]
+version = "1.0.1"
+commit = "bbbb"
+`)
+			},
+		},
+		{
+			name: "PackV2 city import tree",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+
+[imports.shared]
+source = "./packs/shared"
+`)
+				writeFile(t, dir, "packs/shared/pack.toml", `[pack]
+name = "shared"
+schema = 1
+
+[[agent]]
+name = "builder"
+prompt_template = "prompts/builder.template.md"
+`)
+				writeFile(t, dir, "packs/shared/prompts/builder.template.md", "first prompt\n")
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "packs/shared/prompts/builder.template.md", "second prompt\n")
+			},
+		},
+		{
+			name: "PackV2 rig import tree",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+
+[[rigs]]
+name = "frontend"
+path = "../frontend"
+
+[rigs.imports.shared]
+source = "./packs/shared"
+`)
+				writeFile(t, dir, "packs/shared/pack.toml", `[pack]
+name = "shared"
+schema = 1
+
+[[agent]]
+name = "runner"
+scope = "rig"
+prompt_template = "prompts/runner.template.md"
+`)
+				writeFile(t, dir, "packs/shared/prompts/runner.template.md", "first prompt\n")
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "packs/shared/prompts/runner.template.md", "second prompt\n")
+			},
+		},
+		{
+			name: "convention discovery tree",
+			setup: func(t *testing.T, dir string) {
+				writeFile(t, dir, "city.toml", `[workspace]
+name = "test"
+`)
+				writeFile(t, dir, "agents/builder/prompt.template.md", "first prompt\n")
+			},
+			mutate: func(t *testing.T, dir string) {
+				writeFile(t, dir, "agents/builder/prompt.template.md", "second prompt\n")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			cityPath := filepath.Join(dir, "city.toml")
+			tt.setup(t, dir)
+
+			cfg, prov, err := LoadWithIncludes(fsys.OSFS{}, cityPath)
+			if err != nil {
+				t.Fatalf("LoadWithIncludes: %v", err)
+			}
+			loadedRevision := Revision(fsys.OSFS{}, prov, cfg, dir)
+
+			tt.mutate(t, dir)
+			afterWriteRevision := Revision(fsys.OSFS{}, prov, cfg, dir)
+			if afterWriteRevision != loadedRevision {
+				t.Fatalf("revision changed after post-load mutation; got %q, want loaded snapshot %q", afterWriteRevision, loadedRevision)
+			}
+
+			reloadedCfg, reloadedProv, err := LoadWithIncludes(fsys.OSFS{}, cityPath)
+			if err != nil {
+				t.Fatalf("reloading config: %v", err)
+			}
+			reloadedRevision := Revision(fsys.OSFS{}, reloadedProv, reloadedCfg, dir)
+			if reloadedRevision == loadedRevision {
+				t.Fatal("revision did not change after reloading changed input")
+			}
+		})
+	}
+}
+
 func TestRevision_IncludesFragments(t *testing.T) {
 	dir := t.TempDir()
 	writeFile(t, dir, "city.toml", `[workspace]
diff --git a/internal/config/session_model_phase0_spec_test.go b/internal/config/session_model_phase0_spec_test.go
index 06f99a82c3..ec85b3fa03 100644
--- a/internal/config/session_model_phase0_spec_test.go
+++ b/internal/config/session_model_phase0_spec_test.go
@@ -92,12 +92,16 @@ func TestPhase0ConfigDefaults_OnBootUnclaimsRoutedWorkByDefault(t *testing.T) {
 	for _, want := range []string{
 		"bd list --metadata-field gc.routed_to=myrig/worker",
 		"--status=in_progress",
-		"--assignee \"\"",
+		"--no-assignee",
+		"--status open",
 	} {
 		if !strings.Contains(got, want) {
 			t.Fatalf("EffectiveOnBoot() = %q, want %q", got, want)
 		}
 	}
+	if strings.Contains(got, `--assignee ""`) {
+		t.Fatalf("EffectiveOnBoot() = %q, want to target only ownerless work instead of bulk-unassigning routed work", got)
+	}
 }
 
 func TestPhase0ConfigDefaults_OnDeathUnclaimsAssignedWorkByDefault(t *testing.T) {
diff --git a/internal/config/validate_durations.go b/internal/config/validate_durations.go
index 2c06184eb0..e994df97d6 100644
--- a/internal/config/validate_durations.go
+++ b/internal/config/validate_durations.go
@@ -42,6 +42,8 @@ func ValidateDurations(cfg *City, source string) []string {
 	// Daemon config durations.
 	check("[daemon]", "patrol_interval", cfg.Daemon.PatrolInterval)
 	check("[daemon]", "restart_window", cfg.Daemon.RestartWindow)
+	check("[daemon]", "session_circuit_breaker_window", cfg.Daemon.SessionCircuitBreakerWindow)
+	check("[daemon]", "session_circuit_breaker_reset_after", cfg.Daemon.SessionCircuitBreakerResetAfter)
 	check("[daemon]", "shutdown_timeout", cfg.Daemon.ShutdownTimeout)
 	check("[daemon]", "wisp_gc_interval", cfg.Daemon.WispGCInterval)
 	check("[daemon]", "wisp_ttl", cfg.Daemon.WispTTL)
diff --git a/internal/config/validate_durations_test.go b/internal/config/validate_durations_test.go
index b0df573706..0d67b9121a 100644
--- a/internal/config/validate_durations_test.go
+++ b/internal/config/validate_durations_test.go
@@ -79,14 +79,16 @@ func TestValidateDurationsBadSessionTimeout(t *testing.T) {
 func TestValidateDurationsBadDaemonFields(t *testing.T) {
 	cfg := &City{
 		Daemon: DaemonConfig{
-			PatrolInterval:  "30sec",
-			RestartWindow:   "one hour",
-			ShutdownTimeout: "5 seconds",
+			PatrolInterval:                  "30sec",
+			RestartWindow:                   "one hour",
+			ShutdownTimeout:                 "5 seconds",
+			SessionCircuitBreakerWindow:     "ten minutes",
+			SessionCircuitBreakerResetAfter: "twenty minutes",
 		},
 	}
 	warnings := ValidateDurations(cfg, "city.toml")
-	if len(warnings) != 3 {
-		t.Fatalf("expected 3 warnings, got %d: %v", len(warnings), warnings)
+	if len(warnings) != 5 {
+		t.Fatalf("expected 5 warnings, got %d: %v", len(warnings), warnings)
 	}
 }
 
diff --git a/internal/config/validate_semantics.go b/internal/config/validate_semantics.go
index 03d0327eb4..69d17720de 100644
--- a/internal/config/validate_semantics.go
+++ b/internal/config/validate_semantics.go
@@ -45,9 +45,9 @@ func ValidateSemantics(cfg *City, source string) []string {
 
 	// Check agent session field.
 	for _, a := range cfg.Agents {
-		if a.Session != "" && a.Session != "acp" {
+		if !IsValidSessionTransport(a.Session) {
 			warnings = append(warnings, fmt.Sprintf(
-				"%s: agent %q: session %q is not a valid session transport (use \"acp\" or omit)",
+				"%s: agent %q: session %q is not a valid session transport (use \"acp\", \"tmux\", or omit)",
 				source, a.QualifiedName(), a.Session))
 		}
 	}
diff --git a/internal/config/validate_semantics_test.go b/internal/config/validate_semantics_test.go
index a113f8c1a9..3f7a23189c 100644
--- a/internal/config/validate_semantics_test.go
+++ b/internal/config/validate_semantics_test.go
@@ -77,6 +77,33 @@ func TestValidateSemanticsStartCommandSkipsProviderCheck(t *testing.T) {
 	}
 }
 
+func TestValidateSemanticsAgentSessionTransportAllowsTmux(t *testing.T) {
+	cfg := &City{
+		Agents: []Agent{
+			{Name: "worker", Provider: "claude", Session: "tmux"},
+		},
+	}
+	warnings := ValidateSemantics(cfg, "city.toml")
+	if len(warnings) != 0 {
+		t.Fatalf("expected no warnings for tmux session transport, got: %v", warnings)
+	}
+}
+
+func TestValidateSemanticsAgentSessionTransportRejectsUnknown(t *testing.T) {
+	cfg := &City{
+		Agents: []Agent{
+			{Name: "worker", Provider: "claude", Session: "stdio"},
+		},
+	}
+	warnings := ValidateSemantics(cfg, "city.toml")
+	if len(warnings) != 1 {
+		t.Fatalf("expected 1 warning, got %d: %v", len(warnings), warnings)
+	}
+	if !strings.Contains(warnings[0], "stdio") || !strings.Contains(warnings[0], "tmux") {
+		t.Fatalf("warning should mention bad value and allowed transports: %s", warnings[0])
+	}
+}
+
 func TestValidateSemanticsProviderPromptModeBad(t *testing.T) {
 	cfg := &City{
 		Providers: map[string]ProviderSpec{
diff --git a/internal/convergence/condition.go b/internal/convergence/condition.go
index 6e2a8bdccd..35f058096f 100644
--- a/internal/convergence/condition.go
+++ b/internal/convergence/condition.go
@@ -52,6 +52,7 @@ type ConditionEnv struct {
 	BeadID               string
 	Iteration            int
 	CityPath             string
+	StorePath            string
 	WorkDir              string
 	WispID               string
 	DocPath              string // from var.doc_path, may be empty
@@ -66,7 +67,8 @@ type ConditionEnv struct {
 
 // Environ returns the environment variable slice for exec.Cmd.
 // Only whitelisted variables: PATH (safe default), HOME, TMPDIR, convergence
-// vars, and GC_INTEGRATION_REAL_BD when present for integration-test bd shims.
+// vars, Dolt/Beads connection env, and GC_INTEGRATION_REAL_BD when present for
+// integration-test bd shims.
 func (ce ConditionEnv) Environ() []string {
 	// Use CityPath as HOME to sandbox gate scripts from the
 	// controller's home directory (which may contain .ssh, .gnupg, etc).
@@ -74,11 +76,15 @@ func (ce ConditionEnv) Environ() []string {
 	if home == "" {
 		home = os.TempDir()
 	}
+	storePath := ce.StorePath
+	if storePath == "" {
+		storePath = ce.CityPath
+	}
 	env := []string{
 		"PATH=" + conditionPATH(),
 		"HOME=" + home,
 		"TMPDIR=" + os.TempDir(),
-		"BEADS_DIR=" + filepath.Join(ce.CityPath, ".beads"),
+		"BEADS_DIR=" + filepath.Join(storePath, ".beads"),
 		"GC_BEAD_ID=" + ce.BeadID,
 		"GC_ITERATION=" + strconv.Itoa(ce.Iteration),
 		"GC_WISP_ID=" + ce.WispID,
@@ -87,7 +93,7 @@ func (ce ConditionEnv) Environ() []string {
 		"GC_CUMULATIVE_DURATION_MS=" + strconv.FormatInt(ce.CumulativeDurationMs, 10),
 		"GC_MAX_ITERATIONS=" + strconv.Itoa(ce.MaxIterations),
 	}
-	env = append(env, citylayout.CityRuntimeEnv(ce.CityPath)...)
+	env = append(env, citylayout.CityRuntimeEnvForRuntimeDir(ce.CityPath, citylayout.TrustedAmbientCityRuntimeDir(ce.CityPath))...)
 
 	// Optional fields: only include if non-empty.
 	if ce.DocPath != "" {
@@ -105,9 +111,28 @@ func (ce ConditionEnv) Environ() []string {
 	if ce.WorkDir != "" {
 		env = append(env, "GC_WORK_DIR="+ce.WorkDir)
 	}
+	if ce.StorePath != "" {
+		env = append(env, "GC_STORE_PATH="+ce.StorePath)
+	}
 	if realBD := os.Getenv("GC_INTEGRATION_REAL_BD"); realBD != "" {
 		env = append(env, "GC_INTEGRATION_REAL_BD="+realBD)
 	}
+	for _, key := range []string{
+		"BEADS_DOLT_AUTO_START",
+		"BEADS_DOLT_SERVER_HOST",
+		"BEADS_DOLT_SERVER_PORT",
+		"BEADS_DOLT_SERVER_USER",
+		"BEADS_DOLT_PASSWORD",
+		"GC_DOLT",
+		"GC_DOLT_HOST",
+		"GC_DOLT_PORT",
+		"GC_DOLT_USER",
+		"GC_DOLT_PASSWORD",
+	} {
+		if value := os.Getenv(key); value != "" {
+			env = append(env, key+"="+value)
+		}
+	}
 
 	return env
 }
@@ -197,6 +222,9 @@ func runOnce(ctx context.Context, scriptPath string, env ConditionEnv, timeout t
 
 	cmd := exec.CommandContext(execCtx, scriptPath)
 	cmd.Dir = env.CityPath
+	if env.StorePath != "" {
+		cmd.Dir = env.StorePath
+	}
 	if env.WorkDir != "" {
 		cmd.Dir = env.WorkDir
 	}
diff --git a/internal/convergence/condition_test.go b/internal/convergence/condition_test.go
index afcc4b69cc..f415b00503 100644
--- a/internal/convergence/condition_test.go
+++ b/internal/convergence/condition_test.go
@@ -136,6 +136,65 @@ func TestConditionEnvEnvironPreservesIntegrationRealBD(t *testing.T) {
 	}
 }
 
+func TestConditionEnvEnvironUsesStorePathForBeadsDir(t *testing.T) {
+	env := ConditionEnv{
+		BeadID:    "bead-store",
+		Iteration: 1,
+		CityPath:  "/city",
+		StorePath: "/rig",
+	}
+
+	vars := env.Environ()
+	lookup := make(map[string]string)
+	for _, v := range vars {
+		parts := strings.SplitN(v, "=", 2)
+		if len(parts) == 2 {
+			lookup[parts[0]] = parts[1]
+		}
+	}
+
+	if got := lookup["BEADS_DIR"]; got != filepath.Join("/rig", ".beads") {
+		t.Fatalf("BEADS_DIR = %q, want rig beads dir", got)
+	}
+	if got := lookup["GC_STORE_PATH"]; got != "/rig" {
+		t.Fatalf("GC_STORE_PATH = %q, want /rig", got)
+	}
+	if got := lookup["GC_CITY"]; got != "/city" {
+		t.Fatalf("GC_CITY = %q, want /city", got)
+	}
+}
+
+func TestConditionEnvEnvironPreservesDoltConnection(t *testing.T) {
+	t.Setenv("BEADS_DOLT_SERVER_PORT", "33061")
+	t.Setenv("GC_DOLT_HOST", "127.0.0.1")
+	t.Setenv("GC_DOLT_PASSWORD", "secret")
+
+	env := ConditionEnv{
+		BeadID:    "bead-dolt",
+		Iteration: 1,
+		CityPath:  "/city",
+	}
+
+	vars := env.Environ()
+	lookup := make(map[string]string)
+	for _, v := range vars {
+		parts := strings.SplitN(v, "=", 2)
+		if len(parts) == 2 {
+			lookup[parts[0]] = parts[1]
+		}
+	}
+
+	for key, want := range map[string]string{
+		"BEADS_DOLT_SERVER_PORT": "33061",
+		"GC_DOLT_HOST":           "127.0.0.1",
+		"GC_DOLT_PASSWORD":       "secret",
+	} {
+		if got := lookup[key]; got != want {
+			t.Fatalf("%s = %q, want %q", key, got, want)
+		}
+	}
+}
+
 func TestResolveConditionPath(t *testing.T) {
 	t.Run("absolute path", func(t *testing.T) {
 		dir := t.TempDir()
@@ -315,6 +374,40 @@ func TestRunConditionUsesWorkDir(t *testing.T) {
 	}
 }
 
+func TestRunConditionUsesStorePathAsDefaultWorkDir(t *testing.T) {
+	cityDir := t.TempDir()
+	storeDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(storeDir, "target.txt"), []byte("ok\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	script := filepath.Join(cityDir, "check-store.sh")
+	if err := os.WriteFile(script, []byte("#!/bin/sh\npwd\nprintf '%s\\n' \"$BEADS_DIR\"\ncat target.txt\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	env := ConditionEnv{
+		BeadID:    "b-store",
+		CityPath:  cityDir,
+		StorePath: storeDir,
+	}
+
+	result := RunCondition(context.Background(), script, env, 5*time.Second, 0)
+	if result.Outcome != GatePass {
+		t.Fatalf("Outcome = %q, want %q (stderr=%q)", result.Outcome, GatePass, result.Stderr)
+	}
+	if !strings.Contains(result.Stdout, storeDir) {
+		t.Errorf("Stdout = %q, want to contain store dir %q", result.Stdout, storeDir)
+	}
+	wantBeadsDir := filepath.Join(storeDir, ".beads")
+	if !strings.Contains(result.Stdout, wantBeadsDir) {
+		t.Errorf("Stdout = %q, want to contain BEADS_DIR %q", result.Stdout, wantBeadsDir)
+	}
+	if !strings.Contains(result.Stdout, "ok") {
+		t.Errorf("Stdout = %q, want to contain file contents", result.Stdout)
+	}
+}
+
 func TestConditionPATHUsesResolvedToolDirs(t *testing.T) {
 	origPath := os.Getenv("PATH")
 	t.Cleanup(func() {
diff --git a/internal/dispatch/control.go b/internal/dispatch/control.go
index abeb48213e..43cbe8fade 100644
--- a/internal/dispatch/control.go
+++ b/internal/dispatch/control.go
@@ -38,29 +38,30 @@ func processRetryControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 		return ControlResult{}, fmt.Errorf("%s: no attempt found", bead.ID)
 	}
 	if attempt.Status != "closed" {
-		// Invariant violation: control bead should not be ready if attempt is open.
-		return ControlResult{}, fmt.Errorf("%s: latest attempt %s is %s, not closed (invariant violation)", bead.ID, attempt.ID, attempt.Status)
+		if err := ensureBlockingDependency(store, bead.ID, attempt.ID); err != nil {
+			return ControlResult{}, fmt.Errorf("%s: blocking on pending attempt %s: %w", bead.ID, attempt.ID, err)
+		}
+		return ControlResult{}, ErrControlPending
 	}
 
 	attemptNum, _ := strconv.Atoi(attempt.Metadata["gc.attempt"])
 	result := classifyRetryAttempt(attempt)
-
-	// Record decision in attempt log.
-	if err := appendAttemptLog(store, bead.ID, attemptNum, result.Outcome, result.Reason); err != nil {
+	attemptLog, err := appendAttemptLogValue(bead.Metadata["gc.attempt_log"], attemptNum, result.Outcome, result.Reason)
+	if err != nil {
 		return ControlResult{}, fmt.Errorf("%s: recording attempt log: %w", bead.ID, err)
 	}
 
 	switch result.Outcome {
 	case "pass":
-		if outputJSON := attempt.Metadata["gc.output_json"]; outputJSON != "" {
-			if err := store.SetMetadata(bead.ID, "gc.output_json", outputJSON); err != nil {
-				return ControlResult{}, fmt.Errorf("%s: propagating output: %w", bead.ID, err)
-			}
+		closeMetadata := map[string]string{
+			"gc.attempt_log": attemptLog,
+			"gc.outcome":     "pass",
 		}
-		if err := propagateRetrySubjectMetadata(store, bead.ID, attempt); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: propagating metadata: %w", bead.ID, err)
+		if outputJSON := attempt.Metadata["gc.output_json"]; outputJSON != "" {
+			closeMetadata["gc.output_json"] = outputJSON
 		}
-		if err := setOutcomeAndClose(store, bead.ID, "pass"); err != nil {
+		copyNonGCMetadata(closeMetadata, attempt.Metadata)
+		if err := updateMetadataAndClose(store, bead.ID, closeMetadata); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing passed: %w", bead.ID, err)
 		}
 		scopeResult, err := reconcileClosedScopeMember(store, bead.ID)
@@ -70,15 +71,14 @@ func processRetryControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 		return ControlResult{Processed: true, Action: "pass", Skipped: scopeResult.Skipped}, nil
 
 	case "hard":
-		if err := store.SetMetadataBatch(bead.ID, map[string]string{
+		if err := updateMetadataAndClose(store, bead.ID, map[string]string{
+			"gc.attempt_log":       attemptLog,
+			"gc.outcome":           "fail",
 			"gc.failed_attempt":    strconv.Itoa(attemptNum),
 			"gc.failure_class":     "hard",
 			"gc.failure_reason":    result.Reason,
 			"gc.final_disposition": "hard_fail",
 		}); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: marking hard fail: %w", bead.ID, err)
-		}
-		if err := setOutcomeAndClose(store, bead.ID, "fail"); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing hard-failed: %w", bead.ID, err)
 		}
 		scopeResult, err := reconcileClosedScopeMember(store, bead.ID)
@@ -89,7 +89,7 @@ func processRetryControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 
 	case "transient":
 		if attemptNum >= maxAttempts {
-			exhaustedResult, err := handleRetryExhaustion(store, bead.ID, attemptNum, result.Reason, onExhausted)
+			exhaustedResult, err := handleRetryExhaustion(store, bead.ID, attemptNum, result.Reason, onExhausted, attemptLog)
 			if err != nil {
 				return ControlResult{}, err
 			}
@@ -102,6 +102,9 @@ func processRetryControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 		}
 
 		// Spawn next attempt.
+		if err := store.SetMetadata(bead.ID, "gc.attempt_log", attemptLog); err != nil {
+			return ControlResult{}, fmt.Errorf("%s: recording attempt log: %w", bead.ID, err)
+		}
 		nextAttempt := attemptNum + 1
 		if err := spawnNextAttempt(context.Background(), store, bead, nextAttempt, opts); err != nil {
 			// Controller-internal failure → close with hard error.
@@ -139,7 +142,10 @@ func processRalphControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 		return ControlResult{}, fmt.Errorf("%s: no iteration found", bead.ID)
 	}
 	if iteration.Status != "closed" {
-		return ControlResult{}, fmt.Errorf("%s: latest iteration %s is %s, not closed (invariant violation)", bead.ID, iteration.ID, iteration.Status)
+		if err := ensureBlockingDependency(store, bead.ID, iteration.ID); err != nil {
+			return ControlResult{}, fmt.Errorf("%s: blocking on pending iteration %s: %w", bead.ID, iteration.ID, err)
+		}
+		return ControlResult{}, ErrControlPending
 	}
 
 	iterationNum, _ := strconv.Atoi(iteration.Metadata["gc.attempt"])
@@ -164,17 +170,20 @@ func processRalphControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 		return ControlResult{}, fmt.Errorf("%s: running check: %w", bead.ID, err)
 	}
 
-	if err := appendAttemptLog(store, bead.ID, iterationNum, checkResult.Outcome, checkResult.Stderr); err != nil {
+	attemptLog, err := appendAttemptLogValue(bead.Metadata["gc.attempt_log"], iterationNum, checkResult.Outcome, checkResult.Stderr)
+	if err != nil {
 		return ControlResult{}, fmt.Errorf("%s: recording attempt log: %w", bead.ID, err)
 	}
 
 	if checkResult.Outcome == convergence.GatePass {
+		closeMetadata := map[string]string{
+			"gc.attempt_log": attemptLog,
+			"gc.outcome":     "pass",
+		}
 		if outputJSON := iteration.Metadata["gc.output_json"]; outputJSON != "" {
-			if err := store.SetMetadata(bead.ID, "gc.output_json", outputJSON); err != nil {
-				return ControlResult{}, fmt.Errorf("%s: propagating output: %w", bead.ID, err)
-			}
+			closeMetadata["gc.output_json"] = outputJSON
 		}
-		if err := setOutcomeAndClose(store, bead.ID, "pass"); err != nil {
+		if err := updateMetadataAndClose(store, bead.ID, closeMetadata); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing passed: %w", bead.ID, err)
 		}
 		scopeResult, err := reconcileClosedScopeMember(store, bead.ID)
@@ -185,13 +194,11 @@ func processRalphControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 	}
 
 	if iterationNum >= maxAttempts {
-		if err := store.SetMetadataBatch(bead.ID, map[string]string{
+		if err := updateMetadataAndClose(store, bead.ID, map[string]string{
+			"gc.attempt_log":    attemptLog,
 			"gc.outcome":        "fail",
 			"gc.failed_attempt": strconv.Itoa(iterationNum),
 		}); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: marking exhausted: %w", bead.ID, err)
-		}
-		if err := setOutcomeAndClose(store, bead.ID, "fail"); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing exhausted: %w", bead.ID, err)
 		}
 		scopeResult, err := reconcileClosedScopeMember(store, bead.ID)
@@ -202,6 +209,9 @@ func processRalphControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 	}
 
 	// Spawn next iteration.
+	if err := store.SetMetadata(bead.ID, "gc.attempt_log", attemptLog); err != nil {
+		return ControlResult{}, fmt.Errorf("%s: recording attempt log: %w", bead.ID, err)
+	}
 	nextIteration := iterationNum + 1
 	if err := spawnNextAttempt(context.Background(), store, bead, nextIteration, opts); err != nil {
 		_ = store.SetMetadataBatch(bead.ID, map[string]string{
@@ -218,31 +228,42 @@ func processRalphControl(store beads.Store, bead beads.Bead, opts ProcessOptions
 	return ControlResult{Processed: true, Action: "retry", Created: 1}, nil
 }
 
-func handleRetryExhaustion(store beads.Store, beadID string, attemptNum int, reason, onExhausted string) (ControlResult, error) {
+func ensureBlockingDependency(store beads.Store, issueID, dependsOnID string) error {
+	deps, err := store.DepList(issueID, "down")
+	if err != nil {
+		return err
+	}
+	for _, dep := range deps {
+		if dep.DependsOnID == dependsOnID && dep.Type == "blocks" {
+			return nil
+		}
+	}
+	return store.DepAdd(issueID, dependsOnID, "blocks")
+}
+
+func handleRetryExhaustion(store beads.Store, beadID string, attemptNum int, reason, onExhausted, attemptLog string) (ControlResult, error) {
 	if onExhausted == "soft_fail" {
-		if err := store.SetMetadataBatch(beadID, map[string]string{
+		if err := updateMetadataAndClose(store, beadID, map[string]string{
+			"gc.attempt_log":       attemptLog,
+			"gc.outcome":           "pass",
 			"gc.failed_attempt":    strconv.Itoa(attemptNum),
 			"gc.failure_class":     "transient",
 			"gc.failure_reason":    reason,
 			"gc.final_disposition": "soft_fail",
 		}); err != nil {
-			return ControlResult{}, fmt.Errorf("%s: marking soft-fail: %w", beadID, err)
-		}
-		if err := setOutcomeAndClose(store, beadID, "pass"); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: closing soft-failed: %w", beadID, err)
 		}
 		return ControlResult{Processed: true, Action: "soft-fail"}, nil
 	}
 
-	if err := store.SetMetadataBatch(beadID, map[string]string{
+	if err := updateMetadataAndClose(store, beadID, map[string]string{
+		"gc.attempt_log":       attemptLog,
+		"gc.outcome":           "fail",
 		"gc.failed_attempt":    strconv.Itoa(attemptNum),
 		"gc.failure_class":     "transient",
 		"gc.failure_reason":    reason,
 		"gc.final_disposition": "hard_fail",
 	}); err != nil {
-		return ControlResult{}, fmt.Errorf("%s: marking exhausted: %w", beadID, err)
-	}
-	if err := setOutcomeAndClose(store, beadID, "fail"); err != nil {
 		return ControlResult{}, fmt.Errorf("%s: closing exhausted: %w", beadID, err)
 	}
 	return ControlResult{Processed: true, Action: "fail"}, nil
@@ -271,7 +292,7 @@ func spawnNextAttempt(ctx context.Context, store beads.Store, control beads.Bead
 	// Attach bypasses graph compile routing, so spawned attempts need their
 	// execution lane restored manually. Prefer each step's explicit target when
 	// available, and only inherit the parent execution lane as a fallback.
-	executionRoute := control.Metadata["gc.execution_routed_to"]
+	executionRoute := strings.TrimSpace(control.Metadata["gc.execution_routed_to"])
 	routeCfg := loadAttemptRouteConfig(opts.CityPath)
 	for i := range recipe.Steps {
 		if recipe.Steps[i].Metadata["gc.kind"] == "spec" {
@@ -286,6 +307,8 @@ func spawnNextAttempt(ctx context.Context, store beads.Store, control beads.Bead
 		}
 		if target == "" {
 			target = executionRoute
+		} else {
+			target = qualifyAttemptTargetWithSourceRoute(target, executionRoute, routeCfg)
 		}
 		if isAttemptControlKind(recipe.Steps[i].Metadata["gc.kind"]) {
 			applyAttemptControlStepRoute(&recipe.Steps[i], target, routeCfg, store)
@@ -315,6 +338,23 @@ func spawnNextAttempt(ctx context.Context, store beads.Store, control beads.Bead
 	return nil
 }
 
+func qualifyAttemptTargetWithSourceRoute(target, sourceRoute string, cfg *config.City) string {
+	target = strings.TrimSpace(target)
+	if target == "" || strings.Contains(target, "/") || cfg == nil {
+		return target
+	}
+	sourceRoute = strings.TrimSpace(sourceRoute)
+	slash := strings.IndexByte(sourceRoute, '/')
+	if slash <= 0 {
+		return target
+	}
+	candidate := sourceRoute[:slash] + "/" + target
+	if config.FindAgent(cfg, candidate) != nil || config.FindNamedSession(cfg, candidate) != nil {
+		return candidate
+	}
+	return target
+}
+
 // buildAttemptRecipe constructs a minimal formula.Recipe for one attempt
 // from the frozen step spec.
 func buildAttemptRecipe(step *formula.Step, control beads.Bead, attemptNum int) *formula.Recipe {
@@ -574,8 +614,13 @@ func applyAttemptStepRoute(step *formula.RecipeStep, target string, cfg *config.
 			step.Assignee = binding.directSessionID
 			return
 		}
-		step.Metadata["gc.routed_to"] = binding.qualifiedName
-		step.Metadata["gc.execution_routed_to"] = binding.qualifiedName
+		if binding.qualifiedName != "" {
+			step.Metadata["gc.routed_to"] = binding.qualifiedName
+			step.Metadata["gc.execution_routed_to"] = binding.qualifiedName
+		} else {
+			delete(step.Metadata, "gc.routed_to")
+			delete(step.Metadata, "gc.execution_routed_to")
+		}
 		step.Labels = removeAttemptPoolLabels(step.Labels)
 		if binding.metadataOnly {
 			step.Assignee = ""
@@ -597,9 +642,11 @@ func applyAttemptControlStepRoute(step *formula.RecipeStep, executionTarget stri
 	if step.Metadata == nil {
 		step.Metadata = make(map[string]string)
 	}
+	resolvedExecutionTarget := strings.TrimSpace(executionTarget)
 	if binding, ok := resolveAttemptRouteBinding(executionTarget, cfg, store); ok {
 		switch {
 		case binding.qualifiedName != "":
+			resolvedExecutionTarget = binding.qualifiedName
 			step.Metadata["gc.execution_routed_to"] = binding.qualifiedName
 		case executionTarget != "":
 			// Direct session delivery still executes via the named/session target,
@@ -615,18 +662,10 @@ func applyAttemptControlStepRoute(step *formula.RecipeStep, executionTarget stri
 	}
 	step.Labels = removeAttemptPoolLabels(step.Labels)
 
-	controlTarget := config.ControlDispatcherAgentName
-	if binding, ok := resolveAttemptRouteBinding(controlTarget, cfg, store); ok {
-		step.Metadata["gc.routed_to"] = controlTarget
-		if binding.directSessionID != "" {
-			step.Assignee = binding.directSessionID
-			return
-		}
-		if binding.metadataOnly {
-			step.Assignee = ""
-			return
-		}
-		step.Assignee = binding.sessionName
+	controlTarget := controlDispatcherTargetForExecutionTarget(resolvedExecutionTarget)
+	if assignee, ok := resolveAttemptControlAssignee(controlTarget, cfg, store); ok {
+		delete(step.Metadata, "gc.routed_to")
+		step.Assignee = assignee
 		return
 	}
 
@@ -634,6 +673,42 @@ func applyAttemptControlStepRoute(step *formula.RecipeStep, executionTarget stri
 	step.Assignee = ""
 }
 
+func controlDispatcherTargetForExecutionTarget(executionTarget string) string {
+	executionTarget = strings.TrimSpace(executionTarget)
+	if slash := strings.IndexByte(executionTarget, '/'); slash > 0 {
+		return executionTarget[:slash] + "/" + config.ControlDispatcherAgentName
+	}
+	return config.ControlDispatcherAgentName
+}
+
+func resolveAttemptControlAssignee(target string, cfg *config.City, store beads.Store) (string, bool) {
+	target = strings.TrimSpace(target)
+	if target == "" {
+		return "", false
+	}
+	if binding, ok := resolveAttemptRouteBinding(target, cfg, store); ok {
+		if binding.directSessionID != "" {
+			return binding.directSessionID, true
+		}
+		if binding.sessionName != "" {
+			return binding.sessionName, true
+		}
+	}
+	if cfg != nil {
+		if named := config.FindNamedSession(cfg, target); named != nil {
+			if spec, ok := session.FindNamedSessionSpec(cfg, cfg.EffectiveCityName(), named.QualifiedName()); ok && spec.SessionName != "" {
+				return spec.SessionName, true
+			}
+		}
+		if agentCfg := config.FindAgent(cfg, target); agentCfg != nil {
+			if sessionName := config.NamedSessionRuntimeName(cfg.EffectiveCityName(), cfg.Workspace, agentCfg.QualifiedName()); sessionName != "" {
+				return sessionName, true
+			}
+		}
+	}
+	return "", false
+}
+
 func isAttemptControlKind(kind string) bool {
 	switch kind {
 	case "check", "fanout", "retry-eval", "scope-check", "workflow-finalize", "retry", "ralph":
@@ -656,14 +731,17 @@ func resolveAttemptRouteBinding(target string, cfg *config.City, store beads.Sto
 	}
 	if cfg != nil {
 		if named := config.FindNamedSession(cfg, target); named != nil {
-			if store != nil {
-				if spec, ok := session.FindNamedSessionSpec(cfg, cfg.EffectiveCityName(), named.QualifiedName()); ok {
-					if candidates, err := store.List(beads.ListQuery{Label: session.LabelSession}); err == nil {
+			if spec, ok := session.FindNamedSessionSpec(cfg, cfg.EffectiveCityName(), named.QualifiedName()); ok {
+				if store != nil {
+					if candidates, err := session.NamedSessionResolutionCandidates(store, spec); err == nil {
 						if bead, found := session.FindCanonicalNamedSessionBead(candidates, spec); found {
 							return attemptRouteBinding{directSessionID: bead.ID}, true
 						}
 					}
 				}
+				if spec.SessionName != "" {
+					return attemptRouteBinding{sessionName: spec.SessionName}, true
+				}
 			}
 			return attemptRouteBinding{
 				qualifiedName: named.QualifiedName(),
@@ -937,10 +1015,17 @@ func appendAttemptLog(store beads.Store, controlID string, attempt int, outcome,
 	if err != nil {
 		return err
 	}
+	logJSON, err := appendAttemptLogValue(control.Metadata["gc.attempt_log"], attempt, outcome, reason)
+	if err != nil {
+		return err
+	}
+	return store.SetMetadata(controlID, "gc.attempt_log", logJSON)
+}
 
+func appendAttemptLogValue(existing string, attempt int, outcome, reason string) (string, error) {
 	var log []map[string]string
-	if raw := control.Metadata["gc.attempt_log"]; raw != "" {
-		_ = json.Unmarshal([]byte(raw), &log)
+	if existing != "" {
+		_ = json.Unmarshal([]byte(existing), &log)
 	}
 
 	entry := map[string]string{
@@ -967,10 +1052,27 @@ func appendAttemptLog(store beads.Store, controlID string, attempt int, outcome,
 	log = append(log, entry)
 	logJSON, err := json.Marshal(log)
 	if err != nil {
-		return err
+		return "", err
 	}
 
-	return store.SetMetadata(controlID, "gc.attempt_log", string(logJSON))
+	return string(logJSON), nil
+}
+
+func copyNonGCMetadata(dst, src map[string]string) {
+	for key, value := range src {
+		if key == "" || strings.HasPrefix(key, "gc.") {
+			continue
+		}
+		dst[key] = value
+	}
+}
+
+func updateMetadataAndClose(store beads.Store, beadID string, metadata map[string]string) error {
+	status := "closed"
+	return store.Update(beadID, beads.UpdateOpts{
+		Status:   &status,
+		Metadata: metadata,
+	})
 }
 
 // Note: listByWorkflowRoot, setOutcomeAndClose, propagateRetrySubjectMetadata,
diff --git a/internal/dispatch/control_integration_test.go b/internal/dispatch/control_integration_test.go
index 2de81db6d2..77c7065233 100644
--- a/internal/dispatch/control_integration_test.go
+++ b/internal/dispatch/control_integration_test.go
@@ -2,6 +2,7 @@ package dispatch
 
 import (
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -593,6 +594,11 @@ dir = "gascity"
 [agent.pool]
 min = 0
 max = -1
+
+[[agent]]
+name = "control-dispatcher"
+dir = "gascity"
+max_active_sessions = 1
 `), 0o644); err != nil {
 		t.Fatalf("write city.toml: %v", err)
 	}
@@ -671,8 +677,8 @@ max = -1
 	if claude.ID == "" {
 		t.Fatal("review-claude child not created")
 	}
-	if claude.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-		t.Fatalf("review-claude gc.routed_to = %q, want %q", claude.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+	if got := claude.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("review-claude gc.routed_to = %q, want empty direct dispatcher assignee", got)
 	}
 	if claude.Metadata["gc.execution_routed_to"] != "gascity/claude" {
 		t.Fatalf("review-claude gc.execution_routed_to = %q, want gascity/claude", claude.Metadata["gc.execution_routed_to"])
@@ -680,16 +686,16 @@ max = -1
 	if containsString(claude.Labels, "pool:gascity/claude") {
 		t.Fatalf("review-claude labels = %v, should not contain legacy pool label", claude.Labels)
 	}
-	if claude.Assignee != "" {
-		t.Fatalf("review-claude assignee = %q, want empty metadata-only control route", claude.Assignee)
+	if claude.Assignee != "gascity--control-dispatcher" {
+		t.Fatalf("review-claude assignee = %q, want gascity--control-dispatcher", claude.Assignee)
 	}
 
 	codex := findAttemptByRef(t, store, root.ID, "mol-adopt-pr-v2.review-loop.iteration.2.review-codex")
 	if codex.ID == "" {
 		t.Fatal("review-codex child not created")
 	}
-	if codex.Metadata["gc.routed_to"] != config.ControlDispatcherAgentName {
-		t.Fatalf("review-codex gc.routed_to = %q, want %q", codex.Metadata["gc.routed_to"], config.ControlDispatcherAgentName)
+	if got := codex.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("review-codex gc.routed_to = %q, want empty direct dispatcher assignee", got)
 	}
 	if codex.Metadata["gc.execution_routed_to"] != "gascity/codex" {
 		t.Fatalf("review-codex gc.execution_routed_to = %q, want gascity/codex", codex.Metadata["gc.execution_routed_to"])
@@ -700,8 +706,8 @@ max = -1
 	if containsString(codex.Labels, "pool:gascity/claude") {
 		t.Fatalf("review-codex labels = %v, should not contain pool:gascity/claude", codex.Labels)
 	}
-	if codex.Assignee != "" {
-		t.Fatalf("review-codex assignee = %q, want empty metadata-only control route", codex.Assignee)
+	if codex.Assignee != "gascity--control-dispatcher" {
+		t.Fatalf("review-codex assignee = %q, want gascity--control-dispatcher", codex.Assignee)
 	}
 
 	synthesize := findAttemptByRef(t, store, root.ID, "mol-adopt-pr-v2.review-loop.iteration.2.synthesize")
@@ -865,7 +871,7 @@ func TestResolveAttemptRouteBinding_ConfigTargetBeatsCollidingSessionAlias(t *te
 func TestResolveAttemptRouteBinding_NamedSessionTargetUsesCanonicalBeadID(t *testing.T) {
 	t.Parallel()
 
-	store := beads.NewMemStore()
+	store := &countingAttemptRouteStore{MemStore: beads.NewMemStore()}
 	named, err := store.Create(beads.Bead{
 		Title:  "worker",
 		Type:   session.BeadType,
@@ -896,6 +902,7 @@ func TestResolveAttemptRouteBinding_NamedSessionTargetUsesCanonicalBeadID(t *tes
 		}},
 	}
 
+	startCalls := store.calls
 	binding, ok := resolveAttemptRouteBinding("worker", cfg, store)
 	if !ok {
 		t.Fatal("resolveAttemptRouteBinding did not resolve named target")
@@ -906,9 +913,28 @@ func TestResolveAttemptRouteBinding_NamedSessionTargetUsesCanonicalBeadID(t *tes
 	if binding.qualifiedName != "" || binding.sessionName != "" {
 		t.Fatalf("binding = %+v, want direct named session only", binding)
 	}
+	// Per-resolution List calls must stay bounded so the per-attempt cost
+	// does not fan out under reconciler load. The previous implementation
+	// issued four sequential List calls per resolution; collapsing them
+	// into one label-scoped scan was the fix for ga-pa57. Allow a small
+	// margin (≤2) for unrelated lookups in the binding path while still
+	// guarding against regression to the four-call shape.
+	if delta := store.calls - startCalls; delta > 2 {
+		t.Fatalf("resolveAttemptRouteBinding issued %d List calls, want ≤2 (regression risk for ga-pa57 contention)", delta)
+	}
+}
+
+type countingAttemptRouteStore struct {
+	*beads.MemStore
+	calls int
 }
 
-func TestResolveAttemptRouteBinding_NamedSessionTargetWithoutCanonicalBeadUsesMetadataOnly(t *testing.T) {
+func (s *countingAttemptRouteStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.calls++
+	return s.MemStore.List(query)
+}
+
+func TestResolveAttemptRouteBinding_NamedSessionTargetWithoutCanonicalBeadUsesSessionName(t *testing.T) {
 	t.Parallel()
 
 	store := beads.NewMemStore()
@@ -929,11 +955,180 @@ func TestResolveAttemptRouteBinding_NamedSessionTargetWithoutCanonicalBeadUsesMe
 	if !ok {
 		t.Fatal("resolveAttemptRouteBinding did not resolve named target")
 	}
-	if binding.directSessionID != "" || binding.sessionName != "" {
-		t.Fatalf("binding = %+v, want no direct or legacy session-name target without a canonical bead", binding)
+	if binding.directSessionID != "" {
+		t.Fatalf("directSessionID = %q, want empty without canonical bead", binding.directSessionID)
+	}
+	if binding.sessionName != "worker" {
+		t.Fatalf("sessionName = %q, want worker", binding.sessionName)
+	}
+	if binding.qualifiedName != "" || binding.metadataOnly {
+		t.Fatalf("binding = %+v, want concrete session-name route", binding)
+	}
+}
+
+func TestApplyAttemptControlStepRoute_ImplicitControlDispatcherUsesConcreteAssignee(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "maintainer-city"},
+		Daemon:    config.DaemonConfig{FormulaV2: true},
+		Rigs: []config.Rig{{
+			Name: "gascity",
+			Path: t.TempDir(),
+		}},
+		Agents: []config.Agent{{
+			Name: "claude",
+			Dir:  "gascity",
+		}},
+	}
+	config.InjectImplicitAgents(cfg)
+
+	step := &formula.RecipeStep{
+		Metadata: map[string]string{
+			"gc.routed_to": "stale-route",
+		},
+	}
+	applyAttemptControlStepRoute(step, "gascity/claude", cfg, beads.NewMemStore())
+
+	if step.Assignee != "gascity--control-dispatcher" {
+		t.Fatalf("assignee = %q, want gascity--control-dispatcher", step.Assignee)
+	}
+	if got := step.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("gc.routed_to = %q, want empty for concrete control dispatcher assignee", got)
+	}
+	if got := step.Metadata["gc.execution_routed_to"]; got != "gascity/claude" {
+		t.Fatalf("gc.execution_routed_to = %q, want gascity/claude", got)
+	}
+}
+
+func TestSpawnNextAttemptUsesSourceRigForBareChildControlRoute(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte(`
+[workspace]
+name = "maintainer-city"
+
+[daemon]
+formula_v2 = true
+
+[[rigs]]
+name = "frontend"
+path = "/tmp/frontend"
+
+[[rigs]]
+name = "backend"
+path = "/tmp/backend"
+
+[[agent]]
+name = "reviewer"
+dir = "frontend"
+
+[[agent]]
+name = "control-dispatcher"
+dir = "frontend"
+max_active_sessions = 1
+
+[[agent]]
+name = "reviewer"
+dir = "backend"
+
+[[agent]]
+name = "control-dispatcher"
+dir = "backend"
+max_active_sessions = 1
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	spec := &formula.Step{
+		ID:    "review-loop",
+		Title: "Review loop",
+		Type:  "task",
+		Ralph: &formula.RalphSpec{MaxAttempts: 3},
+		Children: []*formula.Step{
+			{
+				ID:    "review",
+				Title: "Review",
+				Type:  "task",
+				Metadata: map[string]string{
+					"gc.run_target": "reviewer",
+				},
+				Retry: &formula.RetrySpec{MaxAttempts: 2},
+			},
+		},
+	}
+	specJSON, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("marshal step spec: %v", err)
+	}
+
+	root := mustCreate(t, store, beads.Bead{
+		Title:    "workflow",
+		Metadata: map[string]string{"gc.kind": "workflow"},
+	})
+	control := mustCreate(t, store, beads.Bead{
+		Title: "review-loop",
+		Metadata: map[string]string{
+			"gc.kind":                "ralph",
+			"gc.root_bead_id":        root.ID,
+			"gc.step_ref":            "mol-adopt-pr-v2.review-loop",
+			"gc.step_id":             "review-loop",
+			"gc.source_step_spec":    string(specJSON),
+			"gc.control_epoch":       "1",
+			"gc.execution_routed_to": "frontend/reviewer",
+		},
+	})
+
+	if err := spawnNextAttempt(t.Context(), store, control, 2, ProcessOptions{CityPath: cityPath}); err != nil {
+		t.Fatalf("spawnNextAttempt: %v", err)
+	}
+
+	review := findAttemptByRef(t, store, root.ID, "mol-adopt-pr-v2.review-loop.iteration.2.review")
+	if review.ID == "" {
+		t.Fatal("review child not created")
+	}
+	if got := review.Metadata["gc.execution_routed_to"]; got != "frontend/reviewer" {
+		t.Fatalf("review gc.execution_routed_to = %q, want frontend/reviewer", got)
+	}
+	if got := review.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("review gc.routed_to = %q, want empty direct dispatcher assignee", got)
+	}
+	if review.Assignee != "frontend--control-dispatcher" {
+		t.Fatalf("review assignee = %q, want frontend--control-dispatcher", review.Assignee)
+	}
+}
+
+func TestApplyAttemptControlStepRoute_ConfiguredControlDispatcherNeverUsesMetadataRoute(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "maintainer-city"},
+		Agents: []config.Agent{
+			{
+				Name: "claude",
+				Dir:  "gascity",
+			},
+			{
+				Name: "control-dispatcher",
+				Dir:  "gascity",
+			},
+		},
+	}
+
+	step := &formula.RecipeStep{
+		Metadata: map[string]string{
+			"gc.routed_to": "stale-route",
+		},
+	}
+	applyAttemptControlStepRoute(step, "gascity/claude", cfg, beads.NewMemStore())
+
+	if step.Assignee != "gascity--control-dispatcher" {
+		t.Fatalf("assignee = %q, want gascity--control-dispatcher", step.Assignee)
 	}
-	if binding.qualifiedName != "worker" || !binding.metadataOnly {
-		t.Fatalf("binding = %+v, want metadata-only worker route", binding)
+	if got := step.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("gc.routed_to = %q, want empty for concrete control dispatcher assignee", got)
 	}
 }
 
@@ -999,8 +1194,8 @@ func TestApplyAttemptControlStepRoute_KeepsControlBeadsOnDispatcherForNamedExecu
 	if got := step.Metadata["gc.execution_routed_to"]; got != "worker" {
 		t.Fatalf("gc.execution_routed_to = %q, want worker", got)
 	}
-	if got := step.Metadata["gc.routed_to"]; got != config.ControlDispatcherAgentName {
-		t.Fatalf("gc.routed_to = %q, want %q", got, config.ControlDispatcherAgentName)
+	if got := step.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("gc.routed_to = %q, want empty for concrete control-dispatcher assignee", got)
 	}
 	if step.Assignee != dispatcher.ID {
 		t.Fatalf("assignee = %q, want canonical control-dispatcher bead %q", step.Assignee, dispatcher.ID)
@@ -1088,14 +1283,14 @@ func TestRetryIdempotencyKeyPreventsDoubleSpawn(t *testing.T) {
 	allAfterFirst, _ := store.ListOpen()
 	countAfterFirst := len(allAfterFirst)
 
-	// Process again with same state — epoch conflict should prevent double spawn.
+	// Process again with same state -- epoch conflict should prevent double spawn.
 	// The epoch was already incremented by the first Attach, so a second
 	// processRetryControl with the same attempt (attempt 1 still closed, attempt 2
 	// still open) will find attempt 2 as the latest and see it's not closed.
-	// This verifies the invariant violation guard.
+	// This verifies the pending guard.
 	_, err = processRetryControl(store, mustGet(t, store, control.ID), ProcessOptions{})
-	if err == nil {
-		t.Fatal("expected error on second process (attempt 2 is open)")
+	if !errors.Is(err, ErrControlPending) {
+		t.Fatalf("second process error = %v, want %v", err, ErrControlPending)
 	}
 
 	// No new beads should have been created.
diff --git a/internal/dispatch/control_test.go b/internal/dispatch/control_test.go
index c1c3312fc4..55ce6e79d6 100644
--- a/internal/dispatch/control_test.go
+++ b/internal/dispatch/control_test.go
@@ -2,8 +2,8 @@ package dispatch
 
 import (
 	"encoding/json"
+	"errors"
 	"strconv"
-	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -72,6 +72,69 @@ func TestProcessRetryControlPass(t *testing.T) {
 	}
 }
 
+func TestProcessRetryControlPassClosesWithSingleFinalMetadataUpdate(t *testing.T) {
+	t.Parallel()
+	base := beads.NewMemStore()
+
+	root := mustCreate(t, base, beads.Bead{
+		Title:    "workflow",
+		Metadata: map[string]string{"gc.kind": "workflow"},
+	})
+	control := mustCreate(t, base, beads.Bead{
+		Title: "review",
+		Metadata: map[string]string{
+			"gc.kind":             "retry",
+			"gc.root_bead_id":     root.ID,
+			"gc.step_ref":         "mol-test.review",
+			"gc.step_id":          "review",
+			"gc.max_attempts":     "3",
+			"gc.on_exhausted":     "hard_fail",
+			"gc.source_step_spec": `{"id":"review","title":"Review","type":"task","retry":{"max_attempts":3}}`,
+			"gc.control_epoch":    "1",
+		},
+	})
+	attempt1 := mustCreate(t, base, beads.Bead{
+		Title: "review attempt 1",
+		Metadata: map[string]string{
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "mol-test.review.attempt.1",
+			"gc.attempt":      "1",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"ok":true}`,
+			"review.verdict":  "approved",
+		},
+	})
+	mustClose(t, base, attempt1.ID)
+	mustDep(t, base, control.ID, attempt1.ID, "blocks")
+
+	store := &controlCloseTrackingStore{Store: base, targetID: control.ID}
+	result, err := processRetryControl(store, mustGet(t, store, control.ID), ProcessOptions{})
+	if err != nil {
+		t.Fatalf("processRetryControl: %v", err)
+	}
+	if !result.Processed || result.Action != "pass" {
+		t.Fatalf("result = %+v, want processed pass", result)
+	}
+	if store.setMetadataCalls != 0 || store.setMetadataBatchCalls != 0 {
+		t.Fatalf("metadata calls before close = SetMetadata:%d SetMetadataBatch:%d, want none", store.setMetadataCalls, store.setMetadataBatchCalls)
+	}
+	if store.closeUpdateCalls != 1 {
+		t.Fatalf("close update calls = %d, want 1", store.closeUpdateCalls)
+	}
+	for key, want := range map[string]string{
+		"gc.outcome":     "pass",
+		"gc.output_json": `{"ok":true}`,
+		"review.verdict": "approved",
+	} {
+		if got := store.closeUpdateMetadata[key]; got != want {
+			t.Fatalf("close metadata %s = %q, want %q", key, got, want)
+		}
+	}
+	if store.closeUpdateMetadata["gc.attempt_log"] == "" {
+		t.Fatal("close metadata missing gc.attempt_log")
+	}
+}
+
 func TestProcessRetryControlHardFail(t *testing.T) {
 	t.Parallel()
 	store := beads.NewMemStore()
@@ -246,6 +309,110 @@ func TestProcessRetryControlSoftFailOnExhaustion(t *testing.T) {
 	}
 }
 
+func TestProcessRetryControlRetriesInvalidWorkerResultContract(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		attemptMeta map[string]string
+		wantReason  string
+	}{
+		{
+			name: "pass with failure metadata",
+			attemptMeta: map[string]string{
+				"gc.outcome":        "pass",
+				"gc.failure_class":  "transient",
+				"gc.failure_reason": "rate_limited",
+			},
+			wantReason: "pass_with_failure_metadata",
+		},
+		{
+			name: "missing outcome",
+			attemptMeta: map[string]string{
+				"gc.failure_class":  "transient",
+				"gc.failure_reason": "rate_limited",
+			},
+			wantReason: "missing_outcome",
+		},
+		{
+			name: "unknown failure class",
+			attemptMeta: map[string]string{
+				"gc.outcome":       "fail",
+				"gc.failure_class": "mystery",
+			},
+			wantReason: "unknown_failure_class",
+		},
+		{
+			name: "invalid outcome value",
+			attemptMeta: map[string]string{
+				"gc.outcome":       "mystery",
+				"gc.failure_class": "transient",
+			},
+			wantReason: "invalid_outcome_value",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := beads.NewMemStore()
+
+			root := mustCreate(t, store, beads.Bead{
+				Title:    "workflow",
+				Metadata: map[string]string{"gc.kind": "workflow"},
+			})
+			control := mustCreate(t, store, beads.Bead{
+				Title: "review",
+				Metadata: map[string]string{
+					"gc.kind":             "retry",
+					"gc.root_bead_id":     root.ID,
+					"gc.step_ref":         "mol-test.review",
+					"gc.step_id":          "review",
+					"gc.max_attempts":     "2",
+					"gc.on_exhausted":     "hard_fail",
+					"gc.source_step_spec": `{"id":"review","title":"Review","type":"task","retry":{"max_attempts":2}}`,
+					"gc.control_epoch":    "1",
+				},
+			})
+			attemptMeta := map[string]string{
+				"gc.root_bead_id": root.ID,
+				"gc.step_ref":     "mol-test.review.attempt.1",
+				"gc.attempt":      "1",
+			}
+			for key, value := range tt.attemptMeta {
+				attemptMeta[key] = value
+			}
+			attempt1 := mustCreate(t, store, beads.Bead{
+				Title:    "review attempt 1",
+				Metadata: attemptMeta,
+			})
+			mustClose(t, store, attempt1.ID)
+			mustDep(t, store, control.ID, attempt1.ID, "blocks")
+
+			result, err := processRetryControl(store, mustGet(t, store, control.ID), ProcessOptions{})
+			if err != nil {
+				t.Fatalf("processRetryControl: %v", err)
+			}
+			if result.Action != "retry" {
+				t.Fatalf("action = %q, want retry", result.Action)
+			}
+
+			after := mustGet(t, store, control.ID)
+			if after.Status != "open" {
+				t.Fatalf("control status = %q, want open", after.Status)
+			}
+			if after.Metadata["gc.failure_reason"] != "" {
+				t.Fatalf("control gc.failure_reason = %q, want unset before exhaustion", after.Metadata["gc.failure_reason"])
+			}
+			var log []map[string]string
+			if err := json.Unmarshal([]byte(after.Metadata["gc.attempt_log"]), &log); err != nil {
+				t.Fatalf("unmarshal attempt_log: %v", err)
+			}
+			if len(log) != 1 || log[0]["reason"] != tt.wantReason {
+				t.Fatalf("attempt_log = %v, want reason %q", log, tt.wantReason)
+			}
+		})
+	}
+}
+
 func TestProcessRetryControlClosesEnclosingScopeOnFailure(t *testing.T) {
 	t.Parallel()
 	store := beads.NewMemStore()
@@ -439,11 +606,60 @@ func TestProcessRetryControlInvariantViolation(t *testing.T) {
 	mustDep(t, store, control.ID, attempt1.ID, "blocks")
 
 	_, err := processRetryControl(store, mustGet(t, store, control.ID), ProcessOptions{})
-	if err == nil {
-		t.Fatal("expected invariant violation error")
+	if !errors.Is(err, ErrControlPending) {
+		t.Fatalf("error = %v, want %v", err, ErrControlPending)
 	}
-	if !strings.Contains(err.Error(), "invariant violation") {
-		t.Fatalf("error = %v, want invariant violation", err)
+}
+
+func TestProcessRetryControlPendingAttemptAddsBlockingDep(t *testing.T) {
+	t.Parallel()
+	store := beads.NewMemStore()
+
+	root := mustCreate(t, store, beads.Bead{
+		Title:    "workflow",
+		Metadata: map[string]string{"gc.kind": "workflow"},
+	})
+	control := mustCreate(t, store, beads.Bead{
+		Title: "review",
+		Metadata: map[string]string{
+			"gc.kind":             "retry",
+			"gc.root_bead_id":     root.ID,
+			"gc.step_ref":         "mol-test.review",
+			"gc.step_id":          "review",
+			"gc.max_attempts":     "3",
+			"gc.source_step_spec": `{"id":"review","title":"Review","type":"task"}`,
+			"gc.control_epoch":    "1",
+		},
+	})
+	attempt := mustCreate(t, store, beads.Bead{
+		Title: "review attempt 1",
+		Metadata: map[string]string{
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "mol-test.review.attempt.1",
+			"gc.attempt":      "1",
+		},
+	})
+
+	_, err := processRetryControl(store, mustGet(t, store, control.ID), ProcessOptions{})
+	if !errors.Is(err, ErrControlPending) {
+		t.Fatalf("error = %v, want %v", err, ErrControlPending)
+	}
+
+	deps, err := store.DepList(control.ID, "down")
+	if err != nil {
+		t.Fatalf("DepList: %v", err)
+	}
+	if len(deps) != 1 || deps[0].DependsOnID != attempt.ID || deps[0].Type != "blocks" {
+		t.Fatalf("deps = %#v, want one blocks dep on pending attempt %s", deps, attempt.ID)
+	}
+	ready, err := store.Ready()
+	if err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	for _, bead := range ready {
+		if bead.ID == control.ID {
+			t.Fatalf("control bead stayed ready while pending attempt %s is open", attempt.ID)
+		}
 	}
 }
 
@@ -847,6 +1063,94 @@ func TestProcessRalphControlClosesEnclosingScopeOnIterationFailure(t *testing.T)
 	}
 }
 
+func TestProcessRalphControlReturnsPendingForOpenIteration(t *testing.T) {
+	t.Parallel()
+	store := beads.NewMemStore()
+
+	root := mustCreate(t, store, beads.Bead{
+		Title:    "workflow",
+		Metadata: map[string]string{"gc.kind": "workflow"},
+	})
+	control := mustCreate(t, store, beads.Bead{
+		Title: "review loop",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "mol-test.review-loop",
+			"gc.step_id":      "review-loop",
+			"gc.max_attempts": "2",
+		},
+	})
+	iteration := mustCreate(t, store, beads.Bead{
+		Title: "review loop iteration 1",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "mol-test.review-loop.iteration.1",
+			"gc.scope_role":   "body",
+			"gc.attempt":      "1",
+		},
+	})
+	mustDep(t, store, control.ID, iteration.ID, "blocks")
+
+	_, err := processRalphControl(store, mustGet(t, store, control.ID), ProcessOptions{})
+	if !errors.Is(err, ErrControlPending) {
+		t.Fatalf("error = %v, want %v", err, ErrControlPending)
+	}
+}
+
+func TestProcessRalphControlPendingIterationAddsBlockingDep(t *testing.T) {
+	t.Parallel()
+	store := beads.NewMemStore()
+
+	root := mustCreate(t, store, beads.Bead{
+		Title:    "workflow",
+		Metadata: map[string]string{"gc.kind": "workflow"},
+	})
+	control := mustCreate(t, store, beads.Bead{
+		Title: "review loop",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "mol-test.review-loop",
+			"gc.step_id":      "review-loop",
+			"gc.max_attempts": "2",
+		},
+	})
+	iteration := mustCreate(t, store, beads.Bead{
+		Title: "review loop iteration 1",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "mol-test.review-loop.iteration.1",
+			"gc.scope_role":   "body",
+			"gc.attempt":      "1",
+		},
+	})
+
+	_, err := processRalphControl(store, mustGet(t, store, control.ID), ProcessOptions{})
+	if !errors.Is(err, ErrControlPending) {
+		t.Fatalf("error = %v, want %v", err, ErrControlPending)
+	}
+
+	deps, err := store.DepList(control.ID, "down")
+	if err != nil {
+		t.Fatalf("DepList: %v", err)
+	}
+	if len(deps) != 1 || deps[0].DependsOnID != iteration.ID || deps[0].Type != "blocks" {
+		t.Fatalf("deps = %#v, want one blocks dep on pending iteration %s", deps, iteration.ID)
+	}
+	ready, err := store.Ready()
+	if err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	for _, bead := range ready {
+		if bead.ID == control.ID {
+			t.Fatalf("control bead stayed ready while pending iteration %s is open", iteration.ID)
+		}
+	}
+}
+
 // TestReconcileClosedScopeMemberRalphPass covers the pass-side symmetry of
 // TestProcessRalphControlClosesEnclosingScopeOnIterationFailure: when a scoped
 // ralph control closes with gc.outcome=pass, reconcileClosedScopeMember must
@@ -1204,6 +1508,40 @@ func mustDep(t *testing.T, store beads.Store, from, to, depType string) { //noli
 	}
 }
 
+type controlCloseTrackingStore struct {
+	beads.Store
+	targetID              string
+	setMetadataCalls      int
+	setMetadataBatchCalls int
+	closeUpdateCalls      int
+	closeUpdateMetadata   map[string]string
+}
+
+func (s *controlCloseTrackingStore) SetMetadata(id, key, value string) error {
+	if id == s.targetID {
+		s.setMetadataCalls++
+	}
+	return s.Store.SetMetadata(id, key, value)
+}
+
+func (s *controlCloseTrackingStore) SetMetadataBatch(id string, kvs map[string]string) error {
+	if id == s.targetID {
+		s.setMetadataBatchCalls++
+	}
+	return s.Store.SetMetadataBatch(id, kvs)
+}
+
+func (s *controlCloseTrackingStore) Update(id string, opts beads.UpdateOpts) error {
+	if id == s.targetID && opts.Status != nil && *opts.Status == "closed" {
+		s.closeUpdateCalls++
+		s.closeUpdateMetadata = make(map[string]string, len(opts.Metadata))
+		for key, value := range opts.Metadata {
+			s.closeUpdateMetadata[key] = value
+		}
+	}
+	return s.Store.Update(id, opts)
+}
+
 // ---------------------------------------------------------------------------
 // Regression: scope bead must block on children (not parent-child deadlock)
 // ---------------------------------------------------------------------------
diff --git a/internal/dispatch/fanout.go b/internal/dispatch/fanout.go
index 8a597efd6c..b9ec5f6a5d 100644
--- a/internal/dispatch/fanout.go
+++ b/internal/dispatch/fanout.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/gastownhall/gascity/internal/beads"
+	"github.com/gastownhall/gascity/internal/config"
 	"github.com/gastownhall/gascity/internal/formula"
 	"github.com/gastownhall/gascity/internal/molecule"
 )
@@ -61,7 +62,11 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 	if sourceRef == "" {
 		return ControlResult{}, fmt.Errorf("%s: missing gc.control_for", bead.ID)
 	}
-	source, err := resolveWorkflowStepByRefFromBeads(workflowBeads, rootID, sourceRef)
+	blockerIDs, err := controlBlockerIDs(store, bead.ID)
+	if err != nil {
+		return ControlResult{}, fmt.Errorf("%s: loading control blockers: %w", bead.ID, err)
+	}
+	source, err := resolveWorkflowStepByRefFromBeads(workflowBeads, rootID, sourceRef, workflowStepMatchOptions{PreferredIDs: blockerIDs})
 	if err != nil {
 		return ControlResult{}, fmt.Errorf("%s: resolving source step %q: %w", bead.ID, sourceRef, err)
 	}
@@ -110,22 +115,29 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 	if mode == "" {
 		mode = "parallel"
 	}
-	if bead.Metadata["gc.fanout_state"] == "" {
+	if strings.TrimSpace(bead.Metadata["gc.fanout_state"]) == "" {
 		if err := store.SetMetadataBatch(bead.ID, map[string]string{"gc.fanout_state": "spawning"}); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: recording fanout spawn start: %w", bead.ID, err)
 		}
 	}
+	fanoutSinkBlockers := fanoutSinkBlockerIDs(blockerIDs, source.ID)
 
 	var previousSinkIDs []string
 	totalCreated := 0
 	for index, item := range items {
-		targetRef := sourceRef + ".item." + strconv.Itoa(index+1)
+		targetRef := fanoutTargetRef(source, sourceRef, index)
 		target := &formula.Step{
 			ID:          targetRef,
 			Title:       source.Title,
 			Description: source.Description,
 		}
 		itemVars := materializeFanoutVars(bondVars, item, index)
+		if scopeRef := strings.TrimSpace(bead.Metadata["gc.scope_ref"]); scopeRef != "" {
+			if itemVars == nil {
+				itemVars = make(map[string]string, 1)
+			}
+			itemVars["scope_ref"] = scopeRef
+		}
 		fragment, err := formula.CompileExpansionFragment(context.Background(), bead.Metadata["gc.bond"], opts.FormulaSearchPaths, target, itemVars)
 		if err != nil {
 			return ControlResult{}, fmt.Errorf("%s: compiling fragment %d: %w", bead.ID, index+1, err)
@@ -135,8 +147,13 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 				return ControlResult{}, fmt.Errorf("%s: preparing fragment %d: %w", bead.ID, index+1, err)
 			}
 		}
+		routeFanoutFragmentSteps(fragment, bead, opts, store)
 		externalDeps := expectedFragmentExternalDeps(fragment, mode, previousSinkIDs)
-		existingMapping, err := resolveExistingFragmentInstanceFromBeads(store, workflowBeads, rootID, fragment, externalDeps)
+		existingMapping, err := resolveExistingFragmentInstanceFromBeads(store, workflowBeads, rootID, fragment, externalDeps, fragmentResumeMatchOptions{
+			StepRefAliases:     fanoutLegacyStepAliases(fragment, targetRef, sourceRef, index),
+			AliasScopeRef:      strings.TrimSpace(bead.Metadata["gc.scope_ref"]),
+			FanoutSinkBlockers: fanoutSinkBlockers,
+		})
 		if err != nil {
 			return ControlResult{}, fmt.Errorf("%s: resuming fragment %d: %w", bead.ID, index+1, err)
 		}
@@ -177,18 +194,156 @@ func processFanout(store beads.Store, bead beads.Bead, opts ProcessOptions) (Con
 	return ControlResult{Processed: true, Action: "fanout-spawn", Created: totalCreated}, nil
 }
 
-func resolveExistingFragmentInstanceFromBeads(store beads.Store, all []beads.Bead, _ string, fragment *formula.FragmentRecipe, externalDeps []molecule.ExternalDep) (map[string]string, error) {
+func fanoutTargetRef(source beads.Bead, sourceRef string, index int) string {
+	base := strings.TrimSpace(source.Metadata["gc.step_ref"])
+	if base == "" {
+		base = sourceRef
+	}
+	return base + ".item." + strconv.Itoa(index+1)
+}
+
+func controlBlockerIDs(store beads.Store, controlID string) (map[string]struct{}, error) {
+	deps, err := store.DepList(controlID, "down")
+	if err != nil {
+		return nil, err
+	}
+	blockers := make(map[string]struct{}, len(deps))
+	for _, dep := range deps {
+		if dep.Type != "blocks" || dep.DependsOnID == "" {
+			continue
+		}
+		blockers[dep.DependsOnID] = struct{}{}
+	}
+	if len(blockers) == 0 {
+		return nil, nil
+	}
+	return blockers, nil
+}
+
+func fanoutSinkBlockerIDs(blockers map[string]struct{}, sourceID string) map[string]struct{} {
+	if len(blockers) == 0 {
+		return nil
+	}
+	sinks := make(map[string]struct{}, len(blockers))
+	for blockerID := range blockers {
+		if blockerID == sourceID {
+			continue
+		}
+		sinks[blockerID] = struct{}{}
+	}
+	if len(sinks) == 0 {
+		return nil
+	}
+	return sinks
+}
+
+func fanoutLegacyStepAliases(fragment *formula.FragmentRecipe, targetRef, sourceRef string, index int) map[string]string {
+	if fragment == nil {
+		return nil
+	}
+	legacyBase := strings.TrimSpace(sourceRef)
+	if legacyBase == "" {
+		return nil
+	}
+	legacyTargetRef := legacyBase + ".item." + strconv.Itoa(index+1)
+	if legacyTargetRef == targetRef {
+		return nil
+	}
+
+	aliases := make(map[string]string, len(fragment.Steps))
+	for _, step := range fragment.Steps {
+		if strings.Count(step.ID, targetRef) != 1 {
+			continue
+		}
+		legacyID := strings.Replace(step.ID, targetRef, legacyTargetRef, 1)
+		if legacyID != step.ID {
+			aliases[step.ID] = legacyID
+		}
+	}
+	if len(aliases) == 0 {
+		return nil
+	}
+	return aliases
+}
+
+type fragmentResumeMatchOptions struct {
+	StepRefAliases     map[string]string
+	AliasScopeRef      string
+	FanoutSinkBlockers map[string]struct{}
+}
+
+func routeFanoutFragmentSteps(fragment *formula.FragmentRecipe, control beads.Bead, opts ProcessOptions, store beads.Store) {
+	if fragment == nil {
+		return
+	}
+	executionRoute := strings.TrimSpace(control.Metadata["gc.execution_routed_to"])
+	routeCfg := loadAttemptRouteConfig(opts.CityPath)
+	for i := range fragment.Steps {
+		step := &fragment.Steps[i]
+		if step.Metadata["gc.kind"] == "spec" {
+			continue
+		}
+		if isAttemptControlKind(step.Metadata["gc.kind"]) {
+			target := strings.TrimSpace(step.Metadata["gc.execution_routed_to"])
+			if target == "" {
+				target = fanoutFragmentStepTarget(*step, executionRoute, routeCfg)
+			}
+			applyAttemptControlStepRoute(step, target, routeCfg, store)
+			continue
+		}
+		if fanoutFragmentStepHasRoute(*step) {
+			continue
+		}
+		target := fanoutFragmentStepTarget(*step, executionRoute, routeCfg)
+		if target == "" {
+			continue
+		}
+		applyAttemptStepRoute(step, target, routeCfg, store)
+	}
+}
+
+func fanoutFragmentStepTarget(step formula.RecipeStep, executionRoute string, routeCfg *config.City) string {
+	target := strings.TrimSpace(step.Metadata["gc.run_target"])
+	if target == "" {
+		target = strings.TrimSpace(step.Metadata["gc.routed_to"])
+	}
+	if target == "" {
+		target = strings.TrimSpace(step.Assignee)
+	}
+	if target == "" {
+		return executionRoute
+	}
+	return qualifyAttemptTargetWithSourceRoute(target, executionRoute, routeCfg)
+}
+
+func fanoutFragmentStepHasRoute(step formula.RecipeStep) bool {
+	if strings.TrimSpace(step.Metadata["gc.execution_routed_to"]) != "" {
+		return true
+	}
+	if strings.TrimSpace(step.Metadata["gc.routed_to"]) != "" {
+		return true
+	}
+	return strings.TrimSpace(step.Assignee) != ""
+}
+
+func resolveExistingFragmentInstanceFromBeads(store beads.Store, all []beads.Bead, _ string, fragment *formula.FragmentRecipe, externalDeps []molecule.ExternalDep, opts fragmentResumeMatchOptions) (map[string]string, error) {
 	if fragment == nil || len(fragment.Steps) == 0 {
 		return nil, nil
 	}
 
 	expected := make(map[string]struct{}, len(fragment.Steps))
+	aliasToExpected := make(map[string]string, len(opts.StepRefAliases))
 	for _, step := range fragment.Steps {
 		expected[step.ID] = struct{}{}
+		if alias := strings.TrimSpace(opts.StepRefAliases[step.ID]); alias != "" && alias != step.ID {
+			aliasToExpected[alias] = step.ID
+		}
 	}
 
 	mapping := make(map[string]string, len(fragment.Steps))
 	partial := make(map[string]beads.Bead, len(fragment.Steps))
+	rejectedAlias := make(map[string]beads.Bead)
+	usedAlias := false
 	for _, bead := range all {
 		if bead.Metadata["gc.partial_fragment"] == "true" {
 			continue
@@ -197,32 +352,76 @@ func resolveExistingFragmentInstanceFromBeads(store beads.Store, all []beads.Bea
 		if stepRef == "" {
 			continue
 		}
-		if _, ok := expected[stepRef]; !ok {
+		matchID := stepRef
+		aliasMatch := false
+		if _, ok := expected[matchID]; !ok {
+			matchID = aliasToExpected[stepRef]
+			aliasMatch = matchID != ""
+		}
+		if matchID == "" {
 			continue
 		}
-		if existing := mapping[stepRef]; existing != "" && existing != bead.ID {
-			return nil, fmt.Errorf("duplicate fragment bead for %s (%s, %s)", stepRef, existing, bead.ID)
+		if aliasMatch {
+			scopeOwned := false
+			if opts.AliasScopeRef != "" {
+				beadScopeRef := strings.TrimSpace(bead.Metadata["gc.scope_ref"])
+				if beadScopeRef != "" {
+					if beadScopeRef != opts.AliasScopeRef {
+						continue
+					}
+					scopeOwned = true
+				}
+			}
+			blockerOwned := len(opts.FanoutSinkBlockers) > 0
+			// Legacy aliases are only safe to reuse once current-iteration
+			// ownership is proven. Without a matching scope_ref or already-wired
+			// sink blockers, an open legacy fragment could still belong to an
+			// older iteration that shared the same logical target.
+			if !scopeOwned && !blockerOwned {
+				if bead.Status != "closed" {
+					rejectedAlias[bead.ID] = bead
+				}
+				continue
+			}
+			usedAlias = true
+		}
+		if existing := mapping[matchID]; existing != "" && existing != bead.ID {
+			return nil, fmt.Errorf("duplicate fragment bead for %s (%s, %s)", matchID, existing, bead.ID)
 		}
-		mapping[stepRef] = bead.ID
+		mapping[matchID] = bead.ID
 		partial[bead.ID] = bead
 	}
 
 	switch {
 	case len(mapping) == 0:
+		if err := discardFragmentCandidates(store, fragment.Name, rejectedAlias); err != nil {
+			return nil, err
+		}
 		return nil, nil
 	case len(mapping) != len(expected):
-		if err := discardPartialFragmentInstance(store, partial); err != nil {
-			return nil, fmt.Errorf("recovering partial fragment instance for %s: %w", fragment.Name, err)
+		if err := discardFragmentCandidates(store, fragment.Name, partial, rejectedAlias); err != nil {
+			return nil, err
 		}
 		return nil, nil
 	default:
+		if usedAlias && !fragmentAliasMatchesExistingBlockers(fragment, mapping, opts.FanoutSinkBlockers) {
+			if err := discardFragmentCandidates(store, fragment.Name, openFragmentBeads(partial), rejectedAlias); err != nil {
+				return nil, err
+			}
+			return nil, nil
+		}
+		if len(rejectedAlias) > 0 {
+			if err := discardFragmentCandidates(store, fragment.Name, rejectedAlias); err != nil {
+				return nil, err
+			}
+		}
 		complete, err := fragmentInstanceComplete(store, fragment, mapping, externalDeps)
 		if err != nil {
 			return nil, err
 		}
 		if !complete {
-			if err := discardPartialFragmentInstance(store, partial); err != nil {
-				return nil, fmt.Errorf("recovering incompletely wired fragment instance for %s: %w", fragment.Name, err)
+			if err := discardFragmentCandidates(store, fragment.Name, partial); err != nil {
+				return nil, err
 			}
 			return nil, nil
 		}
@@ -230,6 +429,55 @@ func resolveExistingFragmentInstanceFromBeads(store beads.Store, all []beads.Bea
 	}
 }
 
+func fragmentAliasMatchesExistingBlockers(fragment *formula.FragmentRecipe, mapping map[string]string, blockers map[string]struct{}) bool {
+	if len(blockers) == 0 {
+		return true
+	}
+	sinkIDs := mapStepIDs(fragment.Sinks, mapping)
+	if len(sinkIDs) == 0 {
+		return false
+	}
+	for _, sinkID := range sinkIDs {
+		if _, ok := blockers[sinkID]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
+func discardFragmentCandidates(store beads.Store, fragmentName string, groups ...map[string]beads.Bead) error {
+	candidates := make(map[string]beads.Bead)
+	for _, group := range groups {
+		for id, bead := range group {
+			candidates[id] = bead
+		}
+	}
+	if len(candidates) == 0 {
+		return nil
+	}
+	if err := discardPartialFragmentInstance(store, candidates); err != nil {
+		return fmt.Errorf("recovering partial fragment instance for %s: %w", fragmentName, err)
+	}
+	return nil
+}
+
+func openFragmentBeads(group map[string]beads.Bead) map[string]beads.Bead {
+	if len(group) == 0 {
+		return nil
+	}
+	openOnly := make(map[string]beads.Bead)
+	for id, bead := range group {
+		if bead.Status == "closed" {
+			continue
+		}
+		openOnly[id] = bead
+	}
+	if len(openOnly) == 0 {
+		return nil
+	}
+	return openOnly
+}
+
 func fragmentInstanceComplete(store beads.Store, fragment *formula.FragmentRecipe, mapping map[string]string, externalDeps []molecule.ExternalDep) (bool, error) {
 	if fragment == nil {
 		return false, fmt.Errorf("fragment is nil")
@@ -250,6 +498,9 @@ func fragmentInstanceComplete(store beads.Store, fragment *formula.FragmentRecip
 		if bead.Assignee != step.Assignee {
 			return false, nil
 		}
+		if !fragmentRouteMetadataMatches(bead, step) {
+			return false, nil
+		}
 	}
 
 	for _, dep := range fragment.Deps {
@@ -304,6 +555,15 @@ func fragmentInstanceComplete(store beads.Store, fragment *formula.FragmentRecip
 	return true, nil
 }
 
+func fragmentRouteMetadataMatches(bead beads.Bead, step formula.RecipeStep) bool {
+	for _, key := range []string{"gc.routed_to", "gc.execution_routed_to"} {
+		if strings.TrimSpace(bead.Metadata[key]) != strings.TrimSpace(step.Metadata[key]) {
+			return false
+		}
+	}
+	return true
+}
+
 func expectedFragmentExternalDeps(fragment *formula.FragmentRecipe, mode string, previousSinkIDs []string) []molecule.ExternalDep {
 	if fragment == nil || mode != "sequential" || len(previousSinkIDs) == 0 {
 		return nil
@@ -454,12 +714,33 @@ func detachIncomingDeps(store beads.Store, beadID string) error {
 	return nil
 }
 
-func resolveWorkflowStepByRefFromBeads(all []beads.Bead, rootID, stepRef string) (beads.Bead, error) {
+type workflowStepMatchOptions struct {
+	PreferredIDs map[string]struct{}
+}
+
+func resolveWorkflowStepByRefFromBeads(all []beads.Bead, rootID, stepRef string, opts workflowStepMatchOptions) (beads.Bead, error) {
+	if len(opts.PreferredIDs) > 0 {
+		if match, ok := findWorkflowStepByRef(all, stepRef, opts.PreferredIDs); ok {
+			return match, nil
+		}
+	}
+	if match, ok := findWorkflowStepByRef(all, stepRef, nil); ok {
+		return match, nil
+	}
+	return beads.Bead{}, fmt.Errorf("step ref %q not found under root %s", stepRef, rootID)
+}
+
+func findWorkflowStepByRef(all []beads.Bead, stepRef string, allowedIDs map[string]struct{}) (beads.Bead, bool) {
 	var suffixMatch *beads.Bead
 	for _, bead := range all {
+		if len(allowedIDs) > 0 {
+			if _, ok := allowedIDs[bead.ID]; !ok {
+				continue
+			}
+		}
 		ref := bead.Metadata["gc.step_ref"]
 		if ref == stepRef {
-			return bead, nil
+			return bead, true
 		}
 		if suffixMatch == nil && strings.HasSuffix(ref, "."+stepRef) {
 			match := bead
@@ -467,9 +748,9 @@ func resolveWorkflowStepByRefFromBeads(all []beads.Bead, rootID, stepRef string)
 		}
 	}
 	if suffixMatch != nil {
-		return *suffixMatch, nil
+		return *suffixMatch, true
 	}
-	return beads.Bead{}, fmt.Errorf("step ref %q not found under root %s", stepRef, rootID)
+	return beads.Bead{}, false
 }
 
 func resolveFanoutItems(source beads.Bead, forEach string) ([]interface{}, error) {
diff --git a/internal/dispatch/ralph.go b/internal/dispatch/ralph.go
index a9dcd9e2c6..bf52867185 100644
--- a/internal/dispatch/ralph.go
+++ b/internal/dispatch/ralph.go
@@ -50,7 +50,7 @@ func processRalphCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 	if err != nil {
 		return ControlResult{}, err
 	}
-	tracef("ralph check-result bead=%s logical=%s attempt=%d outcome=%s exit=%v", bead.ID, logicalID, attempt, result.Outcome, result.ExitCode)
+	opts.tracef("ralph check-result bead=%s logical=%s attempt=%d outcome=%s exit=%v", bead.ID, logicalID, attempt, result.Outcome, result.ExitCode)
 	if err := persistCheckResult(store, bead.ID, result); err != nil {
 		return ControlResult{}, fmt.Errorf("%s: persisting check result: %w", bead.ID, err)
 	}
@@ -89,7 +89,7 @@ func processRalphCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 	nextAttempt := attempt + 1
 	switch bead.Metadata["gc.retry_state"] {
 	case "":
-		tracef("ralph retry-mark-spawning bead=%s next=%d", bead.ID, nextAttempt)
+		opts.tracef("ralph retry-mark-spawning bead=%s next=%d", bead.ID, nextAttempt)
 		if err := store.SetMetadataBatch(bead.ID, map[string]string{
 			"gc.retry_state":  "spawning",
 			"gc.next_attempt": strconv.Itoa(nextAttempt),
@@ -104,11 +104,11 @@ func processRalphCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 		return ControlResult{}, fmt.Errorf("%s: unsupported gc.retry_state %q", bead.ID, bead.Metadata["gc.retry_state"])
 	}
 	if bead.Metadata["gc.retry_state"] != "spawned" {
-		tracef("ralph retry-append-start bead=%s next=%d", bead.ID, nextAttempt)
-		if _, err := appendRalphRetry(store, logicalID, subject, bead, nextAttempt, opts.CityPath); err != nil {
+		opts.tracef("ralph retry-append-start bead=%s next=%d", bead.ID, nextAttempt)
+		if _, err := appendRalphRetry(store, logicalID, subject, bead, nextAttempt, opts); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: appending retry: %w", bead.ID, err)
 		}
-		tracef("ralph retry-append-done bead=%s next=%d", bead.ID, nextAttempt)
+		opts.tracef("ralph retry-append-done bead=%s next=%d", bead.ID, nextAttempt)
 		if err := store.SetMetadataBatch(bead.ID, map[string]string{
 			"gc.retry_state":  "spawned",
 			"gc.next_attempt": strconv.Itoa(nextAttempt),
@@ -116,11 +116,11 @@ func processRalphCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 			return ControlResult{}, fmt.Errorf("%s: recording retry spawn complete: %w", bead.ID, err)
 		}
 	}
-	tracef("ralph retry-finalize-start bead=%s next=%d", bead.ID, nextAttempt)
+	opts.tracef("ralph retry-finalize-start bead=%s next=%d", bead.ID, nextAttempt)
 	if err := finalizeRalphRetry(store, logicalID, bead.ID); err != nil {
 		return ControlResult{}, fmt.Errorf("%s: finalizing retry: %w", bead.ID, err)
 	}
-	tracef("ralph retry-finalize-done bead=%s next=%d", bead.ID, nextAttempt)
+	opts.tracef("ralph retry-finalize-done bead=%s next=%d", bead.ID, nextAttempt)
 	return ControlResult{Processed: true, Action: "retry"}, nil
 }
 
@@ -146,6 +146,10 @@ func runRalphCheck(store beads.Store, bead, subject beads.Bead, attempt int, opt
 	if cityPath == "" {
 		return convergence.GateResult{}, fmt.Errorf("%s: missing city path for exec check", bead.ID)
 	}
+	storePath := opts.StorePath
+	if storePath == "" {
+		storePath = cityPath
+	}
 
 	workDir := resolveInheritedMetadata(store, bead, "work_dir", "gc.work_dir")
 	resolvedWorkDir := ""
@@ -153,10 +157,10 @@ func runRalphCheck(store beads.Store, bead, subject beads.Bead, attempt int, opt
 		if filepath.IsAbs(workDir) {
 			resolvedWorkDir = workDir
 		} else {
-			resolvedWorkDir = filepath.Join(cityPath, workDir)
+			resolvedWorkDir = filepath.Join(storePath, workDir)
 		}
 	}
-	scriptBase := cityPath
+	scriptBase := storePath
 	if resolvedWorkDir != "" {
 		scriptBase = resolvedWorkDir
 	}
@@ -184,10 +188,15 @@ func runRalphCheck(store beads.Store, bead, subject beads.Bead, attempt int, opt
 		timeout = parsed
 	}
 
+	conditionBeadID := subject.ID
+	if conditionBeadID == "" {
+		conditionBeadID = bead.ID
+	}
 	result := convergence.RunCondition(context.Background(), scriptPath, convergence.ConditionEnv{
-		BeadID:    bead.ID,
+		BeadID:    conditionBeadID,
 		Iteration: attempt,
 		CityPath:  cityPath,
+		StorePath: storePath,
 		WorkDir:   resolvedWorkDir,
 	}, timeout, 0)
 	return result, nil
@@ -220,7 +229,7 @@ func persistCheckResult(store beads.Store, beadID string, result convergence.Gat
 	return store.SetMetadataBatch(beadID, batch)
 }
 
-func appendRalphRetry(store beads.Store, logicalID string, prevSubject, prevCheck beads.Bead, nextAttempt int, cityPath string) (map[string]string, error) {
+func appendRalphRetry(store beads.Store, logicalID string, prevSubject, prevCheck beads.Bead, nextAttempt int, opts ProcessOptions) (map[string]string, error) {
 	var rootBeads []beads.Bead
 	rootID := prevSubject.Metadata["gc.root_bead_id"]
 	if rootID != "" {
@@ -255,10 +264,10 @@ func appendRalphRetry(store beads.Store, logicalID string, prevSubject, prevChec
 		}
 		return existing, nil
 	}
-	cfg := loadAttemptRouteConfig(cityPath)
+	cfg := loadAttemptRouteConfig(opts.CityPath)
 	if molecule.IsGraphApplyEnabled() {
 		if applier, ok := store.(beads.GraphApplyStore); ok {
-			return appendRalphRetryViaGraphApply(store, applier, logicalID, prevSubject, prevCheck, attemptSet, oldAttempt, nextAttempt, oldScopeRef, newScopeRef, cfg)
+			return appendRalphRetryViaGraphApply(store, applier, logicalID, prevSubject, prevCheck, attemptSet, oldAttempt, nextAttempt, oldScopeRef, newScopeRef, cfg, opts)
 		}
 	}
 	return appendRalphRetryLegacy(store, logicalID, prevSubject, prevCheck, attemptSet, oldAttempt, nextAttempt, oldScopeRef, newScopeRef, cfg)
@@ -411,7 +420,7 @@ func appendRalphRetryLegacy(store beads.Store, logicalID string, prevSubject, pr
 	return mapping, nil
 }
 
-func appendRalphRetryViaGraphApply(store beads.Store, applier beads.GraphApplyStore, logicalID string, prevSubject, prevCheck beads.Bead, attemptSet map[string]beads.Bead, oldAttempt, nextAttempt int, oldScopeRef, newScopeRef string, cfg *config.City) (map[string]string, error) {
+func appendRalphRetryViaGraphApply(store beads.Store, applier beads.GraphApplyStore, logicalID string, prevSubject, prevCheck beads.Bead, attemptSet map[string]beads.Bead, oldAttempt, nextAttempt int, oldScopeRef, newScopeRef string, cfg *config.City, opts ProcessOptions) (map[string]string, error) {
 	ordered := make([]beads.Bead, 0, len(attemptSet))
 	for _, bead := range attemptSet {
 		ordered = append(ordered, bead)
@@ -458,7 +467,7 @@ func appendRalphRetryViaGraphApply(store beads.Store, applier beads.GraphApplySt
 		Type:   "blocks",
 	})
 
-	tracef("ralph retry-graph-apply-start logical=%s next=%d nodes=%d edges=%d", logicalID, nextAttempt, len(plan.Nodes), len(plan.Edges))
+	opts.tracef("ralph retry-graph-apply-start logical=%s next=%d nodes=%d edges=%d", logicalID, nextAttempt, len(plan.Nodes), len(plan.Edges))
 	applied, err := applier.ApplyGraphPlan(context.Background(), plan)
 	if err != nil {
 		return nil, err
@@ -466,7 +475,7 @@ func appendRalphRetryViaGraphApply(store beads.Store, applier beads.GraphApplySt
 	if err := beads.ValidateGraphApplyResult(plan, applied); err != nil {
 		return nil, err
 	}
-	tracef("ralph retry-graph-apply-done logical=%s next=%d nodes=%d", logicalID, nextAttempt, len(applied.IDs))
+	opts.tracef("ralph retry-graph-apply-done logical=%s next=%d nodes=%d", logicalID, nextAttempt, len(applied.IDs))
 
 	mapping := make(map[string]string, len(applied.IDs))
 	for oldID, newID := range applied.IDs {
diff --git a/internal/dispatch/retry.go b/internal/dispatch/retry.go
index 03900b7a15..e858043b20 100644
--- a/internal/dispatch/retry.go
+++ b/internal/dispatch/retry.go
@@ -230,7 +230,10 @@ func classifyRetryAttempt(subject beads.Bead) retryEvalResult {
 	switch outcome {
 	case "pass":
 		if strings.TrimSpace(subject.Metadata["gc.failure_class"]) != "" || strings.TrimSpace(subject.Metadata["gc.failure_reason"]) != "" {
-			return retryEvalResult{Outcome: "hard", Reason: "invalid_worker_result_contract"}
+			return retryEvalResult{Outcome: "transient", Reason: "pass_with_failure_metadata"}
+		}
+		if strings.TrimSpace(subject.Metadata["gc.output_json_required"]) == "true" && strings.TrimSpace(subject.Metadata["gc.output_json"]) == "" {
+			return retryEvalResult{Outcome: "transient", Reason: "missing_required_output_json"}
 		}
 		return retryEvalResult{Outcome: "pass"}
 	case "fail":
@@ -240,12 +243,12 @@ func classifyRetryAttempt(subject beads.Bead) retryEvalResult {
 		case "hard", "":
 			return retryEvalResult{Outcome: "hard", Reason: retryFailureReason(subject)}
 		default:
-			return retryEvalResult{Outcome: "hard", Reason: "invalid_worker_result_contract"}
+			return retryEvalResult{Outcome: "transient", Reason: "unknown_failure_class"}
 		}
 	case "":
-		return retryEvalResult{Outcome: "hard", Reason: "invalid_worker_result_contract"}
+		return retryEvalResult{Outcome: "transient", Reason: "missing_outcome"}
 	default:
-		return retryEvalResult{Outcome: "hard", Reason: "invalid_worker_result_contract"}
+		return retryEvalResult{Outcome: "transient", Reason: "invalid_outcome_value"}
 	}
 }
 
diff --git a/internal/dispatch/retry_test.go b/internal/dispatch/retry_test.go
index c2bd192543..661f9be32d 100644
--- a/internal/dispatch/retry_test.go
+++ b/internal/dispatch/retry_test.go
@@ -1,7 +1,6 @@
 package dispatch
 
 import (
-	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -86,6 +85,101 @@ func TestProcessRetryEvalPassClosesLogical(t *testing.T) {
 	}
 }
 
+func TestProcessRetryEvalRetriesPassMissingRequiredOutputJSON(t *testing.T) {
+	t.Parallel()
+
+	store := newStrictCloseStore()
+	root := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	logical := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "prepare review items",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                 "retry",
+			"gc.root_bead_id":         root.ID,
+			"gc.step_ref":             "demo.prepare-review-items",
+			"gc.max_attempts":         "3",
+			"gc.on_exhausted":         "hard_fail",
+			"gc.output_json_required": "true",
+		},
+	})
+	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare review items attempt 1",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.kind":                 "retry-run",
+			"gc.root_bead_id":         root.ID,
+			"gc.step_ref":             "demo.prepare-review-items.run.1",
+			"gc.logical_bead_id":      logical.ID,
+			"gc.attempt":              "1",
+			"gc.max_attempts":         "3",
+			"gc.on_exhausted":         "hard_fail",
+			"gc.outcome":              "pass",
+			"gc.output_json_required": "true",
+		},
+	})
+	eval1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "prepare review items eval 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "retry-eval",
+			"gc.root_bead_id":    root.ID,
+			"gc.step_ref":        "demo.prepare-review-items.eval.1",
+			"gc.logical_bead_id": logical.ID,
+			"gc.attempt":         "1",
+			"gc.max_attempts":    "3",
+			"gc.on_exhausted":    "hard_fail",
+		},
+	})
+	mustDepAdd(t, store, logical.ID, eval1.ID, "blocks")
+	mustDepAdd(t, store, eval1.ID, run1.ID, "blocks")
+
+	result, err := ProcessControl(store, eval1, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(retry-eval missing output_json): %v", err)
+	}
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	evalAfter := mustGetBead(t, store, eval1.ID)
+	if evalAfter.Status != "closed" || evalAfter.Metadata["gc.outcome"] != "fail" {
+		t.Fatalf("eval = status %q outcome %q, want closed/fail", evalAfter.Status, evalAfter.Metadata["gc.outcome"])
+	}
+	if evalAfter.Metadata["gc.failure_class"] != "transient" {
+		t.Fatalf("eval gc.failure_class = %q, want transient", evalAfter.Metadata["gc.failure_class"])
+	}
+	if evalAfter.Metadata["gc.failure_reason"] != "missing_required_output_json" {
+		t.Fatalf("eval gc.failure_reason = %q, want missing_required_output_json", evalAfter.Metadata["gc.failure_reason"])
+	}
+
+	logicalAfter := mustGetBead(t, store, logical.ID)
+	if logicalAfter.Status != "open" {
+		t.Fatalf("logical status = %q, want open", logicalAfter.Status)
+	}
+
+	var run2 beads.Bead
+	all, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("ListOpen(): %v", err)
+	}
+	for _, bead := range all {
+		if bead.Metadata["gc.step_ref"] == "demo.prepare-review-items.run.2" {
+			run2 = bead
+		}
+	}
+	if run2.ID == "" {
+		t.Fatal("missing retry run 2")
+	}
+}
+
 func TestProcessRetryEvalPassPropagatesNonGCMetadataToLogical(t *testing.T) {
 	t.Parallel()
 
@@ -587,7 +681,7 @@ func TestProcessRetryEvalStaleAttemptFinalizesNoop(t *testing.T) {
 	}
 }
 
-func TestProcessRetryEvalRejectsInvalidWorkerResultContract(t *testing.T) {
+func TestProcessRetryEvalRetriesInvalidWorkerResultContract(t *testing.T) {
 	t.Parallel()
 
 	store := newStrictCloseStore()
@@ -644,16 +738,201 @@ func TestProcessRetryEvalRejectsInvalidWorkerResultContract(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ProcessControl(retry-eval invalid contract): %v", err)
 	}
-	if !result.Processed || result.Action != "hard-fail" {
-		t.Fatalf("result = %+v, want processed hard-fail", result)
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	logicalAfter := mustGetBead(t, store, logical.ID)
+	if logicalAfter.Status == "closed" {
+		t.Fatalf("logical status = closed, want open for retry")
+	}
+	if logicalAfter.Metadata["gc.failure_reason"] != "missing_outcome" {
+		t.Fatalf("logical gc.failure_reason = %q, want missing_outcome", logicalAfter.Metadata["gc.failure_reason"])
+	}
+	if logicalAfter.Metadata["gc.retry_count"] != "1" {
+		t.Fatalf("logical gc.retry_count = %q, want 1", logicalAfter.Metadata["gc.retry_count"])
+	}
+}
+
+func TestProcessRetryEvalExhaustsInvalidWorkerResultContract(t *testing.T) {
+	t.Parallel()
+
+	store := newStrictCloseStore()
+	root := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	logical := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "retry",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "demo.review",
+			"gc.max_attempts": "2",
+			"gc.on_exhausted": "hard_fail",
+		},
+	})
+	run2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "review attempt 2",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.kind":            "retry-run",
+			"gc.root_bead_id":    root.ID,
+			"gc.step_ref":        "demo.review.run.2",
+			"gc.logical_bead_id": logical.ID,
+			"gc.attempt":         "2",
+			"gc.max_attempts":    "2",
+			"gc.on_exhausted":    "hard_fail",
+		},
+	})
+	eval2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review eval 2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "retry-eval",
+			"gc.root_bead_id":    root.ID,
+			"gc.step_ref":        "demo.review.eval.2",
+			"gc.logical_bead_id": logical.ID,
+			"gc.attempt":         "2",
+			"gc.max_attempts":    "2",
+			"gc.on_exhausted":    "hard_fail",
+		},
+	})
+	mustDepAdd(t, store, logical.ID, eval2.ID, "blocks")
+	mustDepAdd(t, store, eval2.ID, run2.ID, "blocks")
+
+	result, err := ProcessControl(store, eval2, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(retry-eval exhausted invalid contract): %v", err)
+	}
+	if !result.Processed || result.Action != "fail" {
+		t.Fatalf("result = %+v, want processed fail", result)
 	}
 
 	logicalAfter := mustGetBead(t, store, logical.ID)
 	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "fail" {
 		t.Fatalf("logical = status %q outcome %q, want closed/fail", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
 	}
-	if !strings.Contains(logicalAfter.Metadata["gc.failure_reason"], "invalid_worker_result_contract") {
-		t.Fatalf("logical gc.failure_reason = %q, want invalid_worker_result_contract", logicalAfter.Metadata["gc.failure_reason"])
+	if logicalAfter.Metadata["gc.failure_class"] != "transient" {
+		t.Fatalf("logical gc.failure_class = %q, want transient", logicalAfter.Metadata["gc.failure_class"])
+	}
+	if logicalAfter.Metadata["gc.failure_reason"] != "missing_outcome" {
+		t.Fatalf("logical gc.failure_reason = %q, want missing_outcome", logicalAfter.Metadata["gc.failure_reason"])
+	}
+}
+
+func TestProcessRetryEvalRetriesDistinctInvalidWorkerResultContracts(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name   string
+		meta   map[string]string
+		reason string
+	}{
+		{
+			name: "pass with failure metadata",
+			meta: map[string]string{
+				"gc.outcome":        "pass",
+				"gc.failure_class":  "transient",
+				"gc.failure_reason": "rate_limited",
+			},
+			reason: "pass_with_failure_metadata",
+		},
+		{
+			name: "fail with unknown failure class",
+			meta: map[string]string{
+				"gc.outcome":        "fail",
+				"gc.failure_class":  "mystery",
+				"gc.failure_reason": "weird",
+			},
+			reason: "unknown_failure_class",
+		},
+		{
+			name: "unknown outcome value",
+			meta: map[string]string{
+				"gc.outcome": "maybe",
+			},
+			reason: "invalid_outcome_value",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newStrictCloseStore()
+			root := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title: "workflow",
+				Type:  "task",
+				Metadata: map[string]string{
+					"gc.kind":             "workflow",
+					"gc.formula_contract": "graph.v2",
+				},
+			})
+			logical := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title: "review",
+				Type:  "task",
+				Metadata: map[string]string{
+					"gc.kind":         "retry",
+					"gc.root_bead_id": root.ID,
+					"gc.step_ref":     "demo.review",
+					"gc.max_attempts": "3",
+					"gc.on_exhausted": "hard_fail",
+				},
+			})
+			run1Meta := map[string]string{
+				"gc.kind":            "retry-run",
+				"gc.root_bead_id":    root.ID,
+				"gc.step_ref":        "demo.review.run.1",
+				"gc.logical_bead_id": logical.ID,
+				"gc.attempt":         "1",
+				"gc.max_attempts":    "3",
+				"gc.on_exhausted":    "hard_fail",
+			}
+			for key, value := range tc.meta {
+				run1Meta[key] = value
+			}
+			run1 := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title:    "review attempt 1",
+				Type:     "task",
+				Status:   "closed",
+				Metadata: run1Meta,
+			})
+			eval1 := mustCreateWorkflowBead(t, store, beads.Bead{
+				Title: "review eval 1",
+				Type:  "task",
+				Metadata: map[string]string{
+					"gc.kind":            "retry-eval",
+					"gc.root_bead_id":    root.ID,
+					"gc.step_ref":        "demo.review.eval.1",
+					"gc.logical_bead_id": logical.ID,
+					"gc.attempt":         "1",
+					"gc.max_attempts":    "3",
+					"gc.on_exhausted":    "hard_fail",
+				},
+			})
+			mustDepAdd(t, store, logical.ID, eval1.ID, "blocks")
+			mustDepAdd(t, store, eval1.ID, run1.ID, "blocks")
+
+			result, err := ProcessControl(store, eval1, ProcessOptions{})
+			if err != nil {
+				t.Fatalf("ProcessControl(retry-eval %s): %v", tc.name, err)
+			}
+			if !result.Processed || result.Action != "retry" {
+				t.Fatalf("result = %+v, want processed retry", result)
+			}
+
+			logicalAfter := mustGetBead(t, store, logical.ID)
+			if logicalAfter.Metadata["gc.failure_reason"] != tc.reason {
+				t.Fatalf("logical gc.failure_reason = %q, want %q", logicalAfter.Metadata["gc.failure_reason"], tc.reason)
+			}
+		})
 	}
 }
 
diff --git a/internal/dispatch/runtime.go b/internal/dispatch/runtime.go
index ae4cb69b82..5d0c6557f8 100644
--- a/internal/dispatch/runtime.go
+++ b/internal/dispatch/runtime.go
@@ -6,9 +6,11 @@ import (
 	"sort"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/formula"
+	"github.com/gastownhall/gascity/internal/sourceworkflow"
 )
 
 // ControlResult reports whether a control bead was processed and what it did.
@@ -19,13 +21,37 @@ type ControlResult struct {
 	Skipped   int
 }
 
+// SourceWorkflowStore identifies a store that may contain workflow roots for
+// source-workflow singleton checks.
+type SourceWorkflowStore struct {
+	Store    beads.Store
+	StoreRef string
+}
+
 // ProcessOptions provides control-dispatcher execution context.
 type ProcessOptions struct {
 	CityPath           string
+	StorePath          string
 	FormulaSearchPaths []string
 	PrepareFragment    func(*formula.FragmentRecipe, beads.Bead) error
 	RecycleSession     func(beads.Bead) error
-	Tracef             func(format string, args ...any)
+	// ResolveStoreRef opens the bead store identified by a gc.source_store_ref
+	// value (e.g. "city:foo", "rig:alpha"). Used by processWorkflowFinalize to
+	// propagate successful workflow completion across store boundaries: when
+	// a graph workflow finalizes with outcome=pass, every parent source bead
+	// linked via gc.source_bead_id+gc.source_store_ref is also closed in its
+	// native store. May be nil - in which case cross-store propagation is
+	// silently skipped (single-store callers, tests without resolvers, etc.).
+	ResolveStoreRef func(ref string) (beads.Store, error)
+	// SourceWorkflowLock serializes source-bead mutation with graph workflow
+	// launch/recovery for the same store ref and source bead ID. May be nil
+	// for single-process tests and callers without cross-store propagation.
+	SourceWorkflowLock func(storeRef, sourceBeadID string, fn func() error) error
+	// SourceWorkflowStores returns every store that may contain live workflow
+	// roots. When set, workflow-finalize uses it to avoid closing a source bead
+	// while any live root in another store still references that source.
+	SourceWorkflowStores func() ([]SourceWorkflowStore, error)
+	Tracef               func(format string, args ...any)
 }
 
 var (
@@ -33,6 +59,13 @@ var (
 	errScopeBodyMissing = errors.New("scope body missing")
 )
 
+const (
+	maxSourceChainHops               = 32
+	maxWorkflowFinalizeErrorMetadata = 512
+)
+
+const workflowFinalizeErrorMetadataKey = "gc.last_finalize_error"
+
 // ErrControlPending reports that a control bead is not yet processable but
 // should be retried later.
 var ErrControlPending = errors.New("workflow control pending")
@@ -76,7 +109,7 @@ func ProcessControl(store beads.Store, bead beads.Bead, opts ProcessOptions) (Co
 	case "scope-check":
 		return processScopeCheck(store, bead, opts)
 	case "workflow-finalize":
-		return processWorkflowFinalize(store, bead)
+		return processWorkflowFinalize(store, bead, opts)
 	default:
 		return ControlResult{}, fmt.Errorf("%s: unsupported control bead kind %q", bead.ID, bead.Metadata["gc.kind"])
 	}
@@ -132,19 +165,15 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 	if scopeRef == "" {
 		return ControlResult{}, fmt.Errorf("%s: missing gc.scope_ref", bead.ID)
 	}
-
-	snapshot, err := tracePhase(opts, bead.ID, "load-snapshot", func() (scopeSnapshot, error) {
-		return loadScopeSnapshot(store, rootID, scopeRef)
+	body, err := tracePhase(opts, bead.ID, "resolve-body", func() (beads.Bead, error) {
+		return resolveScopeBody(store, rootID, scopeRef)
 	})
 	if err != nil {
 		if errors.Is(err, errScopeBodyMissing) {
 			return ControlResult{}, ErrControlPending
 		}
-		return ControlResult{}, fmt.Errorf("%s: loading scope snapshot for %s: %w", bead.ID, scopeRef, err)
+		return ControlResult{}, fmt.Errorf("%s: loading scope body for %s: %w", bead.ID, scopeRef, err)
 	}
-	opts.tracef("scope-check bead=%s snapshot root=%s scope=%s all=%d members=%d body=%s subject=%s outcome=%s",
-		bead.ID, rootID, scopeRef, len(snapshot.all), len(snapshot.members), snapshot.body.ID, subject.ID, subject.Metadata["gc.outcome"])
-	body := snapshot.body
 
 	if isRetryAttemptSubject(subject) {
 		if err := tracePhaseErr(opts, bead.ID, "close-control", func() error {
@@ -152,9 +181,18 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 		}); err != nil {
 			return ControlResult{}, fmt.Errorf("%s: completing retry-attempt control bead: %w", bead.ID, err)
 		}
-		remainingOpen := snapshot.hasOpenScopeMembers(bead.ID)
+		remainingOpen, err := tracePhase(opts, bead.ID, "check-open-members", func() (bool, error) {
+			return hasOpenScopeMembers(store, rootID, scopeRef, bead.ID)
+		})
+		if err != nil {
+			return ControlResult{}, fmt.Errorf("%s: checking scope completion: %w", bead.ID, err)
+		}
 		opts.tracef("scope-check bead=%s phase=check-remaining-open remaining_open=%t ignore=%s", bead.ID, remainingOpen, bead.ID)
 		if !remainingOpen {
+			snapshot, err := loadScopeSnapshotForControl(store, rootID, scopeRef, body, subject, bead.ID, opts)
+			if err != nil {
+				return ControlResult{}, err
+			}
 			outputJSON, err := tracePhase(opts, bead.ID, "resolve-output", func() (string, error) {
 				return snapshot.resolveScopeOutputJSON(subject)
 			})
@@ -196,6 +234,10 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 	}
 
 	if subject.Metadata["gc.outcome"] == "fail" {
+		snapshot, err := loadScopeSnapshotForControl(store, rootID, scopeRef, body, subject, bead.ID, opts)
+		if err != nil {
+			return ControlResult{}, err
+		}
 		skipped, err := tracePhase(opts, bead.ID, "skip-open-members", func() (int, error) {
 			return snapshot.skipOpenScopeMembers(store, bead.ID)
 		})
@@ -223,9 +265,18 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 		return ControlResult{}, fmt.Errorf("%s: completing control bead: %w", bead.ID, err)
 	}
 
-	remainingOpen := snapshot.hasOpenScopeMembers(bead.ID)
+	remainingOpen, err := tracePhase(opts, bead.ID, "check-open-members", func() (bool, error) {
+		return hasOpenScopeMembers(store, rootID, scopeRef, bead.ID)
+	})
+	if err != nil {
+		return ControlResult{}, fmt.Errorf("%s: checking scope completion: %w", bead.ID, err)
+	}
 	opts.tracef("scope-check bead=%s phase=check-remaining-open remaining_open=%t ignore=%s", bead.ID, remainingOpen, bead.ID)
 	if !remainingOpen {
+		snapshot, err := loadScopeSnapshotForControl(store, rootID, scopeRef, body, subject, bead.ID, opts)
+		if err != nil {
+			return ControlResult{}, err
+		}
 		// Propagate non-gc metadata from scope members to the scope body.
 		// This enables compositional metadata bubbling: attempt → retry →
 		// scope → ralph → parent scope, etc.
@@ -266,41 +317,91 @@ func processScopeCheck(store beads.Store, bead beads.Bead, opts ProcessOptions)
 	return ControlResult{Processed: true, Action: "continue"}, nil
 }
 
+func loadScopeSnapshotForControl(store beads.Store, rootID, scopeRef string, body, subject beads.Bead, controlID string, opts ProcessOptions) (scopeSnapshot, error) {
+	snapshot, err := tracePhase(opts, controlID, "load-snapshot", func() (scopeSnapshot, error) {
+		return loadScopeSnapshotWithBody(store, rootID, scopeRef, body)
+	})
+	if err != nil {
+		if errors.Is(err, errScopeBodyMissing) {
+			return scopeSnapshot{}, ErrControlPending
+		}
+		return scopeSnapshot{}, fmt.Errorf("%s: loading scope snapshot for %s: %w", controlID, scopeRef, err)
+	}
+	opts.tracef("scope-check bead=%s snapshot root=%s scope=%s all=%d members=%d body=%s subject=%s outcome=%s",
+		controlID, rootID, scopeRef, len(snapshot.all), len(snapshot.members), snapshot.body.ID, subject.ID, subject.Metadata["gc.outcome"])
+	return snapshot, nil
+}
+
 type scopeSnapshot struct {
-	rootID   string
-	scopeRef string
-	all      []beads.Bead
-	members  []beads.Bead
-	body     beads.Bead
+	rootID      string
+	scopeRef    string
+	all         []beads.Bead
+	allComplete bool
+	members     []beads.Bead
+	body        beads.Bead
 }
 
 func loadScopeSnapshot(store beads.Store, rootID, scopeRef string) (scopeSnapshot, error) {
-	all, err := listByWorkflowRoot(store, rootID)
+	body, err := resolveScopeBody(store, rootID, scopeRef)
+	if err != nil {
+		return scopeSnapshot{}, err
+	}
+	return loadScopeSnapshotWithBody(store, rootID, scopeRef, body)
+}
+
+func loadScopeSnapshotWithBody(store beads.Store, rootID, scopeRef string, body beads.Bead) (scopeSnapshot, error) {
+	members, err := listByWorkflowRootAndScope(store, rootID, scopeRef)
 	if err != nil {
 		return scopeSnapshot{}, err
 	}
 	snapshot := scopeSnapshot{
 		rootID:   rootID,
 		scopeRef: scopeRef,
-		all:      all,
+		members:  members,
+		body:     body,
 	}
-	bodyFound := false
-	for _, bead := range all {
-		if bead.Metadata["gc.root_bead_id"] != rootID {
+	snapshot.all = mergeScopeSnapshotBeads(snapshot.members, snapshot.body)
+	return snapshot, nil
+}
+
+func listByWorkflowRootAndScope(store beads.Store, rootID, scopeRef string) ([]beads.Bead, error) {
+	return store.List(beads.ListQuery{
+		Metadata: map[string]string{
+			"gc.root_bead_id": rootID,
+			"gc.scope_ref":    scopeRef,
+		},
+		IncludeClosed: true,
+	})
+}
+
+func listActiveByWorkflowRootAndScope(store beads.Store, rootID, scopeRef string) ([]beads.Bead, error) {
+	return store.List(beads.ListQuery{
+		Metadata: map[string]string{
+			"gc.root_bead_id": rootID,
+			"gc.scope_ref":    scopeRef,
+		},
+	})
+}
+
+func mergeScopeSnapshotBeads(members []beads.Bead, body beads.Bead) []beads.Bead {
+	out := make([]beads.Bead, 0, len(members)+1)
+	seen := make(map[string]struct{}, len(members)+1)
+	for _, bead := range members {
+		if bead.ID == "" {
 			continue
 		}
-		if bead.Metadata["gc.scope_ref"] == scopeRef {
-			snapshot.members = append(snapshot.members, bead)
-		}
-		if !bodyFound && bead.Metadata["gc.kind"] == "scope" && matchesScopeRef(bead, scopeRef) {
-			snapshot.body = bead
-			bodyFound = true
+		if _, ok := seen[bead.ID]; ok {
+			continue
 		}
+		out = append(out, bead)
+		seen[bead.ID] = struct{}{}
 	}
-	if !bodyFound {
-		return scopeSnapshot{}, fmt.Errorf("%w: scope %q not found under root %s", errScopeBodyMissing, scopeRef, rootID)
+	if body.ID != "" {
+		if _, ok := seen[body.ID]; !ok {
+			out = append(out, body)
+		}
 	}
-	return snapshot, nil
+	return out
 }
 
 func (s scopeSnapshot) hasOpenScopeMembers(ignoreIDs ...string) bool {
@@ -321,6 +422,9 @@ func (s scopeSnapshot) hasOpenScopeMembers(ignoreIDs ...string) bool {
 		if _, skip := ignored[member.ID]; skip {
 			continue
 		}
+		if member.Metadata["gc.kind"] == "spec" {
+			continue
+		}
 		switch member.Metadata["gc.scope_role"] {
 		case "body", "teardown":
 			continue
@@ -331,6 +435,14 @@ func (s scopeSnapshot) hasOpenScopeMembers(ignoreIDs ...string) bool {
 	return false
 }
 
+func hasOpenScopeMembers(store beads.Store, rootID, scopeRef string, ignoreIDs ...string) (bool, error) {
+	members, err := listActiveByWorkflowRootAndScope(store, rootID, scopeRef)
+	if err != nil {
+		return false, err
+	}
+	return scopeSnapshot{members: members}.hasOpenScopeMembers(ignoreIDs...), nil
+}
+
 func (s scopeSnapshot) propagateScopeMemberMetadata(store beads.Store, bodyID string) error {
 	batch := map[string]string{}
 	for _, member := range s.members {
@@ -380,11 +492,22 @@ func (s scopeSnapshot) resolveScopeOutputJSON(subject beads.Bead) (string, error
 }
 
 func (s scopeSnapshot) skipOpenScopeMembers(store beads.Store, skipControlID string) (int, error) {
+	all := s.all
+	if !s.allComplete {
+		loaded, err := listByWorkflowRoot(store, s.rootID)
+		if err != nil {
+			return 0, err
+		}
+		all = loaded
+	}
 	pending := make(map[string]beads.Bead)
 	for _, member := range s.members {
 		if member.ID == skipControlID || member.Status != "open" {
 			continue
 		}
+		if member.Metadata["gc.kind"] == "spec" {
+			continue
+		}
 		switch member.Metadata["gc.scope_role"] {
 		case "body", "teardown":
 			continue
@@ -401,7 +524,7 @@ func (s scopeSnapshot) skipOpenScopeMembers(store beads.Store, skipControlID str
 		case "body", "teardown":
 			continue
 		}
-		for _, candidate := range s.all {
+		for _, candidate := range all {
 			if candidate.Status != "open" {
 				continue
 			}
@@ -466,7 +589,7 @@ func isRetryAttemptSubject(subject beads.Bead) bool {
 	return false
 }
 
-func processWorkflowFinalize(store beads.Store, bead beads.Bead) (ControlResult, error) {
+func processWorkflowFinalize(store beads.Store, bead beads.Bead, opts ProcessOptions) (ControlResult, error) {
 	rootID := bead.Metadata["gc.root_bead_id"]
 	if rootID == "" {
 		return ControlResult{}, fmt.Errorf("%s: missing gc.root_bead_id", bead.ID)
@@ -480,20 +603,376 @@ func processWorkflowFinalize(store beads.Store, bead beads.Bead) (ControlResult,
 		return ControlResult{}, fmt.Errorf("%s: resolving workflow outcome: %w", bead.ID, err)
 	}
 
+	// On success, propagate the closure across the gc.source_bead_id chain so
+	// parent source beads in other stores (e.g. the city-scope "Adopt PR"
+	// request that spawned a rig-scope mol-adopt-pr-v2 workflow) don't accumulate
+	// as orphans. Failures intentionally leave parent sources open so a human
+	// can investigate via list - the bead IS the audit handle.
+	if outcome == "pass" {
+		if err := preflightSourceBeadChain(store, rootID, opts); err != nil {
+			return ControlResult{}, recordWorkflowFinalizeError(store, bead.ID, fmt.Errorf("%s: preflighting source bead chain: %w", rootID, err))
+		}
+	}
 	// Close the root BEFORE the finalize bead. If the root close fails and
 	// the control-dispatcher crashes, the finalize bead stays open so the
-	// next serve cycle will retry. Closing the finalize first would make it
-	// non-retriable (ProcessControl skips closed beads), stranding the root
-	// as in_progress forever.
+	// next serve cycle will retry. Source-chain propagation is preflighted first
+	// so retryable scan failures keep the root live for singleton scans, but
+	// source beads are not mutated until the root is durably closed.
 	if err := setOutcomeAndClose(store, rootID, outcome); err != nil {
-		return ControlResult{}, fmt.Errorf("%s: completing workflow head: %w", rootID, err)
+		if errors.Is(err, beads.ErrNotFound) {
+			if closeErr := setOutcomeAndClose(store, bead.ID, "missing_root"); closeErr != nil {
+				return ControlResult{}, recordWorkflowFinalizeError(store, bead.ID, fmt.Errorf("%s: closing orphaned finalizer (root %s missing): %w", bead.ID, rootID, closeErr))
+			}
+			return ControlResult{Processed: true, Action: "workflow-missing_root"}, nil
+		}
+		return ControlResult{}, recordWorkflowFinalizeError(store, bead.ID, fmt.Errorf("%s: completing workflow head: %w", rootID, err))
+	}
+	if outcome == "pass" {
+		if err := closeSourceBeadChain(store, rootID, opts); err != nil {
+			return ControlResult{}, recordWorkflowFinalizeError(store, bead.ID, fmt.Errorf("%s: closing source bead chain: %w", rootID, err))
+		}
 	}
 	if err := setOutcomeAndClose(store, bead.ID, "pass"); err != nil {
-		return ControlResult{}, fmt.Errorf("%s: completing workflow finalizer: %w", bead.ID, err)
+		return ControlResult{}, recordWorkflowFinalizeError(store, bead.ID, fmt.Errorf("%s: completing workflow finalizer: %w", bead.ID, err))
 	}
 	return ControlResult{Processed: true, Action: "workflow-" + outcome}, nil
 }
 
+func preflightSourceBeadChain(rootStore beads.Store, rootID string, opts ProcessOptions) error {
+	return walkSourceBeadChain(rootStore, rootID, opts, false)
+}
+
+// closeSourceBeadChain walks gc.source_bead_id / gc.source_store_ref upward
+// from the just-finalized workflow root and closes every parent source bead
+// in its native store. A missing resolver for a cross-store ref, a deleted
+// parent, or a cycle stops the walk as a traced no-op.
+// Resolver, store read, and close failures are returned so the finalizer stays
+// open for retry. This is what makes "Adopt PR" city-scope source beads
+// disappear from the human-visible queue once the rig-scope workflow merges.
+func closeSourceBeadChain(rootStore beads.Store, rootID string, opts ProcessOptions) error {
+	return walkSourceBeadChain(rootStore, rootID, opts, true)
+}
+
+func walkSourceBeadChain(rootStore beads.Store, rootID string, opts ProcessOptions, mutate bool) error {
+	currentStore := rootStore
+	currentID := rootID
+	currentRef := ""
+	excludeRootSourceRef := ""
+	resolvedStores := make(map[string]beads.Store)
+	visited := make(map[string]bool)
+	for hop := 0; hop < maxSourceChainHops; hop++ {
+		current, err := currentStore.Get(currentID)
+		if err != nil {
+			if errors.Is(err, beads.ErrNotFound) {
+				opts.tracef("close-source-chain root=%s stop reason=deleted_current at_id=%s ref=%s", rootID, currentID, sourceChainStoreLabel(currentRef))
+				return nil
+			}
+			return fmt.Errorf("getting source chain bead %s in %s: %w", currentID, sourceChainStoreLabel(currentRef), err)
+		}
+		if currentID == rootID && currentRef == "" {
+			excludeRootSourceRef = strings.TrimSpace(current.Metadata[sourceworkflow.SourceStoreRefMetadataKey])
+		}
+		nextID := strings.TrimSpace(current.Metadata["gc.source_bead_id"])
+		if nextID == "" {
+			opts.tracef("close-source-chain root=%s stop reason=no_source at_id=%s ref=%s", rootID, currentID, sourceChainStoreLabel(currentRef))
+			return nil
+		}
+		nextRef := strings.TrimSpace(current.Metadata[sourceworkflow.SourceStoreRefMetadataKey])
+		effectiveRef := currentRef
+		nextStore := currentStore
+		if nextRef != "" {
+			effectiveRef = nextRef
+			if opts.ResolveStoreRef == nil {
+				opts.tracef("close-source-chain root=%s stop reason=missing_resolver source=%s ref=%s", rootID, nextID, sourceChainStoreLabel(effectiveRef))
+				return nil
+			}
+			resolved, ok := resolvedStores[nextRef]
+			if !ok {
+				resolvedStore, err := opts.ResolveStoreRef(nextRef)
+				if err != nil {
+					return fmt.Errorf("resolving source store %q: %w", nextRef, err)
+				}
+				if resolvedStore == nil {
+					return fmt.Errorf("resolving source store %q: nil store", nextRef)
+				}
+				resolved = resolvedStore
+				resolvedStores[nextRef] = resolvedStore
+			}
+			nextStore = resolved
+		}
+		key := sourceChainKey(effectiveRef, nextID)
+		if visited[key] {
+			opts.tracef("close-source-chain root=%s stop reason=cycle source=%s ref=%s", rootID, nextID, sourceChainStoreLabel(effectiveRef))
+			return nil
+		}
+		visited[key] = true
+
+		var stopWalk bool
+		loadAndClose := func() error {
+			loaded, err := nextStore.Get(nextID)
+			if err != nil {
+				if errors.Is(err, beads.ErrNotFound) {
+					opts.tracef("close-source-chain root=%s stop reason=deleted_parent source=%s ref=%s", rootID, nextID, sourceChainStoreLabel(effectiveRef))
+					stopWalk = true
+					return nil
+				}
+				return fmt.Errorf("getting source bead %s in %s: %w", nextID, sourceChainStoreLabel(effectiveRef), err)
+			}
+			liveRoots, err := listLiveSourceWorkflowRoots(nextStore, nextID, effectiveRef, rootID, excludeRootSourceRef, opts)
+			if err != nil {
+				return fmt.Errorf("listing live workflows for source bead %s in %s: %w", nextID, sourceChainStoreLabel(effectiveRef), err)
+			}
+			if len(liveRoots) > 0 {
+				opts.tracef("close-source-chain root=%s stop reason=live_child_workflow source=%s ref=%s live_roots=%s", rootID, nextID, sourceChainStoreLabel(effectiveRef), sourceChainRootIDs(liveRoots))
+				stopWalk = true
+				return nil
+			}
+			if !mutate {
+				return nil
+			}
+			if err := propagateSourceBeadTerminalMetadata(nextStore, loaded.ID, current.Metadata); err != nil {
+				return fmt.Errorf("propagating source bead metadata %s in %s: %w", nextID, sourceChainStoreLabel(effectiveRef), err)
+			}
+			if loaded.Status == "closed" {
+				opts.tracef("close-source-chain root=%s skip reason=already_closed source=%s ref=%s", rootID, nextID, sourceChainStoreLabel(effectiveRef))
+				return nil
+			}
+			if err := closeSourceBeadPreservingOutcome(nextStore, loaded); err != nil {
+				return fmt.Errorf("closing source bead %s in %s: %w", nextID, sourceChainStoreLabel(effectiveRef), err)
+			}
+			opts.tracef("close-source-chain root=%s closed source=%s ref=%s preserved_outcome=%t", rootID, nextID, sourceChainStoreLabel(effectiveRef), strings.TrimSpace(loaded.Metadata["gc.outcome"]) != "")
+			return nil
+		}
+		if mutate && opts.SourceWorkflowLock != nil {
+			if err := opts.SourceWorkflowLock(effectiveRef, nextID, loadAndClose); err != nil {
+				return fmt.Errorf("locking source bead %s in %s: %w", nextID, sourceChainStoreLabel(effectiveRef), err)
+			}
+		} else if err := loadAndClose(); err != nil {
+			return err
+		}
+		if stopWalk {
+			return nil
+		}
+		currentStore = nextStore
+		currentID = nextID
+		currentRef = effectiveRef
+	}
+	err := fmt.Errorf("source chain depth limit reached after %d hops", maxSourceChainHops)
+	opts.tracef("close-source-chain root=%s stop reason=depth_limit max_hops=%d", rootID, maxSourceChainHops)
+	return err
+}
+
+func listLiveSourceWorkflowRoots(fallbackStore beads.Store, sourceBeadID, sourceStoreRef, excludeRootID, excludeRootSourceRef string, opts ProcessOptions) ([]beads.Bead, error) {
+	stores, err := sourceWorkflowStoresForLiveRootScan(fallbackStore, sourceStoreRef, opts)
+	if err != nil {
+		return nil, err
+	}
+	roots := make([]beads.Bead, 0)
+	seenRoots := make(map[string]struct{}, len(stores))
+	visitedSources := make(map[string]struct{})
+	var collect func(string, string) error
+	collect = func(currentSourceID, currentSourceStoreRef string) error {
+		currentSourceID = strings.TrimSpace(currentSourceID)
+		if currentSourceID == "" {
+			return nil
+		}
+		for i, info := range stores {
+			if info.Store == nil {
+				continue
+			}
+			rootStoreRef := strings.TrimSpace(info.StoreRef)
+			sourceVisitKey := sourceWorkflowScanKey(rootStoreRef, currentSourceStoreRef, currentSourceID, i)
+			if _, ok := visitedSources[sourceVisitKey]; ok {
+				continue
+			}
+			visitedSources[sourceVisitKey] = struct{}{}
+			matches, err := sourceworkflow.ListLiveRoots(info.Store, currentSourceID, currentSourceStoreRef, rootStoreRef)
+			if err != nil {
+				return fmt.Errorf("listing live workflows in %s: %w", sourceChainStoreLabel(rootStoreRef), err)
+			}
+			matches = withoutSourceWorkflowRoot(matches, excludeRootID, excludeRootSourceRef)
+			for _, root := range matches {
+				rootKey := sourceWorkflowRootKey(rootStoreRef, root.ID, i)
+				if _, ok := seenRoots[rootKey]; ok {
+					continue
+				}
+				seenRoots[rootKey] = struct{}{}
+				roots = append(roots, root)
+			}
+			children, err := sourceWorkflowChildSources(info.Store, currentSourceID, currentSourceStoreRef, rootStoreRef)
+			if err != nil {
+				return fmt.Errorf("listing source workflow children in %s: %w", sourceChainStoreLabel(rootStoreRef), err)
+			}
+			for _, child := range children {
+				if err := collect(child.ID, rootStoreRef); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	}
+	if err := collect(sourceBeadID, sourceStoreRef); err != nil {
+		return nil, err
+	}
+	return roots, nil
+}
+
+func sourceWorkflowStoresForLiveRootScan(fallbackStore beads.Store, sourceStoreRef string, opts ProcessOptions) ([]SourceWorkflowStore, error) {
+	if opts.SourceWorkflowStores == nil {
+		return []SourceWorkflowStore{{Store: fallbackStore, StoreRef: strings.TrimSpace(sourceStoreRef)}}, nil
+	}
+	stores, err := opts.SourceWorkflowStores()
+	if err != nil {
+		return nil, err
+	}
+	scanned := make([]SourceWorkflowStore, 0, len(stores))
+	for _, info := range stores {
+		if info.Store == nil {
+			continue
+		}
+		info.StoreRef = strings.TrimSpace(info.StoreRef)
+		scanned = append(scanned, info)
+	}
+	if len(scanned) == 0 {
+		return []SourceWorkflowStore{{Store: fallbackStore, StoreRef: strings.TrimSpace(sourceStoreRef)}}, nil
+	}
+	return scanned, nil
+}
+
+func sourceWorkflowChildSources(store beads.Store, sourceBeadID, sourceStoreRef, rootStoreRef string) ([]beads.Bead, error) {
+	sourceBeadID = strings.TrimSpace(sourceBeadID)
+	if store == nil || sourceBeadID == "" {
+		return nil, nil
+	}
+	candidates, err := store.List(beads.ListQuery{
+		IncludeClosed: true,
+		Metadata: map[string]string{
+			"gc.source_bead_id": sourceBeadID,
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	children := make([]beads.Bead, 0, len(candidates))
+	for _, candidate := range candidates {
+		if candidate.ID == "" || sourceworkflow.IsWorkflowRoot(candidate) {
+			continue
+		}
+		if !sourceworkflow.WorkflowMatchesSource(candidate, sourceBeadID, sourceStoreRef, rootStoreRef) {
+			continue
+		}
+		children = append(children, candidate)
+	}
+	return children, nil
+}
+
+func sourceWorkflowScanKey(rootStoreRef, sourceStoreRef, sourceBeadID string, storeIndex int) string {
+	keyScope := strings.TrimSpace(rootStoreRef)
+	if keyScope == "" {
+		keyScope = fmt.Sprintf("store#%d", storeIndex)
+	}
+	return keyScope + "\x00" + strings.TrimSpace(sourceStoreRef) + "\x00" + strings.TrimSpace(sourceBeadID)
+}
+
+func sourceWorkflowRootKey(rootStoreRef, rootID string, storeIndex int) string {
+	keyScope := strings.TrimSpace(rootStoreRef)
+	if keyScope == "" {
+		keyScope = fmt.Sprintf("store#%d", storeIndex)
+	}
+	return keyScope + "\x00" + strings.TrimSpace(rootID)
+}
+
+func withoutSourceWorkflowRoot(roots []beads.Bead, rootID, rootSourceStoreRef string) []beads.Bead {
+	rootID = strings.TrimSpace(rootID)
+	if rootID == "" || len(roots) == 0 {
+		return roots
+	}
+	rootSourceStoreRef = strings.TrimSpace(rootSourceStoreRef)
+	out := roots[:0]
+	for _, root := range roots {
+		if root.ID != rootID {
+			out = append(out, root)
+			continue
+		}
+		// Legacy roots may not have gc.source_store_ref. In that case the
+		// exclusion is ID-only and relies on bead IDs being unique across scanned
+		// stores; modern roots use the source-store ref check below.
+		if rootSourceStoreRef != "" && strings.TrimSpace(root.Metadata[sourceworkflow.SourceStoreRefMetadataKey]) != rootSourceStoreRef {
+			out = append(out, root)
+		}
+	}
+	return out
+}
+
+func sourceChainKey(storeRef, beadID string) string {
+	// Upward finalize walks only need the parent store and source bead. The
+	// downward delete-source walk also keys by querying root store because it
+	// recursively fans out across every source-workflow store.
+	return strings.TrimSpace(storeRef) + "\x00" + strings.TrimSpace(beadID)
+}
+
+func sourceChainStoreLabel(storeRef string) string {
+	storeRef = strings.TrimSpace(storeRef)
+	if storeRef == "" {
+		return "current store"
+	}
+	return storeRef
+}
+
+func sourceChainRootIDs(roots []beads.Bead) string {
+	ids := make([]string, 0, len(roots))
+	for _, root := range roots {
+		if root.ID != "" {
+			ids = append(ids, root.ID)
+		}
+	}
+	sort.Strings(ids)
+	return strings.Join(ids, ",")
+}
+
+func closeSourceBeadPreservingOutcome(store beads.Store, bead beads.Bead) error {
+	status := "closed"
+	opts := beads.UpdateOpts{Status: &status}
+	if strings.TrimSpace(bead.Metadata["gc.outcome"]) == "" {
+		opts.Metadata = map[string]string{"gc.outcome": "pass"}
+	}
+	return store.Update(bead.ID, opts)
+}
+
+func propagateSourceBeadTerminalMetadata(store beads.Store, beadID string, metadata map[string]string) error {
+	batch := make(map[string]string)
+	copyNonGCMetadata(batch, metadata)
+	if len(batch) == 0 {
+		return nil
+	}
+	return store.SetMetadataBatch(beadID, batch)
+}
+
+func recordWorkflowFinalizeError(store beads.Store, finalizerID string, err error) error {
+	if err == nil {
+		return nil
+	}
+	reason := strings.TrimSpace(err.Error())
+	if len(reason) > maxWorkflowFinalizeErrorMetadata {
+		reason = truncateWorkflowFinalizeErrorMetadata(reason)
+	}
+	if setErr := store.SetMetadata(finalizerID, workflowFinalizeErrorMetadataKey, reason); setErr != nil {
+		return errors.Join(err, fmt.Errorf("recording workflow finalize error on %s: %w", finalizerID, setErr))
+	}
+	return err
+}
+
+func truncateWorkflowFinalizeErrorMetadata(reason string) string {
+	limit := maxWorkflowFinalizeErrorMetadata
+	if len(reason) <= limit {
+		return reason
+	}
+	for limit > 0 && !utf8.ValidString(reason[:limit]) {
+		limit--
+	}
+	return reason[:limit]
+}
+
 func reconcileTerminalScopedMember(store beads.Store, bead beads.Bead) (ControlResult, error) {
 	scopeRef := bead.Metadata["gc.scope_ref"]
 	if scopeRef == "" {
@@ -576,6 +1055,16 @@ func resolveBlockingSubjectID(store beads.Store, beadID string) (string, error)
 }
 
 func resolveScopeBody(store beads.Store, rootID, scopeRef string) (beads.Bead, error) {
+	if bead, ok, err := resolveScopeBodyByRole(store, rootID, scopeRef, false); err != nil {
+		return beads.Bead{}, err
+	} else if ok {
+		return bead, nil
+	}
+	if bead, ok, err := resolveScopeBodyByRole(store, rootID, scopeRef, true); err != nil {
+		return beads.Bead{}, err
+	} else if ok {
+		return bead, nil
+	}
 	all, err := listByWorkflowRoot(store, rootID)
 	if err != nil {
 		return beads.Bead{}, err
@@ -586,6 +1075,26 @@ func resolveScopeBody(store beads.Store, rootID, scopeRef string) (beads.Bead, e
 	return beads.Bead{}, fmt.Errorf("%w: scope %q not found under root %s", errScopeBodyMissing, scopeRef, rootID)
 }
 
+func resolveScopeBodyByRole(store beads.Store, rootID, scopeRef string, includeClosed bool) (beads.Bead, bool, error) {
+	matches, err := store.List(beads.ListQuery{
+		Metadata: map[string]string{
+			"gc.root_bead_id": rootID,
+			"gc.kind":         "scope",
+			"gc.scope_role":   "body",
+		},
+		IncludeClosed: includeClosed,
+	})
+	if err != nil {
+		return beads.Bead{}, false, err
+	}
+	for _, bead := range matches {
+		if matchesScopeRef(bead, scopeRef) {
+			return bead, true, nil
+		}
+	}
+	return beads.Bead{}, false, nil
+}
+
 func skipOpenScopeMembers(store beads.Store, rootID, scopeRef, skipControlID string) (int, error) {
 	snapshot, err := loadScopeSnapshot(store, rootID, scopeRef)
 	if err != nil {
@@ -619,14 +1128,6 @@ func sortedPendingIDs(pending map[string]beads.Bead) []string {
 	return ids
 }
 
-func hasOpenScopeMembers(store beads.Store, rootID, scopeRef string) (bool, error) {
-	snapshot, err := loadScopeSnapshot(store, rootID, scopeRef)
-	if err != nil {
-		return false, err
-	}
-	return snapshot.hasOpenScopeMembers(), nil
-}
-
 func listByWorkflowRoot(store beads.Store, rootID string) ([]beads.Bead, error) {
 	all, err := store.List(beads.ListQuery{
 		Metadata:      map[string]string{"gc.root_bead_id": rootID},
diff --git a/internal/dispatch/runtime_test.go b/internal/dispatch/runtime_test.go
index d1879390e4..099a0d1112 100644
--- a/internal/dispatch/runtime_test.go
+++ b/internal/dispatch/runtime_test.go
@@ -7,9 +7,12 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
+	"unicode/utf8"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
@@ -17,6 +20,7 @@ import (
 	"github.com/gastownhall/gascity/internal/formula"
 	"github.com/gastownhall/gascity/internal/formulatest"
 	"github.com/gastownhall/gascity/internal/molecule"
+	"github.com/gastownhall/gascity/internal/sourceworkflow"
 )
 
 func TestProcessScopeCheckClosesScopeOnSuccess(t *testing.T) {
@@ -112,6 +116,151 @@ func TestProcessScopeCheckClosesScopeOnSuccess(t *testing.T) {
 	}
 }
 
+func TestProcessScopeCheckSuccessUsesScopedSnapshotQueries(t *testing.T) {
+	t.Parallel()
+
+	base := beads.NewMemStore()
+	store := &scopeSnapshotQueryGuardStore{Store: base}
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	body := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "body",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.scope_role":   "body",
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "body",
+		},
+	})
+	step := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "implement",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "member",
+			"gc.outcome":      "pass",
+		},
+	})
+	control := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize scope for implement",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope-check",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "control",
+		},
+	})
+	control = mustGetBead(t, store, control.ID)
+
+	mustDepAdd(t, store, control.ID, step.ID, "blocks")
+	mustDepAdd(t, store, body.ID, control.ID, "blocks")
+
+	result, err := ProcessControl(store, control, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(scope-check): %v", err)
+	}
+	if !result.Processed || result.Action != "scope-pass" {
+		t.Fatalf("scope result = %+v, want processed scope-pass", result)
+	}
+	if store.broadRootQueries != 0 {
+		t.Fatalf("broad workflow-root queries = %d, want 0", store.broadRootQueries)
+	}
+	if store.scopedMemberQueries == 0 {
+		t.Fatal("expected scoped member query")
+	}
+	if store.scopeBodyQueries == 0 {
+		t.Fatal("expected scope body query")
+	}
+}
+
+func TestProcessScopeCheckPassWithRemainingOpenAvoidsClosedSnapshot(t *testing.T) {
+	t.Parallel()
+
+	base := beads.NewMemStore()
+	store := &scopeSnapshotQueryGuardStore{Store: base}
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "body",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.scope_role":   "body",
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "body",
+		},
+	})
+	done := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "done",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "member",
+			"gc.outcome":      "pass",
+		},
+	})
+	stillOpen := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "still open",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "member",
+		},
+	})
+	control := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize scope for done",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope-check",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "body",
+			"gc.scope_role":   "control",
+		},
+	})
+
+	mustDepAdd(t, store, control.ID, done.ID, "blocks")
+
+	result, err := ProcessControl(store, control, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(scope-check): %v", err)
+	}
+	if !result.Processed || result.Action != "continue" {
+		t.Fatalf("scope result = %+v, want processed continue", result)
+	}
+	if store.closedScopedQueries != 0 {
+		t.Fatalf("closed scoped snapshot queries = %d, want 0", store.closedScopedQueries)
+	}
+	if store.activeScopedQueries == 0 {
+		t.Fatal("expected active scoped completion query")
+	}
+	remaining, err := store.Get(stillOpen.ID)
+	if err != nil {
+		t.Fatalf("Get remaining member: %v", err)
+	}
+	if remaining.Status != "open" {
+		t.Fatalf("remaining member status = %q, want open", remaining.Status)
+	}
+}
+
 func TestProcessScopeCheckAbortsScopeOnFailure(t *testing.T) {
 	t.Parallel()
 
@@ -487,14 +636,37 @@ func TestProcessScopeCheckUsesSingleWorkflowSnapshotAndEmitsTrace(t *testing.T)
 	if result.Action != "scope-pass" {
 		t.Fatalf("action = %q, want scope-pass", result.Action)
 	}
-	if store.listCalls != 1 {
-		t.Fatalf("List calls = %d, want 1 workflow snapshot", store.listCalls)
+	if store.listCalls != 3 {
+		t.Fatalf("List calls = %d, want 3 scoped completion/snapshot queries", store.listCalls)
+	}
+	if len(store.queries) != 3 {
+		t.Fatalf("queries = %d, want 3", len(store.queries))
+	}
+	for i, query := range store.queries {
+		if got := query.Metadata["gc.root_bead_id"]; got != workflow.ID {
+			t.Fatalf("query[%d] root metadata = %q, want %q", i, got, workflow.ID)
+		}
+	}
+	if got := store.queries[0].Metadata["gc.kind"]; got != "scope" {
+		t.Fatalf("query[0] gc.kind = %q, want scope", got)
+	}
+	if got := store.queries[0].Metadata["gc.scope_role"]; got != "body" {
+		t.Fatalf("query[0] gc.scope_role = %q, want body", got)
+	}
+	if store.queries[0].IncludeClosed {
+		t.Fatal("query[0] should be active-only body lookup")
 	}
-	if len(store.queries) != 1 {
-		t.Fatalf("queries = %d, want 1", len(store.queries))
+	if got := store.queries[1].Metadata["gc.scope_ref"]; got != "body" {
+		t.Fatalf("query[1] gc.scope_ref = %q, want body", got)
 	}
-	if got := store.queries[0].Metadata["gc.root_bead_id"]; got != workflow.ID {
-		t.Fatalf("root metadata query = %q, want %q", got, workflow.ID)
+	if store.queries[1].IncludeClosed {
+		t.Fatal("query[1] should be active-only completion check")
+	}
+	if got := store.queries[2].Metadata["gc.scope_ref"]; got != "body" {
+		t.Fatalf("query[2] gc.scope_ref = %q, want body", got)
+	}
+	if !store.queries[2].IncludeClosed {
+		t.Fatal("query[2] should load closed scope members for final snapshot")
 	}
 	traceText := trace.String()
 	for _, want := range []string{
@@ -520,12 +692,53 @@ type countingListStore struct {
 	queries   []beads.ListQuery
 }
 
+type workflowFinalizeCloseFailStore struct {
+	beads.Store
+	finalizerID string
+}
+
 func (s *countingListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
 	s.listCalls++
 	s.queries = append(s.queries, query)
 	return s.MemStore.List(query)
 }
 
+func (s *workflowFinalizeCloseFailStore) Update(id string, opts beads.UpdateOpts) error {
+	if id == s.finalizerID && opts.Status != nil && *opts.Status == "closed" {
+		return errors.New("finalizer close failed")
+	}
+	return s.Store.Update(id, opts)
+}
+
+type scopeSnapshotQueryGuardStore struct {
+	beads.Store
+	broadRootQueries    int
+	scopedMemberQueries int
+	scopeBodyQueries    int
+	activeScopedQueries int
+	closedScopedQueries int
+}
+
+func (s *scopeSnapshotQueryGuardStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if root := strings.TrimSpace(query.Metadata["gc.root_bead_id"]); root != "" {
+		switch {
+		case len(query.Metadata) == 1:
+			s.broadRootQueries++
+			return nil, fmt.Errorf("unexpected broad workflow-root query for %s", root)
+		case query.Metadata["gc.scope_ref"] != "":
+			s.scopedMemberQueries++
+			if query.IncludeClosed {
+				s.closedScopedQueries++
+			} else {
+				s.activeScopedQueries++
+			}
+		case query.Metadata["gc.kind"] == "scope":
+			s.scopeBodyQueries++
+		}
+	}
+	return s.Store.List(query)
+}
+
 func newStrictCloseStore() *strictCloseStore {
 	return &strictCloseStore{MemStore: beads.NewMemStore()}
 }
@@ -606,861 +819,1375 @@ func TestProcessWorkflowFinalizeClosesWorkflow(t *testing.T) {
 	}
 }
 
-func TestProcessRalphCheckRetriesThenPasses(t *testing.T) {
+func TestProcessWorkflowFinalizeOrphanedRootClosesFinalizerWithoutError(t *testing.T) {
 	t.Parallel()
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "retry-check.sh", "#!/bin/bash\nset -euo pipefail\nTARGET=\"$GC_CITY_PATH/retry-demo.txt\"\n[ -f \"$TARGET\" ]\ngrep -qx \"pass\" \"$TARGET\"\n")
-
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 2)
-
-	if err := os.WriteFile(filepath.Join(cityPath, "retry-demo.txt"), []byte("fail\n"), 0o644); err != nil {
-		t.Fatalf("write failing artifact: %v", err)
-	}
-	if err := store.Close(run1.ID); err != nil {
-		t.Fatalf("close run1: %v", err)
-	}
+	store := beads.NewMemStore()
+	finalizer := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": "missing-root-id",
+		},
+	})
 
-	result1, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	result, err := ProcessControl(store, finalizer, ProcessOptions{})
 	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
-	}
-	if !result1.Processed || result1.Action != "retry" {
-		t.Fatalf("result1 = %+v, want processed retry", result1)
+		t.Fatalf("ProcessControl(orphan finalize): %v", err)
 	}
-
-	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
-	if err := os.WriteFile(filepath.Join(cityPath, "retry-demo.txt"), []byte("pass\n"), 0o644); err != nil {
-		t.Fatalf("write passing artifact: %v", err)
+	if !result.Processed {
+		t.Fatalf("result = %+v, want processed", result)
 	}
-	if err := store.Close(run2.ID); err != nil {
-		t.Fatalf("close run2: %v", err)
+	if result.Action != "workflow-missing_root" {
+		t.Fatalf("result.Action = %q, want workflow-missing_root", result.Action)
 	}
 
-	result2, err := ProcessControl(store, check2, ProcessOptions{CityPath: cityPath})
+	finalizerAfter, err := store.Get(finalizer.ID)
 	if err != nil {
-		t.Fatalf("ProcessControl(check2): %v", err)
+		t.Fatalf("get finalizer: %v", err)
 	}
-	if !result2.Processed || result2.Action != "pass" {
-		t.Fatalf("result2 = %+v, want processed pass", result2)
+	if finalizerAfter.Status != "closed" {
+		t.Fatalf("finalizer status = %q, want closed", finalizerAfter.Status)
 	}
-
-	logicalAfter := mustGetBead(t, store, logical.ID)
-	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "pass" {
-		t.Fatalf("logical = status %q outcome %q, want closed/pass", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	if got := finalizerAfter.Metadata["gc.outcome"]; got != "missing_root" {
+		t.Fatalf("finalizer outcome = %q, want missing_root", got)
 	}
 }
 
-func TestProcessRalphCheckPassClosesCheckBeforeLogicalAndPropagatesOutputJSON(t *testing.T) {
+func TestProcessWorkflowFinalizeOrphanedRootReportsFinalizerCloseFailure(t *testing.T) {
 	t.Parallel()
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "pass-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 0\n")
-
-	store := &ralphPassOrderStore{MemStore: beads.NewMemStore()}
-	logical, run1, check1 := newSimpleRalphLoopInStore(t, store, "implement", checkPath, 1)
-	store.logicalID = logical.ID
-	store.checkID = check1.ID
-
-	if err := store.SetMetadata(run1.ID, "gc.output_json", `{"items":[{"name":"claude"}]}`); err != nil {
-		t.Fatalf("set run output json: %v", err)
-	}
-	if err := store.Close(run1.ID); err != nil {
-		t.Fatalf("close run1: %v", err)
+	mem := beads.NewMemStore()
+	finalizer := mustCreateWorkflowBead(t, mem, beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": "missing-root-id",
+		},
+	})
+	store := &workflowFinalizeCloseFailStore{
+		Store:       mem,
+		finalizerID: finalizer.ID,
 	}
 
-	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
-	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
-	}
-	if !result.Processed || result.Action != "pass" {
-		t.Fatalf("result = %+v, want processed pass", result)
+	result, err := ProcessControl(store, finalizer, ProcessOptions{})
+	if err == nil {
+		t.Fatalf("ProcessControl(orphan finalize) error = nil, want finalizer close failure")
 	}
-
-	checkAfter := mustGetBead(t, store, check1.ID)
-	if checkAfter.Status != "closed" || checkAfter.Metadata["gc.outcome"] != "pass" {
-		t.Fatalf("check = status %q outcome %q, want closed/pass", checkAfter.Status, checkAfter.Metadata["gc.outcome"])
+	if result.Processed {
+		t.Fatalf("result = %+v, want not processed when finalizer close fails", result)
 	}
-
-	logicalAfter := mustGetBead(t, store, logical.ID)
-	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "pass" {
-		t.Fatalf("logical = status %q outcome %q, want closed/pass", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	if !strings.Contains(err.Error(), "closing orphaned finalizer") {
+		t.Fatalf("error = %q, want orphaned finalizer context", err)
 	}
-	if got := logicalAfter.Metadata["gc.output_json"]; got != `{"items":[{"name":"claude"}]}` {
-		t.Fatalf("logical gc.output_json = %q, want propagated run output", got)
+	if !strings.Contains(err.Error(), "missing-root-id") {
+		t.Fatalf("error = %q, want missing root ID context", err)
 	}
 }
 
-func TestNestedRalphScopePassPropagatesOutputJSONToLogical(t *testing.T) {
+// TestProcessWorkflowFinalizeClosesCrossStoreSourceBead verifies that when a
+// graph workflow finalizes successfully, the engine closes any source bead
+// chain that crosses store boundaries. This is the PR-review case: the city
+// scope holds the human-visible "Adopt PR" source bead, and the rig scope
+// holds the launch bead + workflow root that the operator drives. Without
+// this propagation, the city source bead stays open forever even after the
+// PR is merged and the rig workflow is fully closed - the only way to know
+// the request finished is to read metadata, not list status.
+//
+// Wiring under test:
+//   - city store: city source bead (the original "Adopt PR" request)
+//   - rig store:  rig launch bead     gc.source_bead_id=<city-source>, gc.source_store_ref=city:test
+//     workflow root       gc.source_bead_id=<rig-launch>,  gc.source_store_ref=rig:test
+//     cleanup, finalizer
+//
+// On a successful (outcome=pass) finalize, the engine should close BOTH the
+// rig-store workflow root AND the city-store source bead.
+func TestProcessWorkflowFinalizeClosesCrossStoreSourceBead(t *testing.T) {
 	t.Parallel()
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "nested-pass-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 0\n")
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
 
-	store := beads.NewMemStore()
-	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "workflow",
+	citySource := mustCreateWorkflowBead(t, cityStore, beads.Bead{
+		Title: "Adopt PR: gastownhall/example#1",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":             "workflow",
-			"gc.formula_contract": "graph.v2",
+			"pr_review.pr_number":       "1",
+			"pr_review.repo_slug":       "gastownhall/example",
+			"pr_review.workflow_status": "running",
 		},
 	})
-	logical := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review-loop",
+
+	rigLaunch := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Adopt PR workflow: gastownhall/example#1",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":         "ralph",
-			"gc.step_id":      "review-loop",
-			"gc.max_attempts": "1",
-			"gc.root_bead_id": workflow.ID,
+			"gc.source_bead_id":         citySource.ID,
+			"gc.source_store_ref":       "city:test",
+			"pr_review.final_pr_url":    "https://github.com/gastownhall/example/pull/1",
+			"pr_review.workflow_status": "completed",
+			"workflow_id":               "wf-1",
 		},
 	})
-	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review-loop.run.1",
+
+	workflow := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "mol-adopt-pr-v2",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":                 "scope",
-			"gc.scope_role":           "body",
-			"gc.scope_name":           "review-loop",
-			"gc.step_ref":             "review-loop.run.1",
-			"gc.step_id":              "review-loop",
-			"gc.ralph_step_id":        "review-loop",
-			"gc.attempt":              "1",
-			"gc.root_bead_id":         workflow.ID,
-			"gc.logical_bead_id":      logical.ID,
-			"gc.output_json_required": "true",
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   rigLaunch.ID,
+			"gc.source_store_ref": "rig:test",
 		},
 	})
-	member := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title:  "review-loop.run.1.synthesize",
+
+	cleanup := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title:  "Clean up worktree",
 		Type:   "task",
 		Status: "closed",
 		Metadata: map[string]string{
-			"gc.scope_ref":            "review-loop.run.1",
-			"gc.scope_role":           "member",
-			"gc.output_json_required": "true",
-			"gc.output_json":          `{"items":[{"name":"claude"}]}`,
-			"gc.outcome":              "pass",
-			"gc.step_id":              "review-loop",
-			"gc.ralph_step_id":        "review-loop",
-			"gc.attempt":              "1",
-			"gc.root_bead_id":         workflow.ID,
-		},
-	})
-	control := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "Finalize scope for review-loop.run.1.synthesize",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":          "scope-check",
-			"gc.scope_ref":     "review-loop.run.1",
-			"gc.scope_role":    "control",
-			"gc.control_for":   "review-loop.run.1.synthesize",
-			"gc.step_id":       "review-loop",
-			"gc.ralph_step_id": "review-loop",
-			"gc.attempt":       "1",
-			"gc.on_fail":       "abort_scope",
-			"gc.root_bead_id":  workflow.ID,
+			"gc.outcome": "pass",
 		},
 	})
-	check1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "check 1",
+
+	finalizer := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Finalize workflow",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "check",
-			"gc.step_id":         "review-loop",
-			"gc.ralph_step_id":   "review-loop",
-			"gc.attempt":         "1",
-			"gc.step_ref":        "review-loop.check.1",
-			"gc.check_mode":      "exec",
-			"gc.check_path":      checkPath,
-			"gc.check_timeout":   "30s",
-			"gc.max_attempts":    "1",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": logical.ID,
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
 		},
 	})
 
-	mustDepAdd(t, store, control.ID, member.ID, "blocks")
-	mustDepAdd(t, store, run1.ID, control.ID, "blocks")
-	mustDepAdd(t, store, check1.ID, run1.ID, "blocks")
-	mustDepAdd(t, store, logical.ID, check1.ID, "blocks")
+	mustDepAdd(t, rigStore, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, rigStore, workflow.ID, finalizer.ID, "blocks")
 
-	scopeResult, err := ProcessControl(store, control, ProcessOptions{})
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test":
+			return cityStore, nil
+		case "rig:test":
+			return rigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown store ref: %s", ref)
+		}
+	}
+
+	result, err := ProcessControl(rigStore, finalizer, ProcessOptions{
+		ResolveStoreRef: resolver,
+	})
 	if err != nil {
-		t.Fatalf("ProcessControl(scope-check): %v", err)
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
 	}
-	if !scopeResult.Processed || scopeResult.Action != "scope-pass" {
-		t.Fatalf("scopeResult = %+v, want processed scope-pass", scopeResult)
+	if !result.Processed || result.Action != "workflow-pass" {
+		t.Fatalf("workflow result = %+v, want processed workflow-pass", result)
 	}
 
-	runAfter := mustGetBead(t, store, run1.ID)
-	if runAfter.Status != "closed" || runAfter.Metadata["gc.outcome"] != "pass" {
-		t.Fatalf("run1 = status %q outcome %q, want closed/pass", runAfter.Status, runAfter.Metadata["gc.outcome"])
+	rigRootAfter, err := rigStore.Get(workflow.ID)
+	if err != nil {
+		t.Fatalf("get workflow root: %v", err)
 	}
-	if got := runAfter.Metadata["gc.output_json"]; got != `{"items":[{"name":"claude"}]}` {
-		t.Fatalf("run1 gc.output_json = %q, want propagated body output", got)
+	if rigRootAfter.Status != "closed" {
+		t.Fatalf("workflow root status = %q, want closed", rigRootAfter.Status)
 	}
-
-	checkResult, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	rigLaunchAfter, err := rigStore.Get(rigLaunch.ID)
 	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
+		t.Fatalf("get rig launch bead: %v", err)
 	}
-	if !checkResult.Processed || checkResult.Action != "pass" {
-		t.Fatalf("checkResult = %+v, want processed pass", checkResult)
+	if rigLaunchAfter.Status != "closed" {
+		t.Fatalf("rig launch bead status = %q, want closed", rigLaunchAfter.Status)
+	}
+	if got := rigLaunchAfter.Metadata["gc.outcome"]; got != "pass" {
+		t.Errorf("rig launch bead gc.outcome = %q, want %q", got, "pass")
 	}
 
-	logicalAfter := mustGetBead(t, store, logical.ID)
-	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "pass" {
-		t.Fatalf("logical = status %q outcome %q, want closed/pass", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	citySourceAfter, err := cityStore.Get(citySource.ID)
+	if err != nil {
+		t.Fatalf("get city source bead: %v", err)
 	}
-	if got := logicalAfter.Metadata["gc.output_json"]; got != `{"items":[{"name":"claude"}]}` {
-		t.Fatalf("logical gc.output_json = %q, want propagated nested output", got)
+	if citySourceAfter.Status != "closed" {
+		t.Fatalf("city source bead status = %q, want closed (cross-store closure on successful finalize)", citySourceAfter.Status)
+	}
+	if got := citySourceAfter.Metadata["gc.outcome"]; got != "pass" {
+		t.Errorf("city source bead gc.outcome = %q, want %q", got, "pass")
+	}
+	if got := citySourceAfter.Metadata["pr_review.workflow_status"]; got != "completed" {
+		t.Errorf("city source bead pr_review.workflow_status = %q, want completed", got)
+	}
+	if got := citySourceAfter.Metadata["pr_review.final_pr_url"]; got != "https://github.com/gastownhall/example/pull/1" {
+		t.Errorf("city source bead final PR URL = %q, want propagated final PR URL", got)
+	}
+	if got := citySourceAfter.Metadata["workflow_id"]; got != "wf-1" {
+		t.Errorf("city source bead workflow_id = %q, want propagated workflow id", got)
 	}
 }
 
-func TestProcessRalphCheckResumesExistingRetryAttemptWithoutDuplicates(t *testing.T) {
-	t.Parallel()
+type sourceChainFinalizeFixture struct {
+	cityStore  *beads.MemStore
+	rigStore   *beads.MemStore
+	citySource beads.Bead
+	rigLaunch  beads.Bead
+	workflow   beads.Bead
+	finalizer  beads.Bead
+}
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+func newSourceChainFinalizeFixture(t *testing.T) sourceChainFinalizeFixture {
+	t.Helper()
 
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
-	if err := store.Close(run1.ID); err != nil {
-		t.Fatalf("close run1: %v", err)
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	citySource := mustCreateWorkflowBead(t, cityStore, beads.Bead{
+		Title: "Adopt PR: gastownhall/example#3",
+		Type:  "task",
+	})
+	rigLaunch := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Adopt PR workflow: gastownhall/example#3",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.source_bead_id":   citySource.ID,
+			"gc.source_store_ref": "city:test",
+		},
+	})
+	workflow := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "mol-adopt-pr-v2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   rigLaunch.ID,
+			"gc.source_store_ref": "rig:test",
+		},
+	})
+	cleanup := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title:  "Clean up worktree",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.outcome": "pass",
+		},
+	})
+	finalizer := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	mustDepAdd(t, rigStore, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, rigStore, workflow.ID, finalizer.ID, "blocks")
+
+	return sourceChainFinalizeFixture{
+		cityStore:  cityStore,
+		rigStore:   rigStore,
+		citySource: citySource,
+		rigLaunch:  rigLaunch,
+		workflow:   workflow,
+		finalizer:  finalizer,
 	}
-	if _, err := appendRalphRetry(store, logical.ID, run1, check1, 2, cityPath); err != nil {
-		t.Fatalf("appendRalphRetry: %v", err)
+}
+
+func (f sourceChainFinalizeFixture) resolver(ref string) (beads.Store, error) {
+	switch ref {
+	case "city:test":
+		return f.cityStore, nil
+	case "rig:test":
+		return f.rigStore, nil
+	default:
+		return nil, fmt.Errorf("unknown store ref: %s", ref)
 	}
+}
 
-	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
-	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
+func sourceChainFixtureStores(f sourceChainFinalizeFixture) func() ([]SourceWorkflowStore, error) {
+	return func() ([]SourceWorkflowStore, error) {
+		return []SourceWorkflowStore{
+			{Store: f.cityStore, StoreRef: "city:test"},
+			{Store: f.rigStore, StoreRef: "rig:test"},
+		}, nil
 	}
-	if !result.Processed || result.Action != "retry" {
-		t.Fatalf("result = %+v, want processed retry", result)
+}
+
+func TestProcessWorkflowFinalizeRetriesWhenSourceStoreResolverFails(t *testing.T) {
+	t.Parallel()
+
+	f := newSourceChainFinalizeFixture(t)
+	resolver := func(ref string) (beads.Store, error) {
+		if ref == "city:test" {
+			return nil, errors.New("city store unavailable")
+		}
+		return f.resolver(ref)
 	}
 
-	all, err := store.ListOpen()
+	_, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef: resolver,
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) err = nil, want retryable resolver error")
+	}
+	if !strings.Contains(err.Error(), "city store unavailable") {
+		t.Fatalf("ProcessControl error = %v, want city store resolver failure", err)
+	}
+	finalizerAfter, err := f.rigStore.Get(f.finalizer.ID)
 	if err != nil {
-		t.Fatalf("store.List: %v", err)
+		t.Fatalf("get finalizer: %v", err)
 	}
-	attempt2 := 0
-	for _, bead := range all {
-		if bead.Metadata["gc.attempt"] == "2" {
-			attempt2++
-		}
+	if finalizerAfter.Status == "closed" {
+		t.Fatal("finalizer status = closed; want open so source-chain resolver failure is retryable")
 	}
-	if attempt2 != 2 {
-		t.Fatalf("attempt 2 bead count = %d, want 2", attempt2)
+	citySourceAfter, err := f.cityStore.Get(f.citySource.ID)
+	if err != nil {
+		t.Fatalf("get city source: %v", err)
 	}
+	if citySourceAfter.Status == "closed" {
+		t.Fatal("city source status = closed; want open after failed source-chain propagation")
+	}
+}
 
-	check1After := mustGetBead(t, store, check1.ID)
-	if check1After.Status != "closed" || check1After.Metadata["gc.outcome"] != "fail" {
-		t.Fatalf("check1 = status %q outcome %q, want closed/fail", check1After.Status, check1After.Metadata["gc.outcome"])
+type getErrorStore struct {
+	beads.Store
+	failID string
+	err    error
+}
+
+func (s getErrorStore) Get(id string) (beads.Bead, error) {
+	if id == s.failID {
+		return beads.Bead{}, s.err
 	}
-	if got := check1After.Metadata["gc.retry_state"]; got != "spawned" {
-		t.Fatalf("check1 retry_state = %q, want spawned", got)
+	return s.Store.Get(id)
+}
+
+type updateErrorStore struct {
+	beads.Store
+	failID string
+	err    error
+}
+
+func (s updateErrorStore) Update(id string, opts beads.UpdateOpts) error {
+	if id == s.failID {
+		return s.err
 	}
+	return s.Store.Update(id, opts)
 }
 
-func TestAppendRalphRetryDefersAssigneesUntilDepsAreWired(t *testing.T) {
+func TestProcessWorkflowFinalizeRetriesWhenSourceBeadLookupFails(t *testing.T) {
 	t.Parallel()
 
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", "unused", 3)
-	inspect := &assigneeVisibilityOnCreateStore{MemStore: store}
-	runner := "runner"
-	checker := "checker"
-	if err := inspect.Update(run1.ID, beads.UpdateOpts{Assignee: &runner}); err != nil {
-		t.Fatalf("assign run1: %v", err)
-	}
-	if err := inspect.Update(check1.ID, beads.UpdateOpts{Assignee: &checker}); err != nil {
-		t.Fatalf("assign check1: %v", err)
+	f := newSourceChainFinalizeFixture(t)
+	lookupErr := errors.New("city source lookup failed")
+	resolver := func(ref string) (beads.Store, error) {
+		if ref == "city:test" {
+			return getErrorStore{Store: f.cityStore, failID: f.citySource.ID, err: lookupErr}, nil
+		}
+		return f.resolver(ref)
 	}
-	run1 = mustGetBead(t, inspect, run1.ID)
-	check1 = mustGetBead(t, inspect, check1.ID)
 
-	mapping, err := appendRalphRetry(inspect, logical.ID, run1, check1, 2, "")
-	if err != nil {
-		t.Fatalf("appendRalphRetry: %v", err)
+	_, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef: resolver,
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) err = nil, want retryable parent lookup error")
 	}
-	if len(inspect.visibleOnCreate) > 0 {
-		t.Fatalf("retry beads became visible in assignee queues during creation before wiring completed: %v", inspect.visibleOnCreate)
+	if !strings.Contains(err.Error(), lookupErr.Error()) {
+		t.Fatalf("ProcessControl error = %v, want parent lookup failure", err)
 	}
-
-	run2 := mustGetBead(t, inspect, mapping[run1.ID])
-	check2 := mustGetBead(t, inspect, mapping[check1.ID])
-	if run2.Assignee != runner {
-		t.Fatalf("run2 assignee = %q, want %q", run2.Assignee, runner)
+	finalizerAfter, err := f.rigStore.Get(f.finalizer.ID)
+	if err != nil {
+		t.Fatalf("get finalizer: %v", err)
 	}
-	if check2.Assignee != checker {
-		t.Fatalf("check2 assignee = %q, want %q", check2.Assignee, checker)
+	if finalizerAfter.Status == "closed" {
+		t.Fatal("finalizer status = closed; want open so parent lookup failure is retryable")
 	}
 }
 
-func TestAppendRalphRetryGraphEdgesSkipsParentChildDeps(t *testing.T) {
+func TestProcessWorkflowFinalizeClosesSourcesUnderProvidedLock(t *testing.T) {
 	t.Parallel()
 
-	store := beads.NewMemStore()
-	parent := mustCreateWorkflowBead(t, store, beads.Bead{Title: "parent", Type: "task"})
-	child := mustCreateWorkflowBead(t, store, beads.Bead{Title: "child", Type: "task", ParentID: parent.ID})
-	blocker := mustCreateWorkflowBead(t, store, beads.Bead{Title: "blocker", Type: "task"})
-	mustDepAdd(t, store, child.ID, parent.ID, "parent-child")
-	mustDepAdd(t, store, child.ID, blocker.ID, "blocks")
+	f := newSourceChainFinalizeFixture(t)
+	var locked []string
+	locker := func(storeRef, sourceBeadID string, fn func() error) error {
+		locked = append(locked, storeRef+"\x00"+sourceBeadID)
+		return fn()
+	}
 
-	plan := &beads.GraphApplyPlan{}
-	if err := appendRalphRetryGraphEdges(plan, store, child.ID, map[string]bool{
-		parent.ID:  true,
-		blocker.ID: true,
+	if _, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef:    f.resolver,
+		SourceWorkflowLock: locker,
 	}); err != nil {
-		t.Fatalf("appendRalphRetryGraphEdges: %v", err)
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
 	}
-
-	if len(plan.Edges) != 1 {
-		t.Fatalf("edges = %+v, want only the blocking edge", plan.Edges)
+	want := []string{
+		"rig:test\x00" + f.rigLaunch.ID,
+		"city:test\x00" + f.citySource.ID,
 	}
-	edge := plan.Edges[0]
-	if edge.Type != "blocks" || edge.FromKey != child.ID || edge.ToKey != blocker.ID {
-		t.Fatalf("edge = %+v, want blocks edge to blocker", edge)
+	if !slices.Equal(locked, want) {
+		t.Fatalf("locked source beads = %q, want %q", locked, want)
 	}
 }
 
-func TestAppendRalphRetryClearsPoolAssignee(t *testing.T) {
+func TestProcessWorkflowFinalizeConvergesUnderConcurrentSharedAncestor(t *testing.T) {
 	t.Parallel()
 
 	cityPath := t.TempDir()
-	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte(`
-[workspace]
-name = "test-city"
-provider = "claude"
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+	citySource := mustCreateWorkflowBead(t, cityStore, beads.Bead{
+		Title: "Adopt PR: gastownhall/example#shared",
+		Type:  "task",
+	})
+	newRigWorkflow := func(name string) (beads.Bead, beads.Bead, beads.Bead) {
+		t.Helper()
+		launch := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+			Title: "Adopt PR workflow: " + name,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.source_bead_id":   citySource.ID,
+				"gc.source_store_ref": "city:test",
+			},
+		})
+		workflow := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+			Title: "mol-adopt-pr-v2 " + name,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":             "workflow",
+				"gc.formula_contract": "graph.v2",
+				"gc.source_bead_id":   launch.ID,
+				"gc.source_store_ref": "rig:test",
+			},
+		})
+		cleanup := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+			Title:  "cleanup " + name,
+			Type:   "task",
+			Status: "closed",
+			Metadata: map[string]string{
+				"gc.outcome": "pass",
+			},
+		})
+		finalizer := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+			Title: "Finalize workflow " + name,
+			Type:  "task",
+			Metadata: map[string]string{
+				"gc.kind":         "workflow-finalize",
+				"gc.root_bead_id": workflow.ID,
+			},
+		})
+		mustDepAdd(t, rigStore, finalizer.ID, cleanup.ID, "blocks")
+		mustDepAdd(t, rigStore, workflow.ID, finalizer.ID, "blocks")
+		return launch, workflow, finalizer
+	}
+	launchA, workflowA, finalizerA := newRigWorkflow("a")
+	launchB, workflowB, finalizerB := newRigWorkflow("b")
+
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test":
+			return cityStore, nil
+		case "rig:test":
+			return rigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown store ref: %s", ref)
+		}
+	}
+	locker := func(storeRef, sourceBeadID string, fn func() error) error {
+		return sourceworkflow.WithLock(context.Background(), cityPath, storeRef, sourceBeadID, fn)
+	}
+
+	start := make(chan struct{})
+	errs := make(chan error, 2)
+	var wg sync.WaitGroup
+	for _, finalizer := range []beads.Bead{finalizerA, finalizerB} {
+		wg.Add(1)
+		go func(finalizer beads.Bead) {
+			defer wg.Done()
+			<-start
+			result, err := ProcessControl(rigStore, finalizer, ProcessOptions{
+				ResolveStoreRef: resolver,
+				SourceWorkflowStores: func() ([]SourceWorkflowStore, error) {
+					return []SourceWorkflowStore{
+						{Store: cityStore, StoreRef: "city:test"},
+						{Store: rigStore, StoreRef: "rig:test"},
+					}, nil
+				},
+				SourceWorkflowLock: locker,
+			})
+			if err != nil {
+				errs <- err
+				return
+			}
+			if !result.Processed || result.Action != "workflow-pass" {
+				errs <- fmt.Errorf("ProcessControl(%s) = %+v, want workflow-pass", finalizer.ID, result)
+				return
+			}
+			errs <- nil
+		}(finalizer)
+	}
+	close(start)
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatalf("concurrent ProcessControl: %v", err)
+		}
+	}
 
-[[agent]]
-name = "polecat"
+	for _, bead := range []beads.Bead{launchA, launchB, workflowA, workflowB, finalizerA, finalizerB} {
+		after := mustGetBead(t, rigStore, bead.ID)
+		if after.Status != "closed" {
+			t.Fatalf("%s status = %q, want closed", bead.ID, after.Status)
+		}
+		if strings.TrimSpace(after.Metadata[workflowFinalizeErrorMetadataKey]) != "" {
+			t.Fatalf("%s has %s=%q, want none", bead.ID, workflowFinalizeErrorMetadataKey, after.Metadata[workflowFinalizeErrorMetadataKey])
+		}
+	}
+	citySourceAfter := mustGetBead(t, cityStore, citySource.ID)
+	if citySourceAfter.Status != "closed" {
+		t.Fatalf("city source status = %q, want closed after both shared descendants finalize", citySourceAfter.Status)
+	}
+	if got := citySourceAfter.Metadata["gc.outcome"]; got != "pass" {
+		t.Fatalf("city source gc.outcome = %q, want pass", got)
+	}
+}
 
-[agent.pool]
-min = 0
-max = -1
-`), 0o644); err != nil {
-		t.Fatalf("write city.toml: %v", err)
+func TestProcessWorkflowFinalizePreservesExistingParentOutcome(t *testing.T) {
+	t.Parallel()
+
+	f := newSourceChainFinalizeFixture(t)
+	if err := f.cityStore.SetMetadata(f.citySource.ID, "gc.outcome", "quarantined"); err != nil {
+		t.Fatalf("SetMetadata(city outcome): %v", err)
 	}
 
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", "unused", 3)
-	poolSlot := "polecat-2"
-	if err := store.Update(run1.ID, beads.UpdateOpts{
-		Assignee: &poolSlot,
-		Metadata: map[string]string{"gc.routed_to": "polecat"},
+	if _, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef: f.resolver,
 	}); err != nil {
-		t.Fatalf("assign pooled run1: %v", err)
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
 	}
-	run1 = mustGetBead(t, store, run1.ID)
-	check1 = mustGetBead(t, store, check1.ID)
-
-	mapping, err := appendRalphRetry(store, logical.ID, run1, check1, 2, cityPath)
+	citySourceAfter, err := f.cityStore.Get(f.citySource.ID)
 	if err != nil {
-		t.Fatalf("appendRalphRetry: %v", err)
+		t.Fatalf("get city source: %v", err)
 	}
-
-	run2 := mustGetBead(t, store, mapping[run1.ID])
-	if run2.Assignee != "" {
-		t.Fatalf("run2 assignee = %q, want empty for pooled retry task", run2.Assignee)
+	if citySourceAfter.Status != "closed" {
+		t.Fatalf("city source status = %q, want closed", citySourceAfter.Status)
+	}
+	if got := citySourceAfter.Metadata["gc.outcome"]; got != "quarantined" {
+		t.Fatalf("city source gc.outcome = %q, want preexisting outcome %q", got, "quarantined")
 	}
 }
 
-func TestAppendRalphRetryRemapsNestedRetryLogicalRefs(t *testing.T) {
+func TestProcessWorkflowFinalizeDoesNotCloseSourcesWhenRootCloseFails(t *testing.T) {
 	t.Parallel()
 
-	store := beads.NewMemStore()
-	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "workflow",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":             "workflow",
-			"gc.formula_contract": "graph.v2",
-		},
-	})
-	logical := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review loop",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":         "ralph",
-			"gc.step_id":      "review-loop",
-			"gc.max_attempts": "2",
-			"gc.root_bead_id": workflow.ID,
-		},
-	})
-	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "attempt 1 body",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":            "scope",
-			"gc.scope_role":      "body",
-			"gc.scope_name":      "review-loop",
-			"gc.step_ref":        "demo.review-loop.run.1",
-			"gc.step_id":         "review-loop",
-			"gc.ralph_step_id":   "review-loop",
-			"gc.attempt":         "1",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": logical.ID,
-		},
-	})
-	check1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "check review loop",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":            "check",
-			"gc.step_id":         "review-loop",
-			"gc.ralph_step_id":   "review-loop",
-			"gc.attempt":         "1",
-			"gc.max_attempts":    "2",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": logical.ID,
-			"gc.step_ref":        "demo.review-loop.check.1",
-		},
-	})
-	nestedLogical := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review claude",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":         "retry",
-			"gc.scope_ref":    "demo.review-loop.run.1",
-			"gc.scope_role":   "member",
-			"gc.step_ref":     "demo.review-loop.run.1.review-claude",
-			"gc.max_attempts": "3",
-			"gc.root_bead_id": workflow.ID,
-		},
-	})
-	nestedRun := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review claude run 1",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":            "retry-run",
-			"gc.scope_ref":       "demo.review-loop.run.1",
-			"gc.scope_role":      "member",
-			"gc.step_ref":        "demo.review-loop.run.1.review-claude.run.1",
-			"gc.attempt":         "1",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": nestedLogical.ID,
-		},
-	})
-	nestedEval := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review claude eval 1",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":            "retry-eval",
-			"gc.scope_ref":       "demo.review-loop.run.1",
-			"gc.scope_role":      "member",
-			"gc.step_ref":        "demo.review-loop.run.1.review-claude.eval.1",
-			"gc.control_for":     "demo.review-loop.run.1.review-claude.eval.1",
-			"gc.attempt":         "1",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": nestedLogical.ID,
-		},
-	})
-
-	mustDepAdd(t, store, nestedLogical.ID, nestedEval.ID, "blocks")
-	mustDepAdd(t, store, nestedEval.ID, nestedRun.ID, "blocks")
-	mustDepAdd(t, store, check1.ID, run1.ID, "blocks")
-	mustDepAdd(t, store, logical.ID, check1.ID, "blocks")
-
-	mapping, err := appendRalphRetry(store, logical.ID, run1, check1, 2, "")
-	if err != nil {
-		t.Fatalf("appendRalphRetry: %v", err)
+	f := newSourceChainFinalizeFixture(t)
+	rootCloseErr := errors.New("root close failed")
+	rigStore := updateErrorStore{Store: f.rigStore, failID: f.workflow.ID, err: rootCloseErr}
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test":
+			return f.cityStore, nil
+		case "rig:test":
+			return f.rigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown store ref: %s", ref)
+		}
 	}
 
-	nestedLogical2 := mustGetBead(t, store, mapping[nestedLogical.ID])
-	nestedRun2 := mustGetBead(t, store, mapping[nestedRun.ID])
-	nestedEval2 := mustGetBead(t, store, mapping[nestedEval.ID])
-
-	if got := nestedRun2.Metadata["gc.logical_bead_id"]; got != nestedLogical2.ID {
-		t.Fatalf("nested run gc.logical_bead_id = %q, want %q", got, nestedLogical2.ID)
+	_, err := ProcessControl(rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef:      resolver,
+		SourceWorkflowStores: sourceChainFixtureStores(f),
+		SourceWorkflowLock:   func(_ string, _ string, fn func() error) error { return fn() },
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) err = nil, want root close failure")
 	}
-	if got := nestedEval2.Metadata["gc.logical_bead_id"]; got != nestedLogical2.ID {
-		t.Fatalf("nested eval gc.logical_bead_id = %q, want %q", got, nestedLogical2.ID)
+	if !strings.Contains(err.Error(), rootCloseErr.Error()) {
+		t.Fatalf("ProcessControl error = %v, want root close failure", err)
 	}
-	if got := nestedEval2.Metadata["gc.control_for"]; got != "demo.review-loop.run.2.review-claude.eval.1" {
-		t.Fatalf("nested eval gc.control_for = %q, want demo.review-loop.run.2.review-claude.eval.1", got)
+	for _, check := range []struct {
+		name  string
+		store beads.Store
+		id    string
+	}{
+		{name: "workflow root", store: f.rigStore, id: f.workflow.ID},
+		{name: "finalizer", store: f.rigStore, id: f.finalizer.ID},
+		{name: "rig launch", store: f.rigStore, id: f.rigLaunch.ID},
+		{name: "city source", store: f.cityStore, id: f.citySource.ID},
+	} {
+		got, getErr := check.store.Get(check.id)
+		if getErr != nil {
+			t.Fatalf("get %s: %v", check.name, getErr)
+		}
+		if got.Status == "closed" {
+			t.Fatalf("%s status = closed; want open after root close failure", check.name)
+		}
+	}
+	finalizerAfter, err := f.rigStore.Get(f.finalizer.ID)
+	if err != nil {
+		t.Fatalf("get finalizer: %v", err)
+	}
+	if got := finalizerAfter.Metadata["gc.last_finalize_error"]; !strings.Contains(got, rootCloseErr.Error()) {
+		t.Fatalf("finalizer gc.last_finalize_error = %q, want root close failure", got)
 	}
 }
 
-func TestBuildRalphRetryGraphNodeRemapsNestedRetryLogicalRef(t *testing.T) {
+func TestProcessWorkflowFinalizeRecordsSourceWorkflowStoreScanFailure(t *testing.T) {
 	t.Parallel()
 
-	node := buildRalphRetryGraphNode(beads.Bead{
-		ID:    "old-eval",
-		Title: "eval",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":            "retry-eval",
-			"gc.attempt":         "1",
-			"gc.scope_ref":       "demo.review-loop.run.1",
-			"gc.step_ref":        "demo.review-loop.run.1.review-claude.eval.1",
-			"gc.control_for":     "demo.review-loop.run.1.review-claude.eval.1",
-			"gc.logical_bead_id": "old-logical",
-		},
-	}, "top-logical", "demo.review-loop.run.1", "demo.review-loop.run.2", 1, 2, map[string]bool{
-		"old-eval":    true,
-		"old-logical": true,
-	}, (*config.City)(nil))
+	f := newSourceChainFinalizeFixture(t)
+	scanErr := errors.New("skipped source-workflow store: rigs/broken")
 
-	if got := node.Metadata["gc.step_ref"]; got != "demo.review-loop.run.2.review-claude.eval.1" {
-		t.Fatalf("node gc.step_ref = %q, want demo.review-loop.run.2.review-claude.eval.1", got)
+	_, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef: f.resolver,
+		SourceWorkflowStores: func() ([]SourceWorkflowStore, error) {
+			return nil, scanErr
+		},
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) err = nil, want source-workflow store scan failure")
 	}
-	if got := node.Metadata["gc.control_for"]; got != "demo.review-loop.run.2.review-claude.eval.1" {
-		t.Fatalf("node gc.control_for = %q, want demo.review-loop.run.2.review-claude.eval.1", got)
+	if !strings.Contains(err.Error(), scanErr.Error()) {
+		t.Fatalf("ProcessControl error = %v, want scan failure", err)
 	}
-	if got := node.MetadataRefs["gc.logical_bead_id"]; got != "old-logical" {
-		t.Fatalf("node gc.logical_bead_id ref = %q, want old-logical", got)
+	workflowAfter, err := f.rigStore.Get(f.workflow.ID)
+	if err != nil {
+		t.Fatalf("get workflow root: %v", err)
 	}
-	if got := node.Metadata["gc.logical_bead_id"]; got != "" {
-		t.Fatalf("node gc.logical_bead_id = %q, want empty metadata when ref remap is used", got)
+	if workflowAfter.Status == "closed" {
+		t.Fatal("workflow root status = closed; want open when source-workflow scan preflight fails")
+	}
+	finalizerAfter, err := f.rigStore.Get(f.finalizer.ID)
+	if err != nil {
+		t.Fatalf("get finalizer: %v", err)
+	}
+	if finalizerAfter.Status == "closed" {
+		t.Fatal("finalizer status = closed; want open when source-workflow scan preflight fails")
+	}
+	if got := finalizerAfter.Metadata["gc.last_finalize_error"]; !strings.Contains(got, scanErr.Error()) {
+		t.Fatalf("finalizer gc.last_finalize_error = %q, want scan failure", got)
 	}
 }
 
-func TestBuildRalphRetryGraphNodeRemapsNestedScopeCheckControlForFromStepRef(t *testing.T) {
+func TestRecordWorkflowFinalizeErrorTruncatesAtUTF8Boundary(t *testing.T) {
 	t.Parallel()
 
-	node := buildRalphRetryGraphNode(beads.Bead{
-		ID:    "old-scope-check",
-		Title: "scope-check",
+	store := beads.NewMemStore()
+	finalizer := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize workflow",
 		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":        "scope-check",
-			"gc.attempt":     "3",
-			"gc.scope_ref":   "mol-adopt-pr-v2.review-loop.run.3",
-			"gc.step_ref":    "mol-adopt-pr-v2.review-loop.run.3.review-pipeline.review-codex.run.1-scope-check",
-			"gc.control_for": "review-loop.run.3.review-pipeline.review-codex.run.1",
-		},
-	}, "top-logical", "mol-adopt-pr-v2.review-loop.run.3", "mol-adopt-pr-v2.review-loop.run.4", 3, 4, nil, (*config.City)(nil))
+	})
+	reason := strings.Repeat("a", maxWorkflowFinalizeErrorMetadata-1) + "é tail"
 
-	if got := node.Metadata["gc.step_ref"]; got != "mol-adopt-pr-v2.review-loop.run.4.review-pipeline.review-codex.run.1-scope-check" {
-		t.Fatalf("node gc.step_ref = %q, want rewritten outer Ralph scope with nested retry attempt unchanged", got)
+	err := recordWorkflowFinalizeError(store, finalizer.ID, errors.New(reason))
+	if err == nil {
+		t.Fatal("recordWorkflowFinalizeError err = nil, want original error returned")
 	}
-	if got := node.Metadata["gc.control_for"]; got != "mol-adopt-pr-v2.review-loop.run.4.review-pipeline.review-codex.run.1" {
-		t.Fatalf("node gc.control_for = %q, want scope-check control_for derived from rewritten step_ref", got)
+	finalizerAfter := mustGetBead(t, store, finalizer.ID)
+	got := finalizerAfter.Metadata[workflowFinalizeErrorMetadataKey]
+	if len(got) > maxWorkflowFinalizeErrorMetadata {
+		t.Fatalf("recorded reason length = %d, want <= %d", len(got), maxWorkflowFinalizeErrorMetadata)
+	}
+	if !utf8.ValidString(got) {
+		t.Fatalf("recorded reason is invalid UTF-8: %q", got)
 	}
 }
 
-func TestLogicalStepRefForAttemptBeadPrefersNestedAttemptOverOuterRalphScope(t *testing.T) {
+func TestProcessWorkflowFinalizeLeavesAncestorOpenWhenLiveRootExistsInAnotherStore(t *testing.T) {
 	t.Parallel()
 
-	bead := beads.Bead{
+	f := newSourceChainFinalizeFixture(t)
+	otherRoot := mustCreateWorkflowBead(t, f.rigStore, beads.Bead{
+		Title: "second live workflow",
+		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":     "scope-check",
-			"gc.attempt":  "3",
-			"gc.step_ref": "mol-adopt-pr-v2.review-loop.run.3.review-pipeline.review-codex.eval.1-scope-check",
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   f.citySource.ID,
+			"gc.source_store_ref": "city:test",
 		},
+	})
+	var trace bytes.Buffer
+
+	if _, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef: f.resolver,
+		SourceWorkflowStores: func() ([]SourceWorkflowStore, error) {
+			return []SourceWorkflowStore{
+				{Store: f.cityStore, StoreRef: "city:test"},
+				{Store: f.rigStore, StoreRef: "rig:test"},
+			}, nil
+		},
+		Tracef: func(format string, args ...any) {
+			fmt.Fprintf(&trace, format+"\n", args...) //nolint:errcheck // test buffer
+		},
+	}); err != nil {
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
 	}
 
-	if got := logicalStepRefForAttemptBead(bead); got != "mol-adopt-pr-v2.review-loop.run.3.review-pipeline.review-codex" {
-		t.Fatalf("logicalStepRefForAttemptBead(scope-check) = %q, want nested retry logical step", got)
+	rigLaunchAfter, err := f.rigStore.Get(f.rigLaunch.ID)
+	if err != nil {
+		t.Fatalf("get rig launch: %v", err)
+	}
+	if rigLaunchAfter.Status != "closed" {
+		t.Fatalf("rig launch status = %q, want closed", rigLaunchAfter.Status)
+	}
+	citySourceAfter, err := f.cityStore.Get(f.citySource.ID)
+	if err != nil {
+		t.Fatalf("get city source: %v", err)
+	}
+	if citySourceAfter.Status != "open" {
+		t.Fatalf("city source status = %q, want open while %s is live", citySourceAfter.Status, otherRoot.ID)
+	}
+	traceText := trace.String()
+	for _, want := range []string{
+		"reason=live_child_workflow",
+		"source=" + f.citySource.ID,
+		"live_roots=" + otherRoot.ID,
+	} {
+		if !strings.Contains(traceText, want) {
+			t.Fatalf("trace missing %q:\n%s", want, traceText)
+		}
 	}
 }
 
-func TestLogicalStepRefForAttemptBeadMapsFlatScopeCheckToControlStep(t *testing.T) {
+func TestProcessWorkflowFinalizeLeavesSharedAncestorOpenForIndirectLiveRoot(t *testing.T) {
 	t.Parallel()
 
-	bead := beads.Bead{
+	f := newSourceChainFinalizeFixture(t)
+	otherRigStore := beads.NewMemStore()
+	otherLaunch := mustCreateWorkflowBead(t, otherRigStore, beads.Bead{
+		Title: "Second Adopt PR workflow launch",
+		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":     "scope-check",
-			"gc.step_ref": "demo.review-scope-check",
+			"gc.source_bead_id":   f.citySource.ID,
+			"gc.source_store_ref": "city:test",
+		},
+	})
+	otherRoot := mustCreateWorkflowBead(t, otherRigStore, beads.Bead{
+		Title: "second live workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   otherLaunch.ID,
+			"gc.source_store_ref": "rig:other",
 		},
+	})
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test":
+			return f.cityStore, nil
+		case "rig:test":
+			return f.rigStore, nil
+		case "rig:other":
+			return otherRigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown store ref: %s", ref)
+		}
 	}
+	var trace bytes.Buffer
 
-	if got := logicalStepRefForAttemptBead(bead); got != "demo.review" {
-		t.Fatalf("logicalStepRefForAttemptBead(flat scope-check) = %q, want demo.review", got)
+	if _, err := ProcessControl(f.rigStore, f.finalizer, ProcessOptions{
+		ResolveStoreRef: resolver,
+		SourceWorkflowStores: func() ([]SourceWorkflowStore, error) {
+			return []SourceWorkflowStore{
+				{Store: f.cityStore, StoreRef: "city:test"},
+				{Store: f.rigStore, StoreRef: "rig:test"},
+				{Store: otherRigStore, StoreRef: "rig:other"},
+			}, nil
+		},
+		Tracef: func(format string, args ...any) {
+			fmt.Fprintf(&trace, format+"\n", args...) //nolint:errcheck // test buffer
+		},
+	}); err != nil {
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
+	}
+
+	rigLaunchAfter, err := f.rigStore.Get(f.rigLaunch.ID)
+	if err != nil {
+		t.Fatalf("get rig launch: %v", err)
+	}
+	if rigLaunchAfter.Status != "closed" {
+		t.Fatalf("rig launch status = %q, want closed", rigLaunchAfter.Status)
+	}
+	citySourceAfter, err := f.cityStore.Get(f.citySource.ID)
+	if err != nil {
+		t.Fatalf("get city source: %v", err)
+	}
+	if citySourceAfter.Status != "open" {
+		t.Fatalf("city source status = %q, want open while indirect live root %s is running", citySourceAfter.Status, otherRoot.ID)
+	}
+	traceText := trace.String()
+	for _, want := range []string{
+		"reason=live_child_workflow",
+		"source=" + f.citySource.ID,
+		"live_roots=" + otherRoot.ID,
+	} {
+		if !strings.Contains(traceText, want) {
+			t.Fatalf("trace missing %q:\n%s", want, traceText)
+		}
 	}
 }
 
-func TestResolveLogicalBeadIDPrefersExactScopeCheckTargetStep(t *testing.T) {
+func TestProcessWorkflowFinalizeClosesIntraStoreSourceBeadWithoutResolver(t *testing.T) {
 	t.Parallel()
 
 	store := beads.NewMemStore()
-	root := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "workflow",
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Same-store source",
+		Type:  "task",
+	})
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Same-store workflow",
 		Type:  "task",
 		Metadata: map[string]string{
 			"gc.kind":             "workflow",
 			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   source.ID,
 		},
 	})
-	_ = mustCreateWorkflowBead(t, store, beads.Bead{
-		ID:    "parent",
-		Title: "loop",
-		Type:  "task",
+	cleanup := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "Clean up worktree",
+		Type:   "task",
+		Status: "closed",
 		Metadata: map[string]string{
-			"gc.kind":         "ralph",
-			"gc.root_bead_id": root.ID,
-			"gc.step_ref":     "demo.loop",
+			"gc.outcome": "pass",
 		},
 	})
-	child := mustCreateWorkflowBead(t, store, beads.Bead{
-		ID:    "child",
-		Title: "child",
+	finalizer := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize workflow",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":         "retry",
-			"gc.root_bead_id": root.ID,
-			"gc.step_ref":     "demo.loop.run.1.child",
-		},
-	})
-	scopeCheck := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "Finalize child scope",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":         "scope-check",
-			"gc.root_bead_id": root.ID,
-			"gc.attempt":      "1",
-			"gc.step_ref":     "demo.loop.run.1.child-scope-check",
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
 		},
 	})
+	mustDepAdd(t, store, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, store, workflow.ID, finalizer.ID, "blocks")
 
-	if got := resolveLogicalBeadID(store, scopeCheck); got != child.ID {
-		t.Fatalf("resolveLogicalBeadID(child scope-check) = %q, want %q", got, child.ID)
+	if _, err := ProcessControl(store, finalizer, ProcessOptions{}); err != nil {
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
+	}
+	sourceAfter, err := store.Get(source.ID)
+	if err != nil {
+		t.Fatalf("get source: %v", err)
+	}
+	if sourceAfter.Status != "closed" {
+		t.Fatalf("source status = %q, want closed", sourceAfter.Status)
+	}
+	if got := sourceAfter.Metadata["gc.outcome"]; got != "pass" {
+		t.Fatalf("source gc.outcome = %q, want pass", got)
 	}
 }
 
-func TestProcessRalphCheckExhaustsRetries(t *testing.T) {
+func TestProcessWorkflowFinalizeStopsOnSourceChainCycle(t *testing.T) {
 	t.Parallel()
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
-
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 2)
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Cyclic workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	parent := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Cyclic parent",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.source_bead_id": workflow.ID,
+		},
+	})
+	if err := store.SetMetadata(workflow.ID, "gc.source_bead_id", parent.ID); err != nil {
+		t.Fatalf("SetMetadata(workflow source): %v", err)
+	}
+	cleanup := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "Clean up worktree",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.outcome": "pass",
+		},
+	})
+	finalizer := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	mustDepAdd(t, store, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, store, workflow.ID, finalizer.ID, "blocks")
 
-	if err := store.Close(run1.ID); err != nil {
-		t.Fatalf("close run1: %v", err)
+	var trace bytes.Buffer
+	if _, err := ProcessControl(store, finalizer, ProcessOptions{
+		Tracef: func(format string, args ...any) {
+			fmt.Fprintf(&trace, format+"\n", args...) //nolint:errcheck // test buffer
+		},
+	}); err != nil {
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
 	}
-	result1, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	finalizerAfter, err := store.Get(finalizer.ID)
 	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
-	}
-	if !result1.Processed || result1.Action != "retry" {
-		t.Fatalf("result1 = %+v, want processed retry", result1)
+		t.Fatalf("get finalizer: %v", err)
 	}
-
-	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
-	if err := store.Close(run2.ID); err != nil {
-		t.Fatalf("close run2: %v", err)
+	if finalizerAfter.Status != "closed" {
+		t.Fatalf("finalizer status = %q, want closed", finalizerAfter.Status)
 	}
-	result2, err := ProcessControl(store, check2, ProcessOptions{CityPath: cityPath})
+	parentAfter, err := store.Get(parent.ID)
 	if err != nil {
-		t.Fatalf("ProcessControl(check2): %v", err)
+		t.Fatalf("get parent: %v", err)
 	}
-	if !result2.Processed || result2.Action != "fail" {
-		t.Fatalf("result2 = %+v, want processed fail", result2)
-	}
-
-	logicalAfter := mustGetBead(t, store, logical.ID)
-	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "fail" {
-		t.Fatalf("logical = status %q outcome %q, want closed/fail", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	if parentAfter.Status != "closed" {
+		t.Fatalf("parent status = %q, want closed before cycle stop", parentAfter.Status)
 	}
-	if got := logicalAfter.Metadata["gc.failed_attempt"]; got != "2" {
-		t.Fatalf("logical failed attempt = %q, want 2", got)
+	if got := strings.Count(trace.String(), "reason=cycle"); got != 2 {
+		t.Fatalf("cycle trace count = %d, want 2:\n%s", got, trace.String())
 	}
 }
 
-func TestProcessRalphCheckRetriesNestedAttemptScope(t *testing.T) {
+func TestPreflightSourceBeadChainReportsDepthLimitBeforeMutation(t *testing.T) {
 	t.Parallel()
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "nested-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 0\n")
-
 	store := beads.NewMemStore()
-	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "workflow",
+	root := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Workflow root",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":             "workflow",
-			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id": "pending",
 		},
 	})
-	logical := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review loop",
-		Type:  "task",
-		Metadata: map[string]string{
-			"gc.kind":         "ralph",
-			"gc.step_id":      "review-loop",
-			"gc.max_attempts": "2",
-			"gc.root_bead_id": workflow.ID,
+	previousID := root.ID
+	sourceIDs := make([]string, 0, maxSourceChainHops+2)
+	for i := 0; i < 34; i++ {
+		source := mustCreateWorkflowBead(t, store, beads.Bead{
+			Title: fmt.Sprintf("Source %d", i),
+			Type:  "task",
+		})
+		sourceIDs = append(sourceIDs, source.ID)
+		if err := store.SetMetadata(previousID, "gc.source_bead_id", source.ID); err != nil {
+			t.Fatalf("SetMetadata(source %d): %v", i, err)
+		}
+		previousID = source.ID
+	}
+
+	var trace bytes.Buffer
+	err := preflightSourceBeadChain(store, root.ID, ProcessOptions{
+		Tracef: func(format string, args ...any) {
+			fmt.Fprintf(&trace, format+"\n", args...) //nolint:errcheck // test buffer
 		},
 	})
-	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "attempt 1 body",
+	if err == nil {
+		t.Fatal("preflightSourceBeadChain err = nil, want depth-limit error")
+	}
+	if !strings.Contains(err.Error(), "depth limit") {
+		t.Fatalf("preflightSourceBeadChain error = %v, want depth-limit error", err)
+	}
+	closed := 0
+	for _, sourceID := range sourceIDs {
+		source, err := store.Get(sourceID)
+		if err != nil {
+			t.Fatalf("get source %s: %v", sourceID, err)
+		}
+		if source.Status == "closed" {
+			closed++
+		}
+	}
+	if closed != 0 {
+		t.Fatalf("closed source count = %d, want 0 before source-chain mutation", closed)
+	}
+	if !strings.Contains(trace.String(), "reason=depth_limit") {
+		t.Fatalf("trace missing depth_limit:\n%s", trace.String())
+	}
+}
+
+func TestWithoutSourceWorkflowRootLegacyFallbackExcludesMatchingIDOnly(t *testing.T) {
+	t.Parallel()
+
+	roots := []beads.Bead{
+		{
+			ID: "shared-root-id",
+			Metadata: map[string]string{
+				sourceworkflow.SourceStoreRefMetadataKey: "rig:other",
+			},
+		},
+		{ID: "other-root"},
+	}
+
+	got := withoutSourceWorkflowRoot(roots, "shared-root-id", "")
+	if len(got) != 1 || got[0].ID != "other-root" {
+		t.Fatalf("withoutSourceWorkflowRoot legacy fallback = %#v, want only other-root retained", got)
+	}
+}
+
+// TestProcessWorkflowFinalizeLeavesCrossStoreSourceBeadOpenOnFailure pins the
+// failure-side contract: a failed workflow should leave the city source bead
+// open so a human can see and act on the failure. Closure propagation only
+// happens on success.
+func TestProcessWorkflowFinalizeLeavesCrossStoreSourceBeadOpenOnFailure(t *testing.T) {
+	t.Parallel()
+
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
+
+	citySource := mustCreateWorkflowBead(t, cityStore, beads.Bead{
+		Title: "Adopt PR: gastownhall/example#2",
+		Type:  "task",
+	})
+
+	rigLaunch := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Adopt PR workflow: gastownhall/example#2",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "scope",
-			"gc.scope_role":      "body",
-			"gc.scope_name":      "review-loop",
-			"gc.step_ref":        "mol-adopt-pr-v2.review-loop.run.1",
-			"gc.step_id":         "review-loop",
-			"gc.ralph_step_id":   "review-loop",
-			"gc.attempt":         "1",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": logical.ID,
+			"gc.source_bead_id":   citySource.ID,
+			"gc.source_store_ref": "city:test",
 		},
 	})
-	member1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "review claude",
+
+	workflow := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "mol-adopt-pr-v2",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.scope_ref":     "review-loop.run.1",
-			"gc.scope_role":    "member",
-			"gc.on_fail":       "abort_scope",
-			"gc.step_id":       "review-loop",
-			"gc.ralph_step_id": "review-loop",
-			"gc.attempt":       "1",
-			"gc.root_bead_id":  workflow.ID,
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   rigLaunch.ID,
+			"gc.source_store_ref": "rig:test",
 		},
 	})
-	control1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "Finalize scope for review claude",
-		Type:  "task",
+
+	cleanup := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title:  "Clean up worktree",
+		Type:   "task",
+		Status: "closed",
 		Metadata: map[string]string{
-			"gc.kind":          "scope-check",
-			"gc.scope_ref":     "review-loop.run.1",
-			"gc.scope_role":    "control",
-			"gc.control_for":   "review-loop.run.1.review-claude",
-			"gc.step_id":       "review-loop",
-			"gc.ralph_step_id": "review-loop",
-			"gc.attempt":       "1",
-			"gc.on_fail":       "abort_scope",
-			"gc.root_bead_id":  workflow.ID,
+			"gc.outcome": "fail",
 		},
 	})
-	check1 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "check review loop",
+
+	finalizer := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Finalize workflow",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "check",
-			"gc.step_id":         "review-loop",
-			"gc.ralph_step_id":   "review-loop",
-			"gc.attempt":         "1",
-			"gc.check_mode":      "exec",
-			"gc.check_path":      checkPath,
-			"gc.check_timeout":   "30s",
-			"gc.max_attempts":    "2",
-			"gc.root_bead_id":    workflow.ID,
-			"gc.logical_bead_id": logical.ID,
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
 		},
 	})
 
-	mustDepAdd(t, store, control1.ID, member1.ID, "blocks")
-	mustDepAdd(t, store, run1.ID, control1.ID, "blocks")
-	mustDepAdd(t, store, check1.ID, run1.ID, "blocks")
-	mustDepAdd(t, store, logical.ID, check1.ID, "blocks")
-
-	if err := store.SetMetadataBatch(member1.ID, map[string]string{"gc.outcome": "fail"}); err != nil {
-		t.Fatalf("mark member fail: %v", err)
-	}
-	if err := store.Close(member1.ID); err != nil {
-		t.Fatalf("close member1: %v", err)
-	}
-	if _, err := ProcessControl(store, control1, ProcessOptions{}); err != nil {
-		t.Fatalf("ProcessControl(scope-check): %v", err)
-	}
+	mustDepAdd(t, rigStore, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, rigStore, workflow.ID, finalizer.ID, "blocks")
 
-	run1After := mustGetBead(t, store, run1.ID)
-	if run1After.Status != "closed" || run1After.Metadata["gc.outcome"] != "fail" {
-		t.Fatalf("run1/body = status %q outcome %q, want closed/fail", run1After.Status, run1After.Metadata["gc.outcome"])
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test":
+			return cityStore, nil
+		case "rig:test":
+			return rigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown store ref: %s", ref)
+		}
 	}
 
-	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	result, err := ProcessControl(rigStore, finalizer, ProcessOptions{
+		ResolveStoreRef: resolver,
+	})
 	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
+		t.Fatalf("ProcessControl(workflow-finalize): %v", err)
 	}
-	if !result.Processed || result.Action != "retry" {
-		t.Fatalf("result = %+v, want processed retry", result)
+	if !result.Processed || result.Action != "workflow-fail" {
+		t.Fatalf("workflow result = %+v, want processed workflow-fail", result)
 	}
 
-	logicalDeps, err := store.DepList(logical.ID, "down")
+	rigRootAfter, err := rigStore.Get(workflow.ID)
 	if err != nil {
-		t.Fatalf("logical deps: %v", err)
-	}
-	if len(logicalDeps) != 1 {
-		t.Fatalf("logical deps = %+v, want exactly one current blocker", logicalDeps)
+		t.Fatalf("get workflow root: %v", err)
 	}
-	check2 := mustGetBead(t, store, logicalDeps[0].DependsOnID)
-	run2ID, err := resolveBlockingSubjectID(store, check2.ID)
-	if err != nil {
-		t.Fatalf("resolve run2 subject: %v", err)
+	if rigRootAfter.Status != "closed" {
+		t.Fatalf("workflow root status = %q, want closed", rigRootAfter.Status)
 	}
-	run2 := mustGetBead(t, store, run2ID)
-	if run2.Metadata["gc.kind"] != "scope" || run2.Metadata["gc.attempt"] != "2" {
-		t.Fatalf("run2 metadata = %+v, want scope attempt 2", run2.Metadata)
+	if got := rigRootAfter.Metadata["gc.outcome"]; got != "fail" {
+		t.Errorf("workflow root gc.outcome = %q, want %q", got, "fail")
 	}
 
-	all, err := store.ListOpen()
+	finalizerAfter, err := rigStore.Get(finalizer.ID)
 	if err != nil {
-		t.Fatalf("store.List: %v", err)
-	}
-	var clonedMember beads.Bead
-	var clonedControl beads.Bead
-	for _, bead := range all {
-		if bead.ID == member1.ID || bead.ID == control1.ID {
-			continue
-		}
-		if bead.Metadata["gc.attempt"] != "2" {
-			continue
-		}
-		if bead.Metadata["gc.scope_ref"] != run2.Metadata["gc.step_ref"] {
-			continue
-		}
-		switch bead.Metadata["gc.kind"] {
-		case "scope-check":
-			clonedControl = bead
-		default:
-			clonedMember = bead
-		}
+		t.Fatalf("get workflow finalizer: %v", err)
 	}
-	if clonedMember.ID == "" {
-		t.Fatal("missing cloned nested member for attempt 2")
+	if finalizerAfter.Status != "closed" {
+		t.Fatalf("workflow finalizer status = %q, want closed", finalizerAfter.Status)
 	}
-	if clonedControl.ID == "" {
-		t.Fatal("missing cloned nested scope-check for attempt 2")
+	if got := finalizerAfter.Metadata["gc.outcome"]; got != "pass" {
+		t.Errorf("workflow finalizer gc.outcome = %q, want %q", got, "pass")
 	}
-	if clonedMember.Status != "open" {
-		t.Fatalf("cloned member status = %q, want open", clonedMember.Status)
+
+	rigLaunchAfter, err := rigStore.Get(rigLaunch.ID)
+	if err != nil {
+		t.Fatalf("get rig launch bead: %v", err)
 	}
-	if clonedControl.Metadata["gc.scope_ref"] != run2.Metadata["gc.step_ref"] {
-		t.Fatalf("cloned control scope_ref = %q, want %q", clonedControl.Metadata["gc.scope_ref"], run2.Metadata["gc.step_ref"])
+	if rigLaunchAfter.Status == "closed" {
+		t.Fatalf("rig launch bead status = closed; want still open on failed workflow")
 	}
 
-	ready, err := store.Ready()
+	citySourceAfter, err := cityStore.Get(citySource.ID)
 	if err != nil {
-		t.Fatalf("store.Ready: %v", err)
+		t.Fatalf("get city source bead: %v", err)
 	}
-	foundMemberReady := false
-	for _, bead := range ready {
-		if bead.ID == clonedMember.ID {
-			foundMemberReady = true
-		}
+	if citySourceAfter.Status == "closed" {
+		t.Fatalf("city source bead status = closed; want still open on failed workflow so the human can act on the failure")
 	}
-	if !foundMemberReady {
-		t.Fatalf("expected cloned nested member %s to be ready; ready=%+v", clonedMember.ID, ready)
+}
+
+func TestProcessWorkflowFinalizeKeepsFinalizerOpenWhenSourceResolverFails(t *testing.T) {
+	t.Parallel()
+
+	rigStore := beads.NewMemStore()
+
+	rigLaunch := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Adopt PR workflow: gastownhall/example#3",
+		Type:  "task",
+	})
+
+	workflow := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "mol-adopt-pr-v2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   rigLaunch.ID,
+			"gc.source_store_ref": "rig:test",
+		},
+	})
+
+	cleanup := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title:  "Clean up worktree",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.outcome": "pass",
+		},
+	})
+
+	finalizer := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+
+	mustDepAdd(t, rigStore, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, rigStore, workflow.ID, finalizer.ID, "blocks")
+
+	_, err := ProcessControl(rigStore, finalizer, ProcessOptions{
+		ResolveStoreRef: func(ref string) (beads.Store, error) {
+			return nil, fmt.Errorf("resolver offline for %s", ref)
+		},
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) error = nil, want resolver failure")
+	}
+	if !strings.Contains(err.Error(), "resolver offline for rig:test") {
+		t.Fatalf("ProcessControl(workflow-finalize) error = %v, want resolver failure context", err)
+	}
+
+	finalizerAfter, err := rigStore.Get(finalizer.ID)
+	if err != nil {
+		t.Fatalf("get workflow finalizer: %v", err)
+	}
+	if finalizerAfter.Status != "open" {
+		t.Fatalf("workflow finalizer status = %q, want open so source-chain closure can retry", finalizerAfter.Status)
+	}
+
+	rigLaunchAfter, err := rigStore.Get(rigLaunch.ID)
+	if err != nil {
+		t.Fatalf("get rig launch bead: %v", err)
+	}
+	if rigLaunchAfter.Status != "open" {
+		t.Fatalf("rig launch bead status = %q, want open after resolver failure", rigLaunchAfter.Status)
 	}
 }
 
-func TestProcessRalphCheckRecoversPartialRetryAttempt(t *testing.T) {
+func TestProcessWorkflowFinalizeKeepsFinalizerOpenWhenSourceStoreReadFails(t *testing.T) {
 	t.Parallel()
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+	cityStore := beads.NewMemStore()
+	rigStore := beads.NewMemStore()
 
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
-	partialRun2 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "run 2",
+	citySource := mustCreateWorkflowBead(t, cityStore, beads.Bead{
+		Title: "Adopt PR: gastownhall/example#4",
+		Type:  "task",
+	})
+
+	rigLaunch := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Adopt PR workflow: gastownhall/example#4",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "run",
-			"gc.step_id":         "implement",
-			"gc.ralph_step_id":   "implement",
-			"gc.attempt":         "2",
-			"gc.step_ref":        "implement.run.2",
-			"gc.retry_from":      run1.ID,
-			"gc.logical_bead_id": logical.ID,
-			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+			"gc.source_bead_id":   citySource.ID,
+			"gc.source_store_ref": "city:test",
+		},
+	})
+
+	workflow := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "mol-adopt-pr-v2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+			"gc.source_bead_id":   rigLaunch.ID,
+			"gc.source_store_ref": "rig:test",
+		},
+	})
+
+	cleanup := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title:  "Clean up worktree",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.outcome": "pass",
+		},
+	})
+
+	finalizer := mustCreateWorkflowBead(t, rigStore, beads.Bead{
+		Title: "Finalize workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "workflow-finalize",
+			"gc.root_bead_id": workflow.ID,
 		},
 	})
+
+	mustDepAdd(t, rigStore, finalizer.ID, cleanup.ID, "blocks")
+	mustDepAdd(t, rigStore, workflow.ID, finalizer.ID, "blocks")
+
+	resolver := func(ref string) (beads.Store, error) {
+		switch ref {
+		case "city:test":
+			return getFailStore{
+				Store:  cityStore,
+				failID: citySource.ID,
+				err:    fmt.Errorf("city store read failed"),
+			}, nil
+		case "rig:test":
+			return rigStore, nil
+		default:
+			return nil, fmt.Errorf("unknown store ref: %s", ref)
+		}
+	}
+
+	_, err := ProcessControl(rigStore, finalizer, ProcessOptions{
+		ResolveStoreRef: resolver,
+	})
+	if err == nil {
+		t.Fatal("ProcessControl(workflow-finalize) error = nil, want source-store read failure")
+	}
+	if !strings.Contains(err.Error(), "city store read failed") {
+		t.Fatalf("ProcessControl(workflow-finalize) error = %v, want source-store read failure context", err)
+	}
+
+	finalizerAfter, err := rigStore.Get(finalizer.ID)
+	if err != nil {
+		t.Fatalf("get workflow finalizer: %v", err)
+	}
+	if finalizerAfter.Status != "open" {
+		t.Fatalf("workflow finalizer status = %q, want open so source-chain closure can retry", finalizerAfter.Status)
+	}
+
+	workflowAfter, err := rigStore.Get(workflow.ID)
+	if err != nil {
+		t.Fatalf("get workflow root: %v", err)
+	}
+	if workflowAfter.Status != "open" {
+		t.Fatalf("workflow root status = %q, want open because source-chain preflight failed", workflowAfter.Status)
+	}
+
+	rigLaunchAfter, err := rigStore.Get(rigLaunch.ID)
+	if err != nil {
+		t.Fatalf("get rig launch bead: %v", err)
+	}
+	if rigLaunchAfter.Status != "open" {
+		t.Fatalf("rig launch bead status = %q, want open because source-chain preflight failed", rigLaunchAfter.Status)
+	}
+
+	citySourceAfter, err := cityStore.Get(citySource.ID)
+	if err != nil {
+		t.Fatalf("get city source bead: %v", err)
+	}
+	if citySourceAfter.Status != "open" {
+		t.Fatalf("city source bead status = %q, want open after source-store read failure", citySourceAfter.Status)
+	}
+}
+
+type getFailStore struct {
+	beads.Store
+	failID string
+	err    error
+}
+
+func (s getFailStore) Get(id string) (beads.Bead, error) {
+	if id == s.failID {
+		return beads.Bead{}, s.err
+	}
+	return s.Store.Get(id)
+}
+
+func TestProcessRalphCheckRetriesThenPasses(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "retry-check.sh", "#!/bin/bash\nset -euo pipefail\nTARGET=\"$GC_CITY_PATH/retry-demo.txt\"\n[ -f \"$TARGET\" ]\ngrep -qx \"pass\" \"$TARGET\"\n")
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 2)
+
+	if err := os.WriteFile(filepath.Join(cityPath, "retry-demo.txt"), []byte("fail\n"), 0o644); err != nil {
+		t.Fatalf("write failing artifact: %v", err)
+	}
+	if err := store.Close(run1.ID); err != nil {
+		t.Fatalf("close run1: %v", err)
+	}
+
+	result1, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result1.Processed || result1.Action != "retry" {
+		t.Fatalf("result1 = %+v, want processed retry", result1)
+	}
+
+	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
+	if err := os.WriteFile(filepath.Join(cityPath, "retry-demo.txt"), []byte("pass\n"), 0o644); err != nil {
+		t.Fatalf("write passing artifact: %v", err)
+	}
+	if err := store.Close(run2.ID); err != nil {
+		t.Fatalf("close run2: %v", err)
+	}
+
+	result2, err := ProcessControl(store, check2, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check2): %v", err)
+	}
+	if !result2.Processed || result2.Action != "pass" {
+		t.Fatalf("result2 = %+v, want processed pass", result2)
+	}
+
+	logicalAfter := mustGetBead(t, store, logical.ID)
+	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("logical = status %q outcome %q, want closed/pass", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	}
+}
+
+func TestProcessRalphCheckPassClosesCheckBeforeLogicalAndPropagatesOutputJSON(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "pass-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 0\n")
+
+	store := &ralphPassOrderStore{MemStore: beads.NewMemStore()}
+	logical, run1, check1 := newSimpleRalphLoopInStore(t, store, "implement", checkPath, 1)
+	store.logicalID = logical.ID
+	store.checkID = check1.ID
+
+	if err := store.SetMetadata(run1.ID, "gc.output_json", `{"items":[{"name":"claude"}]}`); err != nil {
+		t.Fatalf("set run output json: %v", err)
+	}
 	if err := store.Close(run1.ID); err != nil {
 		t.Fatalf("close run1: %v", err)
 	}
@@ -1469,167 +2196,2196 @@ func TestProcessRalphCheckRecoversPartialRetryAttempt(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ProcessControl(check1): %v", err)
 	}
-	if !result.Processed || result.Action != "retry" {
-		t.Fatalf("result = %+v, want processed retry", result)
+	if !result.Processed || result.Action != "pass" {
+		t.Fatalf("result = %+v, want processed pass", result)
 	}
 
-	partialAfter := mustGetBead(t, store, partialRun2.ID)
-	if partialAfter.Status != "closed" || partialAfter.Metadata["gc.partial_retry"] != "true" || partialAfter.Metadata["gc.outcome"] != "skipped" {
-		t.Fatalf("partial run2 = status %q partial_retry=%q outcome=%q, want closed/true/skipped", partialAfter.Status, partialAfter.Metadata["gc.partial_retry"], partialAfter.Metadata["gc.outcome"])
+	checkAfter := mustGetBead(t, store, check1.ID)
+	if checkAfter.Status != "closed" || checkAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("check = status %q outcome %q, want closed/pass", checkAfter.Status, checkAfter.Metadata["gc.outcome"])
 	}
 
-	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
-	if run2.ID == partialRun2.ID {
-		t.Fatal("expected recreated run2, got preserved partial bead")
+	logicalAfter := mustGetBead(t, store, logical.ID)
+	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("logical = status %q outcome %q, want closed/pass", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
 	}
-	if check2.Metadata["gc.attempt"] != "2" {
-		t.Fatalf("check2 attempt = %q, want 2", check2.Metadata["gc.attempt"])
+	if got := logicalAfter.Metadata["gc.output_json"]; got != `{"items":[{"name":"claude"}]}` {
+		t.Fatalf("logical gc.output_json = %q, want propagated run output", got)
 	}
 }
 
-func TestProcessRalphCheckRecoversIncompletelyWiredRetryAttempt(t *testing.T) {
+func TestNestedRalphScopePassPropagatesOutputJSONToLogical(t *testing.T) {
 	t.Parallel()
 
 	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+	checkPath := writeCheckScript(t, cityPath, "nested-pass-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 0\n")
 
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
-	partialRun2 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "run 2",
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "run",
-			"gc.step_id":         "implement",
-			"gc.ralph_step_id":   "implement",
-			"gc.attempt":         "2",
-			"gc.step_ref":        "implement.run.2",
-			"gc.retry_from":      run1.ID,
-			"gc.logical_bead_id": logical.ID,
-			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
 		},
 	})
-	partialCheck2 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "check 2",
+	logical := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review-loop",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "check",
-			"gc.step_id":         "implement",
-			"gc.ralph_step_id":   "implement",
-			"gc.attempt":         "2",
-			"gc.step_ref":        "implement.check.2",
-			"gc.retry_from":      check1.ID,
-			"gc.logical_bead_id": logical.ID,
-			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+			"gc.kind":         "ralph",
+			"gc.step_id":      "review-loop",
+			"gc.max_attempts": "1",
+			"gc.root_bead_id": workflow.ID,
 		},
 	})
-	if err := store.DepAdd(logical.ID, partialCheck2.ID, "blocks"); err != nil {
-		t.Fatalf("seed logical -> partial check2: %v", err)
+	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review-loop.run.1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                 "scope",
+			"gc.scope_role":           "body",
+			"gc.scope_name":           "review-loop",
+			"gc.step_ref":             "review-loop.run.1",
+			"gc.step_id":              "review-loop",
+			"gc.ralph_step_id":        "review-loop",
+			"gc.attempt":              "1",
+			"gc.root_bead_id":         workflow.ID,
+			"gc.logical_bead_id":      logical.ID,
+			"gc.output_json_required": "true",
+		},
+	})
+	member := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "review-loop.run.1.synthesize",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.scope_ref":            "review-loop.run.1",
+			"gc.scope_role":           "member",
+			"gc.output_json_required": "true",
+			"gc.output_json":          `{"items":[{"name":"claude"}]}`,
+			"gc.outcome":              "pass",
+			"gc.step_id":              "review-loop",
+			"gc.ralph_step_id":        "review-loop",
+			"gc.attempt":              "1",
+			"gc.root_bead_id":         workflow.ID,
+		},
+	})
+	control := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize scope for review-loop.run.1.synthesize",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":          "scope-check",
+			"gc.scope_ref":     "review-loop.run.1",
+			"gc.scope_role":    "control",
+			"gc.control_for":   "review-loop.run.1.synthesize",
+			"gc.step_id":       "review-loop",
+			"gc.ralph_step_id": "review-loop",
+			"gc.attempt":       "1",
+			"gc.on_fail":       "abort_scope",
+			"gc.root_bead_id":  workflow.ID,
+		},
+	})
+	check1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "check 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "review-loop",
+			"gc.ralph_step_id":   "review-loop",
+			"gc.attempt":         "1",
+			"gc.step_ref":        "review-loop.check.1",
+			"gc.check_mode":      "exec",
+			"gc.check_path":      checkPath,
+			"gc.check_timeout":   "30s",
+			"gc.max_attempts":    "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+
+	mustDepAdd(t, store, control.ID, member.ID, "blocks")
+	mustDepAdd(t, store, run1.ID, control.ID, "blocks")
+	mustDepAdd(t, store, check1.ID, run1.ID, "blocks")
+	mustDepAdd(t, store, logical.ID, check1.ID, "blocks")
+
+	scopeResult, err := ProcessControl(store, control, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(scope-check): %v", err)
+	}
+	if !scopeResult.Processed || scopeResult.Action != "scope-pass" {
+		t.Fatalf("scopeResult = %+v, want processed scope-pass", scopeResult)
+	}
+
+	runAfter := mustGetBead(t, store, run1.ID)
+	if runAfter.Status != "closed" || runAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("run1 = status %q outcome %q, want closed/pass", runAfter.Status, runAfter.Metadata["gc.outcome"])
+	}
+	if got := runAfter.Metadata["gc.output_json"]; got != `{"items":[{"name":"claude"}]}` {
+		t.Fatalf("run1 gc.output_json = %q, want propagated body output", got)
+	}
+
+	checkResult, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !checkResult.Processed || checkResult.Action != "pass" {
+		t.Fatalf("checkResult = %+v, want processed pass", checkResult)
+	}
+
+	logicalAfter := mustGetBead(t, store, logical.ID)
+	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("logical = status %q outcome %q, want closed/pass", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	}
+	if got := logicalAfter.Metadata["gc.output_json"]; got != `{"items":[{"name":"claude"}]}` {
+		t.Fatalf("logical gc.output_json = %q, want propagated nested output", got)
+	}
+}
+
+func TestProcessRalphCheckResumesExistingRetryAttemptWithoutDuplicates(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
+	if err := store.Close(run1.ID); err != nil {
+		t.Fatalf("close run1: %v", err)
+	}
+	if _, err := appendRalphRetry(store, logical.ID, run1, check1, 2, ProcessOptions{CityPath: cityPath}); err != nil {
+		t.Fatalf("appendRalphRetry: %v", err)
+	}
+
+	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	all, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List: %v", err)
+	}
+	attempt2 := 0
+	for _, bead := range all {
+		if bead.Metadata["gc.attempt"] == "2" {
+			attempt2++
+		}
+	}
+	if attempt2 != 2 {
+		t.Fatalf("attempt 2 bead count = %d, want 2", attempt2)
+	}
+
+	check1After := mustGetBead(t, store, check1.ID)
+	if check1After.Status != "closed" || check1After.Metadata["gc.outcome"] != "fail" {
+		t.Fatalf("check1 = status %q outcome %q, want closed/fail", check1After.Status, check1After.Metadata["gc.outcome"])
+	}
+	if got := check1After.Metadata["gc.retry_state"]; got != "spawned" {
+		t.Fatalf("check1 retry_state = %q, want spawned", got)
+	}
+}
+
+func TestAppendRalphRetryDefersAssigneesUntilDepsAreWired(t *testing.T) {
+	t.Parallel()
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", "unused", 3)
+	inspect := &assigneeVisibilityOnCreateStore{MemStore: store}
+	runner := "runner"
+	checker := "checker"
+	if err := inspect.Update(run1.ID, beads.UpdateOpts{Assignee: &runner}); err != nil {
+		t.Fatalf("assign run1: %v", err)
+	}
+	if err := inspect.Update(check1.ID, beads.UpdateOpts{Assignee: &checker}); err != nil {
+		t.Fatalf("assign check1: %v", err)
+	}
+	run1 = mustGetBead(t, inspect, run1.ID)
+	check1 = mustGetBead(t, inspect, check1.ID)
+
+	mapping, err := appendRalphRetry(inspect, logical.ID, run1, check1, 2, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("appendRalphRetry: %v", err)
+	}
+	if len(inspect.visibleOnCreate) > 0 {
+		t.Fatalf("retry beads became visible in assignee queues during creation before wiring completed: %v", inspect.visibleOnCreate)
+	}
+
+	run2 := mustGetBead(t, inspect, mapping[run1.ID])
+	check2 := mustGetBead(t, inspect, mapping[check1.ID])
+	if run2.Assignee != runner {
+		t.Fatalf("run2 assignee = %q, want %q", run2.Assignee, runner)
+	}
+	if check2.Assignee != checker {
+		t.Fatalf("check2 assignee = %q, want %q", check2.Assignee, checker)
+	}
+}
+
+func TestAppendRalphRetryGraphEdgesSkipsParentChildDeps(t *testing.T) {
+	t.Parallel()
+
+	store := beads.NewMemStore()
+	parent := mustCreateWorkflowBead(t, store, beads.Bead{Title: "parent", Type: "task"})
+	child := mustCreateWorkflowBead(t, store, beads.Bead{Title: "child", Type: "task", ParentID: parent.ID})
+	blocker := mustCreateWorkflowBead(t, store, beads.Bead{Title: "blocker", Type: "task"})
+	mustDepAdd(t, store, child.ID, parent.ID, "parent-child")
+	mustDepAdd(t, store, child.ID, blocker.ID, "blocks")
+
+	plan := &beads.GraphApplyPlan{}
+	if err := appendRalphRetryGraphEdges(plan, store, child.ID, map[string]bool{
+		parent.ID:  true,
+		blocker.ID: true,
+	}); err != nil {
+		t.Fatalf("appendRalphRetryGraphEdges: %v", err)
+	}
+
+	if len(plan.Edges) != 1 {
+		t.Fatalf("edges = %+v, want only the blocking edge", plan.Edges)
+	}
+	edge := plan.Edges[0]
+	if edge.Type != "blocks" || edge.FromKey != child.ID || edge.ToKey != blocker.ID {
+		t.Fatalf("edge = %+v, want blocks edge to blocker", edge)
+	}
+}
+
+func TestAppendRalphRetryClearsPoolAssignee(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	if err := os.WriteFile(filepath.Join(cityPath, "city.toml"), []byte(`
+[workspace]
+name = "test-city"
+provider = "claude"
+
+[[agent]]
+name = "polecat"
+
+[agent.pool]
+min = 0
+max = -1
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", "unused", 3)
+	poolSlot := "polecat-2"
+	if err := store.Update(run1.ID, beads.UpdateOpts{
+		Assignee: &poolSlot,
+		Metadata: map[string]string{"gc.routed_to": "polecat"},
+	}); err != nil {
+		t.Fatalf("assign pooled run1: %v", err)
+	}
+	run1 = mustGetBead(t, store, run1.ID)
+	check1 = mustGetBead(t, store, check1.ID)
+
+	mapping, err := appendRalphRetry(store, logical.ID, run1, check1, 2, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("appendRalphRetry: %v", err)
+	}
+
+	run2 := mustGetBead(t, store, mapping[run1.ID])
+	if run2.Assignee != "" {
+		t.Fatalf("run2 assignee = %q, want empty for pooled retry task", run2.Assignee)
+	}
+}
+
+func TestAppendRalphRetryRemapsNestedRetryLogicalRefs(t *testing.T) {
+	t.Parallel()
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	logical := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review loop",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.step_id":      "review-loop",
+			"gc.max_attempts": "2",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "attempt 1 body",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "scope",
+			"gc.scope_role":      "body",
+			"gc.scope_name":      "review-loop",
+			"gc.step_ref":        "demo.review-loop.run.1",
+			"gc.step_id":         "review-loop",
+			"gc.ralph_step_id":   "review-loop",
+			"gc.attempt":         "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+	check1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "check review loop",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "review-loop",
+			"gc.ralph_step_id":   "review-loop",
+			"gc.attempt":         "1",
+			"gc.max_attempts":    "2",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+			"gc.step_ref":        "demo.review-loop.check.1",
+		},
+	})
+	nestedLogical := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review claude",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "retry",
+			"gc.scope_ref":    "demo.review-loop.run.1",
+			"gc.scope_role":   "member",
+			"gc.step_ref":     "demo.review-loop.run.1.review-claude",
+			"gc.max_attempts": "3",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	nestedRun := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review claude run 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "retry-run",
+			"gc.scope_ref":       "demo.review-loop.run.1",
+			"gc.scope_role":      "member",
+			"gc.step_ref":        "demo.review-loop.run.1.review-claude.run.1",
+			"gc.attempt":         "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": nestedLogical.ID,
+		},
+	})
+	nestedEval := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review claude eval 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "retry-eval",
+			"gc.scope_ref":       "demo.review-loop.run.1",
+			"gc.scope_role":      "member",
+			"gc.step_ref":        "demo.review-loop.run.1.review-claude.eval.1",
+			"gc.control_for":     "demo.review-loop.run.1.review-claude.eval.1",
+			"gc.attempt":         "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": nestedLogical.ID,
+		},
+	})
+
+	mustDepAdd(t, store, nestedLogical.ID, nestedEval.ID, "blocks")
+	mustDepAdd(t, store, nestedEval.ID, nestedRun.ID, "blocks")
+	mustDepAdd(t, store, check1.ID, run1.ID, "blocks")
+	mustDepAdd(t, store, logical.ID, check1.ID, "blocks")
+
+	mapping, err := appendRalphRetry(store, logical.ID, run1, check1, 2, ProcessOptions{})
+	if err != nil {
+		t.Fatalf("appendRalphRetry: %v", err)
+	}
+
+	nestedLogical2 := mustGetBead(t, store, mapping[nestedLogical.ID])
+	nestedRun2 := mustGetBead(t, store, mapping[nestedRun.ID])
+	nestedEval2 := mustGetBead(t, store, mapping[nestedEval.ID])
+
+	if got := nestedRun2.Metadata["gc.logical_bead_id"]; got != nestedLogical2.ID {
+		t.Fatalf("nested run gc.logical_bead_id = %q, want %q", got, nestedLogical2.ID)
+	}
+	if got := nestedEval2.Metadata["gc.logical_bead_id"]; got != nestedLogical2.ID {
+		t.Fatalf("nested eval gc.logical_bead_id = %q, want %q", got, nestedLogical2.ID)
+	}
+	if got := nestedEval2.Metadata["gc.control_for"]; got != "demo.review-loop.run.2.review-claude.eval.1" {
+		t.Fatalf("nested eval gc.control_for = %q, want demo.review-loop.run.2.review-claude.eval.1", got)
+	}
+}
+
+func TestBuildRalphRetryGraphNodeRemapsNestedRetryLogicalRef(t *testing.T) {
+	t.Parallel()
+
+	node := buildRalphRetryGraphNode(beads.Bead{
+		ID:    "old-eval",
+		Title: "eval",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "retry-eval",
+			"gc.attempt":         "1",
+			"gc.scope_ref":       "demo.review-loop.run.1",
+			"gc.step_ref":        "demo.review-loop.run.1.review-claude.eval.1",
+			"gc.control_for":     "demo.review-loop.run.1.review-claude.eval.1",
+			"gc.logical_bead_id": "old-logical",
+		},
+	}, "top-logical", "demo.review-loop.run.1", "demo.review-loop.run.2", 1, 2, map[string]bool{
+		"old-eval":    true,
+		"old-logical": true,
+	}, (*config.City)(nil))
+
+	if got := node.Metadata["gc.step_ref"]; got != "demo.review-loop.run.2.review-claude.eval.1" {
+		t.Fatalf("node gc.step_ref = %q, want demo.review-loop.run.2.review-claude.eval.1", got)
+	}
+	if got := node.Metadata["gc.control_for"]; got != "demo.review-loop.run.2.review-claude.eval.1" {
+		t.Fatalf("node gc.control_for = %q, want demo.review-loop.run.2.review-claude.eval.1", got)
+	}
+	if got := node.MetadataRefs["gc.logical_bead_id"]; got != "old-logical" {
+		t.Fatalf("node gc.logical_bead_id ref = %q, want old-logical", got)
+	}
+	if got := node.Metadata["gc.logical_bead_id"]; got != "" {
+		t.Fatalf("node gc.logical_bead_id = %q, want empty metadata when ref remap is used", got)
+	}
+}
+
+func TestBuildRalphRetryGraphNodeRemapsNestedScopeCheckControlForFromStepRef(t *testing.T) {
+	t.Parallel()
+
+	node := buildRalphRetryGraphNode(beads.Bead{
+		ID:    "old-scope-check",
+		Title: "scope-check",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":        "scope-check",
+			"gc.attempt":     "3",
+			"gc.scope_ref":   "mol-adopt-pr-v2.review-loop.run.3",
+			"gc.step_ref":    "mol-adopt-pr-v2.review-loop.run.3.review-pipeline.review-codex.run.1-scope-check",
+			"gc.control_for": "review-loop.run.3.review-pipeline.review-codex.run.1",
+		},
+	}, "top-logical", "mol-adopt-pr-v2.review-loop.run.3", "mol-adopt-pr-v2.review-loop.run.4", 3, 4, nil, (*config.City)(nil))
+
+	if got := node.Metadata["gc.step_ref"]; got != "mol-adopt-pr-v2.review-loop.run.4.review-pipeline.review-codex.run.1-scope-check" {
+		t.Fatalf("node gc.step_ref = %q, want rewritten outer Ralph scope with nested retry attempt unchanged", got)
+	}
+	if got := node.Metadata["gc.control_for"]; got != "mol-adopt-pr-v2.review-loop.run.4.review-pipeline.review-codex.run.1" {
+		t.Fatalf("node gc.control_for = %q, want scope-check control_for derived from rewritten step_ref", got)
+	}
+}
+
+func TestLogicalStepRefForAttemptBeadPrefersNestedAttemptOverOuterRalphScope(t *testing.T) {
+	t.Parallel()
+
+	bead := beads.Bead{
+		Metadata: map[string]string{
+			"gc.kind":     "scope-check",
+			"gc.attempt":  "3",
+			"gc.step_ref": "mol-adopt-pr-v2.review-loop.run.3.review-pipeline.review-codex.eval.1-scope-check",
+		},
+	}
+
+	if got := logicalStepRefForAttemptBead(bead); got != "mol-adopt-pr-v2.review-loop.run.3.review-pipeline.review-codex" {
+		t.Fatalf("logicalStepRefForAttemptBead(scope-check) = %q, want nested retry logical step", got)
+	}
+}
+
+func TestLogicalStepRefForAttemptBeadMapsFlatScopeCheckToControlStep(t *testing.T) {
+	t.Parallel()
+
+	bead := beads.Bead{
+		Metadata: map[string]string{
+			"gc.kind":     "scope-check",
+			"gc.step_ref": "demo.review-scope-check",
+		},
+	}
+
+	if got := logicalStepRefForAttemptBead(bead); got != "demo.review" {
+		t.Fatalf("logicalStepRefForAttemptBead(flat scope-check) = %q, want demo.review", got)
+	}
+}
+
+func TestResolveLogicalBeadIDPrefersExactScopeCheckTargetStep(t *testing.T) {
+	t.Parallel()
+
+	store := beads.NewMemStore()
+	root := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	_ = mustCreateWorkflowBead(t, store, beads.Bead{
+		ID:    "parent",
+		Title: "loop",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "demo.loop",
+		},
+	})
+	child := mustCreateWorkflowBead(t, store, beads.Bead{
+		ID:    "child",
+		Title: "child",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "retry",
+			"gc.root_bead_id": root.ID,
+			"gc.step_ref":     "demo.loop.run.1.child",
+		},
+	})
+	scopeCheck := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize child scope",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope-check",
+			"gc.root_bead_id": root.ID,
+			"gc.attempt":      "1",
+			"gc.step_ref":     "demo.loop.run.1.child-scope-check",
+		},
+	})
+
+	if got := resolveLogicalBeadID(store, scopeCheck); got != child.ID {
+		t.Fatalf("resolveLogicalBeadID(child scope-check) = %q, want %q", got, child.ID)
+	}
+}
+
+func TestProcessRalphCheckExhaustsRetries(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 2)
+
+	if err := store.Close(run1.ID); err != nil {
+		t.Fatalf("close run1: %v", err)
+	}
+	result1, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result1.Processed || result1.Action != "retry" {
+		t.Fatalf("result1 = %+v, want processed retry", result1)
+	}
+
+	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
+	if err := store.Close(run2.ID); err != nil {
+		t.Fatalf("close run2: %v", err)
+	}
+	result2, err := ProcessControl(store, check2, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check2): %v", err)
+	}
+	if !result2.Processed || result2.Action != "fail" {
+		t.Fatalf("result2 = %+v, want processed fail", result2)
+	}
+
+	logicalAfter := mustGetBead(t, store, logical.ID)
+	if logicalAfter.Status != "closed" || logicalAfter.Metadata["gc.outcome"] != "fail" {
+		t.Fatalf("logical = status %q outcome %q, want closed/fail", logicalAfter.Status, logicalAfter.Metadata["gc.outcome"])
+	}
+	if got := logicalAfter.Metadata["gc.failed_attempt"]; got != "2" {
+		t.Fatalf("logical failed attempt = %q, want 2", got)
+	}
+}
+
+func TestProcessRalphCheckRetriesNestedAttemptScope(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "nested-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 0\n")
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	logical := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review loop",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "ralph",
+			"gc.step_id":      "review-loop",
+			"gc.max_attempts": "2",
+			"gc.root_bead_id": workflow.ID,
+		},
+	})
+	run1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "attempt 1 body",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "scope",
+			"gc.scope_role":      "body",
+			"gc.scope_name":      "review-loop",
+			"gc.step_ref":        "mol-adopt-pr-v2.review-loop.run.1",
+			"gc.step_id":         "review-loop",
+			"gc.ralph_step_id":   "review-loop",
+			"gc.attempt":         "1",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+	member1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "review claude",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.scope_ref":     "review-loop.run.1",
+			"gc.scope_role":    "member",
+			"gc.on_fail":       "abort_scope",
+			"gc.step_id":       "review-loop",
+			"gc.ralph_step_id": "review-loop",
+			"gc.attempt":       "1",
+			"gc.root_bead_id":  workflow.ID,
+		},
+	})
+	control1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize scope for review claude",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":          "scope-check",
+			"gc.scope_ref":     "review-loop.run.1",
+			"gc.scope_role":    "control",
+			"gc.control_for":   "review-loop.run.1.review-claude",
+			"gc.step_id":       "review-loop",
+			"gc.ralph_step_id": "review-loop",
+			"gc.attempt":       "1",
+			"gc.on_fail":       "abort_scope",
+			"gc.root_bead_id":  workflow.ID,
+		},
+	})
+	check1 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "check review loop",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "review-loop",
+			"gc.ralph_step_id":   "review-loop",
+			"gc.attempt":         "1",
+			"gc.check_mode":      "exec",
+			"gc.check_path":      checkPath,
+			"gc.check_timeout":   "30s",
+			"gc.max_attempts":    "2",
+			"gc.root_bead_id":    workflow.ID,
+			"gc.logical_bead_id": logical.ID,
+		},
+	})
+
+	mustDepAdd(t, store, control1.ID, member1.ID, "blocks")
+	mustDepAdd(t, store, run1.ID, control1.ID, "blocks")
+	mustDepAdd(t, store, check1.ID, run1.ID, "blocks")
+	mustDepAdd(t, store, logical.ID, check1.ID, "blocks")
+
+	if err := store.SetMetadataBatch(member1.ID, map[string]string{"gc.outcome": "fail"}); err != nil {
+		t.Fatalf("mark member fail: %v", err)
+	}
+	if err := store.Close(member1.ID); err != nil {
+		t.Fatalf("close member1: %v", err)
+	}
+	if _, err := ProcessControl(store, control1, ProcessOptions{}); err != nil {
+		t.Fatalf("ProcessControl(scope-check): %v", err)
+	}
+
+	run1After := mustGetBead(t, store, run1.ID)
+	if run1After.Status != "closed" || run1After.Metadata["gc.outcome"] != "fail" {
+		t.Fatalf("run1/body = status %q outcome %q, want closed/fail", run1After.Status, run1After.Metadata["gc.outcome"])
+	}
+
+	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	logicalDeps, err := store.DepList(logical.ID, "down")
+	if err != nil {
+		t.Fatalf("logical deps: %v", err)
+	}
+	if len(logicalDeps) != 1 {
+		t.Fatalf("logical deps = %+v, want exactly one current blocker", logicalDeps)
+	}
+	check2 := mustGetBead(t, store, logicalDeps[0].DependsOnID)
+	run2ID, err := resolveBlockingSubjectID(store, check2.ID)
+	if err != nil {
+		t.Fatalf("resolve run2 subject: %v", err)
+	}
+	run2 := mustGetBead(t, store, run2ID)
+	if run2.Metadata["gc.kind"] != "scope" || run2.Metadata["gc.attempt"] != "2" {
+		t.Fatalf("run2 metadata = %+v, want scope attempt 2", run2.Metadata)
+	}
+
+	all, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List: %v", err)
+	}
+	var clonedMember beads.Bead
+	var clonedControl beads.Bead
+	for _, bead := range all {
+		if bead.ID == member1.ID || bead.ID == control1.ID {
+			continue
+		}
+		if bead.Metadata["gc.attempt"] != "2" {
+			continue
+		}
+		if bead.Metadata["gc.scope_ref"] != run2.Metadata["gc.step_ref"] {
+			continue
+		}
+		switch bead.Metadata["gc.kind"] {
+		case "scope-check":
+			clonedControl = bead
+		default:
+			clonedMember = bead
+		}
+	}
+	if clonedMember.ID == "" {
+		t.Fatal("missing cloned nested member for attempt 2")
+	}
+	if clonedControl.ID == "" {
+		t.Fatal("missing cloned nested scope-check for attempt 2")
+	}
+	if clonedMember.Status != "open" {
+		t.Fatalf("cloned member status = %q, want open", clonedMember.Status)
+	}
+	if clonedControl.Metadata["gc.scope_ref"] != run2.Metadata["gc.step_ref"] {
+		t.Fatalf("cloned control scope_ref = %q, want %q", clonedControl.Metadata["gc.scope_ref"], run2.Metadata["gc.step_ref"])
+	}
+
+	ready, err := store.Ready()
+	if err != nil {
+		t.Fatalf("store.Ready: %v", err)
+	}
+	foundMemberReady := false
+	for _, bead := range ready {
+		if bead.ID == clonedMember.ID {
+			foundMemberReady = true
+		}
+	}
+	if !foundMemberReady {
+		t.Fatalf("expected cloned nested member %s to be ready; ready=%+v", clonedMember.ID, ready)
+	}
+}
+
+func TestProcessRalphCheckRecoversPartialRetryAttempt(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
+	partialRun2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "run 2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "run",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "2",
+			"gc.step_ref":        "implement.run.2",
+			"gc.retry_from":      run1.ID,
+			"gc.logical_bead_id": logical.ID,
+			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+		},
+	})
+	if err := store.Close(run1.ID); err != nil {
+		t.Fatalf("close run1: %v", err)
+	}
+
+	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	partialAfter := mustGetBead(t, store, partialRun2.ID)
+	if partialAfter.Status != "closed" || partialAfter.Metadata["gc.partial_retry"] != "true" || partialAfter.Metadata["gc.outcome"] != "skipped" {
+		t.Fatalf("partial run2 = status %q partial_retry=%q outcome=%q, want closed/true/skipped", partialAfter.Status, partialAfter.Metadata["gc.partial_retry"], partialAfter.Metadata["gc.outcome"])
+	}
+
+	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
+	if run2.ID == partialRun2.ID {
+		t.Fatal("expected recreated run2, got preserved partial bead")
+	}
+	if check2.Metadata["gc.attempt"] != "2" {
+		t.Fatalf("check2 attempt = %q, want 2", check2.Metadata["gc.attempt"])
+	}
+}
+
+func TestProcessRalphCheckRecoversIncompletelyWiredRetryAttempt(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
+	partialRun2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "run 2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "run",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "2",
+			"gc.step_ref":        "implement.run.2",
+			"gc.retry_from":      run1.ID,
+			"gc.logical_bead_id": logical.ID,
+			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+		},
+	})
+	partialCheck2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "check 2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "2",
+			"gc.step_ref":        "implement.check.2",
+			"gc.retry_from":      check1.ID,
+			"gc.logical_bead_id": logical.ID,
+			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+		},
+	})
+	if err := store.DepAdd(logical.ID, partialCheck2.ID, "blocks"); err != nil {
+		t.Fatalf("seed logical -> partial check2: %v", err)
+	}
+	if err := store.Close(run1.ID); err != nil {
+		t.Fatalf("close run1: %v", err)
+	}
+
+	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	for _, partialID := range []string{partialRun2.ID, partialCheck2.ID} {
+		partial := mustGetBead(t, store, partialID)
+		if partial.Status != "closed" || partial.Metadata["gc.partial_retry"] != "true" || partial.Metadata["gc.outcome"] != "skipped" {
+			t.Fatalf("partial bead %s = status %q partial_retry=%q outcome=%q, want closed/true/skipped", partialID, partial.Status, partial.Metadata["gc.partial_retry"], partial.Metadata["gc.outcome"])
+		}
+	}
+
+	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
+	if run2.ID == partialRun2.ID || check2.ID == partialCheck2.ID {
+		t.Fatal("expected recreated retry attempt, got preserved incompletely wired beads")
+	}
+}
+
+func TestProcessRalphCheckRecoversRetryAttemptMissingFinalAssigneePass(t *testing.T) {
+	t.Parallel()
+
+	cityPath := t.TempDir()
+	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+
+	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
+	runner := "runner"
+	checker := "checker"
+	if err := store.Update(run1.ID, beads.UpdateOpts{Assignee: &runner}); err != nil {
+		t.Fatalf("assign run1: %v", err)
+	}
+	if err := store.Update(check1.ID, beads.UpdateOpts{Assignee: &checker}); err != nil {
+		t.Fatalf("assign check1: %v", err)
+	}
+	run1 = mustGetBead(t, store, run1.ID)
+	check1 = mustGetBead(t, store, check1.ID)
+
+	partialRun2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "run 2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "run",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "2",
+			"gc.step_ref":        "implement.run.2",
+			"gc.retry_from":      run1.ID,
+			"gc.logical_bead_id": logical.ID,
+			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+		},
+	})
+	partialCheck2 := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "check 2",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":            "check",
+			"gc.step_id":         "implement",
+			"gc.ralph_step_id":   "implement",
+			"gc.attempt":         "2",
+			"gc.step_ref":        "implement.check.2",
+			"gc.retry_from":      check1.ID,
+			"gc.logical_bead_id": logical.ID,
+			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+		},
+	})
+	mustDepAdd(t, store, partialCheck2.ID, partialRun2.ID, "blocks")
+	mustDepAdd(t, store, logical.ID, partialCheck2.ID, "blocks")
+	if err := store.Close(run1.ID); err != nil {
+		t.Fatalf("close run1: %v", err)
+	}
+
+	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	if err != nil {
+		t.Fatalf("ProcessControl(check1): %v", err)
+	}
+	if !result.Processed || result.Action != "retry" {
+		t.Fatalf("result = %+v, want processed retry", result)
+	}
+
+	for _, partialID := range []string{partialRun2.ID, partialCheck2.ID} {
+		partial := mustGetBead(t, store, partialID)
+		if partial.Status != "closed" || partial.Metadata["gc.partial_retry"] != "true" || partial.Metadata["gc.outcome"] != "skipped" {
+			t.Fatalf("partial bead %s = status %q partial_retry=%q outcome=%q, want closed/true/skipped", partialID, partial.Status, partial.Metadata["gc.partial_retry"], partial.Metadata["gc.outcome"])
+		}
+	}
+
+	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
+	if run2.ID == partialRun2.ID || check2.ID == partialCheck2.ID {
+		t.Fatal("expected recreated retry attempt after missing assignee finalization")
+	}
+	if run2.Assignee != runner {
+		t.Fatalf("run2 assignee = %q, want %q", run2.Assignee, runner)
+	}
+	if check2.Assignee != checker {
+		t.Fatalf("check2 assignee = %q, want %q", check2.Assignee, checker)
+	}
+}
+
+func TestProcessFanoutSpawnsFragmentsAndClosesOnSecondPass(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[vars.scope_ref]
+default = ""
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.scope_ref" = "{scope_ref}" }
+
+[[template]]
+id = "{target}.synth"
+title = "Synthesize {reviewer}"
+needs = ["{target}.review"]
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"},{"name":"codex"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.control_for":  "demo.survey",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result1, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result1.Processed || result1.Action != "fanout-spawn" {
+		t.Fatalf("result1 = %+v, want processed fanout-spawn", result1)
+	}
+
+	fanoutAfterSpawn := mustGetBead(t, store, fanout.ID)
+	if fanoutAfterSpawn.Status != "open" {
+		t.Fatalf("fanout status after spawn = %q, want open", fanoutAfterSpawn.Status)
+	}
+	if got := fanoutAfterSpawn.Metadata["gc.fanout_state"]; got != "spawned" {
+		t.Fatalf("fanout state = %q, want spawned", got)
+	}
+
+	all, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List: %v", err)
+	}
+	var sinkIDs []string
+	reviewCount := 0
+	synthCount := 0
+	for _, bead := range all {
+		if bead.Metadata["gc.root_bead_id"] != workflow.ID {
+			continue
+		}
+		switch {
+		case strings.HasSuffix(bead.Metadata["gc.step_ref"], ".review"):
+			reviewCount++
+			if !strings.Contains(bead.Title, "claude") && !strings.Contains(bead.Title, "codex") {
+				t.Fatalf("unexpected review title %q", bead.Title)
+			}
+			if err := store.SetMetadataBatch(bead.ID, map[string]string{"gc.outcome": "pass"}); err != nil {
+				t.Fatalf("mark review pass: %v", err)
+			}
+			if err := store.Close(bead.ID); err != nil {
+				t.Fatalf("close review: %v", err)
+			}
+		case strings.HasSuffix(bead.Metadata["gc.step_ref"], ".synth"):
+			synthCount++
+			sinkIDs = append(sinkIDs, bead.ID)
+		}
+	}
+	if reviewCount != 2 || synthCount != 2 {
+		t.Fatalf("spawned reviews=%d synths=%d, want 2/2", reviewCount, synthCount)
+	}
+
+	for _, sinkID := range sinkIDs {
+		if err := store.SetMetadataBatch(sinkID, map[string]string{"gc.outcome": "pass"}); err != nil {
+			t.Fatalf("mark sink pass: %v", err)
+		}
+		if err := store.Close(sinkID); err != nil {
+			t.Fatalf("close sink: %v", err)
+		}
+	}
+
+	result2, err := ProcessControl(store, mustGetBead(t, store, fanout.ID), ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout finalize): %v", err)
+	}
+	if !result2.Processed || result2.Action != "fanout-pass" {
+		t.Fatalf("result2 = %+v, want processed fanout-pass", result2)
+	}
+
+	fanoutClosed := mustGetBead(t, store, fanout.ID)
+	if fanoutClosed.Status != "closed" || fanoutClosed.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("fanout = status %q outcome %q, want closed/pass", fanoutClosed.Status, fanoutClosed.Metadata["gc.outcome"])
+	}
+}
+
+func TestProcessFanoutRoutesFragmentRetryControlsToControlDispatcher(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte(`
+[workspace]
+name = "maintainer-city"
+
+[[rig]]
+name = "gascity"
+path = "/tmp/gascity"
+
+[[agent]]
+name = "reviewer"
+dir = "gascity"
+
+[[agent]]
+name = "control-dispatcher"
+dir = "gascity"
+max_active_sessions = 1
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.run_target" = "{reviewer}", "gc.scope_ref" = "body", "gc.scope_role" = "member" }
+
+[template.retry]
+max_attempts = 3
+on_exhausted = "hard_fail"
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"gascity/reviewer"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                "fanout",
+			"gc.root_bead_id":        workflow.ID,
+			"gc.control_for":         "demo.survey",
+			"gc.execution_routed_to": "gascity/reviewer",
+			"gc.for_each":            "output.items",
+			"gc.bond":                "expansion-review",
+			"gc.bond_vars":           `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":         "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{
+		CityPath:           dir,
+		FormulaSearchPaths: []string{dir},
+	})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+
+	logical := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review")
+	if logical.ID == "" {
+		t.Fatal("logical retry control not created")
+	}
+	if logical.Metadata["gc.kind"] != "retry" {
+		t.Fatalf("logical gc.kind = %q, want retry", logical.Metadata["gc.kind"])
+	}
+	if got := logical.Assignee; got != "gascity--control-dispatcher" {
+		t.Fatalf("logical retry assignee = %q, want gascity--control-dispatcher", got)
+	}
+	if got := logical.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("logical retry gc.routed_to = %q, want empty direct dispatcher assignee", got)
+	}
+	if got := logical.Metadata["gc.execution_routed_to"]; got != "gascity/reviewer" {
+		t.Fatalf("logical retry gc.execution_routed_to = %q, want gascity/reviewer", got)
+	}
+}
+
+func TestProcessFanoutRoutesFragmentMemberSteps(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte(`
+[workspace]
+name = "maintainer-city"
+
+[[rig]]
+name = "gascity"
+path = "/tmp/gascity"
+
+[[agent]]
+name = "reviewer"
+dir = "gascity"
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.run_target" = "{reviewer}", "gc.scope_ref" = "body", "gc.scope_role" = "member" }
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"gascity/reviewer"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                "fanout",
+			"gc.root_bead_id":        workflow.ID,
+			"gc.control_for":         "demo.survey",
+			"gc.execution_routed_to": "gascity/reviewer",
+			"gc.for_each":            "output.items",
+			"gc.bond":                "expansion-review",
+			"gc.bond_vars":           `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":         "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{
+		CityPath:           dir,
+		FormulaSearchPaths: []string{dir},
+	})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+
+	member := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review")
+	if member.ID == "" {
+		t.Fatal("member step not created")
+	}
+	if got := member.Assignee; got != "" {
+		t.Fatalf("member assignee = %q, want empty metadata-routed assignee", got)
+	}
+	if got := member.Metadata["gc.routed_to"]; got != "gascity/reviewer" {
+		t.Fatalf("member gc.routed_to = %q, want gascity/reviewer", got)
+	}
+	if got := member.Metadata["gc.execution_routed_to"]; got != "gascity/reviewer" {
+		t.Fatalf("member gc.execution_routed_to = %q, want gascity/reviewer", got)
+	}
+}
+
+func TestProcessFanoutDoesNotUseControlRoutedToAsExecutionRoute(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte(`
+[workspace]
+name = "maintainer-city"
+
+[[rig]]
+name = "gascity"
+path = "/tmp/gascity"
+
+[[agent]]
+name = "control-dispatcher"
+dir = "gascity"
+max_active_sessions = 1
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review"
+
+[template.retry]
+max_attempts = 3
+on_exhausted = "hard_fail"
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.control_for":  "demo.survey",
+			"gc.routed_to":    "gascity/control-dispatcher",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.fanout_mode":  "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{
+		CityPath:           dir,
+		FormulaSearchPaths: []string{dir},
+	})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+
+	logical := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review")
+	if logical.ID == "" {
+		t.Fatal("logical retry control not created")
+	}
+	if got := logical.Metadata["gc.execution_routed_to"]; got != "" {
+		t.Fatalf("logical retry gc.execution_routed_to = %q, want empty when control has no execution route", got)
+	}
+}
+
+func TestProcessFanoutPreservesPreparedControlExecutionRoutes(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte(`
+[workspace]
+name = "maintainer-city"
+
+[[rig]]
+name = "gascity"
+path = "/tmp/gascity"
+
+[[agent]]
+name = "reviewer"
+dir = "gascity"
+
+[[agent]]
+name = "control-dispatcher"
+dir = "gascity"
+max_active_sessions = 1
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.run_target" = "{reviewer}", "gc.scope_ref" = "body", "gc.scope_role" = "member" }
+
+[template.retry]
+max_attempts = 3
+on_exhausted = "hard_fail"
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"gascity/reviewer"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                "fanout",
+			"gc.root_bead_id":        workflow.ID,
+			"gc.control_for":         "demo.survey",
+			"gc.execution_routed_to": "gascity/reviewer",
+			"gc.for_each":            "output.items",
+			"gc.bond":                "expansion-review",
+			"gc.bond_vars":           `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":         "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{
+		CityPath:           dir,
+		FormulaSearchPaths: []string{dir},
+		PrepareFragment: func(fragment *formula.FragmentRecipe, _ beads.Bead) error {
+			for i := range fragment.Steps {
+				if fragment.Steps[i].Metadata == nil {
+					fragment.Steps[i].Metadata = make(map[string]string)
+				}
+				fragment.Steps[i].Metadata["gc.dynamic_fragment"] = "true"
+			}
+			formula.ApplyFragmentRecipeGraphControls(fragment)
+			for i := range fragment.Steps {
+				step := &fragment.Steps[i]
+				switch step.Metadata["gc.kind"] {
+				case "workflow", "scope", "ralph", "retry", "spec":
+					continue
+				case "scope-check", "workflow-finalize", "fanout", "check", "retry-eval":
+					step.Metadata["gc.execution_routed_to"] = "gascity/reviewer"
+					delete(step.Metadata, "gc.routed_to")
+					step.Assignee = "gascity--control-dispatcher"
+				default:
+					step.Metadata["gc.routed_to"] = "gascity/reviewer"
+					delete(step.Metadata, "gc.execution_routed_to")
+					step.Assignee = "gascity--reviewer"
+				}
+			}
+			return nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+
+	retryControl := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review")
+	if retryControl.ID == "" {
+		t.Fatal("retry control not created")
+	}
+	if retryControl.Metadata["gc.kind"] != "retry" {
+		t.Fatalf("retry control gc.kind = %q, want retry", retryControl.Metadata["gc.kind"])
+	}
+	if got := retryControl.Assignee; got != "gascity--control-dispatcher" {
+		t.Fatalf("retry control assignee = %q, want gascity--control-dispatcher", got)
+	}
+	if got := retryControl.Metadata["gc.execution_routed_to"]; got != "gascity/reviewer" {
+		t.Fatalf("retry control gc.execution_routed_to = %q, want gascity/reviewer", got)
+	}
+
+	scopeCheck := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review-scope-check")
+	if scopeCheck.ID == "" {
+		t.Fatal("scope-check control not created")
+	}
+	if scopeCheck.Metadata["gc.kind"] != "scope-check" {
+		t.Fatalf("scope-check gc.kind = %q, want scope-check", scopeCheck.Metadata["gc.kind"])
+	}
+	if got := scopeCheck.Assignee; got != "gascity--control-dispatcher" {
+		t.Fatalf("scope-check assignee = %q, want gascity--control-dispatcher", got)
+	}
+	if got := scopeCheck.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("scope-check gc.routed_to = %q, want empty direct dispatcher assignee", got)
+	}
+	if got := scopeCheck.Metadata["gc.execution_routed_to"]; got != "gascity/reviewer" {
+		t.Fatalf("scope-check gc.execution_routed_to = %q, want gascity/reviewer", got)
+	}
+}
+
+func TestProcessFanoutUsesResolvedSourceStepRefForIterationScopedFragments(t *testing.T) {
+	t.Parallel()
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[vars.reviewer]
+required = true
+
+[vars.scope_ref]
+default = "body"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.scope_ref" = "{scope_ref}" }
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	_ = mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "stale prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"stale"}]}`,
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "mol.review-loop.iteration.2.design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for prepare items",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "mol.review-loop.iteration.2",
+			"gc.control_for":  "design-review.prepare-review-items",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}","scope_ref":"body"}`,
+			"gc.fanout_mode":  "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("spawn result = %+v, want processed fanout-spawn", result)
+	}
+
+	child := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.2.design-review.prepare-review-items.item.1.review")
+	if child.ID == "" {
+		t.Fatal("missing iteration-qualified fanout child")
+	}
+	if got := child.Metadata["gc.scope_ref"]; got != "mol.review-loop.iteration.2" {
+		t.Fatalf("child gc.scope_ref = %q, want live fanout scope", got)
+	}
+	if stale := findAttemptByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.review"); stale.ID != "" {
+		t.Fatalf("spawned stale logical child ref %q; want iteration-qualified source step ref", stale.Metadata["gc.step_ref"])
+	}
+}
+
+func TestProcessFanoutPropagatesLiveScopeRefWithoutBondVarOverride(t *testing.T) {
+	t.Parallel()
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[vars.reviewer]
+required = true
+
+[vars.scope_ref]
+default = "body"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.scope_ref" = "{scope_ref}" }
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "mol.review-loop.iteration.4.design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for prepare items",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "mol.review-loop.iteration.4",
+			"gc.control_for":  "design-review.prepare-review-items",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("spawn result = %+v, want processed fanout-spawn", result)
+	}
+
+	child := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.4.design-review.prepare-review-items.item.1.review")
+	if child.ID == "" {
+		t.Fatal("missing iteration-qualified fanout child")
+	}
+	if got := child.Metadata["gc.scope_ref"]; got != "mol.review-loop.iteration.4" {
+		t.Fatalf("child gc.scope_ref = %q, want live fanout scope without bond_vars scope_ref", got)
+	}
+}
+
+func TestProcessFanoutDoesNotReusePriorIterationFragments(t *testing.T) {
+	t.Parallel()
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[vars.reviewer]
+required = true
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	_ = mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "old review",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "expansion-review.design-review.prepare-review-items.item.1.review",
+			"gc.outcome":      "pass",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "mol.review-loop.iteration.3.design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for prepare items",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "mol.review-loop.iteration.3",
+			"gc.control_for":  "design-review.prepare-review-items",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if result.Created == 0 {
+		t.Fatalf("fanout reused a prior-iteration fragment; created=%d", result.Created)
+	}
+	if child := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.3.design-review.prepare-review-items.item.1.review"); child.ID == "" {
+		t.Fatal("missing new iteration-qualified review child")
+	}
+}
+
+func TestProcessFanoutUsesControlForWhenSourceStepRefIsLogical(t *testing.T) {
+	t.Parallel()
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[vars.reviewer]
+required = true
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for prepare items",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.control_for":  "design-review.prepare-review-items",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	if _, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}}); err != nil {
+		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+	}
+	if child := findAttemptByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.review"); child.ID == "" {
+		t.Fatal("missing logical source child")
+	}
+}
+
+func TestProcessFanoutRecreatesExistingFragmentWithStaleRouteMetadata(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "city.toml"), []byte(`
+[workspace]
+name = "maintainer-city"
+
+[[rig]]
+name = "gascity"
+path = "/tmp/gascity"
+
+[[agent]]
+name = "reviewer"
+dir = "gascity"
+
+[[agent]]
+name = "control-dispatcher"
+dir = "gascity"
+max_active_sessions = 1
+`), 0o644); err != nil {
+		t.Fatalf("write city.toml: %v", err)
+	}
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+metadata = { "gc.run_target" = "{reviewer}", "gc.scope_ref" = "body", "gc.scope_role" = "member" }
+
+[template.retry]
+max_attempts = 3
+on_exhausted = "hard_fail"
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"gascity/reviewer"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":                "fanout",
+			"gc.root_bead_id":        workflow.ID,
+			"gc.control_for":         "demo.survey",
+			"gc.execution_routed_to": "gascity/reviewer",
+			"gc.for_each":            "output.items",
+			"gc.bond":                "expansion-review",
+			"gc.bond_vars":           `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":         "parallel",
+			"gc.fanout_state":        "spawning",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	fragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
+		ID:          "demo.survey.item.1",
+		Title:       source.Title,
+		Description: source.Description,
+	}, map[string]string{"reviewer": "gascity/reviewer"})
+	if err != nil {
+		t.Fatalf("CompileExpansionFragment: %v", err)
+	}
+	routeFanoutFragmentSteps(fragment, fanout, ProcessOptions{CityPath: dir}, store)
+	if _, err := molecule.InstantiateFragment(context.Background(), store, fragment, molecule.FragmentOptions{RootID: workflow.ID}); err != nil {
+		t.Fatalf("InstantiateFragment: %v", err)
+	}
+	staleRetryControl := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review")
+	if staleRetryControl.ID == "" {
+		t.Fatal("stale retry control not created")
+	}
+	if err := store.SetMetadataBatch(staleRetryControl.ID, map[string]string{"gc.execution_routed_to": "gascity/old-reviewer"}); err != nil {
+		t.Fatalf("stale route metadata: %v", err)
+	}
+
+	result, err := ProcessControl(store, fanout, ProcessOptions{
+		CityPath:           dir,
+		FormulaSearchPaths: []string{dir},
+	})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout resume): %v", err)
+	}
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+	if result.Created == 0 {
+		t.Fatal("expected stale fragment to be discarded and recreated")
+	}
+
+	staleAfter := mustGetBead(t, store, staleRetryControl.ID)
+	if staleAfter.Status != "closed" || staleAfter.Metadata["gc.partial_fragment"] != "true" || staleAfter.Metadata["gc.outcome"] != "skipped" {
+		t.Fatalf("stale retry control = status %q partial=%q outcome=%q, want closed/true/skipped", staleAfter.Status, staleAfter.Metadata["gc.partial_fragment"], staleAfter.Metadata["gc.outcome"])
+	}
+	recreated := findAttemptByRef(t, store, workflow.ID, "expansion-review.demo.survey.item.1.review")
+	if recreated.ID == "" || recreated.ID == staleRetryControl.ID {
+		t.Fatalf("recreated retry control ID = %q, stale ID = %q", recreated.ID, staleRetryControl.ID)
+	}
+	if got := recreated.Metadata["gc.execution_routed_to"]; got != "gascity/reviewer" {
+		t.Fatalf("recreated retry control gc.execution_routed_to = %q, want gascity/reviewer", got)
+	}
+}
+
+func TestProcessFanoutResumesExistingFragmentsWithoutDuplicates(t *testing.T) {
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+
+[[template]]
+id = "{target}.synth"
+title = "Synthesize {reviewer}"
+needs = ["{target}.review"]
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "survey",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "demo.survey",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"},{"name":"codex"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for survey",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.control_for":  "demo.survey",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+			"gc.fanout_state": "spawning",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	for i, reviewer := range []string{"claude", "codex"} {
+		targetRef := "demo.survey.item." + strconv.Itoa(i+1)
+		fragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
+			ID:          targetRef,
+			Title:       source.Title,
+			Description: source.Description,
+		}, map[string]string{"reviewer": reviewer})
+		if err != nil {
+			t.Fatalf("CompileExpansionFragment(%s): %v", reviewer, err)
+		}
+		if _, err := molecule.InstantiateFragment(context.Background(), store, fragment, molecule.FragmentOptions{RootID: workflow.ID}); err != nil {
+			t.Fatalf("InstantiateFragment(%s): %v", reviewer, err)
+		}
 	}
-	if err := store.Close(run1.ID); err != nil {
-		t.Fatalf("close run1: %v", err)
+
+	before, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List before: %v", err)
 	}
 
-	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
 	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
+		t.Fatalf("ProcessControl(fanout resume): %v", err)
 	}
-	if !result.Processed || result.Action != "retry" {
-		t.Fatalf("result = %+v, want processed retry", result)
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+	if result.Created != 0 {
+		t.Fatalf("result.Created = %d, want 0 newly created beads", result.Created)
 	}
 
-	for _, partialID := range []string{partialRun2.ID, partialCheck2.ID} {
-		partial := mustGetBead(t, store, partialID)
-		if partial.Status != "closed" || partial.Metadata["gc.partial_retry"] != "true" || partial.Metadata["gc.outcome"] != "skipped" {
-			t.Fatalf("partial bead %s = status %q partial_retry=%q outcome=%q, want closed/true/skipped", partialID, partial.Status, partial.Metadata["gc.partial_retry"], partial.Metadata["gc.outcome"])
-		}
+	after, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List after: %v", err)
+	}
+	if len(after) != len(before) {
+		t.Fatalf("bead count after resume = %d, want unchanged %d", len(after), len(before))
 	}
 
-	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
-	if run2.ID == partialRun2.ID || check2.ID == partialCheck2.ID {
-		t.Fatal("expected recreated retry attempt, got preserved incompletely wired beads")
+	fanoutAfter := mustGetBead(t, store, fanout.ID)
+	if got := fanoutAfter.Metadata["gc.fanout_state"]; got != "spawned" {
+		t.Fatalf("fanout state after resume = %q, want spawned", got)
 	}
 }
 
-func TestProcessRalphCheckRecoversRetryAttemptMissingFinalAssigneePass(t *testing.T) {
+func TestProcessFanoutResumesLegacyIterationFragmentsWithoutDuplicates(t *testing.T) {
 	t.Parallel()
+	formulatest.EnableV2ForTest(t)
 
-	cityPath := t.TempDir()
-	checkPath := writeCheckScript(t, cityPath, "always-fail-check.sh", "#!/bin/bash\nset -euo pipefail\nexit 1\n")
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
 
-	store, logical, run1, check1 := newSimpleRalphLoop(t, "implement", checkPath, 3)
-	runner := "runner"
-	checker := "checker"
-	if err := store.Update(run1.ID, beads.UpdateOpts{Assignee: &runner}); err != nil {
-		t.Fatalf("assign run1: %v", err)
-	}
-	if err := store.Update(check1.ID, beads.UpdateOpts{Assignee: &checker}); err != nil {
-		t.Fatalf("assign check1: %v", err)
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+
+[[template]]
+id = "{target}.synth"
+title = "Synthesize {reviewer}"
+needs = ["{target}.review"]
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
 	}
-	run1 = mustGetBead(t, store, run1.ID)
-	check1 = mustGetBead(t, store, check1.ID)
 
-	partialRun2 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "run 2",
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "run",
-			"gc.step_id":         "implement",
-			"gc.ralph_step_id":   "implement",
-			"gc.attempt":         "2",
-			"gc.step_ref":        "implement.run.2",
-			"gc.retry_from":      run1.ID,
-			"gc.logical_bead_id": logical.ID,
-			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
 		},
 	})
-	partialCheck2 := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "check 2",
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "mol.review-loop.iteration.5.design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for prepare items",
 		Type:  "task",
 		Metadata: map[string]string{
-			"gc.kind":            "check",
-			"gc.step_id":         "implement",
-			"gc.ralph_step_id":   "implement",
-			"gc.attempt":         "2",
-			"gc.step_ref":        "implement.check.2",
-			"gc.retry_from":      check1.ID,
-			"gc.logical_bead_id": logical.ID,
-			"gc.root_bead_id":    logical.Metadata["gc.root_bead_id"],
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "mol.review-loop.iteration.5",
+			"gc.control_for":  "design-review.prepare-review-items",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+			"gc.fanout_state": "spawning",
 		},
 	})
-	mustDepAdd(t, store, partialCheck2.ID, partialRun2.ID, "blocks")
-	mustDepAdd(t, store, logical.ID, partialCheck2.ID, "blocks")
-	if err := store.Close(run1.ID); err != nil {
-		t.Fatalf("close run1: %v", err)
-	}
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
 
-	result, err := ProcessControl(store, check1, ProcessOptions{CityPath: cityPath})
+	legacyFragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
+		ID:          "design-review.prepare-review-items.item.1",
+		Title:       source.Title,
+		Description: source.Description,
+	}, map[string]string{
+		"reviewer":  "claude",
+		"scope_ref": "mol.review-loop.iteration.5",
+	})
 	if err != nil {
-		t.Fatalf("ProcessControl(check1): %v", err)
+		t.Fatalf("CompileExpansionFragment(legacy): %v", err)
 	}
-	if !result.Processed || result.Action != "retry" {
-		t.Fatalf("result = %+v, want processed retry", result)
+	legacyInst, err := molecule.InstantiateFragment(context.Background(), store, legacyFragment, molecule.FragmentOptions{RootID: workflow.ID})
+	if err != nil {
+		t.Fatalf("InstantiateFragment(legacy): %v", err)
+	}
+	for _, sinkID := range mapStepIDs(legacyFragment.Sinks, legacyInst.IDMapping) {
+		mustDepAdd(t, store, fanout.ID, sinkID, "blocks")
 	}
 
-	for _, partialID := range []string{partialRun2.ID, partialCheck2.ID} {
-		partial := mustGetBead(t, store, partialID)
-		if partial.Status != "closed" || partial.Metadata["gc.partial_retry"] != "true" || partial.Metadata["gc.outcome"] != "skipped" {
-			t.Fatalf("partial bead %s = status %q partial_retry=%q outcome=%q, want closed/true/skipped", partialID, partial.Status, partial.Metadata["gc.partial_retry"], partial.Metadata["gc.outcome"])
-		}
+	before, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List before: %v", err)
 	}
 
-	run2, check2 := nextSimpleAttempt(t, store, logical.ID)
-	if run2.ID == partialRun2.ID || check2.ID == partialCheck2.ID {
-		t.Fatal("expected recreated retry attempt after missing assignee finalization")
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout legacy resume): %v", err)
 	}
-	if run2.Assignee != runner {
-		t.Fatalf("run2 assignee = %q, want %q", run2.Assignee, runner)
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
 	}
-	if check2.Assignee != checker {
-		t.Fatalf("check2 assignee = %q, want %q", check2.Assignee, checker)
+	if result.Created != 0 {
+		t.Fatalf("result.Created = %d, want legacy fragment reuse without duplication", result.Created)
+	}
+
+	after, err := store.ListOpen()
+	if err != nil {
+		t.Fatalf("store.List after: %v", err)
+	}
+	if len(after) != len(before) {
+		t.Fatalf("open bead count after legacy resume = %d, want unchanged %d", len(after), len(before))
+	}
+
+	if reused := findAttemptByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.review"); reused.ID == "" {
+		t.Fatal("missing reused legacy fragment bead")
+	}
+	if duplicated := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.5.design-review.prepare-review-items.item.1.review"); duplicated.ID != "" {
+		t.Fatalf("created duplicate iteration-qualified fragment %q instead of reusing legacy fragment", duplicated.ID)
 	}
 }
 
-func TestProcessFanoutSpawnsFragmentsAndClosesOnSecondPass(t *testing.T) {
+func TestProcessFanoutBlankStateRecreatesLegacyFragmentsWithoutOwnershipProof(t *testing.T) {
+	t.Parallel()
 	formulatest.EnableV2ForTest(t)
 
 	dir := t.TempDir()
@@ -1662,23 +4418,24 @@ needs = ["{target}.review"]
 		},
 	})
 	source := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title:  "survey",
+		Title:  "prepare items",
 		Type:   "task",
 		Status: "closed",
 		Metadata: map[string]string{
 			"gc.root_bead_id": workflow.ID,
-			"gc.step_ref":     "demo.survey",
+			"gc.step_ref":     "mol.review-loop.iteration.6.design-review.prepare-review-items",
 			"gc.outcome":      "pass",
-			"gc.output_json":  `{"items":[{"name":"claude"},{"name":"codex"}]}`,
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
 		},
 	})
 	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "Expand fanout for survey",
+		Title: "Expand fanout for prepare items",
 		Type:  "task",
 		Metadata: map[string]string{
 			"gc.kind":         "fanout",
 			"gc.root_bead_id": workflow.ID,
-			"gc.control_for":  "demo.survey",
+			"gc.scope_ref":    "mol.review-loop.iteration.6",
+			"gc.control_for":  "design-review.prepare-review-items",
 			"gc.for_each":     "output.items",
 			"gc.bond":         "expansion-review",
 			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
@@ -1687,78 +4444,161 @@ needs = ["{target}.review"]
 	})
 	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
 
-	result1, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	legacyFragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
+		ID:          "design-review.prepare-review-items.item.1",
+		Title:       source.Title,
+		Description: source.Description,
+	}, map[string]string{"reviewer": "claude"})
 	if err != nil {
-		t.Fatalf("ProcessControl(fanout spawn): %v", err)
+		t.Fatalf("CompileExpansionFragment(legacy): %v", err)
 	}
-	if !result1.Processed || result1.Action != "fanout-spawn" {
-		t.Fatalf("result1 = %+v, want processed fanout-spawn", result1)
+	if _, err := molecule.InstantiateFragment(context.Background(), store, legacyFragment, molecule.FragmentOptions{RootID: workflow.ID}); err != nil {
+		t.Fatalf("InstantiateFragment(legacy): %v", err)
 	}
 
-	fanoutAfterSpawn := mustGetBead(t, store, fanout.ID)
-	if fanoutAfterSpawn.Status != "open" {
-		t.Fatalf("fanout status after spawn = %q, want open", fanoutAfterSpawn.Status)
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
+	if err != nil {
+		t.Fatalf("ProcessControl(fanout blank-state legacy recreate): %v", err)
 	}
-	if got := fanoutAfterSpawn.Metadata["gc.fanout_state"]; got != "spawned" {
-		t.Fatalf("fanout state = %q, want spawned", got)
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+	if result.Created == 0 {
+		t.Fatal("expected blank-state fanout to recreate a current fragment when legacy ownership is unproven")
 	}
 
-	all, err := store.ListOpen()
-	if err != nil {
-		t.Fatalf("store.List: %v", err)
+	fanoutAfter := mustGetBead(t, store, fanout.ID)
+	if got := fanoutAfter.Metadata["gc.fanout_state"]; got != "spawned" {
+		t.Fatalf("fanout gc.fanout_state = %q, want spawned", got)
 	}
-	var sinkIDs []string
-	reviewCount := 0
-	synthCount := 0
-	for _, bead := range all {
-		if bead.Metadata["gc.root_bead_id"] != workflow.ID {
-			continue
+	if child := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.6.design-review.prepare-review-items.item.1.review"); child.ID == "" {
+		t.Fatal("missing new iteration-qualified review child")
+	}
+	legacyReview := findWorkflowBeadByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.review")
+	legacySynth := findWorkflowBeadByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.synth")
+	for _, legacy := range []beads.Bead{legacyReview, legacySynth} {
+		if legacy.ID == "" {
+			t.Fatal("missing retired legacy fragment bead")
 		}
-		switch {
-		case strings.HasSuffix(bead.Metadata["gc.step_ref"], ".review"):
-			reviewCount++
-			if !strings.Contains(bead.Title, "claude") && !strings.Contains(bead.Title, "codex") {
-				t.Fatalf("unexpected review title %q", bead.Title)
-			}
-			if err := store.SetMetadataBatch(bead.ID, map[string]string{"gc.outcome": "pass"}); err != nil {
-				t.Fatalf("mark review pass: %v", err)
-			}
-			if err := store.Close(bead.ID); err != nil {
-				t.Fatalf("close review: %v", err)
-			}
-		case strings.HasSuffix(bead.Metadata["gc.step_ref"], ".synth"):
-			synthCount++
-			sinkIDs = append(sinkIDs, bead.ID)
+		if legacy.Status != "closed" {
+			t.Fatalf("legacy bead %s status = %q, want closed", legacy.ID, legacy.Status)
+		}
+		if legacy.Metadata["gc.partial_fragment"] != "true" {
+			t.Fatalf("legacy bead %s gc.partial_fragment = %q, want true", legacy.ID, legacy.Metadata["gc.partial_fragment"])
+		}
+		if mustReadyContains(t, store, legacy.ID) {
+			t.Fatalf("legacy bead %s should no longer be ready/open", legacy.ID)
 		}
 	}
-	if reviewCount != 2 || synthCount != 2 {
-		t.Fatalf("spawned reviews=%d synths=%d, want 2/2", reviewCount, synthCount)
+}
+
+func TestProcessFanoutDoesNotReuseOpenLegacyFragmentsWithoutOwnershipProof(t *testing.T) {
+	t.Parallel()
+	formulatest.EnableV2ForTest(t)
+
+	dir := t.TempDir()
+	expansion := `
+formula = "expansion-review"
+type = "expansion"
+version = 2
+contract = "graph.v2"
+
+[[template]]
+id = "{target}.review"
+title = "Review {reviewer}"
+
+[[template]]
+id = "{target}.synth"
+title = "Synthesize {reviewer}"
+needs = ["{target}.review"]
+`
+	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
+		t.Fatalf("write expansion formula: %v", err)
 	}
 
-	for _, sinkID := range sinkIDs {
-		if err := store.SetMetadataBatch(sinkID, map[string]string{"gc.outcome": "pass"}); err != nil {
-			t.Fatalf("mark sink pass: %v", err)
-		}
-		if err := store.Close(sinkID); err != nil {
-			t.Fatalf("close sink: %v", err)
-		}
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	source := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "prepare items",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "mol.review-loop.iteration.7.design-review.prepare-review-items",
+			"gc.outcome":      "pass",
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
+		},
+	})
+	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Expand fanout for prepare items",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "fanout",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "mol.review-loop.iteration.7",
+			"gc.control_for":  "design-review.prepare-review-items",
+			"gc.for_each":     "output.items",
+			"gc.bond":         "expansion-review",
+			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
+			"gc.fanout_mode":  "parallel",
+			"gc.fanout_state": "spawning",
+		},
+	})
+	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
+
+	legacyFragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
+		ID:          "design-review.prepare-review-items.item.1",
+		Title:       source.Title,
+		Description: source.Description,
+	}, map[string]string{"reviewer": "claude"})
+	if err != nil {
+		t.Fatalf("CompileExpansionFragment(legacy): %v", err)
+	}
+	if _, err := molecule.InstantiateFragment(context.Background(), store, legacyFragment, molecule.FragmentOptions{RootID: workflow.ID}); err != nil {
+		t.Fatalf("InstantiateFragment(legacy): %v", err)
 	}
 
-	result2, err := ProcessControl(store, mustGetBead(t, store, fanout.ID), ProcessOptions{FormulaSearchPaths: []string{dir}})
+	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
 	if err != nil {
-		t.Fatalf("ProcessControl(fanout finalize): %v", err)
+		t.Fatalf("ProcessControl(fanout legacy resume): %v", err)
 	}
-	if !result2.Processed || result2.Action != "fanout-pass" {
-		t.Fatalf("result2 = %+v, want processed fanout-pass", result2)
+	if !result.Processed || result.Action != "fanout-spawn" {
+		t.Fatalf("result = %+v, want processed fanout-spawn", result)
+	}
+	if result.Created == 0 {
+		t.Fatal("expected a new iteration-qualified fragment when legacy ownership is unproven")
 	}
 
-	fanoutClosed := mustGetBead(t, store, fanout.ID)
-	if fanoutClosed.Status != "closed" || fanoutClosed.Metadata["gc.outcome"] != "pass" {
-		t.Fatalf("fanout = status %q outcome %q, want closed/pass", fanoutClosed.Status, fanoutClosed.Metadata["gc.outcome"])
+	if child := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.7.design-review.prepare-review-items.item.1.review"); child.ID == "" {
+		t.Fatal("missing new iteration-qualified review child")
+	}
+	legacyReview := findWorkflowBeadByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.review")
+	legacySynth := findWorkflowBeadByRef(t, store, workflow.ID, "expansion-review.design-review.prepare-review-items.item.1.synth")
+	for _, legacy := range []beads.Bead{legacyReview, legacySynth} {
+		if legacy.ID == "" {
+			t.Fatal("missing retired legacy fragment bead")
+		}
+		if legacy.Status != "closed" {
+			t.Fatalf("legacy bead %s status = %q, want closed", legacy.ID, legacy.Status)
+		}
+		if legacy.Metadata["gc.partial_fragment"] != "true" {
+			t.Fatalf("legacy bead %s gc.partial_fragment = %q, want true", legacy.ID, legacy.Metadata["gc.partial_fragment"])
+		}
+		if mustReadyContains(t, store, legacy.ID) {
+			t.Fatalf("legacy bead %s should no longer be ready/open", legacy.ID)
+		}
 	}
 }
 
-func TestProcessFanoutResumesExistingFragmentsWithoutDuplicates(t *testing.T) {
+func TestProcessFanoutDoesNotReuseClosedLegacyFragmentsFromPriorIteration(t *testing.T) {
+	t.Parallel()
 	formulatest.EnableV2ForTest(t)
 
 	dir := t.TempDir()
@@ -1771,11 +4611,6 @@ contract = "graph.v2"
 [[template]]
 id = "{target}.review"
 title = "Review {reviewer}"
-
-[[template]]
-id = "{target}.synth"
-title = "Synthesize {reviewer}"
-needs = ["{target}.review"]
 `
 	if err := os.WriteFile(filepath.Join(dir, "expansion-review.toml"), []byte(expansion), 0o644); err != nil {
 		t.Fatalf("write expansion formula: %v", err)
@@ -1791,23 +4626,24 @@ needs = ["{target}.review"]
 		},
 	})
 	source := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title:  "survey",
+		Title:  "prepare items",
 		Type:   "task",
 		Status: "closed",
 		Metadata: map[string]string{
 			"gc.root_bead_id": workflow.ID,
-			"gc.step_ref":     "demo.survey",
+			"gc.step_ref":     "mol.review-loop.iteration.7.design-review.prepare-review-items",
 			"gc.outcome":      "pass",
-			"gc.output_json":  `{"items":[{"name":"claude"},{"name":"codex"}]}`,
+			"gc.output_json":  `{"items":[{"name":"claude"}]}`,
 		},
 	})
 	fanout := mustCreateWorkflowBead(t, store, beads.Bead{
-		Title: "Expand fanout for survey",
+		Title: "Expand fanout for prepare items",
 		Type:  "task",
 		Metadata: map[string]string{
 			"gc.kind":         "fanout",
 			"gc.root_bead_id": workflow.ID,
-			"gc.control_for":  "demo.survey",
+			"gc.scope_ref":    "mol.review-loop.iteration.7",
+			"gc.control_for":  "design-review.prepare-review-items",
 			"gc.for_each":     "output.items",
 			"gc.bond":         "expansion-review",
 			"gc.bond_vars":    `{"reviewer":"{item.name}"}`,
@@ -1817,48 +4653,71 @@ needs = ["{target}.review"]
 	})
 	mustDepAdd(t, store, fanout.ID, source.ID, "blocks")
 
-	for i, reviewer := range []string{"claude", "codex"} {
-		targetRef := "demo.survey.item." + strconv.Itoa(i+1)
-		fragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
-			ID:          targetRef,
-			Title:       source.Title,
-			Description: source.Description,
-		}, map[string]string{"reviewer": reviewer})
-		if err != nil {
-			t.Fatalf("CompileExpansionFragment(%s): %v", reviewer, err)
-		}
-		if _, err := molecule.InstantiateFragment(context.Background(), store, fragment, molecule.FragmentOptions{RootID: workflow.ID}); err != nil {
-			t.Fatalf("InstantiateFragment(%s): %v", reviewer, err)
-		}
+	legacyRef := "expansion-review.design-review.prepare-review-items.item.1.review"
+	legacyFragment, err := formula.CompileExpansionFragment(context.Background(), "expansion-review", []string{dir}, &formula.Step{
+		ID:          "design-review.prepare-review-items.item.1",
+		Title:       source.Title,
+		Description: source.Description,
+	}, map[string]string{"reviewer": "claude"})
+	if err != nil {
+		t.Fatalf("CompileExpansionFragment(legacy): %v", err)
+	}
+	if _, err := molecule.InstantiateFragment(context.Background(), store, legacyFragment, molecule.FragmentOptions{RootID: workflow.ID}); err != nil {
+		t.Fatalf("InstantiateFragment(legacy): %v", err)
 	}
 
-	before, err := store.ListOpen()
-	if err != nil {
-		t.Fatalf("store.List before: %v", err)
+	legacy := findAttemptByRef(t, store, workflow.ID, legacyRef)
+	if legacy.ID == "" {
+		t.Fatal("missing legacy fragment bead")
+	}
+	if err := store.SetMetadataBatch(legacy.ID, map[string]string{"gc.outcome": "pass"}); err != nil {
+		t.Fatalf("mark legacy fragment pass: %v", err)
+	}
+	if err := store.Close(legacy.ID); err != nil {
+		t.Fatalf("close legacy fragment: %v", err)
 	}
 
 	result, err := ProcessControl(store, fanout, ProcessOptions{FormulaSearchPaths: []string{dir}})
 	if err != nil {
-		t.Fatalf("ProcessControl(fanout resume): %v", err)
+		t.Fatalf("ProcessControl(fanout closed legacy resume): %v", err)
 	}
 	if !result.Processed || result.Action != "fanout-spawn" {
 		t.Fatalf("result = %+v, want processed fanout-spawn", result)
 	}
-	if result.Created != 0 {
-		t.Fatalf("result.Created = %d, want 0 newly created beads", result.Created)
+	if result.Created == 0 {
+		t.Fatalf("result.Created = %d, want a new iteration-qualified fragment instead of closed legacy reuse", result.Created)
 	}
 
-	after, err := store.ListOpen()
-	if err != nil {
-		t.Fatalf("store.List after: %v", err)
+	current := findAttemptByRef(t, store, workflow.ID, "expansion-review.mol.review-loop.iteration.7.design-review.prepare-review-items.item.1.review")
+	if current.ID == "" {
+		t.Fatal("missing new iteration-qualified fragment bead")
 	}
-	if len(after) != len(before) {
-		t.Fatalf("bead count after resume = %d, want unchanged %d", len(after), len(before))
+	if current.ID == legacy.ID {
+		t.Fatalf("reused closed legacy fragment %q for current iteration", current.ID)
 	}
 
-	fanoutAfter := mustGetBead(t, store, fanout.ID)
-	if got := fanoutAfter.Metadata["gc.fanout_state"]; got != "spawned" {
-		t.Fatalf("fanout state after resume = %q, want spawned", got)
+	all, err := store.ListByMetadata(map[string]string{"gc.root_bead_id": workflow.ID}, 0, beads.IncludeClosed)
+	if err != nil {
+		t.Fatalf("ListByMetadata(root): %v", err)
+	}
+	var legacyAfter beads.Bead
+	for _, bead := range all {
+		if bead.Metadata["gc.step_ref"] == legacyRef {
+			legacyAfter = bead
+			break
+		}
+	}
+	if legacyAfter.ID == "" {
+		t.Fatal("missing closed legacy fragment after resume")
+	}
+	if legacyAfter.Status != "closed" {
+		t.Fatalf("legacy fragment status = %q, want closed", legacyAfter.Status)
+	}
+	if got := legacyAfter.Metadata["gc.partial_fragment"]; got != "" {
+		t.Fatalf("legacy fragment gc.partial_fragment = %q, want preserved historical bead", got)
+	}
+	if got := legacyAfter.Metadata["gc.outcome"]; got != "pass" {
+		t.Fatalf("legacy fragment gc.outcome = %q, want preserved pass outcome", got)
 	}
 }
 
@@ -2522,7 +5381,7 @@ func TestResolveWorkflowStepByRefFromBeadsPrefersExactMatch(t *testing.T) {
 	exact := beads.Bead{ID: "exact", Metadata: map[string]string{"gc.step_ref": "demo.survey"}}
 	suffix := beads.Bead{ID: "suffix", Metadata: map[string]string{"gc.step_ref": "other.demo.survey"}}
 
-	got, err := resolveWorkflowStepByRefFromBeads([]beads.Bead{suffix, exact}, "wf-1", "demo.survey")
+	got, err := resolveWorkflowStepByRefFromBeads([]beads.Bead{suffix, exact}, "wf-1", "demo.survey", workflowStepMatchOptions{})
 	if err != nil {
 		t.Fatalf("resolveWorkflowStepByRefFromBeads: %v", err)
 	}
@@ -2531,6 +5390,26 @@ func TestResolveWorkflowStepByRefFromBeadsPrefersExactMatch(t *testing.T) {
 	}
 }
 
+func TestResolveWorkflowStepByRefFromBeadsPrefersCurrentBlockerMatch(t *testing.T) {
+	t.Parallel()
+
+	exact := beads.Bead{ID: "exact", Metadata: map[string]string{"gc.step_ref": "demo.survey"}}
+	current := beads.Bead{ID: "current", Metadata: map[string]string{"gc.step_ref": "mol.iteration.2.demo.survey"}}
+
+	got, err := resolveWorkflowStepByRefFromBeads(
+		[]beads.Bead{exact, current},
+		"wf-1",
+		"demo.survey",
+		workflowStepMatchOptions{PreferredIDs: map[string]struct{}{current.ID: {}}},
+	)
+	if err != nil {
+		t.Fatalf("resolveWorkflowStepByRefFromBeads: %v", err)
+	}
+	if got.ID != current.ID {
+		t.Fatalf("matched bead %s, want current blocker %s", got.ID, current.ID)
+	}
+}
+
 func TestCopyRetryDepsSkipsDynamicFragmentTargets(t *testing.T) {
 	t.Parallel()
 
@@ -3036,6 +5915,61 @@ func TestRunRalphCheckTimeoutMetadataPrecedence(t *testing.T) {
 	}
 }
 
+func TestRunRalphCheckUsesStorePathForRelativeCheckAndSubjectEnv(t *testing.T) {
+	cityPath := t.TempDir()
+	storePath := t.TempDir()
+	workDir := filepath.Join(storePath, "frontend")
+	checkDir := filepath.Join(workDir, "checks")
+	if err := os.MkdirAll(checkDir, 0o755); err != nil {
+		t.Fatalf("mkdir check dir: %v", err)
+	}
+
+	checkPath := filepath.Join(checkDir, "env.sh")
+	script := "#!/bin/sh\n" +
+		"pwd\n" +
+		"printf 'BEAD=%s\\n' \"$GC_BEAD_ID\"\n" +
+		"printf 'CITY=%s\\n' \"$GC_CITY\"\n" +
+		"printf 'STORE=%s\\n' \"$GC_STORE_PATH\"\n" +
+		"printf 'BEADS=%s\\n' \"$BEADS_DIR\"\n"
+	if err := os.WriteFile(checkPath, []byte(script), 0o755); err != nil {
+		t.Fatalf("write check script: %v", err)
+	}
+
+	store := beads.NewMemStore()
+	check := beads.Bead{
+		ID:   "check-1",
+		Type: "task",
+		Metadata: map[string]string{
+			"gc.check_path":    "checks/env.sh",
+			"gc.check_timeout": "30s",
+			"gc.work_dir":      "frontend",
+		},
+	}
+	subject := beads.Bead{ID: "run-1", Type: "task"}
+
+	result, err := runRalphCheck(store, check, subject, 2, ProcessOptions{
+		CityPath:  cityPath,
+		StorePath: storePath,
+	})
+	if err != nil {
+		t.Fatalf("runRalphCheck: %v", err)
+	}
+	if result.Outcome != "pass" {
+		t.Fatalf("result.Outcome = %q, want pass (stderr=%q)", result.Outcome, result.Stderr)
+	}
+	for _, want := range []string{
+		workDir,
+		"BEAD=run-1",
+		"CITY=" + cityPath,
+		"STORE=" + storePath,
+		"BEADS=" + filepath.Join(storePath, ".beads"),
+	} {
+		if !strings.Contains(result.Stdout, want) {
+			t.Fatalf("stdout = %q, want to contain %q", result.Stdout, want)
+		}
+	}
+}
+
 func writeCheckScript(t *testing.T, cityPath, name, contents string) string {
 	t.Helper()
 	scriptDir := filepath.Join(cityPath, ".gc", "scripts")
@@ -3206,6 +6140,20 @@ func mustGetBead(t *testing.T, store beads.Store, beadID string) beads.Bead {
 	return bead
 }
 
+func findWorkflowBeadByRef(t *testing.T, store beads.Store, rootID, stepRef string) beads.Bead {
+	t.Helper()
+	all, err := listByWorkflowRoot(store, rootID)
+	if err != nil {
+		t.Fatalf("list workflow beads: %v", err)
+	}
+	for _, bead := range all {
+		if bead.Metadata["gc.step_ref"] == stepRef {
+			return bead
+		}
+	}
+	return beads.Bead{}
+}
+
 type ralphPassOrderStore struct {
 	*beads.MemStore
 	logicalID string
@@ -3450,6 +6398,168 @@ func TestFullMetadataPropagationChain(t *testing.T) {
 	}
 }
 
+func TestProcessScopeCheckIgnoresOpenSpecBeadsWhenCompletingScope(t *testing.T) {
+	t.Parallel()
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	body := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "iteration 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.scope_role":   "body",
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "review-loop.iteration.1",
+		},
+	})
+	mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Step spec for apply",
+		Type:  "spec",
+		Metadata: map[string]string{
+			"gc.kind":         "spec",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "member",
+			"gc.step_ref":     "review-loop.iteration.1.apply.spec",
+		},
+	})
+	member := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "apply",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "member",
+			"gc.outcome":      "pass",
+		},
+	})
+	scopeCheck := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize apply",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope-check",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "control",
+		},
+	})
+	mustDepAdd(t, store, scopeCheck.ID, member.ID, "blocks")
+	mustDepAdd(t, store, body.ID, scopeCheck.ID, "blocks")
+
+	result, err := ProcessControl(store, mustGetBead(t, store, scopeCheck.ID), ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(scope-check): %v", err)
+	}
+	if result.Action != "scope-pass" {
+		t.Fatalf("scope-check action = %q, want scope-pass", result.Action)
+	}
+
+	bodyAfter := mustGetBead(t, store, body.ID)
+	if bodyAfter.Status != "closed" || bodyAfter.Metadata["gc.outcome"] != "pass" {
+		t.Fatalf("scope body = status %q outcome %q, want closed/pass", bodyAfter.Status, bodyAfter.Metadata["gc.outcome"])
+	}
+}
+
+func TestProcessScopeCheckDoesNotSkipOpenSpecBeadsWhenFailingScope(t *testing.T) {
+	t.Parallel()
+
+	store := beads.NewMemStore()
+	workflow := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "workflow",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula_contract": "graph.v2",
+		},
+	})
+	body := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "iteration 1",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope",
+			"gc.scope_role":   "body",
+			"gc.root_bead_id": workflow.ID,
+			"gc.step_ref":     "review-loop.iteration.1",
+		},
+	})
+	spec := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Step spec for apply",
+		Type:  "spec",
+		Metadata: map[string]string{
+			"gc.kind":         "spec",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "member",
+			"gc.step_ref":     "review-loop.iteration.1.apply.spec",
+		},
+	})
+	openMember := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "apply",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "member",
+		},
+	})
+	failedMember := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title:  "review",
+		Type:   "task",
+		Status: "closed",
+		Metadata: map[string]string{
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "member",
+			"gc.outcome":      "fail",
+		},
+	})
+	scopeCheck := mustCreateWorkflowBead(t, store, beads.Bead{
+		Title: "Finalize review",
+		Type:  "task",
+		Metadata: map[string]string{
+			"gc.kind":         "scope-check",
+			"gc.root_bead_id": workflow.ID,
+			"gc.scope_ref":    "review-loop.iteration.1",
+			"gc.scope_role":   "control",
+		},
+	})
+	mustDepAdd(t, store, scopeCheck.ID, failedMember.ID, "blocks")
+	mustDepAdd(t, store, body.ID, scopeCheck.ID, "blocks")
+
+	result, err := ProcessControl(store, mustGetBead(t, store, scopeCheck.ID), ProcessOptions{})
+	if err != nil {
+		t.Fatalf("ProcessControl(scope-check): %v", err)
+	}
+	if result.Action != "scope-fail" {
+		t.Fatalf("scope-check action = %q, want scope-fail", result.Action)
+	}
+	if result.Skipped != 1 {
+		t.Fatalf("scope-check skipped = %d, want 1 non-spec member", result.Skipped)
+	}
+
+	specAfter := mustGetBead(t, store, spec.ID)
+	if specAfter.Status != "open" {
+		t.Fatalf("spec status = %q, want open", specAfter.Status)
+	}
+	openMemberAfter := mustGetBead(t, store, openMember.ID)
+	if openMemberAfter.Status != "closed" || openMemberAfter.Metadata["gc.outcome"] != "skipped" {
+		t.Fatalf("open member = status %q outcome %q, want closed/skipped", openMemberAfter.Status, openMemberAfter.Metadata["gc.outcome"])
+	}
+	bodyAfter := mustGetBead(t, store, body.ID)
+	if bodyAfter.Status != "closed" || bodyAfter.Metadata["gc.outcome"] != "fail" {
+		t.Fatalf("body = status %q outcome %q, want closed/fail", bodyAfter.Status, bodyAfter.Metadata["gc.outcome"])
+	}
+}
+
 // TestProcessControlEmitsSkipReasonWhenNotOpen is the regression guard for
 // the 20-minute silent stall on ga-ttn5z. When a rogue worker had flipped
 // a retry-control bead (ga-fw2fm) to status=in_progress, ProcessControl
diff --git a/internal/dispatch/trace.go b/internal/dispatch/trace.go
deleted file mode 100644
index fae14b83ac..0000000000
--- a/internal/dispatch/trace.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package dispatch
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"time"
-)
-
-func tracef(format string, args ...any) {
-	path := strings.TrimSpace(os.Getenv("GC_WORKFLOW_TRACE"))
-	if path == "" {
-		path = strings.TrimSpace(os.Getenv("GC_SLING_TRACE"))
-	}
-	if path == "" {
-		return
-	}
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
-	if err != nil {
-		return
-	}
-	defer f.Close()                                                                                    //nolint:errcheck // best-effort trace log
-	fmt.Fprintf(f, "%s %s\n", time.Now().UTC().Format(time.RFC3339Nano), fmt.Sprintf(format, args...)) //nolint:errcheck
-}
diff --git a/internal/docgen/cli.go b/internal/docgen/cli.go
index e0b3dfa436..62e7e0d055 100644
--- a/internal/docgen/cli.go
+++ b/internal/docgen/cli.go
@@ -11,6 +11,8 @@ import (
 	"github.com/spf13/pflag"
 )
 
+const skipCLIDocAnnotation = "gc.docgen.skip"
+
 func escapeMDXText(s string) string {
 	s = strings.ReplaceAll(s, "<", "&lt;")
 	s = strings.ReplaceAll(s, ">", "&gt;")
@@ -77,7 +79,7 @@ func walkCommands(w io.Writer, cmd *cobra.Command) error {
 		return err
 	}
 	for _, child := range cmd.Commands() {
-		if child.Hidden {
+		if skipCLIDocCommand(child) {
 			continue
 		}
 		if err := walkCommands(w, child); err != nil {
@@ -87,6 +89,13 @@ func walkCommands(w io.Writer, cmd *cobra.Command) error {
 	return nil
 }
 
+func skipCLIDocCommand(cmd *cobra.Command) bool {
+	if cmd.Hidden {
+		return true
+	}
+	return cmd.Annotations[skipCLIDocAnnotation] == "true"
+}
+
 // renderCommand renders a single command section.
 func renderCommand(w io.Writer, cmd *cobra.Command) error {
 	fullPath := cmd.CommandPath()
@@ -234,7 +243,7 @@ func writeFlagTable(w io.Writer, flags []flagInfo) error {
 func renderSubcommandsTable(w io.Writer, cmd *cobra.Command) error {
 	var children []*cobra.Command
 	for _, c := range cmd.Commands() {
-		if !c.Hidden {
+		if !skipCLIDocCommand(c) {
 			children = append(children, c)
 		}
 	}
diff --git a/internal/docgen/cli_test.go b/internal/docgen/cli_test.go
index fa0d21edbe..54a52809b5 100644
--- a/internal/docgen/cli_test.go
+++ b/internal/docgen/cli_test.go
@@ -97,6 +97,24 @@ func TestRenderCLIMarkdown_HiddenCommandSkipped(t *testing.T) {
 	}
 }
 
+func TestRenderCLIMarkdown_AnnotatedCommandSkipped(t *testing.T) {
+	root := &cobra.Command{Use: "app", Short: "test"}
+	root.AddCommand(&cobra.Command{
+		Use:         "pack",
+		Short:       "local pack command",
+		Annotations: map[string]string{skipCLIDocAnnotation: "true"},
+	})
+
+	var buf bytes.Buffer
+	if err := RenderCLIMarkdown(&buf, root); err != nil {
+		t.Fatalf("RenderCLIMarkdown: %v", err)
+	}
+
+	if strings.Contains(buf.String(), "pack") {
+		t.Error("annotated command 'pack' should not appear in output")
+	}
+}
+
 func TestRenderCLIMarkdown_HiddenFlagSkipped(t *testing.T) {
 	root := &cobra.Command{Use: "app", Short: "test"}
 	root.Flags().String("visible", "", "shown flag")
diff --git a/internal/doctor/checks.go b/internal/doctor/checks.go
index 147096148a..49cbad4845 100644
--- a/internal/doctor/checks.go
+++ b/internal/doctor/checks.go
@@ -167,6 +167,7 @@ func (c *ConfigRefsCheck) Run(_ *CheckContext) *CheckResult {
 	r := &CheckResult{Name: c.Name()}
 	var issues []string
 
+	builtinProviders := config.BuiltinProviders()
 	for _, a := range c.cfg.Agents {
 		qn := a.QualifiedName()
 		if a.PromptTemplate != "" {
@@ -190,7 +191,9 @@ func (c *ConfigRefsCheck) Run(_ *CheckContext) *CheckResult {
 			}
 		}
 		if a.Provider != "" && len(c.cfg.Providers) > 0 {
-			if _, ok := c.cfg.Providers[a.Provider]; !ok {
+			_, declared := c.cfg.Providers[a.Provider]
+			_, builtin := builtinProviders[a.Provider]
+			if !declared && !builtin {
 				issues = append(issues, fmt.Sprintf("agent %q: provider %q not defined in [providers]", qn, a.Provider))
 			}
 		}
@@ -2390,7 +2393,7 @@ type DoltConfigExpectedValue struct {
 func DoltConfigExpectedValues() []DoltConfigExpectedValue {
 	return []DoltConfigExpectedValue{
 		{"behavior.auto_gc_behavior.enable", true},
-		{"behavior.auto_gc_behavior.archive_level", 1},
+		{"behavior.auto_gc_behavior.archive_level", 0},
 		{"listener.read_timeout_millis", 300000},
 		{"listener.write_timeout_millis", 300000},
 		{"listener.max_connections", 1000},
@@ -2520,7 +2523,7 @@ func (c *DoltConfigCheck) Run(_ *CheckContext) *CheckResult {
 				drifted = append(drifted, fmt.Sprintf("%s (got %v, want %v)", exp.Path, got, want))
 			}
 		case int:
-			if !yamlIntEqual(got, want) {
+			if !doltConfigExpectedIntEqual(exp.Path, got, want) {
 				drifted = append(drifted, fmt.Sprintf("%s (got %v, want %d)", exp.Path, got, want))
 			}
 		default:
@@ -2551,6 +2554,20 @@ func (c *DoltConfigCheck) Run(_ *CheckContext) *CheckResult {
 	return r
 }
 
+func doltConfigExpectedIntEqual(path string, got any, want int) bool {
+	if yamlIntEqual(got, want) {
+		return true
+	}
+	// Managed configs written before archive_level defaulted to 0 can contain
+	// archive_level: 1. Accept that one-release compatibility value so first
+	// post-upgrade doctor runs do not report drift before gc start rewrites the
+	// managed config.
+	if path == "behavior.auto_gc_behavior.archive_level" && want == 0 {
+		return yamlIntEqual(got, 1)
+	}
+	return false
+}
+
 // CanFix returns false. TODO: wire Fix() into the same code path as
 // `gc start` uses to rewrite the managed config once that helper is exposed
 // from the doctor package.
@@ -2559,87 +2576,14 @@ func (c *DoltConfigCheck) CanFix() bool { return false }
 // Fix is a no-op. See TODO on CanFix.
 func (c *DoltConfigCheck) Fix(_ *CheckContext) error { return nil }
 
-// doltVersionInfo is the parsed semantic version of the installed `dolt`.
-type doltVersionInfo struct {
-	Major, Minor, Patch int
-	Raw                 string
-}
+type doltVersionInfo = doltversion.Info
 
-// parseDoltVersion parses the first version-like token from `dolt version`
-// output. Accepted formats:
-//
-//	"dolt version 1.75.2\nWarning: ..."
-//	"dolt version 1.75.2"
-//	"1.75.2"
-//
-// Any suffix after patch (e.g. "-rc1") is ignored.
 func parseDoltVersion(out string) (doltVersionInfo, error) {
-	out = strings.TrimSpace(out)
-	if out == "" {
-		return doltVersionInfo{}, fmt.Errorf("empty version output")
-	}
-	// Only look at the first line — dolt sometimes emits a "Warning: ..."
-	// second line for deprecated flags.
-	if i := strings.IndexByte(out, '\n'); i >= 0 {
-		out = out[:i]
-	}
-	out = strings.TrimSpace(out)
-	// Strip the "dolt version " prefix if present.
-	const prefix = "dolt version "
-	if strings.HasPrefix(strings.ToLower(out), prefix) {
-		out = out[len(prefix):]
-	}
-	// Take the first whitespace-delimited token.
-	if i := strings.IndexAny(out, " \t"); i >= 0 {
-		out = out[:i]
-	}
-	out = strings.TrimPrefix(out, "v")
-	// Strip any pre-release / build suffix after MAJOR.MINOR.PATCH.
-	core := out
-	for _, sep := range []string{"-", "+"} {
-		if i := strings.Index(core, sep); i >= 0 {
-			core = core[:i]
-		}
-	}
-	parts := strings.Split(core, ".")
-	if len(parts) < 3 {
-		return doltVersionInfo{}, fmt.Errorf("unrecognized version %q", out)
-	}
-	major, err := strconv.Atoi(parts[0])
-	if err != nil {
-		return doltVersionInfo{}, fmt.Errorf("unrecognized major in %q: %w", out, err)
-	}
-	minor, err := strconv.Atoi(parts[1])
-	if err != nil {
-		return doltVersionInfo{}, fmt.Errorf("unrecognized minor in %q: %w", out, err)
-	}
-	patch, err := strconv.Atoi(parts[2])
-	if err != nil {
-		return doltVersionInfo{}, fmt.Errorf("unrecognized patch in %q: %w", out, err)
-	}
-	return doltVersionInfo{Major: major, Minor: minor, Patch: patch, Raw: fmt.Sprintf("%d.%d.%d", major, minor, patch)}, nil
+	return doltversion.Parse(out)
 }
 
-// compareDoltVersion returns -1 if a<b, 0 if a==b, 1 if a>b.
 func compareDoltVersion(a, b doltVersionInfo) int {
-	switch {
-	case a.Major != b.Major:
-		if a.Major < b.Major {
-			return -1
-		}
-		return 1
-	case a.Minor != b.Minor:
-		if a.Minor < b.Minor {
-			return -1
-		}
-		return 1
-	case a.Patch != b.Patch:
-		if a.Patch < b.Patch {
-			return -1
-		}
-		return 1
-	}
-	return 0
+	return doltversion.Compare(a, b)
 }
 
 // DoltVersionCheck shells out to `dolt version` and verifies the managed-Dolt
@@ -2727,21 +2671,24 @@ func (c *DoltVersionCheck) Run(_ *CheckContext) *CheckResult {
 		return r
 	}
 
-	info, err := parseDoltVersion(out)
-	if err != nil {
-		r.Status = StatusWarning
-		r.Message = fmt.Sprintf("parse dolt version: %v", err)
+	info, err := doltversion.CheckFinalMinimum(out, doltversion.ManagedMin)
+	switch {
+	case errors.Is(err, doltversion.ErrPreRelease):
+		r.Status = StatusError
+		r.Message = fmt.Sprintf("dolt version %s is a pre-release; final release %s or newer is required for managed config", info.Raw, doltversion.ManagedMin)
+		r.FixHint = "upgrade dolt: https://docs.dolthub.com/introduction/installation"
 		return r
-	}
-
-	minVer, _ := parseDoltVersion(doltversion.ManagedMin)
-
-	if compareDoltVersion(info, minVer) < 0 {
+	case errors.Is(err, doltversion.ErrBelowMinimum):
 		r.Status = StatusError
 		r.Message = fmt.Sprintf("dolt version %s is below minimum %s required for managed config", info.Raw, doltversion.ManagedMin)
 		r.FixHint = "upgrade dolt: https://docs.dolthub.com/introduction/installation"
 		return r
+	case err != nil:
+		r.Status = StatusWarning
+		r.Message = fmt.Sprintf("parse dolt version: %v", err)
+		return r
 	}
+
 	r.Status = StatusOK
 	r.Message = fmt.Sprintf("dolt %s", info.Raw)
 	return r
diff --git a/internal/doctor/checks_beads_role.go b/internal/doctor/checks_beads_role.go
new file mode 100644
index 0000000000..c28227eac0
--- /dev/null
+++ b/internal/doctor/checks_beads_role.go
@@ -0,0 +1,64 @@
+package doctor
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// BeadsRoleCheck verifies that beads.role is set in global git config.
+// bd exits non-zero with "beads.role not configured" (gastownhall/beads#2950)
+// when this key is absent, causing the config-set calls in gc-beads-bd's
+// op_init to fail silently (they use || true). The silent failures leave
+// issue_prefix and types.custom unset in the Dolt database, making every
+// subsequent bd-create call fail with "database not initialized".
+type BeadsRoleCheck struct{}
+
+// Name returns the check identifier.
+func (c *BeadsRoleCheck) Name() string { return "beads-role" }
+
+// Run checks that beads.role is set in global git config.
+func (c *BeadsRoleCheck) Run(_ *CheckContext) *CheckResult {
+	r := &CheckResult{Name: c.Name()}
+	out, err := exec.Command("git", "config", "--global", "beads.role").Output()
+	if err != nil || strings.TrimSpace(string(out)) == "" {
+		r.Status = StatusError
+		r.Message = "beads.role not set in global git config"
+		r.FixHint = "run: git config --global beads.role maintainer"
+		return r
+	}
+	r.Status = StatusOK
+	r.Message = fmt.Sprintf("beads.role = %q", strings.TrimSpace(string(out)))
+	return r
+}
+
+// CanFix returns true — the missing role can be set automatically.
+func (c *BeadsRoleCheck) CanFix() bool { return true }
+
+// Fix sets beads.role to "maintainer" in global git config if it is not
+// already set. A non-empty existing value is left unchanged.
+func (c *BeadsRoleCheck) Fix(_ *CheckContext) error {
+	out, err := exec.Command("git", "config", "--global", "beads.role").CombinedOutput()
+	if err == nil && strings.TrimSpace(string(out)) != "" {
+		return nil
+	}
+	writeOut, writeErr := exec.Command("git", "config", "--global", "beads.role", "maintainer").CombinedOutput()
+	if writeErr != nil {
+		writeMsg := strings.TrimSpace(string(writeOut))
+		if err != nil {
+			readMsg := strings.TrimSpace(string(out))
+			if readMsg == "" {
+				readMsg = err.Error()
+			}
+			if writeMsg != "" {
+				return fmt.Errorf("setting beads.role after reading current value failed (%s): %s: %w", readMsg, writeMsg, writeErr)
+			}
+			return fmt.Errorf("setting beads.role after reading current value failed (%s): %w", readMsg, writeErr)
+		}
+		if writeMsg != "" {
+			return fmt.Errorf("setting beads.role: %s: %w", writeMsg, writeErr)
+		}
+		return fmt.Errorf("setting beads.role: %w", writeErr)
+	}
+	return nil
+}
diff --git a/internal/doctor/checks_beads_role_test.go b/internal/doctor/checks_beads_role_test.go
new file mode 100644
index 0000000000..32ce5255ce
--- /dev/null
+++ b/internal/doctor/checks_beads_role_test.go
@@ -0,0 +1,132 @@
+package doctor
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// setupFakeGitConfig returns a HOME override that points to an empty temp dir,
+// so git config --global reads/writes go there without touching the real user config.
+func setupFakeGitConfig(t *testing.T) string {
+	t.Helper()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	// Windows / macOS also respect GIT_CONFIG_GLOBAL:
+	t.Setenv("GIT_CONFIG_GLOBAL", filepath.Join(home, ".gitconfig"))
+	return home
+}
+
+func TestBeadsRoleCheck_NotSet(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	setupFakeGitConfig(t)
+
+	c := &BeadsRoleCheck{}
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusError {
+		t.Fatalf("status = %v, want StatusError (beads.role unset)", r.Status)
+	}
+	if !strings.Contains(r.Message, "beads.role") {
+		t.Errorf("message %q should mention beads.role", r.Message)
+	}
+	if r.FixHint == "" {
+		t.Error("FixHint should be set when beads.role is missing")
+	}
+}
+
+func TestBeadsRoleCheck_Set(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	home := setupFakeGitConfig(t)
+
+	cfg := filepath.Join(home, ".gitconfig")
+	if err := os.WriteFile(cfg, []byte("[beads]\n\trole = maintainer\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &BeadsRoleCheck{}
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusOK {
+		t.Fatalf("status = %v, want StatusOK (beads.role = maintainer)", r.Status)
+	}
+	if !strings.Contains(r.Message, "maintainer") {
+		t.Errorf("message %q should include the role value", r.Message)
+	}
+}
+
+func TestBeadsRoleCheck_CanFix(t *testing.T) {
+	c := &BeadsRoleCheck{}
+	if !c.CanFix() {
+		t.Fatal("CanFix should return true")
+	}
+}
+
+func TestBeadsRoleCheck_Fix_SetsRole(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	setupFakeGitConfig(t)
+
+	c := &BeadsRoleCheck{}
+	if err := c.Fix(&CheckContext{}); err != nil {
+		t.Fatalf("Fix returned error: %v", err)
+	}
+	// After Fix, Run should pass.
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusOK {
+		t.Fatalf("after Fix: status = %v, want StatusOK", r.Status)
+	}
+	if !strings.Contains(r.Message, "maintainer") {
+		t.Errorf("after Fix: message %q should contain 'maintainer'", r.Message)
+	}
+}
+
+func TestBeadsRoleCheck_Fix_PreservesExistingRole(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	home := setupFakeGitConfig(t)
+
+	cfg := filepath.Join(home, ".gitconfig")
+	if err := os.WriteFile(cfg, []byte("[beads]\n\trole = contributor\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &BeadsRoleCheck{}
+	if err := c.Fix(&CheckContext{}); err != nil {
+		t.Fatalf("Fix returned error: %v", err)
+	}
+	// Should not have overwritten the existing "contributor" value.
+	out, err := exec.Command("git", "config", "--global", "beads.role").Output()
+	if err != nil {
+		t.Fatalf("git config --global beads.role: %v", err)
+	}
+	if got := strings.TrimSpace(string(out)); got != "contributor" {
+		t.Errorf("beads.role = %q, want %q (Fix should preserve existing value)", got, "contributor")
+	}
+}
+
+func TestBeadsRoleCheck_Fix_PreservesReadFailureContext(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	home := setupFakeGitConfig(t)
+	cfg := filepath.Join(home, ".gitconfig")
+	if err := os.WriteFile(cfg, []byte("not valid\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &BeadsRoleCheck{}
+	err := c.Fix(&CheckContext{})
+	if err == nil {
+		t.Fatal("Fix error = nil, want read failure context")
+	}
+	if !strings.Contains(err.Error(), "bad config line 1") {
+		t.Fatalf("Fix error = %q, want preserved git read failure", err)
+	}
+}
diff --git a/internal/doctor/checks_semantic.go b/internal/doctor/checks_semantic.go
index 21dba4eb75..88ee33edf6 100644
--- a/internal/doctor/checks_semantic.go
+++ b/internal/doctor/checks_semantic.go
@@ -1,12 +1,17 @@
 package doctor
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
+	"strings"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/pathutil"
 )
 
 // --- Duration reasonableness check ---
@@ -178,6 +183,512 @@ func (c *EventLogSizeCheck) CanFix() bool { return false }
 // Fix is a no-op.
 func (c *EventLogSizeCheck) Fix(_ *CheckContext) error { return nil }
 
+// --- Worktree disk size check ---
+
+// rigSize pairs a rig directory name with its measured byte footprint
+// under .gc/worktrees/<rig>/. Used as the sort key for ordered output.
+type rigSize struct {
+	name  string
+	bytes int64
+}
+
+// WorktreeDiskSizeCheck warns when a per-rig footprint under
+// .gc/worktrees/<rig>/ exceeds the configured threshold. Build
+// artifacts, nested task worktrees, and accumulated state can grow
+// unboundedly here; without this check the disk fills silently.
+type WorktreeDiskSizeCheck struct {
+	cfg config.DoctorConfig
+	// measureDir is injectable so tests can avoid shelling out to du.
+	// Production uses duDirBytes from checks.go.
+	measureDir func(string) (int64, bool, error)
+}
+
+// NewWorktreeDiskSizeCheck creates a worktree disk-footprint check.
+// The cfg is read for thresholds and policy at Run time, so reload-time
+// changes propagate naturally.
+func NewWorktreeDiskSizeCheck(cfg config.DoctorConfig) *WorktreeDiskSizeCheck {
+	// Wrap duDirBytes so its dolt-flavored error messages
+	// ("measure dolt data dir: ...") get re-tagged as worktree
+	// measurement failures when surfaced through this check.
+	measure := func(path string) (int64, bool, error) {
+		n, ok, err := duDirBytes(path)
+		if err != nil {
+			return n, ok, fmt.Errorf("measure worktree dir %q: %w", path, err)
+		}
+		return n, ok, nil
+	}
+	return &WorktreeDiskSizeCheck{cfg: cfg, measureDir: measure}
+}
+
+// Name returns the check identifier.
+func (c *WorktreeDiskSizeCheck) Name() string { return "worktree-disk-size" }
+
+// Run measures each rig's worktree footprint and reports any rigs
+// exceeding the configured warn or error thresholds.
+func (c *WorktreeDiskSizeCheck) Run(ctx *CheckContext) *CheckResult {
+	r := &CheckResult{Name: c.Name()}
+	wtRoot := filepath.Join(ctx.CityPath, ".gc", "worktrees")
+
+	rigEntries, err := os.ReadDir(wtRoot)
+	if err != nil {
+		if os.IsNotExist(err) {
+			r.Status = StatusOK
+			r.Message = "no .gc/worktrees directory"
+			return r
+		}
+		r.Status = StatusError
+		r.Message = fmt.Sprintf("reading .gc/worktrees: %v", err)
+		return r
+	}
+
+	measure := c.measureDir
+	if measure == nil {
+		measure = duDirBytes
+	}
+
+	var sizes []rigSize
+	var measureErrs []string
+	for _, e := range rigEntries {
+		if !e.IsDir() {
+			continue
+		}
+		root := filepath.Join(wtRoot, e.Name())
+		bytes, exists, err := measure(root)
+		if err != nil {
+			measureErrs = append(measureErrs, fmt.Sprintf("%s: %v", e.Name(), err))
+			continue
+		}
+		if !exists {
+			continue
+		}
+		sizes = append(sizes, rigSize{name: e.Name(), bytes: bytes})
+	}
+
+	if len(sizes) == 0 {
+		if len(measureErrs) > 0 {
+			// "We can't tell" must not look like "we're fine". Matches
+			// DoltNomsSize's policy of escalating on measurement failure.
+			r.Status = StatusWarning
+			r.Message = "could not measure any rig worktree directory"
+			r.Details = measureErrs
+			r.FixHint = "check filesystem permissions on .gc/worktrees/<rig>/"
+		} else {
+			r.Status = StatusOK
+			r.Message = "no rig worktree directories"
+		}
+		return r
+	}
+
+	sort.Slice(sizes, func(i, j int) bool { return sizes[i].bytes > sizes[j].bytes })
+
+	warn := c.cfg.WorktreeRigWarnBytes()
+	errBytes := c.cfg.WorktreeRigErrorBytes()
+
+	var details []string
+	var overThreshold int
+	status := StatusOK
+	for _, s := range sizes {
+		switch {
+		case s.bytes >= errBytes:
+			details = append(details, fmt.Sprintf("rig %q: %s (exceeds %s error threshold)",
+				s.name, humanSize(s.bytes), humanSize(errBytes)))
+			overThreshold++
+			if status < StatusError {
+				status = StatusError
+			}
+		case s.bytes >= warn:
+			details = append(details, fmt.Sprintf("rig %q: %s (exceeds %s warn threshold)",
+				s.name, humanSize(s.bytes), humanSize(warn)))
+			overThreshold++
+			if status < StatusWarning {
+				status = StatusWarning
+			}
+		}
+	}
+	for _, e := range measureErrs {
+		details = append(details, "measure error: "+e)
+	}
+	if len(measureErrs) > 0 && status < StatusWarning {
+		status = StatusWarning
+	}
+
+	r.Status = status
+	switch status {
+	case StatusError:
+		r.Message = fmt.Sprintf("%d rig(s) over worktree size threshold (largest: %q at %s)",
+			overThreshold, sizes[0].name, humanSize(sizes[0].bytes))
+		r.Details = details
+		r.FixHint = "investigate .gc/worktrees/<rig>/ for build-artifact accumulation; consider routing builds out of worktrees, periodic clean steps, or running `gc doctor --fix` to remove safely-prunable nested worktrees"
+	case StatusWarning:
+		if overThreshold > 0 {
+			r.Message = fmt.Sprintf("%d rig(s) approaching worktree size limit (largest: %q at %s)",
+				overThreshold, sizes[0].name, humanSize(sizes[0].bytes))
+			r.FixHint = "see fix hint for nested-worktree-prune; tune [doctor].worktree_rig_warn_size if 10 GB is too tight for this install"
+		} else {
+			r.Message = fmt.Sprintf("could not measure %d rig worktree path(s) (largest measured: %q at %s)",
+				len(measureErrs), sizes[0].name, humanSize(sizes[0].bytes))
+			r.FixHint = "check filesystem permissions on .gc/worktrees/<rig>/"
+		}
+		r.Details = details
+	default:
+		// All under thresholds: report the worst rig as info.
+		r.Message = fmt.Sprintf("largest rig worktree: %q at %s (under %s warn)",
+			sizes[0].name, humanSize(sizes[0].bytes), humanSize(warn))
+	}
+	return r
+}
+
+// CanFix returns false — pruning is the responsibility of
+// NestedWorktreePruneCheck, which has the safety logic. This check is
+// observation-only.
+func (c *WorktreeDiskSizeCheck) CanFix() bool { return false }
+
+// Fix is a no-op; see CanFix.
+func (c *WorktreeDiskSizeCheck) Fix(_ *CheckContext) error { return nil }
+
+// --- Nested-worktree prune check ---
+
+// nestedWorktreeFinding describes one nested worktree under an agent
+// home and whether it is mechanically safe to remove.
+type nestedWorktreeFinding struct {
+	path     string // absolute, canonical
+	parent   string // agent home that contains it
+	branch   string // branch name (best-effort; empty for detached)
+	reason   string // why it was rejected (empty if safe)
+	probeErr bool   // rejected because a safety probe failed
+	safeToRm bool
+}
+
+// gitWorktree is the slice of internal/git.Git used by NestedWorktreePruneCheck.
+// Defined as an interface so tests can inject a fake without standing up real
+// repositories.
+type gitWorktree interface {
+	IsRepo() bool
+	WorktreeList() ([]git.Worktree, error)
+	HasUncommittedWork() bool
+	HasUnpushedCommitsResult() (bool, error)
+	HasStashesResult() (bool, error)
+	WorktreeRemove(path string, force bool) error
+}
+
+// NestedWorktreePruneCheck identifies nested git worktrees inside agent
+// home worktrees that are safely reclaimable: no uncommitted changes,
+// no unpushed commits, no stashed work. These reproduce from the remote
+// via `git worktree add path origin/<branch>`, so removing the local
+// directory is non-destructive.
+//
+// The rule is mechanical, never role-coupled: any nested worktree whose
+// branch tip is reachable from a remote and whose working tree is clean
+// is reclaimable, regardless of which agent created it.
+type NestedWorktreePruneCheck struct {
+	cfg config.DoctorConfig
+	// newGit produces a gitWorktree handle for a given path. Production
+	// uses git.New; tests inject fakes.
+	newGit func(path string) gitWorktree
+	// findings is populated by Run for Fix to consume.
+	findings []nestedWorktreeFinding
+}
+
+// NewNestedWorktreePruneCheck creates the prune check using real git.
+func NewNestedWorktreePruneCheck(cfg config.DoctorConfig) *NestedWorktreePruneCheck {
+	return &NestedWorktreePruneCheck{
+		cfg:    cfg,
+		newGit: func(p string) gitWorktree { return git.New(p) },
+	}
+}
+
+// Name returns the check identifier.
+func (c *NestedWorktreePruneCheck) Name() string { return "nested-worktree-prune" }
+
+// Run walks .gc/worktrees/<rig>/<agent>/ for each agent home that is a
+// git worktree, lists its sibling worktrees, and classifies each
+// nested entry as safe-to-prune or rejected with a reason.
+func (c *NestedWorktreePruneCheck) Run(ctx *CheckContext) *CheckResult {
+	r := &CheckResult{Name: c.Name()}
+	c.findings = nil
+
+	wtRoot := filepath.Join(ctx.CityPath, ".gc", "worktrees")
+	rigEntries, err := os.ReadDir(wtRoot)
+	if err != nil {
+		if os.IsNotExist(err) {
+			r.Status = StatusOK
+			r.Message = "no .gc/worktrees directory"
+			return r
+		}
+		r.Status = StatusError
+		r.Message = fmt.Sprintf("reading .gc/worktrees: %v", err)
+		return r
+	}
+
+	// Discover agent homes: <wtRoot>/<rig>/<agent>/ that hold a .git
+	// pointer. Multiple rigs may share a single repo, so we deduplicate
+	// nested findings by canonical path below.
+	var homes []string
+	for _, rigEntry := range rigEntries {
+		if !rigEntry.IsDir() {
+			continue
+		}
+		rigDir := filepath.Join(wtRoot, rigEntry.Name())
+		agentEntries, err := os.ReadDir(rigDir)
+		if err != nil {
+			continue
+		}
+		for _, agentEntry := range agentEntries {
+			if !agentEntry.IsDir() {
+				continue
+			}
+			home := filepath.Join(rigDir, agentEntry.Name())
+			if isGitWorktreePath(home) {
+				homes = append(homes, pathutil.NormalizePathForCompare(home))
+			}
+		}
+	}
+
+	if len(homes) == 0 {
+		r.Status = StatusOK
+		r.Message = "no agent worktrees to inspect"
+		return r
+	}
+
+	// Group homes by their shared git admin dir so each admin's
+	// WorktreeList runs exactly once but every entry is evaluated
+	// against ALL homes in that admin group. Admin-less homes (parse
+	// failure, main checkout) keep one group per home.
+	adminGroups := make(map[string][]string)
+	var adminOrder []string
+	for _, home := range homes {
+		key := readGitAdminDir(home)
+		if key == "" {
+			key = "home:" + home
+		}
+		if _, seen := adminGroups[key]; !seen {
+			adminOrder = append(adminOrder, key)
+		}
+		adminGroups[key] = append(adminGroups[key], home)
+	}
+
+	seen := make(map[string]bool)
+	var listingErrs []string
+	for _, key := range adminOrder {
+		group := adminGroups[key]
+		// Pick the first home as the WorktreeList source. All homes
+		// in a group share the admin dir, so any of them returns the
+		// same content.
+		source := group[0]
+		gw := c.newGit(source)
+		entries, err := gw.WorktreeList()
+		if err != nil {
+			listingErrs = append(listingErrs, fmt.Sprintf("listing worktrees from %s: %v", source, err))
+			continue
+		}
+		for _, wt := range entries {
+			candidate := pathutil.NormalizePathForCompare(wt.Path)
+			if seen[candidate] {
+				continue
+			}
+			// A candidate is nested if it lives strictly inside ANY
+			// home in this admin group. Skipping homes other than
+			// `source` would have lost coverage for entries nested
+			// under those homes.
+			parent := ""
+			for _, home := range group {
+				if pathStrictlyInside(candidate, home) {
+					parent = home
+					break
+				}
+			}
+			if parent == "" {
+				continue
+			}
+			seen[candidate] = true
+			c.findings = append(c.findings, classifyNested(c.newGit, candidate, parent, wt.Branch))
+		}
+	}
+
+	if len(c.findings) == 0 {
+		r.Status = StatusOK
+		r.Message = "no nested worktrees found"
+		// Surface listing errors even when no findings were classified
+		// — partial inspection failures must not be silent.
+		if len(listingErrs) > 0 {
+			r.Status = StatusWarning
+			r.Message = fmt.Sprintf("no nested worktrees classified; %d listing failure(s)", len(listingErrs))
+			r.Details = listingErrs
+		}
+		return r
+	}
+
+	var safe, unsafe []string
+	var probeErrs int
+	for _, f := range c.findings {
+		line := fmt.Sprintf("%s (branch %q)", f.path, f.branch)
+		if f.safeToRm {
+			safe = append(safe, line)
+		} else {
+			if f.probeErr {
+				probeErrs++
+			}
+			unsafe = append(unsafe, fmt.Sprintf("%s — %s", line, f.reason))
+		}
+	}
+
+	// Build details with listing errors first so operators see partial
+	// failures alongside the classified findings.
+	details := make([]string, 0, len(listingErrs)+len(safe)+len(unsafe))
+	details = append(details, listingErrs...)
+
+	if len(safe) == 0 {
+		if len(listingErrs) > 0 || probeErrs > 0 {
+			r.Status = StatusWarning
+			r.Message = fmt.Sprintf("%d nested worktree(s); none safely prunable; %d inspection failure(s)",
+				len(c.findings), len(listingErrs)+probeErrs)
+		} else {
+			r.Status = StatusOK
+			r.Message = fmt.Sprintf("%d nested worktree(s); none safely prunable",
+				len(c.findings))
+		}
+		details = append(details, unsafe...)
+		r.Details = details
+		return r
+	}
+
+	if c.cfg.NestedWorktreePrune {
+		r.Status = StatusError
+	} else {
+		r.Status = StatusWarning
+	}
+	r.Message = fmt.Sprintf("%d nested worktree(s) safely prunable (%d kept due to local work)",
+		len(safe), len(unsafe))
+	details = append(details, safe...)
+	details = append(details, unsafe...)
+	r.Details = details
+	r.FixHint = "run `gc doctor --fix` to remove safely-prunable nested worktrees (mechanical: only those with clean work tree, no unpushed commits, no stashes)"
+	return r
+}
+
+// CanFix returns true — Fix removes the safely-prunable findings.
+func (c *NestedWorktreePruneCheck) CanFix() bool { return true }
+
+// Fix removes each safely-prunable nested worktree found by Run.
+// Continues past per-entry failures so a single locked or transiently
+// broken worktree does not strand the rest — operators run --fix to
+// reclaim disk, and partial success is more useful than zero progress.
+// Returns the joined errors of all failed removals, or nil on full
+// success. Worktrees marked unsafe (uncommitted / unpushed / stashed)
+// are never touched.
+func (c *NestedWorktreePruneCheck) Fix(_ *CheckContext) error {
+	var errs []error
+	for _, f := range c.findings {
+		if !f.safeToRm {
+			continue
+		}
+		// Run the removal from the parent home rather than the worktree
+		// being removed: git refuses to remove a worktree whose path
+		// equals cwd in some configurations, and operating from cwd of
+		// a directory we're about to delete is fragile in general.
+		current := classifyNested(c.newGit, f.path, f.parent, f.branch)
+		if !current.safeToRm {
+			reason := current.reason
+			if reason == "" {
+				reason = "safety revalidation failed"
+			}
+			errs = append(errs, fmt.Errorf("nested worktree %s no longer safe to remove: %s", f.path, reason))
+			continue
+		}
+		gw := c.newGit(f.parent)
+		if err := gw.WorktreeRemove(f.path, true); err != nil {
+			errs = append(errs, fmt.Errorf("removing nested worktree %s: %w", f.path, err))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+// classifyNested runs the safety gates on a candidate nested worktree
+// and returns a finding describing whether it is safe to remove and,
+// if not, the first reason it was rejected. Order of checks matches
+// the user's manual recovery procedure: probe git, then status, log,
+// stash. Any probe error rejects the candidate with a visible reason:
+// "can't tell" is not safe enough for a destructive fix.
+func classifyNested(newGit func(string) gitWorktree, path, parent, branch string) nestedWorktreeFinding {
+	f := nestedWorktreeFinding{path: path, parent: parent, branch: branch}
+	gw := newGit(path)
+	if !gw.IsRepo() {
+		f.reason = "git status unreadable"
+		return f
+	}
+	if gw.HasUncommittedWork() {
+		f.reason = "has uncommitted changes"
+		return f
+	}
+	hasUnpushed, err := gw.HasUnpushedCommitsResult()
+	if err != nil {
+		f.reason = fmt.Sprintf("unpushed commit probe failed: %v", err)
+		f.probeErr = true
+		return f
+	}
+	if hasUnpushed {
+		f.reason = "has unpushed commits"
+		return f
+	}
+	hasStashes, err := gw.HasStashesResult()
+	if err != nil {
+		f.reason = fmt.Sprintf("stash probe failed: %v", err)
+		f.probeErr = true
+		return f
+	}
+	if hasStashes {
+		f.reason = "has stashed work"
+		return f
+	}
+	f.safeToRm = true
+	return f
+}
+
+// isGitWorktreePath reports whether path holds a .git file or .git
+// directory, indicating it is either the main repo or a worktree of one.
+func isGitWorktreePath(path string) bool {
+	gitPath := filepath.Join(path, ".git")
+	_, err := os.Stat(gitPath)
+	return err == nil
+}
+
+// readGitAdminDir returns the shared git admin directory that backs the
+// worktree at home. For a worktree, .git is a file containing
+// "gitdir: <repo>/.git/worktrees/<name>"; the admin root is the prefix
+// before "/worktrees/". Returns "" if the file is missing, malformed,
+// or not a worktree pointer (e.g. a main checkout where .git is a dir).
+// Used to dedup WorktreeList calls across agent homes that share a repo.
+func readGitAdminDir(home string) string {
+	data, err := os.ReadFile(filepath.Join(home, ".git"))
+	if err != nil {
+		return ""
+	}
+	line := strings.TrimSpace(string(data))
+	const prefix = "gitdir: "
+	if !strings.HasPrefix(line, prefix) {
+		return ""
+	}
+	target := pathutil.NormalizePathForCompare(strings.TrimPrefix(line, prefix))
+	// The admin-dir's "/worktrees/" segment is always the last one in
+	// the gitdir path: <admin>/worktrees/<name>. Using LastIndex keeps
+	// the dedup correct when the repo's own path contains a literal
+	// "/worktrees/" segment (e.g. /x/worktrees/y/.git/worktrees/wt).
+	const sep = string(filepath.Separator) + "worktrees" + string(filepath.Separator)
+	if i := strings.LastIndex(target, sep); i > 0 {
+		return target[:i]
+	}
+	return target
+}
+
+// pathStrictlyInside reports whether child is a strict subpath of
+// parent. Wraps the package-local isSubpath with an equal-paths check
+// so a worktree home isn't mistakenly classified as nested under
+// itself. Inputs must already be canonical (use
+// pathutil.NormalizePathForCompare).
+func pathStrictlyInside(child, parent string) bool {
+	return child != parent && isSubpath(parent, child)
+}
+
 // humanSize returns a human-readable file size string.
 func humanSize(bytes int64) string {
 	const (
diff --git a/internal/doctor/checks_semantic_test.go b/internal/doctor/checks_semantic_test.go
index 70877f7208..9ea92b11e9 100644
--- a/internal/doctor/checks_semantic_test.go
+++ b/internal/doctor/checks_semantic_test.go
@@ -1,12 +1,15 @@
 package doctor
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/git"
+	"github.com/gastownhall/gascity/internal/pathutil"
 )
 
 // --- DurationRangeCheck ---
@@ -308,3 +311,938 @@ func TestHumanSize(t *testing.T) {
 		}
 	}
 }
+
+// --- WorktreeDiskSizeCheck ---
+
+// fakeMeasure returns a deterministic byte count per directory path so
+// tests don't shell out to du. Returns sizes[path] when present; treats
+// missing keys as not-existent (mirrors duDirBytes signature).
+func fakeMeasure(sizes map[string]int64, errs map[string]error) func(string) (int64, bool, error) {
+	return func(path string) (int64, bool, error) {
+		if e, ok := errs[path]; ok {
+			return 0, true, e
+		}
+		n, ok := sizes[path]
+		if !ok {
+			return 0, false, nil
+		}
+		return n, true, nil
+	}
+}
+
+func TestWorktreeDiskSizeCheck_NoWorktreesDir(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, ".gc"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	c := NewWorktreeDiskSizeCheck(config.DoctorConfig{})
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusOK {
+		t.Errorf("status = %d, want OK; msg=%s", r.Status, r.Message)
+	}
+}
+
+func TestWorktreeDiskSizeCheck_AllUnderThreshold(t *testing.T) {
+	dir := t.TempDir()
+	rigA := filepath.Join(dir, ".gc", "worktrees", "rig-a")
+	rigB := filepath.Join(dir, ".gc", "worktrees", "rig-b")
+	if err := os.MkdirAll(rigA, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(rigB, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{WorktreeRigWarnSize: "10GB", WorktreeRigErrorSize: "50GB"},
+		measureDir: fakeMeasure(map[string]int64{
+			rigA: 1 * 1024 * 1024 * 1024, // 1 GB
+			rigB: 500 * 1024 * 1024,      // 500 MB
+		}, nil),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusOK {
+		t.Errorf("status = %d, want OK; msg=%s details=%v", r.Status, r.Message, r.Details)
+	}
+	if !strings.Contains(r.Message, "rig-a") {
+		t.Errorf("message should name largest rig (rig-a); got %q", r.Message)
+	}
+}
+
+func TestWorktreeDiskSizeCheck_UnderThresholdWithMeasurementErrorReturnsWarning(t *testing.T) {
+	dir := t.TempDir()
+	rigOK := filepath.Join(dir, ".gc", "worktrees", "ok")
+	rigBroken := filepath.Join(dir, ".gc", "worktrees", "broken")
+	for _, p := range []string{rigOK, rigBroken} {
+		if err := os.MkdirAll(p, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{WorktreeRigWarnSize: "10GB", WorktreeRigErrorSize: "50GB"},
+		measureDir: fakeMeasure(map[string]int64{
+			rigOK: 1 * 1024 * 1024 * 1024,
+		}, map[string]error{
+			rigBroken: errors.New("permission denied"),
+		}),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning; msg=%s details=%v", r.Status, r.Message, r.Details)
+	}
+	if !strings.Contains(strings.Join(r.Details, "\n"), "measure error: broken: permission denied") {
+		t.Errorf("details should surface measurement error; got %v", r.Details)
+	}
+}
+
+func TestWorktreeDiskSizeCheck_OverWarnThreshold(t *testing.T) {
+	dir := t.TempDir()
+	rigA := filepath.Join(dir, ".gc", "worktrees", "rig-a")
+	rigB := filepath.Join(dir, ".gc", "worktrees", "rig-b")
+	if err := os.MkdirAll(rigA, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(rigB, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{WorktreeRigWarnSize: "5GB", WorktreeRigErrorSize: "50GB"},
+		measureDir: fakeMeasure(map[string]int64{
+			rigA: 8 * 1024 * 1024 * 1024, // 8 GB — over warn
+			rigB: 1 * 1024 * 1024 * 1024, // 1 GB — under
+		}, nil),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning; msg=%s details=%v", r.Status, r.Message, r.Details)
+	}
+	if len(r.Details) != 1 {
+		t.Errorf("len(Details) = %d, want 1; details=%v", len(r.Details), r.Details)
+	}
+	if !strings.Contains(r.Details[0], "rig-a") {
+		t.Errorf("details should flag rig-a; got %q", r.Details[0])
+	}
+	if strings.Contains(strings.Join(r.Details, "\n"), "rig-b") {
+		t.Errorf("details should not flag rig-b (under threshold); got %v", r.Details)
+	}
+	if r.FixHint == "" {
+		t.Error("expected fix hint")
+	}
+}
+
+func TestWorktreeDiskSizeCheck_OverErrorThreshold(t *testing.T) {
+	dir := t.TempDir()
+	rig := filepath.Join(dir, ".gc", "worktrees", "huge")
+	if err := os.MkdirAll(rig, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{WorktreeRigWarnSize: "5GB", WorktreeRigErrorSize: "20GB"},
+		measureDir: fakeMeasure(map[string]int64{
+			rig: 100 * 1024 * 1024 * 1024, // 100 GB
+		}, nil),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusError {
+		t.Fatalf("status = %d, want Error", r.Status)
+	}
+	if !strings.Contains(r.Details[0], "error threshold") {
+		t.Errorf("details should mention error threshold; got %q", r.Details[0])
+	}
+}
+
+func TestWorktreeDiskSizeCheck_DetailsSortedDescending(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"small", "huge", "medium"} {
+		if err := os.MkdirAll(filepath.Join(dir, ".gc", "worktrees", name), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{WorktreeRigWarnSize: "1GB", WorktreeRigErrorSize: "100GB"},
+		measureDir: fakeMeasure(map[string]int64{
+			filepath.Join(dir, ".gc", "worktrees", "small"):  500 * 1024 * 1024,
+			filepath.Join(dir, ".gc", "worktrees", "medium"): 5 * 1024 * 1024 * 1024,
+			filepath.Join(dir, ".gc", "worktrees", "huge"):   30 * 1024 * 1024 * 1024,
+		}, nil),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning; details=%v", r.Status, r.Details)
+	}
+	// The largest should appear first in details. The "small" rig is
+	// under threshold and should not appear at all.
+	if !strings.HasPrefix(r.Details[0], `rig "huge"`) {
+		t.Errorf("details[0] should start with huge rig; got %q", r.Details[0])
+	}
+	if strings.Contains(strings.Join(r.Details, "\n"), `rig "small"`) {
+		t.Errorf("under-threshold rig should be omitted from details; got %v", r.Details)
+	}
+}
+
+// TestWorktreeDiskSizeCheck_CountExcludesMeasurementErrors pins the
+// fix for a count bug: the message reports "<N> rig(s) over threshold"
+// where N must be the threshold-violation count, NOT
+// `len(details)` (which also includes measurement errors).
+func TestWorktreeDiskSizeCheck_CountExcludesMeasurementErrors(t *testing.T) {
+	dir := t.TempDir()
+	rigOver := filepath.Join(dir, ".gc", "worktrees", "over")
+	rigBroken := filepath.Join(dir, ".gc", "worktrees", "broken")
+	for _, p := range []string{rigOver, rigBroken} {
+		if err := os.MkdirAll(p, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{WorktreeRigWarnSize: "5GB", WorktreeRigErrorSize: "100GB"},
+		measureDir: fakeMeasure(map[string]int64{
+			rigOver: 8 * 1024 * 1024 * 1024,
+		}, map[string]error{
+			rigBroken: errors.New("permission denied"),
+		}),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning", r.Status)
+	}
+	// Exactly one rig is over threshold; the broken one is a
+	// measurement error, not a threshold violation.
+	if !strings.Contains(r.Message, "1 rig(s)") {
+		t.Errorf("message should report 1 rig over threshold (not 2); got %q", r.Message)
+	}
+}
+
+func TestWorktreeDiskSizeCheck_AllMeasurementsFailedReturnsWarning(t *testing.T) {
+	// "We can't tell" must not look like "we're fine". When every rig
+	// fails to measure (e.g. permission denied), the check escalates
+	// to Warning and surfaces the errors — matches DoltNomsSize policy.
+	dir := t.TempDir()
+	rigA := filepath.Join(dir, ".gc", "worktrees", "broken-a")
+	rigB := filepath.Join(dir, ".gc", "worktrees", "broken-b")
+	if err := os.MkdirAll(rigA, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(rigB, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &WorktreeDiskSizeCheck{
+		cfg: config.DoctorConfig{},
+		measureDir: fakeMeasure(nil, map[string]error{
+			rigA: errors.New("permission denied"),
+			rigB: errors.New("io error"),
+		}),
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Errorf("status = %d, want Warning", r.Status)
+	}
+	if r.FixHint == "" {
+		t.Error("expected fix hint pointing at filesystem permissions")
+	}
+	if len(r.Details) != 2 {
+		t.Errorf("len(Details) = %d, want 2 (one per failed rig)", len(r.Details))
+	}
+}
+
+// --- NestedWorktreePruneCheck ---
+
+// fakeGitWorktree implements gitWorktree for tests. Behaves like the
+// shared admin dir of a multi-worktree repo: list returns the same
+// entries regardless of which path is used to construct it. Per-path
+// "uncommitted/unpushed/stashed" flags drive classifyNested.
+var _ gitWorktree = (*fakeGitWorktree)(nil)
+
+type fakeGitWorktree struct {
+	listResp    []git.Worktree
+	listErr     error
+	notRepo     map[string]bool // paths where IsRepo returns false
+	uncommitted map[string]bool
+	unpushed    map[string]bool
+	unpushedErr map[string]error
+	stashed     map[string]bool
+	stashedErr  map[string]error
+	removeCalls *[]string // path argument of each WorktreeRemove call
+	removeFrom  *[]string // currentPath (cwd-equivalent) at each remove call
+	removeErr   map[string]error
+	currentPath string
+	onList      func(callerPath string) // optional probe; fires per WorktreeList call
+}
+
+func (f *fakeGitWorktree) IsRepo() bool { return !f.notRepo[f.currentPath] }
+func (f *fakeGitWorktree) WorktreeList() ([]git.Worktree, error) {
+	if f.onList != nil {
+		f.onList(f.currentPath)
+	}
+	return f.listResp, f.listErr
+}
+func (f *fakeGitWorktree) HasUncommittedWork() bool { return f.uncommitted[f.currentPath] }
+func (f *fakeGitWorktree) HasUnpushedCommitsResult() (bool, error) {
+	if err := f.unpushedErr[f.currentPath]; err != nil {
+		return false, err
+	}
+	return f.unpushed[f.currentPath], nil
+}
+
+func (f *fakeGitWorktree) HasStashesResult() (bool, error) {
+	if err := f.stashedErr[f.currentPath]; err != nil {
+		return false, err
+	}
+	return f.stashed[f.currentPath], nil
+}
+
+func (f *fakeGitWorktree) WorktreeRemove(path string, _ bool) error {
+	if f.removeCalls != nil {
+		*f.removeCalls = append(*f.removeCalls, path)
+	}
+	if f.removeFrom != nil {
+		*f.removeFrom = append(*f.removeFrom, f.currentPath)
+	}
+	if f.removeErr != nil {
+		if e, ok := f.removeErr[path]; ok {
+			return e
+		}
+	}
+	return nil
+}
+
+// makeAgentHome creates dir/.gc/worktrees/rig-a/<agent>/ with a stub
+// .git file so isGitWorktreePath returns true. Returns the agent home
+// path (canonicalized via pathutil.NormalizePathForCompare to match
+// what the check stores). The .git stub uses a shared gitdir so all
+// homes created via this helper appear to belong to the same admin
+// dir; tests that need distinct admin dirs should use
+// makeAgentHomeAdmin.
+func makeAgentHome(t *testing.T, dir, agent string) string {
+	t.Helper()
+	return makeAgentHomeAdmin(t, dir, "rig-a", agent, "/tmp/none")
+}
+
+// makeAgentHomeAdmin is like makeAgentHome but lets the test specify
+// the gitdir admin root, so two homes can simulate distinct repos.
+func makeAgentHomeAdmin(t *testing.T, dir, rig, agent, adminRoot string) string {
+	t.Helper()
+	home := filepath.Join(dir, ".gc", "worktrees", rig, agent)
+	if err := os.MkdirAll(home, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	gitdir := adminRoot + "/worktrees/" + agent
+	if err := os.WriteFile(filepath.Join(home, ".git"), []byte("gitdir: "+gitdir+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return pathutil.NormalizePathForCompare(home)
+}
+
+func TestNestedWorktreePruneCheck_NoWorktreesDir(t *testing.T) {
+	dir := t.TempDir()
+	c := NewNestedWorktreePruneCheck(config.DoctorConfig{})
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusOK {
+		t.Errorf("status = %d, want OK", r.Status)
+	}
+}
+
+func TestNestedWorktreePruneCheck_NoNestedWorktrees(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "home-branch"},
+					// sibling worktree at unrelated path — not nested
+					{Path: filepath.Join(dir, "external"), Branch: "external"},
+				},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusOK {
+		t.Fatalf("status = %d, want OK; msg=%s", r.Status, r.Message)
+	}
+	if len(c.findings) != 0 {
+		t.Errorf("findings = %d, want 0", len(c.findings))
+	}
+}
+
+func TestNestedWorktreePruneCheck_ClassifiesSafeAndUnsafe(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	safe := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task-clean"))
+	dirty := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task-dirty"))
+	unpushed := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task-unpushed"))
+	stashed := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task-stashed"))
+	if err := os.MkdirAll(safe, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(dirty, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(unpushed, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(stashed, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "home-branch"},
+					{Path: safe, Branch: "task-clean"},
+					{Path: dirty, Branch: "task-dirty"},
+					{Path: unpushed, Branch: "task-unpushed"},
+					{Path: stashed, Branch: "task-stashed"},
+				},
+				uncommitted: map[string]bool{dirty: true},
+				unpushed:    map[string]bool{unpushed: true},
+				stashed:     map[string]bool{stashed: true},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning; msg=%s details=%v", r.Status, r.Message, r.Details)
+	}
+
+	var safeCount, unsafeCount int
+	for _, f := range c.findings {
+		if f.safeToRm {
+			safeCount++
+		} else {
+			unsafeCount++
+		}
+	}
+	if safeCount != 1 {
+		t.Errorf("safeCount = %d, want 1", safeCount)
+	}
+	if unsafeCount != 3 {
+		t.Errorf("unsafeCount = %d, want 3", unsafeCount)
+	}
+
+	for _, f := range c.findings {
+		if f.path == home {
+			t.Errorf("agent home %q should not be a nested finding", home)
+		}
+	}
+
+	// Fix removes only the safe one.
+	if err := c.Fix(&CheckContext{CityPath: dir}); err != nil {
+		t.Fatalf("Fix: %v", err)
+	}
+	if len(removes) != 1 {
+		t.Fatalf("removes = %v, want exactly one (the safe entry)", removes)
+	}
+	if removes[0] != safe {
+		t.Errorf("removed %q, want %q", removes[0], safe)
+	}
+}
+
+func TestNestedWorktreePruneCheck_PruneTrueEscalatesSeverity(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	safe := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task-clean"))
+	if err := os.MkdirAll(safe, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{NestedWorktreePrune: true},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "home-branch"},
+					{Path: safe, Branch: "task-clean"},
+				},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusError {
+		t.Errorf("status = %d, want Error (NestedWorktreePrune=true escalates)", r.Status)
+	}
+}
+
+func TestNestedWorktreePruneCheck_AllUnsafeReturnsOK(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	dirty := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task"))
+	if err := os.MkdirAll(dirty, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "home-branch"},
+					{Path: dirty, Branch: "task"},
+				},
+				uncommitted: map[string]bool{dirty: true},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusOK {
+		t.Errorf("status = %d, want OK (nothing safely prunable)", r.Status)
+	}
+	if !strings.Contains(r.Message, "none safely prunable") {
+		t.Errorf("message should say 'none safely prunable'; got %q", r.Message)
+	}
+}
+
+func TestNestedWorktreePruneCheck_AllUnsafeWithListingErrorReturnsWarning(t *testing.T) {
+	dir := t.TempDir()
+	homeA := makeAgentHomeAdmin(t, dir, "rig-a", "agent-1", "/repo-a/.git")
+	homeB := makeAgentHomeAdmin(t, dir, "rig-b", "agent-2", "/repo-b/.git")
+	dirty := pathutil.NormalizePathForCompare(filepath.Join(homeA, "worktrees", "task"))
+	if err := os.MkdirAll(dirty, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			switch path {
+			case homeB:
+				return &fakeGitWorktree{
+					listErr:     errors.New("cannot list worktrees"),
+					currentPath: path,
+				}
+			default:
+				return &fakeGitWorktree{
+					listResp: []git.Worktree{
+						{Path: homeA, Branch: "home-a"},
+						{Path: dirty, Branch: "task"},
+					},
+					uncommitted: map[string]bool{dirty: true},
+					currentPath: path,
+				}
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning; msg=%s details=%v", r.Status, r.Message, r.Details)
+	}
+	if !strings.Contains(strings.Join(r.Details, "\n"), "cannot list worktrees") {
+		t.Errorf("details should include listing error; got %v", r.Details)
+	}
+}
+
+func TestNestedWorktreePruneCheck_DeduplicatesAcrossHomes(t *testing.T) {
+	// Two agent homes that share the same git repo would each list the
+	// same nested worktree. The check must not classify or remove it
+	// twice.
+	dir := t.TempDir()
+	homeA := makeAgentHome(t, dir, "polecat-1")
+	homeB := makeAgentHome(t, dir, "polecat-2")
+
+	// Nested under homeA. homeB will also list it because they share a repo.
+	nested := pathutil.NormalizePathForCompare(filepath.Join(homeA, "worktrees", "task"))
+	if err := os.MkdirAll(nested, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: homeA, Branch: "a"},
+					{Path: homeB, Branch: "b"},
+					{Path: nested, Branch: "task"},
+				},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning", r.Status)
+	}
+	if len(c.findings) != 1 {
+		t.Errorf("findings = %d, want 1 (deduplicated)", len(c.findings))
+	}
+
+	if err := c.Fix(&CheckContext{}); err != nil {
+		t.Fatalf("Fix: %v", err)
+	}
+	if len(removes) != 1 {
+		t.Errorf("removes = %v, want exactly one", removes)
+	}
+}
+
+// TestNestedWorktreePruneCheck_FixContinuesPastError pins the
+// reclaim-as-much-as-possible semantic: a single locked worktree must
+// not strand later safe entries. The returned error joins all per-entry
+// failures so the operator sees what was missed.
+func TestNestedWorktreePruneCheck_FixContinuesPastError(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	first := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "first"))
+	second := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "second"))
+	third := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "third"))
+	for _, p := range []string{first, second, third} {
+		if err := os.MkdirAll(p, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "home"},
+					{Path: first, Branch: "first"},
+					{Path: second, Branch: "second"},
+					{Path: third, Branch: "third"},
+				},
+				removeCalls: &removes,
+				removeErr:   map[string]error{second: errors.New("git locked")},
+				currentPath: path,
+			}
+		},
+	}
+	if r := c.Run(&CheckContext{CityPath: dir}); r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning", r.Status)
+	}
+	err := c.Fix(&CheckContext{})
+	if err == nil {
+		t.Fatal("Fix should surface the remove error")
+	}
+	if !strings.Contains(err.Error(), "git locked") {
+		t.Errorf("error should wrap original; got %v", err)
+	}
+	// All three were attempted; only the failing one is missing from a
+	// successful-removal perspective — but accumulator records every
+	// call.
+	if len(removes) != 3 {
+		t.Errorf("removes = %v, want all three attempted", removes)
+	}
+}
+
+func TestNestedWorktreePruneCheck_FixRevalidatesBeforeRemove(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "agent-1")
+	nested := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task"))
+	if err := os.MkdirAll(nested, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes []string
+	uncommitted := map[string]bool{}
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "h"},
+					{Path: nested, Branch: "task"},
+				},
+				uncommitted: uncommitted,
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	if r := c.Run(&CheckContext{CityPath: dir}); r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning", r.Status)
+	}
+	uncommitted[nested] = true
+	err := c.Fix(&CheckContext{})
+	if err == nil {
+		t.Fatal("Fix should fail closed when revalidation finds new local work")
+	}
+	if len(removes) != 0 {
+		t.Errorf("removes = %v, want none after failed revalidation", removes)
+	}
+}
+
+func TestNestedWorktreePruneCheck_ProbeErrorsAreUnsafe(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "agent-1")
+	unpushedErr := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "unpushed-error"))
+	stashErr := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "stash-error"))
+	for _, p := range []string{unpushedErr, stashErr} {
+		if err := os.MkdirAll(p, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "h"},
+					{Path: unpushedErr, Branch: "unpushed-error"},
+					{Path: stashErr, Branch: "stash-error"},
+				},
+				unpushedErr: map[string]error{unpushedErr: errors.New("log failed")},
+				stashedErr:  map[string]error{stashErr: errors.New("stash failed")},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning because probe errors are inspection failures; msg=%s details=%v", r.Status, r.Message, r.Details)
+	}
+	if len(c.findings) != 2 {
+		t.Fatalf("findings = %d, want 2", len(c.findings))
+	}
+	for _, f := range c.findings {
+		if f.safeToRm {
+			t.Fatalf("%s should not be safe after probe error", f.path)
+		}
+		if !strings.Contains(f.reason, "probe failed") {
+			t.Errorf("reason for %s = %q, want probe failure", f.path, f.reason)
+		}
+	}
+	if err := c.Fix(&CheckContext{}); err != nil {
+		t.Fatalf("Fix should skip unsafe probe-error findings without error: %v", err)
+	}
+	if len(removes) != 0 {
+		t.Errorf("removes = %v, want none", removes)
+	}
+}
+
+func TestReadGitAdminDir_RepoPathContainsWorktreesSegment(t *testing.T) {
+	// Regression: if the repo's own path contains "/worktrees/" as a
+	// literal segment (e.g. user keeps repos under ~/worktrees/), the
+	// admin-dir extraction must still find the LAST "/worktrees/"
+	// (the one git inserts before the per-worktree subdir), not the
+	// user's path component.
+	dir := t.TempDir()
+	tricky := filepath.Join(dir, "worktrees", "myproj")
+	if err := os.MkdirAll(tricky, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	gitdir := tricky + "/.git/worktrees/agentA"
+	if err := os.WriteFile(filepath.Join(tricky, ".git"), []byte("gitdir: "+gitdir+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got := readGitAdminDir(tricky)
+	want := pathutil.NormalizePathForCompare(tricky + "/.git")
+	if got != want {
+		t.Errorf("readGitAdminDir = %q, want %q (must use LastIndex of /worktrees/)", got, want)
+	}
+}
+
+// TestNestedWorktreePruneCheck_DedupsWorktreeListAcrossSharedAdminDir
+// pins the optimization that skips redundant `git worktree list` calls
+// for agent homes that share a single admin dir. Two homes pointing at
+// the same admin dir must trigger exactly one WorktreeList call; two
+// homes pointing at distinct admin dirs must trigger two.
+func TestNestedWorktreePruneCheck_DedupsWorktreeListAcrossSharedAdminDir(t *testing.T) {
+	dir := t.TempDir()
+	homeA := makeAgentHomeAdmin(t, dir, "rig-a", "polecat-1", "/repo/.git")
+	homeB := makeAgentHomeAdmin(t, dir, "rig-a", "polecat-2", "/repo/.git")
+	homeC := makeAgentHomeAdmin(t, dir, "rig-b", "polecat-3", "/other/.git")
+
+	var listCalls []string
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: homeA, Branch: "a"},
+					{Path: homeB, Branch: "b"},
+					{Path: homeC, Branch: "c"},
+				},
+				removeCalls: &removes,
+				currentPath: path,
+				onList:      func(p string) { listCalls = append(listCalls, p) },
+			}
+		},
+	}
+	if r := c.Run(&CheckContext{CityPath: dir}); r.Status != StatusOK {
+		t.Fatalf("status = %d, want OK; msg=%s", r.Status, r.Message)
+	}
+	if len(listCalls) != 2 {
+		t.Errorf("WorktreeList calls = %v, want 2 (one per distinct admin dir; homeA and homeB share)", listCalls)
+	}
+}
+
+// TestNestedWorktreePruneCheck_DedupCoversNestedUnderEveryHome pins the
+// fix for a correctness bug introduced by the admin-dir dedup: when
+// homes A and B share an admin dir, only A's WorktreeList runs, but
+// nested entries living under B must still be classified. Iterating
+// the shared list against EVERY home in the admin group preserves
+// coverage; the previous implementation only checked containment
+// against the source home and silently dropped B's nested entries.
+func TestNestedWorktreePruneCheck_DedupCoversNestedUnderEveryHome(t *testing.T) {
+	dir := t.TempDir()
+	homeA := makeAgentHomeAdmin(t, dir, "rig-a", "polecat-1", "/repo/.git")
+	homeB := makeAgentHomeAdmin(t, dir, "rig-a", "polecat-2", "/repo/.git")
+	nestedUnderA := pathutil.NormalizePathForCompare(filepath.Join(homeA, "worktrees", "task-a"))
+	nestedUnderB := pathutil.NormalizePathForCompare(filepath.Join(homeB, "worktrees", "task-b"))
+	for _, p := range []string{nestedUnderA, nestedUnderB} {
+		if err := os.MkdirAll(p, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	var listCalls []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: homeA, Branch: "a"},
+					{Path: homeB, Branch: "b"},
+					{Path: nestedUnderA, Branch: "task-a"},
+					{Path: nestedUnderB, Branch: "task-b"},
+				},
+				currentPath: path,
+				onList:      func(p string) { listCalls = append(listCalls, p) },
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning", r.Status)
+	}
+	if len(listCalls) != 1 {
+		t.Errorf("WorktreeList calls = %v, want 1 (admin-dir dedup)", listCalls)
+	}
+	if len(c.findings) != 2 {
+		t.Errorf("findings = %d, want 2 (one nested under each home, even though only one WorktreeList ran)",
+			len(c.findings))
+	}
+	parents := map[string]bool{}
+	for _, f := range c.findings {
+		parents[f.parent] = true
+	}
+	if !parents[homeA] || !parents[homeB] {
+		t.Errorf("findings should attribute parents to both homes; got %v", parents)
+	}
+}
+
+// TestNestedWorktreePruneCheck_FixUsesParentForGitContext pins the fix
+// for the cwd-removal pattern: WorktreeRemove must run from the parent
+// home, not from the worktree being removed.
+func TestNestedWorktreePruneCheck_FixUsesParentForGitContext(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	nested := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "task"))
+	if err := os.MkdirAll(nested, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes, removeFrom []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "h"},
+					{Path: nested, Branch: "task"},
+				},
+				removeCalls: &removes,
+				removeFrom:  &removeFrom,
+				currentPath: path,
+			}
+		},
+	}
+	if r := c.Run(&CheckContext{CityPath: dir}); r.Status != StatusWarning {
+		t.Fatalf("status = %d, want Warning", r.Status)
+	}
+	if err := c.Fix(&CheckContext{}); err != nil {
+		t.Fatalf("Fix: %v", err)
+	}
+	if len(removeFrom) != 1 || removeFrom[0] != home {
+		t.Errorf("WorktreeRemove ran from %v, want exactly [%q] (parent home, not the worktree being removed)",
+			removeFrom, home)
+	}
+}
+
+// TestNestedWorktreePruneCheck_BrokenRepoGate pins the IsRepo gate that
+// defends against fail-open semantics in HasUnpushedCommits / HasStashes
+// (which return false on git error). A candidate whose admin dir is
+// corrupt must not be classified as safe to remove.
+func TestNestedWorktreePruneCheck_BrokenRepoGate(t *testing.T) {
+	dir := t.TempDir()
+	home := makeAgentHome(t, dir, "polecat-1")
+	broken := pathutil.NormalizePathForCompare(filepath.Join(home, "worktrees", "broken"))
+	if err := os.MkdirAll(broken, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var removes []string
+	c := &NestedWorktreePruneCheck{
+		cfg: config.DoctorConfig{},
+		newGit: func(path string) gitWorktree {
+			return &fakeGitWorktree{
+				listResp: []git.Worktree{
+					{Path: home, Branch: "h"},
+					{Path: broken, Branch: "broken"},
+				},
+				notRepo:     map[string]bool{broken: true},
+				removeCalls: &removes,
+				currentPath: path,
+			}
+		},
+	}
+	r := c.Run(&CheckContext{CityPath: dir})
+	if r.Status != StatusOK {
+		t.Fatalf("status = %d, want OK (broken candidate marked unsafe)", r.Status)
+	}
+	if len(c.findings) != 1 {
+		t.Fatalf("findings = %d, want 1", len(c.findings))
+	}
+	if c.findings[0].safeToRm {
+		t.Error("broken candidate should NOT be safeToRm")
+	}
+	if c.findings[0].reason != "git status unreadable" {
+		t.Errorf("reason = %q, want %q", c.findings[0].reason, "git status unreadable")
+	}
+}
+
+func TestPathStrictlyInside(t *testing.T) {
+	tests := []struct {
+		child, parent string
+		want          bool
+	}{
+		{"/a/b/c", "/a/b", true},
+		{"/a/b", "/a/b", false},  // equal — strict
+		{"/a/b", "/a/bc", false}, // prefix-but-not-subpath
+		{"/x/y", "/a/b", false},
+		{"/a/b/c/d", "/a/b", true},
+	}
+	for _, tt := range tests {
+		got := pathStrictlyInside(tt.child, tt.parent)
+		if got != tt.want {
+			t.Errorf("pathStrictlyInside(%q, %q) = %v, want %v", tt.child, tt.parent, got, tt.want)
+		}
+	}
+}
diff --git a/internal/doctor/checks_test.go b/internal/doctor/checks_test.go
index 3fa5fcadac..8b676ad79b 100644
--- a/internal/doctor/checks_test.go
+++ b/internal/doctor/checks_test.go
@@ -262,6 +262,24 @@ func TestConfigRefsCheck_UndefinedProvider(t *testing.T) {
 	}
 }
 
+func TestConfigRefsCheck_BuiltinProviderNotFlagged(t *testing.T) {
+	// Builtin providers (e.g. "claude") should not be flagged as undefined
+	// even when custom providers are declared in [providers].
+	dir := t.TempDir()
+	cfg := &config.City{
+		Providers: map[string]config.ProviderSpec{"ollama-local": {}},
+		Agents: []config.Agent{
+			{Name: "worker", Provider: "claude"},
+			{Name: "coder", Provider: "codex"},
+		},
+	}
+	c := NewConfigRefsCheck(cfg, dir)
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusOK {
+		t.Errorf("status = %d, want OK (builtin providers are implicitly valid); details = %v", r.Status, r.Details)
+	}
+}
+
 func TestConfigRefsCheck_NoProvidersDefined(t *testing.T) {
 	// When no providers section exists, agent provider refs are not checked.
 	dir := t.TempDir()
@@ -2248,6 +2266,57 @@ func setupManagedDoltCity(t *testing.T) string {
 	return dir
 }
 
+func startDoctorTCPListenerProcess(t *testing.T, dataDir string) (*exec.Cmd, int) {
+	t.Helper()
+	readyPath := filepath.Join(t.TempDir(), "ready")
+	proc := exec.Command("python3", "-c", `
+import socket
+import sys
+import time
+data_dir = sys.argv[1]
+ready_path = sys.argv[2]
+sock = socket.socket()
+sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+sock.bind(("127.0.0.1", 0))
+sock.listen(5)
+with open(ready_path, "w") as f:
+    f.write(str(sock.getsockname()[1]) + "\n")
+while True:
+    time.sleep(1)
+`, dataDir, readyPath)
+	if err := proc.Start(); err != nil {
+		t.Fatalf("start doctor TCP listener: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = proc.Process.Kill()
+		_ = proc.Wait()
+	})
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		data, err := os.ReadFile(readyPath)
+		if err == nil {
+			trimmed := strings.TrimSpace(string(data))
+			if trimmed == "" {
+				time.Sleep(25 * time.Millisecond)
+				continue
+			}
+			port, parseErr := strconv.Atoi(trimmed)
+			if parseErr != nil {
+				t.Fatalf("parse listener port %q: %v", trimmed, parseErr)
+			}
+			conn, dialErr := net.DialTimeout("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)), 200*time.Millisecond)
+			if dialErr == nil {
+				_ = conn.Close()
+				return proc, port
+			}
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("doctor TCP listener for %s did not become ready", dataDir)
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+}
+
 func setupFreshManagedDoltCity(t *testing.T) string {
 	t.Helper()
 	t.Setenv("GC_DOLT_DATA_DIR", "")
@@ -2699,14 +2768,9 @@ func TestDoltNomsSizeCheck_UsesPublishedRuntimeDataDir(t *testing.T) {
 	if err := os.MkdirAll(dataDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("Listen: %v", err)
-	}
-	t.Cleanup(func() { _ = ln.Close() })
-	port := ln.Addr().(*net.TCPAddr).Port
+	proc, port := startDoctorTCPListenerProcess(t, dataDir)
 	statePath := filepath.Join(dir, ".gc", "runtime", "packs", "dolt", "dolt-state.json")
-	state := fmt.Sprintf(`{"running":true,"pid":%d,"port":%d,"data_dir":%q}`, os.Getpid(), port, dataDir)
+	state := fmt.Sprintf(`{"running":true,"pid":%d,"port":%d,"data_dir":%q}`, proc.Process.Pid, port, dataDir)
 	if err := os.WriteFile(statePath, []byte(state), 0o644); err != nil {
 		t.Fatal(err)
 	}
@@ -2886,7 +2950,7 @@ func writeDoctorManagedDoltConfig(t *testing.T, cityPath string, overrides map[s
 		"behavior": map[string]any{
 			"auto_gc_behavior": map[string]any{
 				"enable":        true,
-				"archive_level": 1,
+				"archive_level": 0,
 			},
 		},
 	}
@@ -3011,6 +3075,18 @@ func TestDoltConfigCheck_OK(t *testing.T) {
 	}
 }
 
+func TestDoltConfigCheck_AcceptsLegacyArchiveLevelOne(t *testing.T) {
+	dir := setupManagedDoltCity(t)
+	writeDoctorManagedDoltConfig(t, dir, map[string]any{
+		"behavior.auto_gc_behavior.archive_level": 1,
+	})
+	c := NewDoltConfigCheck(dir, false)
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusOK {
+		t.Fatalf("status = %d, want OK for one-release archive_level=1 compatibility; msg = %s", r.Status, r.Message)
+	}
+}
+
 func TestDoltConfigCheck_UsesTrustedCityRuntimeDir(t *testing.T) {
 	dir := setupManagedDoltCity(t)
 	customRuntimeDir := filepath.Join(t.TempDir(), "runtime-root")
@@ -3229,22 +3305,25 @@ func TestManagedDoltChecksSkipInvalidCityConfig(t *testing.T) {
 
 func TestParseDoltVersion(t *testing.T) {
 	cases := []struct {
-		name    string
-		in      string
-		wantMaj int
-		wantMin int
-		wantPat int
-		wantErr bool
+		name       string
+		in         string
+		wantMaj    int
+		wantMin    int
+		wantPat    int
+		wantPreRel bool
+		wantErr    bool
 	}{
-		{"plain", "dolt version 1.75.2", 1, 75, 2, false},
-		{"with_warning", "dolt version 1.75.2\nWarning: some deprecation", 1, 75, 2, false},
-		{"no_prefix", "1.50.0", 1, 50, 0, false},
-		{"with_v_prefix", "v1.50.0", 1, 50, 0, false},
-		{"prerelease", "dolt version 1.76.0-rc1", 1, 76, 0, false},
-		{"build_suffix", "dolt version 1.76.0+build.5", 1, 76, 0, false},
-		{"empty", "", 0, 0, 0, true},
-		{"garbage", "hello world", 0, 0, 0, true},
-		{"too_few_parts", "dolt version 1.50", 0, 0, 0, true},
+		{"plain", "dolt version 1.75.2", 1, 75, 2, false, false},
+		{"with_warning", "dolt version 1.75.2\nWarning: some deprecation", 1, 75, 2, false, false},
+		{"no_prefix", "1.50.0", 1, 50, 0, false, false},
+		{"with_v_prefix", "v1.50.0", 1, 50, 0, false, false},
+		{"prerelease", "dolt version 1.76.0-rc1", 1, 76, 0, true, false},
+		{"dev_prerelease", "dolt version 1.86.2-dev.0", 1, 86, 2, true, false},
+		{"build_suffix", "dolt version 1.76.0+build.5", 1, 76, 0, false, false},
+		{"hyphenated_build_suffix", "dolt version 1.76.0+build-5", 1, 76, 0, false, false},
+		{"empty", "", 0, 0, 0, false, true},
+		{"garbage", "hello world", 0, 0, 0, false, true},
+		{"too_few_parts", "dolt version 1.50", 0, 0, 0, false, true},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -3262,6 +3341,9 @@ func TestParseDoltVersion(t *testing.T) {
 				t.Errorf("parseDoltVersion(%q) = %d.%d.%d, want %d.%d.%d",
 					tc.in, got.Major, got.Minor, got.Patch, tc.wantMaj, tc.wantMin, tc.wantPat)
 			}
+			if got.PreRelease != tc.wantPreRel {
+				t.Errorf("parseDoltVersion(%q).PreRelease = %v, want %v", tc.in, got.PreRelease, tc.wantPreRel)
+			}
 		})
 	}
 }
@@ -3300,12 +3382,12 @@ func TestDoltVersionCheck_OK(t *testing.T) {
 
 func TestDoltVersionCheck_OK_AtMinimum(t *testing.T) {
 	c := NewDoltVersionCheck()
-	c.versionOutput = func() (string, error) { return "dolt version 1.86.1\n", nil }
+	c.versionOutput = func() (string, error) { return "dolt version 1.86.2\n", nil }
 	r := c.Run(&CheckContext{})
 	if r.Status != StatusOK {
 		t.Fatalf("status = %d, want OK; msg = %s", r.Status, r.Message)
 	}
-	if !strings.Contains(r.Message, "1.86.1") {
+	if !strings.Contains(r.Message, "1.86.2") {
 		t.Errorf("message = %q, want version in message", r.Message)
 	}
 }
@@ -3324,7 +3406,42 @@ func TestDoltVersionCheck_Error_BelowManagedConfigFloor(t *testing.T) {
 
 func TestDoltVersionCheck_Error_BelowMinimum(t *testing.T) {
 	c := NewDoltVersionCheck()
-	c.versionOutput = func() (string, error) { return "dolt version 1.86.0\n", nil }
+	c.versionOutput = func() (string, error) { return "dolt version 1.86.1\n", nil }
+	r := c.Run(&CheckContext{})
+	if r.Status != StatusError {
+		t.Fatalf("status = %d, want Error; msg = %s", r.Status, r.Message)
+	}
+	if !strings.Contains(r.Message, "below minimum") {
+		t.Errorf("message = %q, want below-minimum text", r.Message)
+	}
+}
+
+func TestDoltVersionCheck_Error_PreReleaseAtFloor(t *testing.T) {
+	cases := []string{
+		"dolt version 1.86.2-rc1\n",
+		"dolt version 1.86.2-rc1+build.5\n",
+		"dolt version 1.86.2-dev.0\n",
+		"dolt version 1.99.0-rc1\n",
+		"dolt version 2.0.0-rc1\n",
+	}
+	for _, version := range cases {
+		t.Run(strings.TrimSpace(version), func(t *testing.T) {
+			c := NewDoltVersionCheck()
+			c.versionOutput = func() (string, error) { return version, nil }
+			r := c.Run(&CheckContext{})
+			if r.Status != StatusError {
+				t.Fatalf("status = %d, want Error; msg = %s", r.Status, r.Message)
+			}
+			if !strings.Contains(r.Message, "pre-release") || !strings.Contains(r.Message, "1.86.2") {
+				t.Errorf("message = %q, want pre-release and minimum version text", r.Message)
+			}
+		})
+	}
+}
+
+func TestDoltVersionCheck_Error_LeadingWhitespaceBelowMinimum(t *testing.T) {
+	c := NewDoltVersionCheck()
+	c.versionOutput = func() (string, error) { return "  dolt version 1.85.9\n", nil }
 	r := c.Run(&CheckContext{})
 	if r.Status != StatusError {
 		t.Fatalf("status = %d, want Error; msg = %s", r.Status, r.Message)
diff --git a/internal/doltversion/doltversion.go b/internal/doltversion/doltversion.go
index 855b07bf9e..b7d1f942c7 100644
--- a/internal/doltversion/doltversion.go
+++ b/internal/doltversion/doltversion.go
@@ -1,5 +1,121 @@
 // Package doltversion centralizes Dolt version requirements.
 package doltversion
 
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
 // ManagedMin is the minimum Dolt version required for managed bd/Dolt operation.
-const ManagedMin = "1.86.1"
+const ManagedMin = "1.86.2"
+
+var (
+	// ErrPreRelease reports a Dolt version that is not a final release.
+	ErrPreRelease = errors.New("dolt version is a pre-release")
+	// ErrBelowMinimum reports a Dolt version below the configured minimum.
+	ErrBelowMinimum = errors.New("dolt version is below minimum")
+)
+
+// Info is the parsed semantic version of the installed `dolt` binary.
+type Info struct {
+	Major, Minor, Patch int
+	Raw                 string
+	PreRelease          bool
+}
+
+// Parse parses the first version-like token from `dolt version` output.
+// Build metadata after patch, such as "+build.5", is ignored. Pre-release
+// suffixes, such as "-rc1", are preserved so callers can fail closed.
+func Parse(out string) (Info, error) {
+	out = strings.TrimSpace(out)
+	if out == "" {
+		return Info{}, fmt.Errorf("empty version output")
+	}
+	if i := strings.IndexByte(out, '\n'); i >= 0 {
+		out = out[:i]
+	}
+	out = strings.TrimSpace(out)
+	const prefix = "dolt version "
+	if strings.HasPrefix(strings.ToLower(out), prefix) {
+		out = out[len(prefix):]
+	}
+	if i := strings.IndexAny(out, " \t"); i >= 0 {
+		out = out[:i]
+	}
+	out = strings.TrimPrefix(out, "v")
+	buildTrimmed := out
+	if i := strings.Index(buildTrimmed, "+"); i >= 0 {
+		buildTrimmed = buildTrimmed[:i]
+	}
+	core := buildTrimmed
+	preRelease := false
+	if i := strings.Index(core, "-"); i >= 0 {
+		preRelease = true
+		core = core[:i]
+	}
+	parts := strings.Split(core, ".")
+	if len(parts) < 3 {
+		return Info{}, fmt.Errorf("unrecognized version %q", out)
+	}
+	major, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return Info{}, fmt.Errorf("unrecognized major in %q: %w", out, err)
+	}
+	minor, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return Info{}, fmt.Errorf("unrecognized minor in %q: %w", out, err)
+	}
+	patch, err := strconv.Atoi(parts[2])
+	if err != nil {
+		return Info{}, fmt.Errorf("unrecognized patch in %q: %w", out, err)
+	}
+	raw := fmt.Sprintf("%d.%d.%d", major, minor, patch)
+	if preRelease {
+		raw = out
+	}
+	return Info{Major: major, Minor: minor, Patch: patch, Raw: raw, PreRelease: preRelease}, nil
+}
+
+// Compare returns -1 if a < b, 0 if a == b, and 1 if a > b.
+func Compare(a, b Info) int {
+	switch {
+	case a.Major != b.Major:
+		if a.Major < b.Major {
+			return -1
+		}
+		return 1
+	case a.Minor != b.Minor:
+		if a.Minor < b.Minor {
+			return -1
+		}
+		return 1
+	case a.Patch != b.Patch:
+		if a.Patch < b.Patch {
+			return -1
+		}
+		return 1
+	}
+	return 0
+}
+
+// CheckFinalMinimum parses output and verifies it names a final Dolt release
+// at or above minimum.
+func CheckFinalMinimum(out, minimum string) (Info, error) {
+	info, err := Parse(out)
+	if err != nil {
+		return Info{}, err
+	}
+	minInfo, err := Parse(minimum)
+	if err != nil {
+		return info, fmt.Errorf("parse minimum dolt version %q: %w", minimum, err)
+	}
+	if info.PreRelease {
+		return info, ErrPreRelease
+	}
+	if Compare(info, minInfo) < 0 {
+		return info, ErrBelowMinimum
+	}
+	return info, nil
+}
diff --git a/internal/doltversion/doltversion_test.go b/internal/doltversion/doltversion_test.go
new file mode 100644
index 0000000000..c8184fa27c
--- /dev/null
+++ b/internal/doltversion/doltversion_test.go
@@ -0,0 +1,103 @@
+package doltversion
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		name       string
+		input      string
+		wantRaw    string
+		wantMajor  int
+		wantMinor  int
+		wantPatch  int
+		wantPreRel bool
+		wantErr    bool
+	}{
+		{
+			name:      "dolt version prefix",
+			input:     "dolt version 1.86.2",
+			wantRaw:   "1.86.2",
+			wantMajor: 1,
+			wantMinor: 86,
+			wantPatch: 2,
+		},
+		{
+			name:      "build metadata",
+			input:     "dolt version 1.86.2+build-5",
+			wantRaw:   "1.86.2",
+			wantMajor: 1,
+			wantMinor: 86,
+			wantPatch: 2,
+		},
+		{
+			name:       "pre-release",
+			input:      "dolt version 1.99.0-rc1",
+			wantRaw:    "1.99.0-rc1",
+			wantMajor:  1,
+			wantMinor:  99,
+			wantPatch:  0,
+			wantPreRel: true,
+		},
+		{
+			name:       "pre-release with build metadata",
+			input:      "dolt version 1.86.2-rc1+build.5",
+			wantRaw:    "1.86.2-rc1+build.5",
+			wantMajor:  1,
+			wantMinor:  86,
+			wantPatch:  2,
+			wantPreRel: true,
+		},
+		{
+			name:    "missing patch",
+			input:   "dolt version 1.86",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := Parse(tt.input)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("Parse(%q) error = nil, want error", tt.input)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Parse(%q) error = %v", tt.input, err)
+			}
+			if got.Raw != tt.wantRaw || got.Major != tt.wantMajor || got.Minor != tt.wantMinor ||
+				got.Patch != tt.wantPatch || got.PreRelease != tt.wantPreRel {
+				t.Fatalf("Parse(%q) = %+v, want raw=%q major=%d minor=%d patch=%d prerelease=%v",
+					tt.input, got, tt.wantRaw, tt.wantMajor, tt.wantMinor, tt.wantPatch, tt.wantPreRel)
+			}
+		})
+	}
+}
+
+func TestCheckFinalMinimum(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		wantErr error
+	}{
+		{name: "at floor", input: "dolt version 1.86.2"},
+		{name: "above floor", input: "dolt version 1.86.10"},
+		{name: "below floor", input: "dolt version 1.86.1", wantErr: ErrBelowMinimum},
+		{name: "pre-release at floor", input: "dolt version 1.86.2-rc1", wantErr: ErrPreRelease},
+		{name: "pre-release with build metadata at floor", input: "dolt version 1.86.2-rc1+build.5", wantErr: ErrPreRelease},
+		{name: "pre-release above floor", input: "dolt version 2.0.0-rc1", wantErr: ErrPreRelease},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := CheckFinalMinimum(tt.input, ManagedMin)
+			if !errors.Is(err, tt.wantErr) {
+				t.Fatalf("CheckFinalMinimum(%q) error = %v, want %v", tt.input, err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/internal/doltversion/testenv_import_test.go b/internal/doltversion/testenv_import_test.go
new file mode 100644
index 0000000000..f6b44a97ae
--- /dev/null
+++ b/internal/doltversion/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package doltversion
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/events/events.go b/internal/events/events.go
index 92847e851c..3d432127a5 100644
--- a/internal/events/events.go
+++ b/internal/events/events.go
@@ -17,37 +17,44 @@ import (
 
 // Event type constants. Only types we actually emit today.
 const (
-	SessionWoke             = "session.woke"
-	SessionStopped          = "session.stopped"
-	SessionCrashed          = "session.crashed"
-	BeadCreated             = "bead.created"
-	BeadClosed              = "bead.closed"
-	BeadUpdated             = "bead.updated"
-	MailSent                = "mail.sent"
-	MailRead                = "mail.read"
-	MailArchived            = "mail.archived"
-	MailMarkedRead          = "mail.marked_read"
-	MailMarkedUnread        = "mail.marked_unread"
-	MailReplied             = "mail.replied"
-	MailDeleted             = "mail.deleted"
-	SessionDraining         = "session.draining"
-	SessionUndrained        = "session.undrained"
-	SessionQuarantined      = "session.quarantined"
-	SessionIdleKilled       = "session.idle_killed"
-	SessionSuspended        = "session.suspended"
-	SessionUpdated          = "session.updated"
-	ConvoyCreated           = "convoy.created"
-	ConvoyClosed            = "convoy.closed"
-	ControllerStarted       = "controller.started"
-	ControllerStopped       = "controller.stopped"
-	CitySuspended           = "city.suspended"
-	CityResumed             = "city.resumed"
+	SessionWoke        = "session.woke"
+	SessionStopped     = "session.stopped"
+	SessionCrashed     = "session.crashed"
+	BeadCreated        = "bead.created"
+	BeadClosed         = "bead.closed"
+	BeadUpdated        = "bead.updated"
+	MailSent           = "mail.sent"
+	MailRead           = "mail.read"
+	MailArchived       = "mail.archived"
+	MailMarkedRead     = "mail.marked_read"
+	MailMarkedUnread   = "mail.marked_unread"
+	MailReplied        = "mail.replied"
+	MailDeleted        = "mail.deleted"
+	SessionDraining    = "session.draining"
+	SessionUndrained   = "session.undrained"
+	SessionQuarantined = "session.quarantined"
+	SessionIdleKilled  = "session.idle_killed"
+	SessionSuspended   = "session.suspended"
+	SessionUpdated     = "session.updated"
+	ConvoyCreated      = "convoy.created"
+	ConvoyClosed       = "convoy.closed"
+	ControllerStarted  = "controller.started"
+	ControllerStopped  = "controller.stopped"
+	CitySuspended      = "city.suspended"
+	CityResumed        = "city.resumed"
+	// Typed async request result events. 5 success types (one per
+	// operation, fully typed payload) + 1 shared failure type.
+	RequestResultCityCreate     = "request.result.city.create"
+	RequestResultCityUnregister = "request.result.city.unregister"
+	RequestResultSessionCreate  = "request.result.session.create"
+	RequestResultSessionMessage = "request.result.session.message"
+	RequestResultSessionSubmit  = "request.result.session.submit"
+	RequestFailed               = "request.failed"
+
+	// Non-terminal city lifecycle events recorded in the per-city
+	// event log during init/unregister for diagnostics.
 	CityCreated             = "city.created"
-	CityReady               = "city.ready"
-	CityInitFailed          = "city.init_failed"
 	CityUnregisterRequested = "city.unregister_requested"
-	CityUnregistered        = "city.unregistered"
-	CityUnregisterFailed    = "city.unregister_failed"
 	OrderFired              = "order.fired"
 	OrderCompleted          = "order.completed"
 	OrderFailed             = "order.failed"
@@ -78,8 +85,10 @@ var KnownEventTypes = []string{
 	ConvoyCreated, ConvoyClosed,
 	ControllerStarted, ControllerStopped,
 	CitySuspended, CityResumed,
-	CityCreated, CityReady, CityInitFailed,
-	CityUnregisterRequested, CityUnregistered, CityUnregisterFailed,
+	RequestResultCityCreate, RequestResultCityUnregister,
+	RequestResultSessionCreate, RequestResultSessionMessage,
+	RequestResultSessionSubmit, RequestFailed,
+	CityCreated, CityUnregisterRequested,
 	OrderFired, OrderCompleted, OrderFailed,
 	ProviderSwapped, WorkerOperation,
 	ExtMsgBound, ExtMsgUnbound, ExtMsgGroupCreated,
@@ -126,6 +135,12 @@ type Provider interface {
 	Close() error
 }
 
+// TailProvider is an optional extension for providers that can return the
+// trailing matching events without scanning or materializing the whole history.
+type TailProvider interface {
+	ListTail(filter Filter, limit int) ([]Event, error)
+}
+
 // Watcher yields events one at a time. Created by [Provider.Watch].
 // Callers must call Close() when done watching.
 type Watcher interface {
diff --git a/internal/events/events_test.go b/internal/events/events_test.go
index 1223e06592..7fd1937c40 100644
--- a/internal/events/events_test.go
+++ b/internal/events/events_test.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -80,7 +81,7 @@ func TestFileRecorderPayloadRoundTrip(t *testing.T) {
 	payload := json.RawMessage(`{"type":"merge-request","title":"Fix bug","labels":["urgent"]}`)
 	rec.Record(Event{
 		Type:    BeadCreated,
-		Actor:   "polecat",
+		Actor:   "actor-payload",
 		Subject: "gc-42",
 		Payload: payload,
 	})
@@ -229,6 +230,40 @@ func TestFileRecorderResumesSeq(t *testing.T) {
 	}
 }
 
+func TestFileRecorderCoordinatesSeqAcrossStaleRecorders(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	var stderr bytes.Buffer
+
+	rec1, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rec1.Close() //nolint:errcheck // test cleanup
+	rec2, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rec2.Close() //nolint:errcheck // test cleanup
+
+	rec1.Record(Event{Type: BeadCreated, Actor: "rec1"})
+	rec2.Record(Event{Type: BeadUpdated, Actor: "rec2"})
+
+	events, err := ReadAll(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(events) != 2 {
+		t.Fatalf("got %d events, want 2", len(events))
+	}
+	for i, event := range events {
+		want := uint64(i + 1)
+		if event.Seq != want {
+			t.Fatalf("events[%d].Seq = %d, want %d; events=%+v", i, event.Seq, want, events)
+		}
+	}
+}
+
 func TestFileRecorderFillsTimestamp(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "events.jsonl")
@@ -301,7 +336,7 @@ func TestFakeList(t *testing.T) {
 	f := NewFake()
 	f.Record(Event{Type: BeadCreated, Actor: "human", Subject: "gc-1"})
 	f.Record(Event{Type: BeadClosed, Actor: "human", Subject: "gc-1"})
-	f.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "mayor"})
+	f.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "session-alpha"})
 
 	all, err := f.List(Filter{})
 	if err != nil {
@@ -320,6 +355,38 @@ func TestFakeList(t *testing.T) {
 	}
 }
 
+func TestFakeListTailFiltersLimitModesAndErrors(t *testing.T) {
+	f := NewFake()
+	f.Record(Event{Type: BeadCreated, Actor: "human", Subject: "old"})
+	f.Record(Event{Type: BeadClosed, Actor: "human", Subject: "ignored"})
+	f.Record(Event{Type: BeadCreated, Actor: "human", Subject: "middle"})
+	f.Record(Event{Type: BeadCreated, Actor: "gc", Subject: "wrong-actor"})
+	f.Record(Event{Type: BeadCreated, Actor: "human", Subject: "new"})
+
+	tail, err := f.ListTail(Filter{Type: BeadCreated, Actor: "human"}, 2)
+	if err != nil {
+		t.Fatalf("ListTail(limit): %v", err)
+	}
+	if len(tail) != 2 {
+		t.Fatalf("ListTail(limit) got %d events, want 2", len(tail))
+	}
+	if tail[0].Subject != "middle" || tail[1].Subject != "new" {
+		t.Fatalf("tail subjects = [%s %s], want [middle new]", tail[0].Subject, tail[1].Subject)
+	}
+
+	all, err := f.ListTail(Filter{Type: BeadCreated, Actor: "human"}, 0)
+	if err != nil {
+		t.Fatalf("ListTail(limit=0): %v", err)
+	}
+	if len(all) != 3 {
+		t.Fatalf("ListTail(limit=0) got %d events, want 3", len(all))
+	}
+
+	if _, err := NewFailFake().ListTail(Filter{}, 1); err == nil {
+		t.Fatal("ListTail on broken fake returned nil error")
+	}
+}
+
 func TestFakeLatestSeq(t *testing.T) {
 	f := NewFake()
 	seq, err := f.LatestSeq()
@@ -429,7 +496,7 @@ func TestReadFiltered(t *testing.T) {
 	past := now.Add(-2 * time.Hour)
 	rec.Record(Event{Type: BeadCreated, Actor: "human", Subject: "gc-1", Ts: past})
 	rec.Record(Event{Type: BeadClosed, Actor: "human", Subject: "gc-1", Ts: past})
-	rec.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "mayor", Ts: now})
+	rec.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "session-alpha", Ts: now})
 	rec.Close() //nolint:errcheck // test cleanup
 
 	t.Run("by_type", func(t *testing.T) {
@@ -493,6 +560,85 @@ func TestReadFiltered(t *testing.T) {
 	})
 }
 
+func TestReadFilteredMissingFile(t *testing.T) {
+	got, err := ReadFiltered(filepath.Join(t.TempDir(), "missing.jsonl"), Filter{})
+	if err != nil {
+		t.Fatalf("ReadFiltered(missing): %v", err)
+	}
+	if got != nil {
+		t.Fatalf("ReadFiltered(missing) = %v, want nil", got)
+	}
+}
+
+func TestReadFilteredSkipsMalformedLines(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	data := strings.Join([]string{
+		`not-json`,
+		`{"seq":1,"type":"bead.created","ts":"2025-06-15T10:30:00Z","actor":"actor-a","subject":"gc-1"}`,
+		``,
+	}, "\n")
+	if err := os.WriteFile(path, []byte(data), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ReadFiltered(path, Filter{})
+	if err != nil {
+		t.Fatalf("ReadFiltered: %v", err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("got %d events, want 1", len(got))
+	}
+	if got[0].Subject != "gc-1" {
+		t.Errorf("Subject = %q, want gc-1", got[0].Subject)
+	}
+}
+
+func TestReadFilteredScannerError(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	first := `{"seq":1,"type":"bead.created","ts":"2025-06-15T10:30:00Z","actor":"actor-a","subject":"gc-1"}` + "\n"
+	oversizedLine := strings.Repeat("x", 1024*1024+1)
+	if err := os.WriteFile(path, []byte(first+oversizedLine), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ReadFiltered(path, Filter{})
+	if err == nil {
+		t.Fatal("ReadFiltered returned nil error, want scanner error")
+	}
+	if !strings.Contains(err.Error(), "scanning events") {
+		t.Fatalf("ReadFiltered error = %q, want scanning events context", err.Error())
+	}
+	if len(got) != 1 {
+		t.Fatalf("got %d partial events, want 1", len(got))
+	}
+	if got[0].Subject != "gc-1" {
+		t.Errorf("partial Subject = %q, want gc-1", got[0].Subject)
+	}
+}
+
+func TestReadFilteredLimitStopsScanning(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	first := `{"seq":1,"type":"bead.created","ts":"2025-06-15T10:30:00Z","actor":"actor-a","subject":"gc-1"}` + "\n"
+	oversizedLine := strings.Repeat("x", 1024*1024+1) + "\n"
+	if err := os.WriteFile(path, []byte(first+oversizedLine), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ReadFiltered(path, Filter{Limit: 1})
+	if err != nil {
+		t.Fatalf("ReadFiltered: %v", err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("got %d events, want 1", len(got))
+	}
+	if got[0].Seq != 1 {
+		t.Errorf("got[0].Seq = %d, want 1", got[0].Seq)
+	}
+}
+
 func TestReadFilteredAfterSeq(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "events.jsonl")
@@ -552,6 +698,113 @@ func TestReadFilteredAfterSeqCombined(t *testing.T) {
 	}
 }
 
+func TestReadFilteredTail(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	var stderr bytes.Buffer
+	rec, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec.Record(Event{Type: BeadCreated, Actor: "human"}) // seq 1
+	rec.Record(Event{Type: BeadClosed, Actor: "human"})  // seq 2
+	rec.Record(Event{Type: BeadCreated, Actor: "human"}) // seq 3
+	rec.Record(Event{Type: BeadClosed, Actor: "human"})  // seq 4
+	rec.Record(Event{Type: BeadCreated, Actor: "human"}) // seq 5
+	rec.Close()                                          //nolint:errcheck // test cleanup
+
+	got, err := ReadFilteredTail(path, Filter{Type: BeadCreated}, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d events, want 2", len(got))
+	}
+	if got[0].Seq != 3 || got[1].Seq != 5 {
+		t.Fatalf("tail seqs = [%d %d], want [3 5]", got[0].Seq, got[1].Seq)
+	}
+}
+
+func TestReadFilteredTailScansBackwardsAcrossChunks(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	base := time.Date(2026, 5, 2, 12, 0, 0, 0, time.UTC)
+	var buf bytes.Buffer
+	appendEvent := func(e Event, ending string) {
+		t.Helper()
+		raw, err := json.Marshal(e)
+		if err != nil {
+			t.Fatal(err)
+		}
+		buf.Write(raw)
+		buf.WriteString(ending)
+	}
+
+	appendEvent(Event{Seq: 1, Type: SessionWoke, Actor: "api", Subject: "too-low-seq", Ts: base.Add(9 * time.Second)}, "\n")
+	appendEvent(Event{
+		Seq:     2,
+		Type:    SessionWoke,
+		Actor:   "api",
+		Subject: "cross-chunk",
+		Ts:      base.Add(10 * time.Second),
+		Message: string(bytes.Repeat([]byte("x"), 70*1024)),
+	}, "\n")
+	appendEvent(Event{Seq: 3, Type: SessionStopped, Actor: "api", Subject: "wrong-type", Ts: base.Add(11 * time.Second)}, "\n")
+	appendEvent(Event{Seq: 4, Type: SessionWoke, Actor: "worker", Subject: "wrong-actor", Ts: base.Add(12 * time.Second)}, "\n")
+	appendEvent(Event{Seq: 5, Type: SessionWoke, Actor: "api", Subject: "too-old", Ts: base.Add(-time.Second)}, "\n")
+	buf.WriteString("\nnot-json\n")
+	appendEvent(Event{Seq: 6, Type: SessionWoke, Actor: "api", Subject: "tail-match", Ts: base.Add(20 * time.Second)}, "\r\n")
+
+	if err := os.WriteFile(path, buf.Bytes(), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ReadFilteredTail(path, Filter{
+		AfterSeq: 1,
+		Type:     SessionWoke,
+		Actor:    "api",
+		Since:    base,
+	}, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d events, want 2: %+v", len(got), got)
+	}
+	if got[0].Subject != "cross-chunk" || got[1].Subject != "tail-match" {
+		t.Fatalf("subjects = [%s %s], want [cross-chunk tail-match]", got[0].Subject, got[1].Subject)
+	}
+}
+
+func TestReadFilteredTailLimitModesAndMissingFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	var stderr bytes.Buffer
+	rec, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec.Record(Event{Type: BeadCreated, Actor: "human", Subject: "created"})
+	rec.Record(Event{Type: BeadClosed, Actor: "human", Subject: "closed"})
+	rec.Close() //nolint:errcheck // test cleanup
+
+	got, err := ReadFilteredTail(path, Filter{Actor: "human"}, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("limit=0 got %d events, want 2", len(got))
+	}
+
+	missing, err := ReadFilteredTail(filepath.Join(dir, "missing.jsonl"), Filter{}, 1)
+	if err != nil {
+		t.Fatalf("missing file error: %v", err)
+	}
+	if missing != nil {
+		t.Fatalf("missing file got %+v, want nil", missing)
+	}
+}
+
 func TestReadLatestSeq(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "events.jsonl")
@@ -599,6 +852,40 @@ func TestReadLatestSeqEmpty(t *testing.T) {
 	}
 }
 
+func TestReadLatestSeqUsesTailOfAppendOnlyLog(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	hugeMalformed := append(bytes.Repeat([]byte("x"), 2*1024*1024), '\n')
+	validTail := []byte(`{"seq":42,"type":"bead.updated","ts":"2026-01-01T00:00:00Z","actor":"test"}` + "\n")
+	if err := os.WriteFile(path, append(hugeMalformed, validTail...), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	seq, err := ReadLatestSeq(path)
+	if err != nil {
+		t.Fatalf("ReadLatestSeq: %v", err)
+	}
+	if seq != 42 {
+		t.Fatalf("ReadLatestSeq = %d, want 42", seq)
+	}
+
+	var stderr bytes.Buffer
+	rec, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatalf("NewFileRecorder: %v", err)
+	}
+	rec.Record(Event{Type: BeadClosed, Actor: "test"})
+	rec.Close() //nolint:errcheck // test cleanup
+
+	seq, err = ReadLatestSeq(path)
+	if err != nil {
+		t.Fatalf("ReadLatestSeq(after record): %v", err)
+	}
+	if seq != 43 {
+		t.Fatalf("ReadLatestSeq(after record) = %d, want 43", seq)
+	}
+}
+
 func TestReadFrom(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "events.jsonl")
@@ -628,7 +915,7 @@ func TestReadFrom(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	rec2.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "mayor"})
+	rec2.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "session-alpha"})
 	rec2.Close() //nolint:errcheck // test cleanup
 
 	// Read from mid-file offset → only new event
@@ -704,7 +991,7 @@ func TestFileRecorderList(t *testing.T) {
 
 	rec.Record(Event{Type: BeadCreated, Actor: "human", Subject: "gc-1"})
 	rec.Record(Event{Type: BeadClosed, Actor: "human", Subject: "gc-1"})
-	rec.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "mayor"})
+	rec.Record(Event{Type: SessionWoke, Actor: "gc", Subject: "session-alpha"})
 
 	// List all
 	all, err := rec.List(Filter{})
@@ -728,6 +1015,32 @@ func TestFileRecorderList(t *testing.T) {
 	}
 }
 
+func TestFileRecorderListTail(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	var stderr bytes.Buffer
+	rec, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rec.Close() //nolint:errcheck // test cleanup
+
+	rec.Record(Event{Type: BeadCreated, Actor: "human", Subject: "old"})
+	rec.Record(Event{Type: BeadClosed, Actor: "human", Subject: "ignored"})
+	rec.Record(Event{Type: BeadCreated, Actor: "human", Subject: "new"})
+
+	got, err := rec.ListTail(Filter{Type: BeadCreated}, 1)
+	if err != nil {
+		t.Fatalf("ListTail: %v", err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("ListTail got %d events, want 1", len(got))
+	}
+	if got[0].Subject != "new" {
+		t.Fatalf("subject = %q, want new", got[0].Subject)
+	}
+}
+
 func TestFileRecorderLatestSeq(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "events.jsonl")
@@ -803,6 +1116,59 @@ func TestFileRecorderWatch(t *testing.T) {
 	}
 }
 
+func TestFileRecorderWatchAfterLatestStartsAtEOF(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "events.jsonl")
+	var stderr bytes.Buffer
+	rec, err := NewFileRecorder(path, &stderr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rec.Close() //nolint:errcheck // test cleanup
+
+	rec.Record(Event{Type: BeadCreated, Actor: "human", Subject: "gc-1"})
+	rec.Record(Event{Type: BeadUpdated, Actor: "human", Subject: "gc-1"})
+	seq, err := rec.LatestSeq()
+	if err != nil {
+		t.Fatalf("LatestSeq: %v", err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	w, err := rec.Watch(ctx, seq)
+	if err != nil {
+		t.Fatalf("Watch: %v", err)
+	}
+	defer w.Close() //nolint:errcheck // test cleanup
+
+	fw, ok := w.(*fileWatcher)
+	if !ok {
+		t.Fatalf("Watch returned %T, want *fileWatcher", w)
+	}
+	if fw.offset != info.Size() {
+		t.Fatalf("watch offset = %d, want EOF %d", fw.offset, info.Size())
+	}
+
+	go func() {
+		time.Sleep(50 * time.Millisecond)
+		rec.Record(Event{Type: BeadClosed, Actor: "human", Subject: "gc-1"})
+	}()
+	e, err := w.Next()
+	if err != nil {
+		t.Fatalf("Next: %v", err)
+	}
+	if e.Seq != seq+1 {
+		t.Fatalf("Seq = %d, want %d", e.Seq, seq+1)
+	}
+	if e.Type != BeadClosed {
+		t.Fatalf("Type = %q, want %q", e.Type, BeadClosed)
+	}
+}
+
 func TestFileRecorderWatchContextCancel(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "events.jsonl")
diff --git a/internal/events/eventstest/conformance.go b/internal/events/eventstest/conformance.go
index 5efb386721..9fd909169f 100644
--- a/internal/events/eventstest/conformance.go
+++ b/internal/events/eventstest/conformance.go
@@ -282,13 +282,91 @@ func RunProviderTests(t *testing.T, newProvider func(t *testing.T) (events.Provi
 		}
 	})
 
+	t.Run("ListFilterBySubject", func(t *testing.T) {
+		p, cleanup := newProvider(t)
+		defer cleanup()
+
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "actor-a", Subject: "gc-1"})
+		p.Record(events.Event{Type: events.BeadClosed, Actor: "actor-a", Subject: "gc-2"})
+		p.Record(events.Event{Type: events.BeadUpdated, Actor: "actor-b", Subject: "gc-1"})
+
+		got, err := p.List(events.Filter{Subject: "gc-1"})
+		if err != nil {
+			t.Fatalf("List: %v", err)
+		}
+		if len(got) != 2 {
+			t.Fatalf("List(Subject) returned %d events, want 2", len(got))
+		}
+		for _, e := range got {
+			if e.Subject != "gc-1" {
+				t.Errorf("Subject = %q, want gc-1", e.Subject)
+			}
+		}
+	})
+
+	t.Run("ListFilterByUntil", func(t *testing.T) {
+		p, cleanup := newProvider(t)
+		defer cleanup()
+
+		cutoff := time.Date(2025, 6, 15, 12, 0, 0, 0, time.UTC)
+		before := cutoff.Add(-time.Minute)
+		after := cutoff.Add(time.Minute)
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "actor-a", Subject: "before", Ts: before})
+		p.Record(events.Event{Type: events.BeadUpdated, Actor: "actor-a", Subject: "boundary", Ts: cutoff})
+		p.Record(events.Event{Type: events.BeadClosed, Actor: "actor-a", Subject: "after", Ts: after})
+
+		got, err := p.List(events.Filter{Until: cutoff})
+		if err != nil {
+			t.Fatalf("List: %v", err)
+		}
+		if len(got) != 2 {
+			t.Fatalf("List(Until) returned %d events, want 2", len(got))
+		}
+		if got[0].Subject != "before" {
+			t.Errorf("got[0].Subject = %q, want before", got[0].Subject)
+		}
+		if got[1].Subject != "boundary" {
+			t.Errorf("got[1].Subject = %q, want boundary", got[1].Subject)
+		}
+	})
+
+	t.Run("ListFilterByLimit", func(t *testing.T) {
+		p, cleanup := newProvider(t)
+		defer cleanup()
+
+		for _, subject := range []string{"gc-1", "gc-2", "gc-3", "gc-4"} {
+			p.Record(events.Event{Type: events.BeadCreated, Actor: "actor-a", Subject: subject})
+		}
+
+		got, err := p.List(events.Filter{Limit: 2})
+		if err != nil {
+			t.Fatalf("List: %v", err)
+		}
+		if len(got) != 2 {
+			t.Fatalf("List(Limit) returned %d events, want 2", len(got))
+		}
+		if got[0].Subject != "gc-1" {
+			t.Errorf("got[0].Subject = %q, want gc-1", got[0].Subject)
+		}
+		if got[1].Subject != "gc-2" {
+			t.Errorf("got[1].Subject = %q, want gc-2", got[1].Subject)
+		}
+	})
+
 	t.Run("ListFilterCombined", func(t *testing.T) {
 		p, cleanup := newProvider(t)
 		defer cleanup()
 
-		p.Record(events.Event{Type: events.BeadCreated, Actor: "human"}) // seq 1
-		p.Record(events.Event{Type: events.BeadClosed, Actor: "human"})  // seq 2
-		p.Record(events.Event{Type: events.BeadCreated, Actor: "human"}) // seq 3
+		base := time.Date(2025, 6, 15, 12, 0, 0, 0, time.UTC)
+		p.Record(events.Event{Type: events.MailSent, Actor: "seed", Subject: "seed", Ts: base})                           // seq 1
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "human", Subject: "gc-1", Ts: base.Add(2 * time.Hour)})    // after Until
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "human", Subject: "gc-1", Ts: base.Add(-2 * time.Hour)})   // before Since
+		p.Record(events.Event{Type: events.BeadClosed, Actor: "human", Subject: "gc-1", Ts: base.Add(10 * time.Minute)})  // wrong Type
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "agent", Subject: "gc-1", Ts: base.Add(20 * time.Minute)}) // wrong Actor
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "human", Subject: "gc-2", Ts: base.Add(30 * time.Minute)}) // wrong Subject
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "human", Subject: "gc-1", Ts: base.Add(40 * time.Minute)}) // match 1
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "human", Subject: "gc-1", Ts: base.Add(50 * time.Minute)}) // match 2
+		p.Record(events.Event{Type: events.BeadCreated, Actor: "human", Subject: "gc-1", Ts: base.Add(55 * time.Minute)}) // limited out
 
 		// Get all to find seq of first event.
 		all, err := p.List(events.Filter{})
@@ -299,16 +377,28 @@ func RunProviderTests(t *testing.T, newProvider func(t *testing.T) (events.Provi
 			t.Fatal("need at least 1 event")
 		}
 
-		// Type + AfterSeq combined: bead.created with seq > first event.
-		got, err := p.List(events.Filter{Type: events.BeadCreated, AfterSeq: all[0].Seq})
+		got, err := p.List(events.Filter{
+			Type:     events.BeadCreated,
+			Actor:    "human",
+			Subject:  "gc-1",
+			Since:    base.Add(-time.Hour),
+			Until:    base.Add(time.Hour),
+			AfterSeq: all[0].Seq,
+			Limit:    2,
+		})
 		if err != nil {
 			t.Fatalf("List(combined): %v", err)
 		}
-		if len(got) != 1 {
-			t.Fatalf("List(Type+AfterSeq) returned %d events, want 1", len(got))
+		if len(got) != 2 {
+			t.Fatalf("List(all predicates) returned %d events, want 2", len(got))
 		}
-		if got[0].Type != events.BeadCreated {
-			t.Errorf("Type = %q, want %q", got[0].Type, events.BeadCreated)
+		for _, e := range got {
+			if e.Type != events.BeadCreated || e.Actor != "human" || e.Subject != "gc-1" {
+				t.Fatalf("event = %+v, want bead.created by human for gc-1", e)
+			}
+			if e.Ts.Before(base.Add(-time.Hour)) || e.Ts.After(base.Add(time.Hour)) {
+				t.Fatalf("event Ts = %s, want within combined window", e.Ts)
+			}
 		}
 	})
 
diff --git a/internal/events/exec/exec.go b/internal/events/exec/exec.go
index f196d2b4e4..6fd41bca6c 100644
--- a/internal/events/exec/exec.go
+++ b/internal/events/exec/exec.go
@@ -32,6 +32,13 @@ type Provider struct {
 	stderr  io.Writer
 }
 
+type listScriptFilter struct {
+	Type     string
+	Actor    string
+	Since    time.Time
+	AfterSeq uint64
+}
+
 // NewProvider returns an exec events provider that delegates to the given script.
 // Errors from best-effort operations (Record) are logged to stderr.
 func NewProvider(script string, stderr io.Writer) *Provider {
@@ -56,10 +63,17 @@ func (p *Provider) Record(e events.Event) {
 	}
 }
 
-// List delegates to: script list with JSON filter on stdin.
+// List delegates to: script list with JSON filter on stdin, then applies the
+// SDK filter locally so optional script filtering cannot weaken the contract.
 func (p *Provider) List(filter events.Filter) ([]events.Event, error) {
 	p.ensureRunning()
-	data, err := json.Marshal(filter)
+	scriptFilter := listScriptFilter{
+		Type:     filter.Type,
+		Actor:    filter.Actor,
+		Since:    filter.Since,
+		AfterSeq: filter.AfterSeq,
+	}
+	data, err := json.Marshal(scriptFilter)
 	if err != nil {
 		return nil, fmt.Errorf("exec events provider: marshal filter: %w", err)
 	}
@@ -70,7 +84,11 @@ func (p *Provider) List(filter events.Filter) ([]events.Event, error) {
 	if out == "" {
 		return nil, nil
 	}
-	return unmarshalEvents(out)
+	evts, err := unmarshalEvents(out)
+	if err != nil {
+		return nil, err
+	}
+	return events.ApplyFilter(evts, filter), nil
 }
 
 // LatestSeq delegates to: script latest-seq
diff --git a/internal/events/exec/exec_test.go b/internal/events/exec/exec_test.go
index 3d185af2fd..1afc3dc3cb 100644
--- a/internal/events/exec/exec_test.go
+++ b/internal/events/exec/exec_test.go
@@ -161,6 +161,105 @@ esac
 	}
 }
 
+func TestListAppliesSDKFilterAndStripsScriptLimit(t *testing.T) {
+	dir := t.TempDir()
+	outFile := filepath.Join(dir, "stdin.json")
+	script := writeScript(t, dir, `
+case "$1" in
+  ensure-running) exit 2 ;;
+  list) cat > "`+outFile+`"
+    echo '[{"seq":1,"type":"bead.created","ts":"2025-06-15T10:30:00Z","actor":"actor-a","subject":"gc-1"},{"seq":2,"type":"bead.created","ts":"2025-06-15T10:31:00Z","actor":"actor-a","subject":"gc-1"},{"seq":3,"type":"bead.created","ts":"2025-06-15T10:32:00Z","actor":"actor-a","subject":"gc-2"}]'
+    ;;
+  *) exit 2 ;;
+esac
+`)
+	p := NewProvider(script, os.Stderr)
+	until := time.Date(2025, 6, 15, 10, 31, 0, 0, time.UTC)
+
+	evts, err := p.List(events.Filter{Subject: "gc-1", Until: until, Limit: 1})
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(evts) != 1 {
+		t.Fatalf("List returned %d events, want 1", len(evts))
+	}
+	if evts[0].Seq != 1 {
+		t.Errorf("Seq = %d, want 1", evts[0].Seq)
+	}
+
+	data, err := os.ReadFile(outFile)
+	if err != nil {
+		t.Fatalf("read filter: %v", err)
+	}
+	var f events.Filter
+	if err := json.Unmarshal(data, &f); err != nil {
+		t.Fatalf("unmarshal filter: %v", err)
+	}
+	if f.Subject != "" {
+		t.Errorf("script filter Subject = %q, want empty legacy value", f.Subject)
+	}
+	if !f.Until.IsZero() {
+		t.Errorf("script filter Until = %v, want zero legacy value", f.Until)
+	}
+	if f.Limit != 0 {
+		t.Errorf("script filter Limit = %d, want 0", f.Limit)
+	}
+}
+
+func TestListUsesLegacyScriptFilterShape(t *testing.T) {
+	dir := t.TempDir()
+	script := writeScript(t, dir, `
+case "$1" in
+  ensure-running) exit 2 ;;
+  list)
+    input="$(cat)"
+    case "$input" in
+      *'"Subject"'*|*'"Until"'*|*'"Limit"'*)
+        echo "unknown filter key in $input" >&2
+        exit 1
+        ;;
+    esac
+    echo '[{"seq":1,"type":"bead.created","ts":"2025-06-15T10:30:00Z","actor":"actor-a","subject":"gc-1"},{"seq":2,"type":"bead.created","ts":"2025-06-15T10:31:00Z","actor":"actor-a","subject":"gc-2"}]'
+    ;;
+  *) exit 2 ;;
+esac
+`)
+	p := NewProvider(script, os.Stderr)
+
+	evts, err := p.List(events.Filter{Subject: "gc-1", Limit: 1})
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(evts) != 1 {
+		t.Fatalf("List returned %d events, want 1", len(evts))
+	}
+	if evts[0].Subject != "gc-1" {
+		t.Fatalf("List returned subject %q, want gc-1", evts[0].Subject)
+	}
+}
+
+func TestListInvalidJSON(t *testing.T) {
+	dir := t.TempDir()
+	script := writeScript(t, dir, `
+case "$1" in
+  ensure-running) exit 2 ;;
+  list) cat > /dev/null
+    echo 'not-json'
+    ;;
+  *) exit 2 ;;
+esac
+`)
+	p := NewProvider(script, os.Stderr)
+
+	_, err := p.List(events.Filter{})
+	if err == nil {
+		t.Fatal("List returned nil error, want unmarshal error")
+	}
+	if !strings.Contains(err.Error(), "unmarshal events") {
+		t.Fatalf("List error = %q, want unmarshal context", err.Error())
+	}
+}
+
 func TestLatestSeq(t *testing.T) {
 	dir := t.TempDir()
 	script := writeScript(t, dir, allOpsScript())
diff --git a/internal/events/fake.go b/internal/events/fake.go
index b73e8ca679..4eae3e9790 100644
--- a/internal/events/fake.go
+++ b/internal/events/fake.go
@@ -54,23 +54,36 @@ func (f *Fake) List(filter Filter) ([]Event, error) {
 	if f.broken {
 		return nil, fmt.Errorf("events provider unavailable")
 	}
-	var result []Event
-	for _, e := range f.Events {
-		if filter.AfterSeq > 0 && e.Seq <= filter.AfterSeq {
-			continue
-		}
-		if filter.Type != "" && e.Type != filter.Type {
-			continue
-		}
-		if filter.Actor != "" && e.Actor != filter.Actor {
-			continue
+	return ApplyFilter(f.Events, filter), nil
+}
+
+// ListTail returns the trailing matching events from the in-memory store.
+func (f *Fake) ListTail(filter Filter, limit int) ([]Event, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.broken {
+		return nil, fmt.Errorf("events provider unavailable")
+	}
+	if limit <= 0 {
+		var result []Event
+		for _, e := range f.Events {
+			if matchesFilter(e, filter) {
+				result = append(result, e)
+			}
 		}
-		if !filter.Since.IsZero() && e.Ts.Before(filter.Since) {
-			continue
+		return result, nil
+	}
+	reversed := make([]Event, 0, limit)
+	for i := len(f.Events) - 1; i >= 0 && len(reversed) < limit; i-- {
+		e := f.Events[i]
+		if matchesFilter(e, filter) {
+			reversed = append(reversed, e)
 		}
-		result = append(result, e)
 	}
-	return result, nil
+	for i, j := 0, len(reversed)-1; i < j; i, j = i+1, j-1 {
+		reversed[i], reversed[j] = reversed[j], reversed[i]
+	}
+	return reversed, nil
 }
 
 // LatestSeq returns the highest sequence number, or 0 if empty.
diff --git a/internal/events/multiplexer.go b/internal/events/multiplexer.go
index 4b2e35f061..d446d12699 100644
--- a/internal/events/multiplexer.go
+++ b/internal/events/multiplexer.go
@@ -72,12 +72,16 @@ func (m *Multiplexer) snapshot() map[string]Provider {
 }
 
 // ListAll returns events from all cities matching the filter, sorted by
-// timestamp. Each event is tagged with its source city.
+// timestamp, city, and sequence. Each event is tagged with its source city.
+// A positive filter Limit returns the earliest matching events after that
+// global sort; callers needing the latest matching events should use ListTail.
 func (m *Multiplexer) ListAll(filter Filter) ([]TaggedEvent, error) {
 	providers := m.snapshot()
+	providerFilter := filter
+	providerFilter.Limit = 0
 	var all []TaggedEvent
 	for city, p := range providers {
-		evts, err := p.List(filter)
+		evts, err := p.List(providerFilter)
 		if err != nil {
 			continue // best-effort: skip cities with errors
 		}
@@ -86,11 +90,81 @@ func (m *Multiplexer) ListAll(filter Filter) ([]TaggedEvent, error) {
 		}
 	}
 	sort.Slice(all, func(i, j int) bool {
-		return all[i].Ts.Before(all[j].Ts)
+		return taggedEventLess(all[i], all[j])
 	})
+	if filter.Limit > 0 && len(all) > filter.Limit {
+		all = all[:filter.Limit]
+	}
+	return all, nil
+}
+
+// ListTail returns the trailing matching events across all cities. It asks
+// tail-capable providers for only their local tail, then trims the merged
+// result to the requested global limit.
+func (m *Multiplexer) ListTail(filter Filter, limit int) ([]TaggedEvent, error) {
+	if limit <= 0 {
+		return m.ListAll(filter)
+	}
+	providers := m.snapshot()
+	providerFilter := filter
+	providerFilter.Limit = 0
+	var all []TaggedEvent
+	for city, p := range providers {
+		var evts []Event
+		var err error
+		if tail, ok := p.(TailProvider); ok {
+			evts, err = tail.ListTail(providerFilter, limit)
+		} else {
+			evts, err = p.List(providerFilter)
+			if limit < len(evts) {
+				evts = evts[len(evts)-limit:]
+			}
+		}
+		if err != nil {
+			log.Printf("events: list tail failed for city %q: %v", city, err)
+			continue // best-effort: skip cities with errors
+		}
+		for _, e := range evts {
+			all = append(all, TaggedEvent{Event: e, City: city})
+		}
+	}
+	sort.Slice(all, func(i, j int) bool {
+		return taggedEventLess(all[i], all[j])
+	})
+	if limit < len(all) {
+		all = all[len(all)-limit:]
+	}
 	return all, nil
 }
 
+func taggedEventLess(left, right TaggedEvent) bool {
+	if !left.Ts.Equal(right.Ts) {
+		return left.Ts.Before(right.Ts)
+	}
+	if left.City != right.City {
+		return left.City < right.City
+	}
+	return left.Seq < right.Seq
+}
+
+// LatestCursor returns the current highest sequence number for each provider.
+// Providers that fail are skipped, matching ListAll's best-effort aggregation.
+func (m *Multiplexer) LatestCursor() (map[string]uint64, error) {
+	providers := m.snapshot()
+	cursors := make(map[string]uint64, len(providers))
+	var errs []error
+	for city, p := range providers {
+		seq, err := p.LatestSeq()
+		if err != nil {
+			log.Printf("events: latest cursor failed for city %q: %v", city, err)
+			errs = append(errs, fmt.Errorf("%s: %w", city, err))
+			continue
+		}
+		cursors[city] = seq
+	}
+	return cursors, errors.Join(errs...)
+}
+
 // Watch returns a Watcher that merges events from all currently registered
 // city providers. Events are yielded in approximate time order. The cursor
 // is a map of city→seq positions (use ParseCursor/FormatCursor to persist).
diff --git a/internal/events/multiplexer_test.go b/internal/events/multiplexer_test.go
index 2ed5ea2214..569f6e35be 100644
--- a/internal/events/multiplexer_test.go
+++ b/internal/events/multiplexer_test.go
@@ -53,6 +53,241 @@ func TestMultiplexerListAllWithFilter(t *testing.T) {
 	}
 }
 
+func TestMultiplexerListAllAppliesGlobalLimitAfterMerge(t *testing.T) {
+	m := NewMultiplexer()
+
+	f1 := NewFake()
+	f1.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "first", Ts: time.Unix(1, 0)})
+	f1.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "fourth", Ts: time.Unix(4, 0)})
+
+	f2 := NewFake()
+	f2.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "second", Ts: time.Unix(2, 0)})
+	f2.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "third", Ts: time.Unix(3, 0)})
+
+	m.Add("city-a", f1)
+	m.Add("city-b", f2)
+
+	evts, err := m.ListAll(Filter{Limit: 2})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 2 {
+		t.Fatalf("got %d events, want 2", len(evts))
+	}
+	if evts[0].Subject != "first" {
+		t.Errorf("evts[0].Subject = %q, want first", evts[0].Subject)
+	}
+	if evts[1].Subject != "second" {
+		t.Errorf("evts[1].Subject = %q, want second", evts[1].Subject)
+	}
+}
+
+func TestMultiplexerListAllOrdersEqualTimestampsDeterministically(t *testing.T) {
+	m := NewMultiplexer()
+	ts := time.Unix(1, 0)
+
+	alpha := NewFake()
+	alpha.Events = []Event{
+		{Seq: 5, Type: SessionWoke, Subject: "alpha", Ts: ts},
+	}
+
+	beta := NewFake()
+	beta.Events = []Event{
+		{Seq: 2, Type: SessionWoke, Subject: "beta-two", Ts: ts},
+		{Seq: 1, Type: SessionWoke, Subject: "beta-one", Ts: ts},
+	}
+
+	m.Add("beta", beta)
+	m.Add("alpha", alpha)
+
+	evts, err := m.ListAll(Filter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 3 {
+		t.Fatalf("got %d events, want 3", len(evts))
+	}
+	got := []string{
+		evts[0].City + ":" + evts[0].Subject,
+		evts[1].City + ":" + evts[1].Subject,
+		evts[2].City + ":" + evts[2].Subject,
+	}
+	want := []string{"alpha:alpha", "beta:beta-one", "beta:beta-two"}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("events = %v, want %v", got, want)
+		}
+	}
+}
+
+func TestMultiplexerListTailLimitsAcrossCities(t *testing.T) {
+	m := NewMultiplexer()
+
+	f1 := NewFake()
+	f1.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "old-a", Ts: time.Unix(1, 0)})
+	f1.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "new-a", Ts: time.Unix(3, 0)})
+
+	f2 := NewFake()
+	f2.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "old-b", Ts: time.Unix(2, 0)})
+	f2.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "new-b", Ts: time.Unix(4, 0)})
+
+	m.Add("city-a", f1)
+	m.Add("city-b", f2)
+
+	evts, err := m.ListTail(Filter{}, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 2 {
+		t.Fatalf("got %d events, want 2", len(evts))
+	}
+	if evts[0].Subject != "new-a" || evts[1].Subject != "new-b" {
+		t.Fatalf("subjects = [%s %s], want [new-a new-b]", evts[0].Subject, evts[1].Subject)
+	}
+}
+
+func TestMultiplexerListTailOrdersEqualTimestampsDeterministically(t *testing.T) {
+	m := NewMultiplexer()
+	ts := time.Unix(1, 0)
+
+	alpha := NewFake()
+	alpha.Events = []Event{
+		{Seq: 5, Type: SessionWoke, Subject: "alpha", Ts: ts},
+	}
+
+	beta := NewFake()
+	beta.Events = []Event{
+		{Seq: 2, Type: SessionWoke, Subject: "beta-two", Ts: ts},
+		{Seq: 1, Type: SessionWoke, Subject: "beta-one", Ts: ts},
+	}
+
+	m.Add("beta", beta)
+	m.Add("alpha", alpha)
+
+	evts, err := m.ListTail(Filter{}, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 2 {
+		t.Fatalf("got %d events, want 2", len(evts))
+	}
+	got := []string{
+		evts[0].City + ":" + evts[0].Subject,
+		evts[1].City + ":" + evts[1].Subject,
+	}
+	want := []string{"beta:beta-one", "beta:beta-two"}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("events = %v, want %v", got, want)
+		}
+	}
+}
+
+func TestMultiplexerListTailUsesFallbackAndSkipsErrors(t *testing.T) {
+	m := NewMultiplexer()
+
+	listOnly := NewFake()
+	listOnly.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "list-old", Ts: time.Unix(1, 0)})
+	listOnly.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "list-middle", Ts: time.Unix(4, 0)})
+	listOnly.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "list-new", Ts: time.Unix(6, 0)})
+
+	tailCapable := NewFake()
+	tailCapable.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "tail-old", Ts: time.Unix(2, 0)})
+	tailCapable.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "tail-middle", Ts: time.Unix(3, 0)})
+	tailCapable.Record(Event{Type: SessionWoke, Actor: "b1", Subject: "tail-new", Ts: time.Unix(5, 0)})
+
+	m.Add("list-only", &providerWithoutTail{fake: listOnly})
+	m.Add("tail-capable", tailCapable)
+	m.Add("broken", NewFailFake())
+
+	evts, err := m.ListTail(Filter{Type: SessionWoke}, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 3 {
+		t.Fatalf("got %d events, want 3", len(evts))
+	}
+	got := []string{evts[0].Subject, evts[1].Subject, evts[2].Subject}
+	want := []string{"list-middle", "tail-new", "list-new"}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("subjects = %v, want %v", got, want)
+		}
+	}
+}
+
+func TestMultiplexerListTailIgnoresFilterLimitForListOnlyProviders(t *testing.T) {
+	m := NewMultiplexer()
+
+	listOnly := NewFake()
+	listOnly.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "old", Ts: time.Unix(1, 0)})
+	listOnly.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "middle", Ts: time.Unix(2, 0)})
+	listOnly.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "new", Ts: time.Unix(3, 0)})
+	m.Add("list-only", &providerWithoutTail{fake: listOnly})
+
+	evts, err := m.ListTail(Filter{Type: SessionWoke, Limit: 1}, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 2 {
+		t.Fatalf("got %d events, want 2", len(evts))
+	}
+	got := []string{evts[0].Subject, evts[1].Subject}
+	want := []string{"middle", "new"}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("subjects = %v, want %v", got, want)
+		}
+	}
+}
+
+func TestMultiplexerListTailLimitZeroDelegatesToListAll(t *testing.T) {
+	m := NewMultiplexer()
+	f := NewFake()
+	f.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "old", Ts: time.Unix(1, 0)})
+	f.Record(Event{Type: SessionStopped, Actor: "a1", Subject: "ignored", Ts: time.Unix(2, 0)})
+	f.Record(Event{Type: SessionWoke, Actor: "a1", Subject: "new", Ts: time.Unix(3, 0)})
+	m.Add("city-a", f)
+
+	evts, err := m.ListTail(Filter{Type: SessionWoke}, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(evts) != 2 {
+		t.Fatalf("got %d events, want 2", len(evts))
+	}
+	if evts[0].Subject != "old" || evts[1].Subject != "new" {
+		t.Fatalf("subjects = [%s %s], want [old new]", evts[0].Subject, evts[1].Subject)
+	}
+}
+
+func TestMultiplexerLatestCursorSkipsBrokenProviders(t *testing.T) {
+	m := NewMultiplexer()
+	alpha := NewFake()
+	alpha.Record(Event{Type: SessionWoke, Actor: "a1"})
+	alpha.Record(Event{Type: SessionWoke, Actor: "a1"})
+	beta := NewFake()
+	beta.Record(Event{Type: SessionWoke, Actor: "b1"})
+
+	m.Add("alpha", alpha)
+	m.Add("beta", beta)
+	m.Add("broken", NewFailFake())
+
+	cursors, err := m.LatestCursor()
+	if err == nil {
+		t.Fatal("LatestCursor() error = nil, want broken provider error")
+	}
+	if len(cursors) != 2 {
+		t.Fatalf("cursor count = %d, want 2: %v", len(cursors), cursors)
+	}
+	if cursors["alpha"] != 2 || cursors["beta"] != 1 {
+		t.Fatalf("cursors = %v, want alpha:2 beta:1", cursors)
+	}
+	if _, ok := cursors["broken"]; ok {
+		t.Fatalf("broken provider included in cursor map: %v", cursors)
+	}
+}
+
 func TestMultiplexerWatch(t *testing.T) {
 	m := NewMultiplexer()
 
@@ -180,14 +415,14 @@ func TestWrapForSSE(t *testing.T) {
 	w := WrapForSSE(mw)
 	defer w.Close() //nolint:errcheck
 
-	f1.Record(Event{Type: SessionWoke, Actor: "mayor"})
+	f1.Record(Event{Type: SessionWoke, Actor: "actor-a"})
 
 	e, err := w.Next()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if e.Actor != "city-a/mayor" {
-		t.Errorf("Actor = %q, want %q", e.Actor, "city-a/mayor")
+	if e.Actor != "city-a/actor-a" {
+		t.Errorf("Actor = %q, want %q", e.Actor, "city-a/actor-a")
 	}
 }
 
@@ -210,3 +445,27 @@ func TestMultiplexerSkipsBrokenProvider(t *testing.T) {
 		t.Fatalf("got %d events, want 1", len(evts))
 	}
 }
+
+type providerWithoutTail struct {
+	fake *Fake
+}
+
+func (p *providerWithoutTail) Record(e Event) {
+	p.fake.Record(e)
+}
+
+func (p *providerWithoutTail) List(filter Filter) ([]Event, error) {
+	return p.fake.List(filter)
+}
+
+func (p *providerWithoutTail) LatestSeq() (uint64, error) {
+	return p.fake.LatestSeq()
+}
+
+func (p *providerWithoutTail) Watch(ctx context.Context, afterSeq uint64) (Watcher, error) {
+	return p.fake.Watch(ctx, afterSeq)
+}
+
+func (p *providerWithoutTail) Close() error {
+	return p.fake.Close()
+}
diff --git a/internal/events/query.go b/internal/events/query.go
new file mode 100644
index 0000000000..3ae76d103f
--- /dev/null
+++ b/internal/events/query.go
@@ -0,0 +1,29 @@
+package events
+
+// CountByType returns a map of event type → count for the given events.
+func CountByType(evts []Event) map[string]int {
+	counts := make(map[string]int, len(evts))
+	for _, e := range evts {
+		counts[e.Type]++
+	}
+	return counts
+}
+
+// CountByActor returns a map of actor → count for the given events.
+func CountByActor(evts []Event) map[string]int {
+	counts := make(map[string]int, len(evts))
+	for _, e := range evts {
+		counts[e.Actor]++
+	}
+	return counts
+}
+
+// CountBySubject returns a map of subject → count for the given events.
+// Events with an empty Subject are counted under the empty-string key.
+func CountBySubject(evts []Event) map[string]int {
+	counts := make(map[string]int, len(evts))
+	for _, e := range evts {
+		counts[e.Subject]++
+	}
+	return counts
+}
diff --git a/internal/events/query_test.go b/internal/events/query_test.go
new file mode 100644
index 0000000000..559d727550
--- /dev/null
+++ b/internal/events/query_test.go
@@ -0,0 +1,166 @@
+package events
+
+import (
+	"testing"
+	"time"
+)
+
+// --- matchesFilter unit tests ---
+
+func TestMatchesFilter_Subject(t *testing.T) {
+	e := Event{Type: BeadCreated, Actor: "actor-a", Subject: "gc-42"}
+
+	if !matchesFilter(e, Filter{Subject: "gc-42"}) {
+		t.Error("expected match on Subject gc-42")
+	}
+	if matchesFilter(e, Filter{Subject: "gc-99"}) {
+		t.Error("expected no match on Subject gc-99")
+	}
+	if !matchesFilter(e, Filter{}) {
+		t.Error("empty filter should match everything")
+	}
+}
+
+func TestMatchesFilter_Until(t *testing.T) {
+	now := time.Now()
+	e := Event{Type: BeadCreated, Ts: now}
+
+	if !matchesFilter(e, Filter{Until: now.Add(time.Second)}) {
+		t.Error("event before Until should match")
+	}
+	if !matchesFilter(e, Filter{Until: now}) {
+		t.Error("event exactly at Until should match (not After)")
+	}
+	if matchesFilter(e, Filter{Until: now.Add(-time.Second)}) {
+		t.Error("event after Until should not match")
+	}
+}
+
+func TestFakeList_Limit(t *testing.T) {
+	// Create a fake with 5 events and request only 3.
+	f := NewFake()
+	for i := 0; i < 5; i++ {
+		f.Record(Event{Type: BeadCreated, Actor: "actor-a"})
+	}
+
+	got, err := f.List(Filter{Limit: 3})
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(got) != 3 {
+		t.Errorf("List(Limit:3) returned %d events, want 3", len(got))
+	}
+}
+
+func TestMatchesFilter_SubjectFilter_ViaFake(t *testing.T) {
+	f := NewFake()
+	f.Record(Event{Type: BeadCreated, Subject: "gc-1"})
+	f.Record(Event{Type: BeadCreated, Subject: "gc-2"})
+	f.Record(Event{Type: BeadClosed, Subject: "gc-1"})
+
+	got, err := f.List(Filter{Subject: "gc-1"})
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(got) != 2 {
+		t.Errorf("List(Subject:gc-1) returned %d events, want 2", len(got))
+	}
+}
+
+func TestMatchesFilter_UntilFilter_ViaFake(t *testing.T) {
+	cutoff := time.Now()
+	past := cutoff.Add(-time.Minute)
+	future := cutoff.Add(time.Minute)
+
+	f := NewFake()
+	f.Record(Event{Type: BeadCreated, Ts: past, Subject: "old"})
+	f.Record(Event{Type: BeadCreated, Ts: future, Subject: "new"})
+
+	got, err := f.List(Filter{Until: cutoff})
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(got) != 1 || got[0].Subject != "old" {
+		t.Errorf("List(Until:cutoff) = %v, want 1 old event", got)
+	}
+}
+
+// --- CountByType ---
+
+func TestCountByType_Empty(t *testing.T) {
+	counts := CountByType(nil)
+	if len(counts) != 0 {
+		t.Errorf("CountByType(nil) = %v, want empty map", counts)
+	}
+}
+
+func TestCountByType(t *testing.T) {
+	evts := []Event{
+		{Type: BeadCreated},
+		{Type: BeadCreated},
+		{Type: BeadClosed},
+		{Type: SessionWoke},
+	}
+	counts := CountByType(evts)
+	if counts[BeadCreated] != 2 {
+		t.Errorf("CountByType[BeadCreated] = %d, want 2", counts[BeadCreated])
+	}
+	if counts[BeadClosed] != 1 {
+		t.Errorf("CountByType[BeadClosed] = %d, want 1", counts[BeadClosed])
+	}
+	if counts[SessionWoke] != 1 {
+		t.Errorf("CountByType[SessionWoke] = %d, want 1", counts[SessionWoke])
+	}
+}
+
+// --- CountByActor ---
+
+func TestCountByActor_Empty(t *testing.T) {
+	counts := CountByActor(nil)
+	if len(counts) != 0 {
+		t.Errorf("CountByActor(nil) = %v, want empty map", counts)
+	}
+}
+
+func TestCountByActor(t *testing.T) {
+	evts := []Event{
+		{Actor: "actor-a"},
+		{Actor: "actor-a"},
+		{Actor: "actor-b"},
+	}
+	counts := CountByActor(evts)
+	if counts["actor-a"] != 2 {
+		t.Errorf("CountByActor[actor-a] = %d, want 2", counts["actor-a"])
+	}
+	if counts["actor-b"] != 1 {
+		t.Errorf("CountByActor[actor-b] = %d, want 1", counts["actor-b"])
+	}
+}
+
+// --- CountBySubject ---
+
+func TestCountBySubject_Empty(t *testing.T) {
+	counts := CountBySubject(nil)
+	if len(counts) != 0 {
+		t.Errorf("CountBySubject(nil) = %v, want empty map", counts)
+	}
+}
+
+func TestCountBySubject(t *testing.T) {
+	evts := []Event{
+		{Subject: "gc-1"},
+		{Subject: "gc-1"},
+		{Subject: "gc-2"},
+		{Subject: ""},
+	}
+	counts := CountBySubject(evts)
+	if counts["gc-1"] != 2 {
+		t.Errorf("CountBySubject[gc-1] = %d, want 2", counts["gc-1"])
+	}
+	if counts["gc-2"] != 1 {
+		t.Errorf("CountBySubject[gc-2] = %d, want 1", counts["gc-2"])
+	}
+	if counts[""] != 1 {
+		t.Errorf("CountBySubject[\"\"] = %d, want 1 (no-subject events)", counts[""])
+	}
+}
diff --git a/internal/events/reader.go b/internal/events/reader.go
index f940770369..70a14809f2 100644
--- a/internal/events/reader.go
+++ b/internal/events/reader.go
@@ -2,6 +2,7 @@ package events
 
 import (
 	"bufio"
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -13,8 +14,55 @@ import (
 type Filter struct {
 	Type     string    // match events with this Type
 	Actor    string    // match events with this Actor
+	Subject  string    // match events with this Subject
 	Since    time.Time // match events at or after this time
+	Until    time.Time // match events at or before this time
 	AfterSeq uint64    // match events with Seq > AfterSeq (0 = no filter)
+	Limit    int       // cap results at this count (0 or negative = unlimited)
+}
+
+// matchesFilter reports whether e satisfies all non-zero predicates in f.
+// It does not enforce Limit — that is applied by the caller.
+func matchesFilter(e Event, f Filter) bool {
+	if f.AfterSeq > 0 && e.Seq <= f.AfterSeq {
+		return false
+	}
+	if f.Type != "" && e.Type != f.Type {
+		return false
+	}
+	if f.Actor != "" && e.Actor != f.Actor {
+		return false
+	}
+	if f.Subject != "" && e.Subject != f.Subject {
+		return false
+	}
+	if !f.Since.IsZero() && e.Ts.Before(f.Since) {
+		return false
+	}
+	if !f.Until.IsZero() && e.Ts.After(f.Until) {
+		return false
+	}
+	return true
+}
+
+// ApplyFilter returns events matching all non-zero predicates in filter.
+// It preserves input order and applies a positive Limit after matching.
+func ApplyFilter(evts []Event, filter Filter) []Event {
+	var result []Event
+	for _, e := range evts {
+		if !matchesFilter(e, filter) {
+			continue
+		}
+		result = append(result, e)
+		if limitReached(len(result), filter) {
+			break
+		}
+	}
+	return result
+}
+
+func limitReached(count int, filter Filter) bool {
+	return filter.Limit > 0 && count >= filter.Limit
 }
 
 // ReadAll reads all events from the JSONL file at path.
@@ -47,34 +95,117 @@ func ReadAll(path string) ([]Event, error) {
 
 // ReadFiltered reads events from path and returns only those matching
 // all non-zero fields in filter. Returns (nil, nil) if the file is
-// missing or empty.
+// missing or empty. Scanner errors return the events parsed before the
+// error alongside the error.
 func ReadFiltered(path string, filter Filter) ([]Event, error) {
-	all, err := ReadAll(path)
+	f, err := os.Open(path)
 	if err != nil {
-		return nil, err
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("reading events: %w", err)
 	}
+	defer f.Close() //nolint:errcheck // read-only file
 
 	var result []Event
-	for _, e := range all {
-		if filter.AfterSeq > 0 && e.Seq <= filter.AfterSeq {
-			continue
-		}
-		if filter.Type != "" && e.Type != filter.Type {
-			continue
-		}
-		if filter.Actor != "" && e.Actor != filter.Actor {
-			continue
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024) // handle lines up to 1MB
+	for scanner.Scan() {
+		var e Event
+		if err := json.Unmarshal(scanner.Bytes(), &e); err != nil {
+			continue // skip malformed lines
 		}
-		if !filter.Since.IsZero() && e.Ts.Before(filter.Since) {
+		if !matchesFilter(e, filter) {
 			continue
 		}
 		result = append(result, e)
+		if limitReached(len(result), filter) {
+			break
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return result, fmt.Errorf("scanning events: %w", err)
 	}
 	return result, nil
 }
 
-// ReadLatestSeq returns the highest Seq in the events file, or 0 if
-// the file is missing or empty.
+// ReadFilteredTail reads the trailing matching events from path. A positive
+// limit returns at most that many events in chronological order; limit <= 0
+// falls back to ReadFiltered.
+func ReadFilteredTail(path string, filter Filter, limit int) ([]Event, error) {
+	if limit <= 0 {
+		return ReadFiltered(path, filter)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("reading events tail: %w", err)
+	}
+	defer f.Close() //nolint:errcheck // read-only file
+
+	info, err := f.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("stat events tail: %w", err)
+	}
+	return readFilteredTailFromFile(f, info.Size(), filter, limit)
+}
+
+func readFilteredTailFromFile(f *os.File, size int64, filter Filter, limit int) ([]Event, error) {
+	if size <= 0 {
+		return nil, nil
+	}
+	const chunkSize int64 = 64 * 1024
+	var reversed []Event
+	var pending []byte
+	end := size
+	for end > 0 && len(reversed) < limit {
+		n := chunkSize
+		if end < n {
+			n = end
+		}
+		start := end - n
+		chunk := make([]byte, n)
+		if _, err := f.ReadAt(chunk, start); err != nil && err != io.EOF {
+			return nil, fmt.Errorf("reading events tail: %w", err)
+		}
+		data := make([]byte, 0, len(chunk)+len(pending))
+		data = append(data, chunk...)
+		data = append(data, pending...)
+		parts := bytes.Split(data, []byte{'\n'})
+		firstComplete := 0
+		if start > 0 {
+			pending = append(pending[:0], parts[0]...)
+			firstComplete = 1
+		} else {
+			pending = nil
+		}
+		for i := len(parts) - 1; i >= firstComplete && len(reversed) < limit; i-- {
+			line := bytes.TrimSuffix(parts[i], []byte{'\r'})
+			if len(bytes.TrimSpace(line)) == 0 {
+				continue
+			}
+			var e Event
+			if err := json.Unmarshal(line, &e); err != nil {
+				continue
+			}
+			if matchesFilter(e, filter) {
+				reversed = append(reversed, e)
+			}
+		}
+		end = start
+	}
+	for i, j := 0, len(reversed)-1; i < j; i, j = i+1, j-1 {
+		reversed[i], reversed[j] = reversed[j], reversed[i]
+	}
+	return reversed, nil
+}
+
+// ReadLatestSeq returns the latest complete event Seq in the events file, or
+// 0 if the file is missing or empty. Event logs are append-only and sequence
+// numbers are monotonic, so this reads backward from the tail instead of
+// parsing historical events on every recorder open.
 func ReadLatestSeq(path string) (uint64, error) {
 	f, err := os.Open(path)
 	if err != nil {
@@ -85,19 +216,89 @@ func ReadLatestSeq(path string) (uint64, error) {
 	}
 	defer f.Close() //nolint:errcheck // read-only file
 
-	var maxSeq uint64
-	scanner := bufio.NewScanner(f)
-	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024) // handle lines up to 1MB
-	for scanner.Scan() {
-		var e Event
-		if json.Unmarshal(scanner.Bytes(), &e) == nil && e.Seq > maxSeq {
-			maxSeq = e.Seq
+	info, err := f.Stat()
+	if err != nil {
+		return 0, fmt.Errorf("stat events: %w", err)
+	}
+	return readLatestSeqFromTail(f, info.Size())
+}
+
+func readLatestSeqFromTail(f *os.File, size int64) (uint64, error) {
+	if size <= 0 {
+		return 0, nil
+	}
+	const chunkSize int64 = 64 * 1024
+	var suffix []byte
+	end := size
+	first := true
+	for end > 0 {
+		n := chunkSize
+		if end < n {
+			n = end
+		}
+		start := end - n
+		chunk := make([]byte, n)
+		if _, err := f.ReadAt(chunk, start); err != nil && err != io.EOF {
+			return 0, fmt.Errorf("reading latest seq: %w", err)
 		}
+		data := make([]byte, 0, len(chunk)+len(suffix))
+		data = append(data, chunk...)
+		data = append(data, suffix...)
+		searchEnd := len(data)
+		if first && len(data) > 0 && data[len(data)-1] != '\n' {
+			idx := bytes.LastIndexByte(data, '\n')
+			if idx < 0 {
+				suffix = data
+				end = start
+				first = false
+				continue
+			}
+			searchEnd = idx
+		}
+		searchStart := 0
+		if start > 0 {
+			idx := bytes.IndexByte(data, '\n')
+			if idx < 0 {
+				suffix = data
+				end = start
+				first = false
+				continue
+			}
+			searchStart = idx + 1
+		}
+		if seq, ok := latestSeqInCompleteLines(data[searchStart:searchEnd]); ok {
+			return seq, nil
+		}
+		suffix = data
+		end = start
+		first = false
 	}
-	if err := scanner.Err(); err != nil {
-		return maxSeq, fmt.Errorf("scanning events: %w", err)
+	return 0, nil
+}
+
+func latestSeqInCompleteLines(data []byte) (uint64, bool) {
+	for len(data) > 0 {
+		idx := bytes.LastIndexByte(data, '\n')
+		var line []byte
+		if idx >= 0 {
+			line = data[idx+1:]
+			data = data[:idx]
+		} else {
+			line = data
+			data = nil
+		}
+		line = bytes.TrimSuffix(line, []byte{'\r'})
+		if len(bytes.TrimSpace(line)) == 0 {
+			continue
+		}
+		var header struct {
+			Seq uint64 `json:"seq"`
+		}
+		if err := json.Unmarshal(line, &header); err == nil && header.Seq > 0 {
+			return header.Seq, true
+		}
 	}
-	return maxSeq, nil
+	return 0, false
 }
 
 // ReadFrom reads events starting at the given byte offset in the file.
diff --git a/internal/events/recorder.go b/internal/events/recorder.go
index 134a1cd660..9cb38a1814 100644
--- a/internal/events/recorder.go
+++ b/internal/events/recorder.go
@@ -1,7 +1,6 @@
 package events
 
 import (
-	"bufio"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -9,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+	"syscall"
 	"time"
 )
 
@@ -26,30 +26,17 @@ type FileRecorder struct {
 	closed bool
 }
 
-// NewFileRecorder opens (or creates) the event log at path. It scans any
-// existing file to find the maximum sequence number so new events continue
+// NewFileRecorder opens (or creates) the event log at path. It reads the tail
+// sequence from any existing append-only log so new events continue
 // monotonically. Parent directories are created as needed.
 func NewFileRecorder(path string, stderr io.Writer) (*FileRecorder, error) {
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return nil, fmt.Errorf("creating event log directory: %w", err)
 	}
 
-	// Scan existing file for max seq before opening for append.
-	var maxSeq uint64
-	if f, err := os.Open(path); err == nil {
-		scanner := bufio.NewScanner(f)
-		scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024) // handle lines up to 1MB
-		for scanner.Scan() {
-			var e Event
-			if json.Unmarshal(scanner.Bytes(), &e) == nil && e.Seq > maxSeq {
-				maxSeq = e.Seq
-			}
-		}
-		if err := scanner.Err(); err != nil {
-			f.Close() //nolint:errcheck // closing after scan error
-			return nil, fmt.Errorf("scanning event log: %w", err)
-		}
-		f.Close() //nolint:errcheck // read-only scan
+	maxSeq, err := ReadLatestSeq(path)
+	if err != nil {
+		return nil, err
 	}
 
 	file, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
@@ -74,7 +61,21 @@ func (r *FileRecorder) Record(e Event) {
 	if r.closed {
 		return
 	}
+	if err := syscall.Flock(int(r.file.Fd()), syscall.LOCK_EX); err != nil {
+		fmt.Fprintf(r.stderr, "events: lock: %v\n", err) //nolint:errcheck // best-effort stderr
+		return
+	}
+	defer func() {
+		if err := syscall.Flock(int(r.file.Fd()), syscall.LOCK_UN); err != nil {
+			fmt.Fprintf(r.stderr, "events: unlock: %v\n", err) //nolint:errcheck // best-effort stderr
+		}
+	}()
 
+	if latest, err := ReadLatestSeq(r.path); err == nil && latest > r.seq {
+		r.seq = latest
+	} else if err != nil {
+		fmt.Fprintf(r.stderr, "events: latest seq: %v\n", err) //nolint:errcheck // best-effort stderr
+	}
 	r.seq++
 	e.Seq = r.seq
 	if e.Ts.IsZero() {
@@ -97,6 +98,11 @@ func (r *FileRecorder) List(filter Filter) ([]Event, error) {
 	return ReadFiltered(r.path, filter)
 }
 
+// ListTail returns trailing matching events from the underlying file.
+func (r *FileRecorder) ListTail(filter Filter, limit int) ([]Event, error) {
+	return ReadFilteredTail(r.path, filter, limit)
+}
+
 // LatestSeq returns the highest sequence number in the event log.
 func (r *FileRecorder) LatestSeq() (uint64, error) {
 	r.mu.Lock()
@@ -107,11 +113,20 @@ func (r *FileRecorder) LatestSeq() (uint64, error) {
 
 // Watch returns a Watcher that polls the event file for new events.
 func (r *FileRecorder) Watch(ctx context.Context, afterSeq uint64) (Watcher, error) {
+	var offset int64
+	r.mu.Lock()
+	if afterSeq >= r.seq {
+		if info, err := r.file.Stat(); err == nil {
+			offset = info.Size()
+		}
+	}
+	r.mu.Unlock()
 	return &fileWatcher{
 		path:     r.path,
 		afterSeq: afterSeq,
 		ctx:      ctx,
 		poll:     250 * time.Millisecond,
+		offset:   offset,
 		done:     make(chan struct{}),
 	}, nil
 }
diff --git a/internal/execenv/execenv.go b/internal/execenv/execenv.go
new file mode 100644
index 0000000000..adc098ad5f
--- /dev/null
+++ b/internal/execenv/execenv.go
@@ -0,0 +1,144 @@
+// Package execenv centralizes environment filtering and log redaction for
+// subprocess boundaries.
+package execenv
+
+import (
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// Redacted is the replacement marker used when removing secrets from text.
+const Redacted = "[redacted]"
+
+var sensitiveAssignmentRE = regexp.MustCompile(`(?i)((?:[A-Z0-9_.-]*(?:TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|API[_-]?KEY|ACCESS[_-]?KEY|CREDENTIALS?|OAUTH|AUTH[_-]?JSON)[A-Z0-9_.-]*|--?[A-Z0-9_.-]*(?:token|secret|password|private-key|api-key|access-key|credential|oauth)[A-Z0-9_.-]*)\s*(?:=|:|\s)\s*)([^ \t\r\n,;]+)`)
+
+// IsSensitiveKey reports whether an environment key is likely to contain a
+// secret. Callers should strip inherited values for these keys and require
+// explicit config when a child process truly needs one.
+func IsSensitiveKey(key string) bool {
+	key = strings.ToUpper(strings.TrimSpace(key))
+	if key == "" {
+		return false
+	}
+	for _, marker := range []string{
+		"PASSWORD",
+		"TOKEN",
+		"SECRET",
+		"PRIVATE_KEY",
+		"PRIVATE-KEY",
+		"API_KEY",
+		"API-KEY",
+		"ACCESS_KEY",
+		"ACCESS-KEY",
+		"CREDENTIAL",
+		"OAUTH",
+		"AUTH_JSON",
+		"AUTH-JSON",
+	} {
+		if strings.Contains(key, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+// FilterInherited removes sensitive KEY=VALUE entries from an inherited
+// environment. Explicit overrides should be appended after filtering.
+func FilterInherited(environ []string) []string {
+	out := make([]string, 0, len(environ))
+	for _, entry := range environ {
+		key, _, ok := strings.Cut(entry, "=")
+		if ok && IsSensitiveKey(key) {
+			continue
+		}
+		out = append(out, entry)
+	}
+	return out
+}
+
+// MergeMap filters inherited secrets, removes keys replaced by overrides, and
+// appends overrides in deterministic order. Sensitive override values are kept
+// because explicit configuration is the "required" path.
+func MergeMap(environ []string, overrides map[string]string) []string {
+	out := FilterInherited(environ)
+	if len(overrides) == 0 {
+		return out
+	}
+	keys := make([]string, 0, len(overrides))
+	for key := range overrides {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	for _, key := range keys {
+		out = removeEnvKey(out, key)
+	}
+	for _, key := range keys {
+		out = append(out, key+"="+overrides[key])
+	}
+	return out
+}
+
+// MergeEntries is like MergeMap for already-encoded KEY=VALUE override entries.
+func MergeEntries(environ, overrides []string) []string {
+	out := FilterInherited(environ)
+	if len(overrides) == 0 {
+		return out
+	}
+	for _, entry := range overrides {
+		key, _, ok := strings.Cut(entry, "=")
+		if ok {
+			out = removeEnvKey(out, key)
+		}
+	}
+	return append(out, overrides...)
+}
+
+// RedactText replaces known secret values and common CLI/env secret assignment
+// patterns in text intended for logs or events.
+func RedactText(text string, envs ...[]string) string {
+	if text == "" {
+		return ""
+	}
+	for _, secret := range sensitiveValues(envs...) {
+		text = strings.ReplaceAll(text, secret, Redacted)
+	}
+	return sensitiveAssignmentRE.ReplaceAllString(text, "${1}"+Redacted)
+}
+
+func sensitiveValues(envs ...[]string) []string {
+	seen := map[string]struct{}{}
+	var values []string
+	for _, env := range envs {
+		for _, entry := range env {
+			key, value, ok := strings.Cut(entry, "=")
+			if !ok || !IsSensitiveKey(key) {
+				continue
+			}
+			value = strings.TrimSpace(value)
+			if len(value) < 4 {
+				continue
+			}
+			if _, ok := seen[value]; ok {
+				continue
+			}
+			seen[value] = struct{}{}
+			values = append(values, value)
+		}
+	}
+	sort.Slice(values, func(i, j int) bool {
+		return len(values[i]) > len(values[j])
+	})
+	return values
+}
+
+func removeEnvKey(env []string, key string) []string {
+	prefix := key + "="
+	out := env[:0]
+	for _, entry := range env {
+		if !strings.HasPrefix(entry, prefix) {
+			out = append(out, entry)
+		}
+	}
+	return out
+}
diff --git a/internal/execenv/execenv_test.go b/internal/execenv/execenv_test.go
new file mode 100644
index 0000000000..e89472a1f2
--- /dev/null
+++ b/internal/execenv/execenv_test.go
@@ -0,0 +1,58 @@
+package execenv
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestFilterInheritedStripsSensitiveEnv(t *testing.T) {
+	got := FilterInherited([]string{
+		"PATH=/bin",
+		"GITHUB_TOKEN=ghs_secret",
+		"OPENAI_API_KEY=sk-secret",
+		"GC_INSTANCE_TOKEN=fence",
+		"HOME=/tmp/home",
+	})
+	joined := strings.Join(got, "\n")
+	for _, secret := range []string{"GITHUB_TOKEN", "OPENAI_API_KEY", "GC_INSTANCE_TOKEN", "ghs_secret", "sk-secret", "fence"} {
+		if strings.Contains(joined, secret) {
+			t.Fatalf("FilterInherited leaked %q in %q", secret, joined)
+		}
+	}
+	if !strings.Contains(joined, "PATH=/bin") || !strings.Contains(joined, "HOME=/tmp/home") {
+		t.Fatalf("FilterInherited dropped non-sensitive env: %q", joined)
+	}
+}
+
+func TestMergeMapPreservesExplicitSensitiveOverrides(t *testing.T) {
+	got := MergeMap([]string{
+		"PATH=/bin",
+		"GC_DOLT_PASSWORD=stale",
+		"GITHUB_TOKEN=ambient",
+	}, map[string]string{
+		"GC_DOLT_PASSWORD": "required",
+		"BEADS_DIR":        "/city/.beads",
+	})
+	joined := strings.Join(got, "\n")
+	if strings.Contains(joined, "GITHUB_TOKEN") || strings.Contains(joined, "ambient") || strings.Contains(joined, "stale") {
+		t.Fatalf("MergeMap leaked inherited secret: %q", joined)
+	}
+	if !strings.Contains(joined, "GC_DOLT_PASSWORD=required") {
+		t.Fatalf("MergeMap did not preserve explicit secret override: %q", joined)
+	}
+}
+
+func TestRedactTextRedactsEnvValuesAndAssignments(t *testing.T) {
+	got := RedactText(
+		"token=literal-secret GITHUB_TOKEN=ghs_secret output ghs_secret --password hunter2",
+		[]string{"GITHUB_TOKEN=ghs_secret"},
+	)
+	for _, secret := range []string{"literal-secret", "ghs_secret", "hunter2"} {
+		if strings.Contains(got, secret) {
+			t.Fatalf("RedactText leaked %q in %q", secret, got)
+		}
+	}
+	if strings.Count(got, Redacted) < 3 {
+		t.Fatalf("RedactText redactions = %q, want at least three", got)
+	}
+}
diff --git a/internal/execenv/testenv_import_test.go b/internal/execenv/testenv_import_test.go
new file mode 100644
index 0000000000..423ed568d5
--- /dev/null
+++ b/internal/execenv/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package execenv
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/internal/extmsg/extmsg_test.go b/internal/extmsg/extmsg_test.go
index c569c31f35..d85c943295 100644
--- a/internal/extmsg/extmsg_test.go
+++ b/internal/extmsg/extmsg_test.go
@@ -557,6 +557,48 @@ func TestBindingServiceListBySessionReturnsOnlyBindings(t *testing.T) {
 	}
 }
 
+func TestEmptyMetadataRecordsEncodeAsObjects(t *testing.T) {
+	freezeTestClock(t)
+	store := beads.NewMemStore()
+	fabric := NewServices(store)
+	ref := testConversationRef()
+
+	binding, err := fabric.Bindings.Bind(context.Background(), testControllerCaller(), BindInput{
+		Conversation: ref,
+		SessionID:    "sess-a",
+		Now:          testNow(),
+	})
+	if err != nil {
+		t.Fatalf("Bind: %v", err)
+	}
+	if binding.Metadata == nil {
+		t.Fatal("binding Metadata = nil, want empty object map")
+	}
+
+	group, err := fabric.Groups.EnsureGroup(context.Background(), testControllerCaller(), EnsureGroupInput{
+		RootConversation: ref,
+		Mode:             GroupModeLauncher,
+	})
+	if err != nil {
+		t.Fatalf("EnsureGroup: %v", err)
+	}
+	if group.Metadata == nil {
+		t.Fatal("group Metadata = nil, want empty object map")
+	}
+
+	participant, err := fabric.Groups.UpsertParticipant(context.Background(), testControllerCaller(), UpsertParticipantInput{
+		GroupID:   group.ID,
+		Handle:    "alpha",
+		SessionID: "sess-a",
+	})
+	if err != nil {
+		t.Fatalf("UpsertParticipant: %v", err)
+	}
+	if participant.Metadata == nil {
+		t.Fatal("participant Metadata = nil, want empty object map")
+	}
+}
+
 func TestBindingServiceTouchDebouncesMetadataWrites(t *testing.T) {
 	freezeTestClock(t)
 	store := beads.NewMemStore()
diff --git a/internal/extmsg/helpers.go b/internal/extmsg/helpers.go
index 1100067578..c7d985d2be 100644
--- a/internal/extmsg/helpers.go
+++ b/internal/extmsg/helpers.go
@@ -132,7 +132,7 @@ func encodeMetadataFields(meta map[string]string, fields map[string]string) map[
 
 func decodePrefixedMetadata(meta map[string]string) map[string]string {
 	if len(meta) == 0 {
-		return nil
+		return map[string]string{}
 	}
 	out := make(map[string]string)
 	for k, v := range meta {
@@ -141,7 +141,7 @@ func decodePrefixedMetadata(meta map[string]string) map[string]string {
 		}
 	}
 	if len(out) == 0 {
-		return nil
+		return map[string]string{}
 	}
 	return out
 }
diff --git a/internal/extmsg/http_adapter.go b/internal/extmsg/http_adapter.go
index 1db03c6e46..ce993fa582 100644
--- a/internal/extmsg/http_adapter.go
+++ b/internal/extmsg/http_adapter.go
@@ -103,8 +103,8 @@ func (a *HTTPAdapter) Publish(ctx context.Context, req PublishRequest) (*Publish
 		}, nil
 	}
 
-	var receipt PublishReceipt
-	if err := json.Unmarshal(respBody, &receipt); err != nil {
+	var wire wirePublishReceipt
+	if err := json.Unmarshal(respBody, &wire); err != nil {
 		// Malformed 2xx body — cannot confirm delivery.
 		return &PublishReceipt{
 			Conversation: req.Conversation,
@@ -112,7 +112,38 @@ func (a *HTTPAdapter) Publish(ctx context.Context, req PublishRequest) (*Publish
 			FailureKind:  PublishFailureTransient,
 		}, nil
 	}
-	return &receipt, nil
+	return wire.toPublishReceipt(), nil
+}
+
+// wirePublishReceipt mirrors PublishReceipt with the snake_case json tags
+// adapters write on the /publish response body. PublishReceipt itself is
+// intentionally untagged — it is exposed via the Huma API as
+// OutboundResult.Receipt where PascalCase is the public contract — so we
+// use this intermediate type at the wire boundary instead of changing
+// PublishReceipt's serialization shape.
+//
+// Without this shim, json.Unmarshal into the untagged PublishReceipt
+// silently zeroes MessageID, FailureKind, RetryAfter, and Metadata,
+// because Go's case-insensitive field match does not bridge the
+// underscore boundary (e.g. "message_id" does not match "MessageID").
+type wirePublishReceipt struct {
+	MessageID    string             `json:"message_id,omitempty"`
+	Conversation ConversationRef    `json:"conversation"`
+	Delivered    bool               `json:"delivered"`
+	FailureKind  PublishFailureKind `json:"failure_kind,omitempty"`
+	RetryAfter   time.Duration      `json:"retry_after,omitempty"`
+	Metadata     map[string]string  `json:"metadata,omitempty"`
+}
+
+func (w wirePublishReceipt) toPublishReceipt() *PublishReceipt {
+	return &PublishReceipt{
+		MessageID:    w.MessageID,
+		Conversation: w.Conversation,
+		Delivered:    w.Delivered,
+		FailureKind:  w.FailureKind,
+		RetryAfter:   w.RetryAfter,
+		Metadata:     w.Metadata,
+	}
 }
 
 // EnsureChildConversation forwards a child conversation request to the
diff --git a/internal/extmsg/types.go b/internal/extmsg/types.go
index a3bca73b6f..1ae9041224 100644
--- a/internal/extmsg/types.go
+++ b/internal/extmsg/types.go
@@ -131,6 +131,14 @@ type ExternalOriginEnvelope struct {
 }
 
 // AdapterCapabilities describes what a transport adapter supports.
+//
+// Intentionally untagged: this struct does not cross the gc↔adapter HTTP
+// callback wire. It is passed by value at adapter construction (see
+// NewHTTPAdapter) and exposed via the Huma API at POST /extmsg/adapters,
+// which serializes it with PascalCase keys today. Adding json tags here
+// would silently change that public API contract; if a snake_case
+// migration is wanted, do it as a coordinated API change with
+// regenerated clients, not as a side-effect of this fix.
 type AdapterCapabilities struct {
 	SupportsChildConversations bool
 	SupportsAttachments        bool
@@ -138,12 +146,19 @@ type AdapterCapabilities struct {
 }
 
 // PublishRequest is a request to publish a message to an external conversation.
+//
+// JSON tags are required: this struct is serialized over the HTTP wire to
+// out-of-process adapters (gc → adapter `/publish`), and the adapter side
+// parses snake_case keys. Without tags, Go marshals fields as PascalCase,
+// and case-insensitive matching on the receiver does not bridge the
+// underscore difference (so `ReplyToMessageID` would not match the
+// adapter's `reply_to_message_id` tag and the field would silently zero).
 type PublishRequest struct {
-	Conversation     ConversationRef
-	Text             string
-	ReplyToMessageID string
-	IdempotencyKey   string
-	Metadata         map[string]string
+	Conversation     ConversationRef   `json:"conversation"`
+	Text             string            `json:"text"`
+	ReplyToMessageID string            `json:"reply_to_message_id,omitempty"`
+	IdempotencyKey   string            `json:"idempotency_key,omitempty"`
+	Metadata         map[string]string `json:"metadata,omitempty"`
 }
 
 // PublishFailureKind classifies the reason a publish attempt failed.
@@ -165,6 +180,13 @@ const (
 )
 
 // PublishReceipt is the result of a publish attempt.
+//
+// Intentionally untagged: this struct is exposed via the Huma API as
+// OutboundResult.Receipt at POST /extmsg/outbound, where the public
+// contract is PascalCase. The gc↔adapter HTTP callback wire (which
+// uses snake_case) is bridged in HTTPAdapter.Publish via an explicit
+// wire-shaped intermediate type, so domain-type tagging is not needed
+// to fix the silent-drop bug.
 type PublishReceipt struct {
 	MessageID    string
 	Conversation ConversationRef
diff --git a/internal/extmsg/types_wire_test.go b/internal/extmsg/types_wire_test.go
new file mode 100644
index 0000000000..c10c936e1a
--- /dev/null
+++ b/internal/extmsg/types_wire_test.go
@@ -0,0 +1,140 @@
+package extmsg
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+// TestPublishRequestSnakeCaseWire pins the wire format of PublishRequest.
+// Without explicit json tags, Go marshals fields as PascalCase and the
+// adapter's snake_case decoder silently drops underscore-bearing fields
+// (Go's case-insensitive match does not bridge the underscore boundary).
+// This test fails loudly if the tags are removed or renamed.
+func TestPublishRequestSnakeCaseWire(t *testing.T) {
+	req := PublishRequest{
+		Conversation: ConversationRef{
+			Provider:       "slack",
+			ConversationID: "C123",
+			Kind:           ConversationRoom,
+		},
+		Text:             "hello",
+		ReplyToMessageID: "1700000000.000100",
+		IdempotencyKey:   "idem-xyz",
+		Metadata:         map[string]string{"thread_ts": "1700000000.000100"},
+	}
+
+	body, err := json.Marshal(req)
+	if err != nil {
+		t.Fatalf("Marshal(PublishRequest): %v", err)
+	}
+
+	mustContain := []string{
+		`"conversation":`,
+		`"text":"hello"`,
+		`"reply_to_message_id":"1700000000.000100"`,
+		`"idempotency_key":"idem-xyz"`,
+		`"metadata":`,
+	}
+	for _, want := range mustContain {
+		if !bytes.Contains(body, []byte(want)) {
+			t.Errorf("PublishRequest JSON missing %q\nfull body: %s", want, body)
+		}
+	}
+
+	mustNotContain := []string{
+		`"ReplyToMessageID"`,
+		`"IdempotencyKey"`,
+		`"Metadata"`,
+		`"Text"`,
+		`"Conversation"`,
+	}
+	for _, banned := range mustNotContain {
+		if bytes.Contains(body, []byte(banned)) {
+			t.Errorf("PublishRequest JSON contains PascalCase key %q (tags missing or wrong)\nfull body: %s", banned, body)
+		}
+	}
+}
+
+// TestWirePublishReceiptDecodesSnakeCase pins decode of an adapter
+// /publish response into the wire-shaped intermediate type. This is
+// the path HTTPAdapter.Publish takes — it must decode adapter
+// snake_case correctly so that MessageID, FailureKind, RetryAfter, and
+// Metadata round-trip with non-zero values. If the wire shim's tags
+// regress, this test fails because each field's want-value is
+// distinguishable from its zero value (the bug-mode the test is
+// guarding against).
+func TestWirePublishReceiptDecodesSnakeCase(t *testing.T) {
+	// Shape an adapter would write (snake_case, all fields populated).
+	adapterBody := []byte(`{
+		"conversation": {"provider":"slack","conversation_id":"C123","kind":"room"},
+		"message_id": "1700000000.000100",
+		"delivered": true,
+		"failure_kind": "rate_limited",
+		"retry_after": 5000000000,
+		"metadata": {"thread_ts":"1700000000.000100"}
+	}`)
+
+	var wire wirePublishReceipt
+	if err := json.Unmarshal(adapterBody, &wire); err != nil {
+		t.Fatalf("Unmarshal(wirePublishReceipt): %v", err)
+	}
+	receipt := wire.toPublishReceipt()
+
+	if got, want := receipt.MessageID, "1700000000.000100"; got != want {
+		t.Errorf("MessageID = %q, want %q (json tag missing — silent drop)", got, want)
+	}
+	if !receipt.Delivered {
+		t.Errorf("Delivered = false, want true")
+	}
+	if got, want := receipt.FailureKind, PublishFailureRateLimited; got != want {
+		t.Errorf("FailureKind = %q, want %q (json tag missing — silent drop)", got, want)
+	}
+	if got, want := receipt.RetryAfter, 5*time.Second; got != want {
+		t.Errorf("RetryAfter = %v, want %v (json tag missing — silent drop)", got, want)
+	}
+	if got, want := receipt.Conversation.ConversationID, "C123"; got != want {
+		t.Errorf("Conversation.ConversationID = %q, want %q", got, want)
+	}
+	if got, want := receipt.Metadata["thread_ts"], "1700000000.000100"; got != want {
+		t.Errorf("Metadata[thread_ts] = %q, want %q (json tag missing — silent drop)", got, want)
+	}
+}
+
+// TestPublishReceiptStaysPascalCaseOnAPISurface guards the Huma API
+// contract: PublishReceipt is exposed as OutboundResult.Receipt at
+// POST /extmsg/outbound, where the public schema (internal/api/openapi.json)
+// advertises PascalCase keys. If someone tags PublishReceipt's fields
+// in an attempt to "fix" the snake_case bug at the type level, this
+// test fails because Go's json.Marshal of an untagged struct uses the
+// field name verbatim.
+func TestPublishReceiptStaysPascalCaseOnAPISurface(t *testing.T) {
+	receipt := PublishReceipt{
+		MessageID: "M1",
+		Conversation: ConversationRef{
+			Provider:       "slack",
+			ConversationID: "C1",
+			Kind:           ConversationRoom,
+		},
+		Delivered:   true,
+		FailureKind: PublishFailureRateLimited,
+		RetryAfter:  5 * time.Second,
+		Metadata:    map[string]string{"k": "v"},
+	}
+	body, err := json.Marshal(receipt)
+	if err != nil {
+		t.Fatalf("Marshal(PublishReceipt): %v", err)
+	}
+	mustContain := []string{
+		`"MessageID":"M1"`,
+		`"FailureKind":"rate_limited"`,
+		`"RetryAfter":`,
+		`"Delivered":true`,
+	}
+	for _, want := range mustContain {
+		if !bytes.Contains(body, []byte(want)) {
+			t.Errorf("PublishReceipt JSON missing %q (Huma API surface contract drift)\nfull body: %s", want, body)
+		}
+	}
+}
diff --git a/internal/formula/compile.go b/internal/formula/compile.go
index 2033e222fd..57180a354f 100644
--- a/internal/formula/compile.go
+++ b/internal/formula/compile.go
@@ -252,9 +252,17 @@ func toRecipeWithGraph(f *Formula, graphWorkflow bool) (*Recipe, error) {
 		rootDesc = "{{desc}}"
 	}
 
+	// Vapor formulas and formulas with no materialized steps are executable
+	// wisps: the root bead itself is the work. Poured formulas keep a molecule
+	// container root because their child steps are the routable units.
+	rootOnly := (!f.Pour && f.Phase == "vapor") || len(f.Steps) == 0
+
 	// Root step
 	rootType := "molecule"
-	if graphWorkflow {
+	switch {
+	case graphWorkflow:
+		rootType = "task"
+	case rootOnly:
 		rootType = "task"
 	}
 
@@ -268,16 +276,14 @@ func toRecipeWithGraph(f *Formula, graphWorkflow bool) (*Recipe, error) {
 	if graphWorkflow {
 		rootStep.Metadata = map[string]string{"gc.kind": "workflow"}
 		rootStep.Metadata["gc.formula_contract"] = "graph.v2"
+	} else if rootOnly {
+		rootStep.Metadata = map[string]string{"gc.kind": "wisp"}
 	}
 	defPriority := 2
 	rootStep.Priority = &defPriority
 	r.Steps = append(r.Steps, rootStep)
 
-	// Determine RootOnly: vapor-phase formulas that don't explicitly
-	// request pour get root-only by default.
-	if !f.Pour && f.Phase == "vapor" {
-		r.RootOnly = true
-	}
+	r.RootOnly = rootOnly
 
 	// Flatten step tree
 	idMapping := make(map[string]string) // step.ID -> namespaced ID
diff --git a/internal/formula/compile_test.go b/internal/formula/compile_test.go
index aa0a20d381..8879d33fbd 100644
--- a/internal/formula/compile_test.go
+++ b/internal/formula/compile_test.go
@@ -391,6 +391,42 @@ title = "Scan"
 	if !recipe.RootOnly {
 		t.Error("vapor formula should be RootOnly by default")
 	}
+	if recipe.RootStep().Type != "task" {
+		t.Errorf("root Type = %q, want %q", recipe.RootStep().Type, "task")
+	}
+	if got := recipe.RootStep().Metadata["gc.kind"]; got != "wisp" {
+		t.Errorf("root gc.kind = %q, want wisp", got)
+	}
+}
+
+func TestCompileStepLessFormulaUsesRunnableWispRoot(t *testing.T) {
+	dir := t.TempDir()
+	formulaContent := `
+formula = "router"
+description = "Route pending work"
+version = 1
+`
+	if err := os.WriteFile(filepath.Join(dir, "router.toml"), []byte(formulaContent), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	recipe, err := Compile(context.Background(), "router", []string{dir}, nil)
+	if err != nil {
+		t.Fatalf("Compile: %v", err)
+	}
+
+	if len(recipe.Steps) != 1 {
+		t.Fatalf("len(Steps) = %d, want root only", len(recipe.Steps))
+	}
+	if !recipe.RootOnly {
+		t.Fatal("step-less formula should be RootOnly")
+	}
+	if recipe.RootStep().Type != "task" {
+		t.Fatalf("root Type = %q, want task", recipe.RootStep().Type)
+	}
+	if got := recipe.RootStep().Metadata["gc.kind"]; got != "wisp" {
+		t.Fatalf("root gc.kind = %q, want wisp", got)
+	}
 }
 
 // TestCompileExtendsPhasePour regresses the merge bug where the 'extends'
diff --git a/internal/formulatest/v2.go b/internal/formulatest/v2.go
index 6e8a75dbb7..6e01426a9a 100644
--- a/internal/formulatest/v2.go
+++ b/internal/formulatest/v2.go
@@ -3,18 +3,47 @@
 package formulatest
 
 import (
+	"sync"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/formula"
 )
 
+var v2Mu sync.Mutex
+
+// LockV2ForTest acquires exclusive access to the process-global formula_v2
+// flag for the duration of the test and returns a setter for in-test updates.
+// It is non-reentrant: call it at most once per test goroutine.
+func LockV2ForTest(tb testing.TB) func(enabled bool) {
+	tb.Helper()
+	v2Mu.Lock()
+	prev := formula.IsFormulaV2Enabled()
+	tb.Cleanup(func() {
+		defer v2Mu.Unlock()
+		formula.SetFormulaV2Enabled(prev)
+	})
+	return func(enabled bool) {
+		formula.SetFormulaV2Enabled(enabled)
+	}
+}
+
+// HoldV2ForTest serializes a test against other formula_v2 mutators while
+// preserving the current flag value.
+func HoldV2ForTest(tb testing.TB) {
+	tb.Helper()
+	_ = LockV2ForTest(tb)
+}
+
+// SetV2ForTest sets graph.v2 formula compilation for the duration of the test,
+// restoring the previous value during cleanup.
+func SetV2ForTest(tb testing.TB, enabled bool) {
+	tb.Helper()
+	LockV2ForTest(tb)(enabled)
+}
+
 // EnableV2ForTest enables graph.v2 formula compilation for the duration of the
-// test, restoring the previous value on cleanup. Callers must not use it in
-// tests that run in parallel with other formula-v2 flag mutations because the
-// flag is process-global.
+// test, restoring the previous value during cleanup.
 func EnableV2ForTest(tb testing.TB) {
 	tb.Helper()
-	prev := formula.IsFormulaV2Enabled()
-	formula.SetFormulaV2Enabled(true)
-	tb.Cleanup(func() { formula.SetFormulaV2Enabled(prev) })
+	SetV2ForTest(tb, true)
 }
diff --git a/internal/fsys/fake.go b/internal/fsys/fake.go
index fff8280b64..5d864662b1 100644
--- a/internal/fsys/fake.go
+++ b/internal/fsys/fake.go
@@ -11,14 +11,18 @@ import (
 
 // Fake is an in-memory [FS] for testing. It records all calls (spy) and
 // simulates filesystem state (fake). Pre-populate Dirs, Files, Symlinks,
-// and Errors before calling methods.
+// and Errors before calling methods. ModTimes is optional unless a test needs
+// exact timestamp control; Stat synthesizes and stores a mod time on demand.
 type Fake struct {
 	Dirs     map[string]bool   // pre-populated directories
 	Files    map[string][]byte // pre-populated files
 	Modes    map[string]os.FileMode
-	Symlinks map[string]string // pre-populated symlinks (path -> target)
-	Errors   map[string]error  // path → injected error (checked first)
-	Calls    []Call            // spy log
+	Symlinks map[string]string    // pre-populated symlinks (path -> target)
+	Errors   map[string]error     // path → injected error (checked first)
+	ModTimes map[string]time.Time // file path → synthetic mod time
+	Calls    []Call               // spy log
+
+	clock time.Time
 }
 
 // Call records a single method invocation on [Fake].
@@ -35,7 +39,20 @@ func NewFake() *Fake {
 		Modes:    make(map[string]os.FileMode),
 		Symlinks: make(map[string]string),
 		Errors:   make(map[string]error),
+		ModTimes: make(map[string]time.Time),
+		clock:    time.Unix(0, 0).UTC(),
+	}
+}
+
+func (f *Fake) nextModTime() time.Time {
+	if f.ModTimes == nil {
+		f.ModTimes = make(map[string]time.Time)
+	}
+	if f.clock.IsZero() {
+		f.clock = time.Unix(0, 0).UTC()
 	}
+	f.clock = f.clock.Add(time.Second)
+	return f.clock
 }
 
 // MkdirAll records the call and adds the directory (and parents) to Dirs.
@@ -66,6 +83,7 @@ func (f *Fake) WriteFile(name string, data []byte, perm os.FileMode) error {
 	if err, ok := f.Errors[name]; ok {
 		return err
 	}
+	modTime := f.nextModTime()
 	cp := make([]byte, len(data))
 	copy(cp, data)
 	if f.Files == nil {
@@ -76,6 +94,7 @@ func (f *Fake) WriteFile(name string, data []byte, perm os.FileMode) error {
 	}
 	f.Files[name] = cp
 	f.Modes[name] = perm.Perm()
+	f.ModTimes[name] = modTime
 	return nil
 }
 
@@ -136,7 +155,12 @@ func (f *Fake) Stat(name string) (os.FileInfo, error) {
 			return fakeFileInfo{name: filepath.Base(name), dir: true, mode: f.modeFor(target), id: fakeIdentity(target), hasID: true}, nil
 		}
 		if data, ok := f.Files[target]; ok {
-			return fakeFileInfo{name: filepath.Base(name), size: int64(len(data)), mode: f.modeFor(target), id: fakeIdentity(target), hasID: true}, nil
+			modTime := f.ModTimes[target]
+			if modTime.IsZero() {
+				modTime = f.nextModTime()
+				f.ModTimes[target] = modTime
+			}
+			return fakeFileInfo{name: filepath.Base(name), size: int64(len(data)), mode: f.modeFor(target), id: fakeIdentity(target), hasID: true, modTime: modTime}, nil
 		}
 		return nil, &os.PathError{Op: "stat", Path: name, Err: os.ErrNotExist}
 	}
@@ -144,7 +168,12 @@ func (f *Fake) Stat(name string) (os.FileInfo, error) {
 		return fakeFileInfo{name: filepath.Base(name), dir: true, mode: f.modeFor(name), id: fakeIdentity(name), hasID: true}, nil
 	}
 	if data, ok := f.Files[name]; ok {
-		return fakeFileInfo{name: filepath.Base(name), size: int64(len(data)), mode: f.modeFor(name), id: fakeIdentity(name), hasID: true}, nil
+		modTime := f.ModTimes[name]
+		if modTime.IsZero() {
+			modTime = f.nextModTime()
+			f.ModTimes[name] = modTime
+		}
+		return fakeFileInfo{name: filepath.Base(name), size: int64(len(data)), mode: f.modeFor(name), id: fakeIdentity(name), hasID: true, modTime: modTime}, nil
 	}
 	return nil, &os.PathError{Op: "stat", Path: name, Err: os.ErrNotExist}
 }
@@ -212,6 +241,11 @@ func (f *Fake) Rename(oldpath, newpath string) error {
 	if err, ok := f.Errors[oldpath]; ok {
 		return err
 	}
+	if target, ok := f.Symlinks[oldpath]; ok {
+		f.Symlinks[newpath] = target
+		delete(f.Symlinks, oldpath)
+		return nil
+	}
 	if data, ok := f.Files[oldpath]; ok {
 		f.Files[newpath] = data
 		delete(f.Files, oldpath)
@@ -222,6 +256,12 @@ func (f *Fake) Rename(oldpath, newpath string) error {
 		}
 		delete(f.Modes, oldpath)
 		delete(f.Symlinks, newpath)
+		if modTime, ok := f.ModTimes[oldpath]; ok {
+			f.ModTimes[newpath] = modTime
+			delete(f.ModTimes, oldpath)
+		} else {
+			f.ModTimes[newpath] = f.nextModTime()
+		}
 		return nil
 	}
 	return &os.PathError{Op: "rename", Path: oldpath, Err: os.ErrNotExist}
@@ -233,13 +273,14 @@ func (f *Fake) Remove(name string) error {
 	if err, ok := f.Errors[name]; ok {
 		return err
 	}
+	if _, ok := f.Symlinks[name]; ok {
+		delete(f.Symlinks, name)
+		return nil
+	}
 	if _, ok := f.Files[name]; ok {
 		delete(f.Files, name)
 		delete(f.Modes, name)
-		return nil
-	}
-	if _, ok := f.Symlinks[name]; ok {
-		delete(f.Symlinks, name)
+		delete(f.ModTimes, name)
 		return nil
 	}
 	if f.Dirs[name] {
@@ -256,6 +297,9 @@ func (f *Fake) Chmod(name string, mode os.FileMode) error {
 	if err, ok := f.Errors[name]; ok {
 		return err
 	}
+	if _, ok := f.Symlinks[name]; ok {
+		return nil
+	}
 	if f.Modes == nil {
 		f.Modes = make(map[string]os.FileMode)
 	}
@@ -286,6 +330,7 @@ type fakeFileInfo struct {
 	id      fileIdentity
 	hasID   bool
 	dir     bool
+	modTime time.Time
 	symlink bool
 }
 
@@ -300,7 +345,7 @@ func (fi fakeFileInfo) Mode() os.FileMode {
 	}
 	return fi.mode
 }
-func (fi fakeFileInfo) ModTime() time.Time { return time.Time{} }
+func (fi fakeFileInfo) ModTime() time.Time { return fi.modTime }
 func (fi fakeFileInfo) IsDir() bool        { return fi.dir }
 func (fi fakeFileInfo) Sys() any {
 	if !fi.hasID {
diff --git a/internal/fsys/fake_test.go b/internal/fsys/fake_test.go
index eae07f515e..28f4bf6e7d 100644
--- a/internal/fsys/fake_test.go
+++ b/internal/fsys/fake_test.go
@@ -41,7 +41,9 @@ func TestFakeStatDirModeIncludesDirBit(t *testing.T) {
 
 func TestFakeStatFile(t *testing.T) {
 	f := NewFake()
-	f.Files["/city/city.toml"] = []byte("hello")
+	if err := f.WriteFile("/city/city.toml", []byte("hello"), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
 
 	fi, err := f.Stat("/city/city.toml")
 	if err != nil {
@@ -53,6 +55,89 @@ func TestFakeStatFile(t *testing.T) {
 	if fi.Size() != 5 {
 		t.Errorf("Size() = %d, want 5", fi.Size())
 	}
+	if fi.ModTime().IsZero() {
+		t.Error("expected synthetic mod time for written file")
+	}
+}
+
+func TestFakeStatSynthesizesModTimeForPrepopulatedFile(t *testing.T) {
+	f := &Fake{
+		Files: map[string][]byte{
+			"/city/city.toml": []byte("hello"),
+		},
+	}
+
+	fi, err := f.Stat("/city/city.toml")
+	if err != nil {
+		t.Fatalf("Stat existing file: %v", err)
+	}
+	if fi.ModTime().IsZero() {
+		t.Fatal("expected synthetic mod time for prepopulated file")
+	}
+	if got := f.ModTimes["/city/city.toml"]; !got.Equal(fi.ModTime()) {
+		t.Fatalf("stored mod time = %v, want %v", got, fi.ModTime())
+	}
+
+	fi2, err := f.Stat("/city/city.toml")
+	if err != nil {
+		t.Fatalf("second Stat existing file: %v", err)
+	}
+	if !fi2.ModTime().Equal(fi.ModTime()) {
+		t.Fatalf("second Stat mod time = %v, want %v", fi2.ModTime(), fi.ModTime())
+	}
+}
+
+func TestFakeStatFollowsSymlinkTargets(t *testing.T) {
+	t.Run("file", func(t *testing.T) {
+		f := NewFake()
+		f.Files["/city/target.toml"] = []byte("hello")
+		f.Symlinks["/city/link.toml"] = "/city/target.toml"
+
+		fi, err := f.Stat("/city/link.toml")
+		if err != nil {
+			t.Fatalf("Stat symlink to file: %v", err)
+		}
+		if fi.Name() != "link.toml" {
+			t.Fatalf("Name() = %q, want link.toml", fi.Name())
+		}
+		if fi.Size() != 5 {
+			t.Fatalf("Size() = %d, want 5", fi.Size())
+		}
+		wantModTime := f.ModTimes["/city/target.toml"]
+		if wantModTime.IsZero() {
+			t.Fatal("expected Stat to synthesize and store target mod time")
+		}
+		if !fi.ModTime().Equal(wantModTime) {
+			t.Fatalf("ModTime() = %v, want %v", fi.ModTime(), wantModTime)
+		}
+	})
+
+	t.Run("dir", func(t *testing.T) {
+		f := NewFake()
+		f.Dirs["/city/rigs"] = true
+		f.Symlinks["/city/rig-link"] = "/city/rigs"
+
+		fi, err := f.Stat("/city/rig-link")
+		if err != nil {
+			t.Fatalf("Stat symlink to dir: %v", err)
+		}
+		if !fi.IsDir() {
+			t.Fatal("expected symlink to dir to report directory")
+		}
+	})
+
+	t.Run("missing target", func(t *testing.T) {
+		f := NewFake()
+		f.Symlinks["/city/missing-link"] = "/city/missing"
+
+		_, err := f.Stat("/city/missing-link")
+		if err == nil {
+			t.Fatal("expected error for missing symlink target")
+		}
+		if !os.IsNotExist(err) {
+			t.Fatalf("expected os.IsNotExist, got %v", err)
+		}
+	})
 }
 
 func TestFakeStatMissing(t *testing.T) {
@@ -128,6 +213,24 @@ func TestFakeWriteFile(t *testing.T) {
 	if len(f.Calls) != 1 || f.Calls[0].Method != "WriteFile" {
 		t.Errorf("Calls = %+v, want single WriteFile", f.Calls)
 	}
+	if f.ModTimes["/city/city.toml"].IsZero() {
+		t.Error("expected WriteFile to set a synthetic mod time")
+	}
+}
+
+func TestFakeWriteFileInitializesNilMaps(t *testing.T) {
+	f := &Fake{}
+
+	if err := f.WriteFile("/city/city.toml", []byte("hello"), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	if got := string(f.Files["/city/city.toml"]); got != "hello" {
+		t.Fatalf("Files content = %q, want %q", got, "hello")
+	}
+	if f.ModTimes["/city/city.toml"].IsZero() {
+		t.Fatal("expected WriteFile to initialize synthetic mod time")
+	}
 }
 
 func TestFakeWriteFileInitializesModes(t *testing.T) {
@@ -233,7 +336,10 @@ func TestFakeReadDirEmpty(t *testing.T) {
 
 func TestFakeRename(t *testing.T) {
 	f := NewFake()
-	f.Files["/city/beads.json.tmp"] = []byte(`{"seq":1}`)
+	if err := f.WriteFile("/city/beads.json.tmp", []byte(`{"seq":1}`), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+	oldModTime := f.ModTimes["/city/beads.json.tmp"]
 
 	if err := f.Rename("/city/beads.json.tmp", "/city/beads.json"); err != nil {
 		t.Fatalf("Rename: %v", err)
@@ -246,9 +352,12 @@ func TestFakeRename(t *testing.T) {
 	if string(f.Files["/city/beads.json"]) != `{"seq":1}` {
 		t.Errorf("new path content = %q, want %q", f.Files["/city/beads.json"], `{"seq":1}`)
 	}
+	if got := f.ModTimes["/city/beads.json"]; !got.Equal(oldModTime) {
+		t.Errorf("renamed file mod time = %v, want %v", got, oldModTime)
+	}
 
-	if len(f.Calls) != 1 || f.Calls[0].Method != "Rename" {
-		t.Errorf("Calls = %+v, want single Rename", f.Calls)
+	if len(f.Calls) != 2 || f.Calls[1].Method != "Rename" {
+		t.Errorf("Calls = %+v, want WriteFile then Rename", f.Calls)
 	}
 }
 
@@ -282,6 +391,33 @@ func TestFakeChmodInitializesModes(t *testing.T) {
 	}
 }
 
+func TestFakeRenameSymlink(t *testing.T) {
+	f := NewFake()
+	f.Symlinks["/city/beads-link"] = "/city/beads.json"
+
+	if err := f.Rename("/city/beads-link", "/city/beads-renamed"); err != nil {
+		t.Fatalf("Rename symlink: %v", err)
+	}
+	if _, ok := f.Symlinks["/city/beads-link"]; ok {
+		t.Fatal("old symlink path still exists after Rename")
+	}
+	if got := f.Symlinks["/city/beads-renamed"]; got != "/city/beads.json" {
+		t.Fatalf("renamed symlink target = %q, want /city/beads.json", got)
+	}
+}
+
+func TestFakeRenameSynthesizesModTimeWhenMissing(t *testing.T) {
+	f := NewFake()
+	f.Files["/city/beads.json.tmp"] = []byte(`{"seq":1}`)
+
+	if err := f.Rename("/city/beads.json.tmp", "/city/beads.json"); err != nil {
+		t.Fatalf("Rename without source modtime: %v", err)
+	}
+	if f.ModTimes["/city/beads.json"].IsZero() {
+		t.Fatal("expected Rename to synthesize a mod time when source mod time is missing")
+	}
+}
+
 func TestFakeRenameError(t *testing.T) {
 	f := NewFake()
 	injected := fmt.Errorf("cross-device link")
@@ -304,3 +440,67 @@ func TestFakeRenameMissing(t *testing.T) {
 		t.Errorf("expected os.IsNotExist, got: %v", err)
 	}
 }
+
+func TestFakeRemoveVariants(t *testing.T) {
+	t.Run("file removes modtime", func(t *testing.T) {
+		f := NewFake()
+		if err := f.WriteFile("/city/city.toml", []byte("hello"), 0o644); err != nil {
+			t.Fatalf("WriteFile: %v", err)
+		}
+
+		if err := f.Remove("/city/city.toml"); err != nil {
+			t.Fatalf("Remove file: %v", err)
+		}
+		if _, ok := f.Files["/city/city.toml"]; ok {
+			t.Fatal("file still exists after Remove")
+		}
+		if _, ok := f.ModTimes["/city/city.toml"]; ok {
+			t.Fatal("mod time still exists after Remove")
+		}
+	})
+
+	t.Run("dir", func(t *testing.T) {
+		f := NewFake()
+		f.Dirs["/city/.gc"] = true
+
+		if err := f.Remove("/city/.gc"); err != nil {
+			t.Fatalf("Remove dir: %v", err)
+		}
+		if f.Dirs["/city/.gc"] {
+			t.Fatal("dir still exists after Remove")
+		}
+	})
+
+	t.Run("symlink", func(t *testing.T) {
+		f := NewFake()
+		f.Symlinks["/city/link"] = "/city/target"
+
+		if err := f.Remove("/city/link"); err != nil {
+			t.Fatalf("Remove symlink: %v", err)
+		}
+		if _, ok := f.Symlinks["/city/link"]; ok {
+			t.Fatal("symlink still exists after Remove")
+		}
+	})
+}
+
+func TestFakeChmodVariants(t *testing.T) {
+	f := NewFake()
+	if err := f.WriteFile("/city/city.toml", []byte("hello"), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+	f.Dirs["/city/.gc"] = true
+	f.Symlinks["/city/link"] = "/city/city.toml"
+
+	for _, path := range []string{"/city/city.toml", "/city/.gc", "/city/link"} {
+		if err := f.Chmod(path, 0o600); err != nil {
+			t.Fatalf("Chmod(%s): %v", path, err)
+		}
+	}
+
+	if err := f.Chmod("/city/missing", 0o600); err == nil {
+		t.Fatal("expected error for missing path")
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("expected os.IsNotExist, got %v", err)
+	}
+}
diff --git a/internal/fsys/scaffold.go b/internal/fsys/scaffold.go
new file mode 100644
index 0000000000..fc62e17097
--- /dev/null
+++ b/internal/fsys/scaffold.go
@@ -0,0 +1,30 @@
+package fsys
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// OSScaffoldFS extends [OSFS] with tree-walking, symlink, and
+// recursive-remove operations needed by scaffold rollback.
+type OSScaffoldFS struct{ OSFS }
+
+// Walk delegates to [filepath.Walk].
+func (OSScaffoldFS) Walk(root string, fn filepath.WalkFunc) error {
+	return filepath.Walk(root, fn)
+}
+
+// Readlink delegates to [os.Readlink].
+func (OSScaffoldFS) Readlink(name string) (string, error) {
+	return os.Readlink(name)
+}
+
+// Symlink delegates to [os.Symlink].
+func (OSScaffoldFS) Symlink(oldname, newname string) error {
+	return os.Symlink(oldname, newname)
+}
+
+// RemoveAll delegates to [os.RemoveAll].
+func (OSScaffoldFS) RemoveAll(path string) error {
+	return os.RemoveAll(path)
+}
diff --git a/internal/git/git.go b/internal/git/git.go
index 271e655777..c43d2555e0 100644
--- a/internal/git/git.go
+++ b/internal/git/git.go
@@ -103,21 +103,43 @@ func (g *Git) HasUncommittedWork() bool {
 // HasUnpushedCommits reports whether HEAD has commits not reachable from
 // any remote tracking branch. Used as a safety check before removing a
 // worktree — unpushed commits represent completed work that would be lost.
+// If the probe fails, it returns true to fail closed.
 func (g *Git) HasUnpushedCommits() bool {
+	has, err := g.HasUnpushedCommitsResult()
+	if err != nil {
+		return true
+	}
+	return has
+}
+
+// HasUnpushedCommitsResult is like HasUnpushedCommits but preserves git
+// probe errors for callers that need to expose the precise failure reason.
+func (g *Git) HasUnpushedCommitsResult() (bool, error) {
 	out, err := g.run("log", "HEAD", "--oneline", "--not", "--remotes")
 	if err != nil {
-		return false // can't determine; assume clean
+		return false, fmt.Errorf("checking unpushed commits: %w", err)
 	}
-	return strings.TrimSpace(out) != ""
+	return strings.TrimSpace(out) != "", nil
 }
 
 // HasStashes reports whether the repository has stashed work.
+// If the probe fails, it returns true to fail closed.
 func (g *Git) HasStashes() bool {
+	has, err := g.HasStashesResult()
+	if err != nil {
+		return true
+	}
+	return has
+}
+
+// HasStashesResult is like HasStashes but preserves git probe errors for
+// callers that need to expose the precise failure reason.
+func (g *Git) HasStashesResult() (bool, error) {
 	out, err := g.run("stash", "list")
 	if err != nil {
-		return false // can't determine; assume clean
+		return false, fmt.Errorf("checking stashes: %w", err)
 	}
-	return strings.TrimSpace(out) != ""
+	return strings.TrimSpace(out) != "", nil
 }
 
 // SubmoduleInit initializes and updates submodules recursively.
diff --git a/internal/git/git_test.go b/internal/git/git_test.go
index c3afdee5e8..a9467d4872 100644
--- a/internal/git/git_test.go
+++ b/internal/git/git_test.go
@@ -192,6 +192,75 @@ func TestWorktreeList(t *testing.T) {
 	}
 }
 
+// TestWorktreeList_NestedSiblings verifies the algorithmic assumption used
+// by NestedWorktreePruneCheck: when worktree B is created at a path that
+// lies inside worktree A's working tree, git treats them as siblings in
+// the same admin dir. WorktreeList() from any of A, B, or the main repo
+// returns all three entries with each entry's true on-disk path.
+//
+// This is the foundation for "find nested worktrees" — we walk per-agent
+// homes, list siblings, and filter by path containment to identify nested
+// entries.
+func TestWorktreeList_NestedSiblings(t *testing.T) {
+	repo := initTestRepo(t)
+
+	// Outer worktree (the "agent home").
+	home := filepath.Join(t.TempDir(), "home")
+	runGit(t, repo, "worktree", "add", "-b", "home-branch", home)
+
+	// Nested worktree, path lies inside `home`. Equivalent to the polecat
+	// "$(pwd)/worktrees/<issue>" pattern from mol-polecat-work.toml.
+	nested := filepath.Join(home, "worktrees", "task-x")
+	runGit(t, home, "worktree", "add", "-b", "task-x-branch", nested)
+
+	// Listing from the home worktree returns all three siblings.
+	gHome := New(home)
+	wts, err := gHome.WorktreeList()
+	if err != nil {
+		t.Fatalf("WorktreeList from home: %v", err)
+	}
+	gotPaths := make(map[string]string)
+	for _, wt := range wts {
+		gotPaths[testutil.CanonicalPath(wt.Path)] = wt.Branch
+	}
+
+	wantHome := testutil.CanonicalPath(home)
+	wantNested := testutil.CanonicalPath(nested)
+	wantRepo := testutil.CanonicalPath(repo)
+
+	if _, ok := gotPaths[wantHome]; !ok {
+		t.Errorf("home worktree %q missing from list; got %v", wantHome, gotPaths)
+	}
+	if br := gotPaths[wantNested]; br != "task-x-branch" {
+		t.Errorf("nested worktree branch = %q (path %q), want task-x-branch; full list: %v",
+			br, wantNested, gotPaths)
+	}
+	if _, ok := gotPaths[wantRepo]; !ok {
+		t.Errorf("main repo %q missing from list; got %v", wantRepo, gotPaths)
+	}
+
+	// Listing from inside the nested worktree must produce the same set.
+	gNested := New(nested)
+	wts2, err := gNested.WorktreeList()
+	if err != nil {
+		t.Fatalf("WorktreeList from nested: %v", err)
+	}
+	if len(wts2) != len(wts) {
+		t.Errorf("WorktreeList from nested returned %d entries; from home returned %d (must match)",
+			len(wts2), len(wts))
+	}
+
+	// Path containment is the discriminator the doctor check uses to
+	// classify "nested" vs "agent home" vs "main repo". Verify it works
+	// on canonical paths.
+	if !strings.HasPrefix(wantNested+string(filepath.Separator), wantHome+string(filepath.Separator)) {
+		t.Errorf("nested path %q is not a strict subpath of home %q", wantNested, wantHome)
+	}
+	if strings.HasPrefix(wantHome+string(filepath.Separator), wantNested+string(filepath.Separator)) {
+		t.Errorf("home %q must not be classified as inside nested %q", wantHome, wantNested)
+	}
+}
+
 func TestHasUncommittedWork_Clean(t *testing.T) {
 	repo := initTestRepo(t)
 	g := New(repo)
@@ -263,6 +332,18 @@ func TestHasUnpushedCommits_NoRemote(t *testing.T) {
 	}
 }
 
+func TestHasUnpushedCommitsResult_ReturnsProbeError(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("GIT_CEILING_DIRECTORIES", filepath.Dir(dir))
+	g := New(dir)
+	if _, err := g.HasUnpushedCommitsResult(); err == nil {
+		t.Fatal("HasUnpushedCommitsResult() error = nil, want probe error")
+	}
+	if !g.HasUnpushedCommits() {
+		t.Error("HasUnpushedCommits() should fail closed on probe errors")
+	}
+}
+
 func TestHasStashes_NoneWhenClean(t *testing.T) {
 	repo := initTestRepo(t)
 	g := New(repo)
@@ -286,6 +367,18 @@ func TestHasStashes_DetectsStash(t *testing.T) {
 	}
 }
 
+func TestHasStashesResult_ReturnsProbeError(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("GIT_CEILING_DIRECTORIES", filepath.Dir(dir))
+	g := New(dir)
+	if _, err := g.HasStashesResult(); err == nil {
+		t.Fatal("HasStashesResult() error = nil, want probe error")
+	}
+	if !g.HasStashes() {
+		t.Error("HasStashes() should fail closed on probe errors")
+	}
+}
+
 func TestFetch(t *testing.T) {
 	// Create a bare remote and clone it.
 	bare := t.TempDir()
diff --git a/internal/graphroute/graphroute.go b/internal/graphroute/graphroute.go
index 6f43af4f10..72c51613af 100644
--- a/internal/graphroute/graphroute.go
+++ b/internal/graphroute/graphroute.go
@@ -148,6 +148,25 @@ func ApplyGraphRouteBinding(step *formula.RecipeStep, binding GraphRouteBinding)
 	step.Assignee = binding.SessionName
 }
 
+// ApplyGraphControlRouteBinding routes control steps directly to the
+// control-dispatcher session when possible. gc.routed_to intentionally means
+// "work for this config queue"; using it for a named dispatcher would create
+// config-routed work instead of delivering to the known dispatcher session.
+func ApplyGraphControlRouteBinding(step *formula.RecipeStep, binding GraphRouteBinding) {
+	if binding.DirectSessionID != "" {
+		delete(step.Metadata, "gc.routed_to")
+		step.Assignee = binding.DirectSessionID
+		return
+	}
+	if binding.SessionName != "" {
+		delete(step.Metadata, "gc.routed_to")
+		step.Assignee = binding.SessionName
+		return
+	}
+	delete(step.Metadata, "gc.routed_to")
+	step.Assignee = ""
+}
+
 // AssignGraphStepRoute applies routing to a step, optionally diverting
 // control steps to the control dispatcher.
 func AssignGraphStepRoute(step *formula.RecipeStep, executionBinding GraphRouteBinding, controlBinding *GraphRouteBinding) {
@@ -157,7 +176,7 @@ func AssignGraphStepRoute(step *formula.RecipeStep, executionBinding GraphRouteB
 		} else {
 			delete(step.Metadata, GraphExecutionRouteMetaKey)
 		}
-		ApplyGraphRouteBinding(step, *controlBinding)
+		ApplyGraphControlRouteBinding(step, *controlBinding)
 		return
 	}
 	delete(step.Metadata, GraphExecutionRouteMetaKey)
@@ -194,9 +213,6 @@ func ControlDispatcherBinding(store beads.Store, cityName string, cfg *config.Ci
 		return GraphRouteBinding{}, fmt.Errorf("control-dispatcher agent %q not found", config.ControlDispatcherAgentName)
 	}
 	binding := GraphRouteBinding{QualifiedName: agentCfg.QualifiedName()}
-	if agentutil.IsMultiSessionAgent(&agentCfg) {
-		return binding, nil
-	}
 	sn := agentutil.LookupSessionName(store, cityName, agentCfg.QualifiedName(), cfg.Workspace.SessionTemplate)
 	if sn == "" {
 		return GraphRouteBinding{}, fmt.Errorf("could not resolve session name for %q", agentCfg.QualifiedName())
diff --git a/internal/graphroute/graphroute_test.go b/internal/graphroute/graphroute_test.go
index 5af79249b9..2916c5ec50 100644
--- a/internal/graphroute/graphroute_test.go
+++ b/internal/graphroute/graphroute_test.go
@@ -367,6 +367,55 @@ func TestControlDispatcherBinding_NilResolver(t *testing.T) {
 	}
 }
 
+func TestControlDispatcherBinding_ConfiguredDispatcherUsesConcreteSessionName(t *testing.T) {
+	cfg := &config.City{Agents: []config.Agent{{
+		Name: "control-dispatcher",
+		Dir:  "gascity",
+	}}}
+
+	binding, err := ControlDispatcherBinding(nil, "test-city", cfg, "gascity", Deps{Resolver: testAgentResolver{}})
+	if err != nil {
+		t.Fatalf("ControlDispatcherBinding: %v", err)
+	}
+	if binding.QualifiedName != "gascity/control-dispatcher" {
+		t.Fatalf("QualifiedName = %q, want gascity/control-dispatcher", binding.QualifiedName)
+	}
+	if binding.SessionName != "gascity--control-dispatcher" {
+		t.Fatalf("SessionName = %q, want gascity--control-dispatcher", binding.SessionName)
+	}
+	if binding.MetadataOnly {
+		t.Fatalf("MetadataOnly = true, want false")
+	}
+}
+
+func TestAssignGraphStepRoute_ControlBindingUsesDirectAssigneeWithoutRoutedTo(t *testing.T) {
+	step := &formula.RecipeStep{
+		Metadata: map[string]string{
+			"gc.routed_to": "stale-control-route",
+		},
+	}
+	execution := GraphRouteBinding{
+		QualifiedName: "gascity/claude",
+		MetadataOnly:  true,
+	}
+	control := GraphRouteBinding{
+		QualifiedName: "gascity/control-dispatcher",
+		SessionName:   "gascity--control-dispatcher",
+	}
+
+	AssignGraphStepRoute(step, execution, &control)
+
+	if step.Assignee != "gascity--control-dispatcher" {
+		t.Fatalf("control assignee = %q, want gascity--control-dispatcher", step.Assignee)
+	}
+	if got := step.Metadata["gc.routed_to"]; got != "" {
+		t.Fatalf("control gc.routed_to = %q, want empty direct assignee", got)
+	}
+	if got := step.Metadata[GraphExecutionRouteMetaKey]; got != "gascity/claude" {
+		t.Fatalf("control execution route = %q, want gascity/claude", got)
+	}
+}
+
 func TestWorkflowExecutionRoute(t *testing.T) {
 	b := beads.Bead{Metadata: map[string]string{"gc.routed_to": "myrig/worker"}}
 	if got := WorkflowExecutionRoute(b); got != "myrig/worker" {
diff --git a/internal/hooks/config/claude.json b/internal/hooks/config/claude.json
index 04101f646d..c5e3ca48b3 100644
--- a/internal/hooks/config/claude.json
+++ b/internal/hooks/config/claude.json
@@ -19,7 +19,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc handoff \"context cycle\""
+            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc handoff --auto \"context cycle\""
           }
         ]
       }
@@ -38,17 +38,6 @@
           }
         ]
       }
-    ],
-    "Stop": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc hook --inject"
-          }
-        ]
-      }
     ]
   }
 }
diff --git a/internal/hooks/hooks.go b/internal/hooks/hooks.go
index 3e30b10804..b9f9176fe7 100644
--- a/internal/hooks/hooks.go
+++ b/internal/hooks/hooks.go
@@ -7,6 +7,7 @@ package hooks
 import (
 	"bytes"
 	"embed"
+	"encoding/json"
 	"errors"
 	"fmt"
 	iofs "io/fs"
@@ -150,10 +151,39 @@ func installOverlayManaged(fs fsys.FS, workDir, provider string) error {
 			return fmt.Errorf("reading %s: %w", name, err)
 		}
 		dst := filepath.Join(workDir, filepath.FromSlash(rel))
-		return writeEmbeddedManaged(fs, dst, data, nil)
+		if provider == "codex" && rel == path.Join(".codex", "hooks.json") {
+			return writeCodexHooksManaged(fs, dst, data)
+		}
+		return writeEmbeddedManaged(fs, dst, data, overlayManagedNeedsUpgrade(provider, rel))
 	})
 }
 
+func overlayManagedNeedsUpgrade(provider, rel string) func([]byte) bool {
+	if provider == "pi" && rel == path.Join(".pi", "extensions", "gc-hooks.js") {
+		return piHookNeedsUpgrade
+	}
+	return nil
+}
+
+func piHookNeedsUpgrade(existing []byte) bool {
+	content := string(existing)
+	if !strings.Contains(content, "Gas City hooks for Pi Coding Agent") {
+		return false
+	}
+	for _, marker := range []string{
+		"module.exports = {",
+		`"session.created"`,
+		`"session.compacted"`,
+		`"session.deleted"`,
+		`"experimental.chat.system.transform"`,
+	} {
+		if strings.Contains(content, marker) {
+			return true
+		}
+	}
+	return false
+}
+
 // installClaude writes the runtime settings file (.gc/settings.json) in the
 // city directory. The legacy hooks/claude.json file remains user-owned unless
 // gc can prove it is safe to update a stale generated copy.
@@ -318,6 +348,94 @@ func readClaudeSettingsCandidate(fs fsys.FS, path string) (claudeCandidateState,
 	return candidateUnreadable, nil, err
 }
 
+func writeCodexHooksManaged(fs fsys.FS, dst string, data []byte) error {
+	if existing, err := fs.ReadFile(dst); err == nil {
+		upgraded, changed, upgradeErr := upgradeCodexHookCommands(existing)
+		if upgradeErr != nil || !changed {
+			return nil
+		}
+		return writeManagedData(fs, dst, upgraded)
+	} else if _, statErr := fs.Stat(dst); statErr == nil {
+		return nil
+	}
+	return writeManagedData(fs, dst, data)
+}
+
+func writeManagedData(fs fsys.FS, dst string, data []byte) error {
+	dir := filepath.Dir(dst)
+	if err := fs.MkdirAll(dir, 0o755); err != nil {
+		return fmt.Errorf("creating %s: %w", dir, err)
+	}
+	if err := fs.WriteFile(dst, data, 0o644); err != nil {
+		return fmt.Errorf("writing %s: %w", dst, err)
+	}
+	return nil
+}
+
+func upgradeCodexHookCommands(existing []byte) ([]byte, bool, error) {
+	var root any
+	if err := json.Unmarshal(existing, &root); err != nil {
+		return nil, false, err
+	}
+	if !upgradeCodexHookValue(root) {
+		return nil, false, nil
+	}
+	data, err := json.MarshalIndent(root, "", "  ")
+	if err != nil {
+		return nil, false, err
+	}
+	return append(data, '\n'), true, nil
+}
+
+func upgradeCodexHookValue(v any) bool {
+	switch node := v.(type) {
+	case map[string]any:
+		changed := false
+		for key, val := range node {
+			if key == "command" {
+				if command, ok := val.(string); ok {
+					if upgraded, didUpgrade := upgradeCodexHookCommand(command); didUpgrade {
+						node[key] = upgraded
+						changed = true
+					}
+				}
+				continue
+			}
+			if upgradeCodexHookValue(val) {
+				changed = true
+			}
+		}
+		return changed
+	case []any:
+		changed := false
+		for _, elem := range node {
+			if upgradeCodexHookValue(elem) {
+				changed = true
+			}
+		}
+		return changed
+	default:
+		return false
+	}
+}
+
+func upgradeCodexHookCommand(command string) (string, bool) {
+	if strings.Contains(command, `--hook-format codex`) {
+		return "", false
+	}
+	for _, needle := range []string{
+		`gc prime --hook`,
+		`gc nudge drain --inject`,
+		`gc mail check --inject`,
+		`gc hook --inject`,
+	} {
+		if strings.Contains(command, needle) {
+			return strings.Replace(command, needle, needle+` --hook-format codex`, 1), true
+		}
+	}
+	return "", false
+}
+
 func writeManagedFile(fs fsys.FS, dst string, data []byte, policy writeManagedFilePolicy) error {
 	existing, readErr := fs.ReadFile(dst)
 	if readErr == nil && bytes.Equal(existing, data) {
@@ -359,7 +477,10 @@ func claudeFileNeedsUpgrade(existing []byte) bool {
 	}
 	transforms := []func(string) string{
 		func(s string) string {
-			return strings.Replace(s, `gc handoff \"context cycle\"`, `gc prime --hook`, 1)
+			return strings.Replace(s, `gc handoff --auto \"context cycle\"`, `gc handoff \"context cycle\"`, 1)
+		},
+		func(s string) string {
+			return strings.Replace(s, `gc handoff --auto \"context cycle\"`, `gc prime --hook`, 1)
 		},
 		func(s string) string {
 			return strings.Replace(s, `GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc prime --hook`, `gc prime --hook`, 1)
diff --git a/internal/hooks/hooks_test.go b/internal/hooks/hooks_test.go
index a5b8a84541..d80cee7c34 100644
--- a/internal/hooks/hooks_test.go
+++ b/internal/hooks/hooks_test.go
@@ -121,12 +121,15 @@ func TestInstallClaude(t *testing.T) {
 			return entries[0].Matcher
 		}())
 	}
-	if !strings.Contains(claudeHookCommand(t, runtimeData, "PreCompact"), `gc handoff "context cycle"`) {
-		t.Error("claude PreCompact hook should use gc handoff (not gc prime) to avoid context accumulation on compaction")
+	if !strings.Contains(claudeHookCommand(t, runtimeData, "PreCompact"), `gc handoff --auto "context cycle"`) {
+		t.Error("claude PreCompact hook should use gc handoff --auto (not gc prime or restart handoff) on compaction")
 	}
 	if !strings.Contains(s, "gc nudge drain --inject") {
 		t.Error("claude settings should contain gc nudge drain --inject")
 	}
+	if strings.Contains(s, "gc hook --inject") {
+		t.Error("fresh claude settings should not install no-op gc hook --inject")
+	}
 	if !strings.Contains(s, `"skipDangerousModePermissionPrompt": true`) {
 		t.Error("claude settings should contain skipDangerousModePermissionPrompt")
 	}
@@ -147,7 +150,7 @@ func TestInstallClaudeUpgradesStaleGeneratedFile(t *testing.T) {
 	// Build a realistic stale fixture: the embedded file stores the command
 	// as JSON, so the literal bytes contain escaped quotes. Matching that
 	// shape is what claudeFileNeedsUpgrade expects.
-	stale := strings.Replace(string(current), `gc handoff \"context cycle\"`, `gc prime --hook`, 1)
+	stale := strings.Replace(string(current), `gc handoff --auto \"context cycle\"`, `gc prime --hook`, 1)
 	if stale == string(current) {
 		t.Fatal("stale fixture did not diverge from current embedded config — check stale pattern")
 	}
@@ -160,7 +163,7 @@ func TestInstallClaudeUpgradesStaleGeneratedFile(t *testing.T) {
 
 	hookData := fs.Files["/city/hooks/claude.json"]
 	runtimeData := fs.Files["/city/.gc/settings.json"]
-	if !strings.Contains(claudeHookCommand(t, hookData, "PreCompact"), `gc handoff "context cycle"`) {
+	if !strings.Contains(claudeHookCommand(t, hookData, "PreCompact"), `gc handoff --auto "context cycle"`) {
 		t.Fatalf("upgraded claude hook missing gc handoff:\n%s", string(hookData))
 	}
 	if string(runtimeData) != string(hookData) {
@@ -168,6 +171,29 @@ func TestInstallClaudeUpgradesStaleGeneratedFile(t *testing.T) {
 	}
 }
 
+func TestInstallClaudeUpgradesRestartingPreCompactHandoff(t *testing.T) {
+	fs := fsys.NewFake()
+	current, err := readEmbedded("config/claude.json")
+	if err != nil {
+		t.Fatalf("readEmbedded: %v", err)
+	}
+	stale := strings.Replace(string(current), `gc handoff --auto \"context cycle\"`, `gc handoff \"context cycle\"`, 1)
+	if stale == string(current) {
+		t.Fatal("stale fixture did not diverge from current embedded config — check stale pattern")
+	}
+	fs.Files["/city/hooks/claude.json"] = []byte(stale)
+	fs.Files["/city/.gc/settings.json"] = []byte(stale)
+
+	if err := Install(fs, "/city", "/work", []string{"claude"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	hookData := fs.Files["/city/hooks/claude.json"]
+	if !strings.Contains(claudeHookCommand(t, hookData, "PreCompact"), `gc handoff --auto "context cycle"`) {
+		t.Fatalf("upgraded claude hook missing gc handoff --auto:\n%s", string(hookData))
+	}
+}
+
 func TestInstallClaudeUpgradesGeneratedFileMissingManagedSessionMarkers(t *testing.T) {
 	fs := fsys.NewFake()
 	current, err := readEmbedded("config/claude.json")
@@ -231,6 +257,61 @@ func TestInstallClaudeUpgradesGeneratedFileSessionStartMatcher(t *testing.T) {
 	}
 }
 
+func TestInstallCodexUpgradesGeneratedFileMissingHookFormat(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/work/.codex/hooks.json"] = []byte(`{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc prime --hook"
+      }]
+    }]
+  }
+}`)
+
+	if err := Install(fs, "/city", "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	got := string(fs.Files["/work/.codex/hooks.json"])
+	if !strings.Contains(got, "--hook-format codex") {
+		t.Errorf("upgraded codex hooks missing Codex hook output format:\n%s", got)
+	}
+}
+
+func TestInstallCodexUpgradePreservesCustomHooks(t *testing.T) {
+	fs := fsys.NewFake()
+	fs.Files["/work/.codex/hooks.json"] = []byte(`{
+  "hooks": {
+    "SessionStart": [{
+      "hooks": [{
+        "type": "command",
+        "command": "export PATH=\"$HOME/go/bin:$HOME/.local/bin:$PATH\" && gc prime --hook"
+      }]
+    }],
+    "UserPromptSubmit": [{
+      "hooks": [{
+        "type": "command",
+        "command": "printf custom-codex-hook"
+      }]
+    }]
+  }
+}`)
+
+	if err := Install(fs, "/city", "/work", []string{"codex"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	got := string(fs.Files["/work/.codex/hooks.json"])
+	if !strings.Contains(got, "--hook-format codex") {
+		t.Errorf("upgraded codex hooks missing Codex hook output format:\n%s", got)
+	}
+	if !strings.Contains(got, "printf custom-codex-hook") {
+		t.Errorf("custom codex hook was not preserved:\n%s", got)
+	}
+}
+
 func TestInstallClaudeUpgradesGeneratedFileWithCombinedKnownDrift(t *testing.T) {
 	fs := fsys.NewFake()
 	current, err := readEmbedded("config/claude.json")
@@ -277,7 +358,7 @@ func TestInstallClaudeUpgradesGeneratedFileWithAllKnownDrift(t *testing.T) {
 	if err != nil {
 		t.Fatalf("readEmbedded: %v", err)
 	}
-	stale := strings.Replace(string(current), `gc handoff \"context cycle\"`, `gc prime --hook`, 1)
+	stale := strings.Replace(string(current), `gc handoff --auto \"context cycle\"`, `gc prime --hook`, 1)
 	stale = strings.Replace(stale, `GC_MANAGED_SESSION_HOOK=1 GC_HOOK_EVENT_NAME=SessionStart gc prime --hook`, `gc prime --hook`, 1)
 	stale = strings.Replace(stale, `"matcher": "startup"`, `"matcher": ""`, 1)
 	if stale == string(current) {
@@ -307,7 +388,7 @@ func TestInstallClaudeUpgradesGeneratedFileWithAllKnownDrift(t *testing.T) {
 			return entries[0].Matcher
 		}())
 	}
-	if !strings.Contains(claudeHookCommand(t, hookData, "PreCompact"), `gc handoff "context cycle"`) {
+	if !strings.Contains(claudeHookCommand(t, hookData, "PreCompact"), `gc handoff --auto "context cycle"`) {
 		t.Fatalf("upgraded all-drift PreCompact hook missing gc handoff:\n%s", string(hookData))
 	}
 	if string(runtimeData) != string(hookData) {
@@ -684,6 +765,93 @@ func TestInstallOverlayManagedProviders(t *testing.T) {
 			t.Errorf("expected overlay-managed provider file %s to be written", rel)
 		}
 	}
+	codexHooks := string(fs.Files["/work/.codex/hooks.json"])
+	if !strings.Contains(codexHooks, "--hook-format codex") {
+		t.Error("codex hooks should request Codex hook output format")
+	}
+	for _, rel := range []string{
+		"/work/.codex/hooks.json",
+		"/work/.gemini/settings.json",
+		"/work/.opencode/plugins/gascity.js",
+		"/work/.github/hooks/gascity.json",
+		"/work/.cursor/hooks.json",
+		"/work/.pi/extensions/gc-hooks.js",
+		"/work/.omp/hooks/gc-hook.ts",
+	} {
+		if strings.Contains(string(fs.Files[rel]), "gc hook --inject") {
+			t.Errorf("fresh overlay-managed provider file %s should not install no-op gc hook --inject", rel)
+		}
+	}
+}
+
+func TestInstallPiHookUsesCurrentExtensionAPI(t *testing.T) {
+	fs := fsys.NewFake()
+	if err := Install(fs, "/city", "/work", []string{"pi"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	data := string(fs.Files["/work/.pi/extensions/gc-hooks.js"])
+	for _, want := range []string{
+		"module.exports = function gascityPiExtension(pi)",
+		`pi.on("session_start"`,
+		`pi.on("session_compact"`,
+		`pi.on("before_agent_start"`,
+	} {
+		if !strings.Contains(data, want) {
+			t.Errorf("Pi hook missing current extension API marker %q:\n%s", want, data)
+		}
+	}
+	for _, legacy := range []string{
+		"module.exports = {",
+		`"session.created"`,
+		`"session.compacted"`,
+		`"session.deleted"`,
+		`"experimental.chat.system.transform"`,
+	} {
+		if strings.Contains(data, legacy) {
+			t.Errorf("Pi hook still contains legacy API marker %q:\n%s", legacy, data)
+		}
+	}
+}
+
+func TestInstallPiHookUpgradesLegacyObjectExport(t *testing.T) {
+	fs := fsys.NewFake()
+	legacy := []byte(`// Gas City hooks for Pi Coding Agent.
+module.exports = {
+  name: "gascity",
+  events: { "session.created": () => "" },
+  hooks: { "experimental.chat.system.transform": (system) => system },
+};
+`)
+	fs.Files["/work/.pi/extensions/gc-hooks.js"] = legacy
+
+	if err := Install(fs, "/city", "/work", []string{"pi"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+
+	data := string(fs.Files["/work/.pi/extensions/gc-hooks.js"])
+	if data == string(legacy) {
+		t.Fatal("legacy Pi object-export hook was preserved; expected managed upgrade")
+	}
+	if !strings.Contains(data, `pi.on("session_start"`) {
+		t.Fatalf("upgraded Pi hook does not use current extension API:\n%s", data)
+	}
+}
+
+func TestInstallPiHookPreservesUserAuthoredFile(t *testing.T) {
+	fs := fsys.NewFake()
+	custom := []byte(`module.exports = function customPiExtension(pi) {
+  pi.on("session_start", () => {});
+};
+`)
+	fs.Files["/work/.pi/extensions/gc-hooks.js"] = custom
+
+	if err := Install(fs, "/city", "/work", []string{"pi"}); err != nil {
+		t.Fatalf("Install: %v", err)
+	}
+	if got := string(fs.Files["/work/.pi/extensions/gc-hooks.js"]); got != string(custom) {
+		t.Fatalf("user-authored Pi hook was overwritten:\n%s", got)
+	}
 }
 
 func TestInstallMultipleProviders(t *testing.T) {
diff --git a/internal/mail/beadmail/beadmail.go b/internal/mail/beadmail/beadmail.go
index c5f3bfe6fd..174b0859f5 100644
--- a/internal/mail/beadmail/beadmail.go
+++ b/internal/mail/beadmail/beadmail.go
@@ -5,25 +5,82 @@ package beadmail
 
 import (
 	"crypto/rand"
+	"errors"
 	"fmt"
-	"sort"
+	"log"
 	"strconv"
 	"strings"
+	"sync"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/mail"
+	"github.com/gastownhall/gascity/internal/session"
+)
+
+const (
+	fromSessionIDMetadataKey = mail.FromSessionIDMetadataKey
+	fromDisplayMetadataKey   = mail.FromDisplayMetadataKey
+	toSessionIDMetadataKey   = mail.ToSessionIDMetadataKey
+	toDisplayMetadataKey     = mail.ToDisplayMetadataKey
 )
 
 // Provider implements [mail.Provider] using [beads.Store] as the backend.
 type Provider struct {
-	store beads.Store
+	store        beads.Store
+	sessionCache *sessionBeadCache
+}
+
+type sessionBeadCache struct {
+	mu      sync.Mutex
+	list    []beads.Bead
+	fetched bool
 }
 
 // New returns a beadmail provider backed by the given store.
+//
+// The default provider is stateless so long-lived shared users such as the API
+// always see fresh session topology.
 func New(store beads.Store) *Provider {
 	return &Provider{store: store}
 }
 
+// NewCached returns a beadmail provider backed by the given store with a
+// provider-local session enumeration cache for command-scoped reuse.
+func NewCached(store beads.Store) *Provider {
+	return &Provider{
+		store:        store,
+		sessionCache: &sessionBeadCache{},
+	}
+}
+
+// cachedSessionBeads returns the full set of session beads (open + closed).
+// Cached providers reuse a single enumeration; stateless providers fetch
+// fresh results on every call.
+func (p *Provider) cachedSessionBeads() ([]beads.Bead, error) {
+	if p.store == nil {
+		return nil, nil
+	}
+	if p.sessionCache == nil {
+		return p.store.List(beads.ListQuery{Label: session.LabelSession, IncludeClosed: true})
+	}
+	return p.sessionCache.get(p.store)
+}
+
+func (c *sessionBeadCache) get(store beads.Store) ([]beads.Bead, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.fetched {
+		return c.list, nil
+	}
+	list, err := store.List(beads.ListQuery{Label: session.LabelSession, IncludeClosed: true})
+	if err != nil {
+		return nil, err
+	}
+	c.list = list
+	c.fetched = true
+	return list, nil
+}
+
 // Send creates a message bead with subject in Title and body in Description.
 // Returns an error if to is empty: blank recipients produce messages that never
 // appear in any inbox but still inflate global counts.
@@ -31,6 +88,10 @@ func (p *Provider) Send(from, to, subject, body string) (mail.Message, error) {
 	if to == "" {
 		return mail.Message{}, fmt.Errorf("beadmail send: recipient is required")
 	}
+	from, metadata, err := p.resolveSenderRoute(from)
+	if err != nil {
+		return mail.Message{}, fmt.Errorf("beadmail send: %w", err)
+	}
 	threadID := generateThreadID()
 	labels := []string{"thread:" + threadID}
 
@@ -49,6 +110,7 @@ func (p *Provider) Send(from, to, subject, body string) (mail.Message, error) {
 		Assignee:    to,
 		From:        from,
 		Labels:      labels,
+		Metadata:    metadata,
 	})
 	if err != nil {
 		return mail.Message{}, fmt.Errorf("beadmail send: %w", err)
@@ -56,6 +118,47 @@ func (p *Provider) Send(from, to, subject, body string) (mail.Message, error) {
 	return beadToMessage(b), nil
 }
 
+func (p *Provider) resolveSenderRoute(from string) (string, map[string]string, error) {
+	from = strings.TrimSpace(from)
+	if from == "" || from == "human" || p.store == nil {
+		return from, nil, nil
+	}
+	sessionID, err := session.ResolveSessionID(p.store, from)
+	if err != nil {
+		if errors.Is(err, session.ErrSessionNotFound) || errors.Is(err, session.ErrAmbiguous) {
+			return from, nil, nil
+		}
+		return "", nil, fmt.Errorf("resolving sender %q: %w", from, err)
+	}
+	b, err := p.store.Get(sessionID)
+	if err != nil {
+		return "", nil, fmt.Errorf("loading sender session %q: %w", sessionID, err)
+	}
+	display := senderDisplayAddress(b, from)
+	metadata := map[string]string{fromSessionIDMetadataKey: sessionID}
+	if display != "" {
+		metadata[fromDisplayMetadataKey] = display
+	}
+	return display, metadata, nil
+}
+
+func senderDisplayAddress(b beads.Bead, fallback string) string {
+	if alias := strings.TrimSpace(b.Metadata["alias"]); alias != "" {
+		return alias
+	}
+	fallback = strings.TrimSpace(fallback)
+	if fallback != "" && fallback != b.ID {
+		return fallback
+	}
+	if name := strings.TrimSpace(b.Metadata["session_name"]); name != "" {
+		return name
+	}
+	if b.ID != "" {
+		return b.ID
+	}
+	return fallback
+}
+
 // Inbox returns all unread messages for the recipient.
 func (p *Provider) Inbox(recipient string) ([]mail.Message, error) {
 	return p.filterMessages(recipient, false)
@@ -82,7 +185,10 @@ func (p *Provider) Read(id string) (mail.Message, error) {
 		return mail.Message{}, fmt.Errorf("beadmail read: %w", err)
 	}
 	if !hasLabel(b.Labels, "read") {
-		if err := p.store.Update(id, beads.UpdateOpts{Labels: []string{"read"}}); err != nil {
+		if err := p.store.Update(id, beads.UpdateOpts{
+			Labels:   []string{"read"},
+			Metadata: map[string]string{"mail.read": "true"},
+		}); err != nil {
 			return mail.Message{}, fmt.Errorf("beadmail read: marking as read: %w", err)
 		}
 	}
@@ -96,7 +202,10 @@ func (p *Provider) MarkRead(id string) error {
 	if _, err := p.store.Get(id); err != nil {
 		return fmt.Errorf("beadmail mark-read: %w", err)
 	}
-	return p.store.Update(id, beads.UpdateOpts{Labels: []string{"read"}})
+	return p.store.Update(id, beads.UpdateOpts{
+		Labels:   []string{"read"},
+		Metadata: map[string]string{"mail.read": "true"},
+	})
 }
 
 // MarkUnread marks a message as unread (removes "read" label).
@@ -104,7 +213,10 @@ func (p *Provider) MarkUnread(id string) error {
 	if _, err := p.store.Get(id); err != nil {
 		return fmt.Errorf("beadmail mark-unread: %w", err)
 	}
-	return p.store.Update(id, beads.UpdateOpts{RemoveLabels: []string{"read"}})
+	return p.store.Update(id, beads.UpdateOpts{
+		RemoveLabels: []string{"read"},
+		Metadata:     map[string]string{"mail.read": "false"},
+	})
 }
 
 // Archive closes a message bead without reading it.
@@ -130,6 +242,58 @@ func (p *Provider) Delete(id string) error {
 	return p.Archive(id)
 }
 
+// ArchiveMany archives a batch of messages, preserving per-id error
+// reporting that matches [Provider.Archive]: [mail.ErrAlreadyArchived] for
+// beads that were already closed, a wrapped store error for unknown ids,
+// and a non-message error for beads of the wrong type. Ids that need an
+// actual state transition are closed in a single [beads.Store.CloseAll]
+// round-trip; on batch failure the open subset falls back to per-id
+// [beads.Store.Close].
+func (p *Provider) ArchiveMany(ids []string) ([]mail.ArchiveResult, error) {
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	results := make([]mail.ArchiveResult, len(ids))
+	openIdx := make([]int, 0, len(ids))
+	openIDs := make([]string, 0, len(ids))
+	for i, id := range ids {
+		results[i].ID = id
+		b, err := p.store.Get(id)
+		if err != nil {
+			results[i].Err = fmt.Errorf("beadmail archive: %w", err)
+			continue
+		}
+		if b.Type != "message" {
+			results[i].Err = fmt.Errorf("beadmail archive: bead %s is not a message", id)
+			continue
+		}
+		if b.Status == "closed" {
+			results[i].Err = mail.ErrAlreadyArchived
+			continue
+		}
+		openIdx = append(openIdx, i)
+		openIDs = append(openIDs, id)
+	}
+	if len(openIDs) == 0 {
+		return results, nil
+	}
+	if _, err := p.store.CloseAll(openIDs, nil); err != nil {
+		for k, id := range openIDs {
+			if closeErr := p.store.Close(id); closeErr != nil {
+				results[openIdx[k]].Err = fmt.Errorf("beadmail archive: %w", closeErr)
+			}
+		}
+	}
+	return results, nil
+}
+
+// DeleteMany deletes a batch of messages by closing message beads. Beadmail
+// delete and archive have the same storage semantics, so this preserves the
+// batched [beads.Store.CloseAll] path from [Provider.ArchiveMany].
+func (p *Provider) DeleteMany(ids []string) ([]mail.ArchiveResult, error) {
+	return p.ArchiveMany(ids)
+}
+
 // All returns all open messages (read and unread) for the recipient.
 func (p *Provider) All(recipient string) ([]mail.Message, error) {
 	return p.filterMessages(recipient, true)
@@ -148,9 +312,31 @@ func (p *Provider) Reply(id, from, subject, body string) (mail.Message, error) {
 	if err != nil {
 		return mail.Message{}, fmt.Errorf("beadmail reply: %w", err)
 	}
-	if original.From == "" {
+	toSessionID := strings.TrimSpace(original.Metadata[fromSessionIDMetadataKey])
+	to := toSessionID
+	if to == "" {
+		to = strings.TrimSpace(original.From)
+	}
+	if to == "" {
 		return mail.Message{}, fmt.Errorf("beadmail reply: original message %s has no sender to reply to", id)
 	}
+	toDisplay := strings.TrimSpace(original.Metadata[fromDisplayMetadataKey])
+	if toDisplay == "" {
+		toDisplay = strings.TrimSpace(original.From)
+	}
+	from, metadata, err := p.resolveSenderRoute(from)
+	if err != nil {
+		return mail.Message{}, fmt.Errorf("beadmail reply: %w", err)
+	}
+	if metadata == nil {
+		metadata = make(map[string]string)
+	}
+	if toSessionID != "" {
+		metadata[toSessionIDMetadataKey] = toSessionID
+	}
+	if toDisplay != "" {
+		metadata[toDisplayMetadataKey] = toDisplay
+	}
 
 	threadID := extractLabel(original.Labels, "thread:")
 	if threadID == "" {
@@ -160,12 +346,13 @@ func (p *Provider) Reply(id, from, subject, body string) (mail.Message, error) {
 	labels := []string{"thread:" + threadID, "reply-to:" + id}
 
 	b, err := p.store.Create(beads.Bead{
-		Title:       subject,
+		Title:       deriveReplyTitle(subject, original.Title, body),
 		Description: body,
 		Type:        "message",
-		Assignee:    original.From, // reply goes back to sender
+		Assignee:    to, // reply goes back to sender
 		From:        from,
 		Labels:      labels,
+		Metadata:    metadata,
 	})
 	if err != nil {
 		return mail.Message{}, fmt.Errorf("beadmail reply: %w", err)
@@ -173,8 +360,54 @@ func (p *Provider) Reply(id, from, subject, body string) (mail.Message, error) {
 	return beadToMessage(b), nil
 }
 
+// deriveReplyTitle returns a non-empty title for a reply message. Callers
+// that go through bd create fail validation ("title is required") if the
+// reply's title is empty, so this fallback chain always returns a usable
+// string. Precedence: explicit subject → "Re: <original>" (deduped) →
+// first line of reply body → literal "(reply)".
+func deriveReplyTitle(subject, originalTitle, body string) string {
+	if subject != "" {
+		return subject
+	}
+	if originalTitle != "" {
+		trimmed := strings.TrimLeft(originalTitle, " \t")
+		if strings.HasPrefix(strings.ToLower(trimmed), "re:") {
+			return originalTitle
+		}
+		return "Re: " + originalTitle
+	}
+	snippet := strings.SplitN(body, "\n", 2)[0]
+	if len(snippet) > 80 {
+		snippet = snippet[:77] + "..."
+	}
+	if snippet != "" {
+		return snippet
+	}
+	return "(reply)"
+}
+
 // Thread returns all messages sharing a thread ID, ordered by creation time.
-func (p *Provider) Thread(threadID string) ([]mail.Message, error) {
+// Callers may pass either an actual thread ID or any message bead ID in the
+// thread — the latter is what `gc mail thread <id>` from the CLI hands us.
+// If the input resolves to an existing message bead with a `thread:` label,
+// that label is used; otherwise the input is treated as a thread ID directly
+// so callers that already know the thread ID still work.
+func (p *Provider) Thread(id string) ([]mail.Message, error) {
+	threadID := id
+	msgBead, err := p.store.Get(id)
+	switch {
+	case err == nil:
+		if msgBead.Type != "message" {
+			return nil, fmt.Errorf("beadmail thread: bead %q is type %q, want message", id, msgBead.Type)
+		}
+		if t := extractLabel(msgBead.Labels, "thread:"); t != "" {
+			threadID = t
+		}
+	case errors.Is(err, beads.ErrNotFound):
+		// Caller passed a non-bead-id (e.g., a real thread-id); fall through.
+	default:
+		return nil, fmt.Errorf("beadmail thread: resolving %q: %w", id, err)
+	}
 	bs, err := p.store.List(beads.ListQuery{
 		Label: "thread:" + threadID,
 		Type:  "message",
@@ -187,25 +420,37 @@ func (p *Provider) Thread(threadID string) ([]mail.Message, error) {
 	for i, b := range bs {
 		msgs[i] = beadToMessage(b)
 	}
-	// Sort by creation time ascending.
-	sort.Slice(msgs, func(i, j int) bool {
-		return msgs[i].CreatedAt.Before(msgs[j].CreatedAt)
-	})
+	// Note: store.List already sorts by SortCreatedAsc with an ID tie-break
+	// (see sortBeadsForQuery in internal/beads/query.go), so no post-sort here.
 	return msgs, nil
 }
 
 // Count returns (total, unread) message counts for a recipient.
 func (p *Provider) Count(recipient string) (int, int, error) {
-	candidates, err := p.messageCandidates(recipient)
+	total, unread, err := p.CountRecipients([]string{recipient})
 	if err != nil {
 		return 0, 0, fmt.Errorf("beadmail count: %w", err)
 	}
+	return total, unread, nil
+}
+
+// CountRecipients returns deduplicated total and unread counts for all recipient
+// routes represented by recipients.
+func (p *Provider) CountRecipients(recipients []string) (int, int, error) {
+	if len(recipients) == 0 {
+		return 0, 0, nil
+	}
+	routes := p.recipientRoutesForAll(recipients)
+	candidates, err := p.messageCandidatesForRoutes(routes)
+	if err != nil {
+		return 0, 0, fmt.Errorf("listing messages: %w", err)
+	}
 	var total, unread int
 	for _, b := range candidates {
 		if b.Status != "open" {
 			continue
 		}
-		if recipient != "" && b.Assignee != recipient {
+		if len(routes) > 0 && !matchesRecipientRoute(routes, b.Assignee) {
 			continue
 		}
 		total++
@@ -219,7 +464,8 @@ func (p *Provider) Count(recipient string) (int, int, error) {
 // filterMessages returns open message beads assigned to the recipient.
 // When includeRead is false, messages with the "read" label are excluded.
 func (p *Provider) filterMessages(recipient string, includeRead bool) ([]mail.Message, error) {
-	candidates, err := p.messageCandidates(recipient)
+	routes := p.recipientRoutes(recipient)
+	candidates, err := p.messageCandidatesForRoutes(routes)
 	if err != nil {
 		return nil, fmt.Errorf("beadmail: listing beads: %w", err)
 	}
@@ -228,7 +474,7 @@ func (p *Provider) filterMessages(recipient string, includeRead bool) ([]mail.Me
 		if b.Status != "open" {
 			continue
 		}
-		if recipient != "" && b.Assignee != recipient {
+		if len(routes) > 0 && !matchesRecipientRoute(routes, b.Assignee) {
 			continue
 		}
 		if !includeRead && hasLabel(b.Labels, "read") {
@@ -249,7 +495,199 @@ func (p *Provider) filterMessages(recipient string, includeRead bool) ([]mail.Me
 //
 // Type="message" is the authoritative discriminator; the legacy gc:message
 // label supplement was removed in #862 along with writes to that label.
-func (p *Provider) messageCandidates(recipient string) ([]beads.Bead, error) {
+func (p *Provider) recipientRoutes(recipient string) []string {
+	recipient = strings.TrimSpace(recipient)
+	if recipient == "" {
+		return nil
+	}
+	routes := make([]string, 0, 4)
+	routes = appendRecipientRoute(routes, recipient)
+	if recipient == "human" || p.store == nil {
+		return routes
+	}
+
+	liveMatches, err := p.recipientSessionMatchesByCurrentAddress(recipient, false)
+	if err != nil {
+		log.Printf("beadmail: listing sessions for recipient route %q: %v", recipient, err)
+		return routes
+	}
+	if len(liveMatches) > 1 {
+		return []string{recipient}
+	}
+	if len(liveMatches) == 1 {
+		return appendSessionRecipientRoutes(routes, liveMatches[0])
+	}
+
+	closedMatches, err := p.recipientSessionMatchesByCurrentAddress(recipient, true)
+	if err != nil {
+		log.Printf("beadmail: listing closed sessions for recipient route %q: %v", recipient, err)
+		return routes
+	}
+	if len(closedMatches) > 1 {
+		return []string{recipient}
+	}
+	if len(closedMatches) == 1 {
+		return appendSessionRecipientRoutes(routes, closedMatches[0])
+	}
+	return p.recipientRoutesByHistoricalAlias(recipient, routes)
+}
+
+func (p *Provider) recipientSessionMatchesByCurrentAddress(recipient string, closed bool) ([]beads.Bead, error) {
+	var matches []beads.Bead
+	b, err := p.store.Get(recipient)
+	if err == nil && session.IsSessionBeadOrRepairable(b) && sessionRouteStatusMatches(b, closed) {
+		session.RepairEmptyType(p.store, &b)
+		matches = appendUniqueSessionRecipientMatch(matches, b)
+	} else if err != nil && !errors.Is(err, beads.ErrNotFound) {
+		return nil, fmt.Errorf("looking up session %q: %w", recipient, err)
+	}
+
+	status := ""
+	if closed {
+		status = "closed"
+	}
+	for _, key := range []string{"alias", "session_name"} {
+		keyMatches, err := p.recipientSessionMatchesByMetadata(key, recipient, status)
+		if err != nil {
+			return nil, err
+		}
+		for _, match := range keyMatches {
+			matches = appendUniqueSessionRecipientMatch(matches, match)
+		}
+	}
+	return matches, nil
+}
+
+func (p *Provider) recipientSessionMatchesByMetadata(key, recipient, status string) ([]beads.Bead, error) {
+	query := beads.ListQuery{Metadata: map[string]string{key: recipient}}
+	if status != "" {
+		query.Status = status
+	}
+	items, err := p.store.List(query)
+	if err != nil {
+		return nil, err
+	}
+	matches := make([]beads.Bead, 0, len(items))
+	for _, b := range items {
+		if !session.IsSessionBeadOrRepairable(b) {
+			continue
+		}
+		session.RepairEmptyType(p.store, &b)
+		if !sessionRouteStatusMatches(b, status == "closed") {
+			continue
+		}
+		if strings.TrimSpace(b.Metadata[key]) != recipient {
+			continue
+		}
+		matches = append(matches, b)
+	}
+	return matches, nil
+}
+
+func sessionRouteStatusMatches(b beads.Bead, closed bool) bool {
+	if closed {
+		return b.Status == "closed"
+	}
+	return b.Status != "closed"
+}
+
+func appendUniqueSessionRecipientMatch(matches []beads.Bead, b beads.Bead) []beads.Bead {
+	for _, match := range matches {
+		if match.ID == b.ID {
+			return matches
+		}
+	}
+	return append(matches, b)
+}
+
+func appendSessionRecipientRoutes(routes []string, b beads.Bead) []string {
+	for _, address := range sessionAddressesForRecipientRouting(b) {
+		routes = appendRecipientRoute(routes, address)
+	}
+	return routes
+}
+
+func (p *Provider) recipientRoutesByHistoricalAlias(recipient string, routes []string) []string {
+	sessions, err := p.cachedSessionBeads()
+	if err != nil {
+		log.Printf("beadmail: listing sessions for historical recipient route %q: %v", recipient, err)
+		return routes
+	}
+	var liveMatches []beads.Bead
+	var closedMatches []beads.Bead
+	for _, b := range sessions {
+		if !session.IsSessionBeadOrRepairable(b) || !containsRecipientRoute(session.AliasHistory(b.Metadata), recipient) {
+			continue
+		}
+		if b.Status == "closed" {
+			closedMatches = append(closedMatches, b)
+			continue
+		}
+		liveMatches = append(liveMatches, b)
+	}
+	matches := liveMatches
+	if len(matches) == 0 {
+		matches = closedMatches
+	}
+	if len(matches) > 1 {
+		return []string{recipient}
+	}
+	if len(matches) == 1 {
+		return appendSessionRecipientRoutes(routes, matches[0])
+	}
+	return routes
+}
+
+func (p *Provider) recipientRoutesForAll(recipients []string) []string {
+	var routes []string
+	for _, recipient := range recipients {
+		recipientRoutes := p.recipientRoutes(recipient)
+		for _, route := range recipientRoutes {
+			routes = appendRecipientRoute(routes, route)
+		}
+	}
+	return routes
+}
+
+func sessionAddressesForRecipientRouting(b beads.Bead) []string {
+	var routes []string
+	routes = appendRecipientRoute(routes, b.ID)
+	routes = appendRecipientRoute(routes, b.Metadata["alias"])
+	routes = appendRecipientRoute(routes, b.Metadata["session_name"])
+	for _, alias := range session.AliasHistory(b.Metadata) {
+		routes = appendRecipientRoute(routes, alias)
+	}
+	return routes
+}
+
+func appendRecipientRoute(routes []string, route string) []string {
+	route = strings.TrimSpace(route)
+	if route == "" || containsRecipientRoute(routes, route) {
+		return routes
+	}
+	return append(routes, route)
+}
+
+func containsRecipientRoute(routes []string, route string) bool {
+	route = strings.TrimSpace(route)
+	for _, candidate := range routes {
+		if candidate == route {
+			return true
+		}
+	}
+	return false
+}
+
+func matchesRecipientRoute(routes []string, assignee string) bool {
+	for _, route := range routes {
+		if assignee == route {
+			return true
+		}
+	}
+	return false
+}
+
+func (p *Provider) messageCandidatesForRoutes(routes []string) ([]beads.Bead, error) {
 	seen := make(map[string]beads.Bead)
 	order := make([]string, 0)
 	add := func(bs []beads.Bead) {
@@ -265,16 +703,18 @@ func (p *Provider) messageCandidates(recipient string) ([]beads.Bead, error) {
 	}
 
 	// Primary: targeted query scoped to recipient.
-	if recipient != "" {
-		assigned, err := p.store.List(beads.ListQuery{
-			Assignee: recipient,
-			Type:     "message",
-			Status:   "open",
-		})
-		if err != nil {
-			return nil, fmt.Errorf("listing by assignee: %w", err)
+	if len(routes) > 0 {
+		for _, route := range routes {
+			assigned, err := p.store.List(beads.ListQuery{
+				Assignee: route,
+				Type:     "message",
+				Status:   "open",
+			})
+			if err != nil {
+				return nil, fmt.Errorf("listing by assignee %q: %w", route, err)
+			}
+			add(assigned)
 		}
-		add(assigned)
 	} else {
 		// No recipient filter — use type-based query for global discovery.
 		all, err := p.store.List(beads.ListQuery{Type: "message"})
@@ -299,14 +739,29 @@ func isMessage(b beads.Bead) bool {
 
 // beadToMessage converts a bead to a mail.Message.
 func beadToMessage(b beads.Bead) mail.Message {
+	from := b.From
+	if display := strings.TrimSpace(b.Metadata[fromDisplayMetadataKey]); display != "" {
+		from = display
+	}
+	to := b.Assignee
+	if display := strings.TrimSpace(b.Metadata[toDisplayMetadataKey]); display != "" {
+		to = display
+	}
+	read := hasLabel(b.Labels, "read")
+	switch b.Metadata["mail.read"] {
+	case "true":
+		read = true
+	case "false":
+		read = false
+	}
 	return mail.Message{
 		ID:        b.ID,
-		From:      b.From,
-		To:        b.Assignee,
+		From:      from,
+		To:        to,
 		Subject:   b.Title,
 		Body:      b.Description,
 		CreatedAt: b.CreatedAt,
-		Read:      hasLabel(b.Labels, "read"),
+		Read:      read,
 		ThreadID:  extractLabel(b.Labels, "thread:"),
 		ReplyTo:   extractLabel(b.Labels, "reply-to:"),
 		Priority:  extractPriority(b.Labels),
diff --git a/internal/mail/beadmail/beadmail_bench_test.go b/internal/mail/beadmail/beadmail_bench_test.go
new file mode 100644
index 0000000000..d4b94407d2
--- /dev/null
+++ b/internal/mail/beadmail/beadmail_bench_test.go
@@ -0,0 +1,75 @@
+package beadmail
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// BenchmarkArchiveMany measures the cost of an N-message batch close
+// relative to N single-id Archive calls. Both paths run on a memstore so
+// the bench isolates the bookkeeping cost of per-id Archive (Get + type
+// check + Close) vs. per-id Get + one batch CloseAll for the open subset.
+// ArchiveMany pays a per-id Get to preserve [mail.ErrAlreadyArchived] and
+// non-message reporting parity with single-id Archive; the wall-clock win
+// on [BdStore] comes from collapsing N closes into one batched `bd close`
+// subprocess. Memstore only sees the in-process overhead, so the delta
+// here is modest. This bench exists primarily as a regression guard; the
+// real acceptance target is measured against BdStore, not memstore.
+func BenchmarkArchiveMany(b *testing.B) {
+	for _, n := range []int{20, 200} {
+		b.Run(benchName("ArchiveMany", n), func(b *testing.B) {
+			runArchiveManyBench(b, n, true)
+		})
+		b.Run(benchName("SingleIdLoop", n), func(b *testing.B) {
+			runArchiveManyBench(b, n, false)
+		})
+	}
+}
+
+func runArchiveManyBench(b *testing.B, n int, batch bool) {
+	b.Helper()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		b.StopTimer()
+		p, ids := benchSetup(b, n)
+		b.StartTimer()
+		if batch {
+			if _, err := p.ArchiveMany(ids); err != nil {
+				b.Fatalf("ArchiveMany: %v", err)
+			}
+			continue
+		}
+		for _, id := range ids {
+			if err := p.Archive(id); err != nil {
+				b.Fatalf("Archive %s: %v", id, err)
+			}
+		}
+	}
+}
+
+func benchSetup(b *testing.B, n int) (*Provider, []string) {
+	b.Helper()
+	store := beads.NewMemStore()
+	p := New(store)
+	ids := make([]string, 0, n)
+	for i := 0; i < n; i++ {
+		m, err := p.Send("alice", "bob", "", "bench")
+		if err != nil {
+			b.Fatalf("Send: %v", err)
+		}
+		ids = append(ids, m.ID)
+	}
+	return p, ids
+}
+
+func benchName(base string, n int) string {
+	switch n {
+	case 20:
+		return base + "_N20"
+	case 200:
+		return base + "_N200"
+	default:
+		return base
+	}
+}
diff --git a/internal/mail/beadmail/beadmail_test.go b/internal/mail/beadmail/beadmail_test.go
index 51b93b97c4..0e8a3f86f2 100644
--- a/internal/mail/beadmail/beadmail_test.go
+++ b/internal/mail/beadmail/beadmail_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/mail"
+	"github.com/gastownhall/gascity/internal/session"
 )
 
 // noListScanStore errors when List is called without a filter, proving that
@@ -22,6 +23,18 @@ func (s noListScanStore) List(query beads.ListQuery) ([]beads.Bead, error) {
 	return s.MemStore.List(query)
 }
 
+type noBroadSessionRouteStore struct {
+	*beads.MemStore
+	t *testing.T
+}
+
+func (s noBroadSessionRouteStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == session.LabelSession && len(query.Metadata) == 0 {
+		s.t.Fatalf("recipient routing used broad session scan: %+v", query)
+	}
+	return s.MemStore.List(query)
+}
+
 func TestInboxDoesNotCallBroadList(t *testing.T) {
 	base := beads.NewMemStore()
 	p := New(noListScanStore{MemStore: base})
@@ -185,6 +198,172 @@ func TestSend(t *testing.T) {
 	}
 }
 
+func TestSendStoresStableSessionRouteWithoutChangingDisplaySender(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sender, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "gascity/workflows.codex-min-9",
+			"session_name": "workflows__codex-min-mc-sender",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+
+	msg, err := p.Send("gascity/workflows.codex-min-9", "human", "Approval", "please approve")
+	if err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	if msg.From != "gascity/workflows.codex-min-9" {
+		t.Fatalf("message From = %q, want display alias", msg.From)
+	}
+	b, err := store.Get(msg.ID)
+	if err != nil {
+		t.Fatalf("Get message: %v", err)
+	}
+	if b.From != "gascity/workflows.codex-min-9" {
+		t.Fatalf("bead From = %q, want display alias", b.From)
+	}
+	if b.Metadata[fromSessionIDMetadataKey] != sender.ID {
+		t.Fatalf("%s = %q, want %q", fromSessionIDMetadataKey, b.Metadata[fromSessionIDMetadataKey], sender.ID)
+	}
+	if b.Metadata[fromDisplayMetadataKey] != "gascity/workflows.codex-min-9" {
+		t.Fatalf("%s = %q, want original display alias", fromDisplayMetadataKey, b.Metadata[fromDisplayMetadataKey])
+	}
+}
+
+func TestReplyUsesStoredSenderSessionIDAfterAliasRename(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sender, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "old-sender",
+			"session_name": "sender-gc-42",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+	original, err := p.Send("old-sender", "human", "Approval", "please approve")
+	if err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+	if err := store.SetMetadataBatch(sender.ID, session.UpdatedAliasMetadata(sender.Metadata, "new-sender")); err != nil {
+		t.Fatalf("SetMetadataBatch(alias rename): %v", err)
+	}
+
+	reply, err := p.Reply(original.ID, "human", "approved", "approved")
+	if err != nil {
+		t.Fatalf("Reply: %v", err)
+	}
+	if reply.To != "old-sender" {
+		t.Fatalf("reply To = %q, want original display sender", reply.To)
+	}
+	b, err := store.Get(reply.ID)
+	if err != nil {
+		t.Fatalf("Get reply: %v", err)
+	}
+	if b.Assignee != sender.ID {
+		t.Fatalf("reply bead Assignee = %q, want stable sender session ID %q", b.Assignee, sender.ID)
+	}
+	if b.Metadata[toSessionIDMetadataKey] != sender.ID {
+		t.Fatalf("reply %s = %q, want %q", toSessionIDMetadataKey, b.Metadata[toSessionIDMetadataKey], sender.ID)
+	}
+	if b.Metadata[toDisplayMetadataKey] != "old-sender" {
+		t.Fatalf("reply %s = %q, want original display sender", toDisplayMetadataKey, b.Metadata[toDisplayMetadataKey])
+	}
+	inbox, err := p.Inbox("new-sender")
+	if err != nil {
+		t.Fatalf("Inbox(new-sender): %v", err)
+	}
+	if len(inbox) != 1 || inbox[0].ID != reply.ID {
+		t.Fatalf("Inbox(new-sender) = %#v, want reply %s", inbox, reply.ID)
+	}
+	oldInbox, err := p.Inbox("old-sender")
+	if err != nil {
+		t.Fatalf("Inbox(old-sender): %v", err)
+	}
+	if len(oldInbox) != 1 || oldInbox[0].ID != reply.ID {
+		t.Fatalf("Inbox(old-sender) = %#v, want reply %s", oldInbox, reply.ID)
+	}
+	total, unread, err := p.Count("new-sender")
+	if err != nil {
+		t.Fatalf("Count(new-sender): %v", err)
+	}
+	if total != 1 || unread != 1 {
+		t.Fatalf("Count(new-sender) = (%d, %d), want (1, 1)", total, unread)
+	}
+}
+
+func TestSendFallsBackToLiteralSenderWhenSessionIdentifierIsAmbiguous(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	for i := 0; i < 2; i++ {
+		if _, err := store.Create(beads.Bead{
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"alias": "duplicate",
+			},
+		}); err != nil {
+			t.Fatalf("Create session %d: %v", i, err)
+		}
+	}
+
+	msg, err := p.Send("duplicate", "human", "subject", "body")
+	if err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+	if msg.From != "duplicate" {
+		t.Fatalf("message From = %q, want literal ambiguous sender", msg.From)
+	}
+	b, err := store.Get(msg.ID)
+	if err != nil {
+		t.Fatalf("Get message: %v", err)
+	}
+	if b.Metadata[fromSessionIDMetadataKey] != "" {
+		t.Fatalf("ambiguous sender stored %s = %q, want empty", fromSessionIDMetadataKey, b.Metadata[fromSessionIDMetadataKey])
+	}
+}
+
+func TestInboxFallsBackToLiteralRecipientWhenSessionIdentifierIsAmbiguous(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	for i := 0; i < 2; i++ {
+		if _, err := store.Create(beads.Bead{
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"alias": "duplicate",
+			},
+		}); err != nil {
+			t.Fatalf("Create session %d: %v", i, err)
+		}
+	}
+	msg, err := p.Send("human", "duplicate", "subject", "body")
+	if err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	inbox, err := p.Inbox("duplicate")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(inbox) != 1 || inbox[0].ID != msg.ID {
+		t.Fatalf("Inbox = %#v, want literal recipient message %s", inbox, msg.ID)
+	}
+}
+
 func TestSendRejectsEmptyRecipient(t *testing.T) {
 	p := New(beads.NewMemStore())
 	if _, err := p.Send("human", "", "subject", "body"); err == nil {
@@ -561,6 +740,616 @@ func TestReply(t *testing.T) {
 	}
 }
 
+// TestReplyDerivesSubjectFromOriginal ensures an empty subject is replaced
+// with "Re: <original-subject>", so underlying stores that require a
+// non-empty title (e.g. BdStore → `bd create`) don't reject the reply.
+func TestReplyDerivesSubjectFromOriginal(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sent, err := p.Send("alice", "bob", "Hello", "first message")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	reply, err := p.Reply(sent.ID, "bob", "", "reply body")
+	if err != nil {
+		t.Fatalf("Reply with empty subject: %v", err)
+	}
+	if reply.Subject != "Re: Hello" {
+		t.Errorf("Reply Subject = %q, want %q", reply.Subject, "Re: Hello")
+	}
+}
+
+// TestReplyPreservesExplicitSubject ensures an explicit subject is passed
+// through unchanged — no automatic "Re:" prefixing.
+func TestReplyPreservesExplicitSubject(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sent, err := p.Send("alice", "bob", "Hello", "first message")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	reply, err := p.Reply(sent.ID, "bob", "Custom subject", "reply body")
+	if err != nil {
+		t.Fatalf("Reply: %v", err)
+	}
+	if reply.Subject != "Custom subject" {
+		t.Errorf("Reply Subject = %q, want %q", reply.Subject, "Custom subject")
+	}
+}
+
+// TestReplyAvoidsDoubleRePrefix ensures that replying to a message whose
+// subject already starts with "Re:" does not produce "Re: Re: ..." when
+// the caller omits the subject.
+func TestReplyAvoidsDoubleRePrefix(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sent, err := p.Send("alice", "bob", "Re: Hello", "body")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	reply, err := p.Reply(sent.ID, "bob", "", "reply body")
+	if err != nil {
+		t.Fatalf("Reply: %v", err)
+	}
+	if reply.Subject != "Re: Hello" {
+		t.Errorf("Reply Subject = %q, want %q (no double prefix)", reply.Subject, "Re: Hello")
+	}
+}
+
+// TestReplyFallsBackToBodyWhenOriginalTitleEmpty covers the degenerate case
+// where an original message somehow has no title (possible in stores that
+// don't enforce title). The reply still gets a non-empty title.
+func TestReplyFallsBackToBodyWhenOriginalTitleEmpty(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	// Create a message bead directly without a title.
+	orig, err := store.Create(beads.Bead{
+		Type:     "message",
+		Assignee: "bob",
+		From:     "alice",
+		Labels:   []string{"thread:t1"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	reply, err := p.Reply(orig.ID, "bob", "", "a terse reply body")
+	if err != nil {
+		t.Fatalf("Reply: %v", err)
+	}
+	if reply.Subject == "" {
+		t.Error("Reply Subject is empty; must be non-empty so bd create won't reject")
+	}
+	if reply.Subject != "a terse reply body" {
+		t.Errorf("Reply Subject = %q, want %q (first line of body)", reply.Subject, "a terse reply body")
+	}
+}
+
+// TestReplyAgainstBdStoreValidatesTitle is a regression test that exercises
+// the real BdStore code path: the fake runner emulates `bd create`'s
+// title-required validation. Without a derived title, Reply would fail here.
+func TestReplyAgainstBdStoreValidatesTitle(t *testing.T) {
+	// Fake runner that rejects `bd create` with empty positional title,
+	// the same way the real bd binary does.
+	runner := func(_ string, name string, args ...string) ([]byte, error) {
+		if name != "bd" {
+			return nil, errors.New("unexpected command: " + name)
+		}
+		switch args[0] {
+		case "create":
+			// args: create --json <title> -t <type> [flags...]
+			if len(args) < 3 {
+				return nil, errors.New("bd create: too few args")
+			}
+			title := args[2]
+			if title == "" {
+				return nil, errors.New(`exit status 1: {"error":"validation failed for issue : title is required"}`)
+			}
+			// Return a minimal issue JSON.
+			id := "bd-" + title
+			return []byte(`{"id":"` + id + `","title":"` + title + `","status":"open","issue_type":"message","created_at":"2026-04-24T00:00:00Z"}`), nil
+		case "show":
+			// bd show --json returns a JSON array.
+			return []byte(`[{"id":"bd-Hello","title":"Hello","status":"open","issue_type":"message","assignee":"bob","from":"alice","created_at":"2026-04-24T00:00:00Z","labels":["thread:t1"]}]`), nil
+		case "update":
+			return []byte(`{}`), nil
+		case "list":
+			return []byte(`[]`), nil
+		}
+		return nil, errors.New("unexpected bd subcommand: " + args[0])
+	}
+	p := New(beads.NewBdStore(t.TempDir(), runner))
+
+	// Reply with empty subject — must succeed because the provider derives
+	// "Re: Hello" from the original message.
+	reply, err := p.Reply("bd-Hello", "bob", "", "reply body")
+	if err != nil {
+		t.Fatalf("Reply should derive a non-empty title to pass bd validation: %v", err)
+	}
+	if reply.Subject != "Re: Hello" {
+		t.Errorf("Reply Subject = %q, want %q", reply.Subject, "Re: Hello")
+	}
+}
+
+func TestReplyPrefersStoredSenderSessionID(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sender, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "gascity/workflows.codex-min-9",
+			"session_name": "workflows__codex-min-mc-sender",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+	responder, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "gascity/workflows.codex-min-10",
+			"session_name": "workflows__codex-min-mc-responder",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create responder session: %v", err)
+	}
+	original, err := store.Create(beads.Bead{
+		Title:       "Approval needed",
+		Description: "please approve",
+		Type:        "message",
+		Assignee:    "human",
+		From:        "gascity/workflows.codex-min-9",
+		Labels:      []string{"thread:stable-route"},
+		Metadata: map[string]string{
+			fromSessionIDMetadataKey: sender.ID,
+			fromDisplayMetadataKey:   "gascity/workflows.codex-min-9",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create original message: %v", err)
+	}
+
+	reply, err := p.Reply(original.ID, "gascity/workflows.codex-min-10", "approved", "approved")
+	if err != nil {
+		t.Fatalf("Reply: %v", err)
+	}
+
+	if reply.To != "gascity/workflows.codex-min-9" {
+		t.Fatalf("reply To = %q, want sender display alias", reply.To)
+	}
+	if reply.From != "gascity/workflows.codex-min-10" {
+		t.Fatalf("reply From = %q, want display alias", reply.From)
+	}
+	b, err := store.Get(reply.ID)
+	if err != nil {
+		t.Fatalf("Get reply: %v", err)
+	}
+	if b.Metadata[fromSessionIDMetadataKey] != responder.ID {
+		t.Fatalf("reply %s = %q, want %q", fromSessionIDMetadataKey, b.Metadata[fromSessionIDMetadataKey], responder.ID)
+	}
+	if b.Metadata[fromDisplayMetadataKey] != "gascity/workflows.codex-min-10" {
+		t.Fatalf("reply %s = %q, want responder display alias", fromDisplayMetadataKey, b.Metadata[fromDisplayMetadataKey])
+	}
+	if b.Assignee != sender.ID {
+		t.Fatalf("reply bead Assignee = %q, want stable sender session ID %q", b.Assignee, sender.ID)
+	}
+	if b.Metadata[toSessionIDMetadataKey] != sender.ID {
+		t.Fatalf("reply %s = %q, want %q", toSessionIDMetadataKey, b.Metadata[toSessionIDMetadataKey], sender.ID)
+	}
+	if b.Metadata[toDisplayMetadataKey] != "gascity/workflows.codex-min-9" {
+		t.Fatalf("reply %s = %q, want sender display alias", toDisplayMetadataKey, b.Metadata[toDisplayMetadataKey])
+	}
+}
+
+func TestReplyToClosedSenderSessionIsDiscoverableByHistoricalAlias(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sender, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "gascity/workflows.codex-min-9",
+			"alias_history": "gascity/workflows.codex-min-8",
+			"session_name":  "workflows__codex-min-mc-sender",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create sender session: %v", err)
+	}
+	responder, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "gascity/workflows.codex-min-10",
+			"session_name": "workflows__codex-min-mc-responder",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create responder session: %v", err)
+	}
+	original, err := store.Create(beads.Bead{
+		Title:       "Approval needed",
+		Description: "please approve",
+		Type:        "message",
+		Assignee:    "human",
+		From:        "gascity/workflows.codex-min-8",
+		Labels:      []string{"thread:closed-sender-route"},
+		Metadata: map[string]string{
+			fromSessionIDMetadataKey: sender.ID,
+			fromDisplayMetadataKey:   "gascity/workflows.codex-min-8",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create original message: %v", err)
+	}
+	if err := store.Close(sender.ID); err != nil {
+		t.Fatalf("Close sender session: %v", err)
+	}
+
+	reply, err := p.Reply(original.ID, "gascity/workflows.codex-min-10", "approved", "approved")
+	if err != nil {
+		t.Fatalf("Reply: %v", err)
+	}
+	if reply.To != "gascity/workflows.codex-min-8" {
+		t.Fatalf("reply To = %q, want historical sender display alias", reply.To)
+	}
+	if reply.From != "gascity/workflows.codex-min-10" {
+		t.Fatalf("reply From = %q, want responder display alias", reply.From)
+	}
+	b, err := store.Get(reply.ID)
+	if err != nil {
+		t.Fatalf("Get reply: %v", err)
+	}
+	if b.Assignee != sender.ID {
+		t.Fatalf("reply bead Assignee = %q, want closed sender session ID %q", b.Assignee, sender.ID)
+	}
+	if b.Metadata[fromSessionIDMetadataKey] != responder.ID {
+		t.Fatalf("reply %s = %q, want %q", fromSessionIDMetadataKey, b.Metadata[fromSessionIDMetadataKey], responder.ID)
+	}
+
+	msgs, err := p.Inbox("gascity/workflows.codex-min-8")
+	if err != nil {
+		t.Fatalf("Inbox by historical alias: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox by historical alias returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != reply.ID {
+		t.Fatalf("Inbox by historical alias returned %s, want reply %s", msgs[0].ID, reply.ID)
+	}
+}
+
+func TestRecipientRoutesPreferLiveSessionOverClosedHistory(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	closed, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "old-worker",
+			"alias_history": "worker",
+			"session_name":  "workflows__codex-min-mc-old",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create closed session: %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("Close session: %v", err)
+	}
+	live, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "workflows__codex-min-mc-live",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create live session: %v", err)
+	}
+	closedReply, err := store.Create(beads.Bead{
+		Title:    "old reply",
+		Type:     "message",
+		Assignee: closed.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create closed reply: %v", err)
+	}
+	liveMail, err := store.Create(beads.Bead{
+		Title:    "live mail",
+		Type:     "message",
+		Assignee: live.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create live mail: %v", err)
+	}
+
+	msgs, err := p.Inbox("worker")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != liveMail.ID {
+		t.Fatalf("Inbox returned %s, want live message %s; closed reply was %s", msgs[0].ID, liveMail.ID, closedReply.ID)
+	}
+}
+
+func TestInboxByCurrentSessionAliasAvoidsBroadSessionScan(t *testing.T) {
+	store := noBroadSessionRouteStore{MemStore: beads.NewMemStore(), t: t}
+	p := New(store)
+
+	closed, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "old-worker",
+			"alias_history": "worker",
+			"session_name":  "workflows__codex-min-mc-old",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create closed session: %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("Close session: %v", err)
+	}
+	live, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "workflows__codex-min-mc-live",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create live session: %v", err)
+	}
+	closedReply, err := store.Create(beads.Bead{
+		Title:    "old reply",
+		Type:     "message",
+		Assignee: closed.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create closed reply: %v", err)
+	}
+	liveMail, err := store.Create(beads.Bead{
+		Title:    "live mail",
+		Type:     "message",
+		Assignee: live.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create live mail: %v", err)
+	}
+
+	msgs, err := p.Inbox("worker")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != liveMail.ID {
+		t.Fatalf("Inbox returned %s, want live message %s; closed reply was %s", msgs[0].ID, liveMail.ID, closedReply.ID)
+	}
+}
+
+func TestInboxByClosedCurrentSessionAliasAvoidsBroadSessionScan(t *testing.T) {
+	store := noBroadSessionRouteStore{MemStore: beads.NewMemStore(), t: t}
+	p := New(store)
+
+	closed, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "workflows__codex-min-mc-closed",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create closed session: %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("Close session: %v", err)
+	}
+	closedMail, err := store.Create(beads.Bead{
+		Title:    "closed mail",
+		Type:     "message",
+		Assignee: closed.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create closed mail: %v", err)
+	}
+
+	msgs, err := p.Inbox("worker")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != closedMail.ID {
+		t.Fatalf("Inbox returned %s, want closed mail %s", msgs[0].ID, closedMail.ID)
+	}
+}
+
+func TestInboxByHistoricalAliasFallsBackToSessionScan(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	live, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "new-worker",
+			"alias_history": "worker",
+			"session_name":  "workflows__codex-min-mc-live",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create live session: %v", err)
+	}
+	liveMail, err := store.Create(beads.Bead{
+		Title:    "live mail",
+		Type:     "message",
+		Assignee: live.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create live mail: %v", err)
+	}
+
+	msgs, err := p.Inbox("worker")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != liveMail.ID {
+		t.Fatalf("Inbox returned %s, want live message %s", msgs[0].ID, liveMail.ID)
+	}
+}
+
+func TestRecipientRoutesPreferCurrentAddressOverHistoricalAliasAmbiguity(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	historical, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "new-worker",
+			"alias_history": "worker",
+			"session_name":  "workflows__codex-min-mc-history",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create historical session: %v", err)
+	}
+	current, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "workflows__codex-min-mc-current",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create current session: %v", err)
+	}
+	historicalMail, err := store.Create(beads.Bead{
+		Title:    "historical mail",
+		Type:     "message",
+		Assignee: historical.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create historical mail: %v", err)
+	}
+	currentMail, err := store.Create(beads.Bead{
+		Title:    "current mail",
+		Type:     "message",
+		Assignee: current.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create current mail: %v", err)
+	}
+
+	msgs, err := p.Inbox("worker")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != currentMail.ID {
+		t.Fatalf("Inbox returned %s, want current mail %s; historical mail was %s", msgs[0].ID, currentMail.ID, historicalMail.ID)
+	}
+}
+
+func TestRecipientRoutesPreferClosedCurrentAddressOverLiveHistoricalAlias(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	liveHistorical, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "new-worker",
+			"alias_history": "worker",
+			"session_name":  "workflows__codex-min-mc-live",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create live historical session: %v", err)
+	}
+	closedCurrent, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "workflows__codex-min-mc-closed",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create closed current session: %v", err)
+	}
+	if err := store.Close(closedCurrent.ID); err != nil {
+		t.Fatalf("Close current session: %v", err)
+	}
+	liveMail, err := store.Create(beads.Bead{
+		Title:    "live historical mail",
+		Type:     "message",
+		Assignee: liveHistorical.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create live mail: %v", err)
+	}
+	closedMail, err := store.Create(beads.Bead{
+		Title:    "closed current mail",
+		Type:     "message",
+		Assignee: closedCurrent.ID,
+		From:     "human",
+	})
+	if err != nil {
+		t.Fatalf("Create closed mail: %v", err)
+	}
+
+	msgs, err := p.Inbox("worker")
+	if err != nil {
+		t.Fatalf("Inbox: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox returned %d messages, want 1", len(msgs))
+	}
+	if msgs[0].ID != closedMail.ID {
+		t.Fatalf("Inbox returned %s, want closed current mail %s; live historical mail was %s", msgs[0].ID, closedMail.ID, liveMail.ID)
+	}
+}
+
 // --- Thread ---
 
 func TestThread(t *testing.T) {
@@ -605,6 +1394,110 @@ func TestThreadEmpty(t *testing.T) {
 	}
 }
 
+// TestThreadAcceptsMessageIDOfOriginal locks in the fix for #1526. Callers
+// (notably `gc mail thread <id>` from cmd/gc/cmd_mail.go) pass a *message*
+// bead-ID, not the underlying thread-ID. Provider.Thread must resolve the
+// message-ID to its thread label and return the thread.
+func TestThreadAcceptsMessageIDOfOriginal(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sent, err := p.Send("alice", "bob", "Hello", "first")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := p.Reply(sent.ID, "bob", "Re: Hello", "second"); err != nil {
+		t.Fatal(err)
+	}
+
+	msgs, err := p.Thread(sent.ID)
+	if err != nil {
+		t.Fatalf("Thread(%q): %v", sent.ID, err)
+	}
+	if len(msgs) != 2 {
+		t.Fatalf("Thread(messageID) = %d messages, want 2", len(msgs))
+	}
+	if msgs[0].Body != "first" || msgs[1].Body != "second" {
+		t.Errorf("Thread(messageID) bodies = [%q, %q], want [first, second]", msgs[0].Body, msgs[1].Body)
+	}
+}
+
+// TestThreadSurfacesNonNotFoundStoreErrors verifies that a real store I/O
+// failure during message-id resolution propagates to the caller instead of
+// being silently swallowed as "treat input as thread-id".
+func TestThreadSurfacesNonNotFoundStoreErrors(t *testing.T) {
+	mem := beads.NewMemStore()
+	failing := &getErrorStore{MemStore: mem, getErr: errors.New("simulated I/O failure")}
+	p := New(failing)
+
+	_, err := p.Thread("anything")
+	if err == nil {
+		t.Fatal("Thread: expected error from underlying store, got nil")
+	}
+	if !strings.Contains(err.Error(), "simulated I/O failure") {
+		t.Errorf("Thread: error %q does not wrap underlying store error", err)
+	}
+}
+
+func TestThreadRejectsNonMessageBeadID(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+	task, err := store.Create(beads.Bead{
+		Title:  "not mail",
+		Type:   "task",
+		Labels: []string{"thread:looks-mail-like"},
+	})
+	if err != nil {
+		t.Fatalf("Create task: %v", err)
+	}
+
+	_, err = p.Thread(task.ID)
+	if err == nil {
+		t.Fatal("Thread(non-message bead ID): expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), `bead "`) || !strings.Contains(err.Error(), "want message") {
+		t.Fatalf("Thread(non-message bead ID) error = %q, want clear non-message diagnostic", err)
+	}
+}
+
+// getErrorStore returns a custom error from Get; List defers to MemStore.
+type getErrorStore struct {
+	*beads.MemStore
+	getErr error
+}
+
+func (s *getErrorStore) Get(_ string) (beads.Bead, error) {
+	return beads.Bead{}, s.getErr
+}
+
+// TestThreadAcceptsMessageIDOfReply ensures the resolution works regardless
+// of which message in the thread the caller hands us — the parent OR any
+// reply should both surface the full thread.
+func TestThreadAcceptsMessageIDOfReply(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+
+	sent, err := p.Send("alice", "bob", "Hello", "first")
+	if err != nil {
+		t.Fatal(err)
+	}
+	reply, err := p.Reply(sent.ID, "bob", "Re: Hello", "second")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	msgs, err := p.Thread(reply.ID)
+	if err != nil {
+		t.Fatalf("Thread(%q): %v", reply.ID, err)
+	}
+	if len(msgs) != 2 {
+		t.Fatalf("Thread(replyID) = %d messages, want 2", len(msgs))
+	}
+	if msgs[0].Body != "first" || msgs[1].Body != "second" {
+		t.Errorf("Thread(replyID) bodies = [%q, %q], want [first, second]", msgs[0].Body, msgs[1].Body)
+	}
+}
+
 // --- Count ---
 
 func TestCount(t *testing.T) {
@@ -639,6 +1532,22 @@ func TestCount(t *testing.T) {
 	}
 }
 
+func TestCountRecipientsEmptyDoesNotCountAllMessages(t *testing.T) {
+	store := beads.NewMemStore()
+	p := New(store)
+	if _, err := p.Send("human", "mayor", "", "msg"); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	total, unread, err := p.CountRecipients(nil)
+	if err != nil {
+		t.Fatalf("CountRecipients(nil): %v", err)
+	}
+	if total != 0 || unread != 0 {
+		t.Fatalf("CountRecipients(nil) = (%d,%d), want (0,0)", total, unread)
+	}
+}
+
 // --- Check ---
 
 func TestCheck(t *testing.T) {
@@ -673,6 +1582,111 @@ func TestCheck(t *testing.T) {
 	}
 }
 
+// --- Provider session-list cache (ga-q6ct) ---
+
+// countingSessionListStore counts broad gc:session List calls and forwards
+// the rest. Used to pin that Provider memoizes the gc:session enumeration
+// across multiple Inbox calls in a single command invocation.
+type countingSessionListStore struct {
+	*beads.MemStore
+	sessionListCalls int
+}
+
+func (s *countingSessionListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == session.LabelSession && len(query.Metadata) == 0 {
+		s.sessionListCalls++
+	}
+	return s.MemStore.List(query)
+}
+
+func TestProvider_DefaultProviderSeesNewHistoricalAliasSessionAcrossCalls(t *testing.T) {
+	// Pin: the default Provider is safe for long-lived shared use. If a lookup
+	// runs before the matching session exists, later lookups must see newly
+	// created sessions instead of reusing a stale provider-lifetime snapshot.
+	store := &countingSessionListStore{MemStore: beads.NewMemStore()}
+	p := New(store)
+
+	if _, err := p.Inbox("old-route"); err != nil {
+		t.Fatalf("initial Inbox(old-route): %v", err)
+	}
+
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "worker-a",
+			"alias_history": "old-route",
+			"session_name":  "wf__a",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create session: %v", err)
+	}
+	if _, err := p.Send("human", sessionBead.Metadata["alias"], "", "for old route"); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+
+	msgs, err := p.Inbox("old-route")
+	if err != nil {
+		t.Fatalf("second Inbox(old-route): %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("Inbox(old-route) = %d messages, want 1", len(msgs))
+	}
+	if msgs[0].Body != "for old route" {
+		t.Fatalf("Inbox(old-route) body = %q, want %q", msgs[0].Body, "for old route")
+	}
+	if store.sessionListCalls != 2 {
+		t.Errorf("broad gc:session List calls = %d, want 2 (default provider must refetch per call to avoid stale shared state)", store.sessionListCalls)
+	}
+}
+
+func TestProviderCached_BroadSessionListCachedAcrossInboxCalls(t *testing.T) {
+	// Pin: the command-scoped cached Provider still dedupes the broad
+	// historical-alias session scan within one provider lifetime.
+	store := &countingSessionListStore{MemStore: beads.NewMemStore()}
+
+	// Two live sessions with alias_history that includes the route we'll
+	// search for. AliasHistory lookup is the path that does the broad scan.
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "worker-a",
+			"alias_history": "old-route",
+			"session_name":  "wf__a",
+		},
+	}); err != nil {
+		t.Fatalf("Create session A: %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":         "worker-b",
+			"alias_history": "old-route-2",
+			"session_name":  "wf__b",
+		},
+	}); err != nil {
+		t.Fatalf("Create session B: %v", err)
+	}
+
+	p := NewCached(store)
+
+	// Exercise three independent Inbox calls that each force the
+	// alias-history fallback (no current alias matches "old-route" or
+	// "old-route-2"). Without the cache: 3 broad scans. With cache: 1.
+	for _, recipient := range []string{"old-route", "old-route-2", "old-route"} {
+		if _, err := p.Inbox(recipient); err != nil {
+			t.Fatalf("Inbox(%q): %v", recipient, err)
+		}
+	}
+
+	if store.sessionListCalls != 1 {
+		t.Errorf("broad gc:session List calls = %d, want 1 (Provider must cache the enumeration)", store.sessionListCalls)
+	}
+}
+
 // --- Compile-time interface check ---
 
 var _ mail.Provider = (*Provider)(nil)
diff --git a/internal/mail/exec/conformance_test.go b/internal/mail/exec/conformance_test.go
index eb9c6d21e1..feada70291 100644
--- a/internal/mail/exec/conformance_test.go
+++ b/internal/mail/exec/conformance_test.go
@@ -174,7 +174,11 @@ case "$op" in
     printf '{"id":"%s","from":"%s","to":"%s","subject":"%s","body":"%s","created_at":"%s","thread_id":"%s","reply_to":"%s"}\n' "$new_msgid" "$from" "$orig_from" "$subject" "$body" "$ts" "$orig_thread" "$msgid"
     ;;
   thread)
-    thread_id="$1"
+    id="$1"
+    thread_id="$id"
+    if [ -f "$STATE/messages/$id" ]; then
+      thread_id=$(sed -n '8p' "$STATE/messages/$id")
+    fi
     result=""
     for f in "$STATE"/messages/*; do
       [ -f "$f" ] || continue
diff --git a/internal/mail/exec/exec.go b/internal/mail/exec/exec.go
index bb78e8af51..d4c24016d1 100644
--- a/internal/mail/exec/exec.go
+++ b/internal/mail/exec/exec.go
@@ -115,6 +115,34 @@ func (p *Provider) Delete(id string) error {
 	return err
 }
 
+// ArchiveMany archives a batch by looping over [Provider.Archive].
+// The exec script protocol is single-id per invocation; a batch endpoint
+// would require a protocol extension that is out of scope here.
+func (p *Provider) ArchiveMany(ids []string) ([]mail.ArchiveResult, error) {
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	results := make([]mail.ArchiveResult, len(ids))
+	for i, id := range ids {
+		results[i] = mail.ArchiveResult{ID: id, Err: p.Archive(id)}
+	}
+	return results, nil
+}
+
+// DeleteMany deletes a batch by looping over [Provider.Delete].
+// The exec script protocol is single-id per invocation; a batch endpoint
+// would require a protocol extension that is out of scope here.
+func (p *Provider) DeleteMany(ids []string) ([]mail.ArchiveResult, error) {
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	results := make([]mail.ArchiveResult, len(ids))
+	for i, id := range ids {
+		results[i] = mail.ArchiveResult{ID: id, Err: p.Delete(id)}
+	}
+	return results, nil
+}
+
 // All delegates to: script all <recipient>
 func (p *Provider) All(recipient string) ([]mail.Message, error) {
 	p.ensureRunning()
@@ -155,10 +183,11 @@ func (p *Provider) Reply(id, from, subject, body string) (mail.Message, error) {
 	return unmarshalMessage(out)
 }
 
-// Thread delegates to: script thread <thread-id>
-func (p *Provider) Thread(threadID string) ([]mail.Message, error) {
+// Thread delegates to: script thread <id>, where id may be a thread ID or
+// any message ID in that thread.
+func (p *Provider) Thread(id string) ([]mail.Message, error) {
 	p.ensureRunning()
-	out, err := p.run(nil, "thread", threadID)
+	out, err := p.run(nil, "thread", id)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/mail/exec/mcp_conformance_test.go b/internal/mail/exec/mcp_conformance_test.go
index 7406aa1618..ce31969eb9 100644
--- a/internal/mail/exec/mcp_conformance_test.go
+++ b/internal/mail/exec/mcp_conformance_test.go
@@ -30,7 +30,7 @@ func TestMCPMailConformance(t *testing.T) {
 
 		// State directory for the mock curl.
 		stateDir := filepath.Join(dir, "state")
-		for _, sub := range []string{"agents", "messages"} {
+		for _, sub := range []string{"agents", "messages", "contacts"} {
 			if err := os.MkdirAll(filepath.Join(stateDir, sub), 0o755); err != nil {
 				t.Fatal(err)
 			}
@@ -81,7 +81,8 @@ func TestMCPMailBridgeSourceable(t *testing.T) {
 		`declare -f gc_to_mcp_name >/dev/null && ` +
 		`declare -f mcp_to_gc_name >/dev/null && ` +
 		`declare -f ensure_agent >/dev/null && ` +
-		`declare -f build_name_map_json >/dev/null`
+		`declare -f build_name_map_json >/dev/null && ` +
+		`declare -f ensure_contact >/dev/null`
 	cmd := osexec.Command("bash", "-c", check, "bash", scriptPath)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -117,7 +118,7 @@ func TestMCPMailCrossPodNameResolution(t *testing.T) {
 
 	// Shared mock MCP state — both "pods" talk to the same mock server.
 	stateDir := filepath.Join(dir, "state")
-	for _, sub := range []string{"agents", "messages"} {
+	for _, sub := range []string{"agents", "messages", "contacts"} {
 		if err := os.MkdirAll(filepath.Join(stateDir, sub), 0o755); err != nil {
 			t.Fatal(err)
 		}
@@ -210,7 +211,7 @@ func TestMCPMailProjectKeyIsolation(t *testing.T) {
 	// so both "pods" see each other's messages regardless of project value.
 	// This lets us isolate the cache-sharing behavior from mcp-side routing.
 	stateDir := filepath.Join(dir, "state")
-	for _, sub := range []string{"agents", "messages"} {
+	for _, sub := range []string{"agents", "messages", "contacts"} {
 		if err := os.MkdirAll(filepath.Join(stateDir, sub), 0o755); err != nil {
 			t.Fatal(err)
 		}
@@ -323,6 +324,7 @@ export GC_MCP_MAIL_PROJECT="` + projectKey + `"
 // mcpMockCurl returns a mock curl script that simulates mcp_agent_mail v0.3.0.
 // Matches the real API: ensure_project uses human_key, register_agent accepts
 // name+program+model, send_message returns deliveries format,
+// authenticated agent operations require the returned registration token,
 // acknowledge_message requires agent_name, get_message is removed.
 func mcpMockCurl(stateDir string) string {
 	return `#!/usr/bin/env bash
@@ -341,6 +343,39 @@ now_ts() {
   date -u "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "2026-02-28T12:00:00Z"
 }
 
+token_for() {
+  local name="$1"
+  printf 'token-%s' "$name"
+}
+
+require_token() {
+  local action="$1" name="$2" token="$3" param="$4"
+  if [ -z "$token" ] || [ "$token" != "$(token_for "$name")" ]; then
+    jq -n --arg action "$action" --arg name "$name" --arg param "$param" '{
+      jsonrpc: "2.0", id: 1,
+      error: {code: -32000, message: ($action + " requires " + $param + " for agent " + $name)}
+    }'
+    exit 0
+  fi
+}
+
+contact_file() {
+  local from="$1" to="$2"
+  printf '%s/contact-%s-%s' "$STATE_DIR/contacts" "$from" "$to"
+}
+
+require_contact() {
+  local from="$1" to="$2"
+  [ "$from" = "$to" ] && return 0
+  if [ ! -f "$(contact_file "$from" "$to")" ]; then
+    jq -n --arg from "$from" --arg to "$to" '{
+      jsonrpc: "2.0", id: 1,
+      error: {code: -32000, message: ("Contact approval required for recipients: " + $to + " from " + $from)}
+    }'
+    exit 0
+  fi
+}
+
 # Parse curl args to extract URL and data.
 url="" data=""
 while [ $# -gt 0 ]; do
@@ -372,10 +407,11 @@ if [[ "$url" == */mcp ]] && [ -n "$data" ]; then
       if [ -z "$name" ]; then
         name="AutoAgent$(next_id)"
       fi
+      token="$(token_for "$name")"
       echo "$name" > "$STATE_DIR/agents/$name"
-      jq -n --arg name "$name" '{
+      jq -n --arg name "$name" --arg token "$token" '{
         jsonrpc: "2.0", id: 1,
-        result: { content: [{type: "text", text: ({"id": 1, "name": $name, "program": "gc", "model": "agent"} | tojson)}] }
+        result: { content: [{type: "text", text: ({"id": 1, "name": $name, "program": "gc", "model": "agent", "registration_token": $token} | tojson)}] }
       }'
       ;;
 
@@ -390,7 +426,10 @@ if [[ "$url" == */mcp ]] && [ -n "$data" ]; then
     send_message)
       id=$(next_id)
       sender=$(echo "$args" | jq -r '.sender_name')
+      sender_token=$(echo "$args" | jq -r '.sender_token // empty')
+      require_token "send_message" "$sender" "$sender_token" "sender_token"
       to=$(echo "$args" | jq -r '.to[0]')
+      require_contact "$sender" "$to"
       subject=$(echo "$args" | jq -r '.subject')
       body_md=$(echo "$args" | jq -r '.body_md')
       ts=$(now_ts)
@@ -419,8 +458,28 @@ if [[ "$url" == */mcp ]] && [ -n "$data" ]; then
       }'
       ;;
 
+    macro_contact_handshake)
+      requester=$(echo "$args" | jq -r '.requester // .agent_name // empty')
+      target=$(echo "$args" | jq -r '.target // .to_agent // empty')
+      requester_token=$(echo "$args" | jq -r '.requester_registration_token // empty')
+      target_token=$(echo "$args" | jq -r '.target_registration_token // empty')
+      require_token "macro_contact_handshake requester approval" "$requester" "$requester_token" "requester_registration_token"
+      require_token "macro_contact_handshake target approval" "$target" "$target_token" "target_registration_token"
+      printf approved > "$(contact_file "$requester" "$target")"
+      jq -n --arg from "$requester" --arg to "$target" '{
+        jsonrpc: "2.0", id: 1,
+        result: { content: [{type: "text", text: ({
+          request: {from: $from, to: $to, status: "approved"},
+          response: {from: $from, to: $to, status: "approved"},
+          welcome_message: null
+        } | tojson)}] }
+      }'
+      ;;
+
     fetch_inbox)
       name=$(echo "$args" | jq -r '.agent_name')
+      registration_token=$(echo "$args" | jq -r '.registration_token // empty')
+      require_token "fetch_inbox" "$name" "$registration_token" "registration_token"
       include_bodies=$(echo "$args" | jq -r '.include_bodies // false')
       # Return ALL messages for this recipient (the script does local
       # read/archived filtering). mcp_agent_mail returns all messages too.
@@ -444,6 +503,9 @@ if [[ "$url" == */mcp ]] && [ -n "$data" ]; then
       ;;
 
     acknowledge_message)
+      name=$(echo "$args" | jq -r '.agent_name')
+      registration_token=$(echo "$args" | jq -r '.registration_token // empty')
+      require_token "acknowledge_message" "$name" "$registration_token" "registration_token"
       mid=$(echo "$args" | jq -r '.message_id')
       file="$STATE_DIR/messages/$mid.json"
       if [ ! -f "$file" ]; then
@@ -464,6 +526,9 @@ if [[ "$url" == */mcp ]] && [ -n "$data" ]; then
       ;;
 
     mark_message_read)
+      name=$(echo "$args" | jq -r '.agent_name')
+      registration_token=$(echo "$args" | jq -r '.registration_token // empty')
+      require_token "mark_message_read" "$name" "$registration_token" "registration_token"
       mid=$(echo "$args" | jq -r '.message_id')
       file="$STATE_DIR/messages/$mid.json"
       if [ ! -f "$file" ]; then
diff --git a/internal/mail/exec/mcp_live_test.go b/internal/mail/exec/mcp_live_test.go
index 5b9dc1a35a..a4c4ed0671 100644
--- a/internal/mail/exec/mcp_live_test.go
+++ b/internal/mail/exec/mcp_live_test.go
@@ -105,6 +105,7 @@ func startMCPServer(t *testing.T, serverURL string) {
 	}
 
 	cmd := osexec.Command(python, "-m", "mcp_agent_mail.http")
+	cmd.Dir = t.TempDir()
 	cmd.Stdout = os.Stderr // visible with -v
 	cmd.Stderr = os.Stderr
 	if err := cmd.Start(); err != nil {
diff --git a/internal/mail/fake.go b/internal/mail/fake.go
index e863da284b..e9520880d5 100644
--- a/internal/mail/fake.go
+++ b/internal/mail/fake.go
@@ -166,6 +166,32 @@ func (f *Fake) Delete(id string) error {
 	return f.Archive(id)
 }
 
+// ArchiveMany archives a batch of messages by looping over [Fake.Archive],
+// preserving per-id error reporting including [ErrAlreadyArchived].
+func (f *Fake) ArchiveMany(ids []string) ([]ArchiveResult, error) {
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	results := make([]ArchiveResult, len(ids))
+	for i, id := range ids {
+		results[i] = ArchiveResult{ID: id, Err: f.Archive(id)}
+	}
+	return results, nil
+}
+
+// DeleteMany deletes a batch of messages by looping over [Fake.Delete],
+// preserving per-id error reporting including [ErrAlreadyArchived].
+func (f *Fake) DeleteMany(ids []string) ([]ArchiveResult, error) {
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	results := make([]ArchiveResult, len(ids))
+	for i, id := range ids {
+		results[i] = ArchiveResult{ID: id, Err: f.Delete(id)}
+	}
+	return results, nil
+}
+
 // All returns all open messages (read and unread) for the recipient.
 func (f *Fake) All(recipient string) ([]Message, error) {
 	f.mu.Lock()
@@ -229,12 +255,20 @@ func (f *Fake) Reply(id, from, subject, body string) (Message, error) {
 }
 
 // Thread returns all messages sharing a thread ID, ordered by time.
-func (f *Fake) Thread(threadID string) ([]Message, error) {
+// id may be either the thread ID or any message ID in that thread.
+func (f *Fake) Thread(id string) ([]Message, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	if f.broken {
 		return nil, fmt.Errorf("mail provider unavailable")
 	}
+	threadID := id
+	for _, fm := range f.messages {
+		if fm.msg.ID == id {
+			threadID = fm.msg.ThreadID
+			break
+		}
+	}
 	var result []Message
 	for _, fm := range f.messages {
 		if fm.msg.ThreadID == threadID {
diff --git a/internal/mail/mail.go b/internal/mail/mail.go
index 3b46d8ffbc..35cc66b76e 100644
--- a/internal/mail/mail.go
+++ b/internal/mail/mail.go
@@ -16,6 +16,21 @@ var ErrAlreadyArchived = errors.New("already archived")
 // ErrNotFound is returned when a message ID does not exist.
 var ErrNotFound = errors.New("message not found")
 
+const (
+	// FromSessionIDMetadataKey stores the stable session bead ID used for
+	// reply routing when a message's display sender may later be renamed.
+	FromSessionIDMetadataKey = "mail.from_session_id"
+	// FromDisplayMetadataKey stores the human-readable sender captured when
+	// the message was created.
+	FromDisplayMetadataKey = "mail.from_display"
+	// ToSessionIDMetadataKey stores the stable recipient session bead ID used
+	// for routing replies while keeping the public To field human-readable.
+	ToSessionIDMetadataKey = "mail.to_session_id"
+	// ToDisplayMetadataKey stores the human-readable recipient captured when
+	// the message was created.
+	ToDisplayMetadataKey = "mail.to_display"
+)
+
 // Message represents a mail message between agents or humans.
 type Message struct {
 	ID        string    `json:"id"`
@@ -32,6 +47,14 @@ type Message struct {
 	Rig       string    `json:"rig,omitempty"`
 }
 
+// ArchiveResult is one message's outcome in a batch [Provider.ArchiveMany] or
+// [Provider.DeleteMany] call. Err is nil for a newly-closed message,
+// [ErrAlreadyArchived] for an idempotent re-close, or a provider error.
+type ArchiveResult struct {
+	ID  string
+	Err error
+}
+
 // Provider is the internal interface for mail backends. Implementations
 // include beadmail (built-in default backed by beads.Store) and exec
 // (user-supplied script via fork/exec).
@@ -59,9 +82,20 @@ type Provider interface {
 	// Archive closes a message bead (removes from all views).
 	Archive(id string) error
 
+	// ArchiveMany archives a batch of messages in one round-trip where the
+	// backend supports it, returning per-id results in input order.
+	// Implementations MUST preserve per-id error reporting.
+	ArchiveMany(ids []string) ([]ArchiveResult, error)
+
 	// Delete is an alias for Archive (closes the bead).
 	Delete(id string) error
 
+	// DeleteMany deletes a batch of messages in one round-trip where the
+	// backend supports it, returning per-id results in input order.
+	// Implementations MUST preserve delete semantics and per-id error
+	// reporting.
+	DeleteMany(ids []string) ([]ArchiveResult, error)
+
 	// Check returns unread messages without marking them read.
 	Check(recipient string) ([]Message, error)
 
@@ -70,7 +104,8 @@ type Provider interface {
 	Reply(id, from, subject, body string) (Message, error)
 
 	// Thread returns all messages sharing a thread ID, ordered by time.
-	Thread(threadID string) ([]Message, error)
+	// The id may be either the thread ID or any message ID in that thread.
+	Thread(id string) ([]Message, error)
 
 	// All returns all open messages (read and unread) for the recipient.
 	All(recipient string) ([]Message, error)
diff --git a/internal/mail/mailtest/conformance.go b/internal/mail/mailtest/conformance.go
index 22c93b865e..cfd8927ec7 100644
--- a/internal/mail/mailtest/conformance.go
+++ b/internal/mail/mailtest/conformance.go
@@ -405,6 +405,27 @@ func RunProviderTests(t *testing.T, newProvider func(t *testing.T) mail.Provider
 		}
 	})
 
+	t.Run("Thread_ReturnsAllForMessageID", func(t *testing.T) {
+		p := newProvider(t)
+		sent, err := p.Send("alice", "bob", "Hello", "first")
+		if err != nil {
+			t.Fatalf("Send: %v", err)
+		}
+		reply, err := p.Reply(sent.ID, "bob", "RE: Hello", "second")
+		if err != nil {
+			t.Fatalf("Reply: %v", err)
+		}
+		for _, id := range []string{sent.ID, reply.ID} {
+			msgs, err := p.Thread(id)
+			if err != nil {
+				t.Fatalf("Thread(%q): %v", id, err)
+			}
+			if len(msgs) != 2 {
+				t.Fatalf("Thread(%q) = %d messages, want 2", id, len(msgs))
+			}
+		}
+	})
+
 	t.Run("Thread_Empty", func(t *testing.T) {
 		p := newProvider(t)
 		msgs, err := p.Thread("nonexistent-thread")
@@ -516,6 +537,183 @@ func RunProviderTests(t *testing.T, newProvider func(t *testing.T) mail.Provider
 		}
 	})
 
+	t.Run("ArchiveMany_AllSucceed", func(t *testing.T) {
+		p := newProvider(t)
+		var ids []string
+		for i := 0; i < 3; i++ {
+			m, err := p.Send("alice", "bob", "", "batch")
+			if err != nil {
+				t.Fatalf("Send %d: %v", i, err)
+			}
+			ids = append(ids, m.ID)
+		}
+		results, err := p.ArchiveMany(ids)
+		if err != nil {
+			t.Fatalf("ArchiveMany: %v", err)
+		}
+		if len(results) != len(ids) {
+			t.Fatalf("results = %d, want %d", len(results), len(ids))
+		}
+		for i, r := range results {
+			if r.ID != ids[i] {
+				t.Errorf("results[%d].ID = %q, want %q", i, r.ID, ids[i])
+			}
+			if r.Err != nil {
+				t.Errorf("results[%d].Err = %v, want nil", i, r.Err)
+			}
+		}
+		msgs, err := p.Inbox("bob")
+		if err != nil {
+			t.Fatalf("Inbox: %v", err)
+		}
+		if len(msgs) != 0 {
+			t.Errorf("Inbox after ArchiveMany = %d, want 0", len(msgs))
+		}
+	})
+
+	t.Run("ArchiveMany_EmptyReturnsNil", func(t *testing.T) {
+		p := newProvider(t)
+		results, err := p.ArchiveMany(nil)
+		if err != nil {
+			t.Fatalf("ArchiveMany(nil): %v", err)
+		}
+		if len(results) != 0 {
+			t.Errorf("results = %d, want 0", len(results))
+		}
+	})
+
+	t.Run("ArchiveMany_PreservesInputOrder", func(t *testing.T) {
+		p := newProvider(t)
+		var ids []string
+		for i := 0; i < 3; i++ {
+			m, err := p.Send("alice", "bob", "", "order")
+			if err != nil {
+				t.Fatalf("Send %d: %v", i, err)
+			}
+			ids = append(ids, m.ID)
+		}
+		reversed := []string{ids[2], ids[0], ids[1]}
+		results, err := p.ArchiveMany(reversed)
+		if err != nil {
+			t.Fatalf("ArchiveMany: %v", err)
+		}
+		for i, r := range results {
+			if r.ID != reversed[i] {
+				t.Errorf("results[%d].ID = %q, want %q", i, r.ID, reversed[i])
+			}
+		}
+	})
+
+	t.Run("ArchiveMany_MixedOpenClosed", func(t *testing.T) {
+		p := newProvider(t)
+		var ids []string
+		for i := 0; i < 3; i++ {
+			m, err := p.Send("alice", "bob", "", "mixed")
+			if err != nil {
+				t.Fatalf("Send %d: %v", i, err)
+			}
+			ids = append(ids, m.ID)
+		}
+		if err := p.Archive(ids[1]); err != nil {
+			t.Fatalf("pre-Archive middle: %v", err)
+		}
+		results, err := p.ArchiveMany(ids)
+		if err != nil {
+			t.Fatalf("ArchiveMany: %v", err)
+		}
+		if len(results) != len(ids) {
+			t.Fatalf("results = %d, want %d", len(results), len(ids))
+		}
+		if results[0].Err != nil {
+			t.Errorf("results[0].Err = %v, want nil", results[0].Err)
+		}
+		if !errors.Is(results[1].Err, mail.ErrAlreadyArchived) {
+			t.Errorf("results[1].Err = %v, want ErrAlreadyArchived", results[1].Err)
+		}
+		if results[2].Err != nil {
+			t.Errorf("results[2].Err = %v, want nil", results[2].Err)
+		}
+		msgs, err := p.Inbox("bob")
+		if err != nil {
+			t.Fatalf("Inbox: %v", err)
+		}
+		if len(msgs) != 0 {
+			t.Errorf("Inbox after ArchiveMany = %d, want 0", len(msgs))
+		}
+	})
+
+	t.Run("DeleteMany_AllSucceed", func(t *testing.T) {
+		p := newProvider(t)
+		var ids []string
+		for i := 0; i < 3; i++ {
+			m, err := p.Send("alice", "bob", "", "delete batch")
+			if err != nil {
+				t.Fatalf("Send %d: %v", i, err)
+			}
+			ids = append(ids, m.ID)
+		}
+		results, err := p.DeleteMany(ids)
+		if err != nil {
+			t.Fatalf("DeleteMany: %v", err)
+		}
+		if len(results) != len(ids) {
+			t.Fatalf("results = %d, want %d", len(results), len(ids))
+		}
+		for i, r := range results {
+			if r.ID != ids[i] {
+				t.Errorf("results[%d].ID = %q, want %q", i, r.ID, ids[i])
+			}
+			if r.Err != nil {
+				t.Errorf("results[%d].Err = %v, want nil", i, r.Err)
+			}
+		}
+		msgs, err := p.Inbox("bob")
+		if err != nil {
+			t.Fatalf("Inbox: %v", err)
+		}
+		if len(msgs) != 0 {
+			t.Errorf("Inbox after DeleteMany = %d, want 0", len(msgs))
+		}
+	})
+
+	t.Run("DeleteMany_MixedOpenClosed", func(t *testing.T) {
+		p := newProvider(t)
+		var ids []string
+		for i := 0; i < 3; i++ {
+			m, err := p.Send("alice", "bob", "", "mixed delete")
+			if err != nil {
+				t.Fatalf("Send %d: %v", i, err)
+			}
+			ids = append(ids, m.ID)
+		}
+		if err := p.Delete(ids[1]); err != nil {
+			t.Fatalf("pre-Delete middle: %v", err)
+		}
+		results, err := p.DeleteMany(ids)
+		if err != nil {
+			t.Fatalf("DeleteMany: %v", err)
+		}
+		if len(results) != len(ids) {
+			t.Fatalf("results = %d, want %d", len(results), len(ids))
+		}
+		if results[0].Err != nil {
+			t.Errorf("results[0].Err = %v, want nil", results[0].Err)
+		}
+		if !errors.Is(results[1].Err, mail.ErrAlreadyArchived) {
+			t.Errorf("results[1].Err = %v, want ErrAlreadyArchived", results[1].Err)
+		}
+		if results[2].Err != nil {
+			t.Errorf("results[2].Err = %v, want nil", results[2].Err)
+		}
+		msgs, err := p.Inbox("bob")
+		if err != nil {
+			t.Fatalf("Inbox: %v", err)
+		}
+		if len(msgs) != 0 {
+			t.Errorf("Inbox after DeleteMany = %d, want 0", len(msgs))
+		}
+	})
+
 	// --- Group 12: Lifecycle ---
 
 	t.Run("Lifecycle_SendInboxReadInboxEmpty", func(t *testing.T) {
diff --git a/internal/molecule/graph_apply.go b/internal/molecule/graph_apply.go
index 4a4a398ad2..c5ee37e39b 100644
--- a/internal/molecule/graph_apply.go
+++ b/internal/molecule/graph_apply.go
@@ -134,7 +134,7 @@ func buildRecipeApplyPlan(recipe *formula.Recipe, opts Options) (*beads.GraphApp
 		}
 		if step.IsRoot {
 			rootIncluded = true
-			if !opts.PreserveRootType && step.Metadata["gc.kind"] != "workflow" {
+			if !opts.PreserveRootType && !preserveExecutableRootType(step) {
 				node.Type = "molecule"
 			}
 			if opts.Title != "" {
diff --git a/internal/molecule/molecule.go b/internal/molecule/molecule.go
index 93fa6fded5..1d2e490c1e 100644
--- a/internal/molecule/molecule.go
+++ b/internal/molecule/molecule.go
@@ -417,7 +417,7 @@ func Instantiate(ctx context.Context, store beads.Store, recipe *formula.Recipe,
 		}
 		// Root bead overrides.
 		if step.IsRoot {
-			if !opts.PreserveRootType && step.Metadata["gc.kind"] != "workflow" {
+			if !opts.PreserveRootType && !preserveExecutableRootType(step) {
 				b.Type = "molecule"
 			}
 			b.Ref = recipe.Name
@@ -819,6 +819,15 @@ func stepToBead(step formula.RecipeStep, vars map[string]string, priorityOverrid
 	return b
 }
 
+func preserveExecutableRootType(step formula.RecipeStep) bool {
+	switch step.Metadata["gc.kind"] {
+	case "workflow", "wisp":
+		return true
+	default:
+		return false
+	}
+}
+
 func validateTimeoutMetadataVars(stepID string, metadata map[string]string) error {
 	for _, key := range []string{"gc.step_timeout", "gc.check_timeout"} {
 		raw := metadata[key]
diff --git a/internal/molecule/molecule_test.go b/internal/molecule/molecule_test.go
index 2122dec95c..9c2f34303e 100644
--- a/internal/molecule/molecule_test.go
+++ b/internal/molecule/molecule_test.go
@@ -21,9 +21,7 @@ import (
 // graph will be missing the dep — which is exactly what we saw in
 // production.
 func TestBuildRecipeApplyPlanBugReportFlowV2(t *testing.T) {
-	prev := formula.IsFormulaV2Enabled()
-	formula.SetFormulaV2Enabled(true)
-	t.Cleanup(func() { formula.SetFormulaV2Enabled(prev) })
+	formulatest.EnableV2ForTest(t)
 
 	const toolingPath = "/home/ubuntu/tooling/formulas"
 	if _, err := os.Stat(filepath.Join(toolingPath, "mol-bug-report-flow-v2.formula.toml")); err != nil {
@@ -85,9 +83,7 @@ func TestBuildRecipeApplyPlanBugReportFlowV2(t *testing.T) {
 // soon as its non-attempt blockers (body scope) close, trips the
 // "latest attempt ... is open, not closed" invariant, and crash-loops.
 func TestCookTeardownRetryBlocksOnAttempt(t *testing.T) {
-	prevFormulaV2 := formula.IsFormulaV2Enabled()
-	formula.SetFormulaV2Enabled(true)
-	t.Cleanup(func() { formula.SetFormulaV2Enabled(prevFormulaV2) })
+	formulatest.EnableV2ForTest(t)
 	prevGraphApply := IsGraphApplyEnabled()
 	SetGraphApplyEnabled(true)
 	t.Cleanup(func() { SetGraphApplyEnabled(prevGraphApply) })
@@ -1241,6 +1237,43 @@ func TestInstantiateRootOnly(t *testing.T) {
 	}
 }
 
+func TestInstantiateRunnableWispRootPreservesTaskType(t *testing.T) {
+	store := beads.NewMemStore()
+	recipe := &formula.Recipe{
+		Name:     "patrol",
+		RootOnly: true,
+		Steps: []formula.RecipeStep{
+			{ID: "patrol", Title: "Patrol", Type: "task", IsRoot: true, Metadata: map[string]string{"gc.kind": "wisp"}},
+			{ID: "patrol.scan", Title: "Scan", Type: "task"},
+		},
+		Deps: []formula.RecipeDep{
+			{StepID: "patrol.scan", DependsOnID: "patrol", Type: "parent-child"},
+		},
+	}
+
+	result, err := Instantiate(context.Background(), store, recipe, Options{})
+	if err != nil {
+		t.Fatalf("Instantiate: %v", err)
+	}
+	root, err := store.Get(result.RootID)
+	if err != nil {
+		t.Fatalf("Get(%s): %v", result.RootID, err)
+	}
+	if root.Type != "task" {
+		t.Fatalf("root Type = %q, want task", root.Type)
+	}
+	if got := root.Metadata["gc.kind"]; got != "wisp" {
+		t.Fatalf("root gc.kind = %q, want wisp", got)
+	}
+	ready, err := store.Ready()
+	if err != nil {
+		t.Fatalf("Ready: %v", err)
+	}
+	if len(ready) != 1 || ready[0].ID != result.RootID {
+		t.Fatalf("Ready() = %+v, want only root %s", ready, result.RootID)
+	}
+}
+
 func TestInstantiateVarDefaults(t *testing.T) {
 	store := beads.NewMemStore()
 	defaultVal := "default-branch"
diff --git a/internal/nudgequeue/waits.go b/internal/nudgequeue/waits.go
index 1f21533866..51fa28a8fd 100644
--- a/internal/nudgequeue/waits.go
+++ b/internal/nudgequeue/waits.go
@@ -1,6 +1,7 @@
 package nudgequeue
 
 import (
+	"errors"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -95,9 +96,15 @@ func markTerminal(store beads.Store, nudgeID, now string) error {
 			"commit_boundary": "delivery-withdrawn",
 			"terminal_at":     now,
 		}); err != nil {
+			if errors.Is(err, beads.ErrNotFound) {
+				continue
+			}
 			return err
 		}
 		if err := store.Close(item.ID); err != nil {
+			if errors.Is(err, beads.ErrNotFound) {
+				continue
+			}
 			return err
 		}
 	}
diff --git a/internal/orders/override.go b/internal/orders/override.go
index ee884d6f7a..c3a2d52a9d 100644
--- a/internal/orders/override.go
+++ b/internal/orders/override.go
@@ -1,6 +1,17 @@
 package orders
 
-import "fmt"
+import (
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+)
+
+// RigWildcard is the Override.Rig value that matches every order with the
+// override's name regardless of rig scope (city-level + every rig-scoped
+// instance). It is reserved as a config-time literal: real rig names
+// equal to "*" are rejected by config validation.
+const RigWildcard = "*"
 
 // Override modifies a scanned order's scheduling fields.
 // Uses pointer fields to distinguish "not set" from "set to zero value."
@@ -20,9 +31,18 @@ type Override struct {
 }
 
 // ApplyOverrides applies each override to the matching order in aa.
-// Matching is by name, optionally scoped by rig. Returns an error if an
-// override targets a nonexistent order (following the agent override
-// pattern where unmatched targets are errors, not silent no-ops).
+//
+// Matching rules:
+//   - ov.Rig == "":  matches only city-level orders (those with no rig).
+//     If no city-level order with the name exists but rig-scoped instances
+//     do, returns an error suggesting the explicit rig = "<name>" syntax.
+//   - ov.Rig == "*": wildcard — matches every order with the name,
+//     regardless of rig.
+//   - otherwise:     matches only the order with that exact rig.
+//
+// Returns an error if an override targets a nonexistent order (following
+// the agent override pattern where unmatched targets are errors, not
+// silent no-ops).
 func ApplyOverrides(aa []Order, overrides []Override) error {
 	for i, ov := range overrides {
 		if ov.Name == "" {
@@ -33,25 +53,76 @@ func ApplyOverrides(aa []Order, overrides []Override) error {
 			if aa[j].Name != ov.Name {
 				continue
 			}
-			// Scope matching: when ov.Rig is set, only match that rig.
-			// When ov.Rig is empty, only match city-level orders
-			// (those with no rig), not rig-scoped ones.
-			if aa[j].Rig != ov.Rig {
+			if !rigMatches(ov.Rig, aa[j].Rig) {
 				continue
 			}
 			applyOverride(&aa[j], &ov)
 			found = true
 		}
 		if !found {
-			if ov.Rig != "" {
-				return fmt.Errorf("orders.overrides[%d]: order %q (rig %q) not found", i, ov.Name, ov.Rig)
-			}
-			return fmt.Errorf("orders.overrides[%d]: order %q not found", i, ov.Name)
+			return notFoundError(i, ov, aa)
 		}
 	}
 	return nil
 }
 
+func rigMatches(ovRig, orderRig string) bool {
+	if ovRig == RigWildcard {
+		return true
+	}
+	return ovRig == orderRig
+}
+
+// notFoundError builds the unmatched-override error. When the override is
+// rigless ("") but the slice contains rig-scoped orders with the same
+// name, the error names every such rig so the user knows exactly what to
+// type — this is the gotcha that the previous error message hid.
+func notFoundError(idx int, ov Override, aa []Order) error {
+	switch ov.Rig {
+	case "":
+		rigs := rigsForName(aa, ov.Name)
+		if len(rigs) > 0 {
+			return fmt.Errorf(
+				"orders.overrides[%d]: order %q not found at city scope (%s rig-scoped); "+
+					"set %s to target a per-rig instance, "+
+					"or use rig = %q to target all instances",
+				idx, ov.Name, pluralizeRigCount(len(rigs)), formatRigSuggestions(rigs), RigWildcard,
+			)
+		}
+		return fmt.Errorf("orders.overrides[%d]: order %q not found", idx, ov.Name)
+	case RigWildcard:
+		return fmt.Errorf("orders.overrides[%d]: order %q not found (rig %q matches no instances)", idx, ov.Name, RigWildcard)
+	default:
+		return fmt.Errorf("orders.overrides[%d]: order %q (rig %q) not found", idx, ov.Name, ov.Rig)
+	}
+}
+
+func rigsForName(aa []Order, name string) []string {
+	seen := map[string]struct{}{}
+	for _, a := range aa {
+		if a.Name != name || a.Rig == "" {
+			continue
+		}
+		seen[a.Rig] = struct{}{}
+	}
+	return slices.Sorted(maps.Keys(seen))
+}
+
+func formatRigSuggestions(rigs []string) string {
+	parts := make([]string, len(rigs))
+	for i, r := range rigs {
+		parts[i] = fmt.Sprintf("rig = %q", r)
+	}
+	return strings.Join(parts, ", ")
+}
+
+func pluralizeRigCount(n int) string {
+	if n == 1 {
+		return "1 instance"
+	}
+	return fmt.Sprintf("%d instances", n)
+}
+
 func applyOverride(a *Order, ov *Override) {
 	if ov.Enabled != nil {
 		a.Enabled = ov.Enabled
diff --git a/internal/orders/override_test.go b/internal/orders/override_test.go
new file mode 100644
index 0000000000..753dfb5c1d
--- /dev/null
+++ b/internal/orders/override_test.go
@@ -0,0 +1,254 @@
+package orders
+
+import (
+	"strings"
+	"testing"
+)
+
+// boolPtr / strPtr are local helpers so tests stay self-contained.
+func boolPtr(b bool) *bool    { return &b }
+func strPtr(s string) *string { return &s }
+
+func TestApplyOverrides(t *testing.T) {
+	t.Parallel()
+
+	disabled := boolPtr(false)
+	tenSec := strPtr("10s")
+	thirtySec := strPtr("30s")
+
+	tests := []struct {
+		name      string
+		orders    []Order
+		overrides []Override
+		// wantErrSubstrs: all of these substrings must appear in the
+		// returned error. Empty means the call must succeed.
+		wantErrSubstrs []string
+		// check inspects the post-apply orders slice when no error.
+		check func(t *testing.T, aa []Order)
+	}{
+		{
+			name: "city level override matches city order",
+			orders: []Order{
+				{Name: "patrol", Rig: ""},
+			},
+			overrides: []Override{
+				{Name: "patrol", Rig: "", Enabled: disabled},
+			},
+			check: func(t *testing.T, aa []Order) {
+				t.Helper()
+				if aa[0].Enabled == nil || *aa[0].Enabled {
+					t.Errorf("city-level patrol not disabled: %+v", aa[0].Enabled)
+				}
+			},
+		},
+		{
+			name: "rig scoped override matches only that rig",
+			orders: []Order{
+				{Name: "patrol", Rig: "demo"},
+				{Name: "patrol", Rig: "prod"},
+			},
+			overrides: []Override{
+				{Name: "patrol", Rig: "demo", Interval: tenSec},
+			},
+			check: func(t *testing.T, aa []Order) {
+				t.Helper()
+				if aa[0].Interval != "10s" {
+					t.Errorf("demo patrol interval = %q, want 10s", aa[0].Interval)
+				}
+				if aa[1].Interval != "" {
+					t.Errorf("prod patrol interval should be unchanged, got %q", aa[1].Interval)
+				}
+			},
+		},
+		{
+			name: "rigless override does not match rig-scoped orders, error suggests rig syntax",
+			orders: []Order{
+				{Name: "patrol", Rig: "demo"},
+				{Name: "patrol", Rig: "prod"},
+				{Name: "other", Rig: ""},
+			},
+			overrides: []Override{
+				{Name: "patrol", Rig: "", Enabled: disabled},
+			},
+			wantErrSubstrs: []string{
+				"orders.overrides[0]",
+				`"patrol"`,
+				"not found",
+				// regression-grade: the enriched error must mention the
+				// rig-scope mismatch and the actual rig names that exist,
+				// so users see exactly what to type.
+				`rig = "demo"`,
+				`rig = "prod"`,
+			},
+		},
+		{
+			name: "rig scoped override with no matching rig instance returns error naming the rig",
+			orders: []Order{
+				{Name: "patrol", Rig: "demo"},
+			},
+			overrides: []Override{
+				{Name: "patrol", Rig: "missing", Interval: tenSec},
+			},
+			wantErrSubstrs: []string{
+				"orders.overrides[0]",
+				`"patrol"`,
+				`"missing"`,
+				"not found",
+			},
+		},
+		{
+			name: "wildcard rig matches every instance with that name",
+			orders: []Order{
+				{Name: "patrol", Rig: ""},
+				{Name: "patrol", Rig: "demo"},
+				{Name: "patrol", Rig: "prod"},
+				{Name: "other", Rig: "demo"},
+			},
+			overrides: []Override{
+				{Name: "patrol", Rig: RigWildcard, Enabled: disabled, Interval: thirtySec},
+			},
+			check: func(t *testing.T, aa []Order) {
+				t.Helper()
+				for i, a := range aa {
+					if a.Name != "patrol" {
+						if a.Enabled != nil {
+							t.Errorf("aa[%d] %q: unrelated order should not be touched", i, a.Name)
+						}
+						continue
+					}
+					if a.Enabled == nil || *a.Enabled {
+						t.Errorf("aa[%d] (rig=%q): expected disabled", i, a.Rig)
+					}
+					if a.Interval != "30s" {
+						t.Errorf("aa[%d] (rig=%q): interval=%q, want 30s", i, a.Rig, a.Interval)
+					}
+				}
+			},
+		},
+		{
+			name: "wildcard rig with no matching name still errors",
+			orders: []Order{
+				{Name: "patrol", Rig: "demo"},
+			},
+			overrides: []Override{
+				{Name: "ghost", Rig: RigWildcard, Enabled: disabled},
+			},
+			wantErrSubstrs: []string{
+				"orders.overrides[0]",
+				`"ghost"`,
+				"not found",
+			},
+		},
+		{
+			name: "empty name returns error",
+			orders: []Order{
+				{Name: "patrol", Rig: ""},
+			},
+			overrides: []Override{
+				{Name: "", Rig: "", Enabled: disabled},
+			},
+			wantErrSubstrs: []string{
+				"orders.overrides[0]",
+				"name is required",
+			},
+		},
+		{
+			name: "name not found anywhere returns plain not-found error",
+			orders: []Order{
+				{Name: "patrol", Rig: "demo"},
+			},
+			overrides: []Override{
+				{Name: "ghost", Rig: "", Enabled: disabled},
+			},
+			wantErrSubstrs: []string{
+				"orders.overrides[0]",
+				`"ghost"`,
+				"not found",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			// Copy orders so test cases don't bleed.
+			aa := make([]Order, len(tt.orders))
+			copy(aa, tt.orders)
+
+			err := ApplyOverrides(aa, tt.overrides)
+			if len(tt.wantErrSubstrs) == 0 {
+				if err != nil {
+					t.Fatalf("ApplyOverrides returned error: %v", err)
+				}
+				if tt.check != nil {
+					tt.check(t, aa)
+				}
+				return
+			}
+			if err == nil {
+				t.Fatalf("ApplyOverrides succeeded; want error containing %v", tt.wantErrSubstrs)
+			}
+			msg := err.Error()
+			for _, sub := range tt.wantErrSubstrs {
+				if !strings.Contains(msg, sub) {
+					t.Errorf("error %q missing substring %q", msg, sub)
+				}
+			}
+		})
+	}
+}
+
+// TestApplyOverrides_RiglessHintExcludesUnrelatedOrders ensures that the
+// rig-suggestion hint listing only reports rigs that have an order with the
+// override's name, not arbitrary rigs in the slice.
+func TestApplyOverrides_RiglessHintExcludesUnrelatedOrders(t *testing.T) {
+	t.Parallel()
+
+	aa := []Order{
+		{Name: "patrol", Rig: "demo"},
+		{Name: "elsewhere", Rig: "unrelated-rig"},
+	}
+	err := ApplyOverrides(aa, []Override{{Name: "patrol", Rig: ""}})
+	if err == nil {
+		t.Fatal("expected error for rigless override against rig-scoped patrol")
+	}
+	msg := err.Error()
+	if !strings.Contains(msg, `rig = "demo"`) {
+		t.Errorf("error should suggest rig = %q; got %q", "demo", msg)
+	}
+	if strings.Contains(msg, "unrelated-rig") {
+		t.Errorf("error should NOT mention unrelated-rig; got %q", msg)
+	}
+}
+
+// TestApplyOverrides_PreservesNotFoundSubstring is a regression guard for
+// cmd/gc/order_dispatch_test.go's TestBuildOrderDispatcherOverrideNotFoundNonFatal,
+// which asserts strings.Contains(stderr, "not found"). If we change the
+// error wording in the future, this test fails first and forces an update
+// to the dispatcher test in the same change.
+func TestApplyOverrides_PreservesNotFoundSubstring(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name   string
+		orders []Order
+		ov     Override
+	}{
+		{"missing name", []Order{{Name: "patrol"}}, Override{Name: "ghost"}},
+		{"missing rig", []Order{{Name: "patrol", Rig: "demo"}}, Override{Name: "patrol", Rig: "missing"}},
+		{"rigless against rig-scoped", []Order{{Name: "patrol", Rig: "demo"}}, Override{Name: "patrol"}},
+		{"wildcard against missing name", []Order{{Name: "patrol", Rig: "demo"}}, Override{Name: "ghost", Rig: RigWildcard}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			err := ApplyOverrides(tc.orders, []Override{tc.ov})
+			if err == nil {
+				t.Fatal("expected error")
+			}
+			if !strings.Contains(err.Error(), "not found") {
+				t.Errorf("error %q must contain literal substring %q", err.Error(), "not found")
+			}
+		})
+	}
+}
diff --git a/internal/orders/runtime_helpers_test.go b/internal/orders/runtime_helpers_test.go
new file mode 100644
index 0000000000..16fac0ce76
--- /dev/null
+++ b/internal/orders/runtime_helpers_test.go
@@ -0,0 +1,55 @@
+package orders
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+func TestLastRunFuncForStoreReturnsLatestRun(t *testing.T) {
+	store := beads.NewMemStore()
+
+	first, err := store.Create(beads.Bead{
+		Title:  "order:digest",
+		Status: "closed",
+		Labels: []string{"order-run:digest"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	time.Sleep(time.Millisecond)
+
+	second, err := store.Create(beads.Bead{
+		Title:  "order:digest",
+		Status: "closed",
+		Labels: []string{"order-run:digest", "wisp-failed"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := LastRunFuncForStore(store)("digest")
+	if err != nil {
+		t.Fatalf("LastRunFuncForStore(): %v", err)
+	}
+	if !got.Equal(second.CreatedAt) {
+		t.Fatalf("LastRunFuncForStore() = %s, want %s (latest run should remain authoritative)", got, second.CreatedAt)
+	}
+	if !second.CreatedAt.After(first.CreatedAt) {
+		t.Fatalf("test setup invalid: second.CreatedAt=%s, first.CreatedAt=%s", second.CreatedAt, first.CreatedAt)
+	}
+}
+
+func TestLastRunFuncForStoreReturnsZeroWhenNoRunsExist(t *testing.T) {
+	store := beads.NewMemStore()
+
+	got, err := LastRunFuncForStore(store)("digest")
+	if err != nil {
+		t.Fatalf("LastRunFuncForStore(): %v", err)
+	}
+	if !got.IsZero() {
+		t.Fatalf("LastRunFuncForStore() = %s, want zero time", got)
+	}
+}
diff --git a/internal/orders/triggers.go b/internal/orders/triggers.go
index d1286b2277..ce8a1ebbfc 100644
--- a/internal/orders/triggers.go
+++ b/internal/orders/triggers.go
@@ -3,12 +3,14 @@ package orders
 import (
 	"context"
 	"fmt"
+	"os"
 	"os/exec"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gastownhall/gascity/internal/events"
+	"github.com/gastownhall/gascity/internal/execenv"
 )
 
 // TriggerResult holds the outcome of a trigger check.
@@ -29,19 +31,32 @@ type LastRunFunc func(name string) (time.Time, error)
 // Returns 0 if no cursor exists.
 type CursorFunc func(orderName string) uint64
 
+// TriggerOptions carries execution context for triggers that run subprocesses.
+type TriggerOptions struct {
+	ConditionDir     string
+	ConditionEnv     []string
+	ConditionTimeout time.Duration
+}
+
 // CheckTrigger evaluates an order's trigger condition and returns whether it's due.
 // ep is an events Provider used by event triggers to query events; may be nil for
 // non-event triggers.
 // cursorFn returns the last-processed event seq for event triggers; may be nil for
 // non-event triggers.
 func CheckTrigger(a Order, now time.Time, lastRunFn LastRunFunc, ep events.Provider, cursorFn CursorFunc) TriggerResult {
+	return CheckTriggerWithOptions(a, now, lastRunFn, ep, cursorFn, TriggerOptions{})
+}
+
+// CheckTriggerWithOptions evaluates an order trigger using explicit execution
+// context for condition checks.
+func CheckTriggerWithOptions(a Order, now time.Time, lastRunFn LastRunFunc, ep events.Provider, cursorFn CursorFunc, opts TriggerOptions) TriggerResult {
 	switch a.Trigger {
 	case "cooldown":
 		return checkCooldown(a, now, lastRunFn)
 	case "cron":
 		return checkCron(a, now, lastRunFn)
 	case "condition":
-		return checkCondition(a)
+		return checkCondition(a, opts)
 	case "event":
 		return checkEvent(a, ep, cursorFn)
 	case "manual":
@@ -131,12 +146,19 @@ func cronFieldMatches(field string, value int) bool {
 
 // checkCondition runs the check command and returns due if exit code is 0.
 // Uses a timeout to prevent hanging check scripts from blocking trigger evaluation.
-func checkCondition(a Order) TriggerResult {
+func checkCondition(a Order, opts TriggerOptions) TriggerResult {
 	const triggerCheckTimeout = 10 * time.Second
-	timeout := triggerCheckTimeout
+	timeout := opts.ConditionTimeout
+	if timeout <= 0 {
+		timeout = triggerCheckTimeout
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, "sh", "-c", a.Check)
+	if opts.ConditionDir != "" {
+		cmd.Dir = opts.ConditionDir
+	}
+	cmd.Env = mergeConditionEnv(os.Environ(), opts.ConditionEnv)
 	if err := cmd.Run(); err != nil {
 		if ctx.Err() == context.DeadlineExceeded {
 			return TriggerResult{Due: false, Reason: fmt.Sprintf("check command timed out after %s", timeout)}
@@ -146,6 +168,10 @@ func checkCondition(a Order) TriggerResult {
 	return TriggerResult{Due: true, Reason: "condition: check passed (exit 0)"}
 }
 
+func mergeConditionEnv(environ, extra []string) []string {
+	return execenv.MergeEntries(environ, extra)
+}
+
 // checkEvent checks if matching events exist after the last cursor position.
 func checkEvent(a Order, ep events.Provider, cursorFn CursorFunc) TriggerResult {
 	if ep == nil {
diff --git a/internal/orders/triggers_test.go b/internal/orders/triggers_test.go
index 2ba4d0d11f..9eb415ab14 100644
--- a/internal/orders/triggers_test.go
+++ b/internal/orders/triggers_test.go
@@ -97,6 +97,29 @@ func TestCheckTriggerCondition(t *testing.T) {
 	}
 }
 
+func TestCheckTriggerConditionUsesOptions(t *testing.T) {
+	dir := t.TempDir()
+	if realDir, err := filepath.EvalSymlinks(dir); err == nil {
+		dir = realDir
+	}
+	a := Order{
+		Name:    "check",
+		Trigger: "condition",
+		Check:   `test "$GC_CITY_PATH" = "$EXPECT_CITY" && test "$(pwd -P)" = "$(cd "$EXPECT_CITY" && pwd -P)"`,
+	}
+	now := time.Date(2026, 2, 27, 12, 0, 0, 0, time.UTC)
+	result := CheckTriggerWithOptions(a, now, neverRan, nil, nil, TriggerOptions{
+		ConditionDir: dir,
+		ConditionEnv: []string{
+			"EXPECT_CITY=" + dir,
+			"GC_CITY_PATH=" + dir,
+		},
+	})
+	if !result.Due {
+		t.Errorf("Due = false, want true with condition cwd/env: %s", result.Reason)
+	}
+}
+
 func TestCheckTriggerConditionFails(t *testing.T) {
 	a := Order{Name: "check", Trigger: "condition", Check: "false"}
 	now := time.Date(2026, 2, 27, 12, 0, 0, 0, time.UTC)
diff --git a/internal/overlay/merge_test.go b/internal/overlay/merge_test.go
index 739d5069c7..17288814e9 100644
--- a/internal/overlay/merge_test.go
+++ b/internal/overlay/merge_test.go
@@ -70,7 +70,7 @@ func TestMergeSettingsJSON_SameMatcherReplacement(t *testing.T) {
 	}`
 	over := `{
 		"hooks": {
-			"PreCompact": [{"matcher": "", "hooks": [{"type": "command", "command": "gc handoff \"context cycle\""}]}]
+			"PreCompact": [{"matcher": "", "hooks": [{"type": "command", "command": "gc handoff --auto \"context cycle\""}]}]
 		}
 	}`
 
@@ -91,7 +91,7 @@ func TestMergeSettingsJSON_SameMatcherReplacement(t *testing.T) {
 	entry := arr[0].(map[string]any)
 	innerHooks := entry["hooks"].([]any)
 	cmd := innerHooks[0].(map[string]any)["command"].(string)
-	if cmd != `gc handoff "context cycle"` {
+	if cmd != `gc handoff --auto "context cycle"` {
 		t.Errorf("PreCompact command = %q, want gc handoff", cmd)
 	}
 }
@@ -333,7 +333,7 @@ func TestMergeSettingsJSON_CrewScenario(t *testing.T) {
 	}`
 	over := `{
 		"hooks": {
-			"PreCompact": [{"matcher": "", "hooks": [{"type": "command", "command": "gc handoff \"context cycle\""}]}]
+			"PreCompact": [{"matcher": "", "hooks": [{"type": "command", "command": "gc handoff --auto \"context cycle\""}]}]
 		}
 	}`
 
@@ -362,7 +362,7 @@ func TestMergeSettingsJSON_CrewScenario(t *testing.T) {
 	entry := arr[0].(map[string]any)
 	innerHooks := entry["hooks"].([]any)
 	cmd := innerHooks[0].(map[string]any)["command"].(string)
-	if cmd != `gc handoff "context cycle"` {
+	if cmd != `gc handoff --auto "context cycle"` {
 		t.Errorf("PreCompact command = %q, want gc handoff", cmd)
 	}
 }
@@ -372,7 +372,7 @@ func TestMergeSettingsJSON_BackwardCompat_FullOverlay(t *testing.T) {
 	full := `{
 		"hooks": {
 			"SessionStart": [{"matcher": "", "hooks": [{"type": "command", "command": "gc prime"}]}],
-			"PreCompact": [{"matcher": "", "hooks": [{"type": "command", "command": "gc handoff \"context cycle\""}]}],
+			"PreCompact": [{"matcher": "", "hooks": [{"type": "command", "command": "gc handoff --auto \"context cycle\""}]}],
 			"UserPromptSubmit": [{"matcher": "", "hooks": [{"type": "command", "command": "gc mail check --inject"}]}],
 			"Stop": [{"matcher": "", "hooks": [{"type": "command", "command": "gc hook --inject"}]}]
 		}
diff --git a/internal/pathutil/pathutil.go b/internal/pathutil/pathutil.go
index 85b9dad871..d70e61560f 100644
--- a/internal/pathutil/pathutil.go
+++ b/internal/pathutil/pathutil.go
@@ -70,3 +70,21 @@ func canonicalizePlatformPathAlias(path string) string {
 func SamePath(a, b string) bool {
 	return NormalizePathForCompare(a) == NormalizePathForCompare(b)
 }
+
+// PathWithin reports whether candidate is the same path as root or a path
+// lexically contained beneath root after normalization and symlink resolution.
+func PathWithin(root, candidate string) bool {
+	root = NormalizePathForCompare(root)
+	candidate = NormalizePathForCompare(candidate)
+	if root == "" || candidate == "" {
+		return false
+	}
+	if root == candidate {
+		return true
+	}
+	rel, err := filepath.Rel(root, candidate)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}
diff --git a/internal/pathutil/pathutil_test.go b/internal/pathutil/pathutil_test.go
index 8de6f92ebc..e54c71cc02 100644
--- a/internal/pathutil/pathutil_test.go
+++ b/internal/pathutil/pathutil_test.go
@@ -90,3 +90,33 @@ func TestSamePathDifferent(t *testing.T) {
 		t.Errorf("expected different paths: %q vs %q", a, b)
 	}
 }
+
+func TestPathWithin(t *testing.T) {
+	root := t.TempDir()
+	child := filepath.Join(root, "nested", "child")
+	if err := os.MkdirAll(child, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if !PathWithin(root, child) {
+		t.Fatalf("PathWithin(%q, %q) = false, want true", root, child)
+	}
+	if !PathWithin(root, root) {
+		t.Fatalf("PathWithin(%q, %q) = false, want true for identical paths", root, root)
+	}
+}
+
+func TestPathWithinSymlinkedMissingLeaf(t *testing.T) {
+	root := t.TempDir()
+	realPath := filepath.Join(root, "real")
+	if err := os.MkdirAll(realPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(root, "link")
+	if err := os.Symlink(realPath, link); err != nil {
+		t.Skip("symlinks not supported")
+	}
+	candidate := filepath.Join(link, "missing", "leaf")
+	if !PathWithin(realPath, candidate) {
+		t.Fatalf("PathWithin(%q, %q) = false, want true through symlink ancestor", realPath, candidate)
+	}
+}
diff --git a/internal/runtime/auto/auto.go b/internal/runtime/auto/auto.go
index fb3bffbd2c..a18ab0ebd2 100644
--- a/internal/runtime/auto/auto.go
+++ b/internal/runtime/auto/auto.go
@@ -26,6 +26,7 @@ type Provider struct {
 
 var (
 	_ runtime.Provider                      = (*Provider)(nil)
+	_ runtime.DeadRuntimeSessionChecker     = (*Provider)(nil)
 	_ runtime.InteractionProvider           = (*Provider)(nil)
 	_ runtime.InterruptBoundaryWaitProvider = (*Provider)(nil)
 	_ runtime.InterruptedTurnResetProvider  = (*Provider)(nil)
@@ -175,6 +176,30 @@ func (p *Provider) IsRunning(name string) bool {
 	return p.acpSP.IsRunning(name)
 }
 
+// IsDeadRuntimeSession checks both backends for a positive dead-artifact
+// report because ListRunning is also merged across both backends.
+func (p *Provider) IsDeadRuntimeSession(name string) (bool, error) {
+	primary := p.route(name)
+	if dead, err := providerDeadRuntimeSession(primary, name); dead || err != nil {
+		return dead, err
+	}
+	p.mu.RLock()
+	isACP := p.routes[name]
+	p.mu.RUnlock()
+	if isACP {
+		return providerDeadRuntimeSession(p.defaultSP, name)
+	}
+	return providerDeadRuntimeSession(p.acpSP, name)
+}
+
+func providerDeadRuntimeSession(sp runtime.Provider, name string) (bool, error) {
+	checker, ok := sp.(runtime.DeadRuntimeSessionChecker)
+	if !ok {
+		return false, nil
+	}
+	return checker.IsDeadRuntimeSession(name)
+}
+
 // IsAttached delegates to the routed backend.
 func (p *Provider) IsAttached(name string) bool {
 	return p.route(name).IsAttached(name)
diff --git a/internal/runtime/auto/auto_test.go b/internal/runtime/auto/auto_test.go
index 71a373ba64..7f81433012 100644
--- a/internal/runtime/auto/auto_test.go
+++ b/internal/runtime/auto/auto_test.go
@@ -22,6 +22,29 @@ func (p *falseNegativeStopProvider) Stop(string) error { return p.stopErr }
 
 func (p *falseNegativeStopProvider) IsRunning(string) bool { return false }
 
+type deadRuntimeCheckProvider struct {
+	*runtime.Fake
+	dead   map[string]bool
+	errs   map[string]error
+	checks []string
+}
+
+func newDeadRuntimeCheckProvider() *deadRuntimeCheckProvider {
+	return &deadRuntimeCheckProvider{
+		Fake: runtime.NewFake(),
+		dead: make(map[string]bool),
+		errs: make(map[string]error),
+	}
+}
+
+func (p *deadRuntimeCheckProvider) IsDeadRuntimeSession(name string) (bool, error) {
+	p.checks = append(p.checks, name)
+	if err := p.errs[name]; err != nil {
+		return false, err
+	}
+	return p.dead[name], nil
+}
+
 func TestRouteDefaultAndACP(t *testing.T) {
 	defaultSP := runtime.NewFake()
 	acpSP := runtime.NewFake()
@@ -346,6 +369,46 @@ func TestIsRunningFallsThrough(t *testing.T) {
 	}
 }
 
+func TestIsDeadRuntimeSessionChecksUnroutedFallbackChecker(t *testing.T) {
+	defaultSP := runtime.NewFake()
+	acpSP := newDeadRuntimeCheckProvider()
+	acpSP.dead["lost-route"] = true
+	p := New(defaultSP, acpSP)
+
+	dead, err := p.IsDeadRuntimeSession("lost-route")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if !dead {
+		t.Fatal("IsDeadRuntimeSession = false, want true from fallback checker")
+	}
+	if got := acpSP.checks; len(got) != 1 || got[0] != "lost-route" {
+		t.Fatalf("fallback checks = %v, want [lost-route]", got)
+	}
+}
+
+func TestIsDeadRuntimeSessionFindsDefaultCorpseBehindStaleACPRoute(t *testing.T) {
+	defaultSP := newDeadRuntimeCheckProvider()
+	acpSP := newDeadRuntimeCheckProvider()
+	defaultSP.dead["agent"] = true
+	p := New(defaultSP, acpSP)
+	p.RouteACP("agent")
+
+	dead, err := p.IsDeadRuntimeSession("agent")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if !dead {
+		t.Fatal("IsDeadRuntimeSession = false, want true from default backend")
+	}
+	if got := acpSP.checks; len(got) != 1 || got[0] != "agent" {
+		t.Fatalf("primary checks = %v, want [agent]", got)
+	}
+	if got := defaultSP.checks; len(got) != 1 || got[0] != "agent" {
+		t.Fatalf("fallback checks = %v, want [agent]", got)
+	}
+}
+
 func TestStopFallsThrough(t *testing.T) {
 	defaultSP := runtime.NewFailFake() // Stop always fails (simulates "not found")
 	acpSP := runtime.NewFake()
diff --git a/internal/runtime/dialog.go b/internal/runtime/dialog.go
index 39a143151a..4e6d6ef417 100644
--- a/internal/runtime/dialog.go
+++ b/internal/runtime/dialog.go
@@ -30,9 +30,10 @@ func StartupDialogTimeout() time.Duration {
 
 // AcceptStartupDialogs dismisses startup dialogs that can block automated
 // sessions. Handles (in order):
-//  1. Workspace trust dialog (Claude "Quick safety check", Codex "Do you trust the contents of this directory?")
-//  2. Bypass permissions warning ("Bypass Permissions mode") — requires Down+Enter
-//  3. Claude custom API key confirmation — requires Up+Enter to select "Yes"
+//  1. Codex update dialog ("Update available") — requires Down+Enter to skip
+//  2. Workspace trust dialog (Claude "Quick safety check", Codex "Do you trust the contents of this directory?")
+//  3. Bypass permissions warning ("Bypass Permissions mode") — requires Down+Enter
+//  4. Claude custom API key confirmation — requires Up+Enter to select "Yes"
 //
 // The peek function should return the last N lines of the session's terminal output.
 // The sendKeys function should send bare tmux-style keystrokes (e.g., "Enter", "Down").
@@ -75,7 +76,18 @@ func AcceptStartupDialogsFromStreamWithStatus(
 		return sendKeys(keys...)
 	}
 
-	phaseObserved, err := acceptWorkspaceTrustDialogFromStream(ctx, timeout, stream, trackingSendKeys)
+	phaseObserved, err := acceptCodexUpdateDialogFromStream(ctx, timeout, stream, trackingSendKeys)
+	if err != nil {
+		return observed, fmt.Errorf("codex update dialog: %w", err)
+	}
+	observed = observed || phaseObserved
+	if !phaseObserved && !observed {
+		return false, nil
+	}
+	if err := ctx.Err(); err != nil {
+		return observed, err
+	}
+	phaseObserved, err = acceptWorkspaceTrustDialogFromStream(ctx, timeout, stream, trackingSendKeys)
 	if err != nil {
 		return observed, fmt.Errorf("workspace trust dialog: %w", err)
 	}
@@ -136,6 +148,12 @@ func AcceptStartupDialogsWithTimeout(
 	peek func(lines int) (string, error),
 	sendKeys func(keys ...string) error,
 ) error {
+	if err := acceptCodexUpdateDialog(ctx, timeout, peek, sendKeys); err != nil {
+		return fmt.Errorf("codex update dialog: %w", err)
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
 	if err := acceptWorkspaceTrustDialog(ctx, timeout, peek, sendKeys); err != nil {
 		return fmt.Errorf("workspace trust dialog: %w", err)
 	}
@@ -160,6 +178,74 @@ func AcceptStartupDialogsWithTimeout(
 	return nil
 }
 
+// acceptCodexUpdateDialog skips Codex's interactive update prompt. The default
+// selection is "Update now", so automated sessions must move down to "Skip".
+func acceptCodexUpdateDialog(
+	ctx context.Context,
+	timeout time.Duration,
+	peek func(lines int) (string, error),
+	sendKeys func(keys ...string) error,
+) error {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+
+		content, err := peek(startupDialogPeekLines)
+		if err != nil {
+			return err
+		}
+
+		if containsCodexUpdateDialog(content) {
+			if err := sendKeys("Down"); err != nil {
+				return err
+			}
+			sleep(ctx, bypassDialogConfirmDelay)
+			return sendKeys("Enter")
+		}
+
+		if containsPromptIndicator(content) ||
+			containsWorkspaceTrustDialog(content) ||
+			strings.Contains(content, "Bypass Permissions mode") ||
+			containsCustomAPIKeyDialog(content) ||
+			ContainsRateLimitDialog(content) {
+			return nil
+		}
+
+		sleep(ctx, dialogPollInterval)
+	}
+	return nil
+}
+
+func containsCodexUpdateDialog(content string) bool {
+	return strings.Contains(content, "Update available!") &&
+		strings.Contains(content, "Skip until next version") &&
+		strings.Contains(content, "Press enter to continue")
+}
+
+func acceptCodexUpdateDialogFromStream(
+	ctx context.Context,
+	timeout time.Duration,
+	snapshots *replayableSnapshotCursor,
+	sendKeys func(keys ...string) error,
+) (bool, error) {
+	return acceptDialogFromStream(ctx, timeout, snapshots, sendKeys, streamDialogSpec{
+		match:       containsCodexUpdateDialog,
+		matchKeys:   []string{"Down", "Enter"},
+		matchDelay:  bypassDialogConfirmDelay,
+		ready:       containsPromptIndicator,
+		readyOrNext: containsPostUpdateStartupDialog,
+	})
+}
+
+func containsPostUpdateStartupDialog(content string) bool {
+	return containsWorkspaceTrustDialog(content) ||
+		strings.Contains(content, "Bypass Permissions mode") ||
+		containsCustomAPIKeyDialog(content) ||
+		ContainsRateLimitDialog(content)
+}
+
 // acceptWorkspaceTrustDialog dismisses workspace trust dialogs for supported
 // agents. Claude shows "Quick safety check"; Codex shows
 // "Do you trust the contents of this directory?". In both cases the safe
@@ -228,7 +314,7 @@ func containsWorkspaceTrustDialog(content string) bool {
 func containsPostTrustStartupDialog(content string) bool {
 	return strings.Contains(content, "Bypass Permissions mode") ||
 		containsCustomAPIKeyDialog(content) ||
-		containsRateLimitDialog(content)
+		ContainsRateLimitDialog(content)
 }
 
 // acceptBypassPermissionsWarning dismisses the Claude Code bypass permissions
@@ -284,7 +370,7 @@ func acceptBypassPermissionsWarningFromStream(
 }
 
 func containsPostBypassStartupDialog(content string) bool {
-	return containsCustomAPIKeyDialog(content) || containsRateLimitDialog(content)
+	return containsCustomAPIKeyDialog(content) || ContainsRateLimitDialog(content)
 }
 
 // acceptCustomAPIKeyDialog dismisses Claude's API-key confirmation prompt.
@@ -316,7 +402,7 @@ func acceptCustomAPIKeyDialog(
 			return sendKeys("Enter")
 		}
 
-		if containsPromptIndicator(content) || containsRateLimitDialog(content) {
+		if containsPromptIndicator(content) || ContainsRateLimitDialog(content) {
 			return nil
 		}
 
@@ -336,7 +422,7 @@ func acceptCustomAPIKeyDialogFromStream(
 		matchKeys:   []string{"Up", "Enter"},
 		matchDelay:  bypassDialogConfirmDelay,
 		ready:       containsPromptIndicator,
-		readyOrNext: containsRateLimitDialog,
+		readyOrNext: ContainsRateLimitDialog,
 	})
 }
 
@@ -347,8 +433,9 @@ func containsCustomAPIKeyDialog(content string) bool {
 
 // dismissRateLimitDialog detects rate limit / usage limit dialogs (e.g.,
 // Gemini's "Usage limit reached") and selects "Stop" to let the session
-// exit cleanly. The reconciler treats the exit as a startup failure and
-// retries later when the rate limit resets.
+// exit cleanly. The reconciler then peeks the pane and quarantines provider
+// rate-limit exits with sleep_reason=rate_limit instead of counting them as
+// wake failures.
 func dismissRateLimitDialog(
 	ctx context.Context,
 	timeout time.Duration,
@@ -366,7 +453,7 @@ func dismissRateLimitDialog(
 			return err
 		}
 
-		if containsRateLimitDialog(content) {
+		if ContainsRateLimitDialog(content) {
 			// Select "Stop" (option 2). The menu has "Keep trying" selected
 			// by default, so press Down then Enter.
 			if err := sendKeys("Down"); err != nil {
@@ -392,7 +479,7 @@ func dismissRateLimitDialogFromStream(
 	sendKeys func(keys ...string) error,
 ) (bool, error) {
 	return acceptDialogFromStream(ctx, timeout, snapshots, sendKeys, streamDialogSpec{
-		match:      containsRateLimitDialog,
+		match:      ContainsRateLimitDialog,
 		matchKeys:  []string{"Down", "Enter"},
 		matchDelay: bypassDialogConfirmDelay,
 		ready:      containsPromptIndicator,
@@ -632,15 +719,35 @@ func sendDialogKeys(
 	return nil
 }
 
-func containsRateLimitDialog(content string) bool {
+// ContainsRateLimitDialog reports whether pane content shows a provider
+// rate-limit or usage-limit startup dialog. It is intentionally permissive for
+// startup compatibility; use ContainsProviderRateLimitScreen when classifying
+// arbitrary post-crash scrollback.
+func ContainsRateLimitDialog(content string) bool {
 	return strings.Contains(content, "Usage limit reached") ||
+		strings.Contains(content, "You've hit your limit") ||
+		strings.Contains(content, "/rate-limit-options") ||
 		strings.Contains(content, "rate limit") ||
 		strings.Contains(content, "Rate limit")
 }
 
-// containsPromptIndicator checks whether any line in the content ends with
-// a common shell or REPL prompt suffix, indicating the session is ready
-// and no dialog is present.
+// ContainsProviderRateLimitScreen reports whether pane content has
+// high-confidence provider rate-limit screen evidence.
+func ContainsProviderRateLimitScreen(content string) bool {
+	if strings.Contains(content, "Usage limit reached") ||
+		strings.Contains(content, "You've hit your limit") ||
+		strings.Contains(content, "/rate-limit-options") {
+		return true
+	}
+	return strings.Contains(strings.ToLower(content), "rate limit") &&
+		strings.Contains(content, "Keep trying") &&
+		strings.Contains(content, "Stop")
+}
+
+// containsPromptIndicator checks whether any line in the content looks like a
+// common shell or agent prompt, indicating the session is ready and no dialog is
+// present. Full-screen agent UIs often render placeholder input after the prompt
+// glyph, so Claude/Codex prompts are accepted as prefixes too.
 func containsPromptIndicator(content string) bool {
 	for _, line := range strings.Split(content, "\n") {
 		trimmed := strings.ReplaceAll(line, "\u00a0", " ")
@@ -648,7 +755,13 @@ func containsPromptIndicator(content string) bool {
 		if trimmed == "" {
 			continue
 		}
-		for _, suffix := range []string{">", "$", "%", "#", "\u276f"} {
+		for _, prefix := range []string{"\u276f", "\u203a"} {
+			rest, ok := strings.CutPrefix(trimmed, prefix+" ")
+			if trimmed == prefix || (ok && !isNumberedMenuRow(rest)) {
+				return true
+			}
+		}
+		for _, suffix := range []string{">", "$", "%", "#", "\u276f", "\u203a"} {
 			if strings.HasSuffix(trimmed, suffix) {
 				return true
 			}
@@ -657,6 +770,14 @@ func containsPromptIndicator(content string) bool {
 	return false
 }
 
+func isNumberedMenuRow(content string) bool {
+	digits := 0
+	for digits < len(content) && content[digits] >= '0' && content[digits] <= '9' {
+		digits++
+	}
+	return digits > 0 && digits < len(content) && content[digits] == '.'
+}
+
 // sleep waits for the given duration or until ctx is canceled.
 func sleep(ctx context.Context, d time.Duration) {
 	if d <= 0 {
diff --git a/internal/runtime/dialog_test.go b/internal/runtime/dialog_test.go
index 03ac1957e4..f5025dcb28 100644
--- a/internal/runtime/dialog_test.go
+++ b/internal/runtime/dialog_test.go
@@ -79,12 +79,10 @@ func TestAcceptStartupDialogsAcceptsCodexTrustDialog(t *testing.T) {
 	dialogPollTimeout = time.Second
 
 	var sent []string
-	peekCall := 0
 	err := AcceptStartupDialogs(
 		context.Background(),
 		func(_ int) (string, error) {
-			peekCall++
-			if peekCall == 1 {
+			if len(sent) == 0 {
 				return "Do you trust the contents of this directory?", nil
 			}
 			return "user@host $", nil
@@ -107,12 +105,10 @@ func TestAcceptStartupDialogsAcceptsGeminiTrustDialog(t *testing.T) {
 	dialogPollTimeout = time.Second
 
 	var sent []string
-	peekCall := 0
 	err := AcceptStartupDialogs(
 		context.Background(),
 		func(_ int) (string, error) {
-			peekCall++
-			if peekCall == 1 {
+			if len(sent) == 0 {
 				return "Do you trust the files in this folder?\n● 1. Trust folder (city)\n  2. Trust parent folder\n  3. Don't trust", nil
 			}
 			return "Type your message or @path/to/file", nil
@@ -156,6 +152,97 @@ func TestAcceptStartupDialogsPeeksDeepEnoughForLateTrustDialog(t *testing.T) {
 	}
 }
 
+func TestAcceptStartupDialogsSkipsCodexUpdateDialog(t *testing.T) {
+	withZeroDialogTimings(t)
+	dialogPollTimeout = time.Second
+
+	var sent []string
+	err := AcceptStartupDialogs(
+		context.Background(),
+		func(lines int) (string, error) {
+			if lines < 100 {
+				return "loading...", nil
+			}
+			return "✨ Update available! 0.124.0 -> 0.125.0\n" +
+				"› 1. Update now (runs `bun install -g @openai/codex`)\n" +
+				"  2. Skip\n" +
+				"  3. Skip until next version\n" +
+				"Press enter to continue", nil
+		},
+		func(keys ...string) error {
+			sent = append(sent, keys...)
+			return nil
+		},
+	)
+	if err != nil {
+		t.Fatalf("AcceptStartupDialogs returned error: %v", err)
+	}
+	if got, want := strings.Join(sent, ","), "Down,Enter"; got != want {
+		t.Fatalf("sent keys = %q, want %q", got, want)
+	}
+}
+
+func TestAcceptStartupDialogsSkipsUpdateThenHandlesTrustDialog(t *testing.T) {
+	withZeroDialogTimings(t)
+	dialogPollTimeout = time.Second
+
+	var sent []string
+	staleUpdateReturned := false
+	err := AcceptStartupDialogs(
+		context.Background(),
+		func(lines int) (string, error) {
+			if lines < 100 {
+				return "loading...", nil
+			}
+			switch {
+			case len(sent) < 2:
+				return codexUpdateDialogFixture(), nil
+			case !staleUpdateReturned:
+				staleUpdateReturned = true
+				return codexUpdateDialogFixture(), nil
+			case len(sent) == 2:
+				return "Do you trust the contents of this directory?", nil
+			default:
+				return "› Implement {feature}", nil
+			}
+		},
+		func(keys ...string) error {
+			sent = append(sent, keys...)
+			return nil
+		},
+	)
+	if err != nil {
+		t.Fatalf("AcceptStartupDialogs returned error: %v", err)
+	}
+	if got, want := strings.Join(sent, ","), "Down,Enter,Enter"; got != want {
+		t.Fatalf("sent keys = %q, want %q", got, want)
+	}
+}
+
+func TestAcceptStartupDialogsFromStreamSkipsCodexUpdateDialog(t *testing.T) {
+	var sent []string
+	snapshots := make(chan string, 2)
+	snapshots <- codexUpdateDialogFixture()
+	snapshots <- "› Implement {feature}"
+	close(snapshots)
+
+	err := AcceptStartupDialogsFromStream(
+		context.Background(),
+		time.Second,
+		snapshots,
+		func(keys ...string) error {
+			sent = append(sent, keys...)
+			return nil
+		},
+	)
+	if err != nil {
+		t.Fatalf("AcceptStartupDialogsFromStream() error = %v", err)
+	}
+	if got, want := strings.Join(sent, ","), "Down,Enter"; got != want {
+		t.Fatalf("sent keys = %q, want %q", got, want)
+	}
+}
+
 func TestAcceptStartupDialogsAcceptsBypassPermissionsWarning(t *testing.T) {
 	withZeroDialogTimings(t)
 	dialogPollTimeout = time.Second
@@ -485,6 +572,11 @@ func TestContainsPromptIndicator(t *testing.T) {
 		{name: "angle prompt", content: "claude >", want: true},
 		{name: "powerline prompt", content: "dir \u276f", want: true},
 		{name: "claude nbsp prompt", content: "❯\u00a0", want: true},
+		{name: "codex prompt", content: "›", want: true},
+		{name: "codex prompt with nbsp", content: "›\u00a0", want: true},
+		{name: "codex prompt with placeholder", content: "› Improve documentation in @filename", want: true},
+		{name: "claude prompt with text", content: "❯ run tests", want: true},
+		{name: "codex numbered menu row", content: "› 1. Update now (runs `bun install -g @openai/codex`)", want: false},
 		{name: "empty content", content: "", want: false},
 		{name: "no prompt", content: "loading...", want: false},
 		{name: "blank lines only", content: "\n\n", want: false},
@@ -501,6 +593,14 @@ func TestContainsPromptIndicator(t *testing.T) {
 	}
 }
 
+func codexUpdateDialogFixture() string {
+	return "✨ Update available! 0.124.0 -> 0.125.0\n" +
+		"› 1. Update now (runs `bun install -g @openai/codex`)\n" +
+		"  2. Skip\n" +
+		"  3. Skip until next version\n" +
+		"Press enter to continue"
+}
+
 func TestExitsEarlyOnPrompt(t *testing.T) {
 	withZeroDialogTimings(t)
 	dialogPollTimeout = time.Second
@@ -632,6 +732,8 @@ func TestContainsRateLimitDialog(t *testing.T) {
 		want    bool
 	}{
 		{name: "gemini usage limit", content: "Usage limit reached for gemini-3-flash-preview.", want: true},
+		{name: "claude hit limit", content: "You've hit your limit, Pro plan", want: true},
+		{name: "claude rate limit options", content: "/rate-limit-options", want: true},
 		{name: "generic rate limit", content: "rate limit exceeded", want: true},
 		{name: "Rate limit caps", content: "Rate limit: try again later", want: true},
 		{name: "normal output", content: "Hello world", want: false},
@@ -639,8 +741,32 @@ func TestContainsRateLimitDialog(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := containsRateLimitDialog(tt.content); got != tt.want {
-				t.Errorf("containsRateLimitDialog(%q) = %v, want %v", tt.content, got, tt.want)
+			if got := ContainsRateLimitDialog(tt.content); got != tt.want {
+				t.Errorf("ContainsRateLimitDialog(%q) = %v, want %v", tt.content, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestContainsProviderRateLimitScreen(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		content string
+		want    bool
+	}{
+		{name: "gemini usage limit", content: "Usage limit reached for gemini-3-flash-preview.", want: true},
+		{name: "claude hit limit", content: "You've hit your limit, Pro plan", want: true},
+		{name: "claude rate limit options", content: "/rate-limit-options", want: true},
+		{name: "provider menu shape", content: "Rate limit reached\n1. Keep trying\n2. Stop", want: true},
+		{name: "generic crash output", content: "worker failed while parsing rate limit config", want: false},
+		{name: "generic lower-case mention", content: "rate limit exceeded", want: false},
+		{name: "normal output", content: "Hello world", want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ContainsProviderRateLimitScreen(tt.content); got != tt.want {
+				t.Errorf("ContainsProviderRateLimitScreen(%q) = %v, want %v", tt.content, got, tt.want)
 			}
 		})
 	}
diff --git a/internal/runtime/exec/exec_test.go b/internal/runtime/exec/exec_test.go
index 8ccd42d7e9..0b03b3297b 100644
--- a/internal/runtime/exec/exec_test.go
+++ b/internal/runtime/exec/exec_test.go
@@ -15,6 +15,11 @@ import (
 	"github.com/gastownhall/gascity/internal/runtime/runtimetest"
 )
 
+const (
+	startupWatchNoHangTestTimeout = 10 * time.Second
+	startupWatchBlockingSleep     = "30"
+)
+
 // writeScript creates an executable shell script in dir and returns its path.
 func writeScript(t *testing.T, dir, content string) string {
 	t.Helper()
@@ -362,7 +367,7 @@ case "$op" in
     cat > /dev/null
     ;;
   watch-startup)
-    sh -c 'sleep 5' &
+    sh -c 'sleep `+startupWatchBlockingSleep+`' &
     exit 0
     ;;
   peek)
@@ -387,8 +392,10 @@ esac
 	})
 
 	done := make(chan error, 1)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	go func() {
-		done <- p.Start(context.Background(), "test-sess", runtime.Config{
+		done <- p.Start(ctx, "test-sess", runtime.Config{
 			EmitsPermissionWarning: true,
 		})
 	}()
@@ -398,7 +405,8 @@ esac
 		if err != nil {
 			t.Fatalf("Start: %v", err)
 		}
-	case <-time.After(2 * time.Second):
+	case <-time.After(startupWatchNoHangTestTimeout):
+		cancel()
 		t.Fatal("Start() hung while cleaning up a no-event watch-startup child")
 	}
 
@@ -423,7 +431,7 @@ case "$op" in
     ;;
   watch-startup)
     printf '%s\n' 'not-json'
-    sleep 5
+    sleep `+startupWatchBlockingSleep+`
     ;;
   stop)
     echo "$*" >> "`+stopFile+`"
@@ -434,8 +442,10 @@ esac
 	p := NewProvider(script)
 
 	done := make(chan error, 1)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	go func() {
-		done <- p.Start(context.Background(), "test-sess", runtime.Config{
+		done <- p.Start(ctx, "test-sess", runtime.Config{
 			EmitsPermissionWarning: true,
 		})
 	}()
@@ -448,7 +458,8 @@ esac
 		if !strings.Contains(err.Error(), "startup watcher decode") {
 			t.Fatalf("Start error = %v, want startup watcher decode context", err)
 		}
-	case <-time.After(2 * time.Second):
+	case <-time.After(startupWatchNoHangTestTimeout):
+		cancel()
 		t.Fatal("Start() hung after malformed first watch-startup event")
 	}
 
@@ -469,14 +480,14 @@ op="$1"
 case "$op" in
   watch-startup)
     printf '%s\n' 'not-json'
-    sleep 5
+    sleep `+startupWatchBlockingSleep+`
     ;;
   *) exit 2 ;;
 esac
 `)
 	p := NewProvider(script)
 
-	snapshots, closeWatch, ok, err := p.startStartupWatch(context.Background(), "test-sess", time.Second)
+	snapshots, closeWatch, ok, err := p.startStartupWatch(context.Background(), "test-sess", startupWatchNoHangTestTimeout)
 	if err == nil {
 		t.Fatal("startStartupWatch succeeded, want malformed first event error")
 	}
@@ -554,7 +565,7 @@ case "$op" in
     ;;
   watch-startup)
     printf '%s\n' '{"content":"starting up"}'
-    sleep 5
+    sleep `+startupWatchBlockingSleep+`
     ;;
   peek)
     echo "$*" >> "`+peekFile+`"
@@ -573,8 +584,10 @@ esac
 	p := NewProvider(script)
 
 	done := make(chan error, 1)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	go func() {
-		done <- p.Start(context.Background(), "test-sess", runtime.Config{
+		done <- p.Start(ctx, "test-sess", runtime.Config{
 			EmitsPermissionWarning: true,
 		})
 	}()
@@ -584,7 +597,8 @@ esac
 		if err != nil {
 			t.Fatalf("Start: %v", err)
 		}
-	case <-time.After(2 * time.Second):
+	case <-time.After(startupWatchNoHangTestTimeout):
+		cancel()
 		t.Fatal("Start() hung while falling back from an irrelevant watch-startup snapshot")
 	}
 
@@ -622,7 +636,7 @@ case "$op" in
       printf '%s\n' '{"content":"user@host $"}'
       i=$((i+1))
     done
-    sleep 5
+    sleep `+startupWatchBlockingSleep+`
     ;;
   send-keys)
     ;;
@@ -635,8 +649,10 @@ esac
 	p := NewProvider(script)
 
 	done := make(chan error, 1)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	go func() {
-		done <- p.Start(context.Background(), "test-sess", runtime.Config{
+		done <- p.Start(ctx, "test-sess", runtime.Config{
 			EmitsPermissionWarning: true,
 		})
 	}()
@@ -646,7 +662,8 @@ esac
 		if err != nil {
 			t.Fatalf("Start() error = %v, want nil", err)
 		}
-	case <-time.After(2 * time.Second):
+	case <-time.After(startupWatchNoHangTestTimeout):
+		cancel()
 		t.Fatal("Start() hung while cleaning up watch-startup stream")
 	}
 }
diff --git a/internal/runtime/fake.go b/internal/runtime/fake.go
index fbcdde0864..e9a6c88509 100644
--- a/internal/runtime/fake.go
+++ b/internal/runtime/fake.go
@@ -21,10 +21,12 @@ type Fake struct {
 	broken                  bool                         // when true, all ops fail
 	Zombies                 map[string]bool              // sessions with dead agent processes
 	Attached                map[string]bool              // sessions with attached terminals
+	AttachedSequence        map[string][]bool            // scripted IsAttached results by session
 	PeekOutput              map[string]string            // session → canned peek output
 	Activity                map[string]time.Time         // session → last activity time
 	StartErrors             map[string]error             // per-session Start errors for testing
 	StopErrors              map[string]error             // per-session Stop errors for testing
+	StopLeavesRunning       map[string]bool              // per-session Stop returns nil without deleting the session
 	PendingInteractions     map[string]*PendingInteraction
 	Responses               map[string][]InteractionResponse
 	SleepCapabilityValue    SessionSleepCapability
@@ -67,8 +69,10 @@ func NewFake() *Fake {
 		meta:                    make(map[string]map[string]string),
 		Zombies:                 make(map[string]bool),
 		Attached:                make(map[string]bool),
+		AttachedSequence:        make(map[string][]bool),
 		StartErrors:             make(map[string]error),
 		StopErrors:              make(map[string]error),
+		StopLeavesRunning:       make(map[string]bool),
 		PendingInteractions:     make(map[string]*PendingInteraction),
 		Responses:               make(map[string][]InteractionResponse),
 		SleepCapabilityValue:    SessionSleepCapabilityFull,
@@ -93,6 +97,7 @@ func NewFailFake() *Fake {
 		Attached:                make(map[string]bool),
 		StartErrors:             make(map[string]error),
 		StopErrors:              make(map[string]error),
+		StopLeavesRunning:       make(map[string]bool),
 		PendingInteractions:     make(map[string]*PendingInteraction),
 		Responses:               make(map[string][]InteractionResponse),
 		SleepCapabilityValue:    SessionSleepCapabilityFull,
@@ -138,6 +143,9 @@ func (f *Fake) Stop(name string) error {
 	if err, ok := f.StopErrors[name]; ok {
 		return err
 	}
+	if f.StopLeavesRunning[name] {
+		return nil
+	}
 	delete(f.sessions, name)
 	return nil
 }
@@ -225,6 +233,16 @@ func (f *Fake) SetAttached(name string, val bool) {
 	f.Attached[name] = val
 }
 
+// SetAttachedSequence scripts successive IsAttached results for a session.
+func (f *Fake) SetAttachedSequence(name string, values ...bool) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.AttachedSequence == nil {
+		f.AttachedSequence = make(map[string][]bool)
+	}
+	f.AttachedSequence[name] = append([]bool(nil), values...)
+}
+
 // IsAttached reports whether the fake session has an attached terminal.
 // When broken, always returns false.
 func (f *Fake) IsAttached(name string) bool {
@@ -234,6 +252,15 @@ func (f *Fake) IsAttached(name string) bool {
 	if f.broken {
 		return false
 	}
+	if seq := f.AttachedSequence[name]; len(seq) > 0 {
+		next := seq[0]
+		if len(seq) == 1 {
+			delete(f.AttachedSequence, name)
+		} else {
+			f.AttachedSequence[name] = seq[1:]
+		}
+		return next
+	}
 	return f.Attached[name]
 }
 
diff --git a/internal/runtime/fingerprint.go b/internal/runtime/fingerprint.go
index 370486273f..983b8d3ba4 100644
--- a/internal/runtime/fingerprint.go
+++ b/internal/runtime/fingerprint.go
@@ -309,12 +309,16 @@ func CoreFingerprintBreakdown(cfg Config) map[string]string {
 	}
 }
 
-// LogCoreFingerprintDrift writes diagnostic output when config-drift is
-// detected, showing per-field hash breakdown and values for the current
-// config. Compare against stored breakdown (from session start metadata)
-// to identify which field changed.
-func LogCoreFingerprintDrift(w io.Writer, name string, storedBreakdown map[string]string, current Config) {
-	currentBreakdown := CoreFingerprintBreakdown(current)
+// CoreFingerprintDriftFields returns sorted core fingerprint field names whose
+// current hashes differ from the stored per-field breakdown.
+func CoreFingerprintDriftFields(storedBreakdown map[string]string, current Config) []string {
+	if len(storedBreakdown) == 0 {
+		return nil
+	}
+	return coreFingerprintDriftFields(storedBreakdown, CoreFingerprintBreakdown(current))
+}
+
+func coreFingerprintDriftFields(storedBreakdown, currentBreakdown map[string]string) []string {
 	var diffs []string
 	for field, ch := range currentBreakdown {
 		sh := storedBreakdown[field]
@@ -323,6 +327,16 @@ func LogCoreFingerprintDrift(w io.Writer, name string, storedBreakdown map[strin
 		}
 	}
 	sort.Strings(diffs)
+	return diffs
+}
+
+// LogCoreFingerprintDrift writes diagnostic output when config-drift is
+// detected, showing per-field hash breakdown and values for the current
+// config. Compare against stored breakdown (from session start metadata)
+// to identify which field changed.
+func LogCoreFingerprintDrift(w io.Writer, name string, storedBreakdown map[string]string, current Config) {
+	currentBreakdown := CoreFingerprintBreakdown(current)
+	diffs := coreFingerprintDriftFields(storedBreakdown, currentBreakdown)
 	if len(diffs) == 0 {
 		// No stored breakdown available or all fields match — log full breakdown.
 		if len(storedBreakdown) == 0 {
diff --git a/internal/runtime/fingerprint_test.go b/internal/runtime/fingerprint_test.go
index 59e266a19b..1326bbba8a 100644
--- a/internal/runtime/fingerprint_test.go
+++ b/internal/runtime/fingerprint_test.go
@@ -453,6 +453,194 @@ func TestHashPathContentDirectory(t *testing.T) {
 	}
 }
 
+func TestHashPathContentDirectoryIgnoresRuntimeGeneratedArtifacts(t *testing.T) {
+	tests := []struct {
+		name  string
+		write func(t *testing.T, dir string)
+	}{
+		{
+			name: "__pycache__",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				cacheDir := filepath.Join(dir, "__pycache__")
+				if err := os.MkdirAll(cacheDir, 0o755); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(cacheDir, "check.cpython-312.pyc"), []byte("cache-a"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: ".pytest_cache",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				cacheDir := filepath.Join(dir, ".pytest_cache", "v")
+				if err := os.MkdirAll(cacheDir, 0o755); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(cacheDir, "cache"), []byte("pytest"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: ".mypy_cache",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				cacheDir := filepath.Join(dir, ".mypy_cache", "3.12")
+				if err := os.MkdirAll(cacheDir, 0o755); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(cacheDir, "module.data.json"), []byte("mypy"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: ".ruff_cache",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				cacheDir := filepath.Join(dir, ".ruff_cache")
+				if err := os.MkdirAll(cacheDir, 0o755); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(filepath.Join(cacheDir, "CACHEDIR.TAG"), []byte("ruff"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: ".pyc file",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				if err := os.WriteFile(filepath.Join(dir, "check.pyc"), []byte("cache-a"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: ".pyo file",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				if err := os.WriteFile(filepath.Join(dir, "check.pyo"), []byte("cache-a"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "editor backup suffix",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				if err := os.WriteFile(filepath.Join(dir, "check.py~"), []byte("backup"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "vim swap file",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				if err := os.WriteFile(filepath.Join(dir, ".check.py.swp"), []byte("swap"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "vim swap extension file",
+			write: func(t *testing.T, dir string) {
+				t.Helper()
+				if err := os.WriteFile(filepath.Join(dir, ".check.py.swx"), []byte("swap"), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			sub := filepath.Join(dir, "scripts")
+			if err := os.MkdirAll(sub, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(sub, "check.py"), []byte("print('ok')\n"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+
+			h1 := HashPathContent(sub)
+			if h1 == "" {
+				t.Fatal("expected non-empty hash for directory")
+			}
+
+			tt.write(t, sub)
+			h2 := HashPathContent(sub)
+			if h2 != h1 {
+				t.Fatalf("%s changed directory hash: %s vs %s", tt.name, h1, h2)
+			}
+		})
+	}
+}
+
+func TestHashPathContentDirectoryFingerprintsUserAuthoredTempExtensionFiles(t *testing.T) {
+	tests := []string{
+		"payload.tmp",
+		"fixture.temp",
+		"notes.swp",
+		"notes.swx",
+	}
+
+	for _, name := range tests {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			sub := filepath.Join(dir, "scripts")
+			if err := os.MkdirAll(sub, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(sub, "check.py"), []byte("print('ok')\n"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+
+			h1 := HashPathContent(sub)
+			if h1 == "" {
+				t.Fatal("expected non-empty hash for directory")
+			}
+
+			if err := os.WriteFile(filepath.Join(sub, name), []byte("user-authored"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			h2 := HashPathContent(sub)
+			if h2 == h1 {
+				t.Fatalf("user-authored %s should change directory hash", name)
+			}
+		})
+	}
+}
+
+func TestHashPathContentDirectoryFingerprintsSourceFileChanges(t *testing.T) {
+	dir := t.TempDir()
+	sub := filepath.Join(dir, "scripts")
+	if err := os.MkdirAll(sub, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sub, "check.py"), []byte("print('ok')\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	h1 := HashPathContent(sub)
+	if h1 == "" {
+		t.Fatal("expected non-empty hash for directory")
+	}
+
+	if err := os.WriteFile(filepath.Join(sub, "check.py"), []byte("print('changed')\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	h2 := HashPathContent(sub)
+	if h2 == h1 {
+		t.Fatal("source file changes should change directory hash")
+	}
+}
+
 func TestHashPathContentMissingPath(t *testing.T) {
 	h := HashPathContent("/nonexistent/path/that/does/not/exist")
 	if h != "" {
@@ -507,3 +695,21 @@ func TestLogCoreFingerprintDriftCopyFiles(t *testing.T) {
 		t.Errorf("expected RelDst detail in CopyFiles drift output, got: %s", out)
 	}
 }
+
+func TestCoreFingerprintDriftFields(t *testing.T) {
+	current := Config{
+		Command:   "claude",
+		CopyFiles: []CopyEntry{{RelDst: "bar", Probed: true, ContentHash: "newhash"}},
+	}
+	stored := CoreFingerprintBreakdown(current)
+	stored["CopyFiles"] = "oldhash"
+
+	got := CoreFingerprintDriftFields(stored, current)
+	if len(got) != 1 || got[0] != "CopyFiles" {
+		t.Fatalf("CoreFingerprintDriftFields = %v, want [CopyFiles]", got)
+	}
+
+	if got := CoreFingerprintDriftFields(nil, current); len(got) != 0 {
+		t.Fatalf("CoreFingerprintDriftFields with missing breakdown = %v, want empty", got)
+	}
+}
diff --git a/internal/runtime/hybrid/hybrid.go b/internal/runtime/hybrid/hybrid.go
index 2b46650b57..965e8134b7 100644
--- a/internal/runtime/hybrid/hybrid.go
+++ b/internal/runtime/hybrid/hybrid.go
@@ -19,6 +19,7 @@ type Provider struct {
 
 var (
 	_ runtime.Provider                      = (*Provider)(nil)
+	_ runtime.DeadRuntimeSessionChecker     = (*Provider)(nil)
 	_ runtime.InteractionProvider           = (*Provider)(nil)
 	_ runtime.InterruptBoundaryWaitProvider = (*Provider)(nil)
 	_ runtime.InterruptedTurnResetProvider  = (*Provider)(nil)
@@ -57,6 +58,16 @@ func (p *Provider) IsRunning(name string) bool {
 	return p.route(name).IsRunning(name)
 }
 
+// IsDeadRuntimeSession delegates to the routed backend when it can positively
+// distinguish live sessions from visible dead artifacts.
+func (p *Provider) IsDeadRuntimeSession(name string) (bool, error) {
+	checker, ok := p.route(name).(runtime.DeadRuntimeSessionChecker)
+	if !ok {
+		return false, nil
+	}
+	return checker.IsDeadRuntimeSession(name)
+}
+
 // IsAttached delegates to the routed backend.
 func (p *Provider) IsAttached(name string) bool {
 	return p.route(name).IsAttached(name)
diff --git a/internal/runtime/hybrid/hybrid_test.go b/internal/runtime/hybrid/hybrid_test.go
index af0603b15d..c52bde915b 100644
--- a/internal/runtime/hybrid/hybrid_test.go
+++ b/internal/runtime/hybrid/hybrid_test.go
@@ -3,6 +3,7 @@ package hybrid
 import (
 	"context"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 
@@ -177,3 +178,83 @@ func TestPendingUnsupportedWhenBackendLacksInteractionSupport(t *testing.T) {
 type runtimeNoInteractionProvider struct {
 	runtime.Provider
 }
+
+type deadRuntimeCheckProvider struct {
+	*runtime.Fake
+	dead   map[string]bool
+	errs   map[string]error
+	checks []string
+}
+
+func newDeadRuntimeCheckProvider() *deadRuntimeCheckProvider {
+	return &deadRuntimeCheckProvider{
+		Fake: runtime.NewFake(),
+		dead: make(map[string]bool),
+		errs: make(map[string]error),
+	}
+}
+
+func (p *deadRuntimeCheckProvider) IsDeadRuntimeSession(name string) (bool, error) {
+	p.checks = append(p.checks, name)
+	if err := p.errs[name]; err != nil {
+		return false, err
+	}
+	return p.dead[name], nil
+}
+
+func TestIsDeadRuntimeSessionDelegatesToRoutedChecker(t *testing.T) {
+	local := newDeadRuntimeCheckProvider()
+	remote := newDeadRuntimeCheckProvider()
+	remote.dead["polecat-1"] = true
+	h := New(local, remote, isRemote)
+
+	dead, err := h.IsDeadRuntimeSession("polecat-1")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if !dead {
+		t.Fatal("IsDeadRuntimeSession = false, want true from routed remote checker")
+	}
+	if len(local.checks) != 0 {
+		t.Fatalf("local checks = %v, want none", local.checks)
+	}
+	if got := remote.checks; len(got) != 1 || got[0] != "polecat-1" {
+		t.Fatalf("remote checks = %v, want [polecat-1]", got)
+	}
+}
+
+func TestIsDeadRuntimeSessionReturnsFalseWhenRoutedBackendLacksChecker(t *testing.T) {
+	local := runtime.NewFake()
+	remote := newDeadRuntimeCheckProvider()
+	remote.dead["refinery"] = true
+	h := New(local, remote, isRemote)
+
+	dead, err := h.IsDeadRuntimeSession("refinery")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if dead {
+		t.Fatal("IsDeadRuntimeSession = true, want false for non-checker routed backend")
+	}
+	if len(remote.checks) != 0 {
+		t.Fatalf("remote checks = %v, want none for local-routed session", remote.checks)
+	}
+}
+
+func TestIsDeadRuntimeSessionReturnsRoutedCheckerError(t *testing.T) {
+	local := newDeadRuntimeCheckProvider()
+	remote := newDeadRuntimeCheckProvider()
+	remote.errs["polecat-1"] = fmt.Errorf("runtime unavailable")
+	h := New(local, remote, isRemote)
+
+	dead, err := h.IsDeadRuntimeSession("polecat-1")
+	if err == nil {
+		t.Fatal("IsDeadRuntimeSession error = nil, want routed checker error")
+	}
+	if dead {
+		t.Fatal("IsDeadRuntimeSession = true, want false on checker error")
+	}
+	if !strings.Contains(err.Error(), "runtime unavailable") {
+		t.Fatalf("IsDeadRuntimeSession error = %v, want runtime unavailable", err)
+	}
+}
diff --git a/internal/runtime/k8s/beads_script_test.go b/internal/runtime/k8s/beads_script_test.go
index 172fb6f25a..9700ba4584 100644
--- a/internal/runtime/k8s/beads_script_test.go
+++ b/internal/runtime/k8s/beads_script_test.go
@@ -57,6 +57,57 @@ func TestBeadsScriptInitUsesScopeRootAndCanonicalDoltTarget(t *testing.T) {
 	assertCallNotContains(t, result.callLog, "3308")
 }
 
+// TestBeadsScriptInitSetsBEADSDIR verifies the contrib gc-beads-k8s script
+// exports BEADS_DIR inside the pod before running bd init. Without it, bd
+// init creates a .git/ as a side effect in the workspace. Regression for
+// #399.
+func TestBeadsScriptInitSetsBEADSDIR(t *testing.T) {
+	result := runBeadsScript(t, beadsScriptOptions{
+		Op:   "init",
+		Args: []string{"/city/frontend", "fe"},
+		Env: map[string]string{
+			"GC_CITY_PATH":    "/city",
+			"GC_STORE_ROOT":   "/city/frontend",
+			"GC_BEADS_PREFIX": "fe",
+			"GC_DOLT_HOST":    "canonical-dolt.example.com",
+			"GC_DOLT_PORT":    "4406",
+		},
+	})
+	if result.err != nil {
+		t.Fatalf("gc-beads-k8s init error = %v\noutput:\n%s", result.err, result.output)
+	}
+	assertCallContains(t, result.callLog, `export BEADS_DIR="$workdir/.beads"`)
+	assertCallContains(t, result.callLog, `git config --global beads.role`)
+	assertCallContains(t, result.callLog, "init --server")
+}
+
+func TestBeadsScriptInitDoesNotPreseedIssuePrefixBeforeBdInit(t *testing.T) {
+	result := runBeadsScript(t, beadsScriptOptions{
+		Op:   "init",
+		Args: []string{"/city/frontend", "fe"},
+		Env: map[string]string{
+			"GC_CITY_PATH":    "/city",
+			"GC_STORE_ROOT":   "/city/frontend",
+			"GC_BEADS_PREFIX": "fe",
+			"GC_DOLT_HOST":    "canonical-dolt.example.com",
+			"GC_DOLT_PORT":    "4406",
+		},
+	})
+	if result.err != nil {
+		t.Fatalf("gc-beads-k8s init error = %v\noutput:\n%s", result.err, result.output)
+	}
+	lines := strings.Split(strings.TrimSpace(result.callLog), "\n")
+	if len(lines) == 0 {
+		t.Fatal("call log was empty")
+	}
+	if !strings.Contains(lines[0], "init --server") {
+		t.Fatalf("first init call = %q, want init --server", lines[0])
+	}
+	if strings.Contains(result.callLog, "config set issue_prefix") {
+		t.Fatalf("init flow should not rewrite issue_prefix around bd init:\n%s", result.callLog)
+	}
+}
+
 func TestBeadsScriptInitRejectsPartialCanonicalDoltTarget(t *testing.T) {
 	clearDoltAndCityEnv(t)
 	result := runBeadsScript(t, beadsScriptOptions{
@@ -108,6 +159,41 @@ func TestBeadsScriptListUsesScopedWorkdir(t *testing.T) {
 	}
 	assertCallContains(t, result.callLog, "/workspace/frontend")
 	assertCallContains(t, result.callLog, "list --json --limit 0 --all")
+	assertCallContains(t, result.callLog, `export BEADS_DIR="$workdir/.beads"`)
+	assertCallContains(t, result.callLog, `git config --global beads.role`)
+}
+
+func TestBeadsScriptListDoesNotRewriteIssuePrefixPerCommand(t *testing.T) {
+	result := runBeadsScript(t, beadsScriptOptions{
+		Op: "list",
+		Env: map[string]string{
+			"GC_CITY_PATH":    "/city",
+			"GC_STORE_ROOT":   "/city/frontend",
+			"GC_BEADS_PREFIX": "fe",
+		},
+		ListOutput: "[]",
+	})
+	if result.err != nil {
+		t.Fatalf("gc-beads-k8s list error = %v\noutput:\n%s", result.err, result.output)
+	}
+	assertCallNotContains(t, result.callLog, "config set issue_prefix")
+}
+
+func TestBeadsScriptConfigSetKeepsBEADSDIRScoped(t *testing.T) {
+	result := runBeadsScript(t, beadsScriptOptions{
+		Op:   "config-set",
+		Args: []string{"issue_prefix", "fe"},
+		Env: map[string]string{
+			"GC_CITY_PATH":  "/city",
+			"GC_STORE_ROOT": "/city/frontend",
+		},
+	})
+	if result.err != nil {
+		t.Fatalf("gc-beads-k8s config-set error = %v\noutput:\n%s", result.err, result.output)
+	}
+	assertCallContains(t, result.callLog, "/workspace/frontend")
+	assertCallContains(t, result.callLog, "config set issue_prefix fe")
+	assertCallContains(t, result.callLog, `export BEADS_DIR="$workdir/.beads"`)
 }
 
 type beadsScriptOptions struct {
diff --git a/internal/runtime/k8s/pod.go b/internal/runtime/k8s/pod.go
index b5367755e3..50b898f34d 100644
--- a/internal/runtime/k8s/pod.go
+++ b/internal/runtime/k8s/pod.go
@@ -3,6 +3,7 @@ package k8s
 import (
 	"encoding/base64"
 	"fmt"
+	"path/filepath"
 	"sort"
 	"strings"
 
@@ -10,6 +11,8 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	"github.com/gastownhall/gascity/internal/citylayout"
+	"github.com/gastownhall/gascity/internal/pathutil"
 	"github.com/gastownhall/gascity/internal/runtime"
 )
 
@@ -67,6 +70,41 @@ func projectedPodStoreRoot(cfg runtime.Config, podWorkDir string) string {
 	return storeRoot
 }
 
+func projectedPodRuntimeDir(cfgEnv map[string]string, ctrlCity string) string {
+	podCity := "/workspace"
+	runtimeDir := strings.TrimSpace(cfgEnv["GC_CITY_RUNTIME_DIR"])
+	if runtimeDir == "" {
+		return citylayout.RuntimeDataDir(podCity)
+	}
+	remapped := remapControllerPathToPod(runtimeDir, ctrlCity)
+	if remapped != runtimeDir {
+		return remapped
+	}
+	return citylayout.RuntimeDataDir(podCity)
+}
+
+func projectControllerRuntimePathToPod(path, ctrlCity, ctrlRuntimeDir, podRuntimeDir string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return path
+	}
+	if remapped := remapControllerPathToPod(path, ctrlCity); remapped != path {
+		return remapped
+	}
+	if ctrlRuntimeDir != "" && pathutil.PathWithin(ctrlRuntimeDir, path) {
+		normalizedRoot := pathutil.NormalizePathForCompare(ctrlRuntimeDir)
+		normalizedPath := pathutil.NormalizePathForCompare(path)
+		rel, err := filepath.Rel(normalizedRoot, normalizedPath)
+		if err == nil {
+			if rel == "." {
+				return podRuntimeDir
+			}
+			return filepath.Join(podRuntimeDir, rel)
+		}
+	}
+	return path
+}
+
 // projectedPodDoltEnv adapts the controller projection to a pod-visible Dolt
 // target. Managed-local controller projections intentionally omit GC_DOLT_HOST
 // and use a host-local runtime port; pods translate that blank-host managed
@@ -339,6 +377,8 @@ func buildPodEnv(cfgEnv map[string]string, podWorkDir, managedServiceHost, manag
 	}
 
 	ctrlCity := controllerCityPath(cfgEnv)
+	ctrlRuntimeDir := strings.TrimSpace(cfgEnv["GC_CITY_RUNTIME_DIR"])
+	podRuntimeDir := projectedPodRuntimeDir(cfgEnv, ctrlCity)
 
 	var env []corev1.EnvVar
 	for k, v := range cfgEnv {
@@ -352,7 +392,11 @@ func buildPodEnv(cfgEnv map[string]string, podWorkDir, managedServiceHost, manag
 			val = "/workspace"
 		case "GC_DIR":
 			val = podWorkDir
-		case "GC_STORE_ROOT", "GC_RIG_ROOT", "BEADS_DIR", "GT_ROOT", "GC_CITY_RUNTIME_DIR", "GC_PACK_STATE_DIR", "GC_PACK_DIR":
+		case "GC_CITY_RUNTIME_DIR":
+			val = podRuntimeDir
+		case "GC_CONTROL_DISPATCHER_TRACE_DEFAULT", "GC_PACK_STATE_DIR":
+			val = projectControllerRuntimePathToPod(val, ctrlCity, ctrlRuntimeDir, podRuntimeDir)
+		case "GC_STORE_ROOT", "GC_RIG_ROOT", "BEADS_DIR", "GT_ROOT", "GC_PACK_DIR":
 			val = remapControllerPathToPod(val, ctrlCity)
 		}
 		env = append(env, corev1.EnvVar{Name: k, Value: val})
diff --git a/internal/runtime/k8s/provider.go b/internal/runtime/k8s/provider.go
index 40e5e14fb5..0fb46ef1de 100644
--- a/internal/runtime/k8s/provider.go
+++ b/internal/runtime/k8s/provider.go
@@ -747,7 +747,7 @@ func initBeadsInPod(ctx context.Context, ops k8sOps, podName string, cfg runtime
 			`else PREFIX=$(echo '%s' | base64 -d) && `+
 			`DOLT_HOST=$(echo '%s' | base64 -d) && `+
 			`DOLT_PORT=$(echo '%s' | base64 -d) && `+
-			`yes | bd init --server --server-host "$DOLT_HOST" --server-port "$DOLT_PORT" -p "$PREFIX" --skip-hooks --skip-agents; fi`,
+			`yes | BEADS_DIR="$WD/.beads" bd init --server --server-host "$DOLT_HOST" --server-port "$DOLT_PORT" -p "$PREFIX" --skip-hooks --skip-agents; fi`,
 		storeRootB64, patchB64, prefixB64,
 		base64.StdEncoding.EncodeToString([]byte(doltHost)),
 		base64.StdEncoding.EncodeToString([]byte(doltPort)),
diff --git a/internal/runtime/k8s/provider_test.go b/internal/runtime/k8s/provider_test.go
index f12a8a58f9..fd74a109df 100644
--- a/internal/runtime/k8s/provider_test.go
+++ b/internal/runtime/k8s/provider_test.go
@@ -713,33 +713,34 @@ func mustBuildPodEnv(t *testing.T, cfgEnv map[string]string, podWorkDir, managed
 
 func TestBuildPodEnvRemapsVars(t *testing.T) {
 	cfgEnv := map[string]string{
-		"GC_AGENT":               "mayor",
-		"GC_CITY":                "/host/city",
-		"GC_CITY_PATH":           "/host/city",
-		"GC_DIR":                 "/host/city/rig",
-		"GC_RIG_ROOT":            "/host/city/rig",
-		"GC_STORE_ROOT":          "/host/city/rig",
-		"BEADS_DIR":              "/host/city/rig/.beads",
-		"GT_ROOT":                "/host/city",
-		"GC_CITY_RUNTIME_DIR":    "/host/city/.gc/runtime",
-		"GC_PACK_STATE_DIR":      "/host/city/.gc/runtime/packs/rlm",
-		"GC_PACK_DIR":            "/host/city/packs/maintenance",
-		"GC_SESSION":             "exec:gc-session-k8s",
-		"GC_BEADS":               "exec:something",
-		"GC_EVENTS":              "exec:other",
-		"GC_DOLT_HOST":           "",
-		"GC_DOLT_PORT":           "3307",
-		"BEADS_DOLT_SERVER_HOST": "",
-		"BEADS_DOLT_SERVER_PORT": "3307",
-		"GC_K8S_DOLT_HOST":       "legacy-dolt.example.com",
-		"GC_K8S_DOLT_PORT":       "3308",
-		"GC_DOLT_USER":           "admin",
-		"GC_DOLT_PASSWORD":       "secret",
-		"BEADS_DOLT_SERVER_USER": "admin",
-		"BEADS_DOLT_PASSWORD":    "secret",
-		"GC_MAIL":                "exec:mail",
-		"GC_MCP_MAIL_URL":        "http://localhost:8765",
-		"CUSTOM_VAR":             "preserved",
+		"GC_AGENT":                            "mayor",
+		"GC_CITY":                             "/host/city",
+		"GC_CITY_PATH":                        "/host/city",
+		"GC_DIR":                              "/host/city/rig",
+		"GC_RIG_ROOT":                         "/host/city/rig",
+		"GC_STORE_ROOT":                       "/host/city/rig",
+		"BEADS_DIR":                           "/host/city/rig/.beads",
+		"GT_ROOT":                             "/host/city",
+		"GC_CITY_RUNTIME_DIR":                 "/host/city/.gc/runtime",
+		"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": "/host/city/.gc/runtime/control-dispatcher-trace.log",
+		"GC_PACK_STATE_DIR":                   "/host/city/.gc/runtime/packs/rlm",
+		"GC_PACK_DIR":                         "/host/city/packs/maintenance",
+		"GC_SESSION":                          "exec:gc-session-k8s",
+		"GC_BEADS":                            "exec:something",
+		"GC_EVENTS":                           "exec:other",
+		"GC_DOLT_HOST":                        "",
+		"GC_DOLT_PORT":                        "3307",
+		"BEADS_DOLT_SERVER_HOST":              "",
+		"BEADS_DOLT_SERVER_PORT":              "3307",
+		"GC_K8S_DOLT_HOST":                    "legacy-dolt.example.com",
+		"GC_K8S_DOLT_PORT":                    "3308",
+		"GC_DOLT_USER":                        "admin",
+		"GC_DOLT_PASSWORD":                    "secret",
+		"BEADS_DOLT_SERVER_USER":              "admin",
+		"BEADS_DOLT_PASSWORD":                 "secret",
+		"GC_MAIL":                             "exec:mail",
+		"GC_MCP_MAIL_URL":                     "http://localhost:8765",
+		"CUSTOM_VAR":                          "preserved",
 	}
 
 	env := mustBuildPodEnv(t, cfgEnv, "/workspace/rig", podManagedDoltHost, podManagedDoltPort)
@@ -787,6 +788,11 @@ func TestBuildPodEnvRemapsVars(t *testing.T) {
 		t.Errorf("GC_CITY_RUNTIME_DIR = %q, want /workspace/.gc/runtime", envMap["GC_CITY_RUNTIME_DIR"])
 	}
 
+	// GC_CONTROL_DISPATCHER_TRACE_DEFAULT should be remapped.
+	if envMap["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != "/workspace/.gc/runtime/control-dispatcher-trace.log" {
+		t.Errorf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want /workspace/.gc/runtime/control-dispatcher-trace.log", envMap["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"])
+	}
+
 	// GC_PACK_STATE_DIR should be remapped.
 	if envMap["GC_PACK_STATE_DIR"] != "/workspace/.gc/runtime/packs/rlm" {
 		t.Errorf("GC_PACK_STATE_DIR = %q, want /workspace/.gc/runtime/packs/rlm", envMap["GC_PACK_STATE_DIR"])
@@ -843,6 +849,33 @@ func TestBuildPodEnvRemapsVars(t *testing.T) {
 	}
 }
 
+func TestBuildPodEnvReprojectsExternalRuntimeRoots(t *testing.T) {
+	cfgEnv := map[string]string{
+		"GC_CITY":                             "/host/city",
+		"GC_CITY_PATH":                        "/host/city",
+		"GC_CITY_RUNTIME_DIR":                 "/var/tmp/gascity-runtime",
+		"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": "/var/tmp/gascity-runtime/control-dispatcher-trace.log",
+		"GC_PACK_STATE_DIR":                   "/var/tmp/gascity-runtime/packs/rlm",
+	}
+
+	env := mustBuildPodEnv(t, cfgEnv, "/workspace", podManagedDoltHost, podManagedDoltPort)
+
+	envMap := map[string]string{}
+	for _, e := range env {
+		envMap[e.Name] = e.Value
+	}
+
+	if envMap["GC_CITY_RUNTIME_DIR"] != "/workspace/.gc/runtime" {
+		t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want /workspace/.gc/runtime", envMap["GC_CITY_RUNTIME_DIR"])
+	}
+	if envMap["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != "/workspace/.gc/runtime/control-dispatcher-trace.log" {
+		t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want /workspace/.gc/runtime/control-dispatcher-trace.log", envMap["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"])
+	}
+	if envMap["GC_PACK_STATE_DIR"] != "/workspace/.gc/runtime/packs/rlm" {
+		t.Fatalf("GC_PACK_STATE_DIR = %q, want /workspace/.gc/runtime/packs/rlm", envMap["GC_PACK_STATE_DIR"])
+	}
+}
+
 func TestBuildPodEnvProjectsManagedDoltEndpoint(t *testing.T) {
 	cfgEnv := map[string]string{
 		"GC_AGENT":               "worker",
@@ -1386,6 +1419,37 @@ func TestStartWarnsWhenInitBeadsInPodFails(t *testing.T) {
 	}
 }
 
+// TestInitBeadsInPodBdInitSetsBEADSDIR verifies that the pod bootstrap bd init
+// sets BEADS_DIR so bd does not create a .git/ as a side effect in the pod
+// workspace. Regression for #399.
+func TestInitBeadsInPodBdInitSetsBEADSDIR(t *testing.T) {
+	fake := newFakeK8sOps()
+	cfg := runtime.Config{
+		Env: map[string]string{
+			"GC_DOLT_HOST":    podManagedDoltHost,
+			"GC_DOLT_PORT":    podManagedDoltPort,
+			"GC_BEADS_PREFIX": "demo",
+		},
+	}
+	if err := initBeadsInPod(context.Background(), fake, "gc-test-pod", cfg, "/workspace/demo-repo", podManagedDoltHost, podManagedDoltPort); err != nil {
+		t.Fatalf("initBeadsInPod: %v", err)
+	}
+	var script string
+	for _, c := range fake.calls {
+		if c.method == "execInPod" && len(c.cmd) >= 3 && c.cmd[0] == "sh" && c.cmd[1] == "-c" {
+			script = c.cmd[2]
+			break
+		}
+	}
+	if script == "" {
+		t.Fatal("no sh -c exec call found")
+	}
+	want := `BEADS_DIR="$WD/.beads" bd init --server`
+	if !strings.Contains(script, want) {
+		t.Errorf("bd init invocation missing BEADS_DIR env prefix: %q not found in script:\n%s", want, script)
+	}
+}
+
 // TestInitBeadsInPodStripsProjectIDFromMetadata verifies that the metadata
 // patch removes the controller's project_id so the agent pod's bd does not
 // fail with PROJECT IDENTITY MISMATCH against the in-cluster Dolt server.
diff --git a/internal/runtime/provider_core.go b/internal/runtime/provider_core.go
index 1866db025b..a24546c4ac 100644
--- a/internal/runtime/provider_core.go
+++ b/internal/runtime/provider_core.go
@@ -48,6 +48,15 @@ func IsPartialListError(err error) bool {
 	return errors.As(err, &target)
 }
 
+// DeadRuntimeSessionChecker is an optional provider capability for destructive
+// cleanup paths that need positive proof a visible runtime artifact is dead.
+// A false result means either the session is live, absent, or unsupported by
+// the backend; a non-nil error means liveness could not be confirmed.
+type DeadRuntimeSessionChecker interface {
+	// IsDeadRuntimeSession reports whether name is visible but confirmed dead.
+	IsDeadRuntimeSession(name string) (bool, error)
+}
+
 // MergeBackendListResults merges provider ListRunning results. On partial
 // backend failure it returns the best-effort merged names plus a
 // [PartialListError] so callers can continue with partial results while still
diff --git a/internal/runtime/runtime.go b/internal/runtime/runtime.go
index bd1dc8ca69..627d586aab 100644
--- a/internal/runtime/runtime.go
+++ b/internal/runtime/runtime.go
@@ -299,7 +299,8 @@ type CopyEntry struct {
 
 // HashPathContent returns a hex-encoded SHA-256 of the content at path.
 // For a regular file, hashes the file content. For a directory, hashes
-// a sorted manifest of relative paths and their contents. Returns empty
+// a sorted manifest of relative paths and their contents while ignoring
+// runtime-generated Python cache and editor backup artifacts. Returns empty
 // string on any error (caller should treat as "unknown").
 func HashPathContent(path string) string {
 	info, err := os.Stat(path)
@@ -325,10 +326,19 @@ func HashPathContent(path string) string {
 			walkErr = true
 			return nil
 		}
+		rel, _ := filepath.Rel(path, p)
+		if rel == "." {
+			return nil
+		}
+		if hashPathContentSkipEntry(d) {
+			if d.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
 		if d.IsDir() {
 			return nil
 		}
-		rel, _ := filepath.Rel(path, p)
 		entries = append(entries, rel)
 		return nil
 	})
@@ -349,6 +359,25 @@ func HashPathContent(path string) string {
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
 
+func hashPathContentSkipEntry(d fs.DirEntry) bool {
+	base := d.Name()
+	if d.IsDir() {
+		switch base {
+		case "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache":
+			return true
+		default:
+			return false
+		}
+	}
+	switch filepath.Ext(base) {
+	case ".pyc", ".pyo":
+		return true
+	case ".swp", ".swx":
+		return strings.HasPrefix(base, ".")
+	}
+	return strings.HasSuffix(base, "~")
+}
+
 // Config holds the parameters for starting a new session.
 type Config struct {
 	// WorkDir is the working directory for the session process.
diff --git a/internal/runtime/subprocess/conformance_test.go b/internal/runtime/subprocess/conformance_test.go
index a9ce5ac67b..4a8ce86c03 100644
--- a/internal/runtime/subprocess/conformance_test.go
+++ b/internal/runtime/subprocess/conformance_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func TestSubprocessConformance(t *testing.T) {
-	p := NewProviderWithDir(filepath.Join(t.TempDir(), "pids"))
+	p := NewProviderWithDir(filepath.Join(shortTempDir(t), "pids"))
 	var counter int64
 
 	runtimetest.RunProviderTests(t, func(t *testing.T) (runtime.Provider, runtime.Config, string) {
diff --git a/internal/runtime/subprocess/subprocess.go b/internal/runtime/subprocess/subprocess.go
index dcb873bdcd..8784b8575e 100644
--- a/internal/runtime/subprocess/subprocess.go
+++ b/internal/runtime/subprocess/subprocess.go
@@ -159,6 +159,15 @@ func (p *Provider) Start(_ context.Context, name string, cfg runtime.Config) err
 		clearWorkDir()
 		return fmt.Errorf("creating control socket for %q: %w", name, err)
 	}
+	if err := p.persistStartMetadata(name, cfg.Env); err != nil {
+		lis.Close() //nolint:errcheck
+		_ = os.Remove(p.sockPath(name))
+		_ = os.Remove(p.sockNamePath(name))
+		_ = cmd.Process.Kill()
+		_ = cmd.Wait()
+		clearWorkDir()
+		return fmt.Errorf("storing metadata for %q: %w", name, err)
+	}
 
 	go func() {
 		_ = cmd.Wait()
@@ -167,6 +176,7 @@ func (p *Provider) Start(_ context.Context, name string, cfg runtime.Config) err
 		lis.Close()                 //nolint:errcheck
 		os.Remove(p.sockPath(name)) //nolint:errcheck
 		_ = os.Remove(p.sockNamePath(name))
+		p.clearSessionMeta(name)
 		close(done)
 	}()
 
@@ -300,6 +310,17 @@ func (p *Provider) RemoveMeta(name, key string) error {
 	return err
 }
 
+func (p *Provider) persistStartMetadata(name string, env map[string]string) error {
+	p.clearSessionMeta(name)
+	for key, value := range env {
+		if err := p.SetMeta(name, key, value); err != nil {
+			p.clearSessionMeta(name)
+			return err
+		}
+	}
+	return nil
+}
+
 // GetLastActivity returns zero time — subprocess provider does not
 // support activity tracking.
 func (p *Provider) GetLastActivity(_ string) (time.Time, error) {
@@ -369,6 +390,16 @@ func (p *Provider) metaPath(name, key string) string {
 	return filepath.Join(p.dir, metaFilePrefix(name)+".meta."+metaFileKey(key))
 }
 
+func (p *Provider) clearSessionMeta(name string) {
+	matches, err := filepath.Glob(filepath.Join(p.dir, metaFilePrefix(name)+".meta.*"))
+	if err != nil {
+		return
+	}
+	for _, path := range matches {
+		_ = os.Remove(path)
+	}
+}
+
 func metaFilePrefix(name string) string {
 	return "m" + metaFileKey(name)
 }
diff --git a/internal/runtime/subprocess/subprocess_test.go b/internal/runtime/subprocess/subprocess_test.go
index 707ddba8b8..2f7f7adb42 100644
--- a/internal/runtime/subprocess/subprocess_test.go
+++ b/internal/runtime/subprocess/subprocess_test.go
@@ -45,6 +45,36 @@ func TestStartCreatesProcess(t *testing.T) {
 	}
 }
 
+func TestStartPersistsRuntimeMetadataForGetMeta(t *testing.T) {
+	p := newTestProvider(t)
+	err := p.Start(context.Background(), "meta-start", runtime.Config{
+		Command: "sleep 3600",
+		Env: map[string]string{
+			"GC_SESSION_ID":     "bead-123",
+			"GC_INSTANCE_TOKEN": "token-456",
+			"GC_TEMPLATE":       "worker",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	defer p.Stop("meta-start") //nolint:errcheck
+
+	for key, want := range map[string]string{
+		"GC_SESSION_ID":     "bead-123",
+		"GC_INSTANCE_TOKEN": "token-456",
+		"GC_TEMPLATE":       "worker",
+	} {
+		got, err := p.GetMeta("meta-start", key)
+		if err != nil {
+			t.Fatalf("GetMeta(%s): %v", key, err)
+		}
+		if got != want {
+			t.Fatalf("GetMeta(%s) = %q, want %q", key, got, want)
+		}
+	}
+}
+
 func TestStartLongSocketPathUsesShortSocketName(t *testing.T) {
 	// Use /tmp for a short base path — TMPDIR on macOS (/var/folders/...)
 	// is too long to find a depth where legacy > limit but short < limit.
diff --git a/internal/runtime/tmux/adapter.go b/internal/runtime/tmux/adapter.go
index 7dc243a4eb..8b5a6512da 100644
--- a/internal/runtime/tmux/adapter.go
+++ b/internal/runtime/tmux/adapter.go
@@ -33,6 +33,7 @@ var instanceTokenReader = rand.Reader
 // Compile-time check.
 var (
 	_ runtime.Provider                      = (*Provider)(nil)
+	_ runtime.DeadRuntimeSessionChecker     = (*Provider)(nil)
 	_ runtime.ImmediateNudgeProvider        = (*Provider)(nil)
 	_ runtime.InterruptBoundaryWaitProvider = (*Provider)(nil)
 	_ runtime.InterruptedTurnResetProvider  = (*Provider)(nil)
@@ -228,6 +229,23 @@ func (p *Provider) IsRunning(name string) bool {
 	return p.cache.IsRunning(name)
 }
 
+// IsDeadRuntimeSession reports whether a visible tmux session is a
+// remain-on-exit corpse with no live panes.
+func (p *Provider) IsDeadRuntimeSession(name string) (bool, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return false, nil
+	}
+	dead, err := p.tm.sessionPanesDead(name)
+	if err != nil {
+		if errors.Is(err, ErrSessionNotFound) || errors.Is(err, ErrNoServer) {
+			return false, nil
+		}
+		return false, err
+	}
+	return dead, nil
+}
+
 // IsAttached reports whether a user terminal is connected to the named session.
 func (p *Provider) IsAttached(name string) bool {
 	return p.tm.IsSessionAttached(name)
diff --git a/internal/runtime/tmux/executor_test.go b/internal/runtime/tmux/executor_test.go
index d8bb001278..0c8b944f82 100644
--- a/internal/runtime/tmux/executor_test.go
+++ b/internal/runtime/tmux/executor_test.go
@@ -271,6 +271,67 @@ func TestIsSessionRunningFallsBackToSessionExistsOnPaneQueryError(t *testing.T)
 	}
 }
 
+func TestProviderIsDeadRuntimeSessionRequiresEveryPaneDead(t *testing.T) {
+	fe := &fakeExecutor{
+		out: "1\n0",
+	}
+	tm := &Tmux{cfg: Config{SocketName: "x"}, exec: fe}
+	p := &Provider{tm: tm}
+
+	dead, err := p.IsDeadRuntimeSession("runner")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if dead {
+		t.Fatal("IsDeadRuntimeSession = true, want false when any pane is live")
+	}
+
+	if len(fe.calls) != 1 {
+		t.Fatalf("expected 1 call, got %d", len(fe.calls))
+	}
+	want := []string{"-u", "-L", "x", "list-panes", "-s", "-t", "=runner", "-F", "#{pane_dead}"}
+	if len(fe.calls[0]) != len(want) {
+		t.Fatalf("call = %v, want %v", fe.calls[0], want)
+	}
+	for i := range want {
+		if fe.calls[0][i] != want[i] {
+			t.Fatalf("call arg %d = %q, want %q; call=%v", i, fe.calls[0][i], want[i], fe.calls[0])
+		}
+	}
+}
+
+func TestProviderIsDeadRuntimeSessionTrueWhenAllPanesDead(t *testing.T) {
+	fe := &fakeExecutor{
+		out: "1\n1",
+	}
+	tm := &Tmux{cfg: Config{SocketName: "x"}, exec: fe}
+	p := &Provider{tm: tm}
+
+	dead, err := p.IsDeadRuntimeSession("runner")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if !dead {
+		t.Fatal("IsDeadRuntimeSession = false, want true when all panes are dead")
+	}
+}
+
+func TestProviderIsDeadRuntimeSessionTreatsAbsentSessionAsNotDead(t *testing.T) {
+	fe := &fakeExecutor{
+		err: ErrSessionNotFound,
+	}
+	tm := &Tmux{cfg: Config{SocketName: "x"}, exec: fe}
+	p := &Provider{tm: tm}
+
+	dead, err := p.IsDeadRuntimeSession("missing")
+	if err != nil {
+		t.Fatalf("IsDeadRuntimeSession: %v", err)
+	}
+	if dead {
+		t.Fatal("IsDeadRuntimeSession = true, want false for absent session")
+	}
+}
+
 func TestWaitForRuntimeReadyCapturesPromptAboveBlankFooter(t *testing.T) {
 	fe := &promptFooterExecutor{}
 	tm := &Tmux{cfg: DefaultConfig(), exec: fe}
diff --git a/internal/runtime/tmux/interaction.go b/internal/runtime/tmux/interaction.go
index 1b69512102..db9207a931 100644
--- a/internal/runtime/tmux/interaction.go
+++ b/internal/runtime/tmux/interaction.go
@@ -2,6 +2,7 @@ package tmux
 
 import (
 	"crypto/sha256"
+	"errors"
 	"fmt"
 	"regexp"
 	"strings"
@@ -178,6 +179,9 @@ func (t *Tmux) Pending(name string) (*runtime.PendingInteraction, error) {
 	if err != nil {
 		// Pane might not exist (session not started yet or already stopped).
 		// Check for known "can't find" errors vs unexpected failures.
+		if errors.Is(err, ErrSessionNotFound) {
+			return nil, fmt.Errorf("capturing pane: %w: %w", runtime.ErrSessionNotFound, err)
+		}
 		if strings.Contains(err.Error(), "can't find") || strings.Contains(err.Error(), "no server") {
 			return nil, nil
 		}
@@ -227,6 +231,9 @@ func (t *Tmux) Respond(name string, response runtime.InteractionResponse) error
 	// Verify the expected approval is still present before sending keys.
 	paneText, err := t.CapturePane(name, 40)
 	if err != nil {
+		if errors.Is(err, ErrSessionNotFound) {
+			return fmt.Errorf("pre-verify capture failed: %w: %w", runtime.ErrSessionNotFound, err)
+		}
 		return fmt.Errorf("pre-verify capture failed: %w", err)
 	}
 	current := parseApprovalPrompt(paneText)
@@ -260,6 +267,9 @@ func (t *Tmux) Respond(name string, response runtime.InteractionResponse) error
 
 	// Send the keystroke once.
 	if _, err := t.run("send-keys", "-t", name, "-l", key); err != nil {
+		if errors.Is(err, ErrSessionNotFound) {
+			return fmt.Errorf("send-keys failed: %w: %w", runtime.ErrSessionNotFound, err)
+		}
 		return fmt.Errorf("send-keys failed: %w", err)
 	}
 
diff --git a/internal/runtime/tmux/interaction_test.go b/internal/runtime/tmux/interaction_test.go
index fd79ce6fa8..16bf1cd9bd 100644
--- a/internal/runtime/tmux/interaction_test.go
+++ b/internal/runtime/tmux/interaction_test.go
@@ -1,6 +1,7 @@
 package tmux
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -191,6 +192,35 @@ func TestPhase2ProviderPendingInteractionSeam(t *testing.T) {
 	reporter.Require(t, pendingInteractionSeamResult(session, pending, err, fe.calls))
 }
 
+func TestProviderPendingMapsTmuxSessionNotFoundToRuntimeSentinel(t *testing.T) {
+	provider := &Provider{
+		tm: &Tmux{
+			exec: &fakeExecutor{err: ErrSessionNotFound},
+		},
+	}
+
+	pending, err := provider.Pending("missing")
+	if pending != nil {
+		t.Fatalf("Pending = %#v, want nil", pending)
+	}
+	if !errors.Is(err, runtime.ErrSessionNotFound) {
+		t.Fatalf("Pending error = %v, want runtime.ErrSessionNotFound", err)
+	}
+}
+
+func TestProviderRespondMapsTmuxSessionNotFoundToRuntimeSentinel(t *testing.T) {
+	provider := &Provider{
+		tm: &Tmux{
+			exec: &fakeExecutor{err: ErrSessionNotFound},
+		},
+	}
+
+	err := provider.Respond("missing", runtime.InteractionResponse{Action: "approve"})
+	if !errors.Is(err, runtime.ErrSessionNotFound) {
+		t.Fatalf("Respond error = %v, want runtime.ErrSessionNotFound", err)
+	}
+}
+
 func TestPhase2ProviderRespondRejectsMismatchedRequest(t *testing.T) {
 	reporter := workertest.NewSuiteReporter(t, "phase2-tmux-reject", map[string]string{
 		"tier":      "worker-core",
diff --git a/internal/runtime/tmux/tmux.go b/internal/runtime/tmux/tmux.go
index daa89c840f..87230b9742 100644
--- a/internal/runtime/tmux/tmux.go
+++ b/internal/runtime/tmux/tmux.go
@@ -11,6 +11,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	goruntime "runtime"
 	"sort"
 	"strconv"
 	"strings"
@@ -1137,7 +1138,7 @@ func (t *Tmux) ensureHiddenAttachedClient(target string) error {
 		cmdArgs = append(cmdArgs, "-L", t.cfg.SocketName)
 	}
 	cmdArgs = append(cmdArgs, "attach-session", "-t", target)
-	cmd := exec.CommandContext(ctx, "script", "-qfc", "tmux "+shellquote.Join(cmdArgs), "/dev/null")
+	cmd := exec.CommandContext(ctx, "script", hiddenAttachScriptArgs(goruntime.GOOS, cmdArgs)...)
 	cmd.Env = append(cmd.Environ(), "TERM=xterm-256color")
 	cmd.Stdout = io.Discard
 	cmd.Stderr = io.Discard
@@ -1180,6 +1181,14 @@ func (t *Tmux) ensureHiddenAttachedClient(target string) error {
 	return nil
 }
 
+func hiddenAttachScriptArgs(goos string, tmuxArgs []string) []string {
+	if goos == "darwin" {
+		args := []string{"-q", "/dev/null", "tmux"}
+		return append(args, tmuxArgs...)
+	}
+	return []string{"-qfc", "tmux " + shellquote.Join(tmuxArgs), "/dev/null"}
+}
+
 func (t *Tmux) hiddenAttachClient(target string) *hiddenAttachClient {
 	t.hiddenAttachMu.Lock()
 	defer t.hiddenAttachMu.Unlock()
@@ -1397,9 +1406,9 @@ func (t *Tmux) NudgeSession(session, message string) error {
 	time.Sleep(500 * time.Millisecond)
 
 	// 3. Send Escape only for TUIs where it's an insert-mode escape, not a
-	// semantic input key. Claude, Codex, and Gemini all treat Escape as a
-	// semantic control key in some busy states, so default submit must not
-	// synthesize it for them.
+	// semantic input key. Claude, Codex, Gemini, and OpenCode all treat
+	// Escape as a semantic control key in some busy states, so default submit
+	// must not synthesize it for them.
 	if t.shouldSendEscapeBeforeEnter(target) {
 		// See: https://github.com/anthropics/gastown/issues/307
 		_, _ = t.run("send-keys", "-t", target, "Escape")
@@ -1478,7 +1487,7 @@ func (t *Tmux) shouldSendEscapeBeforeEnter(target string) bool {
 	provider, err := t.GetEnvironment(target, "GC_PROVIDER")
 	if err == nil {
 		switch strings.TrimSpace(provider) {
-		case "claude", "codex", "gemini":
+		case "claude", "codex", "gemini", "opencode":
 			return false
 		default:
 			// Unrecognized provider (custom alias) — fall through to
@@ -1492,7 +1501,7 @@ func (t *Tmux) shouldSendEscapeBeforeEnter(target string) bool {
 }
 
 func (t *Tmux) targetLooksLikeNoEscapeProvider(target string) bool {
-	noEscapeProviders := []string{"claude", "codex", "gemini"}
+	noEscapeProviders := []string{"claude", "codex", "gemini", "opencode"}
 	return t.targetLooksLikeAnyProvider(target, noEscapeProviders...)
 }
 
@@ -1690,6 +1699,28 @@ func (t *Tmux) IsPaneDead(target string) (bool, error) {
 	}
 }
 
+func (t *Tmux) sessionPanesDead(session string) (bool, error) {
+	out, err := t.run("list-panes", "-s", "-t", "="+session, "-F", "#{pane_dead}")
+	if err != nil {
+		return false, err
+	}
+	values := strings.Fields(out)
+	if len(values) == 0 {
+		return false, fmt.Errorf("empty pane_dead list for session %s", session)
+	}
+	for _, value := range values {
+		switch value {
+		case "0":
+			return false, nil
+		case "1":
+			continue
+		default:
+			return false, fmt.Errorf("unexpected pane_dead value %q for session %s", value, session)
+		}
+	}
+	return true, nil
+}
+
 // IsSessionRunning reports whether the tmux session exists and its primary pane
 // still has a live process. Dead panes kept by remain-on-exit are treated as
 // not running.
diff --git a/internal/runtime/tmux/tmux_test.go b/internal/runtime/tmux/tmux_test.go
index 08cf1cf93f..50138090e0 100644
--- a/internal/runtime/tmux/tmux_test.go
+++ b/internal/runtime/tmux/tmux_test.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"reflect"
 	"runtime"
 	"strings"
 	"testing"
@@ -268,6 +269,17 @@ func TestHiddenAttachedClientCanSendText(t *testing.T) {
 	t.Fatalf("CapturePaneAll did not contain hidden attach text:\n%s", out)
 }
 
+func TestHiddenAttachScriptArgsArePlatformSpecific(t *testing.T) {
+	tmuxArgs := []string{"-u", "-L", "socket", "attach-session", "-t", "target"}
+
+	if got, want := hiddenAttachScriptArgs("darwin", tmuxArgs), []string{"-q", "/dev/null", "tmux", "-u", "-L", "socket", "attach-session", "-t", "target"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("darwin script args = %#v, want %#v", got, want)
+	}
+	if got, want := hiddenAttachScriptArgs("linux", tmuxArgs), []string{"-qfc", "tmux -u -L socket attach-session -t target", "/dev/null"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("linux script args = %#v, want %#v", got, want)
+	}
+}
+
 func TestSendKeysAndCapture(t *testing.T) {
 	if !hasTmux() {
 		t.Skip("tmux not installed")
@@ -1264,8 +1276,15 @@ func TestCollectReparentedGroupMembers(t *testing.T) {
 		if rpid == pid {
 			t.Errorf("collectReparentedGroupMembers returned known PID %s", pid)
 		}
-		// Each reparented PID should have PPID == 1
+		// Each reparented PID should have PPID == 1.
+		// The process may have exited between collection and this check
+		// (TOCTOU race), so skip verification if getParentPID returns empty.
 		ppid := getParentPID(rpid)
+		if ppid == "" && runtime.GOOS != "windows" {
+			if err := exec.Command("kill", "-0", rpid).Run(); err != nil {
+				continue
+			}
+		}
 		if ppid != "1" {
 			t.Errorf("collectReparentedGroupMembers returned PID %s with PPID %s (expected 1)", rpid, ppid)
 		}
@@ -2114,6 +2133,37 @@ func TestNudgeSessionSkipsEscapeForClaude(t *testing.T) {
 	}
 }
 
+func TestNudgeSessionSkipsEscapeForOpenCode(t *testing.T) {
+	if !hasTmux() {
+		t.Skip("tmux not installed")
+	}
+
+	tm := testTmux()
+	sessionName := "gt-test-nudge-opencode-" + fmt.Sprintf("%d", time.Now().UnixNano()%10000)
+
+	_ = tm.KillSession(sessionName)
+	if err := tm.NewSessionWithCommandAndEnv(sessionName, os.TempDir(), "cat -v", map[string]string{
+		"GC_PROVIDER": "opencode",
+	}); err != nil {
+		t.Fatalf("NewSessionWithCommandAndEnv: %v", err)
+	}
+	defer func() { _ = tm.KillSession(sessionName) }()
+	time.Sleep(300 * time.Millisecond)
+
+	if err := tm.NudgeSession(sessionName, "hello"); err != nil {
+		t.Fatalf("NudgeSession: %v", err)
+	}
+	time.Sleep(300 * time.Millisecond)
+
+	out, err := tm.CapturePaneAll(sessionName)
+	if err != nil {
+		t.Fatalf("CapturePaneAll: %v", err)
+	}
+	if strings.Contains(out, "^[") {
+		t.Fatalf("CapturePaneAll contained Escape for opencode nudge:\n%s", out)
+	}
+}
+
 func TestNudgeSessionSkipsEscapeForGeminiWithoutProviderEnv(t *testing.T) {
 	if !hasTmux() {
 		t.Skip("tmux not installed")
diff --git a/internal/session/chat.go b/internal/session/chat.go
index 4884eae018..726742a108 100644
--- a/internal/session/chat.go
+++ b/internal/session/chat.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log"
 	"strconv"
 	"strings"
 	"sync"
@@ -405,6 +406,7 @@ func (m *Manager) confirmLiveSessionState(id string, b *beads.Bead) error {
 	}
 	if strings.TrimSpace(b.Metadata["pending_create_claim"]) != "" {
 		batch["pending_create_claim"] = ""
+		batch["pending_create_started_at"] = ""
 	}
 	if len(batch) == 0 {
 		return nil
@@ -743,6 +745,10 @@ func (m *Manager) Pending(id string) (*runtime.PendingInteraction, bool, error)
 		if errors.Is(err, runtime.ErrInteractionUnsupported) {
 			return nil, false, nil
 		}
+		if errors.Is(err, runtime.ErrSessionNotFound) {
+			log.Printf("session: pending interaction runtime session gone for %q: %v", sessName, err)
+			return nil, true, nil
+		}
 		return nil, true, fmt.Errorf("getting pending interaction: %w", err)
 	}
 	return pending, true, nil
@@ -764,6 +770,10 @@ func (m *Manager) Respond(id string, response runtime.InteractionResponse) error
 			if errors.Is(err, runtime.ErrInteractionUnsupported) {
 				return ErrInteractionUnsupported
 			}
+			if errors.Is(err, runtime.ErrSessionNotFound) {
+				log.Printf("session: respond pending probe runtime session gone for %q: %v", sessName, err)
+				return ErrNoPendingInteraction
+			}
 			return fmt.Errorf("getting pending interaction: %w", err)
 		}
 		if pending == nil {
@@ -782,6 +792,10 @@ func (m *Manager) Respond(id string, response runtime.InteractionResponse) error
 			if errors.Is(err, runtime.ErrInteractionUnsupported) {
 				return ErrInteractionUnsupported
 			}
+			if errors.Is(err, runtime.ErrSessionNotFound) {
+				log.Printf("session: respond runtime session gone for %q: %v", sessName, err)
+				return ErrNoPendingInteraction
+			}
 			return fmt.Errorf("responding to pending interaction: %w", err)
 		}
 		return nil
@@ -812,7 +826,8 @@ func (m *Manager) TranscriptPath(id string, searchPaths []string) (string, error
 	}
 
 	all, err := m.store.List(beads.ListQuery{
-		Label: LabelSession,
+		Label:         LabelSession,
+		IncludeClosed: b.Status == "closed",
 	})
 	if err != nil {
 		return "", fmt.Errorf("listing sessions: %w", err)
@@ -822,12 +837,17 @@ func (m *Manager) TranscriptPath(id string, searchPaths []string) (string, error
 		if !IsSessionBeadOrRepairable(other) {
 			continue
 		}
-		// Only count active sessions — closed historical sessions should not
-		// make the lookup ambiguous for the one live session.
-		if other.Status == "closed" {
+		// For a live target, closed historical sessions should not make the
+		// lookup ambiguous. For a closed target, historical siblings sharing
+		// the same workdir are the ambiguity we need to preserve.
+		if b.Status != "closed" && other.Status == "closed" {
 			continue
 		}
-		if provider != "" && strings.TrimSpace(other.Metadata["provider"]) != provider {
+		otherProvider := strings.TrimSpace(other.Metadata["provider_kind"])
+		if otherProvider == "" {
+			otherProvider = strings.TrimSpace(other.Metadata["provider"])
+		}
+		if provider != "" && otherProvider != provider {
 			continue
 		}
 		if other.Metadata["work_dir"] == workDir {
diff --git a/internal/session/chat_test.go b/internal/session/chat_test.go
index 09c5a7991b..0df1bf0bbc 100644
--- a/internal/session/chat_test.go
+++ b/internal/session/chat_test.go
@@ -56,10 +56,10 @@ func TestStripResumeFlag(t *testing.T) {
 	}{
 		{
 			name:       "removes resume flag and key",
-			cmd:        "claude --model claude-opus-4-6 --resume abc-123",
+			cmd:        "claude --model claude-opus-4-7 --resume abc-123",
 			resumeFlag: "--resume",
 			sessionKey: "abc-123",
-			want:       "claude --model claude-opus-4-6",
+			want:       "claude --model claude-opus-4-7",
 		},
 		{
 			name:       "resume flag at end",
diff --git a/internal/session/lifecycle_projection.go b/internal/session/lifecycle_projection.go
index 83a8d7d6fe..aacacf32ea 100644
--- a/internal/session/lifecycle_projection.go
+++ b/internal/session/lifecycle_projection.go
@@ -225,7 +225,7 @@ func LifecycleDisplayReason(status string, metadata map[string]string, now time.
 		return ""
 	}
 	if reason := strings.TrimSpace(metadata["sleep_reason"]); reason != "" {
-		staleTimedQuarantine := (reason == "quarantine" || reason == "context-churn") &&
+		staleTimedQuarantine := (reason == "quarantine" || reason == "context-churn" || reason == "rate_limit") &&
 			strings.TrimSpace(metadata["quarantined_until"]) != "" &&
 			!view.HasBlocker(BlockerQuarantined)
 		staleTimedHold := reason == "user-hold" &&
@@ -487,15 +487,23 @@ func projectRuntimeProjection(input LifecycleInput, base BaseState, compat State
 	if base == BaseStateNone || base == BaseStateClosed || base == BaseStateClosing {
 		return RuntimeProjectionMissing, compat, false
 	}
-	if hasWakeCause(wakeCauses, WakeCausePendingCreate) {
-		return RuntimeProjectionStartRequested, StateCreating, false
-	}
+	// #1460: When base is BaseStateCreating, evaluate staleness first.
+	// pending_create_claim represents an in-flight create attempt and is
+	// honored only while the lease (StaleCreatingAfter) is fresh. Once the
+	// lease expires with no live runtime, the claim no longer protects the
+	// bead — otherwise a crashed creator strands the slot indefinitely.
 	if base == BaseStateCreating {
 		if !creatingStateIsStale(input) {
+			if hasWakeCause(wakeCauses, WakeCausePendingCreate) {
+				return RuntimeProjectionStartRequested, StateCreating, false
+			}
 			return RuntimeProjectionFreshCreating, StateCreating, false
 		}
 		return RuntimeProjectionStaleCreating, StateAsleep, shouldResetContinuation(base, input.Metadata, sleepReason)
 	}
+	if hasWakeCause(wakeCauses, WakeCausePendingCreate) {
+		return RuntimeProjectionStartRequested, StateCreating, false
+	}
 	return RuntimeProjectionMissing, StateAsleep, shouldResetContinuation(base, input.Metadata, sleepReason)
 }
 
@@ -503,14 +511,22 @@ func creatingStateIsStale(input LifecycleInput) bool {
 	if input.StaleCreatingAfter <= 0 {
 		return false
 	}
-	if input.CreatedAt.IsZero() {
-		return true
-	}
 	now := input.Now
 	if now.IsZero() {
 		now = time.Now().UTC()
 	}
-	return !now.Before(input.CreatedAt.Add(input.StaleCreatingAfter))
+	startedAt := input.CreatedAt
+	if input.Metadata != nil {
+		if v := strings.TrimSpace(input.Metadata["pending_create_started_at"]); v != "" {
+			if t, err := time.Parse(time.RFC3339, v); err == nil && !t.IsZero() {
+				startedAt = t
+			}
+		}
+	}
+	if startedAt.IsZero() {
+		return true
+	}
+	return !now.Before(startedAt.Add(input.StaleCreatingAfter))
 }
 
 func shouldResetContinuation(base BaseState, meta map[string]string, sleepReason string) bool {
@@ -521,7 +537,7 @@ func shouldResetContinuation(base BaseState, meta map[string]string, sleepReason
 		return false
 	}
 	switch strings.TrimSpace(sleepReason) {
-	case "idle", "idle-timeout", "no-wake-reason", "config-drift", "drained", "city-stop", "user-hold", "wait-hold":
+	case "idle", "idle-timeout", "no-wake-reason", "config-drift", "drained", "city-stop", "user-hold", "wait-hold", "rate_limit":
 		return false
 	}
 	return base == BaseStateActive || base == BaseStateCreating
diff --git a/internal/session/lifecycle_projection_test.go b/internal/session/lifecycle_projection_test.go
index f36d178000..2189662e12 100644
--- a/internal/session/lifecycle_projection_test.go
+++ b/internal/session/lifecycle_projection_test.go
@@ -159,6 +159,29 @@ func TestProjectLifecycleDesiredStateAndBlockers(t *testing.T) {
 	}
 }
 
+func TestProjectLifecycleCreatingStalenessUsesPendingCreateStartedAt(t *testing.T) {
+	now := time.Date(2026, 5, 3, 9, 0, 0, 0, time.UTC)
+	view := ProjectLifecycle(LifecycleInput{
+		Status: "open",
+		Metadata: map[string]string{
+			"state":                     string(StateCreating),
+			"session_name":              "s-worker",
+			"pending_create_started_at": now.Add(-30 * time.Second).UTC().Format(time.RFC3339),
+		},
+		Runtime:            RuntimeFacts{Observed: true, Alive: false},
+		CreatedAt:          now.Add(-2 * time.Minute),
+		StaleCreatingAfter: time.Minute,
+		Now:                now,
+	})
+
+	if view.RuntimeProjection != RuntimeProjectionFreshCreating {
+		t.Fatalf("RuntimeProjection = %q, want %q", view.RuntimeProjection, RuntimeProjectionFreshCreating)
+	}
+	if view.ReconciledState != StateCreating {
+		t.Fatalf("ReconciledState = %q, want %q", view.ReconciledState, StateCreating)
+	}
+}
+
 func TestProjectLifecycleNamedIdentityProjection(t *testing.T) {
 	now := time.Date(2026, 4, 15, 12, 0, 0, 0, time.UTC)
 
@@ -345,6 +368,23 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 			wantReconciledState: StateAsleep,
 			wantReset:           true,
 		},
+		{
+			name: "dead active runtime with rate-limit reason preserves resume identity",
+			input: LifecycleInput{
+				Status: "open",
+				Metadata: map[string]string{
+					"state":               "active",
+					"session_name":        "s-worker",
+					"session_key":         "provider-conversation",
+					"started_config_hash": "config",
+					"sleep_reason":        "rate_limit",
+				},
+				Runtime: RuntimeFacts{Observed: true, Alive: false},
+				Now:     now,
+			},
+			wantRuntime:         RuntimeProjectionMissing,
+			wantReconciledState: StateAsleep,
+		},
 		{
 			name: "fresh creating state stays creating after restart",
 			input: LifecycleInput{
@@ -380,12 +420,17 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 			wantReset:           true,
 		},
 		{
-			name: "pending create claim keeps stale creating state in creating",
+			// Regression for #1460: a pending_create_claim left behind by a
+			// crashed creator must not protect a stale-creating bead forever.
+			// Once the lease window (StaleCreatingAfter) elapses with no live
+			// runtime, the bead heals to asleep and the claim no longer wins.
+			name: "stale creating heals to asleep even with pending_create_claim",
 			input: LifecycleInput{
 				Status: "open",
 				Metadata: map[string]string{
 					"state":                "creating",
 					"session_name":         "s-worker",
+					"session_key":          "old-provider-conversation",
 					"pending_create_claim": "true",
 				},
 				Runtime:            RuntimeFacts{Observed: true, Alive: false},
@@ -393,6 +438,42 @@ func TestProjectLifecycleRuntimeLivenessProjection(t *testing.T) {
 				StaleCreatingAfter: time.Minute,
 				Now:                now,
 			},
+			wantRuntime:         RuntimeProjectionStaleCreating,
+			wantReconciledState: StateAsleep,
+			wantReset:           true,
+		},
+		{
+			// Counterpart: while the lease is still fresh, pending_create_claim
+			// continues to short-circuit so an in-flight create attempt is not
+			// raced.
+			name: "fresh creating with pending_create_claim stays in creating",
+			input: LifecycleInput{
+				Status: "open",
+				Metadata: map[string]string{
+					"state":                "creating",
+					"session_name":         "s-worker",
+					"pending_create_claim": "true",
+				},
+				Runtime:            RuntimeFacts{Observed: true, Alive: false},
+				CreatedAt:          now.Add(-30 * time.Second),
+				StaleCreatingAfter: time.Minute,
+				Now:                now,
+			},
+			wantRuntime:         RuntimeProjectionStartRequested,
+			wantReconciledState: StateCreating,
+		},
+		{
+			name: "non-creating pending_create_claim remains start requested",
+			input: LifecycleInput{
+				Status: "open",
+				Metadata: map[string]string{
+					"state":                "active",
+					"session_name":         "s-worker",
+					"pending_create_claim": "true",
+				},
+				Runtime: RuntimeFacts{Observed: true, Alive: false},
+				Now:     now,
+			},
 			wantRuntime:         RuntimeProjectionStartRequested,
 			wantReconciledState: StateCreating,
 		},
@@ -512,6 +593,14 @@ func TestLifecycleDisplayReasonUsesOnlyActiveLifecycleReasons(t *testing.T) {
 			},
 			want: "",
 		},
+		{
+			name: "expired rate-limit reason is not visible",
+			meta: map[string]string{
+				"sleep_reason":      "rate_limit",
+				"quarantined_until": past,
+			},
+			want: "",
+		},
 		{
 			name: "wait hold is visible",
 			meta: map[string]string{
diff --git a/internal/session/lifecycle_transition.go b/internal/session/lifecycle_transition.go
index 42340bc2fc..c1ce89463d 100644
--- a/internal/session/lifecycle_transition.go
+++ b/internal/session/lifecycle_transition.go
@@ -48,19 +48,27 @@ func applyFreshWakeConversationReset(patch MetadataPatch) {
 	patch[startupDialogVerifiedKey] = ""
 }
 
+func pendingCreateStartedAt(now time.Time) string {
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	return now.UTC().Format(time.RFC3339)
+}
+
 // RequestWakePatch records a controller-owned one-shot create claim.
-func RequestWakePatch(reason string) MetadataPatch {
+func RequestWakePatch(reason string, now time.Time) MetadataPatch {
 	return MetadataPatch{
-		"state":                string(StateCreating),
-		"state_reason":         reason,
-		"pending_create_claim": "true",
-		"held_until":           "",
-		"quarantined_until":    "",
-		"sleep_reason":         "",
-		"wait_hold":            "",
-		"sleep_intent":         "",
-		"wake_attempts":        "0",
-		"churn_count":          "0",
+		"state":                     string(StateCreating),
+		"state_reason":              reason,
+		"pending_create_claim":      "true",
+		"pending_create_started_at": pendingCreateStartedAt(now),
+		"held_until":                "",
+		"quarantined_until":         "",
+		"sleep_reason":              "",
+		"wait_hold":                 "",
+		"sleep_intent":              "",
+		"wake_attempts":             "0",
+		"churn_count":               "0",
 	}
 }
 
@@ -113,7 +121,7 @@ func ClearWakeBlockersPatch(state State, sleepReason string) MetadataPatch {
 		patch["state"] = string(StateAsleep)
 	}
 	switch sleepReason {
-	case "user-hold", "wait-hold", "quarantine", "context-churn", string(StateDrained):
+	case "user-hold", "wait-hold", "quarantine", "context-churn", "rate_limit", string(StateDrained):
 		patch["sleep_reason"] = ""
 	}
 	return patch
@@ -131,8 +139,8 @@ func ClearExpiredHoldPatch(sleepReason string) MetadataPatch {
 	return patch
 }
 
-// ClearExpiredQuarantinePatch clears an expired quarantine or context churn
-// timer and resets retry counters associated with that blocker.
+// ClearExpiredQuarantinePatch clears an expired quarantine-like timer and
+// resets retry counters associated with that blocker.
 func ClearExpiredQuarantinePatch(sleepReason string) MetadataPatch {
 	patch := MetadataPatch{
 		"quarantined_until": "",
@@ -140,7 +148,7 @@ func ClearExpiredQuarantinePatch(sleepReason string) MetadataPatch {
 		"churn_count":       "0",
 	}
 	switch sleepReason {
-	case "quarantine", "context-churn":
+	case "quarantine", "context-churn", "rate_limit":
 		patch["sleep_reason"] = ""
 	}
 	return patch
@@ -152,11 +160,12 @@ func ClearExpiredQuarantinePatch(sleepReason string) MetadataPatch {
 // bead whose last_woke_at was later cleared by crash/churn recovery.
 func ConfirmStartedPatch(now time.Time) MetadataPatch {
 	return MetadataPatch{
-		"state":                string(StateActive),
-		"state_reason":         "creation_complete",
-		"creation_complete_at": now.UTC().Format(time.RFC3339),
-		"pending_create_claim": "",
-		"sleep_reason":         "",
+		"state":                     string(StateActive),
+		"state_reason":              "creation_complete",
+		"creation_complete_at":      now.UTC().Format(time.RFC3339),
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
+		"sleep_reason":              "",
 	}
 }
 
@@ -209,6 +218,7 @@ func CommitStartedPatch(input CommitStartedPatchInput) MetadataPatch {
 	}
 	if input.ClearPendingCreateClaim {
 		patch["pending_create_claim"] = ""
+		patch["pending_create_started_at"] = ""
 	}
 	return patch
 }
@@ -225,12 +235,13 @@ func BeginDrainPatch(now time.Time, reason string) MetadataPatch {
 // SleepPatch records a non-terminal sleep/drain result.
 func SleepPatch(now time.Time, reason string) MetadataPatch {
 	return MetadataPatch{
-		"state":                string(StateAsleep),
-		"sleep_reason":         reason,
-		"last_woke_at":         "",
-		"pending_create_claim": "",
-		"sleep_intent":         "",
-		"slept_at":             now.UTC().Format(time.RFC3339),
+		"state":                     string(StateAsleep),
+		"sleep_reason":              reason,
+		"last_woke_at":              "",
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
+		"sleep_intent":              "",
+		"slept_at":                  now.UTC().Format(time.RFC3339),
 	}
 }
 
@@ -239,9 +250,10 @@ func SleepPatch(now time.Time, reason string) MetadataPatch {
 // reselect it, but explicit attach or work can.
 func AcknowledgeDrainPatch(freshWake bool) MetadataPatch {
 	patch := MetadataPatch{
-		"state":                string(StateDrained),
-		"last_woke_at":         "",
-		"pending_create_claim": "",
+		"state":                     string(StateDrained),
+		"last_woke_at":              "",
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
 	}
 	if freshWake {
 		patch["session_key"] = ""
@@ -275,6 +287,7 @@ func RestartRequestPatch(sessionKey string) MetadataPatch {
 		"continuation_reset_pending": "true",
 		"last_woke_at":               "",
 		"pending_create_claim":       "",
+		"pending_create_started_at":  "",
 	}
 	if sessionKey != "" {
 		patch["session_key"] = sessionKey
@@ -285,17 +298,19 @@ func RestartRequestPatch(sessionKey string) MetadataPatch {
 // ConfigDriftResetPatch records an in-place named-session repair after core
 // config drift. Creating claims a new runtime start; asleep stays dormant
 // until the next normal wake reason.
-func ConfigDriftResetPatch(nextState State, sessionKey string) MetadataPatch {
+func ConfigDriftResetPatch(nextState State, sessionKey string, now time.Time) MetadataPatch {
 	patch := MetadataPatch{
 		"state":                      string(nextState),
 		"last_woke_at":               "",
 		"restart_requested":          "",
 		"continuation_reset_pending": "true",
 		"pending_create_claim":       "",
+		"pending_create_started_at":  "",
 	}
 	applyFreshWakeConversationReset(patch)
 	if nextState == StateCreating {
 		patch["pending_create_claim"] = "true"
+		patch["pending_create_started_at"] = pendingCreateStartedAt(now)
 	}
 	if sessionKey != "" {
 		patch["session_key"] = sessionKey
@@ -310,11 +325,12 @@ func ArchivePatch(now time.Time, reason string, continuityEligible bool) Metadat
 		continuity = "true"
 	}
 	return MetadataPatch{
-		"state":                string(StateArchived),
-		"state_reason":         reason,
-		"archived_at":          now.UTC().Format(time.RFC3339),
-		"continuity_eligible":  continuity,
-		"pending_create_claim": "",
+		"state":                     string(StateArchived),
+		"state_reason":              reason,
+		"archived_at":               now.UTC().Format(time.RFC3339),
+		"continuity_eligible":       continuity,
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
 	}
 }
 
@@ -368,12 +384,13 @@ func ReactivatePatch(continuityEligible bool) MetadataPatch {
 		continuity = "true"
 	}
 	return MetadataPatch{
-		"state":                string(StateAsleep),
-		"state_reason":         "reactivated",
-		"pending_create_claim": "",
-		"continuity_eligible":  continuity,
-		"quarantined_until":    "",
-		"crash_count":          "0",
-		"archived_at":          "",
+		"state":                     string(StateAsleep),
+		"state_reason":              "reactivated",
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
+		"continuity_eligible":       continuity,
+		"quarantined_until":         "",
+		"crash_count":               "0",
+		"archived_at":               "",
 	}
 }
diff --git a/internal/session/lifecycle_transition_test.go b/internal/session/lifecycle_transition_test.go
index 263ca11cef..aed46a8fe4 100644
--- a/internal/session/lifecycle_transition_test.go
+++ b/internal/session/lifecycle_transition_test.go
@@ -17,18 +17,19 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 	}{
 		{
 			name:  "request wake",
-			patch: RequestWakePatch("explicit"),
+			patch: RequestWakePatch("explicit", now),
 			want: MetadataPatch{
-				"state":                string(StateCreating),
-				"state_reason":         "explicit",
-				"pending_create_claim": "true",
-				"held_until":           "",
-				"quarantined_until":    "",
-				"sleep_reason":         "",
-				"wait_hold":            "",
-				"sleep_intent":         "",
-				"wake_attempts":        "0",
-				"churn_count":          "0",
+				"state":                     string(StateCreating),
+				"state_reason":              "explicit",
+				"pending_create_claim":      "true",
+				"pending_create_started_at": now.UTC().Format(time.RFC3339),
+				"held_until":                "",
+				"quarantined_until":         "",
+				"sleep_reason":              "",
+				"wait_hold":                 "",
+				"sleep_intent":              "",
+				"wake_attempts":             "0",
+				"churn_count":               "0",
 			},
 		},
 		{
@@ -81,11 +82,12 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 			name:  "confirm started",
 			patch: ConfirmStartedPatch(now),
 			want: MetadataPatch{
-				"state":                string(StateActive),
-				"state_reason":         "creation_complete",
-				"creation_complete_at": now.UTC().Format(time.RFC3339),
-				"pending_create_claim": "",
-				"sleep_reason":         "",
+				"state":                     string(StateActive),
+				"state_reason":              "creation_complete",
+				"creation_complete_at":      now.UTC().Format(time.RFC3339),
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
+				"sleep_reason":              "",
 			},
 		},
 		{
@@ -101,21 +103,23 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 			name:  "sleep",
 			patch: SleepPatch(now, "idle-timeout"),
 			want: MetadataPatch{
-				"state":                string(StateAsleep),
-				"sleep_reason":         "idle-timeout",
-				"last_woke_at":         "",
-				"pending_create_claim": "",
-				"sleep_intent":         "",
-				"slept_at":             now.Format(time.RFC3339),
+				"state":                     string(StateAsleep),
+				"sleep_reason":              "idle-timeout",
+				"last_woke_at":              "",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
+				"sleep_intent":              "",
+				"slept_at":                  now.Format(time.RFC3339),
 			},
 		},
 		{
 			name:  "acknowledge drain resume mode",
 			patch: AcknowledgeDrainPatch(false),
 			want: MetadataPatch{
-				"state":                "drained",
-				"last_woke_at":         "",
-				"pending_create_claim": "",
+				"state":                     "drained",
+				"last_woke_at":              "",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
 			},
 		},
 		{
@@ -125,6 +129,7 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"state":                      "drained",
 				"last_woke_at":               "",
 				"pending_create_claim":       "",
+				"pending_create_started_at":  "",
 				"session_key":                "",
 				"started_config_hash":        "",
 				"started_live_hash":          "",
@@ -141,6 +146,7 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"sleep_reason":               "idle",
 				"last_woke_at":               "",
 				"pending_create_claim":       "",
+				"pending_create_started_at":  "",
 				"sleep_intent":               "",
 				"slept_at":                   now.Format(time.RFC3339),
 				"session_key":                "",
@@ -160,6 +166,7 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"continuation_reset_pending": "true",
 				"last_woke_at":               "",
 				"pending_create_claim":       "",
+				"pending_create_started_at":  "",
 				"session_key":                "new-session-key",
 			},
 		},
@@ -172,11 +179,12 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"continuation_reset_pending": "true",
 				"last_woke_at":               "",
 				"pending_create_claim":       "",
+				"pending_create_started_at":  "",
 			},
 		},
 		{
 			name:  "config drift reset to creating",
-			patch: ConfigDriftResetPatch(StateCreating, "new-session-key"),
+			patch: ConfigDriftResetPatch(StateCreating, "new-session-key", now),
 			want: MetadataPatch{
 				"state":                      string(StateCreating),
 				"started_config_hash":        "",
@@ -187,12 +195,13 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"restart_requested":          "",
 				"continuation_reset_pending": "true",
 				"pending_create_claim":       "true",
+				"pending_create_started_at":  now.UTC().Format(time.RFC3339),
 				"session_key":                "new-session-key",
 			},
 		},
 		{
 			name:  "config drift reset to asleep",
-			patch: ConfigDriftResetPatch(StateAsleep, "new-session-key"),
+			patch: ConfigDriftResetPatch(StateAsleep, "new-session-key", now),
 			want: MetadataPatch{
 				"state":                      string(StateAsleep),
 				"started_config_hash":        "",
@@ -203,12 +212,13 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"restart_requested":          "",
 				"continuation_reset_pending": "true",
 				"pending_create_claim":       "",
+				"pending_create_started_at":  "",
 				"session_key":                "new-session-key",
 			},
 		},
 		{
 			name:  "config drift reset to asleep without rotated key",
-			patch: ConfigDriftResetPatch(StateAsleep, ""),
+			patch: ConfigDriftResetPatch(StateAsleep, "", now),
 			want: MetadataPatch{
 				"state":                      string(StateAsleep),
 				"started_config_hash":        "",
@@ -219,28 +229,31 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"restart_requested":          "",
 				"continuation_reset_pending": "true",
 				"pending_create_claim":       "",
+				"pending_create_started_at":  "",
 			},
 		},
 		{
 			name:  "archive continuity eligible",
 			patch: ArchivePatch(now, "drain_complete", true),
 			want: MetadataPatch{
-				"state":                string(StateArchived),
-				"state_reason":         "drain_complete",
-				"archived_at":          now.Format(time.RFC3339),
-				"continuity_eligible":  "true",
-				"pending_create_claim": "",
+				"state":                     string(StateArchived),
+				"state_reason":              "drain_complete",
+				"archived_at":               now.Format(time.RFC3339),
+				"continuity_eligible":       "true",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
 			},
 		},
 		{
 			name:  "archive historical only",
 			patch: ArchivePatch(now, "duplicate-repair", false),
 			want: MetadataPatch{
-				"state":                string(StateArchived),
-				"state_reason":         "duplicate-repair",
-				"archived_at":          now.Format(time.RFC3339),
-				"continuity_eligible":  "false",
-				"pending_create_claim": "",
+				"state":                     string(StateArchived),
+				"state_reason":              "duplicate-repair",
+				"archived_at":               now.Format(time.RFC3339),
+				"continuity_eligible":       "false",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
 			},
 		},
 		{
@@ -257,21 +270,22 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 			name:  "retire named session",
 			patch: RetireNamedSessionPatch(now, "duplicate-repair", "worker"),
 			want: MetadataPatch{
-				"state":                  string(StateArchived),
-				"state_reason":           "duplicate-repair",
-				"archived_at":            now.Format(time.RFC3339),
-				"continuity_eligible":    "false",
-				"alias":                  "",
-				"session_name":           "",
-				"session_name_explicit":  "",
-				"pending_create_claim":   "",
-				"retired_named_identity": "worker",
-				"synced_at":              now.Format(time.RFC3339),
-				"held_until":             "",
-				"quarantined_until":      "",
-				"wait_hold":              "",
-				"sleep_intent":           "",
-				"sleep_reason":           "",
+				"state":                     string(StateArchived),
+				"state_reason":              "duplicate-repair",
+				"archived_at":               now.Format(time.RFC3339),
+				"continuity_eligible":       "false",
+				"alias":                     "",
+				"session_name":              "",
+				"session_name_explicit":     "",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
+				"retired_named_identity":    "worker",
+				"synced_at":                 now.Format(time.RFC3339),
+				"held_until":                "",
+				"quarantined_until":         "",
+				"wait_hold":                 "",
+				"sleep_intent":              "",
+				"sleep_reason":              "",
 			},
 		},
 		{
@@ -289,26 +303,28 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 			name:  "reactivate continuity eligible",
 			patch: ReactivatePatch(true),
 			want: MetadataPatch{
-				"state":                string(StateAsleep),
-				"state_reason":         "reactivated",
-				"pending_create_claim": "",
-				"continuity_eligible":  "true",
-				"quarantined_until":    "",
-				"crash_count":          "0",
-				"archived_at":          "",
+				"state":                     string(StateAsleep),
+				"state_reason":              "reactivated",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
+				"continuity_eligible":       "true",
+				"quarantined_until":         "",
+				"crash_count":               "0",
+				"archived_at":               "",
 			},
 		},
 		{
 			name:  "reactivate historical only",
 			patch: ReactivatePatch(false),
 			want: MetadataPatch{
-				"state":                string(StateAsleep),
-				"state_reason":         "reactivated",
-				"pending_create_claim": "",
-				"continuity_eligible":  "false",
-				"quarantined_until":    "",
-				"crash_count":          "0",
-				"archived_at":          "",
+				"state":                     string(StateAsleep),
+				"state_reason":              "reactivated",
+				"pending_create_claim":      "",
+				"pending_create_started_at": "",
+				"continuity_eligible":       "false",
+				"quarantined_until":         "",
+				"crash_count":               "0",
+				"archived_at":               "",
 			},
 		},
 		{
@@ -346,6 +362,16 @@ func TestLifecycleTransitionPatchesSetCompleteMetadata(t *testing.T) {
 				"sleep_reason":      "",
 			},
 		},
+		{
+			name:  "clear expired rate limit",
+			patch: ClearExpiredQuarantinePatch("rate_limit"),
+			want: MetadataPatch{
+				"quarantined_until": "",
+				"wake_attempts":     "0",
+				"churn_count":       "0",
+				"sleep_reason":      "",
+			},
+		},
 		{
 			name:  "clear expired non-quarantine timer",
 			patch: ClearExpiredQuarantinePatch("idle"),
@@ -371,7 +397,7 @@ func TestMetadataPatchApplyReturnsMergedCopy(t *testing.T) {
 		"state":        string(StateAsleep),
 		"session_name": "s-worker",
 	}
-	patch := RequestWakePatch("pin")
+	patch := RequestWakePatch("pin", time.Date(2026, 4, 15, 13, 0, 0, 0, time.UTC))
 
 	merged := patch.Apply(original)
 	if merged["state"] != string(StateCreating) {
@@ -398,15 +424,16 @@ func TestCommitStartedPatchBuildsAtomicStartMetadata(t *testing.T) {
 	})
 
 	want := MetadataPatch{
-		"started_config_hash":  "core-hash",
-		"live_hash":            "live-hash",
-		"started_live_hash":    "live-hash",
-		"core_hash_breakdown":  `{"command":"core-hash"}`,
-		"state":                string(StateActive),
-		"state_reason":         "creation_complete",
-		"creation_complete_at": now.Format(time.RFC3339),
-		"sleep_reason":         "",
-		"pending_create_claim": "",
+		"started_config_hash":       "core-hash",
+		"live_hash":                 "live-hash",
+		"started_live_hash":         "live-hash",
+		"core_hash_breakdown":       `{"command":"core-hash"}`,
+		"state":                     string(StateActive),
+		"state_reason":              "creation_complete",
+		"creation_complete_at":      now.Format(time.RFC3339),
+		"sleep_reason":              "",
+		"pending_create_claim":      "",
+		"pending_create_started_at": "",
 	}
 	if !reflect.DeepEqual(patch, want) {
 		t.Fatalf("patch = %#v, want %#v", patch, want)
@@ -426,7 +453,7 @@ func TestCommitStartedPatchClearsPendingCreateClaimAtomicallyWithStateTransition
 		ClearPendingCreateClaim: true,
 		Now:                     now,
 	})
-	required := []string{"state", "state_reason", "creation_complete_at", "pending_create_claim"}
+	required := []string{"state", "state_reason", "creation_complete_at", "pending_create_claim", "pending_create_started_at"}
 	for _, key := range required {
 		if _, ok := patch[key]; !ok {
 			t.Fatalf("patch missing %q — sweep-visibility atomicity broken: %#v", key, patch)
@@ -435,6 +462,9 @@ func TestCommitStartedPatchClearsPendingCreateClaimAtomicallyWithStateTransition
 	if patch["pending_create_claim"] != "" {
 		t.Fatalf("pending_create_claim = %q, want cleared", patch["pending_create_claim"])
 	}
+	if patch["pending_create_started_at"] != "" {
+		t.Fatalf("pending_create_started_at = %q, want cleared", patch["pending_create_started_at"])
+	}
 }
 
 func TestCommitStartedPatchCanPersistHashesWithoutRestampingState(t *testing.T) {
@@ -519,6 +549,20 @@ func TestClearWakeBlockersPatchClearsOnlyWakeBlockerMetadata(t *testing.T) {
 				"churn_count":       "0",
 			},
 		},
+		{
+			name:        "rate limit reason is cleared",
+			state:       StateAsleep,
+			sleepReason: "rate_limit",
+			want: MetadataPatch{
+				"held_until":        "",
+				"quarantined_until": "",
+				"wait_hold":         "",
+				"sleep_intent":      "",
+				"wake_attempts":     "0",
+				"churn_count":       "0",
+				"sleep_reason":      "",
+			},
+		},
 	}
 
 	for _, tt := range tests {
@@ -532,7 +576,8 @@ func TestClearWakeBlockersPatchClearsOnlyWakeBlockerMetadata(t *testing.T) {
 }
 
 func TestRequestWakePatchClearsStaleWakeBlockers(t *testing.T) {
-	merged := RequestWakePatch("manual").Apply(map[string]string{
+	now := time.Date(2026, 4, 15, 13, 0, 0, 0, time.UTC)
+	merged := RequestWakePatch("manual", now).Apply(map[string]string{
 		"state":             string(StateAsleep),
 		"held_until":        "9999-12-31T23:59:59Z",
 		"quarantined_until": "9999-12-31T23:59:59Z",
@@ -553,6 +598,9 @@ func TestRequestWakePatchClearsStaleWakeBlockers(t *testing.T) {
 			t.Fatalf("%s = %q, want reset to 0", key, merged[key])
 		}
 	}
+	if got, want := merged["pending_create_started_at"], now.UTC().Format(time.RFC3339); got != want {
+		t.Fatalf("pending_create_started_at = %q, want %q", got, want)
+	}
 }
 
 func TestArchivePatchClearsStaleCreateClaim(t *testing.T) {
@@ -568,6 +616,9 @@ func TestArchivePatchClearsStaleCreateClaim(t *testing.T) {
 	if merged["pending_create_claim"] != "" {
 		t.Fatalf("pending_create_claim = %q, want cleared", merged["pending_create_claim"])
 	}
+	if merged["pending_create_started_at"] != "" {
+		t.Fatalf("pending_create_started_at = %q, want cleared", merged["pending_create_started_at"])
+	}
 }
 
 func TestReactivatePatchDoesNotForceHistoricalBeadEligible(t *testing.T) {
diff --git a/internal/session/manager.go b/internal/session/manager.go
index 8cb63548b2..c2733baf7a 100644
--- a/internal/session/manager.go
+++ b/internal/session/manager.go
@@ -480,6 +480,9 @@ func (m *Manager) createAliasedNamedWithTransport(ctx context.Context, alias, ex
 		// Start the runtime session.
 		if err := m.sp.Start(ctx, sessName, cfg); err != nil {
 			if runtimeSessionMatchesBead(m.sp, sessName, b.ID, meta["instance_token"]) {
+				if metaErr := m.confirmStartedRuntimeMetadata(b.ID, &b); metaErr != nil {
+					return metaErr
+				}
 				info = m.infoFromBead(b)
 				return nil
 			}
@@ -494,6 +497,15 @@ func (m *Manager) createAliasedNamedWithTransport(ctx context.Context, alias, ex
 			}
 			return fmt.Errorf("starting session: %w", err)
 		}
+		if metaErr := m.confirmStartedRuntimeMetadata(b.ID, &b); metaErr != nil {
+			if stopErr := m.sp.Stop(sessName); stopErr != nil {
+				metaErr = errors.Join(metaErr, fmt.Errorf("stopping runtime after metadata failure: %w", stopErr))
+			}
+			if rbErr := rollbackFailedCreate(); rbErr != nil {
+				return errors.Join(metaErr, rbErr)
+			}
+			return metaErr
+		}
 
 		info = m.infoFromBead(b)
 		return nil
@@ -504,6 +516,22 @@ func (m *Manager) createAliasedNamedWithTransport(ctx context.Context, alias, ex
 	return info, nil
 }
 
+func (m *Manager) confirmStartedRuntimeMetadata(id string, b *beads.Bead) error {
+	metadata := ConfirmStartedPatch(time.Now().UTC())
+	if err := m.store.SetMetadataBatch(id, metadata); err != nil {
+		return fmt.Errorf("storing started runtime metadata: %w", err)
+	}
+	if b != nil {
+		if b.Metadata == nil {
+			b.Metadata = make(map[string]string, len(metadata))
+		}
+		for k, v := range metadata {
+			b.Metadata[k] = v
+		}
+	}
+	return nil
+}
+
 // CreateNamedWithTransport creates a new chat session bead with an optional
 // explicit session_name and starts the runtime session.
 //
@@ -616,6 +644,7 @@ func (m *Manager) createAliasedBeadOnlyNamed(alias, explicitName, template, titl
 			meta["session_key"] = sessionKey
 		}
 		meta["pending_create_claim"] = "true"
+		meta["pending_create_started_at"] = pendingCreateStartedAt(time.Now().UTC())
 		if explicitName != "" {
 			meta["session_name"] = explicitName
 			meta["session_name_explicit"] = "true"
@@ -720,19 +749,30 @@ func (m *Manager) Suspend(id string) error {
 			return err
 		}
 
-		// Kill the runtime session (skip if already dead).
-		if m.sp.IsRunning(sessName) {
-			if err := m.sp.Stop(sessName); err != nil {
+		// Kill the runtime session. Stop is provider-idempotent, so call it
+		// even when liveness already reports false; tmux remain-on-exit panes
+		// can be non-running but still need their session artifact removed.
+		if strings.TrimSpace(sessName) != "" {
+			running := m.sp.IsRunning(sessName)
+			err := m.sp.Stop(sessName)
+			if err != nil && !running {
+				// Preserve historical Suspend semantics for already-dead
+				// sessions: cleanup is best-effort when the runtime did not
+				// report a live process before Stop.
+				err = nil
+			}
+			if err != nil {
 				return fmt.Errorf("stopping runtime session: %w", err)
 			}
 		}
 
-		// Update state and record suspension timestamp.
-		if err := m.store.SetMetadata(id, "state", string(StateSuspended)); err != nil {
-			return fmt.Errorf("updating session state: %w", err)
-		}
-		if err := m.store.SetMetadata(id, "suspended_at", time.Now().UTC().Format(time.RFC3339)); err != nil {
-			return fmt.Errorf("storing suspension timestamp: %w", err)
+		// Update state and suspension timestamp together so stores with a
+		// write-through cache preserve one coherent lifecycle transition.
+		if err := m.store.Update(id, beads.UpdateOpts{Metadata: map[string]string{
+			"state":        string(StateSuspended),
+			"suspended_at": time.Now().UTC().Format(time.RFC3339),
+		}}); err != nil {
+			return fmt.Errorf("updating suspension state: %w", err)
 		}
 
 		return nil
@@ -821,6 +861,7 @@ func (m *Manager) retireConfiguredNamedSessionIdentifiers(id string, b beads.Bea
 	update.Metadata["session_name"] = ""
 	update.Metadata["session_name_explicit"] = ""
 	update.Metadata["pending_create_claim"] = ""
+	update.Metadata["pending_create_started_at"] = ""
 	if err := m.store.Update(id, update); err != nil {
 		return fmt.Errorf("retiring configured named session identifiers: %w", err)
 	}
@@ -1098,33 +1139,45 @@ func (m *Manager) PruneDetailed(before time.Time) (PruneResult, error) {
 
 // Get returns info about a single session.
 func (m *Manager) Get(id string) (Info, error) {
+	info, _, err := m.GetWithBead(id)
+	return info, err
+}
+
+// GetWithBead returns session info and the underlying bead in a single
+// store fetch, for callers that need both views (e.g. spec build plus
+// metadata lookup) without a redundant store.Get.
+func (m *Manager) GetWithBead(id string) (Info, beads.Bead, error) {
 	b, _, err := m.loadSessionBead(id, true)
 	if err != nil {
-		return Info{}, err
+		return Info{}, beads.Bead{}, err
 	}
-	return m.infoFromBead(b), nil
+	return m.infoFromBead(b), b, nil
 }
 
-// ObserveRuntime reports live provider state for the current session runtime.
-func (m *Manager) ObserveRuntime(id string, processNames []string) (RuntimeObservation, error) {
-	info, err := m.Get(id)
-	if err != nil {
-		return RuntimeObservation{}, err
-	}
+// SessionInfoFromBead converts an already-loaded session bead to Info,
+// applying the same enrichment as Get. Callers that have just resolved
+// the bead can use this to avoid a second store.Get.
+func (m *Manager) SessionInfoFromBead(b beads.Bead) Info {
+	return m.infoFromBead(b)
+}
+
+// ObserveRuntimeForInfo reports live provider state for a session whose Info
+// has already been loaded by the caller, avoiding a redundant store fetch.
+func (m *Manager) ObserveRuntimeForInfo(info Info, processNames []string) RuntimeObservation {
 	obs := RuntimeObservation{SessionName: info.SessionName}
 	if strings.TrimSpace(info.SessionName) == "" || m.sp == nil {
-		return obs, nil
+		return obs
 	}
 	obs.Running = m.sp.IsRunning(info.SessionName)
 	if !obs.Running {
-		return obs, nil
+		return obs
 	}
 	obs.Alive = m.sp.ProcessAlive(info.SessionName, processNames)
 	obs.Attached = m.sp.IsAttached(info.SessionName)
 	if lastActive, err := m.sp.GetLastActivity(info.SessionName); err == nil {
 		obs.LastActive = lastActive
 	}
-	return obs, nil
+	return obs
 }
 
 // ListResult holds the results of a ListFull call, including the raw beads
diff --git a/internal/session/manager_test.go b/internal/session/manager_test.go
index d88ea525ca..87376f5d27 100644
--- a/internal/session/manager_test.go
+++ b/internal/session/manager_test.go
@@ -25,6 +25,24 @@ type noImmediateProvider struct {
 	runtime.Provider
 }
 
+type nonRunningStopRecorder struct {
+	*runtime.Fake
+	stopCalls int
+	stopErr   error
+}
+
+func (p *nonRunningStopRecorder) IsRunning(string) bool {
+	return false
+}
+
+func (p *nonRunningStopRecorder) Stop(name string) error {
+	p.stopCalls++
+	if p.stopErr != nil {
+		return p.stopErr
+	}
+	return p.Fake.Stop(name)
+}
+
 func (p *startOverrideProvider) Start(ctx context.Context, name string, cfg runtime.Config) error {
 	if p.startErr != nil {
 		return p.startErr
@@ -249,6 +267,51 @@ func TestCreate(t *testing.T) {
 	}
 }
 
+func TestCreateConfirmsStartedStateWithoutControllerDriftHash(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(
+		context.Background(),
+		"helper",
+		"my chat",
+		"claude",
+		"/tmp",
+		"claude",
+		map[string]string{"BEADS_DIR": "/tmp/beads"},
+		ProviderResume{},
+		runtime.Config{
+			Env:              map[string]string{"GC_CITY": "test-city"},
+			FingerprintExtra: map[string]string{"depends_on": "db"},
+			SessionLive:      []string{"echo live"},
+		},
+	)
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	b, err := store.Get(info.ID)
+	if err != nil {
+		t.Fatalf("store.Get: %v", err)
+	}
+	if got := b.Metadata["started_config_hash"]; got != "" {
+		t.Fatalf("started_config_hash = %q, want empty so controller owns drift hashes", got)
+	}
+	if got := b.Metadata["started_live_hash"]; got != "" {
+		t.Fatalf("started_live_hash = %q, want empty so controller owns drift hashes", got)
+	}
+	if got := b.Metadata["live_hash"]; got != "" {
+		t.Fatalf("live_hash = %q, want empty so controller owns drift hashes", got)
+	}
+	if got := b.Metadata["state_reason"]; got != "creation_complete" {
+		t.Fatalf("state_reason = %q, want creation_complete", got)
+	}
+	if got := b.Metadata["creation_complete_at"]; got == "" {
+		t.Fatal("creation_complete_at is empty")
+	}
+}
+
 func TestCreateDefaultsTitleToTemplate(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -507,6 +570,32 @@ func TestCreateBeadOnlyNamed_UsesExplicitSessionName(t *testing.T) {
 	}
 }
 
+func TestCreateAliasedBeadOnlyNamed_SetsPendingCreateMetadata(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.CreateAliasedBeadOnlyNamed("worker", "test-city--worker", "worker", "queued", "claude", "/tmp", "claude", "", nil, ProviderResume{})
+	if err != nil {
+		t.Fatalf("CreateAliasedBeadOnlyNamed: %v", err)
+	}
+
+	b, err := store.Get(info.ID)
+	if err != nil {
+		t.Fatalf("store.Get: %v", err)
+	}
+	if got := b.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+	startedAt := b.Metadata["pending_create_started_at"]
+	if startedAt == "" {
+		t.Fatal("pending_create_started_at is empty")
+	}
+	if _, err := time.Parse(time.RFC3339, startedAt); err != nil {
+		t.Fatalf("pending_create_started_at = %q, want RFC3339: %v", startedAt, err)
+	}
+}
+
 func TestCreateBeadOnly_SetsPendingCreateClaimForWakeSignal(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -1259,6 +1348,50 @@ func TestSuspendCrashedSession(t *testing.T) {
 	}
 }
 
+func TestSuspendCleansDeadRuntimeArtifact(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := &nonRunningStopRecorder{Fake: runtime.NewFake()}
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "claude", "/tmp", "claude", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+
+	if sp.stopCalls != 1 {
+		t.Fatalf("Stop calls = %d, want 1 to clean dead runtime artifact", sp.stopCalls)
+	}
+}
+
+func TestSuspendKeepsNonRunningCleanupBestEffort(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := &nonRunningStopRecorder{Fake: runtime.NewFake(), stopErr: errors.New("cleanup unavailable")}
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "claude", "/tmp", "claude", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	if err := mgr.Suspend(info.ID); err != nil {
+		t.Fatalf("Suspend: %v", err)
+	}
+	if sp.stopCalls != 1 {
+		t.Fatalf("Stop calls = %d, want 1", sp.stopCalls)
+	}
+	got, err := mgr.Get(info.ID)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if got.State != StateSuspended {
+		t.Fatalf("State = %q, want %q", got.State, StateSuspended)
+	}
+}
+
 func TestCreateStoresCommand(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -2685,6 +2818,121 @@ func TestPendingAndRespond(t *testing.T) {
 	}
 }
 
+type pendingSessionGoneProvider struct {
+	*runtime.Fake
+}
+
+func (p *pendingSessionGoneProvider) Pending(_ string) (*runtime.PendingInteraction, error) {
+	return nil, fmt.Errorf("capturing pane: %w", runtime.ErrSessionNotFound)
+}
+
+type pendingSessionErrorProvider struct {
+	*runtime.Fake
+	err error
+}
+
+func (p *pendingSessionErrorProvider) Pending(_ string) (*runtime.PendingInteraction, error) {
+	return nil, p.err
+}
+
+type respondSessionGoneProvider struct {
+	*runtime.Fake
+}
+
+func (p *respondSessionGoneProvider) Pending(_ string) (*runtime.PendingInteraction, error) {
+	return &runtime.PendingInteraction{
+		RequestID: "req-1",
+		Kind:      "approval",
+		Prompt:    "approve?",
+	}, nil
+}
+
+func (p *respondSessionGoneProvider) Respond(_ string, _ runtime.InteractionResponse) error {
+	return fmt.Errorf("send-keys failed: %w", runtime.ErrSessionNotFound)
+}
+
+func TestPendingAndRespondTreatMissingRuntimeSessionAsNoPending(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := &pendingSessionGoneProvider{Fake: runtime.NewFake()}
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "claude", "/tmp", "claude", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	pending, supported, err := mgr.Pending(info.ID)
+	if err != nil {
+		t.Fatalf("Pending: %v", err)
+	}
+	if !supported {
+		t.Fatal("Pending should report supported when the provider supports interactions")
+	}
+	if pending != nil {
+		t.Fatalf("Pending = %#v, want nil for missing runtime session", pending)
+	}
+
+	err = mgr.Respond(info.ID, runtime.InteractionResponse{Action: "approve"})
+	if !errors.Is(err, ErrNoPendingInteraction) {
+		t.Fatalf("Respond error = %v, want ErrNoPendingInteraction", err)
+	}
+}
+
+func TestRespondTreatsRuntimeSessionGoneDuringResponseAsNoPending(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := &respondSessionGoneProvider{Fake: runtime.NewFake()}
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "claude", "/tmp", "claude", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	err = mgr.Respond(info.ID, runtime.InteractionResponse{Action: "approve"})
+	if !errors.Is(err, ErrNoPendingInteraction) {
+		t.Fatalf("Respond error = %v, want ErrNoPendingInteraction", err)
+	}
+}
+
+func TestPendingAndRespondDoNotSwallowUnrelatedNotFoundErrors(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := &pendingSessionErrorProvider{
+		Fake: runtime.NewFake(),
+		err:  fmt.Errorf("loading config file: not found"),
+	}
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "claude", "/tmp", "claude", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	pending, supported, err := mgr.Pending(info.ID)
+	if err == nil {
+		t.Fatalf("Pending err = nil, want unrelated provider error")
+	}
+	if !supported {
+		t.Fatal("Pending should report supported when provider returned a non-session-gone error")
+	}
+	if pending != nil {
+		t.Fatalf("Pending = %#v, want nil on provider error", pending)
+	}
+	if !strings.Contains(err.Error(), "loading config file: not found") {
+		t.Fatalf("Pending err = %v, want original provider error", err)
+	}
+
+	err = mgr.Respond(info.ID, runtime.InteractionResponse{Action: "approve"})
+	if err == nil {
+		t.Fatalf("Respond err = nil, want unrelated provider error")
+	}
+	if errors.Is(err, ErrNoPendingInteraction) {
+		t.Fatalf("Respond err = %v, must not downgrade unrelated provider errors to ErrNoPendingInteraction", err)
+	}
+	if !strings.Contains(err.Error(), "loading config file: not found") {
+		t.Fatalf("Respond err = %v, want original provider error", err)
+	}
+}
+
 func TestSendRejectsPendingInteraction(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -2849,6 +3097,47 @@ func TestTranscriptPathSkipsAmbiguousWorkDirFallback(t *testing.T) {
 	}
 }
 
+func TestTranscriptPathClosedSessionSkipsAmbiguousHistoricalWorkDirFallback(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	mgr := NewManager(store, sp)
+
+	workDir := t.TempDir()
+	info1, err := mgr.Create(context.Background(), "helper", "one", "codex", workDir, "codex", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create one: %v", err)
+	}
+	info2, err := mgr.Create(context.Background(), "helper", "two", "codex", workDir, "codex", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create two: %v", err)
+	}
+	if err := mgr.Close(info1.ID); err != nil {
+		t.Fatalf("Close one: %v", err)
+	}
+	if err := mgr.Close(info2.ID); err != nil {
+		t.Fatalf("Close two: %v", err)
+	}
+
+	searchBase := t.TempDir()
+	dayDir := filepath.Join(searchBase, "2026", "05", "04")
+	if err := os.MkdirAll(dayDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll: %v", err)
+	}
+	codexPath := filepath.Join(dayDir, "rollout-current.jsonl")
+	meta := `{"type":"session_meta","payload":{"cwd":"` + workDir + `"}}`
+	if err := os.WriteFile(codexPath, []byte(meta+"\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	path, err := mgr.TranscriptPath(info1.ID, []string{searchBase})
+	if err != nil {
+		t.Fatalf("TranscriptPath: %v", err)
+	}
+	if path != "" {
+		t.Errorf("TranscriptPath = %q, want empty for ambiguous historical codex workdir", path)
+	}
+}
+
 func TestTranscriptPathSameWorkDirDifferentProvidersUsesProviderSpecificFallback(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
diff --git a/internal/session/metadata_candidates.go b/internal/session/metadata_candidates.go
new file mode 100644
index 0000000000..4f6015b469
--- /dev/null
+++ b/internal/session/metadata_candidates.go
@@ -0,0 +1,68 @@
+package session
+
+import (
+	"strings"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+// ExactMetadataSessionCandidates returns session beads matching any exact
+// metadata filter. Each filter must contain exactly one key/value pair; empty
+// filters are ignored. Results are deduplicated by bead ID in query order.
+func ExactMetadataSessionCandidates(store beads.Store, includeClosed bool, filters ...map[string]string) ([]beads.Bead, error) {
+	return exactMetadataSessionCandidates(store, includeClosed, "", filters...)
+}
+
+// ExactMetadataSessionCandidatesWithStatus returns session beads matching any
+// exact metadata filter and the requested bead status.
+func ExactMetadataSessionCandidatesWithStatus(store beads.Store, status string, filters ...map[string]string) ([]beads.Bead, error) {
+	return exactMetadataSessionCandidates(store, false, strings.TrimSpace(status), filters...)
+}
+
+func exactMetadataSessionCandidates(store beads.Store, includeClosed bool, status string, filters ...map[string]string) ([]beads.Bead, error) {
+	if store == nil {
+		return nil, nil
+	}
+	seenQueries := make(map[string]bool, len(filters))
+	seenBeads := make(map[string]bool)
+	candidates := make([]beads.Bead, 0, len(filters))
+	for _, filter := range filters {
+		if len(filter) != 1 {
+			continue
+		}
+		var key, value string
+		for k, v := range filter {
+			key = strings.TrimSpace(k)
+			value = strings.TrimSpace(v)
+		}
+		if key == "" || value == "" {
+			continue
+		}
+		queryKey := key + "\x00" + value
+		if seenQueries[queryKey] {
+			continue
+		}
+		seenQueries[queryKey] = true
+		query := beads.ListQuery{
+			Metadata: map[string]string{key: value},
+		}
+		if status != "" {
+			query.Status = status
+		} else {
+			query.IncludeClosed = includeClosed
+		}
+		items, err := store.List(query)
+		if err != nil {
+			return nil, err
+		}
+		for _, b := range items {
+			if seenBeads[b.ID] || !IsSessionBeadOrRepairable(b) {
+				continue
+			}
+			RepairEmptyType(store, &b)
+			seenBeads[b.ID] = true
+			candidates = append(candidates, b)
+		}
+	}
+	return candidates, nil
+}
diff --git a/internal/session/metadata_candidates_test.go b/internal/session/metadata_candidates_test.go
new file mode 100644
index 0000000000..8faf29ee5f
--- /dev/null
+++ b/internal/session/metadata_candidates_test.go
@@ -0,0 +1,81 @@
+package session
+
+import (
+	"testing"
+
+	"github.com/gastownhall/gascity/internal/beads"
+)
+
+func TestExactMetadataSessionCandidatesDeduplicatesAndFiltersSessions(t *testing.T) {
+	store := beads.NewMemStore()
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": "sky",
+			"alias":        "sky",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(session): %v", err)
+	}
+	if _, err := store.Create(beads.Bead{
+		Type: "task",
+		Metadata: map[string]string{
+			"session_name": "sky",
+		},
+	}); err != nil {
+		t.Fatalf("Create(task): %v", err)
+	}
+
+	candidates, err := ExactMetadataSessionCandidates(store, false,
+		map[string]string{"session_name": "sky"},
+		map[string]string{"alias": "sky"},
+		map[string]string{"session_name": ""},
+		map[string]string{"": "sky"},
+		map[string]string{"session_name": "sky", "alias": "sky"},
+	)
+	if err != nil {
+		t.Fatalf("ExactMetadataSessionCandidates: %v", err)
+	}
+	if len(candidates) != 1 || candidates[0].ID != sessionBead.ID {
+		t.Fatalf("candidates = %#v, want only %s", candidates, sessionBead.ID)
+	}
+}
+
+func TestExactMetadataSessionCandidatesWithStatusReturnsOnlyStatus(t *testing.T) {
+	store := beads.NewMemStore()
+	open, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": "sky",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(open): %v", err)
+	}
+	closed, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": "sky",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(closed): %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("Close(%s): %v", closed.ID, err)
+	}
+
+	candidates, err := ExactMetadataSessionCandidatesWithStatus(store, "closed",
+		map[string]string{"session_name": "sky"},
+	)
+	if err != nil {
+		t.Fatalf("ExactMetadataSessionCandidatesWithStatus: %v", err)
+	}
+	if len(candidates) != 1 || candidates[0].ID != closed.ID {
+		t.Fatalf("candidates = %#v, want closed %s and not open %s", candidates, closed.ID, open.ID)
+	}
+}
diff --git a/internal/session/named_config.go b/internal/session/named_config.go
index 3e4188d8a1..f59e05fac5 100644
--- a/internal/session/named_config.go
+++ b/internal/session/named_config.go
@@ -214,6 +214,204 @@ func BeadConflictsWithNamedSession(b beads.Bead, spec NamedSessionSpec) bool {
 	return false
 }
 
+// ConfiguredNamedSessionLookup is the bounded lookup result for a configured named session.
+type ConfiguredNamedSessionLookup struct {
+	Canonical    beads.Bead
+	HasCanonical bool
+	Conflict     beads.Bead
+	HasConflict  bool
+}
+
+// FindCanonicalConfiguredNamedSessionBead finds the live bead that owns a
+// configured named session using exact metadata-filtered store queries.
+func FindCanonicalConfiguredNamedSessionBead(store beads.Store, spec NamedSessionSpec) (beads.Bead, bool, error) {
+	lookup, err := lookupConfiguredNamedSession(store, spec, false)
+	if err != nil {
+		return beads.Bead{}, false, err
+	}
+	return lookup.Canonical, lookup.HasCanonical, nil
+}
+
+// LookupConfiguredNamedSession finds the canonical bead or first live conflict
+// for a configured named session using exact metadata-filtered store queries.
+// The result is stitched from several sequential store reads; downstream
+// uniqueness and claim serialization remain the authority under concurrent
+// bead mutation.
+func LookupConfiguredNamedSession(store beads.Store, spec NamedSessionSpec) (ConfiguredNamedSessionLookup, error) {
+	return lookupConfiguredNamedSession(store, spec, true)
+}
+
+func lookupConfiguredNamedSession(store beads.Store, spec NamedSessionSpec, includeConflict bool) (ConfiguredNamedSessionLookup, error) {
+	if store == nil {
+		return ConfiguredNamedSessionLookup{}, nil
+	}
+	spec.Identity = NormalizeNamedSessionTarget(spec.Identity)
+	spec.SessionName = strings.TrimSpace(spec.SessionName)
+	if spec.Identity == "" && spec.SessionName == "" {
+		return ConfiguredNamedSessionLookup{}, nil
+	}
+
+	candidates := make([]beads.Bead, 0, 4)
+	seen := make(map[string]bool)
+	var runtimeSessionNameMatches []beads.Bead
+
+	if spec.Identity != "" {
+		matches, err := listConfiguredNamedSessionBeadsByMetadata(store, NamedSessionIdentityMetadata, spec.Identity)
+		if err != nil {
+			return ConfiguredNamedSessionLookup{}, fmt.Errorf("listing canonical named session candidates: %w", err)
+		}
+		candidates = appendUniqueNamedSessionCandidates(candidates, seen, matches)
+		if bead, ok := FindCanonicalNamedSessionBead(candidates, spec); ok {
+			return ConfiguredNamedSessionLookup{Canonical: bead, HasCanonical: true}, nil
+		}
+	}
+
+	if spec.SessionName != "" {
+		matches, err := listConfiguredNamedSessionBeadsByMetadata(store, "session_name", spec.SessionName)
+		if err != nil {
+			return ConfiguredNamedSessionLookup{}, fmt.Errorf("listing canonical named session candidates by session_name: %w", err)
+		}
+		runtimeSessionNameMatches = matches
+		candidates = appendUniqueNamedSessionCandidates(candidates, seen, matches)
+		if bead, ok := FindCanonicalNamedSessionBead(candidates, spec); ok {
+			return ConfiguredNamedSessionLookup{Canonical: bead, HasCanonical: true}, nil
+		}
+	}
+
+	if spec.Identity != "" && spec.Identity != spec.SessionName {
+		matches, err := listConfiguredNamedSessionBeadsByMetadata(store, "session_name", spec.Identity)
+		if err != nil {
+			return ConfiguredNamedSessionLookup{}, fmt.Errorf("listing canonical named session candidates by bare identity: %w", err)
+		}
+		candidates = appendUniqueNamedSessionCandidates(candidates, seen, matches)
+		if bead, ok := FindCanonicalNamedSessionBead(candidates, spec); ok {
+			return ConfiguredNamedSessionLookup{Canonical: bead, HasCanonical: true}, nil
+		}
+	}
+
+	if !includeConflict {
+		return ConfiguredNamedSessionLookup{}, nil
+	}
+
+	conflictCandidates := append([]beads.Bead{}, runtimeSessionNameMatches...)
+	if spec.Identity != "" {
+		matches, err := listConfiguredNamedSessionBeadsByMetadata(store, "alias", spec.Identity)
+		if err != nil {
+			return ConfiguredNamedSessionLookup{}, fmt.Errorf("listing alias conflicts: %w", err)
+		}
+		conflictCandidates = appendUniqueNamedSessionCandidates(conflictCandidates, make(map[string]bool, len(conflictCandidates)+len(matches)), matches)
+	}
+	if bead, conflict := FindNamedSessionConflict(conflictCandidates, spec); conflict {
+		return ConfiguredNamedSessionLookup{Conflict: bead, HasConflict: true}, nil
+	}
+	return ConfiguredNamedSessionLookup{}, nil
+}
+
+func listConfiguredNamedSessionBeadsByMetadata(store beads.Store, key, value string) ([]beads.Bead, error) {
+	key = strings.TrimSpace(key)
+	value = strings.TrimSpace(value)
+	if key == "" || value == "" {
+		return nil, nil
+	}
+	items, err := store.List(beads.ListQuery{
+		Metadata: map[string]string{key: value},
+	})
+	if err != nil {
+		return nil, err
+	}
+	out := make([]beads.Bead, 0, len(items))
+	for _, b := range items {
+		if !IsSessionBeadOrRepairable(b) {
+			continue
+		}
+		RepairEmptyType(store, &b)
+		out = append(out, b)
+	}
+	return out, nil
+}
+
+func appendUniqueNamedSessionCandidates(dst []beads.Bead, seen map[string]bool, src []beads.Bead) []beads.Bead {
+	for _, b := range dst {
+		seen[b.ID] = true
+	}
+	for _, b := range src {
+		if seen[b.ID] {
+			continue
+		}
+		dst = append(dst, b)
+		seen[b.ID] = true
+	}
+	return dst
+}
+
+// NamedSessionResolutionCandidates returns the live session beads that can own
+// or conflict with the configured named-session spec.
+//
+// The implementation issues a single label-scoped store.List for gc:session
+// beads and applies the four metadata predicates in process. Targeted
+// per-key metadata lookups would be marginally cheaper per call against an
+// indexed store, but every named-session resolution drives four sequential
+// bd subprocess invocations through the BdStore exec runner. Under
+// reconciler/wake load — N agents × 4 sequential bd subprocesses each —
+// that fan-out saturates the bd CLI and the underlying Dolt connection
+// pool, tipping individual list invocations past the 120s subprocess
+// timeout (gascity ga-pa57, ga-sed; mayor escalation 2026-04-26). Folding
+// the four metadata predicates into one label-scoped scan caps per-resolve
+// bd invocations at one and bounds the candidate set by the active
+// session count, which is small. Measured under 20-parallel load on a
+// representative city: 5.2s → 1.3s. Interactive session-targeting paths
+// that must avoid label-wide scans use LookupConfiguredNamedSession instead.
+func NamedSessionResolutionCandidates(store beads.Store, spec NamedSessionSpec) ([]beads.Bead, error) {
+	if store == nil {
+		return nil, nil
+	}
+	identity := NormalizeNamedSessionTarget(spec.Identity)
+	sessionName := strings.TrimSpace(spec.SessionName)
+	if identity == "" && sessionName == "" {
+		return nil, nil
+	}
+	items, err := store.List(beads.ListQuery{Label: LabelSession})
+	if err != nil {
+		return nil, err
+	}
+	candidates := make([]beads.Bead, 0, len(items))
+	for _, b := range items {
+		if !IsSessionBeadOrRepairable(b) {
+			continue
+		}
+		if !beadMatchesNamedSessionResolutionFilter(b, identity, sessionName) {
+			continue
+		}
+		RepairEmptyType(store, &b)
+		candidates = append(candidates, b)
+	}
+	return candidates, nil
+}
+
+// beadMatchesNamedSessionResolutionFilter reports whether a bead matches any
+// of the metadata predicates that NamedSessionResolutionCandidates folds
+// in process: configured-named-identity, session_name against the runtime
+// name, session_name against the bare identity, or alias against the bare
+// identity. Empty arguments disable their respective predicates so the
+// behavior matches ExactMetadataSessionCandidates' empty-filter handling.
+func beadMatchesNamedSessionResolutionFilter(b beads.Bead, identity, sessionName string) bool {
+	if identity != "" {
+		if strings.TrimSpace(b.Metadata[NamedSessionIdentityMetadata]) == identity {
+			return true
+		}
+		if strings.TrimSpace(b.Metadata["session_name"]) == identity {
+			return true
+		}
+		if strings.TrimSpace(b.Metadata["alias"]) == identity {
+			return true
+		}
+	}
+	if sessionName != "" && strings.TrimSpace(b.Metadata["session_name"]) == sessionName {
+		return true
+	}
+	return false
+}
+
 // FindNamedSessionConflict finds the first live session bead that blocks a configured named session.
 func FindNamedSessionConflict(candidates []beads.Bead, spec NamedSessionSpec) (beads.Bead, bool) {
 	for _, b := range candidates {
@@ -255,6 +453,9 @@ func FindClosedNamedSessionBeadForSessionName(store beads.Store, identity, sessi
 		if b.Status != "closed" {
 			continue
 		}
+		if !closedNamedSessionReopenEligible(b) {
+			continue
+		}
 		if sessionName != "" {
 			if strings.TrimSpace(b.Metadata["session_name"]) == sessionName {
 				return b, true, nil
@@ -275,6 +476,21 @@ func FindClosedNamedSessionBeadForSessionName(store beads.Store, identity, sessi
 	return beads.Bead{}, false, nil
 }
 
+func closedNamedSessionReopenEligible(b beads.Bead) bool {
+	if strings.TrimSpace(b.Metadata["continuity_eligible"]) == "false" {
+		return false
+	}
+	switch strings.TrimSpace(b.Metadata["close_reason"]) {
+	case "duplicate", "duplicate-repair", "gc_swept", "orphaned", "reconfigured", "stale-session":
+		return false
+	}
+	switch strings.TrimSpace(b.Metadata["state"]) {
+	case "duplicate", "duplicate-repair", "gc_swept", "orphaned", "reconfigured", "stale-session":
+		return false
+	}
+	return true
+}
+
 // FindCanonicalNamedSessionBead finds the active bead that owns a configured named session.
 func FindCanonicalNamedSessionBead(candidates []beads.Bead, spec NamedSessionSpec) (beads.Bead, bool) {
 	identity := NormalizeNamedSessionTarget(spec.Identity)
diff --git a/internal/session/named_config_test.go b/internal/session/named_config_test.go
index cc562a65c2..699938cba4 100644
--- a/internal/session/named_config_test.go
+++ b/internal/session/named_config_test.go
@@ -165,6 +165,35 @@ func TestFindClosedNamedSessionBeadForSessionName_PrefersMatchingCanonicalCandid
 	}
 }
 
+func TestFindClosedNamedSessionBeadForSessionName_SkipsTerminalRetiredCandidate(t *testing.T) {
+	store := beads.NewMemStore()
+	orphaned, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name":               "test-city--mayor",
+			"close_reason":               "orphaned",
+			"state":                      "orphaned",
+			NamedSessionMetadataKey:      "true",
+			NamedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(orphaned): %v", err)
+	}
+	if err := store.Close(orphaned.ID); err != nil {
+		t.Fatalf("Close(orphaned): %v", err)
+	}
+
+	found, ok, err := FindClosedNamedSessionBeadForSessionName(store, "mayor", "test-city--mayor")
+	if err != nil {
+		t.Fatalf("FindClosedNamedSessionBeadForSessionName: %v", err)
+	}
+	if ok {
+		t.Fatalf("FindClosedNamedSessionBeadForSessionName returned %q, want no reusable bead", found.ID)
+	}
+}
+
 func TestFindClosedNamedSessionBead_PrefersNewestClosedCanonical(t *testing.T) {
 	store := beads.NewMemStore()
 	older, err := store.Create(beads.Bead{
@@ -351,3 +380,277 @@ func TestFindClosedNamedSessionBead_AcceptsLegacySessionType(t *testing.T) {
 		t.Fatalf("found bead ID = %q, want legacy %q", found.ID, legacy.ID)
 	}
 }
+
+// listCountingStore wraps a MemStore and records every List query so tests
+// can assert on call count and shape.
+type listCountingStore struct {
+	*beads.MemStore
+	queries []beads.ListQuery
+}
+
+func (s *listCountingStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	s.queries = append(s.queries, query)
+	return s.MemStore.List(query)
+}
+
+func TestLookupConfiguredNamedSession_BoundedConflictQueries(t *testing.T) {
+	store := &listCountingStore{MemStore: beads.NewMemStore()}
+	spec := NamedSessionSpec{
+		Identity:    "mayor",
+		SessionName: "test-city--mayor",
+	}
+	conflict, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": spec.SessionName,
+			"template":     "other",
+			"agent_name":   "other",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(conflict): %v", err)
+	}
+
+	lookup, err := LookupConfiguredNamedSession(store, spec)
+	if err != nil {
+		t.Fatalf("LookupConfiguredNamedSession: %v", err)
+	}
+	if !lookup.HasConflict {
+		t.Fatal("HasConflict = false, want true")
+	}
+	if lookup.Conflict.ID != conflict.ID {
+		t.Fatalf("Conflict.ID = %q, want %q", lookup.Conflict.ID, conflict.ID)
+	}
+	if len(store.queries) > 4 {
+		t.Fatalf("List calls = %d, want bounded small constant without duplicate session_name lookup", len(store.queries))
+	}
+	for i, query := range store.queries {
+		if len(query.Metadata) == 0 {
+			t.Fatalf("query #%d has no metadata filter: %+v", i, query)
+		}
+	}
+}
+
+func TestLookupConfiguredNamedSession_AcceptsTypeOnlyCanonicalBead(t *testing.T) {
+	store := beads.NewMemStore()
+	spec := NamedSessionSpec{
+		Identity:    "mayor",
+		SessionName: "test-city--mayor",
+	}
+	canonical, err := store.Create(beads.Bead{
+		Type: BeadType,
+		Metadata: map[string]string{
+			NamedSessionMetadataKey:      "true",
+			NamedSessionIdentityMetadata: spec.Identity,
+			"session_name":               spec.SessionName,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(canonical): %v", err)
+	}
+
+	lookup, err := LookupConfiguredNamedSession(store, spec)
+	if err != nil {
+		t.Fatalf("LookupConfiguredNamedSession: %v", err)
+	}
+	if !lookup.HasCanonical {
+		t.Fatal("HasCanonical = false, want true")
+	}
+	if lookup.Canonical.ID != canonical.ID {
+		t.Fatalf("Canonical.ID = %q, want %q", lookup.Canonical.ID, canonical.ID)
+	}
+}
+
+func TestLookupConfiguredNamedSession_ReportsSessionNameConflictBeforeAliasConflict(t *testing.T) {
+	store := beads.NewMemStore()
+	spec := NamedSessionSpec{
+		Identity:    "mayor",
+		SessionName: "test-city--mayor",
+	}
+	aliasConflict, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"alias":      spec.Identity,
+			"template":   "other",
+			"agent_name": "other",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(alias conflict): %v", err)
+	}
+	sessionNameConflict, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": spec.SessionName,
+			"template":     "other",
+			"agent_name":   "other",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(session_name conflict): %v", err)
+	}
+
+	lookup, err := LookupConfiguredNamedSession(store, spec)
+	if err != nil {
+		t.Fatalf("LookupConfiguredNamedSession: %v", err)
+	}
+	if !lookup.HasConflict {
+		t.Fatal("HasConflict = false, want true")
+	}
+	if lookup.Conflict.ID != sessionNameConflict.ID {
+		t.Fatalf("Conflict.ID = %q, want session_name conflict %q before alias conflict %q", lookup.Conflict.ID, sessionNameConflict.ID, aliasConflict.ID)
+	}
+}
+
+func TestLookupConfiguredNamedSession_EmptySpecNoListCall(t *testing.T) {
+	store := &listCountingStore{MemStore: beads.NewMemStore()}
+
+	lookup, err := LookupConfiguredNamedSession(store, NamedSessionSpec{})
+	if err != nil {
+		t.Fatalf("LookupConfiguredNamedSession(empty): %v", err)
+	}
+	if lookup.HasCanonical || lookup.HasConflict {
+		t.Fatalf("lookup = %+v, want empty result", lookup)
+	}
+	if len(store.queries) != 0 {
+		t.Fatalf("List calls = %d, want 0", len(store.queries))
+	}
+}
+
+func TestNamedSessionResolutionCandidates_SingleListByLabel(t *testing.T) {
+	store := &listCountingStore{MemStore: beads.NewMemStore()}
+	canonical, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			NamedSessionMetadataKey:      "true",
+			NamedSessionIdentityMetadata: "mayor",
+			"session_name":               "test-city--mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(canonical): %v", err)
+	}
+	// Bead matched only by session_name == identity (legacy / fallback path).
+	bareSessionName, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(bareSessionName): %v", err)
+	}
+	// Bead matched only by alias == identity.
+	aliased, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"alias":    "mayor",
+			"template": "myrig/other",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(aliased): %v", err)
+	}
+	// Bead that should NOT be returned — different identity.
+	if _, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			NamedSessionIdentityMetadata: "polecat",
+			"session_name":               "test-city--polecat",
+		},
+	}); err != nil {
+		t.Fatalf("Create(polecat): %v", err)
+	}
+	// Non-session bead with matching alias — must be excluded.
+	if _, err := store.Create(beads.Bead{
+		Type: "task",
+		Metadata: map[string]string{
+			"alias": "mayor",
+		},
+	}); err != nil {
+		t.Fatalf("Create(non-session): %v", err)
+	}
+	// Closed session with matching identity — must be excluded (live only).
+	closed, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			NamedSessionIdentityMetadata: "mayor",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(closed): %v", err)
+	}
+	if err := store.Close(closed.ID); err != nil {
+		t.Fatalf("Close(closed): %v", err)
+	}
+
+	spec := NamedSessionSpec{
+		Identity:    "mayor",
+		SessionName: "test-city--mayor",
+	}
+	got, err := NamedSessionResolutionCandidates(store, spec)
+	if err != nil {
+		t.Fatalf("NamedSessionResolutionCandidates: %v", err)
+	}
+	gotIDs := make(map[string]bool, len(got))
+	for _, b := range got {
+		gotIDs[b.ID] = true
+	}
+	for _, want := range []string{canonical.ID, bareSessionName.ID, aliased.ID} {
+		if !gotIDs[want] {
+			t.Errorf("missing expected candidate %q in %v", want, gotIDs)
+		}
+	}
+	if gotIDs[closed.ID] {
+		t.Errorf("closed session %q must not appear in live candidates", closed.ID)
+	}
+
+	// One List call total — the contention budget that motivated this
+	// implementation. Pre-collapse, this path issued four sequential
+	// metadata-field List calls per resolution.
+	if len(store.queries) != 1 {
+		t.Fatalf("expected 1 store.List call, got %d: %+v", len(store.queries), store.queries)
+	}
+	q := store.queries[0]
+	if q.Label != LabelSession {
+		t.Errorf("query.Label = %q, want %q", q.Label, LabelSession)
+	}
+	if q.IncludeClosed {
+		t.Errorf("query.IncludeClosed = true, want false (live candidates only)")
+	}
+	if len(q.Metadata) != 0 {
+		t.Errorf("query.Metadata = %+v, want empty (label-scoped scan, in-process filter)", q.Metadata)
+	}
+}
+
+func TestNamedSessionResolutionCandidates_EmptySpecNoListCall(t *testing.T) {
+	store := &listCountingStore{MemStore: beads.NewMemStore()}
+	got, err := NamedSessionResolutionCandidates(store, NamedSessionSpec{})
+	if err != nil {
+		t.Fatalf("NamedSessionResolutionCandidates(empty): %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("got %d candidates for empty spec, want 0", len(got))
+	}
+	if len(store.queries) != 0 {
+		t.Fatalf("expected 0 store.List calls for empty spec, got %d", len(store.queries))
+	}
+}
+
+func TestNamedSessionResolutionCandidates_NilStore(t *testing.T) {
+	got, err := NamedSessionResolutionCandidates(nil, NamedSessionSpec{Identity: "mayor"})
+	if err != nil {
+		t.Fatalf("NamedSessionResolutionCandidates(nil): %v", err)
+	}
+	if got != nil {
+		t.Fatalf("got %v, want nil for nil store", got)
+	}
+}
diff --git a/internal/session/names.go b/internal/session/names.go
index 330fff8513..4582868040 100644
--- a/internal/session/names.go
+++ b/internal/session/names.go
@@ -325,10 +325,13 @@ func ensureSessionNameAvailableForSelfAndOwner(store beads.Store, name, selfID,
 	if name == "" {
 		return nil
 	}
-	all, err := store.List(beads.ListQuery{
-		Label:         LabelSession,
-		IncludeClosed: true,
-	})
+	all, err := ExactMetadataSessionCandidates(store, true,
+		map[string]string{"session_name": name},
+		map[string]string{"alias": name},
+		map[string]string{"agent_name": name},
+		map[string]string{"template": name},
+		map[string]string{"common_name": name},
+	)
 	if err != nil {
 		return fmt.Errorf("listing sessions: %w", err)
 	}
@@ -515,10 +518,13 @@ func isConfiguredNamedSessionRuntimeName(cfg *config.City, name, owner string) b
 // ensureSessionNameAvailableForSelf so the legacy-bypass path cannot
 // suppress rejections from live alias or identifier collisions.
 func noLiveSessionNameCollisions(store beads.Store, name, selfID, selfOwner string) bool {
-	all, err := store.List(beads.ListQuery{
-		Label:         LabelSession,
-		IncludeClosed: true,
-	})
+	all, err := ExactMetadataSessionCandidates(store, true,
+		map[string]string{"session_name": name},
+		map[string]string{"alias": name},
+		map[string]string{"agent_name": name},
+		map[string]string{"template": name},
+		map[string]string{"common_name": name},
+	)
 	if err != nil {
 		return false
 	}
@@ -565,9 +571,11 @@ func ensureSessionAliasAvailable(store beads.Store, cfg *config.City, alias, sel
 			hasSelfBead = true
 		}
 	}
-	all, err := store.List(beads.ListQuery{
-		Label: LabelSession,
-	})
+	all, err := ExactMetadataSessionCandidates(store, false,
+		map[string]string{"session_name": alias},
+		map[string]string{"alias": alias},
+		map[string]string{"agent_name": alias},
+	)
 	if err != nil {
 		return fmt.Errorf("listing sessions: %w", err)
 	}
diff --git a/internal/session/names_test.go b/internal/session/names_test.go
index 2e95256d39..d604d70013 100644
--- a/internal/session/names_test.go
+++ b/internal/session/names_test.go
@@ -13,6 +13,18 @@ import (
 	"github.com/gastownhall/gascity/internal/config"
 )
 
+type noBroadSessionIdentifierStore struct {
+	*beads.MemStore
+	t *testing.T
+}
+
+func (s *noBroadSessionIdentifierStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == LabelSession && len(query.Metadata) == 0 {
+		s.t.Fatalf("session identifier availability used broad session label scan: %+v", query)
+	}
+	return s.MemStore.List(query)
+}
+
 func TestValidateExplicitName(t *testing.T) {
 	longName := strings.Repeat("a", explicitSessionNameMaxLen+1)
 	tests := []struct {
@@ -944,6 +956,42 @@ func TestEnsureSessionNameAvailableWithConfigForOwner_AllowsPoolManagedIdentifie
 	}
 }
 
+func TestEnsureSessionNameAvailableUsesTargetedIdentifierLookups(t *testing.T) {
+	store := &noBroadSessionIdentifierStore{MemStore: beads.NewMemStore(), t: t}
+	_, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"alias": "sky",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(alias holder): %v", err)
+	}
+
+	if err := EnsureSessionNameAvailableWithConfig(store, nil, "sky", ""); !errors.Is(err, ErrSessionNameExists) {
+		t.Fatalf("EnsureSessionNameAvailableWithConfig(alias collision) = %v, want ErrSessionNameExists", err)
+	}
+}
+
+func TestEnsureAliasAvailableUsesTargetedIdentifierLookups(t *testing.T) {
+	store := &noBroadSessionIdentifierStore{MemStore: beads.NewMemStore(), t: t}
+	_, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"session_name": "sky",
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create(session_name holder): %v", err)
+	}
+
+	if err := EnsureAliasAvailableWithConfig(store, nil, "sky", ""); !errors.Is(err, ErrSessionAliasExists) {
+		t.Fatalf("EnsureAliasAvailableWithConfig(session_name collision) = %v, want ErrSessionAliasExists", err)
+	}
+}
+
 func TestWithCitySessionLocks_EmptyCityPathSharesIdentifierNamespace(t *testing.T) {
 	started := make(chan struct{})
 	release := make(chan struct{})
diff --git a/internal/session/resolve.go b/internal/session/resolve.go
index eb91fd7373..77aa7a4491 100644
--- a/internal/session/resolve.go
+++ b/internal/session/resolve.go
@@ -20,6 +20,9 @@ var (
 // live identifiers: open exact session_name matches first, then open exact
 // current alias matches. Normal session targeting does not fall through to
 // template, agent_name, or historical alias compatibility identifiers.
+// When a bead has both alias and session_name equal to the identifier, a
+// separate session_name-only bead owns the identifier; the dual bead remains
+// the session_name match only when no other session_name match exists.
 //
 // Returns ErrSessionNotFound if no live match is found, or ErrAmbiguous
 // (wrapped with details) if multiple sessions match the identifier.
@@ -37,18 +40,26 @@ func ResolveSessionIDAllowClosed(store beads.Store, identifier string) (string,
 
 // ResolveSessionIDByExactID resolves only direct bead ID matches.
 func ResolveSessionIDByExactID(store beads.Store, identifier string) (string, error) {
+	_, id, err := ResolveSessionBeadByExactID(store, identifier)
+	return id, err
+}
+
+// ResolveSessionBeadByExactID is like ResolveSessionIDByExactID but also
+// returns the loaded session bead, so callers that immediately need it can
+// avoid a second store.Get.
+func ResolveSessionBeadByExactID(store beads.Store, identifier string) (beads.Bead, string, error) {
 	if store == nil {
-		return "", fmt.Errorf("session store unavailable")
+		return beads.Bead{}, "", fmt.Errorf("session store unavailable")
 	}
 	b, err := store.Get(identifier)
 	if err == nil && IsSessionBeadOrRepairable(b) {
 		RepairEmptyType(store, &b)
-		return b.ID, nil
+		return b, b.ID, nil
 	}
 	if err != nil && !errors.Is(err, beads.ErrNotFound) {
-		return "", fmt.Errorf("looking up session %q: %w", identifier, err)
+		return beads.Bead{}, "", fmt.Errorf("looking up session %q: %w", identifier, err)
 	}
-	return "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
+	return beads.Bead{}, "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
 }
 
 func resolveSessionID(store beads.Store, identifier string, allowClosed bool) (string, error) {
@@ -58,66 +69,114 @@ func resolveSessionID(store beads.Store, identifier string, allowClosed bool) (s
 		return "", err
 	}
 
-	// Fall back to live alias/session_name resolution among session beads.
-	all, err := store.List(beads.ListQuery{
-		Label:         LabelSession,
+	lookupIdentifier := strings.TrimSpace(identifier)
+	if lookupIdentifier == "" {
+		return "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
+	}
+
+	bySessionName, err := listSessionBeadsByMetadata(store, "session_name", lookupIdentifier, false)
+	if err != nil {
+		return "", fmt.Errorf("listing sessions by session_name: %w", err)
+	}
+	bySessionName = filterOutAliasMatches(bySessionName, lookupIdentifier)
+	if len(bySessionName) > 0 {
+		return chooseSessionMatch(identifier, bySessionName)
+	}
+
+	byAlias, err := listSessionBeadsByMetadata(store, "alias", lookupIdentifier, false)
+	if err != nil {
+		return "", fmt.Errorf("listing sessions by alias: %w", err)
+	}
+	if len(byAlias) > 0 {
+		return chooseSessionMatch(identifier, byAlias)
+	}
+	if !allowClosed {
+		return "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
+	}
+
+	bySessionName, err = listSessionBeadsByMetadata(store, "session_name", lookupIdentifier, true)
+	if err != nil {
+		return "", fmt.Errorf("listing closed sessions by session_name: %w", err)
+	}
+	bySessionName = filterOutAliasMatches(bySessionName, lookupIdentifier)
+	openSessionName, closedSessionName := splitOpen(bySessionName)
+	if len(openSessionName) > 0 {
+		return chooseSessionMatch(identifier, openSessionName)
+	}
+	if len(closedSessionName) > 0 {
+		return chooseSessionMatch(identifier, closedSessionName)
+	}
+
+	byAlias, err = listSessionBeadsByMetadata(store, "alias", lookupIdentifier, true)
+	if err != nil {
+		return "", fmt.Errorf("listing closed sessions by alias: %w", err)
+	}
+	openAlias, closedAlias := splitOpen(byAlias)
+	if len(openAlias) > 0 {
+		return chooseSessionMatch(identifier, openAlias)
+	}
+	if len(closedAlias) > 0 {
+		return chooseSessionMatch(identifier, closedAlias)
+	}
+	return "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
+}
+
+func listSessionBeadsByMetadata(store beads.Store, key, value string, allowClosed bool) ([]beads.Bead, error) {
+	key = strings.TrimSpace(key)
+	value = strings.TrimSpace(value)
+	if key == "" || value == "" {
+		return nil, nil
+	}
+	raw, err := store.List(beads.ListQuery{
+		Metadata:      map[string]string{key: value},
 		IncludeClosed: allowClosed,
 	})
 	if err != nil {
-		return "", fmt.Errorf("listing sessions: %w", err)
+		return nil, err
 	}
-
-	var openSessionNameMatches []beads.Bead
-	var openAliasMatches []beads.Bead
-	var closedSessionNameMatches []beads.Bead
-	var closedAliasMatches []beads.Bead
-	for _, b := range all {
+	out := make([]beads.Bead, 0, len(raw))
+	for _, b := range raw {
 		if !IsSessionBeadOrRepairable(b) {
 			continue
 		}
 		RepairEmptyType(store, &b)
-		alias := strings.TrimSpace(b.Metadata["alias"])
-		sessionName := strings.TrimSpace(b.Metadata["session_name"])
-		if b.Status != "closed" {
-			switch {
-			case alias == identifier:
-				openAliasMatches = append(openAliasMatches, b)
-			case sessionName == identifier:
-				openSessionNameMatches = append(openSessionNameMatches, b)
-			}
-			continue
-		}
-		if !allowClosed {
-			continue
-		}
-		switch {
-		case alias == identifier:
-			closedAliasMatches = append(closedAliasMatches, b)
-		case sessionName == identifier:
-			closedSessionNameMatches = append(closedSessionNameMatches, b)
-		}
+		out = append(out, b)
 	}
+	return out, nil
+}
 
-	for _, matches := range [][]beads.Bead{
-		openSessionNameMatches,
-		openAliasMatches,
-	} {
-		if len(matches) > 0 {
-			return chooseSessionMatch(identifier, matches)
+func filterOutAliasMatches(in []beads.Bead, identifier string) []beads.Bead {
+	hasSessionNameOnlyMatch := false
+	for _, b := range in {
+		if strings.TrimSpace(b.Metadata["alias"]) != identifier {
+			hasSessionNameOnlyMatch = true
+			break
 		}
 	}
-	if !allowClosed {
-		return "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
+	if !hasSessionNameOnlyMatch {
+		return in
 	}
-	for _, matches := range [][]beads.Bead{
-		closedSessionNameMatches,
-		closedAliasMatches,
-	} {
-		if len(matches) > 0 {
-			return chooseSessionMatch(identifier, matches)
+	// Demote dual alias/session_name beads only when another session_name
+	// match can own the identifier; otherwise session_name still wins.
+	out := in[:0]
+	for _, b := range in {
+		if strings.TrimSpace(b.Metadata["alias"]) == identifier {
+			continue
 		}
+		out = append(out, b)
 	}
-	return "", fmt.Errorf("%w: %q", ErrSessionNotFound, identifier)
+	return out
+}
+
+func splitOpen(in []beads.Bead) (open, closed []beads.Bead) {
+	for _, b := range in {
+		if b.Status == "closed" {
+			closed = append(closed, b)
+			continue
+		}
+		open = append(open, b)
+	}
+	return open, closed
 }
 
 func chooseSessionMatch(identifier string, matches []beads.Bead) (string, error) {
diff --git a/internal/session/resolve_test.go b/internal/session/resolve_test.go
index a24cca42e8..a7d59a1f8f 100644
--- a/internal/session/resolve_test.go
+++ b/internal/session/resolve_test.go
@@ -2,12 +2,23 @@ package session_test
 
 import (
 	"errors"
+	"fmt"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/session"
 )
 
+type listCountingStore struct {
+	beads.Store
+	listCalls []beads.ListQuery
+}
+
+func (s *listCountingStore) List(q beads.ListQuery) ([]beads.Bead, error) {
+	s.listCalls = append(s.listCalls, q)
+	return s.Store.List(q)
+}
+
 func TestResolveSessionID_DirectLookup(t *testing.T) {
 	store := beads.NewMemStore()
 	b, _ := store.Create(beads.Bead{
@@ -80,6 +91,59 @@ func TestResolveSessionID_Alias(t *testing.T) {
 	}
 }
 
+type noBroadSessionListStore struct {
+	*beads.MemStore
+	t *testing.T
+}
+
+func (s *noBroadSessionListStore) List(query beads.ListQuery) ([]beads.Bead, error) {
+	if query.Label == session.LabelSession && len(query.Metadata) == 0 {
+		s.t.Fatalf("session resolution used broad session label scan: %+v", query)
+	}
+	return s.MemStore.List(query)
+}
+
+func TestResolveSessionID_UsesTargetedAliasLookup(t *testing.T) {
+	store := &noBroadSessionListStore{MemStore: beads.NewMemStore(), t: t}
+	b, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias": "overseer",
+		},
+	})
+
+	id, err := session.ResolveSessionID(store, "overseer")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+}
+
+func TestResolveSessionIDAllowClosed_UsesTargetedSessionNameLookup(t *testing.T) {
+	store := &noBroadSessionListStore{MemStore: beads.NewMemStore(), t: t}
+	b, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": "sky",
+		},
+	})
+	if err := store.Close(b.ID); err != nil {
+		t.Fatal(err)
+	}
+
+	id, err := session.ResolveSessionIDAllowClosed(store, "sky")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+}
+
 func TestResolveSessionID_DoesNotResolveExactQualifiedTemplate(t *testing.T) {
 	store := beads.NewMemStore()
 	_, _ = store.Create(beads.Bead{
@@ -186,6 +250,73 @@ func TestResolveSessionID_SessionNameExactMatch(t *testing.T) {
 	}
 }
 
+func TestResolveSessionID_SessionNameExactMatchAcceptsTypeOnlySessionBead(t *testing.T) {
+	store := beads.NewMemStore()
+	b, _ := store.Create(beads.Bead{
+		Type: session.BeadType,
+		Metadata: map[string]string{
+			"session_name": "s-gc-legacy",
+		},
+	})
+
+	id, err := session.ResolveSessionID(store, "s-gc-legacy")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+}
+
+func TestResolveSessionID_AliasExactMatchAcceptsTypeOnlySessionBead(t *testing.T) {
+	store := beads.NewMemStore()
+	b, _ := store.Create(beads.Bead{
+		Type: session.BeadType,
+		Metadata: map[string]string{
+			"alias": "legacy",
+		},
+	})
+
+	id, err := session.ResolveSessionID(store, "legacy")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+}
+
+func TestResolveSessionID_TrimsMetadataIdentifier(t *testing.T) {
+	store := beads.NewMemStore()
+	b, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": "worker",
+		},
+	})
+
+	id, err := session.ResolveSessionID(store, " worker ")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+}
+
+func TestResolveSessionID_WhitespaceOnlyIdentifierDoesNotList(t *testing.T) {
+	store := &listCountingStore{Store: beads.NewMemStore()}
+
+	_, err := session.ResolveSessionID(store, "   ")
+	if !errors.Is(err, session.ErrSessionNotFound) {
+		t.Fatalf("ResolveSessionID(whitespace) = %v, want ErrSessionNotFound", err)
+	}
+	if len(store.listCalls) != 0 {
+		t.Fatalf("List calls = %d, want 0 for empty trimmed metadata identifier", len(store.listCalls))
+	}
+}
+
 func TestResolveSessionID_PrefersSessionNameOverAlias(t *testing.T) {
 	store := beads.NewMemStore()
 	_, _ = store.Create(beads.Bead{
@@ -213,6 +344,60 @@ func TestResolveSessionID_PrefersSessionNameOverAlias(t *testing.T) {
 	}
 }
 
+func TestResolveSessionID_PrefersSessionNameOverDualAliasSessionNameBead(t *testing.T) {
+	store := beads.NewMemStore()
+	_, _ = store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "worker",
+		},
+	})
+	named, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": "worker",
+		},
+	})
+
+	id, err := session.ResolveSessionID(store, "worker")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != named.ID {
+		t.Fatalf("got %q, want session-name-only match %q", id, named.ID)
+	}
+}
+
+func TestResolveSessionID_DualAliasSessionNameBeadWinsWhenNoOtherSessionNameMatch(t *testing.T) {
+	store := beads.NewMemStore()
+	dual, _ := store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias":        "worker",
+			"session_name": "worker",
+		},
+	})
+	_, _ = store.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"alias": "worker",
+		},
+	})
+
+	id, err := session.ResolveSessionID(store, "worker")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != dual.ID {
+		t.Fatalf("got %q, want dual session-name match %q", id, dual.ID)
+	}
+}
+
 func TestResolveSessionID_DoesNotResolveHistoricalAlias(t *testing.T) {
 	store := beads.NewMemStore()
 	_, _ = store.Create(beads.Bead{
@@ -299,6 +484,33 @@ func TestResolveSessionIDAllowClosed_ResolvesClosedSessionName(t *testing.T) {
 	}
 }
 
+func TestResolveSessionIDAllowClosed_OpenHitStaysCacheServed(t *testing.T) {
+	backing := &listCountingStore{Store: beads.NewMemStore()}
+	b, _ := backing.Create(beads.Bead{
+		Type:   session.BeadType,
+		Labels: []string{session.LabelSession},
+		Metadata: map[string]string{
+			"session_name": "sky",
+		},
+	})
+	cache := beads.NewCachingStoreForTest(backing, nil)
+	if err := cache.PrimeActive(); err != nil {
+		t.Fatalf("PrimeActive: %v", err)
+	}
+	backing.listCalls = nil
+
+	id, err := session.ResolveSessionIDAllowClosed(cache, "sky")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if id != b.ID {
+		t.Fatalf("got %q, want %q", id, b.ID)
+	}
+	if len(backing.listCalls) != 0 {
+		t.Fatalf("backing List calls = %d, want 0 for cached open match: %+v", len(backing.listCalls), backing.listCalls)
+	}
+}
+
 func TestResolveSessionIDAllowClosed_DoesNotResolveClosedHistoricalAlias(t *testing.T) {
 	store := beads.NewMemStore()
 	b, _ := store.Create(beads.Bead{
@@ -601,6 +813,40 @@ func TestRepairEmptyType_NoopForNonEmpty(t *testing.T) {
 	}
 }
 
+func TestResolveSessionID_BoundedListCalls(t *testing.T) {
+	inner := beads.NewMemStore()
+	for i := 0; i < 200; i++ {
+		_, _ = inner.Create(beads.Bead{
+			Type:   session.BeadType,
+			Labels: []string{session.LabelSession},
+			Metadata: map[string]string{
+				"session_name": fmt.Sprintf("worker-%d", i),
+			},
+		})
+	}
+	target, _ := inner.Create(beads.Bead{
+		Type:     session.BeadType,
+		Labels:   []string{session.LabelSession},
+		Metadata: map[string]string{"alias": "mayor"},
+	})
+	store := &listCountingStore{Store: inner}
+	id, err := session.ResolveSessionID(store, "mayor")
+	if err != nil || id != target.ID {
+		t.Fatalf("resolve failed: id=%q err=%v", id, err)
+	}
+	if len(store.listCalls) == 0 {
+		t.Fatalf("expected at least one List call")
+	}
+	if len(store.listCalls) != 2 {
+		t.Fatalf("List calls = %d, want 2", len(store.listCalls))
+	}
+	for i, q := range store.listCalls {
+		if len(q.Metadata) == 0 {
+			t.Fatalf("List call #%d has no metadata filter (would scan all beads): %+v", i, q)
+		}
+	}
+}
+
 func TestResolveSessionID_SkipsClosedBeads(t *testing.T) {
 	store := beads.NewMemStore()
 	b, _ := store.Create(beads.Bead{
diff --git a/internal/session/submit.go b/internal/session/submit.go
index 1f7210d4cc..287f05f9ff 100644
--- a/internal/session/submit.go
+++ b/internal/session/submit.go
@@ -109,7 +109,15 @@ func (m *Manager) submit(ctx context.Context, id, message, resumeCommand string,
 		case SubmitIntentInterruptNow:
 			return m.interruptAndSubmitLocked(ctx, id, b, sessName, message, resumeCommand, hints)
 		default:
-			resuming := State(b.Metadata["state"]) == StateSuspended || !m.sp.IsRunning(sessName)
+			running := m.sp.IsRunning(sessName)
+			if State(b.Metadata["state"]) == StateCreating && !running {
+				if err := m.enqueueDeferredSubmitLocked(b, sessName, message); err != nil {
+					return err
+				}
+				outcome.Queued = true
+				return nil
+			}
+			resuming := State(b.Metadata["state"]) == StateSuspended || !running
 			return m.sendLocked(ctx, id, b, sessName, message, resumeCommand, hints, usesImmediateDefaultSubmit(b, resuming))
 		}
 	})
@@ -450,7 +458,10 @@ func deferredSubmitAgentKey(b beads.Bead) string {
 	return b.Title
 }
 
-var startSessionSubmitPoller = ensureSessionSubmitPoller
+var (
+	startSessionSubmitPoller      = ensureSessionSubmitPoller
+	sessionSubmitPollerExecutable = os.Executable
+)
 
 func ensureSessionSubmitPoller(cityPath, agentName, sessionName string) error {
 	pidPath := sessionSubmitPollerPIDPath(cityPath, sessionName)
@@ -458,10 +469,13 @@ func ensureSessionSubmitPoller(cityPath, agentName, sessionName string) error {
 		if running, _ := existingSessionSubmitPollerPID(pidPath); running {
 			return nil
 		}
-		exe, err := os.Executable()
+		exe, err := sessionSubmitPollerExecutable()
 		if err != nil {
 			return err
 		}
+		if isGoTestExecutable(exe) {
+			return fmt.Errorf("refusing to start nudge poller with Go test binary %q", exe)
+		}
 		cmd := exec.Command(exe, "nudge", "poll", "--city", cityPath, "--session", sessionName, agentName)
 		cmd.Env = os.Environ()
 		logFile, err := os.OpenFile(sessionSubmitPollerLogPath(cityPath, sessionName), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
@@ -484,6 +498,10 @@ func ensureSessionSubmitPoller(cityPath, agentName, sessionName string) error {
 	})
 }
 
+func isGoTestExecutable(path string) bool {
+	return strings.HasSuffix(filepath.Base(path), ".test")
+}
+
 func sessionSubmitPollerPIDPath(cityPath, sessionName string) string {
 	return citylayout.RuntimePath(cityPath, "nudges", "pollers", sessionName+".pid")
 }
diff --git a/internal/session/submit_test.go b/internal/session/submit_test.go
index b4416189d0..3e932376c9 100644
--- a/internal/session/submit_test.go
+++ b/internal/session/submit_test.go
@@ -2,7 +2,11 @@ package session
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/gastownhall/gascity/internal/beads"
@@ -396,6 +400,31 @@ func TestSubmitFollowUpQueuesDeferredMessageAndStartsCodexPoller(t *testing.T) {
 	}
 }
 
+func TestEnsureSessionSubmitPollerRejectsGoTestExecutable(t *testing.T) {
+	cityPath := t.TempDir()
+	exe := filepath.Join(t.TempDir(), "session.test")
+	if err := os.WriteFile(exe, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("WriteFile(test executable): %v", err)
+	}
+
+	origExecutable := sessionSubmitPollerExecutable
+	sessionSubmitPollerExecutable = func() (string, error) {
+		return exe, nil
+	}
+	defer func() { sessionSubmitPollerExecutable = origExecutable }()
+
+	err := ensureSessionSubmitPoller(cityPath, "agent", "s-test")
+	if err == nil || !strings.Contains(err.Error(), "Go test binary") {
+		t.Fatalf("ensureSessionSubmitPoller error = %v, want Go test binary refusal", err)
+	}
+	if _, statErr := os.Stat(sessionSubmitPollerPIDPath(cityPath, "s-test")); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("poller pid file stat error = %v, want not exist", statErr)
+	}
+	if _, statErr := os.Stat(sessionSubmitPollerLogPath(cityPath, "s-test")); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("poller log file stat error = %v, want not exist", statErr)
+	}
+}
+
 func TestSubmitFollowUpQueuesDeferredMessageForPoolManagedSession(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
@@ -520,6 +549,54 @@ func TestSubmitFollowUpOnAsleepSessionFallsBackToImmediateSend(t *testing.T) {
 	}
 }
 
+func TestSubmitDefaultQueuesWhenWakeAlreadyRequested(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	cityPath := t.TempDir()
+	mgr := NewManagerWithCityPath(store, sp, cityPath)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "claude", t.TempDir(), "claude", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if err := sp.Stop(info.SessionName); err != nil {
+		t.Fatalf("Stop: %v", err)
+	}
+	if err := store.SetMetadataBatch(info.ID, map[string]string{
+		"state":                string(StateCreating),
+		"pending_create_claim": "true",
+	}); err != nil {
+		t.Fatalf("SetMetadataBatch: %v", err)
+	}
+	callsBefore := len(sp.Calls)
+
+	outcome, err := mgr.Submit(context.Background(), info.ID, "deliver after wake", BuildResumeCommand(info), runtime.Config{WorkDir: info.WorkDir}, SubmitIntentDefault)
+	if err != nil {
+		t.Fatalf("Submit(default): %v", err)
+	}
+	if !outcome.Queued {
+		t.Fatal("Submit(default) should queue while wake is already requested")
+	}
+	state, err := nudgequeue.LoadState(cityPath)
+	if err != nil {
+		t.Fatalf("LoadState: %v", err)
+	}
+	if len(state.Pending) != 1 {
+		t.Fatalf("pending queued submits = %d, want 1", len(state.Pending))
+	}
+	if state.Pending[0].SessionID != info.ID {
+		t.Fatalf("SessionID = %q, want %q", state.Pending[0].SessionID, info.ID)
+	}
+	if state.Pending[0].Message != "deliver after wake" {
+		t.Fatalf("Message = %q, want deliver after wake", state.Pending[0].Message)
+	}
+	for _, call := range sp.Calls[callsBefore:] {
+		if call.Method == "Start" || call.Method == "Nudge" || call.Method == "NudgeNow" {
+			t.Fatalf("unexpected runtime call while queueing against requested wake: %#v", call)
+		}
+	}
+}
+
 func TestSubmissionCapabilitiesFollowUpUnsupportedForACP(t *testing.T) {
 	caps := SubmissionCapabilitiesForMetadata(
 		map[string]string{
diff --git a/internal/session/waits.go b/internal/session/waits.go
index 84277efa68..a7d5682c70 100644
--- a/internal/session/waits.go
+++ b/internal/session/waits.go
@@ -180,10 +180,16 @@ func WakeSession(store beads.Store, sessionBead beads.Bead, now time.Time) ([]st
 	if err := CancelWaits(store, sessionBead.ID, now); err != nil {
 		return nil, err
 	}
-	batch := ClearWakeBlockersPatch(State(strings.TrimSpace(sessionBead.Metadata["state"])), sessionBead.Metadata["sleep_reason"])
+	state := State(strings.TrimSpace(sessionBead.Metadata["state"]))
+	batch := ClearWakeBlockersPatch(state, sessionBead.Metadata["sleep_reason"])
+	if state == StateSuspended || state == StateDrained {
+		for k, v := range RequestWakePatch(string(WakeCauseExplicit), now) {
+			batch[k] = v
+		}
+	}
 	if view.BaseState == BaseStateArchived && view.ContinuityEligible {
 		// RequestWakePatch clears wake blockers before claiming the start.
-		batch = RequestWakePatch(string(WakeCauseExplicit))
+		batch = RequestWakePatch(string(WakeCauseExplicit), now)
 		batch["archived_at"] = ""
 		batch["continuity_eligible"] = "true"
 	}
diff --git a/internal/session/waits_test.go b/internal/session/waits_test.go
index 50ca892231..21016fa5a2 100644
--- a/internal/session/waits_test.go
+++ b/internal/session/waits_test.go
@@ -71,6 +71,51 @@ func TestCancelWaits_CancelsLegacyWaitBeadsWithoutLegacyTypeQuery(t *testing.T)
 	}
 }
 
+func TestWakeSessionRequestsStartForSuspendedBead(t *testing.T) {
+	store := beads.NewMemStore()
+	now := time.Date(2026, 5, 3, 8, 30, 0, 0, time.UTC)
+	sessionBead, err := store.Create(beads.Bead{
+		Type:   BeadType,
+		Labels: []string{LabelSession},
+		Metadata: map[string]string{
+			"state":        string(StateSuspended),
+			"state_reason": "user-hold",
+			"held_until":   time.Now().Add(time.Hour).UTC().Format(time.RFC3339),
+			"wait_hold":    "true",
+			"sleep_reason": "user-hold",
+		},
+	})
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+
+	if _, err := WakeSession(store, sessionBead, now); err != nil {
+		t.Fatalf("WakeSession: %v", err)
+	}
+
+	updated, err := store.Get(sessionBead.ID)
+	if err != nil {
+		t.Fatalf("Get(session): %v", err)
+	}
+	if got := updated.Metadata["state"]; got != string(StateCreating) {
+		t.Fatalf("state = %q, want creating", got)
+	}
+	if got := updated.Metadata["state_reason"]; got != string(WakeCauseExplicit) {
+		t.Fatalf("state_reason = %q, want explicit", got)
+	}
+	if got := updated.Metadata["pending_create_claim"]; got != "true" {
+		t.Fatalf("pending_create_claim = %q, want true", got)
+	}
+	if got, want := updated.Metadata["pending_create_started_at"], now.UTC().Format(time.RFC3339); got != want {
+		t.Fatalf("pending_create_started_at = %q, want %q", got, want)
+	}
+	for _, key := range []string{"held_until", "wait_hold", "sleep_reason"} {
+		if got := updated.Metadata[key]; got != "" {
+			t.Fatalf("%s = %q, want cleared", key, got)
+		}
+	}
+}
+
 func TestWakeSessionRejectsArchivedHistoricalBead(t *testing.T) {
 	store := beads.NewMemStore()
 	sessionBead, err := store.Create(beads.Bead{
@@ -119,6 +164,7 @@ func TestWakeSessionRejectsArchivedHistoricalBead(t *testing.T) {
 
 func TestWakeSessionRequestsStartForContinuityEligibleArchivedBead(t *testing.T) {
 	store := beads.NewMemStore()
+	now := time.Date(2026, 5, 3, 8, 45, 0, 0, time.UTC)
 	sessionBead, err := store.Create(beads.Bead{
 		Type:   BeadType,
 		Labels: []string{LabelSession},
@@ -150,7 +196,7 @@ func TestWakeSessionRequestsStartForContinuityEligibleArchivedBead(t *testing.T)
 		t.Fatalf("create wait: %v", err)
 	}
 
-	if _, err := WakeSession(store, sessionBead, time.Now().UTC()); err != nil {
+	if _, err := WakeSession(store, sessionBead, now); err != nil {
 		t.Fatalf("WakeSession: %v", err)
 	}
 
@@ -167,6 +213,9 @@ func TestWakeSessionRequestsStartForContinuityEligibleArchivedBead(t *testing.T)
 	if got := updated.Metadata["pending_create_claim"]; got != "true" {
 		t.Fatalf("pending_create_claim = %q, want true", got)
 	}
+	if got, want := updated.Metadata["pending_create_started_at"], now.UTC().Format(time.RFC3339); got != want {
+		t.Fatalf("pending_create_started_at = %q, want %q", got, want)
+	}
 	for _, key := range []string{"held_until", "quarantined_until", "wait_hold", "sleep_intent", "sleep_reason", "archived_at"} {
 		if got := updated.Metadata[key]; got != "" {
 			t.Fatalf("%s = %q, want cleared", key, got)
diff --git a/internal/sessionlog/opencode_reader.go b/internal/sessionlog/opencode_reader.go
new file mode 100644
index 0000000000..63fd3e1df2
--- /dev/null
+++ b/internal/sessionlog/opencode_reader.go
@@ -0,0 +1,413 @@
+package sessionlog
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+// ReadOpenCodeFile reads an OpenCode session export JSON file and converts it
+// to the standard Session format used by gc session logs.
+func ReadOpenCodeFile(path string, tailCompactions int) (*Session, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var export openCodeExport
+	if err := json.Unmarshal(data, &export); err != nil {
+		return nil, err
+	}
+
+	sessionID := strings.TrimSpace(export.Info.ID)
+	if sessionID == "" {
+		sessionID = openCodeSessionID(path)
+	}
+
+	messages := make([]*Entry, 0, len(export.Messages))
+	orphanedToolUseIDs := make(map[string]bool)
+	var lastID string
+	for idx, rawMessage := range export.Messages {
+		entry := convertOpenCodeMessage(rawMessage, sessionID, idx, orphanedToolUseIDs)
+		if entry == nil {
+			continue
+		}
+		if entry.ParentUUID == "" {
+			entry.ParentUUID = lastID
+		}
+		lastID = entry.UUID
+		messages = append(messages, entry)
+	}
+
+	sess := &Session{
+		ID:                 sessionID,
+		Messages:           messages,
+		OrphanedToolUseIDs: orphanedToolUseIDs,
+	}
+	if len(sess.OrphanedToolUseIDs) == 0 {
+		sess.OrphanedToolUseIDs = nil
+	}
+	if tailCompactions > 0 {
+		paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "", "")
+		sess.Messages = paginated
+		sess.Pagination = info
+	}
+	return sess, nil
+}
+
+// FindOpenCodeSessionFile searches OpenCode JSON export directories for the
+// most recently modified export whose embedded info.directory matches workDir.
+func FindOpenCodeSessionFile(searchPaths []string, workDir string) string {
+	workDir = cleanOpenCodeWorkDir(workDir)
+	if workDir == "" {
+		return ""
+	}
+
+	var (
+		bestPath string
+		bestTime time.Time
+	)
+	for _, root := range mergeOpenCodeSearchPaths(searchPaths) {
+		path := findOpenCodeSessionFileIn(root, workDir)
+		if path == "" {
+			continue
+		}
+		info, err := os.Stat(path)
+		if err != nil {
+			continue
+		}
+		if bestPath == "" || info.ModTime().After(bestTime) {
+			bestPath = path
+			bestTime = info.ModTime()
+		}
+	}
+	return bestPath
+}
+
+func findOpenCodeSessionFileIn(root, workDir string) string {
+	info, err := os.Stat(root)
+	if err != nil || !info.IsDir() {
+		return ""
+	}
+
+	type candidate struct {
+		path    string
+		modTime time.Time
+	}
+	var candidates []candidate
+	err = filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return nil
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		if !strings.HasSuffix(strings.ToLower(entry.Name()), ".json") {
+			return nil
+		}
+		if cleanOpenCodeWorkDir(openCodeExportDirectory(path)) != workDir {
+			return nil
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return nil
+		}
+		candidates = append(candidates, candidate{path: path, modTime: info.ModTime()})
+		return nil
+	})
+	if err != nil {
+		return ""
+	}
+
+	sort.Slice(candidates, func(i, j int) bool {
+		return candidates[i].modTime.After(candidates[j].modTime)
+	})
+	if len(candidates) == 0 {
+		return ""
+	}
+	return candidates[0].path
+}
+
+func convertOpenCodeMessage(rawMessage json.RawMessage, sessionID string, idx int, orphanedToolUseIDs map[string]bool) *Entry {
+	var message openCodeMessage
+	if err := json.Unmarshal(rawMessage, &message); err != nil {
+		return nil
+	}
+
+	role := strings.TrimSpace(message.Info.Role)
+	if role == "" {
+		role = "assistant"
+	}
+	if role == "developer" {
+		return nil
+	}
+
+	uuid := strings.TrimSpace(message.Info.ID)
+	if uuid == "" {
+		uuid = fmt.Sprintf("opencode-%d", idx)
+	}
+	ts := time.Time{}
+	if message.Info.Time.Created > 0 {
+		ts = time.UnixMilli(message.Info.Time.Created)
+	}
+
+	blocks := openCodeMessageBlocks(message.Parts, orphanedToolUseIDs)
+	entry := &Entry{
+		UUID:       uuid,
+		ParentUUID: strings.TrimSpace(message.Info.ParentID),
+		Type:       role,
+		Timestamp:  ts,
+		SessionID:  firstNonEmpty(message.Info.SessionID, sessionID),
+		Raw:        cloneRawJSON(rawMessage),
+	}
+	if len(blocks) == 1 && blocks[0].Type == "text" {
+		entry.Message = mustMarshal(MessageContent{Role: role, Content: mustMarshal(blocks[0].Text)})
+		return entry
+	}
+	entry.Message = mustMarshal(MessageContent{Role: role, Content: mustMarshal(blocks)})
+	return entry
+}
+
+func openCodeMessageBlocks(parts []openCodePart, orphanedToolUseIDs map[string]bool) []ContentBlock {
+	blocks := make([]ContentBlock, 0, len(parts))
+	for _, part := range parts {
+		switch strings.ToLower(strings.TrimSpace(part.Type)) {
+		case "text":
+			text := strings.TrimSpace(part.Text)
+			if text != "" {
+				blocks = append(blocks, ContentBlock{Type: "text", Text: text})
+			}
+		case "reasoning":
+			text := strings.TrimSpace(firstNonEmpty(part.Text, part.Summary))
+			if text != "" {
+				blocks = append(blocks, ContentBlock{Type: "thinking", Text: text})
+			}
+		case "tool":
+			blocks = append(blocks, openCodeToolBlocks(part, orphanedToolUseIDs)...)
+		case "interaction":
+			blocks = append(blocks, openCodeInteractionBlock(part))
+		}
+		if interaction, ok := openCodePartMetadataInteraction(part.Metadata); ok {
+			blocks = append(blocks, interaction)
+		}
+	}
+	if len(blocks) == 0 {
+		return []ContentBlock{{Type: "text"}}
+	}
+	return blocks
+}
+
+func openCodeToolBlocks(part openCodePart, orphanedToolUseIDs map[string]bool) []ContentBlock {
+	callID := firstNonEmpty(part.CallID, part.ID)
+	toolName := strings.TrimSpace(part.Tool)
+	state := decodeOpenCodeToolState(part.State)
+	status := strings.ToLower(strings.TrimSpace(state.Status))
+	input := cloneRawJSON(state.Input)
+	if len(input) == 0 {
+		input = cloneRawJSON(part.Input)
+	}
+
+	blocks := []ContentBlock{{
+		Type:  "tool_use",
+		ID:    callID,
+		Name:  toolName,
+		Input: input,
+	}}
+	if callID != "" {
+		orphanedToolUseIDs[callID] = true
+	}
+	if status == "completed" || status == "error" || status == "failed" {
+		result := ContentBlock{
+			Type:      "tool_result",
+			ToolUseID: callID,
+			Content:   openCodeToolResultContent(state),
+			IsError:   status == "error" || status == "failed",
+		}
+		blocks = append(blocks, result)
+		if callID != "" {
+			delete(orphanedToolUseIDs, callID)
+		}
+	}
+	return blocks
+}
+
+func openCodeToolResultContent(state openCodeToolState) json.RawMessage {
+	if len(state.Output) != 0 {
+		return cloneRawJSON(state.Output)
+	}
+	if len(state.Error) != 0 {
+		return cloneRawJSON(state.Error)
+	}
+	return nil
+}
+
+func openCodeInteractionBlock(part openCodePart) ContentBlock {
+	return ContentBlock{
+		Type:      "interaction",
+		RequestID: firstNonEmpty(part.RequestID, part.ID, part.CallID),
+		Kind:      strings.TrimSpace(part.Kind),
+		State:     openCodeStateText(part.State),
+		Text:      strings.TrimSpace(part.Text),
+		Prompt:    strings.TrimSpace(part.Prompt),
+		Options:   append([]string(nil), part.Options...),
+		Action:    strings.TrimSpace(part.Action),
+		Metadata:  cloneRawJSON(part.Metadata),
+	}
+}
+
+func decodeOpenCodeToolState(raw json.RawMessage) openCodeToolState {
+	var state openCodeToolState
+	if len(raw) == 0 {
+		return state
+	}
+	_ = json.Unmarshal(raw, &state)
+	return state
+}
+
+func openCodeStateText(raw json.RawMessage) string {
+	if len(raw) == 0 {
+		return ""
+	}
+	var text string
+	if err := json.Unmarshal(raw, &text); err == nil {
+		return strings.TrimSpace(text)
+	}
+	var state struct {
+		Status string `json:"status"`
+	}
+	if err := json.Unmarshal(raw, &state); err == nil {
+		return strings.TrimSpace(state.Status)
+	}
+	return ""
+}
+
+func openCodePartMetadataInteraction(raw json.RawMessage) (ContentBlock, bool) {
+	if len(raw) == 0 {
+		return ContentBlock{}, false
+	}
+	var wrapper struct {
+		Interaction *struct {
+			RequestID string          `json:"request_id"`
+			ID        string          `json:"id"`
+			Kind      string          `json:"kind"`
+			State     string          `json:"state"`
+			Text      string          `json:"text"`
+			Prompt    string          `json:"prompt"`
+			Options   []string        `json:"options"`
+			Action    string          `json:"action"`
+			Metadata  json.RawMessage `json:"metadata"`
+		} `json:"interaction"`
+	}
+	if err := json.Unmarshal(raw, &wrapper); err != nil || wrapper.Interaction == nil {
+		return ContentBlock{}, false
+	}
+	interaction := wrapper.Interaction
+	return ContentBlock{
+		Type:      "interaction",
+		RequestID: firstNonEmpty(interaction.RequestID, interaction.ID),
+		Kind:      strings.TrimSpace(interaction.Kind),
+		State:     strings.TrimSpace(interaction.State),
+		Text:      strings.TrimSpace(interaction.Text),
+		Prompt:    strings.TrimSpace(interaction.Prompt),
+		Options:   append([]string(nil), interaction.Options...),
+		Action:    strings.TrimSpace(interaction.Action),
+		Metadata:  cloneRawJSON(interaction.Metadata),
+	}, true
+}
+
+func openCodeExportDirectory(path string) string {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	var export struct {
+		Info struct {
+			Directory string `json:"directory"`
+		} `json:"info"`
+	}
+	if err := json.Unmarshal(data, &export); err != nil {
+		return ""
+	}
+	return export.Info.Directory
+}
+
+func cleanOpenCodeWorkDir(path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return ""
+	}
+	return filepath.Clean(path)
+}
+
+func openCodeSessionID(path string) string {
+	base := filepath.Base(path)
+	if ext := filepath.Ext(base); ext != "" {
+		base = base[:len(base)-len(ext)]
+	}
+	return base
+}
+
+func mergeOpenCodeSearchPaths(extraPaths []string) []string {
+	return mergePaths(DefaultOpenCodeSearchPaths(), extraPaths)
+}
+
+// DefaultOpenCodeSearchPaths returns Gas City's default OpenCode transcript
+// mirror directory.
+func DefaultOpenCodeSearchPaths() []string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return nil
+	}
+	return []string{filepath.Join(home, ".local", "share", "gascity", "opencode-transcripts")}
+}
+
+type openCodeExport struct {
+	Info struct {
+		ID        string `json:"id"`
+		Directory string `json:"directory"`
+	} `json:"info"`
+	Messages []json.RawMessage `json:"messages"`
+}
+
+type openCodeMessage struct {
+	Info  openCodeMessageInfo `json:"info"`
+	Parts []openCodePart      `json:"parts"`
+}
+
+type openCodeMessageInfo struct {
+	ID        string `json:"id"`
+	SessionID string `json:"sessionID"`
+	Role      string `json:"role"`
+	ParentID  string `json:"parentID"`
+	Time      struct {
+		Created int64 `json:"created"`
+	} `json:"time"`
+}
+
+type openCodePart struct {
+	ID        string          `json:"id"`
+	Type      string          `json:"type"`
+	Text      string          `json:"text"`
+	Summary   string          `json:"summary"`
+	CallID    string          `json:"callID"`
+	Tool      string          `json:"tool"`
+	Input     json.RawMessage `json:"input"`
+	State     json.RawMessage `json:"state"`
+	RequestID string          `json:"request_id"`
+	Kind      string          `json:"kind"`
+	Prompt    string          `json:"prompt"`
+	Options   []string        `json:"options"`
+	Action    string          `json:"action"`
+	Metadata  json.RawMessage `json:"metadata"`
+}
+
+type openCodeToolState struct {
+	Status string          `json:"status"`
+	Input  json.RawMessage `json:"input"`
+	Output json.RawMessage `json:"output"`
+	Error  json.RawMessage `json:"error"`
+}
diff --git a/internal/sessionlog/opencode_reader_test.go b/internal/sessionlog/opencode_reader_test.go
new file mode 100644
index 0000000000..0d90ee5b3c
--- /dev/null
+++ b/internal/sessionlog/opencode_reader_test.go
@@ -0,0 +1,121 @@
+package sessionlog
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestReadOpenCodeFileNormalizesExportedMessages(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "session_export.json")
+	body := `{
+  "info": {
+    "id": "ses_opencode_phase1",
+    "directory": "/tmp/gascity/phase1/opencode"
+  },
+  "messages": [
+    {
+      "info": {"id":"msg_user_1","sessionID":"ses_opencode_phase1","role":"user","time":{"created":1770000000000},"agent":"build","model":{"providerID":"google","modelID":"gemini-2.5-flash"}},
+      "parts": [{"id":"part_user_1","sessionID":"ses_opencode_phase1","messageID":"msg_user_1","type":"text","text":"hello opencode"}]
+    },
+    {
+      "info": {"id":"msg_assistant_1","sessionID":"ses_opencode_phase1","role":"assistant","time":{"created":1770000001000},"parentID":"msg_user_1","providerID":"google","modelID":"gemini-2.5-flash","mode":"build","path":{"cwd":"/tmp/gascity/phase1/opencode","root":"/tmp/gascity/phase1/opencode"},"cost":0,"tokens":{"input":1,"output":1,"reasoning":0,"cache":{"read":0,"write":0}}},
+      "parts": [{"id":"part_assistant_1","sessionID":"ses_opencode_phase1","messageID":"msg_assistant_1","type":"text","text":"hello from Gemini through OpenCode"}]
+    }
+  ]
+}`
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatalf("write export fixture: %v", err)
+	}
+
+	sess, err := ReadOpenCodeFile(path, 0)
+	if err != nil {
+		t.Fatalf("ReadOpenCodeFile: %v", err)
+	}
+	if sess.ID != "ses_opencode_phase1" {
+		t.Fatalf("ID = %q, want ses_opencode_phase1", sess.ID)
+	}
+	if len(sess.Messages) != 2 {
+		t.Fatalf("messages = %d, want 2", len(sess.Messages))
+	}
+	if got := sess.Messages[0].TextContent(); got != "hello opencode" {
+		t.Fatalf("user text = %q", got)
+	}
+	if got := sess.Messages[1].TextContent(); got != "hello from Gemini through OpenCode" {
+		t.Fatalf("assistant text = %q", got)
+	}
+}
+
+func TestReadOpenCodeFileNormalizesTools(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "session_export.json")
+	body := `{
+  "info": {"id": "ses_tool", "directory": "/tmp/gascity/phase2/opencode"},
+  "messages": [
+    {
+      "info": {"id":"msg_user_1","sessionID":"ses_tool","role":"user","time":{"created":1770000000000},"agent":"build","model":{"providerID":"google","modelID":"gemini-2.5-flash"}},
+      "parts": [{"id":"part_user_1","sessionID":"ses_tool","messageID":"msg_user_1","type":"text","text":"read the file"}]
+    },
+    {
+      "info": {"id":"msg_assistant_1","sessionID":"ses_tool","role":"assistant","time":{"created":1770000001000},"parentID":"msg_user_1","providerID":"google","modelID":"gemini-2.5-flash","mode":"build","path":{"cwd":"/tmp/gascity/phase2/opencode","root":"/tmp/gascity/phase2/opencode"},"cost":0,"tokens":{"input":1,"output":1,"reasoning":0,"cache":{"read":0,"write":0}}},
+      "parts": [{"id":"part_tool_1","sessionID":"ses_tool","messageID":"msg_assistant_1","type":"tool","callID":"call-1","tool":"Read","state":{"status":"completed","input":{"path":"README.md"},"output":"file data","title":"Read README.md","metadata":{},"time":{"start":1770000001000,"end":1770000002000}}}]
+    }
+  ]
+}`
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatalf("write export fixture: %v", err)
+	}
+
+	sess, err := ReadOpenCodeFile(path, 0)
+	if err != nil {
+		t.Fatalf("ReadOpenCodeFile: %v", err)
+	}
+	if len(sess.Messages) != 2 {
+		t.Fatalf("messages = %d, want 2", len(sess.Messages))
+	}
+	blocks := sess.Messages[1].ContentBlocks()
+	if len(blocks) != 2 {
+		t.Fatalf("tool blocks = %d, want 2", len(blocks))
+	}
+	if blocks[0].Type != "tool_use" || blocks[0].Name != "Read" || blocks[0].ID != "call-1" {
+		t.Fatalf("tool_use block = %#v", blocks[0])
+	}
+	if blocks[1].Type != "tool_result" || blocks[1].ToolUseID != "call-1" {
+		t.Fatalf("tool_result block = %#v", blocks[1])
+	}
+	if len(sess.OrphanedToolUseIDs) != 0 {
+		t.Fatalf("OrphanedToolUseIDs = %#v, want none", sess.OrphanedToolUseIDs)
+	}
+}
+
+func TestFindOpenCodeSessionFileMatchesExportDirectory(t *testing.T) {
+	root := t.TempDir()
+	workDir := filepath.Join(t.TempDir(), "project")
+	if err := os.MkdirAll(filepath.Join(root, "nested"), 0o755); err != nil {
+		t.Fatalf("mkdir nested: %v", err)
+	}
+	oldPath := filepath.Join(root, "old.json")
+	newPath := filepath.Join(root, "nested", "new.json")
+	for _, item := range []struct {
+		path string
+		id   string
+	}{
+		{oldPath, "old"},
+		{newPath, "new"},
+	} {
+		body := `{"info":{"id":"` + item.id + `","directory":"` + filepath.ToSlash(workDir) + `"},"messages":[]}`
+		if err := os.WriteFile(item.path, []byte(body), 0o644); err != nil {
+			t.Fatalf("write %s: %v", item.path, err)
+		}
+	}
+
+	future := time.Now().Add(time.Hour)
+	if err := os.Chtimes(newPath, future, future); err != nil {
+		t.Fatalf("chtimes: %v", err)
+	}
+
+	got := FindOpenCodeSessionFile([]string{root}, workDir)
+	if got != newPath {
+		t.Fatalf("FindOpenCodeSessionFile() = %q, want %q", got, newPath)
+	}
+}
diff --git a/internal/sessionlog/reader.go b/internal/sessionlog/reader.go
index 0d8fbfbe0d..ae570119f5 100644
--- a/internal/sessionlog/reader.go
+++ b/internal/sessionlog/reader.go
@@ -140,7 +140,7 @@ func ReadFile(path string, tailCompactions int) (*Session, error) {
 
 	// Apply compact-boundary pagination.
 	if tailCompactions > 0 {
-		paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "")
+		paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "", "")
 		sess.Messages = paginated
 		sess.Pagination = info
 	}
@@ -155,6 +155,8 @@ func ReadProviderFile(provider, path string, tailCompactions int) (*Session, err
 		return ReadCodexFile(path, tailCompactions)
 	case "gemini":
 		return ReadGeminiFile(path, tailCompactions)
+	case "opencode":
+		return ReadOpenCodeFile(path, tailCompactions)
 	default:
 		return ReadFile(path, tailCompactions)
 	}
@@ -184,7 +186,7 @@ func ReadFileRaw(path string, tailCompactions int) (*Session, error) {
 	}
 
 	if tailCompactions > 0 {
-		paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "")
+		paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "", "")
 		sess.Messages = paginated
 		sess.Pagination = info
 	}
@@ -202,6 +204,8 @@ func ReadProviderFileRaw(provider, path string, tailCompactions int) (*Session,
 		return ReadCodexFile(path, tailCompactions)
 	case "gemini":
 		return ReadGeminiFile(path, tailCompactions)
+	case "opencode":
+		return ReadOpenCodeFile(path, tailCompactions)
 	default:
 		return ReadFileRaw(path, tailCompactions)
 	}
@@ -227,7 +231,7 @@ func ReadFileOlder(path string, tailCompactions int, beforeMessageID string) (*S
 	base := filepath.Base(path)
 	sessionID := strings.TrimSuffix(base, filepath.Ext(base))
 
-	paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, beforeMessageID)
+	paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, beforeMessageID, "")
 
 	return &Session{
 		ID:                 sessionID,
@@ -252,7 +256,7 @@ func ReadFileRawOlder(path string, tailCompactions int, beforeMessageID string)
 	base := filepath.Base(path)
 	sessionID := strings.TrimSuffix(base, filepath.Ext(base))
 
-	paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, beforeMessageID)
+	paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, beforeMessageID, "")
 
 	return &Session{
 		ID:                 sessionID,
@@ -273,6 +277,8 @@ func ReadProviderFileOlder(provider, path string, tailCompactions int, beforeMes
 		return ReadCodexFile(path, tailCompactions)
 	case "gemini":
 		return ReadGeminiFile(path, tailCompactions)
+	case "opencode":
+		return ReadOpenCodeFile(path, tailCompactions)
 	default:
 		return ReadFileOlder(path, tailCompactions, beforeMessageID)
 	}
@@ -287,11 +293,101 @@ func ReadProviderFileRawOlder(provider, path string, tailCompactions int, before
 		return ReadCodexFile(path, tailCompactions)
 	case "gemini":
 		return ReadGeminiFile(path, tailCompactions)
+	case "opencode":
+		return ReadOpenCodeFile(path, tailCompactions)
 	default:
 		return ReadFileRawOlder(path, tailCompactions, beforeMessageID)
 	}
 }
 
+// ReadFileNewer loads newer messages after a cursor.
+func ReadFileNewer(path string, tailCompactions int, afterMessageID string) (*Session, error) {
+	entries, diagnostics, err := parseFileDetailed(path)
+	if err != nil {
+		return nil, err
+	}
+
+	dag := BuildDag(entries)
+
+	var messages []*Entry
+	for _, e := range dag.ActiveBranch {
+		if displayTypes[e.Type] {
+			messages = append(messages, e)
+		}
+	}
+
+	base := filepath.Base(path)
+	sessionID := strings.TrimSuffix(base, filepath.Ext(base))
+
+	paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "", afterMessageID)
+
+	return &Session{
+		ID:                 sessionID,
+		Messages:           paginated,
+		OrphanedToolUseIDs: dag.OrphanedToolUseIDs,
+		HasBranches:        dag.HasBranches,
+		Pagination:         info,
+		Diagnostics:        diagnostics,
+	}, nil
+}
+
+// ReadFileRawNewer loads newer raw (unfiltered) messages after a cursor.
+func ReadFileRawNewer(path string, tailCompactions int, afterMessageID string) (*Session, error) {
+	entries, diagnostics, err := parseFileDetailed(path)
+	if err != nil {
+		return nil, err
+	}
+
+	dag := BuildDag(entries)
+	messages := dag.ActiveBranch
+
+	base := filepath.Base(path)
+	sessionID := strings.TrimSuffix(base, filepath.Ext(base))
+
+	paginated, info := sliceAtCompactBoundaries(messages, tailCompactions, "", afterMessageID)
+
+	return &Session{
+		ID:                 sessionID,
+		Messages:           paginated,
+		OrphanedToolUseIDs: dag.OrphanedToolUseIDs,
+		HasBranches:        dag.HasBranches,
+		Pagination:         info,
+		Diagnostics:        diagnostics,
+	}, nil
+}
+
+// ReadProviderFileNewer reads a newer page of a provider-specific transcript.
+// Codex sessions do not currently support message-ID pagination, so the full
+// provider transcript is returned.
+func ReadProviderFileNewer(provider, path string, tailCompactions int, afterMessageID string) (*Session, error) {
+	switch providerFamily(provider) {
+	case "codex":
+		return ReadCodexFile(path, tailCompactions)
+	case "gemini":
+		return ReadGeminiFile(path, tailCompactions)
+	case "opencode":
+		return ReadOpenCodeFile(path, tailCompactions)
+	default:
+		return ReadFileNewer(path, tailCompactions, afterMessageID)
+	}
+}
+
+// ReadProviderFileRawNewer reads a newer page of a provider-specific raw
+// transcript. Codex sessions do not currently support message-ID pagination, so
+// the full provider transcript is returned.
+func ReadProviderFileRawNewer(provider, path string, tailCompactions int, afterMessageID string) (*Session, error) {
+	switch providerFamily(provider) {
+	case "codex":
+		return ReadCodexFile(path, tailCompactions)
+	case "gemini":
+		return ReadGeminiFile(path, tailCompactions)
+	case "opencode":
+		return ReadOpenCodeFile(path, tailCompactions)
+	default:
+		return ReadFileRawNewer(path, tailCompactions, afterMessageID)
+	}
+}
+
 // parseFile reads all JSONL lines from a file into entries.
 func parseFile(path string) ([]*Entry, error) {
 	entries, _, err := parseFileDetailed(path)
@@ -345,7 +441,7 @@ func parseFileDetailed(path string) ([]*Entry, SessionDiagnostics, error) {
 // sliceAtCompactBoundaries returns the tail portion of messages starting
 // from the Nth-from-last compact boundary. The boundary itself is
 // included so consumers can render a "Context compacted" divider.
-func sliceAtCompactBoundaries(messages []*Entry, tailCompactions int, beforeMessageID string) ([]*Entry, *PaginationInfo) {
+func sliceAtCompactBoundaries(messages []*Entry, tailCompactions int, beforeMessageID, afterMessageID string) ([]*Entry, *PaginationInfo) {
 	totalCount := len(messages)
 
 	// For "load older" requests: truncate at cursor first.
@@ -359,6 +455,16 @@ func sliceAtCompactBoundaries(messages []*Entry, tailCompactions int, beforeMess
 		}
 	}
 
+	// For "load newer" requests: truncate at cursor, keeping entries after it.
+	if afterMessageID != "" {
+		for i, m := range working {
+			if m.UUID == afterMessageID {
+				working = working[i+1:]
+				break
+			}
+		}
+	}
+
 	// Guard: tailCompactions <= 0 means "return the working set as-is".
 	if tailCompactions <= 0 {
 		return working, &PaginationInfo{
@@ -427,8 +533,12 @@ func FindSessionFileForProvider(searchPaths []string, provider, workDir string)
 		return FindCodexSessionFile(searchPaths, workDir)
 	case "gemini":
 		return FindGeminiSessionFile(searchPaths, workDir)
-	default:
+	case "opencode":
+		return FindOpenCodeSessionFile(searchPaths, workDir)
+	case "", "auto":
 		return FindSessionFile(searchPaths, workDir)
+	default:
+		return findSlugSessionFile(searchPaths, workDir)
 	}
 }
 
@@ -442,6 +552,8 @@ func FindProviderFallbackSessionFile(searchPaths []string, provider, workDir str
 		return FindCodexSessionFile(searchPaths, workDir)
 	case "gemini":
 		return FindGeminiSessionFile(searchPaths, workDir)
+	case "opencode":
+		return FindOpenCodeSessionFile(searchPaths, workDir)
 	default:
 		return findClaudeLatestSessionFile(searchPaths, workDir)
 	}
@@ -815,6 +927,8 @@ func providerFamily(provider string) string {
 		return "codex"
 	case strings.Contains(p, "gemini"):
 		return "gemini"
+	case strings.Contains(p, "opencode"):
+		return "opencode"
 	default:
 		return p
 	}
diff --git a/internal/sessionlog/sessionlog_test.go b/internal/sessionlog/sessionlog_test.go
index 5fe1a773fe..597b187dcb 100644
--- a/internal/sessionlog/sessionlog_test.go
+++ b/internal/sessionlog/sessionlog_test.go
@@ -489,7 +489,7 @@ func TestReadFileOlderDiagnostics(t *testing.T) {
 
 func TestSliceAtCompactBoundariesNoBoundaries(t *testing.T) {
 	entries := makeEntries("a", "b", "c", "d")
-	sliced, info := sliceAtCompactBoundaries(entries, 1, "")
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "", "")
 	if len(sliced) != 4 {
 		t.Fatalf("got %d, want all 4 (no boundaries to slice at)", len(sliced))
 	}
@@ -512,7 +512,7 @@ func TestSliceAtCompactBoundariesOneBoundary(t *testing.T) {
 	}
 
 	// tailCompactions=1 with 2 boundaries → slice from the last boundary.
-	sliced, info := sliceAtCompactBoundaries(entries, 1, "")
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "", "")
 	if len(sliced) != 2 {
 		t.Fatalf("got %d, want 2 (from cb2 to end)", len(sliced))
 	}
@@ -538,7 +538,7 @@ func TestSliceAtCompactBoundariesReturnsAllWhenFewer(t *testing.T) {
 	}
 
 	// 1 boundary, tailCompactions=1 → len(boundaries) <= tailCompactions → return all.
-	sliced, info := sliceAtCompactBoundaries(entries, 1, "")
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "", "")
 	if len(sliced) != 3 {
 		t.Fatalf("got %d, want 3 (all entries returned when boundaries <= tailCompactions)", len(sliced))
 	}
@@ -562,7 +562,7 @@ func TestSliceAtCompactBoundariesMultiple(t *testing.T) {
 	}
 
 	// tailCompactions=2 → include from the 2nd-from-last boundary.
-	sliced, info := sliceAtCompactBoundaries(entries, 2, "")
+	sliced, info := sliceAtCompactBoundaries(entries, 2, "", "")
 	if len(sliced) != 4 {
 		t.Fatalf("got %d, want 4", len(sliced))
 	}
@@ -584,7 +584,7 @@ func TestSliceAtCompactBoundariesBeforeCursor(t *testing.T) {
 	}
 
 	// Load older messages before "cb2".
-	sliced, info := sliceAtCompactBoundaries(entries, 1, "cb2")
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "cb2", "")
 	// Working set is [a, cb1, b] — 1 boundary, tailCompactions=1 → return all.
 	if len(sliced) != 3 {
 		t.Fatalf("got %d, want 3 (all working set when boundaries <= tailCompactions)", len(sliced))
@@ -610,7 +610,7 @@ func TestSliceAtCompactBoundariesBeforeCursorWithSlicing(t *testing.T) {
 
 	// Load older before "cb3". Working set: [a, cb1, b, cb2, c].
 	// 2 boundaries in working set, tailCompactions=1 → slice from cb2.
-	sliced, info := sliceAtCompactBoundaries(entries, 1, "cb3")
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "cb3", "")
 	if len(sliced) != 2 {
 		t.Fatalf("got %d, want 2", len(sliced))
 	}
@@ -622,6 +622,79 @@ func TestSliceAtCompactBoundariesBeforeCursorWithSlicing(t *testing.T) {
 	}
 }
 
+func TestSliceAtCompactBoundariesAfterCursor(t *testing.T) {
+	entries := []*Entry{
+		{UUID: "a", Type: "user"},
+		{UUID: "cb1", Type: "system", Subtype: "compact_boundary"},
+		{UUID: "b", Type: "assistant"},
+		{UUID: "cb2", Type: "system", Subtype: "compact_boundary"},
+		{UUID: "c", Type: "user"},
+	}
+
+	// After "cb1" with tailCompactions=0 → returns [b, cb2, c].
+	sliced, info := sliceAtCompactBoundaries(entries, 0, "", "cb1")
+	if len(sliced) != 3 {
+		t.Fatalf("got %d, want 3 (entries after cb1)", len(sliced))
+	}
+	if sliced[0].UUID != "b" {
+		t.Errorf("first = %q, want %q", sliced[0].UUID, "b")
+	}
+	if info.ReturnedMessageCount != 3 {
+		t.Errorf("ReturnedMessageCount = %d, want 3", info.ReturnedMessageCount)
+	}
+}
+
+func TestSliceAtCompactBoundariesAfterCursorWithSlicing(t *testing.T) {
+	entries := []*Entry{
+		{UUID: "a", Type: "user"},
+		{UUID: "cb1", Type: "system", Subtype: "compact_boundary"},
+		{UUID: "b", Type: "assistant"},
+		{UUID: "cb2", Type: "system", Subtype: "compact_boundary"},
+		{UUID: "c", Type: "user"},
+		{UUID: "cb3", Type: "system", Subtype: "compact_boundary"},
+		{UUID: "d", Type: "assistant"},
+	}
+
+	// After "a" with tailCompactions=1 → working set is [cb1, b, cb2, c, cb3, d],
+	// then sliced from last boundary cb3 → [cb3, d].
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "", "a")
+	if len(sliced) != 2 {
+		t.Fatalf("got %d, want 2 (sliced from cb3)", len(sliced))
+	}
+	if sliced[0].UUID != "cb3" {
+		t.Errorf("first = %q, want %q", sliced[0].UUID, "cb3")
+	}
+	if !info.HasOlderMessages {
+		t.Error("expected HasOlderMessages after compaction slicing")
+	}
+}
+
+func TestSliceAtCompactBoundariesAfterCursorLastEntry(t *testing.T) {
+	entries := makeEntries("a", "b", "c")
+
+	// After last entry → empty slice.
+	sliced, info := sliceAtCompactBoundaries(entries, 0, "", "c")
+	if len(sliced) != 0 {
+		t.Fatalf("got %d, want 0 (cursor at last entry)", len(sliced))
+	}
+	if info.ReturnedMessageCount != 0 {
+		t.Errorf("ReturnedMessageCount = %d, want 0", info.ReturnedMessageCount)
+	}
+}
+
+func TestSliceAtCompactBoundariesAfterCursorNotFound(t *testing.T) {
+	entries := makeEntries("a", "b", "c")
+
+	// After nonexistent UUID → full set returned.
+	sliced, info := sliceAtCompactBoundaries(entries, 0, "", "z")
+	if len(sliced) != 3 {
+		t.Fatalf("got %d, want 3 (cursor not found = full set)", len(sliced))
+	}
+	if info.ReturnedMessageCount != 3 {
+		t.Errorf("ReturnedMessageCount = %d, want 3", info.ReturnedMessageCount)
+	}
+}
+
 // --- FindSessionFile tests ---
 
 func TestFindSessionFile(t *testing.T) {
@@ -1091,6 +1164,59 @@ func TestReadFileOlder(t *testing.T) {
 	}
 }
 
+func TestReadFileNewer(t *testing.T) {
+	path := writeJSONL(t,
+		`{"uuid":"a","parentUuid":"","type":"user","timestamp":"2025-01-01T00:00:00Z"}`,
+		`{"uuid":"b","parentUuid":"a","type":"assistant","timestamp":"2025-01-01T00:00:01Z"}`,
+		`{"uuid":"cb1","parentUuid":"b","type":"system","subtype":"compact_boundary","timestamp":"2025-01-01T00:00:02Z"}`,
+		`{"uuid":"c","parentUuid":"cb1","type":"user","timestamp":"2025-01-01T00:00:03Z"}`,
+		`{"uuid":"cb2","parentUuid":"c","type":"system","subtype":"compact_boundary","timestamp":"2025-01-01T00:00:04Z"}`,
+		`{"uuid":"d","parentUuid":"cb2","type":"assistant","timestamp":"2025-01-01T00:00:05Z"}`,
+	)
+	sess, err := ReadFileNewer(path, 0, "b")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Should return display-type entries after "b": c and d (cb1/cb2 are system).
+	for _, m := range sess.Messages {
+		if m.UUID == "a" || m.UUID == "b" {
+			t.Errorf("should not contain entry %q (before or at cursor)", m.UUID)
+		}
+	}
+	found := false
+	for _, m := range sess.Messages {
+		if m.UUID == "d" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("expected entry d in newer messages")
+	}
+}
+
+func TestReadFileRawNewer(t *testing.T) {
+	path := writeJSONL(t,
+		`{"uuid":"a","parentUuid":"","type":"user","timestamp":"2025-01-01T00:00:00Z"}`,
+		`{"uuid":"b","parentUuid":"a","type":"assistant","timestamp":"2025-01-01T00:00:01Z"}`,
+		`{"uuid":"cb1","parentUuid":"b","type":"system","subtype":"compact_boundary","timestamp":"2025-01-01T00:00:02Z"}`,
+		`{"uuid":"c","parentUuid":"cb1","type":"user","timestamp":"2025-01-01T00:00:03Z"}`,
+		`{"uuid":"d","parentUuid":"c","type":"assistant","timestamp":"2025-01-01T00:00:05Z"}`,
+	)
+	sess, err := ReadFileRawNewer(path, 0, "b")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Raw includes all types (including system). After "b": cb1, c, d.
+	if len(sess.Messages) != 3 {
+		t.Fatalf("got %d messages, want 3 (cb1, c, d after cursor b)", len(sess.Messages))
+	}
+	for _, m := range sess.Messages {
+		if m.UUID == "a" || m.UUID == "b" {
+			t.Errorf("should not contain entry %q (before or at cursor)", m.UUID)
+		}
+	}
+}
+
 // --- Edge case tests (from review findings) ---
 
 func TestSliceAtCompactBoundariesCursorAtFirstMessage(t *testing.T) {
@@ -1100,7 +1226,7 @@ func TestSliceAtCompactBoundariesCursorAtFirstMessage(t *testing.T) {
 		{UUID: "c", Type: "user"},
 	}
 	// Cursor at first message → should return empty working set.
-	sliced, info := sliceAtCompactBoundaries(entries, 1, "a")
+	sliced, info := sliceAtCompactBoundaries(entries, 1, "a", "")
 	if len(sliced) != 0 {
 		t.Fatalf("got %d, want 0 (cursor at first message = no older messages)", len(sliced))
 	}
@@ -1116,7 +1242,7 @@ func TestSliceAtCompactBoundariesTailCompactionsZero(t *testing.T) {
 		{UUID: "b", Type: "assistant"},
 	}
 	// tailCompactions=0 should return everything (no panic).
-	sliced, info := sliceAtCompactBoundaries(entries, 0, "")
+	sliced, info := sliceAtCompactBoundaries(entries, 0, "", "")
 	if len(sliced) != 3 {
 		t.Fatalf("got %d, want 3", len(sliced))
 	}
@@ -1132,7 +1258,7 @@ func TestSliceAtCompactBoundariesTailZeroWithCursor(t *testing.T) {
 		{UUID: "c", Type: "user"},
 	}
 	// tailCompactions=0 with cursor should still respect the cursor.
-	sliced, info := sliceAtCompactBoundaries(entries, 0, "b")
+	sliced, info := sliceAtCompactBoundaries(entries, 0, "b", "")
 	if len(sliced) != 1 {
 		t.Fatalf("got %d, want 1 (only messages before cursor 'b')", len(sliced))
 	}
diff --git a/internal/sling/sling.go b/internal/sling/sling.go
index 5cfd1d9d3b..956347c98f 100644
--- a/internal/sling/sling.go
+++ b/internal/sling/sling.go
@@ -8,8 +8,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
-	"os"
 	"path/filepath"
 	"strings"
 	"time"
@@ -96,6 +94,7 @@ type RouteRequest struct {
 	Metadata map[string]string // gc.routed_to, pool label, etc.
 	WorkDir  string            // rig directory for command execution
 	Env      map[string]string // extra env vars (GC_SLING_TARGET, etc.)
+	Force    bool              // allow best-effort routing when the bead is absent
 }
 
 // SlingDeps bundles infrastructure dependencies for sling operations.
@@ -113,7 +112,7 @@ type SlingDeps struct {
 	// SourceWorkflowStores lists every bead store that may contain workflow
 	// roots for source-workflow singleton checks and recovery.
 	SourceWorkflowStores func() ([]SourceWorkflowStore, error)
-	Stderr               io.Writer
+	Tracer               func(format string, args ...any)
 
 	// Narrow interfaces (matches established internal package patterns).
 	Resolver AgentResolver  // agent name resolution
@@ -289,18 +288,21 @@ type ScaleInfo struct {
 // extra env vars and returns combined output.
 type SlingRunner func(dir, command string, env map[string]string) (string, error)
 
-// SlingTracef writes to the sling trace log if GC_SLING_TRACE is set.
+// SlingTracef calls the package-level trace function if set. Wire via
+// SetTracer at process startup; the domain package never opens files or
+// reads environment variables directly.
 func SlingTracef(format string, args ...any) {
-	path := strings.TrimSpace(os.Getenv("GC_SLING_TRACE"))
-	if path == "" {
-		return
+	if globalTracer != nil {
+		globalTracer(format, args...)
 	}
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
-	if err != nil {
-		return
-	}
-	defer f.Close()                                                                                    //nolint:errcheck // best-effort trace log
-	fmt.Fprintf(f, "%s %s\n", time.Now().UTC().Format(time.RFC3339Nano), fmt.Sprintf(format, args...)) //nolint:errcheck
+}
+
+var globalTracer func(format string, args ...any)
+
+// SetTracer installs the package-level trace function. Call once at
+// process startup from the CLI edge.
+func SetTracer(fn func(format string, args ...any)) {
+	globalTracer = fn
 }
 
 // FindRigByPrefix finds a rig whose effective prefix matches (case-insensitive).
@@ -324,9 +326,10 @@ func IsHQPrefix(cfg *config.City, prefix string) bool {
 }
 
 // RigDirForBead resolves the rig directory for a bead ID by extracting
-// the bead prefix and looking up the rig path.
+// the bead prefix and looking up the rig path. Honors hyphenated rig
+// prefixes via BeadPrefixForCity.
 func RigDirForBead(cfg *config.City, beadID string) string {
-	bp := BeadPrefix(beadID)
+	bp := BeadPrefixForCity(cfg, beadID)
 	if bp == "" {
 		return ""
 	}
@@ -366,22 +369,22 @@ func BuildSlingCommand(template, beadID string) string {
 
 // BuildSlingCommandForAgent expands any PathContext placeholders in a custom
 // sling_query, then replaces {} with the bead ID. Malformed templates fall back
-// to the raw sling_query so routing behavior remains non-fatal.
-func BuildSlingCommandForAgent(fieldName, template, beadID, cityPath, cityName string, a config.Agent, rigs []config.Rig, stderr io.Writer) string {
+// to the raw sling_query so routing behavior remains non-fatal. The returned
+// warning is non-empty when template expansion failed and the raw template was
+// used as fallback.
+func BuildSlingCommandForAgent(fieldName, template, beadID, cityPath, cityName string, a config.Agent, rigs []config.Rig) (command, warning string) {
 	if strings.Contains(template, "{{") {
 		expanded, err := workdirutil.ExpandCommandTemplate(template, cityPath, cityName, a, rigs)
 		if err != nil {
-			if stderr != nil {
-				if fieldName == "" {
-					fieldName = "sling_query"
-				}
-				fmt.Fprintf(stderr, "BuildSlingCommandForAgent: agent %q field %q: %v (using raw command)\n", a.QualifiedName(), fieldName, err) //nolint:errcheck
+			if fieldName == "" {
+				fieldName = "sling_query"
 			}
+			warning = fmt.Sprintf("BuildSlingCommandForAgent: agent %q field %q: %v (using raw command)", a.QualifiedName(), fieldName, err)
 		} else {
 			template = expanded
 		}
 	}
-	return BuildSlingCommand(template, beadID)
+	return BuildSlingCommand(template, beadID), warning
 }
 
 // FormatBeadLabel formats a bead ID with optional title for display.
@@ -395,6 +398,11 @@ func FormatBeadLabel(id, title string) string {
 // BeadPrefix extracts the rig prefix from a bead ID by taking the lowercase
 // letters before the first dash. "HW-7" → "hw", "FE-123" → "fe".
 // Returns "" if the ID has no dash (can't determine prefix).
+//
+// This is a config-free heuristic. For inputs whose rig prefix may itself
+// contain hyphens ("agent-diagnostics-hnn" routed to rig "agent-diagnostics"),
+// callers must use BeadPrefixForCity, which resolves the longest matching
+// configured prefix.
 func BeadPrefix(beadID string) string {
 	i := strings.Index(beadID, "-")
 	if i <= 0 {
@@ -403,6 +411,118 @@ func BeadPrefix(beadID string) string {
 	return strings.ToLower(beadID[:i])
 }
 
+// BeadPrefixForCity returns the configured rig (or HQ) prefix that beadID
+// belongs to, preferring the longest match so hyphenated rig prefixes resolve
+// correctly. It does not require the suffix to pass the short bead-ID shape
+// gate; callers that need to decide bead ID vs inline text should use
+// LooksLikeConfiguredBeadID. Falls back to BeadPrefix when no configured
+// prefix matches. Returns "" if the bead has no dash and no configured-prefix
+// match.
+func BeadPrefixForCity(cfg *config.City, beadID string) string {
+	if p := matchConfiguredBeadPrefixCandidate(cfg, beadID); p != "" {
+		return p
+	}
+	return BeadPrefix(beadID)
+}
+
+// LooksLikeConfiguredBeadID reports whether s parses as a bead ID whose
+// prefix matches the city's HQ prefix or any configured rig's effective
+// prefix. Unlike BeadIDParts, it accepts hyphenated rig prefixes
+// (e.g. "agent-diagnostics-hnn" with rig "agent-diagnostics"). The
+// trailing suffix must be alphanumeric (allowing an optional ".child"
+// hierarchical part) and at most 8 characters long.
+func LooksLikeConfiguredBeadID(cfg *config.City, s string) bool {
+	return matchConfiguredBeadPrefix(cfg, s) != ""
+}
+
+// matchConfiguredBeadPrefix returns the longest configured prefix
+// (HQ or rig) that beadID begins with, provided the trailing suffix
+// passes the bead-suffix shape gate. Match is case-insensitive on the
+// prefix; the returned value is the lower-cased configured prefix.
+// Returns "" if no configured prefix matches.
+func matchConfiguredBeadPrefix(cfg *config.City, beadID string) string {
+	return matchConfiguredBeadPrefixBySuffix(cfg, beadID, true)
+}
+
+func matchConfiguredBeadPrefixCandidate(cfg *config.City, beadID string) string {
+	return matchConfiguredBeadPrefixBySuffix(cfg, beadID, false)
+}
+
+func matchConfiguredBeadPrefixBySuffix(cfg *config.City, beadID string, requireValidSuffix bool) string {
+	beadID = strings.TrimSpace(beadID)
+	if cfg == nil || beadID == "" || strings.ContainsAny(beadID, " \t\n") {
+		return ""
+	}
+	candidates := configuredBeadPrefixes(cfg)
+	// Track the longest matching prefix; equal-length ties keep the first
+	// match, matching the order semantics of FindRigByPrefix.
+	best := ""
+	bestLen := 0
+	lower := strings.ToLower(beadID)
+	for _, p := range candidates {
+		lp := strings.ToLower(p)
+		if len(lp) <= bestLen {
+			continue
+		}
+		if !strings.HasPrefix(lower, lp+"-") {
+			continue
+		}
+		if requireValidSuffix {
+			suffix := beadID[len(lp)+1:]
+			if !validBeadSuffix(suffix) {
+				continue
+			}
+		}
+		best = lp
+		bestLen = len(lp)
+	}
+	return best
+}
+
+// configuredBeadPrefixes returns every prefix the city accepts for bead
+// IDs: the city's HQ prefix plus each rig's effective prefix. Empty
+// entries are skipped. The caller picks the longest match; order only
+// matters when equal-length matches tie, in which case the first match
+// (HQ before rigs, then cfg.Rigs declaration order) is kept. Note that
+// config validation rejects duplicate prefixes, so ties should not
+// appear in valid configs.
+func configuredBeadPrefixes(cfg *config.City) []string {
+	if cfg == nil {
+		return nil
+	}
+	out := make([]string, 0, len(cfg.Rigs)+1)
+	if hq := config.EffectiveHQPrefix(cfg); hq != "" {
+		out = append(out, hq)
+	}
+	for i := range cfg.Rigs {
+		if p := cfg.Rigs[i].EffectivePrefix(); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// validBeadSuffix reports whether suffix is a plausible bead-ID suffix:
+// a non-empty alphanumeric base of at most 8 characters, optionally
+// followed by ".child" hierarchical parts. The hierarchical portion is
+// not validated, matching BeadIDParts which truncates at the first dot
+// before validating the base.
+func validBeadSuffix(suffix string) bool {
+	base := suffix
+	if dot := strings.IndexByte(suffix, '.'); dot > 0 {
+		base = suffix[:dot]
+	}
+	if base == "" || len(base) > 8 {
+		return false
+	}
+	for _, c := range base {
+		if (c < '0' || c > '9') && (c < 'a' || c > 'z') && (c < 'A' || c > 'Z') {
+			return false
+		}
+	}
+	return true
+}
+
 // RigPrefixForAgent returns the rig prefix that an agent's rig uses for bead IDs.
 func RigPrefixForAgent(a config.Agent, cfg *config.City) string {
 	if a.Dir == "" || cfg == nil {
@@ -445,7 +565,7 @@ func CrossRigRouteError(beadID string, a config.Agent, cfg *config.City) *CrossR
 	if cfg == nil || a.Dir == "" {
 		return nil
 	}
-	bp := BeadPrefix(beadID)
+	bp := BeadPrefixForCity(cfg, beadID)
 	if bp == "" {
 		return nil
 	}
@@ -689,7 +809,7 @@ func SlingFormulaTargetBranch(beadID string, deps SlingDeps, a config.Agent) str
 
 // BuildSlingFormulaVars builds the variable map for formula instantiation.
 func BuildSlingFormulaVars(formulaName, beadID string, userVars []string, a config.Agent, deps SlingDeps) map[string]string {
-	vars := make(map[string]string, len(userVars)+3)
+	vars := make(map[string]string, len(userVars)+6)
 	for _, v := range userVars {
 		key, value, ok := strings.Cut(v, "=")
 		if ok && key != "" {
@@ -705,10 +825,19 @@ func BuildSlingFormulaVars(formulaName, beadID string, userVars []string, a conf
 		}
 		vars[key] = value
 	}
+	addRoutingVar := func(key, value string) {
+		if _, explicit := vars[key]; explicit {
+			return
+		}
+		vars[key] = value
+	}
 
 	if beadID != "" {
 		addVar("issue", beadID)
 	}
+	addRoutingVar("rig_name", a.Dir)
+	addRoutingVar("binding_name", a.BindingName)
+	addRoutingVar("binding_prefix", a.BindingPrefix())
 
 	autoBranch := SlingFormulaTargetBranch(beadID, deps, a)
 	if SlingFormulaUsesBaseBranch(formulaName) {
@@ -805,6 +934,7 @@ func InstantiateSlingFormula(ctx context.Context, formulaName string, searchPath
 		SlingTracef("instantiate decorate-error formula=%s err=%v", formulaName, err)
 		return nil, err
 	}
+	privatizeAttachedRootOnlyWisp(recipe, sourceBeadID)
 	instantiateStart := time.Now()
 	result, err := molecule.Instantiate(ctx, deps.Store, recipe, opts)
 	if err != nil {
@@ -815,6 +945,35 @@ func InstantiateSlingFormula(ctx context.Context, formulaName string, searchPath
 	return result, nil
 }
 
+func privatizeAttachedRootOnlyWisp(recipe *formula.Recipe, sourceBeadID string) {
+	if recipe == nil || !recipe.RootOnly || strings.TrimSpace(sourceBeadID) == "" || len(recipe.Steps) == 0 {
+		return
+	}
+	root := &recipe.Steps[0]
+	if root.Metadata["gc.kind"] != "wisp" {
+		return
+	}
+	root.Type = "molecule"
+	root.Metadata = mapsCloneWithout(root.Metadata, "gc.kind")
+}
+
+func mapsCloneWithout(in map[string]string, drop string) map[string]string {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make(map[string]string, len(in))
+	for key, value := range in {
+		if key == drop {
+			continue
+		}
+		out[key] = value
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
 // ShouldPromoteWorkflowLaunchStatus reports whether a bead's status should
 // be promoted to in_progress when a workflow launches.
 func ShouldPromoteWorkflowLaunchStatus(status string) bool {
diff --git a/internal/sling/sling_attachment.go b/internal/sling/sling_attachment.go
index 53e254536a..eeaad5dc98 100644
--- a/internal/sling/sling_attachment.go
+++ b/internal/sling/sling_attachment.go
@@ -248,8 +248,7 @@ func checkBatchNoMoleculeChildren(q BeadChildQuerier, open []beads.Bead, store b
 	// without this, users see a generic "cannot use --on" string and
 	// never learn about `gc workflow delete-source`. The first child's
 	// conflict becomes the typed payload; a combined non-typed error
-	// keeps the legacy message so existing "%d/%d" diagnostics stay
-	// readable.
+	// keeps the summary message so "%d/%d" diagnostics stay readable.
 	type workflowConflict struct {
 		childID    string
 		workflowID string
@@ -299,7 +298,7 @@ func checkBatchNoMoleculeChildren(q BeadChildQuerier, open []beads.Bead, store b
 	// workflow — users running the suggested `gc workflow delete-source
 	// <first-child>` command would see unrelated workflow IDs and only
 	// clean up part of the batch. Group blocking workflow IDs by child,
-	// then join them alongside the legacy summary; the CLI walks the
+	// then join them alongside the summary; the CLI walks the
 	// error chain to render one cleanup hint per affected child.
 	conflictsByChild := make(map[string][]string, len(workflowConflicts))
 	childOrder := make([]string, 0, len(workflowConflicts))
diff --git a/internal/sling/sling_core.go b/internal/sling/sling_core.go
index 75868fc50c..342b660ffb 100644
--- a/internal/sling/sling_core.go
+++ b/internal/sling/sling_core.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"path/filepath"
 	"slices"
 	"strings"
 
@@ -17,6 +16,14 @@ import (
 	"github.com/gastownhall/gascity/internal/telemetry"
 )
 
+func depsTracef(deps SlingDeps, format string, args ...any) {
+	if deps.Tracer != nil {
+		deps.Tracer(format, args...)
+		return
+	}
+	SlingTracef(format, args...)
+}
+
 // validateDeps checks that required SlingDeps fields are non-nil.
 func validateDeps(deps SlingDeps) error {
 	if deps.Cfg == nil {
@@ -331,13 +338,17 @@ func finalize(opts SlingOpts, deps SlingDeps, beadID, method string, result Slin
 			Target:  a.QualifiedName(),
 			WorkDir: rigDir,
 			Env:     slingEnv,
+			Force:   opts.Force,
 		}
 		if err := deps.Router.Route(context.Background(), req); err != nil {
 			telemetry.RecordSling(context.Background(), a.QualifiedName(), TargetType(&a), method, err)
 			return result, fmt.Errorf("%w", err)
 		}
 	} else {
-		slingCmd := BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), beadID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs, deps.Stderr)
+		slingCmd, slingWarn := BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), beadID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs)
+		if slingWarn != "" {
+			depsTracef(deps, "sling-core: %s", slingWarn)
+		}
 		if _, err := deps.Runner(rigDir, slingCmd, slingEnv); err != nil {
 			telemetry.RecordSling(context.Background(), a.QualifiedName(), TargetType(&a), method, err)
 			return result, fmt.Errorf("%w", err)
@@ -790,30 +801,17 @@ func validateBatchSlingFormulaRuntimeVars(ctx context.Context, formulaName strin
 }
 
 func sourceWorkflowLockScope(deps SlingDeps) string {
-	cityPath := strings.TrimSpace(deps.CityPath)
-	if cityPath == "" {
-		return strings.TrimSpace(deps.StoreRef)
-	}
-	storeRef := strings.TrimSpace(deps.StoreRef)
-	switch {
-	case storeRef == "", strings.HasPrefix(storeRef, "city:"):
-		return filepath.Clean(cityPath)
-	case strings.HasPrefix(storeRef, "rig:"):
-		rigName := strings.TrimPrefix(storeRef, "rig:")
+	return sourceworkflow.LockScopeForStoreRef(deps.CityPath, "", deps.StoreRef, func(rigName string) (string, bool) {
 		if deps.Cfg != nil {
 			for _, rig := range deps.Cfg.Rigs {
 				if rig.Name != rigName {
 					continue
 				}
-				rigPath := rig.Path
-				if !filepath.IsAbs(rigPath) {
-					rigPath = filepath.Join(cityPath, rigPath)
-				}
-				return filepath.Clean(rigPath)
+				return rig.Path, true
 			}
 		}
-	}
-	return storeRef
+		return "", false
+	})
 }
 
 // DoSlingBatch handles convoy expansion before delegating to DoSling.
@@ -1009,6 +1007,7 @@ func DoSlingBatch(opts SlingOpts, deps SlingDeps, querier BeadChildQuerier) (Sli
 				Target:  a.QualifiedName(),
 				WorkDir: rigDir,
 				Env:     childEnv,
+				Force:   opts.Force,
 			}
 			if err := deps.Router.Route(context.Background(), req); err != nil {
 				childResult.Failed = true
@@ -1020,7 +1019,10 @@ func DoSlingBatch(opts SlingOpts, deps SlingDeps, querier BeadChildQuerier) (Sli
 				continue
 			}
 		} else {
-			slingCmd := BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), child.ID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs, deps.Stderr)
+			slingCmd, slingWarn := BuildSlingCommandForAgent("sling_query", a.EffectiveSlingQuery(), child.ID, deps.CityPath, deps.CityName, a, deps.Cfg.Rigs)
+			if slingWarn != "" {
+				depsTracef(deps, "sling-core: %s", slingWarn)
+			}
 			if _, err := deps.Runner(rigDir, slingCmd, childEnv); err != nil {
 				childResult.Failed = true
 				childResult.FailReason = err.Error()
diff --git a/internal/sling/sling_test.go b/internal/sling/sling_test.go
index 9214647645..407dd37521 100644
--- a/internal/sling/sling_test.go
+++ b/internal/sling/sling_test.go
@@ -198,17 +198,16 @@ func TestBuildSlingCommandForAgentParseErrorRedactsTemplate(t *testing.T) {
 	a := config.Agent{Name: "worker"}
 	template := "custom {} --route={{.Rig"
 
-	var buf strings.Builder
-	got := BuildSlingCommandForAgent("sling_query", template, "BL-42", cityPath, "", a, nil, &buf)
+	got, warning := BuildSlingCommandForAgent("sling_query", template, "BL-42", cityPath, "", a, nil)
 
 	if got != "custom 'BL-42' --route={{.Rig" {
 		t.Fatalf("BuildSlingCommandForAgent() = %q, want %q", got, "custom 'BL-42' --route={{.Rig")
 	}
-	if !strings.Contains(buf.String(), "sling_query") {
-		t.Fatalf("stderr missing field name: %q", buf.String())
+	if !strings.Contains(warning, "sling_query") {
+		t.Fatalf("warning missing field name: %q", warning)
 	}
-	if strings.Contains(buf.String(), template) {
-		t.Fatalf("stderr should redact raw template, got %q", buf.String())
+	if strings.Contains(warning, template) {
+		t.Fatalf("warning should redact raw template, got %q", warning)
 	}
 }
 
@@ -218,7 +217,7 @@ func TestBuildSlingCommandForAgentExpandsPathContextPlaceholders(t *testing.T) {
 	a := config.Agent{Name: "worker", Dir: "frontend"}
 	rigs := []config.Rig{{Name: "frontend", Path: rigPath}}
 
-	got := BuildSlingCommandForAgent(
+	got, _ := BuildSlingCommandForAgent(
 		"sling_query",
 		"custom {} --route={{.CityName}}/{{.Rig}}/{{.AgentBase}}",
 		"BL-42",
@@ -226,7 +225,6 @@ func TestBuildSlingCommandForAgentExpandsPathContextPlaceholders(t *testing.T) {
 		"",
 		a,
 		rigs,
-		nil,
 	)
 
 	if want := "custom 'BL-42' --route=demo-city/frontend/worker"; got != want {
@@ -311,6 +309,273 @@ func TestBeadPrefixSling(t *testing.T) {
 	}
 }
 
+func TestBeadPrefixForCityLongestMatch(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent", Path: "/agent", Prefix: "agent"},
+			{Name: "agent-diagnostics", Path: "/ad", Prefix: "agent-diagnostics"},
+			{Name: "fe", Path: "/fe", Prefix: "fe"},
+		},
+	}
+	tests := []struct {
+		id   string
+		want string
+	}{
+		{"agent-diagnostics-hnn", "agent-diagnostics"},
+		{"agent-diagnostics-spawn-storm", "agent-diagnostics"},
+		{"agent-x1", "agent"},
+		{"fe-42", "fe"},
+		{"unknown-7", "unknown"}, // falls back to BeadPrefix.
+		{"", ""},
+	}
+	for _, tt := range tests {
+		got := BeadPrefixForCity(cfg, tt.id)
+		if got != tt.want {
+			t.Errorf("BeadPrefixForCity(%q) = %q, want %q", tt.id, got, tt.want)
+		}
+	}
+}
+
+func TestBeadPrefixForCityFallsBackToBeadPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fe", Path: "/fe", Prefix: "fe"}},
+	}
+	// Unknown prefix → fall back to BeadPrefix's first-dash split.
+	if got := BeadPrefixForCity(cfg, "unknown-7"); got != "unknown" {
+		t.Errorf("BeadPrefixForCity(unknown-7) = %q, want unknown", got)
+	}
+	// Nil cfg → fall back to BeadPrefix.
+	if got := BeadPrefixForCity(nil, "fe-42"); got != "fe" {
+		t.Errorf("BeadPrefixForCity(nil, fe-42) = %q, want fe", got)
+	}
+}
+
+func TestLooksLikeConfiguredBeadIDAcceptsHyphenatedPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent-diagnostics", Path: "/ad", Prefix: "agent-diagnostics"},
+		},
+	}
+	tests := []struct {
+		id   string
+		want bool
+	}{
+		{"agent-diagnostics-hnn", true},
+		{"agent-diagnostics-h1", true},
+		{"agent-diagnostics-12345678", true},   // 8-char numeric suffix.
+		{"agent-diagnostics-123456789", false}, // 9-char suffix exceeds cap.
+		{"agent-diagnostics-", false},          // empty suffix.
+		{"agent-diagnostics-h.1", true},        // hierarchical .child.
+		{"agent-diagnostics-h.x", true},
+		{"agent-diagnostics-h.", true}, // trailing dot accepted (matches BeadIDParts).
+		{"agent-diagnostics", false},   // no suffix dash.
+	}
+	for _, tt := range tests {
+		got := LooksLikeConfiguredBeadID(cfg, tt.id)
+		if got != tt.want {
+			t.Errorf("LooksLikeConfiguredBeadID(%q) = %v, want %v", tt.id, got, tt.want)
+		}
+	}
+}
+
+func TestLooksLikeConfiguredBeadIDPrefersLongestPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent", Path: "/agent", Prefix: "agent"},
+			{Name: "agent-diagnostics", Path: "/ad", Prefix: "agent-diagnostics"},
+		},
+	}
+	// Both prefixes can match "agent-diagnostics-h1" via the prefix-then-validate
+	// rule, but matchConfiguredBeadPrefix must pick the longest.
+	if !LooksLikeConfiguredBeadID(cfg, "agent-diagnostics-h1") {
+		t.Fatal("LooksLikeConfiguredBeadID(agent-diagnostics-h1) = false, want true")
+	}
+	// "agent-x1" only matches the shorter "agent" prefix.
+	if !LooksLikeConfiguredBeadID(cfg, "agent-x1") {
+		t.Fatal("LooksLikeConfiguredBeadID(agent-x1) = false, want true")
+	}
+}
+
+func TestLooksLikeConfiguredBeadIDRejectsUnknownPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fe", Path: "/fe", Prefix: "fe"}},
+	}
+	cases := []string{
+		"unknown-42",
+		"code-review-please", // no rig "code" or "code-review" configured.
+		"hello-world",
+		"",
+		"   ",
+		"fe foo",  // whitespace.
+		"fe-foo!", // non-alphanumeric suffix char.
+	}
+	for _, c := range cases {
+		if LooksLikeConfiguredBeadID(cfg, c) {
+			t.Errorf("LooksLikeConfiguredBeadID(%q) = true, want false", c)
+		}
+	}
+}
+
+func TestLooksLikeConfiguredBeadIDAcceptsHQPrefix(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test", Prefix: "HQ"},
+	}
+	if !LooksLikeConfiguredBeadID(cfg, "HQ-42") {
+		t.Fatal("HQ-42 should be a configured bead ID")
+	}
+	if !LooksLikeConfiguredBeadID(cfg, "hq-abc") {
+		t.Fatal("hq-abc should match HQ prefix case-insensitively")
+	}
+}
+
+// Underscored rig prefixes (e.g. "live_docs") are common in real cities
+// but were rejected by BeadIDParts' alpha-only prefix charset. The
+// config-aware path matches against cfg.Rigs literally, so the broken
+// charset gate is bypassed for any prefix the city has actually
+// declared. Coverage parallels the bug-report cases: live_docs,
+// migration_evals, scix_experiments, EnterpriseBench.
+func TestLooksLikeConfiguredBeadIDAcceptsUnderscoredPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "live_docs", Path: "/ld", Prefix: "live_docs"},
+			{Name: "migration_evals", Path: "/me", Prefix: "migration_evals"},
+			{Name: "scix_experiments", Path: "/sx", Prefix: "scix_experiments"},
+			{Name: "EnterpriseBench", Path: "/eb", Prefix: "EnterpriseBench"},
+		},
+	}
+	tests := []struct {
+		id   string
+		want bool
+	}{
+		{"live_docs-5du", true},
+		{"migration_evals-cns", true},
+		{"scix_experiments-wqr.9.3", true}, // hierarchical .child suffix.
+		{"EnterpriseBench-0rv.18", true},
+		{"EnterpriseBench-0rv", true},
+		{"live_docs-", false},    // empty suffix.
+		{"live_docs", false},     // no suffix dash.
+		{"unknown_rig-7", false}, // not in config.
+	}
+	for _, tt := range tests {
+		got := LooksLikeConfiguredBeadID(cfg, tt.id)
+		if got != tt.want {
+			t.Errorf("LooksLikeConfiguredBeadID(%q) = %v, want %v", tt.id, got, tt.want)
+		}
+	}
+}
+
+func TestBeadPrefixForCityHandlesUnderscoredPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "live_docs", Path: "/ld", Prefix: "live_docs"},
+			{Name: "migration_evals", Path: "/me", Prefix: "migration_evals"},
+		},
+	}
+	tests := []struct {
+		id   string
+		want string
+	}{
+		{"live_docs-5du", "live_docs"},
+		{"migration_evals-cns", "migration_evals"},
+		{"migration_evals-cns.1", "migration_evals"},
+	}
+	for _, tt := range tests {
+		got := BeadPrefixForCity(cfg, tt.id)
+		if got != tt.want {
+			t.Errorf("BeadPrefixForCity(%q) = %q, want %q", tt.id, got, tt.want)
+		}
+	}
+}
+
+func TestRigDirForBeadHonorsUnderscoredPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "live_docs", Path: "/live-docs-rig", Prefix: "live_docs"},
+		},
+	}
+	if got := RigDirForBead(cfg, "live_docs-5du"); got != "/live-docs-rig" {
+		t.Errorf("RigDirForBead(live_docs-5du) = %q, want /live-docs-rig", got)
+	}
+}
+
+// RigDirForBead returns "" in two distinct ways: the prefix doesn't
+// parse at all (BeadPrefixForCity returns "") and the prefix parses
+// but doesn't match any configured rig (BeadPrefix falls back to
+// first-dash split for unknown prefixes). Cover both so a regression
+// that conflates the branches is caught.
+func TestRigDirForBeadEmptyPrefixAndUnknownRig(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{{Name: "fe", Path: "/fe", Prefix: "fe"}},
+	}
+	// Empty input → BeadPrefixForCity returns "", short-circuits.
+	if got := RigDirForBead(cfg, ""); got != "" {
+		t.Errorf("RigDirForBead(\"\") = %q, want \"\"", got)
+	}
+	// Unknown prefix that BeadPrefix's fallback parses ("unknown")
+	// but is not a configured rig: hits the FindRigByPrefix=false
+	// branch.
+	if got := RigDirForBead(cfg, "unknown-7"); got != "" {
+		t.Errorf("RigDirForBead(unknown-7) = %q, want \"\" (no matching rig)", got)
+	}
+}
+
+// configuredBeadPrefixes skips rigs whose effective prefix is empty.
+// Reaching that branch requires both an empty Name and Prefix —
+// validated configs reject this, but the guard exists so a malformed
+// or partially-applied config can't produce an "" entry that confuses
+// equal-length tiebreaks in matchConfiguredBeadPrefix.
+func TestConfiguredBeadPrefixesSkipsEmptyRigPrefix(t *testing.T) {
+	cfg := &config.City{
+		Workspace: config.Workspace{Name: "test", Prefix: "HQ"},
+		Rigs: []config.Rig{
+			{Name: "fe", Path: "/fe", Prefix: "fe"},
+			{Name: "", Path: "/empty", Prefix: ""},
+		},
+	}
+	got := configuredBeadPrefixes(cfg)
+	want := []string{"HQ", "fe"}
+	if len(got) != len(want) {
+		t.Fatalf("configuredBeadPrefixes = %v, want %v (empty-prefix rig must be skipped)", got, want)
+	}
+	for i := range got {
+		if got[i] != want[i] {
+			t.Errorf("configuredBeadPrefixes[%d] = %q, want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestRigDirForBeadHonorsHyphenatedPrefix(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent", Path: "/agent", Prefix: "agent"},
+			{Name: "agent-diagnostics", Path: "/agent-diag", Prefix: "agent-diagnostics"},
+		},
+	}
+	if got := RigDirForBead(cfg, "agent-diagnostics-hnn"); got != "/agent-diag" {
+		t.Errorf("RigDirForBead = %q, want /agent-diag (longest configured prefix)", got)
+	}
+	if got := RigDirForBead(cfg, "agent-x1"); got != "/agent" {
+		t.Errorf("RigDirForBead = %q, want /agent", got)
+	}
+}
+
+func TestCheckCrossRigDetectsHyphenatedPrefixMismatch(t *testing.T) {
+	cfg := &config.City{
+		Rigs: []config.Rig{
+			{Name: "agent", Path: "/agent", Prefix: "agent"},
+			{Name: "agent-diagnostics", Path: "/ad", Prefix: "agent-diagnostics"},
+		},
+	}
+	// First-dash BeadPrefix yields "agent" for "agent-diagnostics-hnn",
+	// which falsely matches a worker in rig "agent" and lets cross-rig
+	// routing through silently. The longest-prefix resolver returns
+	// "agent-diagnostics", so the guard fires correctly.
+	a := config.Agent{Name: "worker", Dir: "agent"}
+	if msg := CheckCrossRig("agent-diagnostics-hnn", a, cfg); msg == "" {
+		t.Error("expected cross-rig warning: bead in rig 'agent-diagnostics' routed to worker in rig 'agent' must not be silently permitted")
+	}
+}
+
 func TestCheckCrossRigSling(t *testing.T) {
 	cfg := &config.City{
 		Rigs: []config.Rig{
@@ -422,6 +687,65 @@ func TestDoSlingFormulaToAgent(t *testing.T) {
 	}
 }
 
+func TestBuildSlingFormulaVarsSeedsRoutingNamespace(t *testing.T) {
+	deps := testDeps(&config.City{Workspace: config.Workspace{Name: "test"}}, runtime.NewFake(), newFakeRunner().run)
+
+	vars := BuildSlingFormulaVars("mol-polecat-work", "HW-42", nil, config.Agent{
+		Name:        "polecat",
+		Dir:         "hw",
+		BindingName: "gastown",
+	}, deps)
+
+	if got := vars["rig_name"]; got != "hw" {
+		t.Fatalf("rig_name var = %q, want hw", got)
+	}
+	if got := vars["binding_name"]; got != "gastown" {
+		t.Fatalf("binding_name var = %q, want gastown", got)
+	}
+	if got := vars["binding_prefix"]; got != "gastown." {
+		t.Fatalf("binding_prefix var = %q, want gastown.", got)
+	}
+}
+
+func TestBuildSlingFormulaVarsPreservesExplicitRoutingNamespace(t *testing.T) {
+	deps := testDeps(&config.City{Workspace: config.Workspace{Name: "test"}}, runtime.NewFake(), newFakeRunner().run)
+
+	vars := BuildSlingFormulaVars("mol-polecat-work", "HW-42", []string{
+		"rig_name=override-rig",
+		"binding_name=override-binding",
+		"binding_prefix=override.",
+	}, config.Agent{
+		Name:        "polecat",
+		Dir:         "hw",
+		BindingName: "gastown",
+	}, deps)
+
+	if got := vars["rig_name"]; got != "override-rig" {
+		t.Fatalf("rig_name var = %q, want override-rig", got)
+	}
+	if got := vars["binding_name"]; got != "override-binding" {
+		t.Fatalf("binding_name var = %q, want override-binding", got)
+	}
+	if got := vars["binding_prefix"]; got != "override." {
+		t.Fatalf("binding_prefix var = %q, want override.", got)
+	}
+}
+
+func TestBuildSlingFormulaVarsSeedsEmptyRoutingNamespaceForUnboundAgent(t *testing.T) {
+	deps := testDeps(&config.City{Workspace: config.Workspace{Name: "test"}}, runtime.NewFake(), newFakeRunner().run)
+
+	vars := BuildSlingFormulaVars("mol-deacon-patrol", "CITY-42", nil, config.Agent{
+		Name: "deacon",
+	}, deps)
+
+	for _, key := range []string{"rig_name", "binding_name", "binding_prefix"} {
+		got, ok := vars[key]
+		if !ok || got != "" {
+			t.Fatalf("%s var = %q, %v; want empty string, true", key, got, ok)
+		}
+	}
+}
+
 func TestDoSlingCrossRigBlocks(t *testing.T) {
 	runner := newFakeRunner()
 	sp := runtime.NewFake()
@@ -2280,6 +2604,19 @@ func TestSourceWorkflowLockScopeUsesStorePath(t *testing.T) {
 	}); got != filepath.Join("/city", "rigs", "alpha") {
 		t.Fatalf("rig scope = %q, want %q", got, filepath.Join("/city", "rigs", "alpha"))
 	}
+	wantShared := sourceworkflow.LockScopeForStoreRef("/city", "", "rig:alpha", func(rigName string) (string, bool) {
+		if rigName != "alpha" {
+			return "", false
+		}
+		return "rigs/alpha", true
+	})
+	if got := sourceWorkflowLockScope(SlingDeps{
+		CityPath: "/city",
+		StoreRef: "rig:alpha",
+		Cfg:      cfg,
+	}); got != wantShared {
+		t.Fatalf("rig scope = %q, want shared helper scope %q", got, wantShared)
+	}
 }
 
 func TestSlingExpandConvoy(t *testing.T) {
diff --git a/internal/sourceworkflow/sourceworkflow.go b/internal/sourceworkflow/sourceworkflow.go
index bcbf2c301c..c8d6345025 100644
--- a/internal/sourceworkflow/sourceworkflow.go
+++ b/internal/sourceworkflow/sourceworkflow.go
@@ -76,6 +76,45 @@ func NormalizeSourceStoreRef(sourceStoreRef string) string {
 	return strings.TrimSpace(sourceStoreRef)
 }
 
+// LockScopeForStoreRef returns the filesystem scope used for source-workflow
+// locks for a source bead's resident store ref.
+func LockScopeForStoreRef(cityPath, defaultStorePath, storeRef string, rigPath func(string) (string, bool)) string {
+	cityPath = strings.TrimSpace(cityPath)
+	defaultStorePath = strings.TrimSpace(defaultStorePath)
+	storeRef = strings.TrimSpace(storeRef)
+	if storeRef == "" {
+		switch {
+		case defaultStorePath != "":
+			return filepath.Clean(defaultStorePath)
+		case cityPath != "":
+			return filepath.Clean(cityPath)
+		default:
+			return ""
+		}
+	}
+	if cityPath == "" {
+		return filepath.Clean(storeRef)
+	}
+	switch {
+	case strings.HasPrefix(storeRef, "city:"):
+		return filepath.Clean(cityPath)
+	case strings.HasPrefix(storeRef, "rig:"):
+		rigName := strings.TrimSpace(strings.TrimPrefix(storeRef, "rig:"))
+		if rigPath != nil {
+			if path, ok := rigPath(rigName); ok {
+				path = strings.TrimSpace(path)
+				if path != "" {
+					if !filepath.IsAbs(path) {
+						path = filepath.Join(cityPath, path)
+					}
+					return filepath.Clean(path)
+				}
+			}
+		}
+	}
+	return filepath.Clean(storeRef)
+}
+
 // WorkflowMatchesSource reports whether a workflow root belongs to the
 // given source bead and (optionally) a specific source store ref. Legacy
 // roots without SourceStoreRefMetadataKey are treated as belonging to the
diff --git a/internal/sourceworkflow/sourceworkflow_test.go b/internal/sourceworkflow/sourceworkflow_test.go
index f9a7eb0b25..1af4042dd6 100644
--- a/internal/sourceworkflow/sourceworkflow_test.go
+++ b/internal/sourceworkflow/sourceworkflow_test.go
@@ -102,6 +102,37 @@ func TestLockIdentityCanonicalizesScopeRefSymlinks(t *testing.T) {
 	}
 }
 
+func TestLockScopeForStoreRefResolvesCityRigAndDefaultScopes(t *testing.T) {
+	cityPath := filepath.Clean("/city")
+	rigPath := filepath.Join("rigs", "alpha")
+	resolveRig := func(name string) (string, bool) {
+		if name != "alpha" {
+			return "", false
+		}
+		return rigPath, true
+	}
+
+	tests := []struct {
+		name             string
+		defaultStorePath string
+		storeRef         string
+		want             string
+	}{
+		{name: "default store path", defaultStorePath: "/city/rigs/default", want: filepath.Clean("/city/rigs/default")},
+		{name: "city store ref", storeRef: "city:test", want: cityPath},
+		{name: "rig store ref", storeRef: "rig:alpha", want: filepath.Join(cityPath, rigPath)},
+		{name: "unknown store ref", storeRef: "external:one", want: filepath.Clean("external:one")},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := LockScopeForStoreRef(cityPath, tt.defaultStorePath, tt.storeRef, resolveRig)
+			if got != tt.want {
+				t.Fatalf("LockScopeForStoreRef() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestWorkflowMatchesSourceUsesSourceStoreRefWhenPresent(t *testing.T) {
 	root := beads.Bead{
 		ID: "wf-1",
diff --git a/internal/supervisor/registry.go b/internal/supervisor/registry.go
index 62ed93e377..e3a3b74423 100644
--- a/internal/supervisor/registry.go
+++ b/internal/supervisor/registry.go
@@ -5,6 +5,7 @@
 package supervisor
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -22,6 +23,10 @@ import (
 // underscores, and dots.
 var validCityName = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]*$`)
 
+// ErrPendingCityRequestExists indicates a city path already has an in-flight
+// async request waiting for a terminal request-result event.
+var ErrPendingCityRequestExists = errors.New("pending city request already exists")
+
 // CityEntry is one registered city in the supervisor registry.
 type CityEntry struct {
 	Path string `toml:"path"`           // absolute path to city root directory
@@ -41,10 +46,18 @@ type RigEntry struct {
 	DefaultCity string `toml:"default_city,omitempty"` // absolute path to default city (empty = unset)
 }
 
+// PendingCityRequestEntry stores async request correlation while the
+// supervisor reconciler completes city-scoped infrastructure work.
+type PendingCityRequestEntry struct {
+	Path      string `toml:"path"`
+	RequestID string `toml:"request_id"`
+}
+
 // registryFile is the TOML structure of ~/.gc/cities.toml.
 type registryFile struct {
-	Cities []CityEntry `toml:"cities"`
-	Rigs   []RigEntry  `toml:"rigs,omitempty"`
+	Cities              []CityEntry               `toml:"cities"`
+	Rigs                []RigEntry                `toml:"rigs,omitempty"`
+	PendingCityRequests []PendingCityRequestEntry `toml:"pending_city_requests,omitempty"`
 }
 
 // Registry manages the set of registered cities. Thread-safe.
@@ -177,6 +190,86 @@ func (r *Registry) Unregister(cityPath string) error {
 	return r.saveLocked(filtered)
 }
 
+// StorePendingCityRequestID records a request_id for later supervisor
+// reconciliation. The entry is persisted in the supervisor registry so a
+// restarted supervisor can still emit the terminal async result event.
+func (r *Registry) StorePendingCityRequestID(cityPath, requestID string) error {
+	r.refuseHostRegistryDuringTests()
+
+	abs, err := resolveAbsPath(cityPath)
+	if err != nil {
+		return err
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	unlock, err := r.fileLock()
+	if err != nil {
+		return err
+	}
+	defer unlock()
+
+	rf, err := r.loadAllLocked()
+	if err != nil {
+		return err
+	}
+	for _, pending := range rf.PendingCityRequests {
+		if sameRegistryPath(pending.Path, abs) {
+			return fmt.Errorf("%w: %s", ErrPendingCityRequestExists, abs)
+		}
+	}
+	rf.PendingCityRequests = append(rf.PendingCityRequests, PendingCityRequestEntry{
+		Path:      abs,
+		RequestID: requestID,
+	})
+	return r.saveAllLocked(rf)
+}
+
+// ConsumePendingCityRequestID returns and removes the pending request_id for a
+// city path from the persisted supervisor registry.
+func (r *Registry) ConsumePendingCityRequestID(cityPath string) (string, bool, error) {
+	r.refuseHostRegistryDuringTests()
+
+	abs, err := resolveAbsPath(cityPath)
+	if err != nil {
+		return "", false, err
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	unlock, err := r.fileLock()
+	if err != nil {
+		return "", false, err
+	}
+	defer unlock()
+
+	rf, err := r.loadAllLocked()
+	if err != nil {
+		return "", false, err
+	}
+	kept := rf.PendingCityRequests[:0]
+	var requestID string
+	found := false
+	for _, pending := range rf.PendingCityRequests {
+		if sameRegistryPath(pending.Path, abs) {
+			requestID = pending.RequestID
+			found = true
+			continue
+		}
+		kept = append(kept, pending)
+	}
+	if !found {
+		return "", false, nil
+	}
+	rf.PendingCityRequests = kept
+	if err := r.saveAllLocked(rf); err != nil {
+		return "", false, err
+	}
+	return requestID, true, nil
+}
+
 // loadAllLocked reads the full registry file. Caller must hold at least r.mu.RLock.
 func (r *Registry) loadAllLocked() (registryFile, error) {
 	data, err := os.ReadFile(r.path)
diff --git a/internal/supervisor/registry_test.go b/internal/supervisor/registry_test.go
index 26f506471b..b20db60461 100644
--- a/internal/supervisor/registry_test.go
+++ b/internal/supervisor/registry_test.go
@@ -1,6 +1,7 @@
 package supervisor
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -122,6 +123,66 @@ func TestRegistryUnregister(t *testing.T) {
 	}
 }
 
+func TestRegistryPendingCityRequestIDCanonicalizesPath(t *testing.T) {
+	dir := t.TempDir()
+	r := NewRegistry(filepath.Join(dir, "cities.toml"))
+
+	cityPath := filepath.Join(dir, "cities", "alpha")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	linkPath := filepath.Join(dir, "alpha-link")
+	if err := os.Symlink(cityPath, linkPath); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := r.StorePendingCityRequestID(linkPath, "req-alpha"); err != nil {
+		t.Fatalf("StorePendingCityRequestID: %v", err)
+	}
+
+	reopened := NewRegistry(filepath.Join(dir, "cities.toml"))
+	got, ok, err := reopened.ConsumePendingCityRequestID(cityPath)
+	if err != nil {
+		t.Fatalf("ConsumePendingCityRequestID: %v", err)
+	}
+	if !ok {
+		t.Fatal("pending request ID was not persisted")
+	}
+	if got != "req-alpha" {
+		t.Fatalf("request ID = %q, want req-alpha", got)
+	}
+
+	if got, ok, err := reopened.ConsumePendingCityRequestID(cityPath); err != nil || ok || got != "" {
+		t.Fatalf("second consume = (%q, %t, %v), want empty false nil", got, ok, err)
+	}
+}
+
+func TestRegistryStorePendingCityRequestIDRejectsDuplicatePath(t *testing.T) {
+	dir := t.TempDir()
+	r := NewRegistry(filepath.Join(dir, "cities.toml"))
+
+	cityPath := filepath.Join(dir, "cities", "alpha")
+	if err := os.MkdirAll(cityPath, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := r.StorePendingCityRequestID(cityPath, "req-first"); err != nil {
+		t.Fatalf("StorePendingCityRequestID first: %v", err)
+	}
+	err := r.StorePendingCityRequestID(cityPath, "req-second")
+	if !errors.Is(err, ErrPendingCityRequestExists) {
+		t.Fatalf("StorePendingCityRequestID duplicate error = %v, want ErrPendingCityRequestExists", err)
+	}
+
+	got, ok, err := r.ConsumePendingCityRequestID(cityPath)
+	if err != nil {
+		t.Fatalf("ConsumePendingCityRequestID: %v", err)
+	}
+	if !ok || got != "req-first" {
+		t.Fatalf("consumed pending request = (%q, %t), want req-first true", got, ok)
+	}
+}
+
 func TestRegistryUnregisterNotFound(t *testing.T) {
 	dir := t.TempDir()
 	r := NewRegistry(filepath.Join(dir, "cities.toml"))
diff --git a/internal/testenv/lint_test.go b/internal/testenv/lint_test.go
index 3584b96931..d1c8ccbea9 100644
--- a/internal/testenv/lint_test.go
+++ b/internal/testenv/lint_test.go
@@ -36,18 +36,12 @@ func TestRequiresDedicatedTestenvImportFile(t *testing.T) {
 	dirInfos := map[string]*dirInfo{}
 	var strayImports []string
 
-	skipDirs := map[string]bool{
-		"vendor":       true,
-		"node_modules": true,
-		".git":         true,
-	}
-
 	walkErr := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
 		if d.IsDir() {
-			if skipDirs[d.Name()] {
+			if skipRepoLintDir(d.Name()) {
 				return filepath.SkipDir
 			}
 			return nil
@@ -175,18 +169,13 @@ func TestNoLeakVectorReadsAtPackageInit(t *testing.T) {
 	for _, name := range testenv.LeakVectorVars {
 		leakVars[name] = true
 	}
-	skipDirs := map[string]bool{
-		"vendor":       true,
-		"node_modules": true,
-		".git":         true,
-	}
 	var offenders []string
 	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
 		if d.IsDir() {
-			if skipDirs[d.Name()] {
+			if skipRepoLintDir(d.Name()) {
 				return filepath.SkipDir
 			}
 			return nil
@@ -233,6 +222,16 @@ func TestNoLeakVectorReadsAtPackageInit(t *testing.T) {
 	}
 }
 
+func skipRepoLintDir(name string) bool {
+	if name == "vendor" || name == "node_modules" {
+		return true
+	}
+	if strings.HasPrefix(name, ".") || strings.HasPrefix(name, "_") {
+		return true
+	}
+	return name == "worktrees" || strings.HasPrefix(name, "worktree-")
+}
+
 // repoRoot returns the repository root by asking git. Falls back to walking up
 // from this file looking for go.mod if git is unavailable.
 func repoRoot(t *testing.T) string {
diff --git a/internal/testenv/testenv.go b/internal/testenv/testenv.go
index f29d8b24f3..c7134602e7 100644
--- a/internal/testenv/testenv.go
+++ b/internal/testenv/testenv.go
@@ -28,12 +28,13 @@
 //
 // Passthrough: a parent that intentionally launches a helper subprocess
 // with seeded leak-vector vars (e.g. workspacesvc's proxy_process tests,
-// where proxy_process.go seeds GC_CITY/GC_CITY_PATH/GC_CITY_RUNTIME_DIR
-// into the child env) can set GC_TESTENV_PASSTHROUGH in the child env to
-// a comma-separated list of leak-vector var names. init() preserves only
-// those named vars and scrubs the rest. The passthrough var itself is
-// always unset so the child cannot propagate the list further. Unlike a
-// blanket bypass, every surviving GC_* must be explicitly declared.
+// where proxy_process.go seeds GC_CITY/GC_CITY_PATH/GC_CITY_RUNTIME_DIR/
+// GC_CONTROL_DISPATCHER_TRACE_DEFAULT into the child env) can set
+// GC_TESTENV_PASSTHROUGH in the child env to a comma-separated list of
+// leak-vector var names. init() preserves only those named vars and scrubs
+// the rest. The passthrough var itself is always unset so the child cannot
+// propagate the list further. Unlike a blanket bypass, every surviving GC_*
+// must be explicitly declared.
 //
 // Testscript subcommand bypass: when the test binary is re-invoked via
 // rogpeppe/go-internal/testscript's Main as a registered subcommand (e.g.
@@ -81,6 +82,7 @@ var LeakVectorVars = []string{
 	"GC_CITY_PATH",
 	"GC_CITY_ROOT",
 	"GC_CITY_RUNTIME_DIR",
+	"GC_CONTROL_DISPATCHER_TRACE_DEFAULT",
 	"GC_DIR",
 	"GC_HOME",
 	"GC_SESSION_ID",
diff --git a/internal/workdir/workdir_test.go b/internal/workdir/workdir_test.go
index 750c89ec84..c8c3fe91d2 100644
--- a/internal/workdir/workdir_test.go
+++ b/internal/workdir/workdir_test.go
@@ -57,6 +57,49 @@ func TestResolveWorkDirPathUsesPoolInstanceBase(t *testing.T) {
 	}
 }
 
+// TestResolveWorkDirPathGivesEachPoolSlotUniqueWorktree is the #774 regression
+// guard: N pool workers sharing one template must each resolve to a distinct
+// worktree path derived from their namepool slot, not the template base.
+func TestResolveWorkDirPathGivesEachPoolSlotUniqueWorktree(t *testing.T) {
+	cityPath := t.TempDir()
+	rigs := []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}}
+	agent := config.Agent{
+		Name:              "ant",
+		Dir:               "demo",
+		WorkDir:           ".gc/worktrees/{{.Rig}}/ants/{{.AgentBase}}",
+		MinActiveSessions: intPtr(0),
+		MaxActiveSessions: intPtr(4),
+	}
+
+	cases := []struct {
+		slot string
+		want string
+	}{
+		{slot: "demo/ant-fenrir", want: filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant-fenrir")},
+		{slot: "demo/ant-grendel", want: filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant-grendel")},
+		{slot: "demo/ant-hati", want: filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant-hati")},
+		{slot: "demo/ant-skoll", want: filepath.Join(cityPath, ".gc", "worktrees", "demo", "ants", "ant-skoll")},
+	}
+
+	seen := make(map[string]string, len(cases))
+	for _, tc := range cases {
+		t.Run(tc.slot, func(t *testing.T) {
+			got := ResolveWorkDirPath(cityPath, "gastown", tc.slot, agent, rigs)
+			if got != tc.want {
+				t.Fatalf("ResolveWorkDirPath(%q) = %q, want %q", tc.slot, got, tc.want)
+			}
+			if prev, dup := seen[got]; dup {
+				t.Fatalf("slot %q collided with %q on path %q", tc.slot, prev, got)
+			}
+			seen[got] = tc.slot
+		})
+	}
+
+	if len(seen) != len(cases) {
+		t.Fatalf("unique paths = %d, want %d", len(seen), len(cases))
+	}
+}
+
 func TestSessionQualifiedNameCanonicalizesBareAndQualifiedPoolAliases(t *testing.T) {
 	cityPath := t.TempDir()
 	rigs := []config.Rig{{Name: "demo", Path: filepath.Join(cityPath, "repos", "demo")}}
diff --git a/internal/worker/builtin/profiles.go b/internal/worker/builtin/profiles.go
index 7638b18492..955fe38d3c 100644
--- a/internal/worker/builtin/profiles.go
+++ b/internal/worker/builtin/profiles.go
@@ -22,9 +22,10 @@ type BuiltinProviderOption struct {
 //
 //nolint:revive // Mirrors the config boundary naming intentionally.
 type BuiltinOptionChoice struct {
-	Value    string
-	Label    string
-	FlagArgs []string
+	Value       string
+	Label       string
+	FlagArgs    []string
+	FlagAliases [][]string
 }
 
 // BuiltinProviderSpec is the canonical builtin worker materialization source.
@@ -139,9 +140,9 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 				Type:  "select",
 				Choices: []BuiltinOptionChoice{
 					{Value: "", Label: "Default"},
-					{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-6"}},
-					{Value: "sonnet", Label: "Sonnet", FlagArgs: []string{"--model", "claude-sonnet-4-6"}},
-					{Value: "haiku", Label: "Haiku", FlagArgs: []string{"--model", "claude-haiku-4-5-20251001"}},
+					{Value: "opus", Label: "Opus", FlagArgs: []string{"--model", "claude-opus-4-7"}, FlagAliases: [][]string{{"-m", "claude-opus-4-7"}}},
+					{Value: "sonnet", Label: "Sonnet", FlagArgs: []string{"--model", "claude-sonnet-4-6"}, FlagAliases: [][]string{{"-m", "claude-sonnet-4-6"}}},
+					{Value: "haiku", Label: "Haiku", FlagArgs: []string{"--model", "claude-haiku-4-5-20251001"}, FlagAliases: [][]string{{"-m", "claude-haiku-4-5-20251001"}}},
 				},
 			},
 		},
@@ -187,9 +188,10 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 				Type:  "select",
 				Choices: []BuiltinOptionChoice{
 					{Value: "", Label: "Default"},
-					{Value: "gpt-5.5", Label: "GPT-5.5", FlagArgs: []string{"--model", "gpt-5.5"}},
-					{Value: "o3", Label: "o3", FlagArgs: []string{"--model", "o3"}},
-					{Value: "o4-mini", Label: "o4-mini", FlagArgs: []string{"--model", "o4-mini"}},
+					{Value: "gpt-5.5", Label: "GPT-5.5", FlagArgs: []string{"--model", "gpt-5.5"}, FlagAliases: [][]string{{"-m", "gpt-5.5"}}},
+					{Value: "gpt-5.3-codex-spark", Label: "GPT-5.3 Codex Spark", FlagArgs: []string{"--model", "gpt-5.3-codex-spark"}, FlagAliases: [][]string{{"-m", "gpt-5.3-codex-spark"}}},
+					{Value: "o3", Label: "o3", FlagArgs: []string{"--model", "o3"}, FlagAliases: [][]string{{"-m", "o3"}}},
+					{Value: "o4-mini", Label: "o4-mini", FlagArgs: []string{"--model", "o4-mini"}, FlagAliases: [][]string{{"-m", "o4-mini"}}},
 				},
 			},
 			{
@@ -208,10 +210,10 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 				Type:  "select",
 				Choices: []BuiltinOptionChoice{
 					{Value: "", Label: "Default"},
-					{Value: "low", Label: "Low", FlagArgs: []string{"-c", "model_reasoning_effort=low"}},
-					{Value: "medium", Label: "Medium", FlagArgs: []string{"-c", "model_reasoning_effort=medium"}},
-					{Value: "high", Label: "High", FlagArgs: []string{"-c", "model_reasoning_effort=high"}},
-					{Value: "xhigh", Label: "Extra High", FlagArgs: []string{"-c", "model_reasoning_effort=xhigh"}},
+					{Value: "low", Label: "Low", FlagArgs: []string{"-c", "model_reasoning_effort=low"}, FlagAliases: [][]string{{"-c", "model_reasoning_effort=\"low\""}}},
+					{Value: "medium", Label: "Medium", FlagArgs: []string{"-c", "model_reasoning_effort=medium"}, FlagAliases: [][]string{{"-c", "model_reasoning_effort=\"medium\""}}},
+					{Value: "high", Label: "High", FlagArgs: []string{"-c", "model_reasoning_effort=high"}, FlagAliases: [][]string{{"-c", "model_reasoning_effort=\"high\""}}},
+					{Value: "xhigh", Label: "Extra High", FlagArgs: []string{"-c", "model_reasoning_effort=xhigh"}, FlagAliases: [][]string{{"-c", "model_reasoning_effort=\"xhigh\""}}},
 				},
 			},
 		},
@@ -257,8 +259,8 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 				Type:  "select",
 				Choices: []BuiltinOptionChoice{
 					{Value: "", Label: "Default"},
-					{Value: "gemini-2.5-pro", Label: "Gemini 2.5 Pro", FlagArgs: []string{"--model", "gemini-2.5-pro"}},
-					{Value: "gemini-2.5-flash", Label: "Gemini 2.5 Flash", FlagArgs: []string{"--model", "gemini-2.5-flash"}},
+					{Value: "gemini-2.5-pro", Label: "Gemini 2.5 Pro", FlagArgs: []string{"--model", "gemini-2.5-pro"}, FlagAliases: [][]string{{"-m", "gemini-2.5-pro"}}},
+					{Value: "gemini-2.5-flash", Label: "Gemini 2.5 Flash", FlagArgs: []string{"--model", "gemini-2.5-flash"}, FlagAliases: [][]string{{"-m", "gemini-2.5-flash"}}},
 				},
 			},
 		},
@@ -275,10 +277,18 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 		InstructionsFile:  "AGENTS.md",
 	},
 	"copilot": {
-		DisplayName:       "GitHub Copilot",
-		Command:           "copilot",
-		Args:              []string{"--yolo"},
-		PromptMode:        "arg",
+		DisplayName: "GitHub Copilot",
+		Command:     "copilot",
+		Args:        []string{"--yolo"},
+		// PromptMode "none" delivers the prompt via tmux send-keys after the
+		// ready prefix is detected (Step 6 in doStartSession), instead of
+		// appending to argv. Required for copilot CLI 1.0.x which rejects
+		// positional prompt arguments ("error: too many arguments"). The old
+		// 0.0.x line accepted argv prompts; the rewrite in 1.0 made -p the
+		// only non-interactive entry, but -p exits after completion and
+		// breaks the long-running session contract gascity needs. Using
+		// "none" + send-keys preserves the interactive REPL.
+		PromptMode:        "none",
 		ReadyPromptPrefix: "\u276f ",
 		ReadyDelayMs:      5000,
 		ProcessNames:      []string{"copilot"},
@@ -297,13 +307,16 @@ var builtinProviderSpecs = map[string]BuiltinProviderSpec{
 		DisplayName:      "OpenCode",
 		Command:          "opencode",
 		Args:             []string{},
-		PromptMode:       "none",
+		PromptMode:       "flag",
+		PromptFlag:       "--prompt",
 		ReadyDelayMs:     8000,
 		ProcessNames:     []string{"opencode", "node", "bun"},
 		Env:              map[string]string{"OPENCODE_PERMISSION": `{"*":"allow"}`},
 		SupportsACP:      true,
 		SupportsHooks:    true,
 		InstructionsFile: "AGENTS.md",
+		ResumeFlag:       "--session",
+		ResumeStyle:      "flag",
 		ACPArgs:          []string{"acp"},
 	},
 	"auggie": {
@@ -360,23 +373,25 @@ func BuiltinProviders() map[string]BuiltinProviderSpec {
 func CanonicalProfileIdentity(profile string) (ProfileIdentity, bool) {
 	switch profile {
 	case "claude/tmux-cli":
-		return newProfileIdentity(profile, "claude", "tmux-cli"), true
+		return newProfileIdentity(profile, "claude"), true
 	case "codex/tmux-cli":
-		return newProfileIdentity(profile, "codex", "tmux-cli"), true
+		return newProfileIdentity(profile, "codex"), true
 	case "gemini/tmux-cli":
-		return newProfileIdentity(profile, "gemini", "tmux-cli"), true
+		return newProfileIdentity(profile, "gemini"), true
+	case "opencode/tmux-cli":
+		return newProfileIdentity(profile, "opencode"), true
 	default:
 		return ProfileIdentity{}, false
 	}
 }
 
-func newProfileIdentity(profile, family, transport string) ProfileIdentity {
+func newProfileIdentity(profile, family string) ProfileIdentity {
 	compatibility := fmt.Sprintf("%s|behavior=%s|transcript=%s", profile, canonicalBehaviorClaimsVersion, canonicalTranscriptAdapterVersion)
 	sum := sha256.Sum256([]byte(compatibility))
 	return ProfileIdentity{
 		Profile:                  profile,
 		ProviderFamily:           family,
-		TransportClass:           transport,
+		TransportClass:           "tmux-cli",
 		BehaviorClaimsVersion:    canonicalBehaviorClaimsVersion,
 		TranscriptAdapterVersion: canonicalTranscriptAdapterVersion,
 		CompatibilityVersion:     compatibility,
@@ -420,9 +435,10 @@ func cloneBuiltinChoices(choices []BuiltinOptionChoice) []BuiltinOptionChoice {
 	out := make([]BuiltinOptionChoice, len(choices))
 	for i, choice := range choices {
 		out[i] = BuiltinOptionChoice{
-			Value:    choice.Value,
-			Label:    choice.Label,
-			FlagArgs: cloneStrings(choice.FlagArgs),
+			Value:       choice.Value,
+			Label:       choice.Label,
+			FlagArgs:    cloneStrings(choice.FlagArgs),
+			FlagAliases: cloneStringSlices(choice.FlagAliases),
 		}
 	}
 	return out
@@ -447,3 +463,14 @@ func cloneStrings(values []string) []string {
 	copy(out, values)
 	return out
 }
+
+func cloneStringSlices(values [][]string) [][]string {
+	if values == nil {
+		return nil
+	}
+	out := make([][]string, len(values))
+	for i := range values {
+		out[i] = cloneStrings(values[i])
+	}
+	return out
+}
diff --git a/internal/worker/factory.go b/internal/worker/factory.go
index 26ff7afc39..6dec4f9393 100644
--- a/internal/worker/factory.go
+++ b/internal/worker/factory.go
@@ -98,13 +98,23 @@ func (f *Factory) Session(spec SessionSpec) (*SessionHandle, error) {
 // SessionByID rebuilds a session-backed worker handle from persisted session
 // metadata and the factory's optional resolved-runtime hook.
 func (f *Factory) SessionByID(id string) (Handle, error) {
-	info, err := f.manager.Get(id)
+	info, bead, err := f.manager.GetWithBead(id)
 	if err != nil {
 		return nil, err
 	}
+	return f.sessionFromInfoAndBead(info, bead)
+}
+
+// SessionByLoadedBead is like SessionByID but uses an already-loaded bead,
+// avoiding a redundant store.Get for callers that just resolved it (e.g.
+// via session.ResolveSessionBeadByExactID).
+func (f *Factory) SessionByLoadedBead(bead beads.Bead) (Handle, error) {
+	return f.sessionFromInfoAndBead(f.manager.SessionInfoFromBead(bead), bead)
+}
 
+func (f *Factory) sessionFromInfoAndBead(info sessionpkg.Info, bead beads.Bead) (Handle, error) {
 	spec := SessionSpec{
-		ID:       id,
+		ID:       info.ID,
 		Template: info.Template,
 		Title:    info.Title,
 		Alias:    info.Alias,
@@ -117,17 +127,11 @@ func (f *Factory) SessionByID(id string) (Handle, error) {
 			ResumeCommand: info.ResumeCommand,
 		},
 	}
-	sessionKind := ""
-	var metadata map[string]string
-	if f.store != nil {
-		if bead, beadErr := f.store.Get(id); beadErr == nil {
-			sessionKind = strings.TrimSpace(bead.Metadata["mc_session_kind"])
-			if profile := strings.TrimSpace(bead.Metadata["worker_profile"]); profile != "" {
-				spec.Profile = Profile(profile)
-			}
-			metadata = cloneStringMap(bead.Metadata)
-		}
+	sessionKind := strings.TrimSpace(bead.Metadata["real_world_app_session_kind"])
+	if profile := strings.TrimSpace(bead.Metadata["worker_profile"]); profile != "" {
+		spec.Profile = Profile(profile)
 	}
+	metadata := cloneStringMap(bead.Metadata)
 	if f.resolveSessionRuntime != nil {
 		resolved, err := f.resolveSessionRuntime(info, sessionKind, metadata)
 		if err != nil {
diff --git a/internal/worker/factory_test.go b/internal/worker/factory_test.go
index d58b8523a3..1e00fc1300 100644
--- a/internal/worker/factory_test.go
+++ b/internal/worker/factory_test.go
@@ -136,8 +136,8 @@ func TestFactorySessionByIDResolvesSessionRuntime(t *testing.T) {
 	if err != nil {
 		t.Fatalf("CreateBeadOnly: %v", err)
 	}
-	if err := store.SetMetadata(info.ID, "mc_session_kind", "provider"); err != nil {
-		t.Fatalf("SetMetadata(mc_session_kind): %v", err)
+	if err := store.SetMetadata(info.ID, "real_world_app_session_kind", "provider"); err != nil {
+		t.Fatalf("SetMetadata(real_world_app_session_kind): %v", err)
 	}
 	if err := store.SetMetadata(info.ID, "worker_profile", string(ProfileClaudeTmuxCLI)); err != nil {
 		t.Fatalf("SetMetadata(worker_profile): %v", err)
diff --git a/internal/worker/handle_clone.go b/internal/worker/handle_clone.go
index 4bbf15c13f..b54c39b52d 100644
--- a/internal/worker/handle_clone.go
+++ b/internal/worker/handle_clone.go
@@ -8,6 +8,8 @@ func profileFamily(profile Profile) string {
 		return "codex"
 	case ProfileGeminiTmuxCLI:
 		return "gemini"
+	case ProfileOpenCodeTmuxCLI:
+		return "opencode"
 	case ProfileClaudeTmuxCLI:
 		return "claude"
 	default:
diff --git a/internal/worker/handle_test.go b/internal/worker/handle_test.go
index c78c8bf1c3..23b9fd81ab 100644
--- a/internal/worker/handle_test.go
+++ b/internal/worker/handle_test.go
@@ -551,6 +551,22 @@ func TestCanonicalProfileIdentity(t *testing.T) {
 	}
 }
 
+func TestCanonicalProfileIdentityOpenCode(t *testing.T) {
+	identity, ok := CanonicalProfileIdentity(ProfileOpenCodeTmuxCLI)
+	if !ok {
+		t.Fatal("CanonicalProfileIdentity(ProfileOpenCodeTmuxCLI) = false, want true")
+	}
+	if identity.ProviderFamily != "opencode" {
+		t.Fatalf("ProviderFamily = %q, want opencode", identity.ProviderFamily)
+	}
+	if identity.TransportClass != "tmux-cli" {
+		t.Fatalf("TransportClass = %q, want tmux-cli", identity.TransportClass)
+	}
+	if identity.CertificationFingerprint == "" {
+		t.Fatal("CertificationFingerprint is empty")
+	}
+}
+
 func TestSessionHandleMessageInterruptNowUsesWorkerBoundary(t *testing.T) {
 	handle, _, sp, mgr := newTestSessionHandle(t, SessionSpec{
 		Profile:  ProfileClaudeTmuxCLI,
diff --git a/internal/worker/observe.go b/internal/worker/observe.go
index 4b8aaefd8b..fda98924ac 100644
--- a/internal/worker/observe.go
+++ b/internal/worker/observe.go
@@ -41,10 +41,7 @@ func (h *SessionHandle) LiveObservation(_ context.Context) (LiveObservation, err
 	if err != nil {
 		return LiveObservation{}, err
 	}
-	runtimeObs, err := h.manager.ObserveRuntime(id, h.runtimeHints().ProcessNames)
-	if err != nil {
-		return LiveObservation{}, err
-	}
+	runtimeObs := h.manager.ObserveRuntimeForInfo(info, h.runtimeHints().ProcessNames)
 	obs := LiveObservation{
 		Running:          runtimeObs.Running,
 		Alive:            runtimeObs.Alive,
diff --git a/internal/worker/provider_resume.go b/internal/worker/provider_resume.go
index 5788324b82..31d1cb4afa 100644
--- a/internal/worker/provider_resume.go
+++ b/internal/worker/provider_resume.go
@@ -12,7 +12,11 @@ func derivedResumeSessionKey(provider, providerSessionID string) string {
 	if providerSessionID == "" {
 		return ""
 	}
-	if !strings.Contains(strings.ToLower(strings.TrimSpace(provider)), "codex") {
+	providerFamily := strings.ToLower(strings.TrimSpace(provider))
+	if strings.Contains(providerFamily, "opencode") {
+		return providerSessionID
+	}
+	if !strings.Contains(providerFamily, "codex") {
 		return ""
 	}
 	matches := codexThreadIDPattern.FindAllString(providerSessionID, -1)
diff --git a/internal/worker/provider_resume_test.go b/internal/worker/provider_resume_test.go
new file mode 100644
index 0000000000..48f6010e77
--- /dev/null
+++ b/internal/worker/provider_resume_test.go
@@ -0,0 +1,17 @@
+package worker
+
+import "testing"
+
+func TestDerivedResumeSessionKeyOpenCodeUsesProviderSessionID(t *testing.T) {
+	got := derivedResumeSessionKey("opencode/tmux-cli", "ses_21523e55fffeqoQOyaIoQtfdf5")
+	if got != "ses_21523e55fffeqoQOyaIoQtfdf5" {
+		t.Fatalf("derivedResumeSessionKey(opencode) = %q, want provider session id", got)
+	}
+}
+
+func TestDerivedResumeSessionKeyNonResumeProviderStaysEmpty(t *testing.T) {
+	got := derivedResumeSessionKey("gemini/tmux-cli", "ses_21523e55fffeqoQOyaIoQtfdf5")
+	if got != "" {
+		t.Fatalf("derivedResumeSessionKey(gemini) = %q, want empty", got)
+	}
+}
diff --git a/internal/worker/sessionlog_adapter.go b/internal/worker/sessionlog_adapter.go
index 9abdcaff7d..6ead517358 100644
--- a/internal/worker/sessionlog_adapter.go
+++ b/internal/worker/sessionlog_adapter.go
@@ -28,6 +28,7 @@ type TranscriptRequest struct {
 	TranscriptPath  string
 	TailCompactions int
 	BeforeEntryID   string
+	AfterEntryID    string
 	Raw             bool
 }
 
@@ -135,11 +136,16 @@ func (a SessionLogAdapter) ReadTranscript(req TranscriptRequest) (*TranscriptRes
 		err  error
 	)
 	beforeID := strings.TrimSpace(req.BeforeEntryID)
+	afterID := strings.TrimSpace(req.AfterEntryID)
 	switch {
+	case req.Raw && afterID != "":
+		sess, err = sessionlog.ReadProviderFileRawNewer(req.Provider, path, req.TailCompactions, afterID)
 	case req.Raw && beforeID != "":
 		sess, err = sessionlog.ReadProviderFileRawOlder(req.Provider, path, req.TailCompactions, beforeID)
 	case req.Raw:
 		sess, err = sessionlog.ReadProviderFileRaw(req.Provider, path, req.TailCompactions)
+	case afterID != "":
+		sess, err = sessionlog.ReadProviderFileNewer(req.Provider, path, req.TailCompactions, afterID)
 	case beforeID != "":
 		sess, err = sessionlog.ReadProviderFileOlder(req.Provider, path, req.TailCompactions, beforeID)
 	default:
diff --git a/internal/worker/transcript/discovery.go b/internal/worker/transcript/discovery.go
index bf46093828..ac2e0b85c5 100644
--- a/internal/worker/transcript/discovery.go
+++ b/internal/worker/transcript/discovery.go
@@ -11,7 +11,7 @@ import (
 // transcript identifier that should be preferred over workdir-only discovery.
 func SupportsIDLookup(provider string) bool {
 	switch providerFamily(provider) {
-	case "codex", "gemini":
+	case "codex", "gemini", "opencode":
 		return false
 	default:
 		return true
@@ -53,6 +53,8 @@ func providerFamily(provider string) string {
 		return "codex"
 	case strings.Contains(lower, "gemini"):
 		return "gemini"
+	case strings.Contains(lower, "opencode"):
+		return "opencode"
 	default:
 		return "claude"
 	}
diff --git a/internal/worker/transcript/discovery_test.go b/internal/worker/transcript/discovery_test.go
index 642865ba29..29e25ffc75 100644
--- a/internal/worker/transcript/discovery_test.go
+++ b/internal/worker/transcript/discovery_test.go
@@ -130,6 +130,34 @@ func TestDiscoverPathCodexIgnoresGCSessionID(t *testing.T) {
 	}
 }
 
+func TestDiscoverPathClaudeDoesNotScanCodexFallback(t *testing.T) {
+	base := t.TempDir()
+	workDir := filepath.Join(t.TempDir(), "claude-project")
+
+	payload, err := json.Marshal(map[string]any{
+		"type": "session_meta",
+		"payload": map[string]string{
+			"cwd": workDir,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	codexRoot := filepath.Join(base, "sessions")
+	codexDir := filepath.Join(codexRoot, "2026", "04", "18")
+	if err := os.MkdirAll(codexDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(codexDir, "session.jsonl"), append(payload, '\n'), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got := DiscoverPath([]string{codexRoot}, "claude/tmux-cli", workDir, "")
+	if got != "" {
+		t.Fatalf("DiscoverPath() = %q, want no Codex fallback for explicit Claude provider", got)
+	}
+}
+
 func TestSupportsIDLookup(t *testing.T) {
 	tests := []struct {
 		provider string
@@ -138,6 +166,7 @@ func TestSupportsIDLookup(t *testing.T) {
 		{provider: "claude/tmux-cli", want: true},
 		{provider: "codex/tmux-cli", want: false},
 		{provider: "gemini/tmux-cli", want: false},
+		{provider: "opencode/tmux-cli", want: false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.provider, func(t *testing.T) {
diff --git a/internal/worker/types.go b/internal/worker/types.go
index 0cf4fbb5d7..a3bbeda5de 100644
--- a/internal/worker/types.go
+++ b/internal/worker/types.go
@@ -11,9 +11,10 @@ type Profile string
 // revive:disable:exported
 const ( //nolint:revive // exported enum values are documented by the enclosing type.
 	// Profile* identify the supported canonical worker profiles.
-	ProfileClaudeTmuxCLI Profile = "claude/tmux-cli"
-	ProfileCodexTmuxCLI  Profile = "codex/tmux-cli"
-	ProfileGeminiTmuxCLI Profile = "gemini/tmux-cli"
+	ProfileClaudeTmuxCLI   Profile = "claude/tmux-cli"
+	ProfileCodexTmuxCLI    Profile = "codex/tmux-cli"
+	ProfileGeminiTmuxCLI   Profile = "gemini/tmux-cli"
+	ProfileOpenCodeTmuxCLI Profile = "opencode/tmux-cli"
 )
 
 // CapabilityStatus expresses whether a Phase 1 capability is available.
diff --git a/internal/worker/workertest/catalog_phase2_data.go b/internal/worker/workertest/catalog_phase2_data.go
index 5d5c044d0f..2b0f4f5241 100644
--- a/internal/worker/workertest/catalog_phase2_data.go
+++ b/internal/worker/workertest/catalog_phase2_data.go
@@ -28,6 +28,7 @@ var phase2CatalogProfiles = []ProfileID{
 	ProfileClaudeTmuxCLI,
 	ProfileCodexTmuxCLI,
 	ProfileGeminiTmuxCLI,
+	ProfileOpenCodeTmuxCLI,
 }
 
 var phase2CatalogOnce struct {
diff --git a/internal/worker/workertest/phase1_conformance_test.go b/internal/worker/workertest/phase1_conformance_test.go
index 3fd8f0cd7a..389f7af56d 100644
--- a/internal/worker/workertest/phase1_conformance_test.go
+++ b/internal/worker/workertest/phase1_conformance_test.go
@@ -35,8 +35,8 @@ func TestPhase1CatalogProfilesStayAligned(t *testing.T) {
 	}
 
 	profiles := Phase1Profiles()
-	if len(profiles) != 3 {
-		t.Fatalf("profiles = %d, want 3", len(profiles))
+	if len(profiles) != 4 {
+		t.Fatalf("profiles = %d, want 4", len(profiles))
 	}
 	for _, profile := range profiles {
 		if profile.Continuation.AnchorText == "" {
diff --git a/internal/worker/workertest/phase2_fake_worker_test.go b/internal/worker/workertest/phase2_fake_worker_test.go
index e1d468a959..3cc014d701 100644
--- a/internal/worker/workertest/phase2_fake_worker_test.go
+++ b/internal/worker/workertest/phase2_fake_worker_test.go
@@ -32,9 +32,9 @@ var (
 )
 
 const (
-	fakeStartupGateTimeout         = 2 * time.Second
-	fakeStartupLaunchBound         = 750 * time.Millisecond
-	fakeStartupPostControlOverhead = 250 * time.Millisecond
+	fakeStartupGateTimeout         = 10 * time.Second
+	fakeStartupLaunchBound         = 5 * time.Second
+	fakeStartupPostControlOverhead = 2 * time.Second
 	fakeInteractionSignalBound     = 2 * time.Second
 )
 
@@ -87,7 +87,9 @@ func runFakeStartup(t *testing.T, profile ProfileID, outcome string, delay time.
 		t.Fatalf("write fake config: %v", err)
 	}
 
-	cmd := exec.CommandContext(context.Background(), fakeWorkerBinary(t))
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	cmd := exec.CommandContext(ctx, fakeWorkerBinary(t))
 	cmd.Env = append(os.Environ(),
 		"GC_FAKE_WORKER_CONFIG="+configPath,
 		"GC_FAKE_WORKER_START_FILE="+startFile,
@@ -104,7 +106,24 @@ func runFakeStartup(t *testing.T, profile ProfileID, outcome string, delay time.
 	waitCh := make(chan error, 1)
 	go func() {
 		waitCh <- cmd.Wait()
+		close(waitCh)
 	}()
+	t.Cleanup(func() {
+		select {
+		case <-waitCh:
+			return
+		default:
+		}
+		cancel()
+		select {
+		case <-waitCh:
+		case <-time.After(2 * time.Second):
+			if cmd.Process != nil {
+				_ = cmd.Process.Kill()
+			}
+			<-waitCh
+		}
+	})
 
 	waitEvent := waitForWorkerFakeEvent(t, eventPath, "control_waiting", fakeStartupGateTimeout)
 	launchToWait := time.Since(launchStart)
diff --git a/internal/worker/workertest/phase2_result_helpers_test.go b/internal/worker/workertest/phase2_result_helpers_test.go
index 13915e13c9..4ddff097c9 100644
--- a/internal/worker/workertest/phase2_result_helpers_test.go
+++ b/internal/worker/workertest/phase2_result_helpers_test.go
@@ -361,7 +361,7 @@ func historyDiagnosticsResult(profile ProfileID, transcriptPath string, history
 	evidence := historyDiagnosticsEvidence(transcriptPath, history)
 	if loadErr != nil {
 		evidence["load_error"] = loadErr.Error()
-		if profile == ProfileGeminiTmuxCLI {
+		if profile == ProfileGeminiTmuxCLI || profile == ProfileOpenCodeTmuxCLI {
 			return Pass(profile, RequirementTranscriptDiagnostics, "malformed single-file transcript failed closed").WithEvidence(evidence)
 		}
 		return Fail(profile, RequirementTranscriptDiagnostics, fmt.Sprintf("LoadHistory: %v", loadErr)).WithEvidence(evidence)
@@ -431,8 +431,8 @@ func expectedHistoryDiagnosticCode(profile ProfileID) string {
 	case ProfileCodexTmuxCLI:
 		return "malformed_jsonl"
 	default:
-		// Gemini stores one JSON document, so malformed/truncated transcript
-		// input fails closed in encoding/json before a diagnostic code exists.
+		// Gemini and OpenCode store one JSON document, so malformed/truncated
+		// transcript input fails closed before a diagnostic code exists.
 		return ""
 	}
 }
diff --git a/internal/worker/workertest/phase2_transcript_helpers_test.go b/internal/worker/workertest/phase2_transcript_helpers_test.go
index fd22b6f720..a8c8d8b8ae 100644
--- a/internal/worker/workertest/phase2_transcript_helpers_test.go
+++ b/internal/worker/workertest/phase2_transcript_helpers_test.go
@@ -36,6 +36,12 @@ func writeMalformedHistoryTranscript(t *testing.T, profile Profile) string {
 			t.Fatalf("write malformed gemini transcript: %v", err)
 		}
 		return path
+	case ProfileOpenCodeTmuxCLI:
+		path := filepath.Join(t.TempDir(), "session.json")
+		if err := os.WriteFile(path, []byte(`{"info":{"id":"malformed-opencode","directory":"/tmp/gascity/phase2/opencode"},"messages":[`), 0o644); err != nil {
+			t.Fatalf("write malformed opencode transcript: %v", err)
+		}
+		return path
 	default:
 		t.Fatalf("unsupported profile %s", profile.ID)
 		return ""
@@ -70,6 +76,11 @@ func writeInteractionHistoryTranscript(t *testing.T, profile Profile) string {
 			t.Fatalf("write gemini interaction transcript: %v", err)
 		}
 		return path
+	case ProfileOpenCodeTmuxCLI:
+		return writeOpenCodeExportTranscript(t, "opencode-interaction-phase2", "/tmp/gascity/phase2/opencode", []string{
+			`{"info":{"id":"msg_user_1","sessionID":"opencode-interaction-phase2","role":"user","time":{"created":1770000000000}},"parts":[{"id":"part_user_1","type":"text","text":"run a tool"}]}`,
+			`{"info":{"id":"msg_assistant_1","sessionID":"opencode-interaction-phase2","role":"assistant","parentID":"msg_user_1","time":{"created":1770000001000}},"parts":[{"id":"part_interaction_1","type":"interaction","request_id":"approval-1","kind":"approval","state":"pending","prompt":"Allow Read?","options":["approve","deny"],"metadata":{"tool_name":"Read"}}]}`,
+		})
 	default:
 		t.Fatalf("unsupported profile %s", profile.ID)
 		return ""
@@ -111,6 +122,11 @@ func writeInteractionLifecycleTranscript(t *testing.T, profile Profile, finalSta
 			t.Fatalf("write gemini interaction lifecycle transcript: %v", err)
 		}
 		return path
+	case ProfileOpenCodeTmuxCLI:
+		return writeOpenCodeExportTranscript(t, "opencode-interaction-lifecycle-phase2", "/tmp/gascity/phase2/opencode", []string{
+			`{"info":{"id":"msg_assistant_1","sessionID":"opencode-interaction-lifecycle-phase2","role":"assistant","time":{"created":1770000000000}},"parts":[{"id":"part_interaction_1","type":"interaction","request_id":"approval-1","kind":"approval","state":"pending","prompt":"Allow Read?","options":["approve","deny"]}]}`,
+			fmt.Sprintf(`{"info":{"id":"msg_user_1","sessionID":"opencode-interaction-lifecycle-phase2","role":"user","parentID":"msg_assistant_1","time":{"created":1770000001000}},"parts":[{"id":"part_interaction_2","type":"interaction","request_id":"approval-1","kind":"approval","state":%q,"action":%q}]}`, finalStateText, finalAction),
+		})
 	default:
 		t.Fatalf("unsupported profile %s", profile.ID)
 		return ""
@@ -163,12 +179,34 @@ func writeToolTranscript(t *testing.T, profile Profile, openTail bool) string {
 			t.Fatalf("write gemini transcript: %v", err)
 		}
 		return path
+	case ProfileOpenCodeTmuxCLI:
+		state := `{"status":"running","input":{"path":"README.md"}}`
+		tail := ""
+		if !openTail {
+			state = `{"status":"completed","input":{"path":"README.md"},"output":"file data"}`
+			tail = `,{"info":{"id":"msg_assistant_2","sessionID":"opencode-tool-phase2","role":"assistant","parentID":"msg_assistant_1","time":{"created":1770000002000}},"parts":[{"id":"part_assistant_2","type":"text","text":"done"}]}`
+		}
+		return writeOpenCodeExportTranscript(t, "opencode-tool-phase2", "/tmp/gascity/phase2/opencode", []string{
+			`{"info":{"id":"msg_user_1","sessionID":"opencode-tool-phase2","role":"user","time":{"created":1770000000000}},"parts":[{"id":"part_user_1","type":"text","text":"read the file"}]}`,
+			`{"info":{"id":"msg_assistant_1","sessionID":"opencode-tool-phase2","role":"assistant","parentID":"msg_user_1","time":{"created":1770000001000}},"parts":[{"id":"part_tool_1","type":"tool","callID":"call-1","tool":"Read","state":` + state + `}]}` + tail,
+		})
 	default:
 		t.Fatalf("unsupported profile %s", profile.ID)
 		return ""
 	}
 }
 
+func writeOpenCodeExportTranscript(t *testing.T, sessionID, workDir string, messages []string) string {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "session.json")
+	body := `{"info":{"id":` + fmt.Sprintf("%q", sessionID) + `,"directory":` + fmt.Sprintf("%q", workDir) + `},"messages":[` + strings.Join(messages, ",") + `]}`
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatalf("write opencode transcript: %v", err)
+	}
+	return path
+}
+
 func writeLinesFile(t *testing.T, rel string, lines []string) string {
 	t.Helper()
 
diff --git a/internal/worker/workertest/profiles.go b/internal/worker/workertest/profiles.go
index 97169967d0..e659c0c5e0 100644
--- a/internal/worker/workertest/profiles.go
+++ b/internal/worker/workertest/profiles.go
@@ -6,9 +6,10 @@ type ProfileID string
 // revive:disable:exported
 const ( //nolint:revive // exported profile IDs are documented by the enclosing type.
 	// Profile* identify the canonical worker profiles used by conformance tests.
-	ProfileClaudeTmuxCLI ProfileID = "claude/tmux-cli"
-	ProfileCodexTmuxCLI  ProfileID = "codex/tmux-cli"
-	ProfileGeminiTmuxCLI ProfileID = "gemini/tmux-cli"
+	ProfileClaudeTmuxCLI   ProfileID = "claude/tmux-cli"
+	ProfileCodexTmuxCLI    ProfileID = "codex/tmux-cli"
+	ProfileGeminiTmuxCLI   ProfileID = "gemini/tmux-cli"
+	ProfileOpenCodeTmuxCLI ProfileID = "opencode/tmux-cli"
 )
 
 // revive:enable:exported
@@ -88,5 +89,21 @@ func Phase1Profiles() []Profile {
 				ResetResponseContains:  "I cannot repeat the earlier fixture summary because this chat is fresh.",
 			},
 		},
+		{
+			ID:       ProfileOpenCodeTmuxCLI,
+			Provider: "opencode/tmux-cli",
+			WorkDir:  "/tmp/gascity/phase1/opencode",
+			Fixtures: ProfileFixtureSet{
+				FreshRoot:        "testdata/fixtures/opencode/fresh",
+				ContinuationRoot: "testdata/fixtures/opencode/continuation",
+				ResetRoot:        "testdata/fixtures/opencode/reset",
+			},
+			Continuation: ContinuationOracle{
+				AnchorText:             "OpenCode phase 1 validates the tmux CLI transcript contract.",
+				RecallPromptContains:   "Repeat the exact OpenCode phase-1 summary from earlier before answering.",
+				RecallResponseContains: "OpenCode phase 1 validates the tmux CLI transcript contract.",
+				ResetResponseContains:  "I cannot repeat the earlier OpenCode summary because this session started fresh.",
+			},
+		},
 	}
 }
diff --git a/internal/worker/workertest/testdata/fixtures/opencode/continuation/session-opencode-phase1.json b/internal/worker/workertest/testdata/fixtures/opencode/continuation/session-opencode-phase1.json
new file mode 100644
index 0000000000..15436817d4
--- /dev/null
+++ b/internal/worker/workertest/testdata/fixtures/opencode/continuation/session-opencode-phase1.json
@@ -0,0 +1,55 @@
+{
+  "info": {
+    "id": "ses_opencode_phase1",
+    "directory": "/tmp/gascity/phase1/opencode"
+  },
+  "messages": [
+    {
+      "info": {
+        "id": "msg_user_1",
+        "sessionID": "ses_opencode_phase1",
+        "role": "user",
+        "time": {"created": 1770000000000}
+      },
+      "parts": [
+        {"id": "part_user_1", "type": "text", "text": "Summarize the OpenCode worker transcript contract."}
+      ]
+    },
+    {
+      "info": {
+        "id": "msg_assistant_1",
+        "sessionID": "ses_opencode_phase1",
+        "role": "assistant",
+        "parentID": "msg_user_1",
+        "time": {"created": 1770000001000}
+      },
+      "parts": [
+        {"id": "part_assistant_1", "type": "text", "text": "OpenCode phase 1 validates the tmux CLI transcript contract."}
+      ]
+    },
+    {
+      "info": {
+        "id": "msg_user_2",
+        "sessionID": "ses_opencode_phase1",
+        "role": "user",
+        "parentID": "msg_assistant_1",
+        "time": {"created": 1770000002000}
+      },
+      "parts": [
+        {"id": "part_user_2", "type": "text", "text": "Repeat the exact OpenCode phase-1 summary from earlier before answering."}
+      ]
+    },
+    {
+      "info": {
+        "id": "msg_assistant_2",
+        "sessionID": "ses_opencode_phase1",
+        "role": "assistant",
+        "parentID": "msg_user_2",
+        "time": {"created": 1770000003000}
+      },
+      "parts": [
+        {"id": "part_assistant_2", "type": "text", "text": "OpenCode phase 1 validates the tmux CLI transcript contract."}
+      ]
+    }
+  ]
+}
diff --git a/internal/worker/workertest/testdata/fixtures/opencode/fresh/session-opencode-phase1.json b/internal/worker/workertest/testdata/fixtures/opencode/fresh/session-opencode-phase1.json
new file mode 100644
index 0000000000..eed71062ab
--- /dev/null
+++ b/internal/worker/workertest/testdata/fixtures/opencode/fresh/session-opencode-phase1.json
@@ -0,0 +1,31 @@
+{
+  "info": {
+    "id": "ses_opencode_phase1",
+    "directory": "/tmp/gascity/phase1/opencode"
+  },
+  "messages": [
+    {
+      "info": {
+        "id": "msg_user_1",
+        "sessionID": "ses_opencode_phase1",
+        "role": "user",
+        "time": {"created": 1770000000000}
+      },
+      "parts": [
+        {"id": "part_user_1", "type": "text", "text": "Summarize the OpenCode worker transcript contract."}
+      ]
+    },
+    {
+      "info": {
+        "id": "msg_assistant_1",
+        "sessionID": "ses_opencode_phase1",
+        "role": "assistant",
+        "parentID": "msg_user_1",
+        "time": {"created": 1770000001000}
+      },
+      "parts": [
+        {"id": "part_assistant_1", "type": "text", "text": "OpenCode phase 1 validates the tmux CLI transcript contract."}
+      ]
+    }
+  ]
+}
diff --git a/internal/worker/workertest/testdata/fixtures/opencode/reset/session-opencode-phase1-reset.json b/internal/worker/workertest/testdata/fixtures/opencode/reset/session-opencode-phase1-reset.json
new file mode 100644
index 0000000000..92c3d60f49
--- /dev/null
+++ b/internal/worker/workertest/testdata/fixtures/opencode/reset/session-opencode-phase1-reset.json
@@ -0,0 +1,31 @@
+{
+  "info": {
+    "id": "ses_opencode_phase1_reset",
+    "directory": "/tmp/gascity/phase1/opencode"
+  },
+  "messages": [
+    {
+      "info": {
+        "id": "msg_reset_user_1",
+        "sessionID": "ses_opencode_phase1_reset",
+        "role": "user",
+        "time": {"created": 1770000100000}
+      },
+      "parts": [
+        {"id": "part_reset_user_1", "type": "text", "text": "Repeat the exact OpenCode phase-1 summary from earlier before answering."}
+      ]
+    },
+    {
+      "info": {
+        "id": "msg_reset_assistant_1",
+        "sessionID": "ses_opencode_phase1_reset",
+        "role": "assistant",
+        "parentID": "msg_reset_user_1",
+        "time": {"created": 1770000101000}
+      },
+      "parts": [
+        {"id": "part_reset_assistant_1", "type": "text", "text": "I cannot repeat the earlier OpenCode summary because this session started fresh."}
+      ]
+    }
+  ]
+}
diff --git a/internal/worker/workertest/testdata/phase2/scenarios.yaml b/internal/worker/workertest/testdata/phase2/scenarios.yaml
index 2991cfd652..82dedbdf06 100644
--- a/internal/worker/workertest/testdata/phase2/scenarios.yaml
+++ b/internal/worker/workertest/testdata/phase2/scenarios.yaml
@@ -6,7 +6,7 @@ scenarios:
     kind: startup
     description: Bounded startup outcome for the deterministic helper.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-BRINGUP-001]
   - id: startup-command-materialization
     runner: fake-worker
@@ -14,7 +14,7 @@ scenarios:
     kind: startup_materialization
     description: Startup command materialization for canonical worker profiles.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-START-001]
   - id: startup-runtime-config-materialization
     runner: fake-worker
@@ -22,7 +22,7 @@ scenarios:
     kind: startup_materialization
     description: Runtime config materialization for resolved worker startup state.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-START-002]
   - id: input-initial-message-first-start
     runner: fake-worker
@@ -30,7 +30,7 @@ scenarios:
     kind: input_delivery
     description: Initial message delivery on the first worker start.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INPUT-001]
   - id: input-initial-message-resume
     runner: fake-worker
@@ -38,7 +38,7 @@ scenarios:
     kind: input_delivery
     description: Initial message suppression after the first start is recorded.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INPUT-002]
   - id: input-override-defaults
     runner: fake-worker
@@ -46,7 +46,7 @@ scenarios:
     kind: input_delivery
     description: Default launch flags remain stable when initial messages are overridden.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INPUT-003]
   - id: transcript-diagnostics
     runner: fake-worker
@@ -54,7 +54,7 @@ scenarios:
     kind: transcript
     description: Malformed transcript diagnostics for degraded and fail-closed history loads.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-TX-003]
   - id: interaction-signal
     runner: fake-worker
@@ -62,7 +62,7 @@ scenarios:
     kind: interaction
     description: Standalone blocked interaction signal surfaced by the helper.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-000]
   - id: interaction-pending
     runner: fake-worker
@@ -70,7 +70,7 @@ scenarios:
     kind: interaction
     description: Pending structured interaction visible through the runtime seam.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-001]
   - id: interaction-respond
     runner: fake-worker
@@ -78,7 +78,7 @@ scenarios:
     kind: interaction
     description: Pending structured interaction clears when approved.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-002]
   - id: interaction-reject
     runner: fake-worker
@@ -86,7 +86,7 @@ scenarios:
     kind: interaction
     description: Mismatched interaction responses are rejected without clearing state.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-003]
   - id: interaction-instance-local-dedup
     runner: fake-worker
@@ -94,7 +94,7 @@ scenarios:
     kind: interaction
     description: Interaction deduplication remains scoped to the worker instance.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-004]
   - id: interaction-durable-history
     runner: fake-worker
@@ -102,7 +102,7 @@ scenarios:
     kind: interaction
     description: Structured interactions remain durable in normalized history.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-005]
   - id: interaction-lifecycle-history
     runner: fake-worker
@@ -110,7 +110,7 @@ scenarios:
     kind: interaction
     description: Dismissed and resumed interaction lifecycle records are stable.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-INT-006]
   - id: tool-event-normalization
     runner: fake-worker
@@ -118,7 +118,7 @@ scenarios:
     kind: tool
     description: Tool use and tool result substrate events survive normalization.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-TOOL-001]
   - id: tool-event-open-tail
     runner: fake-worker
@@ -126,7 +126,7 @@ scenarios:
     kind: tool
     description: Unresolved tool use evidence remains visible at the transcript tail.
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-TOOL-002]
   - id: real-transport-proof
     runner: tmux-real-transport
@@ -135,5 +135,5 @@ scenarios:
     description: Non-certifying proof that production tmux launch and nudge transport can carry canonical profile startup input.
     certification: proof_only
     executable: true
-    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli]
+    profiles: [claude/tmux-cli, codex/tmux-cli, gemini/tmux-cli, opencode/tmux-cli]
     requirement_codes: [WC-TRANSPORT-001]
diff --git a/internal/workspacesvc/proxy_process.go b/internal/workspacesvc/proxy_process.go
index 040997371c..df86d37691 100644
--- a/internal/workspacesvc/proxy_process.go
+++ b/internal/workspacesvc/proxy_process.go
@@ -198,13 +198,13 @@ func (p *proxyProcessInstance) start(now time.Time) error {
 
 	cmd := exec.Command(p.svc.Process.Command[0], p.svc.Process.Command[1:]...)
 	cmd.Dir = p.commandDir()
-	cmd.Env = append(os.Environ(), citylayout.CityRuntimeEnv(p.rt.CityPath())...)
+	cmd.Env = append(os.Environ(), citylayout.CityRuntimeEnvForRuntimeDir(p.rt.CityPath(), citylayout.TrustedAmbientCityRuntimeDir(p.rt.CityPath()))...)
 	cmd.Env = append(cmd.Env,
 		"GC_SERVICE_NAME="+p.svc.Name,
 		"GC_SERVICE_STATE_ROOT="+p.absStateRoot,
 		"GC_SERVICE_RUN_ROOT="+filepath.Join(p.absStateRoot, "run"),
 		"GC_SERVICE_SOCKET="+p.socketPath,
-		"GC_SERVICE_URL_PREFIX="+p.svc.MountPathOrDefault(),
+		"GC_SERVICE_URL_PREFIX="+citylayout.PublicServiceMountPath(p.rt.CityName(), p.svc.Name),
 		"GC_SERVICE_PUBLIC_URL="+p.publication.URL,
 		"GC_SERVICE_VISIBILITY="+p.publication.Visibility,
 		"GC_PUBLISHED_SERVICES_DIR="+citylayout.PublishedServicesDir(p.rt.CityPath()),
diff --git a/internal/workspacesvc/proxy_process_test.go b/internal/workspacesvc/proxy_process_test.go
index 0b30ba493a..8c339c9483 100644
--- a/internal/workspacesvc/proxy_process_test.go
+++ b/internal/workspacesvc/proxy_process_test.go
@@ -82,7 +82,7 @@ func requirePython3(t *testing.T) {
 // that proxy_process.go intentionally seeds into the helper env. Other GC_*
 // leak vectors stay scrubbed. GC_SERVICE_* vars are not leak vectors so they
 // flow through untouched without being listed here.
-const helperPassthroughForTests = "GC_CITY,GC_CITY_PATH,GC_CITY_RUNTIME_DIR"
+const helperPassthroughForTests = "GC_CITY,GC_CITY_PATH,GC_CITY_RUNTIME_DIR,GC_CONTROL_DISPATCHER_TRACE_DEFAULT"
 
 // setHelperPassthrough installs extraHelperEnv so proxy_process.start()
 // appends the passthrough var to the helper subprocess env. Tests run
@@ -97,9 +97,10 @@ func setHelperPassthrough(t *testing.T) {
 func TestManagerReloadProxyProcessStartsAndProxies(t *testing.T) {
 	t.Setenv("GC_SERVICE_HELPER", "1")
 	// The helper subprocess is the same test binary. proxy_process.go seeds
-	// GC_CITY / GC_CITY_PATH / GC_CITY_RUNTIME_DIR into the child env; without
-	// a passthrough declaration the child's internal/testenv init() would
-	// strip them.
+	// GC_CITY / GC_CITY_PATH / GC_CITY_RUNTIME_DIR /
+	// GC_CONTROL_DISPATCHER_TRACE_DEFAULT into the child env; without a
+	// passthrough declaration the child's internal/testenv init() would strip
+	// them.
 	setHelperPassthrough(t)
 	exe, err := os.Executable()
 	if err != nil {
@@ -172,14 +173,16 @@ func TestProxyProcessHelper(t *testing.T) {
 	})
 	mux.HandleFunc("/env", func(w http.ResponseWriter, _ *http.Request) {
 		_ = json.NewEncoder(w).Encode(map[string]string{
-			"GC_CITY":                   os.Getenv("GC_CITY"),
-			"GC_CITY_PATH":              os.Getenv("GC_CITY_PATH"),
-			"GC_CITY_RUNTIME_DIR":       os.Getenv("GC_CITY_RUNTIME_DIR"),
-			"GC_SERVICE_NAME":           os.Getenv("GC_SERVICE_NAME"),
-			"GC_SERVICE_STATE_ROOT":     os.Getenv("GC_SERVICE_STATE_ROOT"),
-			"GC_SERVICE_PUBLIC_URL":     os.Getenv("GC_SERVICE_PUBLIC_URL"),
-			"GC_SERVICE_VISIBILITY":     os.Getenv("GC_SERVICE_VISIBILITY"),
-			"GC_PUBLISHED_SERVICES_DIR": os.Getenv("GC_PUBLISHED_SERVICES_DIR"),
+			"GC_CITY":                             os.Getenv("GC_CITY"),
+			"GC_CITY_PATH":                        os.Getenv("GC_CITY_PATH"),
+			"GC_CITY_RUNTIME_DIR":                 os.Getenv("GC_CITY_RUNTIME_DIR"),
+			"GC_CONTROL_DISPATCHER_TRACE_DEFAULT": os.Getenv("GC_CONTROL_DISPATCHER_TRACE_DEFAULT"),
+			"GC_SERVICE_NAME":                     os.Getenv("GC_SERVICE_NAME"),
+			"GC_SERVICE_STATE_ROOT":               os.Getenv("GC_SERVICE_STATE_ROOT"),
+			"GC_SERVICE_URL_PREFIX":               os.Getenv("GC_SERVICE_URL_PREFIX"),
+			"GC_SERVICE_PUBLIC_URL":               os.Getenv("GC_SERVICE_PUBLIC_URL"),
+			"GC_SERVICE_VISIBILITY":               os.Getenv("GC_SERVICE_VISIBILITY"),
+			"GC_PUBLISHED_SERVICES_DIR":           os.Getenv("GC_PUBLISHED_SERVICES_DIR"),
 		})
 	})
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
@@ -196,9 +199,10 @@ func TestProxyProcessHelper(t *testing.T) {
 func TestProxyProcessPublishesServiceEnv(t *testing.T) {
 	t.Setenv("GC_SERVICE_HELPER", "1")
 	// The helper subprocess is the same test binary. proxy_process.go seeds
-	// GC_CITY / GC_CITY_PATH / GC_CITY_RUNTIME_DIR into the child env; without
-	// a passthrough declaration the child's internal/testenv init() would
-	// strip them.
+	// GC_CITY / GC_CITY_PATH / GC_CITY_RUNTIME_DIR /
+	// GC_CONTROL_DISPATCHER_TRACE_DEFAULT into the child env; without a
+	// passthrough declaration the child's internal/testenv init() would strip
+	// them.
 	setHelperPassthrough(t)
 	exe, err := os.Executable()
 	if err != nil {
@@ -266,6 +270,9 @@ func TestProxyProcessPublishesServiceEnv(t *testing.T) {
 	if env["GC_CITY_RUNTIME_DIR"] != filepath.Join(rt.cityPath, ".gc", "runtime") {
 		t.Fatalf("GC_CITY_RUNTIME_DIR = %q, want %q", env["GC_CITY_RUNTIME_DIR"], filepath.Join(rt.cityPath, ".gc", "runtime"))
 	}
+	if env["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"] != filepath.Join(rt.cityPath, ".gc", "runtime", "control-dispatcher-trace.log") {
+		t.Fatalf("GC_CONTROL_DISPATCHER_TRACE_DEFAULT = %q, want %q", env["GC_CONTROL_DISPATCHER_TRACE_DEFAULT"], filepath.Join(rt.cityPath, ".gc", "runtime", "control-dispatcher-trace.log"))
+	}
 	if env["GC_SERVICE_NAME"] != "bridge" {
 		t.Fatalf("GC_SERVICE_NAME = %q, want bridge", env["GC_SERVICE_NAME"])
 	}
@@ -281,6 +288,11 @@ func TestProxyProcessPublishesServiceEnv(t *testing.T) {
 	if env["GC_PUBLISHED_SERVICES_DIR"] != citylayout.PublishedServicesDir(rt.cityPath) {
 		t.Fatalf("GC_PUBLISHED_SERVICES_DIR = %q, want %q", env["GC_PUBLISHED_SERVICES_DIR"], citylayout.PublishedServicesDir(rt.cityPath))
 	}
+	// Must be supervisor-routable; the per-city /svc/<name> form 404s on inbound.
+	wantPrefix := citylayout.PublicServiceMountPath(rt.cityName, "bridge")
+	if env["GC_SERVICE_URL_PREFIX"] != wantPrefix {
+		t.Fatalf("GC_SERVICE_URL_PREFIX = %q, want %q", env["GC_SERVICE_URL_PREFIX"], wantPrefix)
+	}
 }
 
 func TestProxyProcessReloadRefreshesPublicationEnv(t *testing.T) {
diff --git a/release-gates/ga-2k9v-mol-dog-stale-db-cron-gate.md b/release-gates/ga-2k9v-mol-dog-stale-db-cron-gate.md
new file mode 100644
index 0000000000..934bed9a74
--- /dev/null
+++ b/release-gates/ga-2k9v-mol-dog-stale-db-cron-gate.md
@@ -0,0 +1,28 @@
+# Release Gate - ga-2k9v (mol-dog-stale-db and gc dolt-cleanup)
+
+Deployer: gascity/workflows.codex-max
+Date: 2026-05-02
+Bead: ga-2k9v / PR #1548
+Branch: `release/ga-2k9v-mol-dog-stale-db-cron`
+
+## Verdict: PASS After Maintainer Fixups
+
+| # | Criterion | Status | Evidence |
+|---|-----------|--------|----------|
+| 1 | Scope documented | PASS | The PR now ships a Go cleanup CLI plus formula/order wiring, not a TOML-only change. The CLI resolves the Dolt port, scans stale DBs, drops only safe stale names under `--force`, purges dropped DB directories, reaps test-only Dolt SQL processes, and emits `gc.dolt.cleanup.v1` JSON. |
+| 2 | Destructive DB safety | PASS | Planner protects registered rig DBs and Dolt internals including `__gc_probe`, narrows `beads_t` to hex protocol-test names, rejects non-conservative identifiers, and reports skipped stale matches. Covered by `TestPlanDoltDrops_*`. |
+| 3 | Purge safety | PASS | `USE <rigDB>` and `CALL DOLT_PURGE_DROPPED_DATABASES()` run on one pinned SQL connection; purge skips missing registered rig DB names only when no reclaimable bytes are present, and fails closed when dropped-database bytes remain for a non-live DB. Covered by `TestSQLCleanupDoltClientPurgePinsUseAndCallToOneConnection`, `TestRunDoltCleanup_ForceSkipsPurgeForMissingRigDatabases`, and `TestRunDoltCleanup_ForceFailsPurgeWhenMissingRigDatabaseHasBytes`. |
+| 4 | Process reaper safety | PASS | The reaper re-discovers PID command line and listening ports before SIGTERM and before SIGKILL; if the PID is gone before SIGTERM it is reported as vanished, if it exits after this process sends SIGTERM it is counted as reaped, and if it is reclassified as protected no signal is sent. Covered by `TestRunDoltCleanup_ForceRevalidatesPIDBeforeSIGTERM`, `TestRunDoltCleanup_ForceDoesNotCountMissingPIDAfterRevalidation`, and `TestRunDoltCleanup_ForceCountsPostSIGTERMGoneAsReaped`. |
+| 5 | Formula contract | PASS | `max_orphans_for_sql` applies to stale dropped database count using `>`, probe-failure JSON is attached before exit, dry-run/escalation done events say "bytes reclaimable", and clean apply closes the work bead. Covered by `go test ./examples/dolt -run StaleDB`. |
+| 6 | Burn-in cadence | PASS | The order intentionally runs every four hours (`0 */4 * * *`) during first-week burn-in, with comments stating it can move toward nightly after measured stability. |
+
+## Local Validation
+
+- `go test ./cmd/gc -run '^(TestCleanupReportJSONShape|TestRunDoltCleanup_|TestResolveDoltPort_|TestPlanDoltDrops_|TestDefaultStaleDatabasePrefixes_|TestLoadRigDoltPorts_|TestSplitCmdline_|TestLooksLikeDoltSQLServer|TestExtractConfigPath_|TestIsTestConfigPath_|TestClassifyDoltProcess_|TestPlanReap_)'`
+- `go test ./examples/dolt -run 'StaleDB'`
+
+## Notes
+
+This release gate supersedes the earlier TOML-only gate text. The reviewed
+surface includes the Go command, JSON report contract, destructive drop/purge
+stages, process reaper, formula shell contract, and four-hour cron burn-in.
diff --git a/release-gates/ga-3m01-bounded-session-resolve-gate.md b/release-gates/ga-3m01-bounded-session-resolve-gate.md
new file mode 100644
index 0000000000..458f07f7ca
--- /dev/null
+++ b/release-gates/ga-3m01-bounded-session-resolve-gate.md
@@ -0,0 +1,67 @@
+# Release gate - bound session resolve list calls (ga-3m01)
+
+**Verdict:** LOCAL FIXES READY FOR RE-REVIEW
+
+Branch: `release/ga-3m01-bounded-session-resolve`
+Base: `origin/main` at adopted PR creation
+PR: `gastownhall/gascity#1241`
+
+Final adopted branch scope:
+
+- `e5718407c` - perf(session): bound alias resolve list calls via metadata filters
+- `18eb8268a` - fix(session): preserve bounded resolver semantics
+- `5d5db8a09` - fix(session): share bounded named-session lookup
+- Maintainer review fixup - restore trimmed metadata lookup semantics, preserve type-only session bead recovery, keep allow-closed open hits cache-served, document the resolver precedence rules, and refresh this gate evidence.
+
+Current diff vs `refs/adopt-pr/ga-houfq0/upstream-base` spans these files:
+
+- `cmd/gc/session_resolve.go`
+- `cmd/gc/session_resolve_test.go`
+- `internal/api/handler_sessions_test.go`
+- `internal/api/session_resolution.go`
+- `internal/session/named_config.go`
+- `internal/session/named_config_test.go`
+- `internal/session/resolve.go`
+- `internal/session/resolve_test.go`
+- `release-gates/ga-3m01-bounded-session-resolve-gate.md`
+
+## Review State
+
+The original reviewer pass applied only to the first cherry-picked perf commit. Adopt-PR review attempt 2 later requested changes for whitespace normalization, the allow-closed cache path, resolver contract documentation, deterministic conflict coverage, and this stale gate evidence. Review attempt 3 then caught that exact metadata lookups had become label-prefiltered and no longer reached legacy type-only session beads.
+
+This local fixup addresses those findings. A fresh synthesis and quality scorecard still need to approve the local HEAD before the workflow can move to human approval or merge.
+
+## Criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Resolver lookups remain bounded | PASS | `TestResolveSessionID_BoundedListCalls`, `TestResolveConfiguredNamedSessionID_BoundedListCalls`, API configured-session tests, and named-session lookup tests assert metadata-filtered queries instead of broad session scans. |
+| 2 | Existing identifier semantics preserved | PASS | `TestResolveSessionID_TrimsMetadataIdentifier` covers the old trim-before-metadata-lookup behavior; `TestResolveSessionID_WhitespaceOnlyIdentifierDoesNotList` covers empty trimmed inputs. |
+| 3 | Type-only session beads remain recoverable | PASS | `TestResolveSessionID_SessionNameExactMatchAcceptsTypeOnlySessionBead`, `TestResolveSessionID_AliasExactMatchAcceptsTypeOnlySessionBead`, and `TestLookupConfiguredNamedSession_AcceptsTypeOnlyCanonicalBead` cover metadata matches on `Type == "session"` beads without the `gc:session` label. |
+| 4 | Allow-closed open hits stay cache-served | PASS | `TestResolveSessionIDAllowClosed_OpenHitStaysCacheServed` primes a `CachingStore` and asserts an open allow-closed hit does not issue backing `List` calls. |
+| 5 | Dual alias/session-name precedence is documented | PASS | `ResolveSessionID` godoc now states that a session-name-only bead owns the identifier over a dual alias/session-name bead, while a single dual bead still resolves. |
+| 6 | Configured named-session conflicts are deterministic | PASS | `TestLookupConfiguredNamedSession_ReportsSessionNameConflictBeforeAliasConflict` pins session-name conflicts before alias conflicts. |
+| 7 | Release evidence covers final branch | PASS | This gate lists the post-review branch files and validation commands instead of the original four-file cherry-pick only. |
+| 8 | Fresh review approval | PENDING | Required by the adopt-PR workflow after this local fixup. |
+
+## Validation
+
+Commands run on the adopted worktree:
+
+- `go test ./internal/session -run 'TestResolveSessionID_TrimsMetadataIdentifier|TestResolveSessionID_WhitespaceOnlyIdentifierDoesNotList|TestResolveSessionIDAllowClosed_OpenHitStaysCacheServed|TestLookupConfiguredNamedSession_ReportsSessionNameConflictBeforeAliasConflict' -count=1` -> pass
+- `go test ./internal/session -run 'TestResolveSessionID_SessionNameExactMatchAcceptsTypeOnlySessionBead|TestResolveSessionID_AliasExactMatchAcceptsTypeOnlySessionBead|TestLookupConfiguredNamedSession_AcceptsTypeOnlyCanonicalBead' -count=1` -> pass
+- `go test ./internal/session -count=1` -> pass
+- `git diff --check` -> pass
+- `go test ./internal/api -run 'TestResolveConfiguredNamedSessionIDWithContext|TestHandleSessionSubmitMaterializesNamedSession|TestFindNamedSessionSpecForTarget' -count=1` -> pass
+- `go test ./cmd/gc -run 'TestResolveSessionID|TestResolveConfiguredNamedSessionID' -count=1` -> pass
+- `make test` -> pass
+
+## Performance Evidence
+
+This gate no longer claims the older `5.2s -> 1.3s` wall-clock measurement for the new `LookupConfiguredNamedSession` path. The current evidence is structural: resolver tests assert bounded metadata-filtered query shapes and prevent broad session scans. A separate benchmark or production trace is required before publishing a wall-clock improvement number for this specific path.
+
+The dispatcher attempt-route binding path intentionally remains on `NamedSessionResolutionCandidates`, whose one label-scoped scan is documented separately for high-concurrency dispatcher load. Migrating or remeasuring that path is outside this PR and should be handled as follow-up work if needed.
+
+## Push Target
+
+Do not push from review-fix iterations. The finalize step owns any push, follow-up PR creation, or merge after fresh review and human approval.
diff --git a/release-gates/ga-dnf3-gate.md b/release-gates/ga-dnf3-gate.md
new file mode 100644
index 0000000000..b5e3ead858
--- /dev/null
+++ b/release-gates/ga-dnf3-gate.md
@@ -0,0 +1,47 @@
+# Release Gate — ga-dnf3 (reconciler deadline_exceeded masking fix)
+
+**Bead:** ga-rhw8 (fix) via review bead ga-dnf3
+**Branch:** `release/ga-dnf3`
+**Source commit:** 7e71fd4c (builder branch) → cherry-picked onto `origin/main` as b961769d (issues.jsonl stripped per deployer EXCLUDES discipline)
+**Evaluator:** gascity/deployer-1 on 2026-04-23
+
+## Gate criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Review PASS present | PASS | ga-dnf3 notes: `review_verdict: pass` from gascity/reviewer. Single-pass (gemini second-pass disabled). |
+| 2 | Acceptance criteria met | PASS | See matrix below. |
+| 3 | Tests pass | PASS | `go test ./cmd/gc -run "TestReconcile|TestCommitStart|TestStartPreparedStart|TestExecutePreparedStartWave|TestSessionLifecycle|TestCandidate" -count=1` → `ok 2.586s` on `release/ga-dnf3`. |
+| 4 | No high-severity review findings open | PASS | Both findings in ga-dnf3 are `severity: info` (log-message accuracy, ErrSessionInitializing+deadline classification change — reviewer noted neither is blocking). |
+| 5 | Final branch is clean | PASS | `git status` clean (no tracked modifications). |
+| 6 | Branch diverges cleanly from main | PASS | Cut fresh from `origin/main`, one commit. No merge conflicts. `issues.jsonl` from the source commit was stripped during cherry-pick (doesn't exist on main, would cause add/delete conflicts). |
+
+## Acceptance criteria matrix (ga-rhw8 scope)
+
+| Criterion | Met | Evidence |
+|-----------|-----|----------|
+| Switch ordering: deadline → canceled → err==nil | YES | `cmd/gc/session_lifecycle_parallel.go:523` reordered so `startCtx.Err()` branches precede `err == nil`. |
+| Nil err promoted to wrapped context error in deadline/canceled branches | YES | Lines 525, 529 wrap context sentinels so `result.err != nil` downstream, triggering `commitStartResultTraced` to record failure and clear `last_woke_at`. |
+| New reproducer test | YES | `cmd/gc/session_lifecycle_start_deadline_test.go` exercises `ctxIgnoringStartProvider` that holds past the deadline and returns nil; asserts `outcome=deadline_exceeded` and `errors.Is(err, context.DeadlineExceeded)`. |
+| Scope discipline: single file + one new test, no unrelated touches | YES | This commit touches only `session_lifecycle_parallel.go` and adds `session_lifecycle_start_deadline_test.go`. |
+
+## Test evidence
+
+```
+$ go test ./cmd/gc -run "TestReconcile|TestCommitStart|TestStartPreparedStart|TestExecutePreparedStartWave|TestSessionLifecycle|TestCandidate" -count=1
+ok github.com/gastownhall/gascity/cmd/gc 2.586s
+
+$ go vet ./cmd/gc/...
+(clean)
+
+$ go build ./...
+(clean)
+```
+
+## Security review
+
+From ga-dnf3, OWASP Top 10 walkthrough: pure control-flow reordering plus `fmt.Errorf` wrap using canonical `context` sentinels. No new I/O, no new auth/access surface, no deserialization. A10 (logging) improves: failures previously tagged silent success are now explicit deadline_exceeded.
+
+## Verdict: PASS
+
+Cleared for PR.
diff --git a/release-gates/ga-hivi-probe-user-db-gate.md b/release-gates/ga-hivi-probe-user-db-gate.md
new file mode 100644
index 0000000000..23ec1459cd
--- /dev/null
+++ b/release-gates/ga-hivi-probe-user-db-gate.md
@@ -0,0 +1,96 @@
+# Release gate — probe a user DB so `__gc_probe` stops hosting stats (ga-42gi / ga-hivi)
+
+**Verdict:** PASS with maintainer fixups
+
+Branch: `release/ga-hivi-probe-user-db` rebased for review on `origin/main` @ `936dea150`.
+
+Commits under review:
+
+- `390278080` — fix(dolt/health): probe a user db so __gc_probe stops hosting stats (ga-42gi). Rebased cherry-pick of source SHA `db6831b0` from `fork/gc-builder-1-01561d4fb9ea`.
+- `842002634` — chore(fmt): align map literals after ga-42gi cherry-pick. Pure formatting for `golangci-lint fmt`.
+- `3d319fad` — chore: release gate PASS for ga-hivi (ga-42gi). Original gate artifact from the contributor branch.
+- Current maintainer fixup commit — `fix(dolt): harden user-db health probe`,
+  resolving the PR-review loop findings for CSV database parsing, Dolt system
+  database exclusions, reserved existing metadata, no-user-database diagnostics,
+  and stale user-database `__gc_read_only_probe` cleanup.
+
+Diff vs `origin/main` now covers these files:
+
+- `cmd/gc/beads_provider_lifecycle.go`
+- `cmd/gc/beads_provider_lifecycle_test.go`
+- `cmd/gc/cmd_dolt_state.go`
+- `cmd/gc/cmd_dolt_state_test.go`
+- `cmd/gc/dolt_sql_health.go`
+- `cmd/gc/dolt_sql_health_test.go`
+- `cmd/gc/embed_builtin_packs_test.go`
+- `examples/bd/assets/scripts/gc-beads-bd.sh`
+- `examples/dolt/commands/cleanup/run.sh`
+- `examples/dolt/commands/gc-nudge/run.sh`
+- `examples/dolt/commands/health/run.sh`
+- `examples/dolt/commands/list/run.sh`
+- `examples/dolt/commands/sync/run.sh`
+- `examples/dolt/formulas/mol-dog-doctor.toml`
+- `examples/dolt/formulas/mol-dog-stale-db.toml`
+- `release-gates/ga-hivi-probe-user-db-gate.md`
+
+## Review
+
+| Review source | Verdict | Notes |
+|---------------|---------|-------|
+| Original ga-hivi review | PASS | Reviewed source commit `db6831b0`; formatter follow-up addressed the style note. |
+| PR-review synthesis `ga-5sq14q2` attempt 1 | request_changes | Major findings are resolved by the local maintainer fixup and require another review iteration before merge. |
+
+## Criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Probe no longer writes `__gc_probe` | PASS | Go probe SQL targets a selected user DB; bash fallback now runs `SHOW DATABASES` and writes `<user_db>.__gc_read_only_probe`; tests reject legacy create/write targets. |
+| 2 | System databases are not probe targets | PASS | Go and shell skip `information_schema`, `mysql`, `dolt_cluster`, `performance_schema`, `sys`, and `__gc_probe`. |
+| 3 | CSV database names parse correctly | PASS | CLI `SHOW DATABASES -r csv` output is parsed with `encoding/csv`; tests cover comma and quote escaped names. |
+| 4 | Existing reserved metadata is rejected except legacy `__gc_probe` | PASS | Canonical metadata normalization now preserves only the legacy `__gc_probe` migration case; existing `mysql` metadata is rejected by regression coverage. |
+| 5 | No-user-database probes are diagnostic, not writable | PASS | Go and shell fallback probes now return an unknown/diagnostic state without issuing a write probe when `SHOW DATABASES` contains no user database. |
+| 6 | Probe-table cleanup covers rotated user DBs | PASS | `gc dolt-state reset-probe` still drops legacy `__gc_probe` and now drops `__gc_read_only_probe` tables from each discovered user database. It deliberately does not drop generic `__probe` tables because those can be user-owned. |
+| 7 | Review-loop major findings closed locally | PASS | Reserved metadata, no-user-database behavior, and stale probe-table cleanup findings are fixed; the workflow must run a fresh review/scorecard before final approval. |
+| 8 | Branch evidence is current | PASS | This artifact records the rebased base SHA, current commit chain, and full changed-file set. |
+
+## Upgrade remediation
+
+Managed Dolt servers upgraded from a build that wrote `__gc_probe` must run this
+once per server after the new binary is available:
+
+```bash
+gc dolt-state reset-probe --host <host> --port <port> --user <user> --force
+```
+
+That command removes the legacy `__gc_probe` database and the GC-owned
+`__gc_read_only_probe` table from discovered user databases. It is idempotent.
+Do not manually drop generic `__probe` tables; they are outside the GC reserved
+contract and may belong to user data.
+
+## Validation
+
+- `git diff --check` → pass.
+- `sh -n examples/bd/assets/scripts/gc-beads-bd.sh` → pass.
+- `sh -n examples/dolt/commands/health/run.sh` → pass.
+- `sh -n examples/dolt/commands/{cleanup,gc-nudge,list,sync}/run.sh` → pass.
+- `bash -n examples/gastown/packs/maintenance/assets/scripts/{jsonl-export,reaper}.sh` → pass.
+- `go test ./cmd/gc -run 'TestManagedDolt|TestDoltStateReadOnlyCheckCmd|TestDoltStateHealthCheckCmd|TestGcBeadsBdReadOnlyFallback|TestGcBeadsBdHealthNoUserDatabaseWarnsAndContinues|TestGcBeadsBdReadOnlyHelperErrorIsDiagnostic|TestGcBeadsBdInitRejectsManagedProbeDatabaseName|TestEnsureCanonicalScopeMetadataRejectsManagedSystemDatabases|TestBuiltinDatabaseEnumeratorsSkipManagedProbeDatabase|TestDoltSyncRejectsManagedProbeDatabaseFilter|TestNormalizeCanonicalBdScopeFilesRejectsExistingManagedSystemDatabase' -count=1` with workflow `GC_*` / `BEADS_*` environment stripped → pass.
+- `GC_FAST_UNIT=0 go test ./cmd/gc -run 'TestDoltStateRecoverManagedCmdNoUserDatabaseHealthSucceeds' -count=1` with workflow `GC_*` / `BEADS_*` environment stripped → pass.
+- `go test ./cmd/gc -run 'TestBuiltinDatabaseEnumeratorsSkipManagedProbeDatabase|TestDoltSyncRejectsManagedProbeDatabaseFilter'` → pass.
+- `go test ./test/docsync -count=1` → pass.
+- `go test ./examples/dolt ./examples/gastown -count=1` → pass.
+
+## Known Environment Noise
+
+`go test ./...` fails in this rig outside the changed surface. With the workflow
+`GC_*` / `BEADS_*` environment stripped, it narrows to
+`TestPhase0CanonicalMetadata_NamedMaterializationWritesNamedOriginWithoutLegacyManualFlag`,
+which fails because a `mayor` session is already active in the local runtime.
+Without stripping the workflow environment, many unrelated command tests also
+fail from `GC_RIG=gascity`, the rig-local `bd` behavior, and local managed-Dolt
+startup state. The focused checks above cover the changed files and the review
+findings.
+
+## Push target
+
+`fork` (quad341/gascity) — `origin` (gastownhall/gascity) is read-only from this rig. PR cross-repo target remains `--head quad341:release/ga-hivi-probe-user-db --base main`.
diff --git a/release-gates/ga-ihtj-gate.md b/release-gates/ga-ihtj-gate.md
new file mode 100644
index 0000000000..1213734f22
--- /dev/null
+++ b/release-gates/ga-ihtj-gate.md
@@ -0,0 +1,77 @@
+# Release Gate — ga-ihtj (ArchiveMany ErrAlreadyArchived fix + ga-ipc4 feature)
+
+**Bead:** ga-ihtj (re-review of ga-dkf7; carries ga-ipc4 feature + ga-dkf7 fix)
+**Originating work:** ga-ipc4 (ArchiveMany batch path) + ga-dkf7 (preserve ErrAlreadyArchived)
+**Branch:** `release/ga-ihtj` — cherry-picks of 285aa325 and 6812b429 onto `origin/main` (`issues.jsonl` stripped per EXCLUDES discipline)
+**Evaluator:** gascity/deployer on 2026-04-24
+**Verdict:** **PASS**
+
+## Deploy strategy note
+
+`ga-ipc4` (commit 285aa325) introduced `ArchiveMany` and its CLI multi-id
+surface; the first-pass review (ga-dkf7) returned REQUEST-CHANGES
+because the success path dropped `mail.ErrAlreadyArchived`. The builder
+addressed that with commit 6812b429 and the re-review bead ga-ihtj
+passed. Both commits ship together because the fix builds directly on
+the ArchiveMany plumbing introduced in 285aa325 — neither is shippable
+alone. A fresh branch off `origin/main` keeps this change independent
+of the in-flight `release/ga-lipl` (PR #1170, beadmail Reply-title
+work).
+
+## Gate criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Review PASS present | PASS | ga-ihtj notes: `Re-review verdict: PASS` from `gascity/reviewer` on builder commit 6812b429 (mail `gm-wisp-cp5y`). First-pass ga-dkf7 returned REQUEST-CHANGES on 285aa325; the re-review covers both commits. Single-pass sufficient while gemini second-pass is disabled. |
+| 2 | Acceptance criteria met | PASS | `ArchiveMany([]string)` batch method present on `mail.Provider`; beadmail single-round-trip `store.CloseAll` preserved for the open subset; `mail.ErrAlreadyArchived` returned per-id for already-closed beads (matches single-id `Archive` semantics); CLI `gc mail delete` / `gc mail archive` accept multiple ids; fake/exec/MCP providers conform; new conformance tests `ArchiveMany_AllSucceed`, `ArchiveMany_EmptyReturnsNil`, `ArchiveMany_PreservesInputOrder`, `ArchiveMany_MixedOpenClosed` apply across all providers; bench `BenchmarkArchiveManyVsSingle` at N=20 and N=200; acceptance subtest `Delete_MultiID_BatchClose` added; `docs/reference/cli.md` updated. |
+| 3 | Tests pass | PASS | `go test ./internal/mail/...` green (mail 0.003s, beadmail 0.005s, exec 13.885s); `go test ./cmd/gc -run 'TestMailDelete\|TestMailArchive'` green (0.027s); `go vet ./internal/mail/... ./cmd/gc/...` clean; `go build ./...` clean. |
+| 4 | No high-severity review findings open | PASS | Zero HIGH findings. Three non-blocking observations in the re-review: (a) 2N subprocess cost on BdStore fallback path mirrors existing per-id fallback shape — not a regression; (b) TOCTOU window between per-id Get and batched CloseAll is pre-existing and fundamental to Get-then-Close; (c) memstore 20-id batch perf deviation (~1.2x vs 10x target) is tracked separately as ga-dyv7. |
+| 5 | Final branch is clean | PASS | `git status` on tracked tree clean after the two cherry-picks. Only `.gitkeep` and `release-gates/ga-bxq5-gate.md` untracked — both are stale scaffold from the prior FAIL gate on ga-bxq5 (blocked on PRs #1147/#1149), unrelated to this deploy. |
+| 6 | Branch diverges cleanly from main | PASS | 2 commits ahead of `origin/main` after cherry-picks (plus the gate commit once added). No content conflicts — the only cherry-pick conflict was the expected `issues.jsonl` modify/delete on 285aa325 (issues.jsonl is a bd-sync artifact absent from `origin/main`), stripped via the `EXCLUDES` recipe. 6812b429 applied without conflict. |
+
+## Cherry-pick log
+
+| Source SHA | Branch SHA | Summary |
+|------------|------------|---------|
+| 285aa325 | 78e6ee4d | perf(mail): add ArchiveMany batch path for multi-id gc mail delete/archive (ga-ipc4) |
+| 6812b429 | 962e4f31 | fix(beadmail): preserve ErrAlreadyArchived in ArchiveMany (ga-dkf7) |
+
+`EXCLUDES`: `issues.jsonl` (bd-sync artifact not present on `origin/main`).
+Intermediate bd-sync commits (`6ca2008a`, `f5f163ff`) not cherry-picked — they touch only `issues.jsonl`.
+
+## Acceptance criteria — ga-ipc4 / ga-dkf7 done-when
+
+- [x] `mail.Provider.ArchiveMany([]string) ([]ArchiveResult, error)` defined and implemented across beadmail / fake / exec / MCP.
+- [x] CLI `gc mail delete <id>...` and `gc mail archive <id>...` accept multiple ids; single-id behavior byte-for-byte unchanged.
+- [x] Single-round-trip `store.CloseAll` preserved on the open subset (architectural BdStore win intact).
+- [x] `mail.ErrAlreadyArchived` returned per-id for already-closed message beads — verified by `ArchiveMany_MixedOpenClosed` across every provider.
+- [x] CLI prints "Already deleted `<id>`" / "Already archived `<id>`" for pre-closed ids (CLI switch at `cmd/gc/cmd_mail.go` fires on `errors.Is(r.Err, mail.ErrAlreadyArchived)`).
+- [x] Bench `BenchmarkArchiveManyVsSingle` present at N=20 and N=200; memstore perf deviation called out in bench comment and tracked by ga-dyv7.
+- [x] `docs/reference/cli.md` updated with multi-id usage.
+- [x] Acceptance subtest `Delete_MultiID_BatchClose` in `test/acceptance/mail_lifecycle_test.go`.
+
+## Test evidence
+
+```
+$ go vet ./internal/mail/... ./cmd/gc/...
+(clean)
+
+$ go build ./...
+(clean)
+
+$ go test ./internal/mail/...
+ok   github.com/gastownhall/gascity/internal/mail           0.003s
+ok   github.com/gastownhall/gascity/internal/mail/beadmail  0.005s
+ok   github.com/gastownhall/gascity/internal/mail/exec      13.885s
+?    github.com/gastownhall/gascity/internal/mail/mailtest  [no test files]
+
+$ go test ./cmd/gc -run 'TestMailDelete|TestMailArchive'
+ok   github.com/gastownhall/gascity/cmd/gc                  0.027s
+```
+
+## Non-blocking follow-ups
+
+- **ga-dyv7** — recalibrate memstore done-when for `ArchiveMany`
+  (current ≈1.2x faster at N=20, spec target 10x; architectural BdStore
+  win preserved at N=200 ≈8.7x faster). Tracked separately; not a
+  deploy blocker.
diff --git a/release-gates/ga-iwec-dolt-1862-floor-gate.md b/release-gates/ga-iwec-dolt-1862-floor-gate.md
new file mode 100644
index 0000000000..caaea17041
--- /dev/null
+++ b/release-gates/ga-iwec-dolt-1862-floor-gate.md
@@ -0,0 +1,53 @@
+# Release gate - dolt 1.86.2 version floor (ga-iwec + ga-kmb4)
+
+**Verdict:** PASS
+
+Branch: `release/ga-iwec-dolt-1862-floor`
+Base: `refs/adopt-pr/ga-uc3d3j/upstream-base` at `936dea150ca8`
+
+Commits present at review input:
+- `c4cbec40d` - feat(dolt): require dolt >= 1.86.2 in pack guards (ga-iwec)
+- `6defe1dd3` - test(dolt/doctor): cover dolt 1.86.2 version-floor + missing prereqs (ga-kmb4)
+- `5e9b00932` - chore: release gate PASS for ga-iwec-dolt-1862-floor
+- `da662ea00` - fix: address Dolt floor review findings
+
+Maintainer review-loop fixup in this commit:
+- Reject `1.86.2-rc*` and `1.86.2-dev*` Dolt builds in both the shell pack doctor and Go `DoltVersionCheck`.
+- Keep final releases with build metadata such as `1.86.2+build.5` accepted.
+- Correct `mol-dog-backup` preflight text so it no longer claims framework-enforced `abort_scope` behavior.
+- Add shell and Go regression coverage for prerelease/dev versions plus parser edge cases.
+
+Diff vs base after the maintainer fixup: 9 files changed, 580 insertions, 32 deletions.
+
+Changed files:
+- `cmd/gc/embed_builtin_packs_test.go`
+- `examples/dolt/doctor/check-dolt/run.sh`
+- `examples/dolt/doctor_test.go`
+- `examples/dolt/formulas/mol-dog-backup.toml`
+- `examples/dolt/pack.toml`
+- `internal/doctor/checks.go`
+- `internal/doctor/checks_test.go`
+- `internal/doltversion/doltversion.go`
+- `release-gates/ga-iwec-dolt-1862-floor-gate.md`
+
+## Review Beads Bundled In This PR
+
+| Review bead | Reviews | Verdict | Reviewer |
+|-------------|---------|---------|----------|
+| ga-zguq | ga-iwec (`run.sh` + `mol-dog-backup.toml` + `pack.toml`) | PASS | gascity/reviewer-1 |
+| ga-245m | ga-iwec second review pass | PASS | gascity/reviewer-1 |
+| ga-57v7 | ga-kmb4 (`examples/dolt/doctor_test.go`) | PASS | gascity/reviewer-1 |
+
+## Criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Review PASS present | PASS | All three source review beads carry reviewer-1 PASS verdicts. |
+| 2 | Acceptance criteria met | PASS | The pack doctor rejects Dolt below `1.86.2`, rejects prerelease/dev builds at the floor, accepts `1.86.2` final and later versions, and reports the upstream `ccf7bde206` context. The backup formula still runs a preflight before `sync`, and the text now matches the actual dependency semantics. |
+| 3 | Tests pass | PASS | `git diff --check`; `bash -n examples/dolt/doctor/check-dolt/run.sh`; `go test -run 'TestDoctorCheckVersionFloor|TestDoctorCheckVersionFloorDoesNotRequireVersionSort|TestBuiltinDoltDoctorAllowsAtMinimumVersionWhenProbeSucceeds|TestBuiltinDoltDoctorBoundsVersionProbe|TestDoltVersionCheck|TestParseDoltVersion' -count=1 ./examples/dolt ./cmd/gc ./internal/doctor`; `go test -count=1 ./internal/formula/...`. |
+| 4 | No high-severity review findings open | PASS after maintainer fixup | The review-loop fixup addresses the major prerelease acceptance finding and the scorecard-required formula wording, gate refresh, and parser edge coverage. A fresh review pass must confirm this before `review.verdict=done`. |
+| 5 | Branch evidence matches current reviewed state | PASS | Base, commit stack, diff summary, changed file list, and validation evidence above reflect the reviewed worktree after the maintainer fixup. |
+
+## Notes
+
+The broader repository suite was not rerun in this review-loop step. The prior scorecard noted unrelated broader failures in environment/config harness areas, so this gate records the scoped checks that cover the changed Dolt floor and formula surfaces.
diff --git a/release-gates/ga-o4a9-gate.md b/release-gates/ga-o4a9-gate.md
new file mode 100644
index 0000000000..8a50a1e5a3
--- /dev/null
+++ b/release-gates/ga-o4a9-gate.md
@@ -0,0 +1,117 @@
+# Release Gate — ga-o4a9 (maintenance scripts skip test-pattern DBs)
+
+**Bead:** ga-o4a9 (review of ga-47ew)
+**Originating work:** ga-47ew — `reaper.sh` alerts on `benchdb` test-fixture scratch DB
+**Branch:** `release/ga-o4a9` — intended cherry-pick of `2e653fdc` onto `origin/main`; final PR #1185 squash also included follow-up repair commits listed in the post-merge scope audit below
+**Evaluator:** gascity/deployer on 2026-04-24
+**Verdict:** **PASS**, with post-merge scope audit addendum on 2026-05-04
+
+## Deploy strategy note
+
+Single-bead deploy. The builder's source branch (`gc-builder-1-01561d4fb9ea`)
+is 40+ commits ahead of `origin/main` carrying unrelated in-flight work, so
+the gate uses the rollup-ship cherry-pick recipe to land just `2e653fdc` on
+a fresh `release/ga-o4a9` cut from `origin/main`.
+
+Post-merge review of PR #1185 found that the final squash included additional
+repair commits beyond the original maintenance-script cherry-pick. This gate
+therefore records both the original single-bead intent and the actual landed
+surface.
+
+## Gate criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Review PASS present | PASS | ga-o4a9 notes: `Review verdict: PASS` from `gascity/reviewer-1` on builder commit `2e653fdc`. Rubric covered gates, style, security, spec compliance, coverage; "Findings: None". Mail `gm-wisp-pdnd` (subject "ready for release gate") confirms handoff. Single-pass sufficient while gemini second-pass is disabled. |
+| 2 | Acceptance criteria met | PASS | Both `reaper.sh` and `jsonl-export.sh` extended with the mol-dog-stale-db exclusion patterns: `benchdb` (exact), `testdb_*`, `beads_t[0-9a-f]{8,}`, `beads_pt*`, `beads_vr*`, `doctest_*`, `doctortest_*`. New `TestMaintenanceDoltScriptsSkipTestPatternDatabases` parameterizes the dolt stub via `DOLT_DBS` (default `beads` preserves prior fixtures); seeds excluded-pattern names and production names; asserts dolt args log never references excluded DBs and always references included DBs across both `reaper` and `jsonl_export` subtests. |
+| 3 | Tests pass | PASS | Original gate evidence: `go vet ./...` clean; `go build ./...` clean; `go test ./examples/gastown/...` green (12.762s); targeted `TestMaintenanceDoltScriptsSkipTestPatternDatabases` passes. Full `go test ./...` shows one pre-existing failure in `internal/runtime/k8s` (`TestControllerScriptDeployFailsWhenBootstrapFails` — bootstrap GC_DOLT_HOST/GC_DOLT_PORT message check); confirmed unrelated by reproducing on `origin/main`. Post-merge audit also covers the follow-up SSE and test-lifecycle files listed below. |
+| 4 | No high-severity review findings open | PASS | Zero HIGH findings. Reviewer notes "Findings: None". |
+| 5 | Final branch is clean | PASS | `git status` on tracked tree clean after the cherry-pick. Only `.gitkeep` untracked (pre-existing scaffold marker, unrelated). |
+| 6 | Branch diverges cleanly from main | PASS | Original gate branch was 1 commit ahead of `origin/main` after cherry-pick, plus the gate commit. The final PR #1185 squash included the additional repair commits in the scope audit below. |
+
+## Post-merge scope audit
+
+PR #1185 landed as squash commit `b56c4186d6074aa5db556827481dd14a21817d6d`
+for review range
+`dc2bbb7532ccbafc23226ac492faa9e4728887a6..b56c4186d6074aa5db556827481dd14a21817d6d`.
+The actual changed file list was:
+
+```text
+cmd/gc/controller_test.go
+examples/gastown/maintenance_scripts_test.go
+examples/gastown/packs/maintenance/assets/scripts/jsonl-export.sh
+examples/gastown/packs/maintenance/assets/scripts/reaper.sh
+internal/api/huma_handlers_events.go
+internal/api/huma_handlers_supervisor.go
+internal/api/sse.go
+internal/api/supervisor_test.go
+release-gates/ga-o4a9-gate.md
+test/integration/e2e_hook_test.go
+```
+
+The extra non-maintenance repair commits folded into the squash were:
+
+```text
+5efb4b466 fix(api): flush SSE stream headers before events
+fd672431 test: avoid reload cleanup shutdown wait
+6798cb52 test: harden hook inject integration marker
+```
+
+Rollup-ship scope guard: before a release gate can be marked PASS, the
+operator must run `git diff --name-status origin/main...HEAD` on the final
+release branch and reconcile every changed file with the gate criteria. If the
+branch contains files outside the bead's reviewed surface, the release must
+either get separate gates for those files or stop before squash merge so
+authorship trailers are not applied across unrelated commits.
+
+## Cherry-pick log
+
+| Source SHA | Branch SHA | Summary |
+|------------|------------|---------|
+| 2e653fdc | 2ff4633a | fix(maintenance): skip test-pattern DBs in reaper + jsonl-export (ga-47ew) |
+
+No `EXCLUDES`. The commit was authored on a builder branch where
+`issues.jsonl` had already been sync'd by an earlier commit, so the
+ga-47ew code commit itself does not include `issues.jsonl` and applies
+cleanly to `origin/main`.
+
+## Acceptance criteria — ga-47ew done-when
+
+- [x] `reaper.sh` exclusion regex extended with `benchdb`, `testdb_*`, `beads_t[0-9a-f]{8,}`, `beads_pt*`, `beads_vr*`, `doctest_*`, `doctortest_*` patterns (line `grep -vi 'mol-dog-stale-db patterns'`).
+- [x] `jsonl-export.sh` carries the identical exclusion regex with the same comment tying the filter to the Go cleanup planner contract.
+- [x] No other maintenance script under `packs/maintenance/assets/scripts/` uses a `SHOW DATABASES` → exclusion-grep pipeline (verified by reviewer; both files cover the surface).
+- [x] `TestMaintenanceDoltScriptsSkipTestPatternDatabases` added to `examples/gastown/maintenance_scripts_test.go` covering both `reaper` and `jsonl_export` subtests; default-`beads` `DOLT_DBS` preserves existing test behavior.
+- [x] Hardcoded patterns (not env var) — matches existing exclusion style; avoids premature flexibility per the builder plan.
+
+## Test evidence
+
+```
+$ go vet ./...
+(clean)
+
+$ go build ./...
+(clean)
+
+$ go test -run TestMaintenanceDoltScriptsSkipTestPatternDatabases ./examples/gastown/...
+ok   github.com/gastownhall/gascity/examples/gastown   0.113s
+
+$ go test ./examples/gastown/...
+ok   github.com/gastownhall/gascity/examples/gastown   12.762s
+?    github.com/gastownhall/gascity/examples/gastown/packs/gastown      [no test files]
+?    github.com/gastownhall/gascity/examples/gastown/packs/maintenance  [no test files]
+
+$ go test ./...
+(all green except pre-existing FAIL in internal/runtime/k8s
+ TestControllerScriptDeployFailsWhenBootstrapFails — reproduced on
+ origin/main; unrelated to this shell-script-only change)
+```
+
+## Pre-existing failure (not a deploy blocker)
+
+`internal/runtime/k8s.TestControllerScriptDeployFailsWhenBootstrapFails`
+fails on `origin/main` with the same assertion error
+(`deploy output did not report bootstrap failure: controller bootstrap
+requires both GC_DOLT_HOST and GC_DOLT_PORT when either is set`). This
+is a controller-script bootstrap-error-message regression unrelated to
+the maintenance-script exclusion work. Worth a separate bead if not
+already tracked.
diff --git a/release-gates/ga-onjy-gate.md b/release-gates/ga-onjy-gate.md
new file mode 100644
index 0000000000..bdef89f2c4
--- /dev/null
+++ b/release-gates/ga-onjy-gate.md
@@ -0,0 +1,78 @@
+# Release Gate — ga-onjy (clear inherited GC_BEADS env in test config writers)
+
+**Bead:** ga-onjy (review of ga-y64o)
+**Originating work:** ga-y64o — tests inherit `GC_BEADS=bd` from agent env, leaking orphan `dolt sql-server` processes
+**Branch:** `release/ga-onjy` — cherry-pick of `e16ccf1f` onto `origin/main`
+**Evaluator:** gascity/deployer on 2026-04-24
+**Verdict:** **PASS**
+
+## Deploy strategy note
+
+Single-bead deploy. The builder's source branch (`gc-builder-1-01561d4fb9ea`)
+carries unrelated in-flight work ahead of `origin/main`, so the gate uses the
+rollup-ship cherry-pick recipe to land just `e16ccf1f` on a fresh
+`release/ga-onjy` cut from `origin/main`. No `EXCLUDES` needed — the commit
+only touches three test files in `cmd/gc/`.
+
+## Gate criteria
+
+| # | Criterion | Verdict | Evidence |
+|---|-----------|---------|----------|
+| 1 | Review PASS present | PASS | ga-onjy notes: `Reviewer verdict: PASS` from `gascity/reviewer-1` on builder commit `e16ccf1f`. Rubric covered style, security (OWASP), spec compliance, coverage; "Findings: None". Mail `gm-wisp-syrr` (subject "ready for release gate") confirms handoff. Single-pass sufficient while gemini second-pass is disabled. |
+| 2 | Acceptance criteria met | PASS | `clearInheritedBeadsEnv(t)` helper added to `cmd/gc/path_helpers_test.go:22-45` — name, comment, 11-key env list, and loop body match the investigator spec byte-for-byte. All five required call sites updated: `writeCityRuntimeConfig`, `writeCityRuntimeConfigNamed`, `writeCityRuntimeConfigWithIncludes` in `cmd/gc/city_runtime_test.go`; `writeCityTOML`, `writeControllerNamedSessionCityTOML` in `cmd/gc/controller_test.go` (verified by `grep -rn 'clearInheritedBeadsEnv(t)' cmd/gc` → 5 hits). No new tests added — existing `TestCityRuntimeReload\|TestControllerReloads` regress-test the leak via pgrep delta. "Do not touch" list (`cr.shutdown`, `configuredBeadsProviderValue`, `gc-beads-bd.sh`) honored. |
+| 3 | Tests pass | PASS | `go vet ./...` clean. Targeted `go test ./cmd/gc/ -run 'TestCityRuntimeReload\|TestControllerReloads' -count=1` passes (0.309s) with `pgrep -af 'dolt sql-server.*--config /tmp/'` delta = 0 (19 → 19). Broader `cmd/gc/` suite shows 4 pre-existing failures unrelated to this change: `TestOpenStoreAtForCityExecProjectsConfiguredTargets`, `TestOpenStoreAtForCityExecBeadsBdProjectsScopedExternalDoltEnv`, `TestOpenStoreAtForCityExecUsesUniversalStoreTargetEnv`, `TestControllerQueryRuntimeEnvReturnsNilForNonBD`. Reproduced byte-for-byte on `origin/main` baseline (deployer re-ran with `git checkout origin/main -- cmd/gc/`); same four FAILs with identical messages. None of the 4 touch the env-clearing surface in this change. |
+| 4 | No high-severity review findings open | PASS | Zero HIGH findings. Reviewer notes "Findings: None". |
+| 5 | Final branch is clean | PASS | `git status` on tracked tree clean after the cherry-pick. Only `.gitkeep` untracked (pre-existing scaffold marker, unrelated). |
+| 6 | Branch diverges cleanly from main | PASS | 1 commit ahead of `origin/main` after cherry-pick (plus this gate commit once added). Cherry-pick of `e16ccf1f` applied with auto-merge of `cmd/gc/city_runtime_test.go`, no conflicts. |
+
+## Cherry-pick log
+
+| Source SHA | Branch SHA | Summary |
+|------------|------------|---------|
+| e16ccf1f | 97dee9e7 | test(cmd/gc): clear inherited GC_BEADS/dolt env in city.toml writers (ga-y64o) |
+
+No `EXCLUDES`. The commit touches only three test files; `issues.jsonl` is not in the diff.
+
+## Acceptance criteria — ga-y64o done-when
+
+- [x] `clearInheritedBeadsEnv` helper exists in a `_test.go` file in `cmd/gc/` (`cmd/gc/path_helpers_test.go:22-45`).
+- [x] All five test-config helpers call `clearInheritedBeadsEnv(t)` (verified via grep, 5 call sites).
+- [x] From an agent session with `GC_BEADS=bd` set, `go test ./cmd/gc/ -run "TestCityRuntimeReload|TestControllerReloads" -count=1` passes AND `pgrep -af 'dolt sql-server.*--config /tmp/'` count does not grow during the run (deployer measured 19 → 19).
+- [x] No new tests added unless they reproduce the leak — diff is +29/-0 across 3 files, no new `Test*` functions.
+- [x] `go vet ./...` clean. `go test ./cmd/gc/...` passes for everything not pre-existing-broken.
+
+## Test evidence
+
+```
+$ go vet ./...
+(clean)
+
+$ pgrep -af 'dolt sql-server.*--config /tmp/' | wc -l
+19
+
+$ go test ./cmd/gc/ -run 'TestCityRuntimeReload|TestControllerReloads' -count=1 -timeout 120s
+ok   github.com/gastownhall/gascity/cmd/gc   0.309s
+
+$ pgrep -af 'dolt sql-server.*--config /tmp/' | wc -l
+19
+
+$ go test ./cmd/gc/ -run 'TestCityRuntime|TestController|TestOpenStoreAt|TestPathHelpers' -count=1 -timeout 300s
+--- FAIL: TestOpenStoreAtForCityExecProjectsConfiguredTargets         (pre-existing on origin/main)
+--- FAIL: TestOpenStoreAtForCityExecBeadsBdProjectsScopedExternalDoltEnv (pre-existing on origin/main)
+--- FAIL: TestOpenStoreAtForCityExecUsesUniversalStoreTargetEnv       (pre-existing on origin/main)
+--- FAIL: TestControllerQueryRuntimeEnvReturnsNilForNonBD             (pre-existing on origin/main)
+FAIL   github.com/gastownhall/gascity/cmd/gc   110.166s
+
+$ git checkout origin/main -- cmd/gc/   # baseline check
+$ go test ./cmd/gc/ -run '<the 4 above>' -count=1 -timeout 120s
+--- FAIL: ... (same 4 fail identically — confirmed pre-existing)
+```
+
+## Pre-existing failures (not deploy blockers)
+
+The 4 failures listed above reproduce on `origin/main` baseline with byte-for-byte
+identical assertion messages. They concern store-target env file resolution
+(`store_target_exec_test.go`) and a controller-runtime-env probe
+(`work_query_probe_test.go:172`) — none touch `GC_BEADS` env clearing or the
+test-config writers modified by ga-y64o. Worth separate beads if not already
+tracked.
diff --git a/renovate.json b/renovate.json
index 3f875da94b..056acc37fb 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    "helpers:pinGitHubActionDigests",
+    "docker:pinDigests"
   ],
   "labels": ["dependencies"],
   "packageRules": [
@@ -12,6 +14,152 @@
     {
       "matchManagers": ["github-actions"],
       "groupName": "github actions"
+    },
+    {
+      "matchManagers": ["dockerfile"],
+      "groupName": "container base images"
+    },
+    {
+      "matchManagers": ["pip_requirements"],
+      "groupName": "python requirements"
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "groupName": "pinned build tools"
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^\\.github/workflows/(ci|nightly|mac-regression|rc-gate|review-formulas)\\.yml$/",
+        "/^deps\\.env$/",
+        "/^Makefile$/",
+        "/^contrib/k8s/Dockerfile\\.base$/"
+      ],
+      "matchStrings": [
+        "DOLT_VERSION:\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\"",
+        "DOLT_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "dolthub/dolt",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^\\.github/workflows/(ci|nightly|mac-regression|rc-gate|review-formulas)\\.yml$/",
+        "/^deps\\.env$/"
+      ],
+      "matchStrings": [
+        "BD_VERSION:\\s*\"(?<currentValue>v?\\d+\\.\\d+\\.\\d+)\""
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "gastownhall/beads"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^\\.github/actions/setup-gascity-(ubuntu|macos)/action\\.yml$/",
+        "/^contrib/k8s/Dockerfile\\.base$/",
+        "/^scripts/worker_inference_setup\\.py$/"
+      ],
+      "matchStrings": [
+        "claude-version:[\\s\\S]*?default:\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\"",
+        "CLAUDE_CODE_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)",
+        "CLAUDE_CODE_VERSION\\s*=\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""
+      ],
+      "datasourceTemplate": "npm",
+      "depNameTemplate": "@anthropic-ai/claude-code"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^contrib/k8s/Dockerfile\\.controller$/"
+      ],
+      "matchStrings": [
+        "KUBECTL_VERSION=(?<currentValue>v?\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "kubernetes/kubernetes"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^Makefile$/"
+      ],
+      "matchStrings": [
+        "GOLANGCI_LINT_VERSION\\s*:=\\s*(?<currentValue>\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "golangci/golangci-lint"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^Makefile$/"
+      ],
+      "matchStrings": [
+        "BUILDX_VERSION\\s*:=\\s*(?<currentValue>\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "docker/buildx"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^scripts/test-docker-session$/"
+      ],
+      "matchStrings": [
+        "FROM alpine:(?<currentValue>[^@\\s]+)@(?<currentDigest>sha256:[a-f0-9]+)"
+      ],
+      "datasourceTemplate": "docker",
+      "depNameTemplate": "alpine"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^scripts/worker_inference_setup\\.py$/"
+      ],
+      "matchStrings": [
+        "\"@openai/codex\",\\s*\"CODEX_CLI_VERSION\",\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""
+      ],
+      "datasourceTemplate": "npm",
+      "depNameTemplate": "@openai/codex"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^scripts/worker_inference_setup\\.py$/"
+      ],
+      "matchStrings": [
+        "\"@google/gemini-cli\",\\s*\"GEMINI_CLI_VERSION\",\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\""
+      ],
+      "datasourceTemplate": "npm",
+      "depNameTemplate": "@google/gemini-cli"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^deps\\.env$/"
+      ],
+      "matchStrings": [
+        "BR_VERSION=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "Dicklesworthstone/beads_rust",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "/^\\.github/workflows/container-scan\\.yml$/"
+      ],
+      "matchStrings": [
+        "TRIVY_VERSION:\\s*\"(?<currentValue>v?\\d+\\.\\d+\\.\\d+)\""
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "aquasecurity/trivy"
     }
   ]
 }
diff --git a/scripts/go-test-observable b/scripts/go-test-observable
new file mode 100755
index 0000000000..b4ac0abba0
--- /dev/null
+++ b/scripts/go-test-observable
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -lt 2 ] || [ "$2" != "--" ]; then
+  echo "usage: scripts/go-test-observable <name> -- <go test args...>" >&2
+  exit 2
+fi
+
+name="$1"
+shift 2
+
+if [ "$#" -eq 0 ]; then
+  echo "scripts/go-test-observable: missing go test args" >&2
+  exit 2
+fi
+
+log="${OBSERVABLE_TEST_LOG:-/tmp/gascity-${name}.jsonl}"
+rm -f "$log"
+
+echo "observable go test: log=$log" >&2
+echo "observable go test: command=go test -json $*" >&2
+
+print_failure_details() {
+  if ! command -v jq >/dev/null 2>&1; then
+    return
+  fi
+  if [ ! -s "$log" ]; then
+    return
+  fi
+
+  echo "observable go test: failure details from $log" >&2
+
+  mapfile -t failed_tests < <(jq -r 'select(.Action == "fail" and .Test != null) | .Test' "$log" | sort -u)
+  if [ "${#failed_tests[@]}" -gt 0 ]; then
+    for test_name in "${failed_tests[@]}"; do
+      echo "observable go test: failed test: $test_name" >&2
+      jq -r --arg test "$test_name" 'select(.Test == $test and .Output != null) | .Output' "$log" >&2
+    done
+  else
+    echo "observable go test: no test-level failure event was emitted; showing package output tail" >&2
+  fi
+
+  failure_lines="${OBSERVABLE_FAILURE_LINES:-240}"
+  echo "observable go test: last ${failure_lines} output lines" >&2
+  jq -r 'select(.Action == "output" and .Output != null) | .Output' "$log" | tail -n "$failure_lines" >&2
+}
+
+if command -v jq >/dev/null 2>&1; then
+  set +e
+  go test -json "$@" \
+    | tee "$log" \
+    | jq -r '
+      select(
+        .Action == "run" or
+        .Action == "fail" or
+        .Action == "skip" or
+        (.Action == "pass" and (.Test == null or (.Elapsed // 0) >= 1))
+      ) |
+      "\(.Time // "") \(.Action) \(.Test // .Package)"'
+  status=${PIPESTATUS[0]}
+  set -e
+else
+  echo "observable go test: jq not found; printing raw JSON progress" >&2
+  set +e
+  go test -json "$@" | tee "$log"
+  status=${PIPESTATUS[0]}
+  set -e
+fi
+
+if [ "$status" -ne 0 ]; then
+  echo "observable go test: FAIL status=$status log=$log" >&2
+  print_failure_details
+else
+  echo "observable go test: PASS log=$log" >&2
+fi
+
+exit "$status"
diff --git a/scripts/test-docker-session b/scripts/test-docker-session
index 9fea2cd464..76166cac1a 100755
--- a/scripts/test-docker-session
+++ b/scripts/test-docker-session
@@ -112,7 +112,7 @@ chmod +x "$BUILD_CTX/scroll-entrypoint.sh"
 
 # Primary image: Alpine + procps + tmux.
 cat > "$BUILD_CTX/Dockerfile" <<'DOCKERFILE'
-FROM alpine:latest
+FROM alpine:3.22@sha256:310c62b5e7ca5b08167e4384c68db0fd2905dd9c7493756d356e893909057601
 RUN apk add --no-cache procps tmux bash
 COPY entrypoint.sh /entrypoint.sh
 COPY delay-entrypoint.sh /delay-entrypoint.sh
@@ -125,7 +125,7 @@ echo "  OK: built $TEST_IMAGE (with tmux)"
 
 # Secondary image: no tmux (for requirement check test).
 cat > "$BUILD_CTX/Dockerfile.notmux" <<'DOCKERFILE'
-FROM alpine:latest
+FROM alpine:3.22@sha256:310c62b5e7ca5b08167e4384c68db0fd2905dd9c7493756d356e893909057601
 RUN apk add --no-cache procps
 CMD ["sleep", "300"]
 DOCKERFILE
diff --git a/scripts/test-go-test-shard b/scripts/test-go-test-shard
new file mode 100755
index 0000000000..282e8140c8
--- /dev/null
+++ b/scripts/test-go-test-shard
@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -ne 3 ]]; then
+  echo "usage: $0 <package> <shard-index> <shard-total>" >&2
+  exit 1
+fi
+
+test_pkg="$1"
+shard_index="$2"
+shard_total="$3"
+
+if ! [[ "$shard_index" =~ ^[0-9]+$ && "$shard_total" =~ ^[0-9]+$ ]]; then
+  echo "shard index and total must be positive integers" >&2
+  exit 1
+fi
+if (( shard_index < 1 || shard_total < 1 || shard_index > shard_total )); then
+  echo "invalid shard ${shard_index} of ${shard_total}" >&2
+  exit 1
+fi
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+timeout="${GO_TEST_TIMEOUT:-20m}"
+
+gopath_val="$(go env GOPATH)"
+gocache_val="$(go env GOCACHE)"
+gomodcache_val="$(go env GOMODCACHE)"
+gotmpdir_val="$(go env GOTMPDIR)"
+goroot_val="$(go env GOROOT)"
+
+extra_env=()
+while IFS='=' read -r name _; do
+  case "$name" in
+    ANTHROPIC_*|CLAUDE_CODE_*|GC_ACCEPTANCE_KEEP|GC_TIERC_FORCE|GC_TUTORIAL_GOLDENS_USE_CLAUDE_FOR_CODEX)
+      extra_env+=("${name}=${!name}")
+      ;;
+  esac
+done < <(env)
+
+run_go_test() {
+  local base_env=(
+    PATH="${PATH}" \
+    HOME="${HOME:-}" \
+    USER="${USER:-}" \
+    LOGNAME="${LOGNAME:-}" \
+    SHELL="${SHELL:-/bin/sh}" \
+    LANG="${LANG:-C.UTF-8}" \
+    TMPDIR="${TMPDIR:-/tmp}" \
+    XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-}" \
+    GOPATH="${gopath_val}" \
+    GOCACHE="${gocache_val}" \
+    GOMODCACHE="${gomodcache_val}" \
+    GOTMPDIR="${gotmpdir_val}" \
+    GOROOT="${GOROOT:-$goroot_val}" \
+    GOENV="${GOENV-}" \
+    GOFLAGS="${GOFLAGS-}" \
+    GO111MODULE="${GO111MODULE-}" \
+    GOEXPERIMENT="${GOEXPERIMENT-}" \
+    GOPROXY="${GOPROXY-}" \
+    GOPRIVATE="${GOPRIVATE-}" \
+    GONOPROXY="${GONOPROXY-}" \
+    GONOSUMDB="${GONOSUMDB-}" \
+    GOSUMDB="${GOSUMDB-}" \
+    GOINSECURE="${GOINSECURE-}" \
+    GOVCS="${GOVCS-}" \
+    GOWORK="${GOWORK-}" \
+    GC_FAST_UNIT="${GC_FAST_UNIT:-0}"
+  )
+  if (( ${#extra_env[@]} > 0 )); then
+    env -i "${base_env[@]}" "${extra_env[@]}" go test "$@"
+  else
+    env -i "${base_env[@]}" go test "$@"
+  fi
+}
+
+go_test_args=(-timeout "$timeout")
+if [[ -n "${GO_TEST_TAGS:-}" ]]; then
+  go_test_args=(-tags "$GO_TEST_TAGS" "${go_test_args[@]}")
+fi
+if [[ -n "${GO_TEST_COUNT:-}" ]]; then
+  go_test_args=(-count="$GO_TEST_COUNT" "${go_test_args[@]}")
+fi
+if [[ -n "${GO_TEST_COVERPROFILE:-}" ]]; then
+  go_test_args+=(-coverpkg=./... -coverprofile "$GO_TEST_COVERPROFILE")
+fi
+
+list_output="$(run_go_test "${go_test_args[@]}" "$test_pkg" -list '^Test' 2>&1)"
+tests=()
+while IFS= read -r line; do
+  [[ "$line" == Test* ]] || continue
+  tests+=("$line")
+done <<< "$list_output"
+
+if [[ ${#tests[@]} -eq 0 ]]; then
+  echo "no tests discovered for ${test_pkg}; go test -list output:" >&2
+  printf '%s\n' "$list_output" >&2
+  exit 1
+fi
+
+selected=()
+for i in "${!tests[@]}"; do
+  if (( i % shard_total == shard_index - 1 )); then
+    selected+=("${tests[$i]}")
+  fi
+done
+
+if [[ ${#selected[@]} -eq 0 ]]; then
+  echo "no tests selected for ${test_pkg} shard ${shard_index} of ${shard_total}" >&2
+  exit 1
+fi
+
+join_regex() {
+  local IFS='|'
+  printf '%s' "$*"
+}
+
+regex="^($(join_regex "${selected[@]}"))$"
+echo "Running ${test_pkg} shard ${shard_index} of ${shard_total} (${#selected[@]} tests)"
+printf '  %s\n' "${selected[@]}"
+run_go_test "${go_test_args[@]}" "$test_pkg" -run "$regex"
diff --git a/scripts/test-integration-shard b/scripts/test-integration-shard
index 4e050b16bf..bd784b44d5 100755
--- a/scripts/test-integration-shard
+++ b/scripts/test-integration-shard
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 if [[ $# -ne 1 ]]; then
-  echo "usage: $0 <packages|review-formulas|review-formulas-basic|review-formulas-retries|review-formulas-recovery|bdstore|rest|rest-smoke|rest-full|all>" >&2
+  echo "usage: $0 <packages|packages-core-N-of-M|packages-cmd-gc-N-of-M|packages-runtime-tmux-N-of-M|review-formulas|review-formulas-basic[-N-of-M]|review-formulas-retries[-N-of-M]|review-formulas-recovery|bdstore|rest|rest-smoke[-N-of-M]|rest-full[-N-of-M]|all>" >&2
   exit 1
 fi
 
@@ -111,6 +111,40 @@ run_pkg_tests() {
   run_go_test "${go_test_args[@]}" "$test_pkg" -run "$regex"
 }
 
+run_pkg_tests_modulo() {
+  local test_pkg="$1"
+  local shard_index="$2"
+  local shard_total="$3"
+  shift 3
+  local -a tests=("$@") selected=()
+  local i
+
+  validate_modulo_shard "$shard_index" "$shard_total"
+  for i in "${!tests[@]}"; do
+    if (( i % shard_total == shard_index - 1 )); then
+      selected+=("${tests[$i]}")
+    fi
+  done
+  if [[ ${#selected[@]} -eq 0 ]]; then
+    echo "no tests selected for shard ${shard} (${shard_index} of ${shard_total})" >&2
+    exit 1
+  fi
+  run_pkg_tests "$test_pkg" "${selected[@]}"
+}
+
+validate_modulo_shard() {
+  local shard_index="$1"
+  local shard_total="$2"
+  if ! [[ "$shard_index" =~ ^[0-9]+$ && "$shard_total" =~ ^[0-9]+$ ]]; then
+    echo "shard index and total must be positive integers" >&2
+    exit 1
+  fi
+  if (( shard_index < 1 || shard_total < 1 || shard_index > shard_total )); then
+    echo "invalid shard ${shard_index} of ${shard_total}" >&2
+    exit 1
+  fi
+}
+
 list_integration_tests() {
   run_go_test -tags integration -list '^Test' "$pkg" | grep '^Test'
 }
@@ -152,12 +186,78 @@ run_packages_shard() {
   run_go_test "${go_test_args[@]}" "${packages[@]}"
 }
 
+run_packages_core_shard() {
+  local shard_index="$1"
+  local shard_total="$2"
+  local -a packages=() selected=() go_test_args=()
+  local line i
+
+  validate_modulo_shard "$shard_index" "$shard_total"
+  while IFS= read -r line; do
+    packages+=("$line")
+  done < <(
+    go list ./... |
+      grep -v '^github.com/gastownhall/gascity/test/integration$' |
+      grep -v '^github.com/gastownhall/gascity/cmd/gc$' |
+      grep -v '^github.com/gastownhall/gascity/internal/runtime/tmux$'
+  )
+  if [[ ${#packages[@]} -eq 0 ]]; then
+    echo "no core packages found" >&2
+    exit 1
+  fi
+  for i in "${!packages[@]}"; do
+    if (( i % shard_total == shard_index - 1 )); then
+      selected+=("${packages[$i]}")
+    fi
+  done
+  if [[ ${#selected[@]} -eq 0 ]]; then
+    echo "no core packages selected for shard ${shard_index} of ${shard_total}" >&2
+    exit 1
+  fi
+  echo "Running shard packages-core-${shard_index}-of-${shard_total} (${#selected[@]} packages)"
+  go_test_args=(-tags integration -timeout "$timeout")
+  if [[ -n "${GO_TEST_COVERPROFILE:-}" ]]; then
+    go_test_args+=(-coverpkg=./... -coverprofile "$GO_TEST_COVERPROFILE")
+  fi
+  run_go_test "${go_test_args[@]}" "${selected[@]}"
+}
+
+run_packages_cmd_gc_shard() {
+  local shard_index="$1"
+  local shard_total="$2"
+  validate_modulo_shard "$shard_index" "$shard_total"
+  # The package integration bucket should stay a fast package sweep. The
+  # slow process-backed cmd/gc scenarios run through make test-cmd-gc-process
+  # locally and the dedicated CI cmd/gc process job on Linux.
+  GC_FAST_UNIT="${GC_FAST_UNIT:-1}" GO_TEST_TAGS=integration GO_TEST_TIMEOUT="$timeout" "$repo_root/scripts/test-go-test-shard" ./cmd/gc "$shard_index" "$shard_total"
+}
+
+run_packages_runtime_tmux_shard() {
+  local shard_index="$1"
+  local shard_total="$2"
+  validate_modulo_shard "$shard_index" "$shard_total"
+  GO_TEST_TAGS=integration GO_TEST_TIMEOUT="$timeout" "$repo_root/scripts/test-go-test-shard" ./internal/runtime/tmux "$shard_index" "$shard_total"
+}
+
 run_rest_smoke_shard() {
   validate_selected_tests "${rest_smoke_tests[@]}"
   run_pkg_tests "$pkg" "${rest_smoke_tests[@]}"
 }
 
+run_rest_smoke_shard_modulo() {
+  local shard_index="$1"
+  local shard_total="$2"
+  validate_selected_tests "${rest_smoke_tests[@]}"
+  run_pkg_tests_modulo "$pkg" "$shard_index" "$shard_total" "${rest_smoke_tests[@]}"
+}
+
 run_rest_full_shard() {
+  run_rest_full_shard_modulo 1 1
+}
+
+run_rest_full_shard_modulo() {
+  local shard_index="$1"
+  local shard_total="$2"
   # bash 3.2 has no associative arrays; encode the excluded set as a
   # newline-delimited string and use grep -Fx to test membership.
   local -a all_tests=() rest_tests=()
@@ -178,7 +278,7 @@ run_rest_full_shard() {
     fi
   done
 
-  run_pkg_tests "$pkg" "${rest_tests[@]}"
+  run_pkg_tests_modulo "$pkg" "$shard_index" "$shard_total" "${rest_tests[@]}"
 }
 
 run_review_formulas_all() {
@@ -189,6 +289,37 @@ run_review_formulas_all() {
   exit "$status"
 }
 
+if [[ "$shard" =~ ^packages-core-([0-9]+)-of-([0-9]+)$ ]]; then
+  run_packages_core_shard "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}"
+  exit 0
+fi
+if [[ "$shard" =~ ^packages-cmd-gc-([0-9]+)-of-([0-9]+)$ ]]; then
+  run_packages_cmd_gc_shard "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}"
+  exit 0
+fi
+if [[ "$shard" =~ ^packages-runtime-tmux-([0-9]+)-of-([0-9]+)$ ]]; then
+  run_packages_runtime_tmux_shard "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}"
+  exit 0
+fi
+if [[ "$shard" =~ ^review-formulas-basic-([0-9]+)-of-([0-9]+)$ ]]; then
+  validate_selected_tests "${review_formulas_basic_tests[@]}"
+  run_pkg_tests_modulo "$pkg" "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${review_formulas_basic_tests[@]}"
+  exit 0
+fi
+if [[ "$shard" =~ ^review-formulas-retries-([0-9]+)-of-([0-9]+)$ ]]; then
+  validate_selected_tests "${review_formulas_retry_tests[@]}"
+  run_pkg_tests_modulo "$pkg" "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${review_formulas_retry_tests[@]}"
+  exit 0
+fi
+if [[ "$shard" =~ ^rest-smoke-([0-9]+)-of-([0-9]+)$ ]]; then
+  run_rest_smoke_shard_modulo "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}"
+  exit 0
+fi
+if [[ "$shard" =~ ^rest-full-([0-9]+)-of-([0-9]+)$ ]]; then
+  run_rest_full_shard_modulo "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}"
+  exit 0
+fi
+
 case "$shard" in
   packages)
     run_packages_shard
diff --git a/scripts/test-local-parallel b/scripts/test-local-parallel
new file mode 100755
index 0000000000..5dbe9dd9c5
--- /dev/null
+++ b/scripts/test-local-parallel
@@ -0,0 +1,211 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'USAGE'
+usage: scripts/test-local-parallel <fast|cmd-gc-process|integration|full>
+
+Environment:
+  LOCAL_TEST_JOBS        max concurrent jobs (default: detected CPU count)
+  CMD_GC_PROCESS_TOTAL  cmd/gc shard count (default: 6)
+USAGE
+}
+
+if [[ $# -ne 1 ]]; then
+  usage
+  exit 1
+fi
+
+mode="$1"
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+detect_cpus() {
+  nproc 2>/dev/null ||
+    getconf _NPROCESSORS_ONLN 2>/dev/null ||
+    sysctl -n hw.ncpu 2>/dev/null ||
+    printf '8\n'
+}
+
+local_jobs="${LOCAL_TEST_JOBS:-$(detect_cpus)}"
+cmd_gc_total="${CMD_GC_PROCESS_TOTAL:-6}"
+
+if ! [[ "$local_jobs" =~ ^[0-9]+$ && "$local_jobs" -gt 0 ]]; then
+  echo "LOCAL_TEST_JOBS must be a positive integer" >&2
+  exit 1
+fi
+if ! [[ "$cmd_gc_total" =~ ^[0-9]+$ && "$cmd_gc_total" -gt 0 ]]; then
+  echo "CMD_GC_PROCESS_TOTAL must be a positive integer" >&2
+  exit 1
+fi
+
+gopath_val="$(go env GOPATH)"
+gocache_val="$(go env GOCACHE)"
+gomodcache_val="$(go env GOMODCACHE)"
+gotmpdir_val="$(go env GOTMPDIR)"
+goroot_val="$(go env GOROOT)"
+
+jobspecs=()
+
+add_job() {
+  local label="$1"
+  local command="$2"
+  jobspecs+=("${label}::${command}")
+}
+
+add_fsys_compile_job() {
+  add_job "fsys-darwin-compile" \
+    'tmp=$(mktemp -d); trap '"'"'rm -rf "$tmp"'"'"' EXIT; GOOS=darwin GOARCH=arm64 go test -c -o "$tmp/fsys.test" ./internal/fsys'
+}
+
+add_unit_core_job() {
+  add_job "unit-core" \
+    'GC_FAST_UNIT=1 go test $(go list ./... | grep -v '"'"'^github.com/gastownhall/gascity/cmd/gc$'"'"')'
+}
+
+add_cmd_gc_shards() {
+  local label_prefix="$1"
+  local gc_fast_unit="$2"
+  local tags="$3"
+  local i command
+  for i in $(seq 1 "$cmd_gc_total"); do
+    command="GC_FAST_UNIT=${gc_fast_unit} GO_TEST_COUNT=1 GO_TEST_TIMEOUT=20m"
+    if [[ -n "$tags" ]]; then
+      command+=" GO_TEST_TAGS=${tags}"
+    fi
+    command+=" ./scripts/test-go-test-shard ./cmd/gc ${i} ${cmd_gc_total}"
+    add_job "${label_prefix}-${i}-of-${cmd_gc_total}" "$command"
+  done
+}
+
+add_integration_jobs() {
+  local i
+  for i in 1 2 3 4; do
+    add_job "integration-packages-core-${i}-of-4" "./scripts/test-integration-shard packages-core-${i}-of-4"
+  done
+  for i in 1 2 3 4 5 6; do
+    add_job "integration-packages-cmd-gc-${i}-of-6" "./scripts/test-integration-shard packages-cmd-gc-${i}-of-6"
+  done
+  for i in 1 2 3; do
+    add_job "integration-packages-runtime-tmux-${i}-of-3" "./scripts/test-integration-shard packages-runtime-tmux-${i}-of-3"
+  done
+  for i in 1 2; do
+    add_job "integration-review-formulas-basic-${i}-of-2" "./scripts/test-integration-shard review-formulas-basic-${i}-of-2"
+  done
+  for i in 1 2; do
+    add_job "integration-review-formulas-retries-${i}-of-2" "./scripts/test-integration-shard review-formulas-retries-${i}-of-2"
+  done
+  add_job "integration-review-formulas-recovery" "./scripts/test-integration-shard review-formulas-recovery"
+  add_job "integration-bdstore" "./scripts/test-integration-shard bdstore"
+  for i in 1 2; do
+    add_job "integration-rest-smoke-${i}-of-2" "./scripts/test-integration-shard rest-smoke-${i}-of-2"
+  done
+  for i in 1 2 3 4 5 6 7 8; do
+    add_job "integration-rest-full-${i}-of-8" "./scripts/test-integration-shard rest-full-${i}-of-8"
+  done
+}
+
+case "$mode" in
+  fast)
+    add_fsys_compile_job
+    add_unit_core_job
+    add_cmd_gc_shards "unit-cmd-gc" "1" ""
+    ;;
+  cmd-gc-process)
+    add_cmd_gc_shards "cmd-gc-process" "0" ""
+    ;;
+  integration)
+    add_integration_jobs
+    ;;
+  full)
+    add_fsys_compile_job
+    add_unit_core_job
+    add_cmd_gc_shards "cmd-gc-process" "0" ""
+    add_integration_jobs
+    ;;
+  *)
+    usage
+    exit 1
+    ;;
+esac
+
+if [[ ${#jobspecs[@]} -eq 0 ]]; then
+  echo "no jobs selected for mode ${mode}" >&2
+  exit 1
+fi
+
+cleanup_log_dir=1
+if [[ -n "${LOCAL_TEST_LOG_DIR:-}" ]]; then
+  log_dir="$LOCAL_TEST_LOG_DIR"
+  cleanup_log_dir=0
+else
+  log_dir="$(mktemp -d "${TMPDIR:-/tmp}/gc-local-tests.XXXXXX")"
+fi
+export LOCAL_TEST_LOG_DIR="$log_dir"
+export TEST_LOCAL_GOPATH="$gopath_val"
+export TEST_LOCAL_GOCACHE="$gocache_val"
+export TEST_LOCAL_GOMODCACHE="$gomodcache_val"
+export TEST_LOCAL_GOTMPDIR="$gotmpdir_val"
+export TEST_LOCAL_GOROOT="${GOROOT:-$goroot_val}"
+
+echo "Running ${#jobspecs[@]} ${mode} job(s) with LOCAL_TEST_JOBS=${local_jobs}"
+
+set +e
+printf '%s\0' "${jobspecs[@]}" | xargs -0 -n1 -P "$local_jobs" bash -c '
+  set -euo pipefail
+  spec="$1"
+  label="${spec%%::*}"
+  command="${spec#*::}"
+  safe_label="$(printf "%s" "$label" | tr -c "A-Za-z0-9._-" "_")"
+  log="$LOCAL_TEST_LOG_DIR/${safe_label}.log"
+
+  echo "[$label] start"
+  if env -i \
+    PATH="${PATH}" \
+    HOME="${HOME:-}" \
+    USER="${USER:-}" \
+    LOGNAME="${LOGNAME:-}" \
+    SHELL="${SHELL:-/bin/sh}" \
+    LANG="${LANG:-C.UTF-8}" \
+    TMPDIR="${TMPDIR:-/tmp}" \
+    XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-}" \
+    GOPATH="${TEST_LOCAL_GOPATH}" \
+    GOCACHE="${TEST_LOCAL_GOCACHE}" \
+    GOMODCACHE="${TEST_LOCAL_GOMODCACHE}" \
+    GOTMPDIR="${TEST_LOCAL_GOTMPDIR}" \
+    GOROOT="${TEST_LOCAL_GOROOT}" \
+    GOENV="${GOENV-}" \
+    GOFLAGS="${GOFLAGS-}" \
+    GO111MODULE="${GO111MODULE-}" \
+    GOEXPERIMENT="${GOEXPERIMENT-}" \
+    GOPROXY="${GOPROXY-}" \
+    GOPRIVATE="${GOPRIVATE-}" \
+    GONOPROXY="${GONOPROXY-}" \
+    GONOSUMDB="${GONOSUMDB-}" \
+    GOSUMDB="${GOSUMDB-}" \
+    GOINSECURE="${GOINSECURE-}" \
+    GOVCS="${GOVCS-}" \
+    GOWORK="${GOWORK-}" \
+    bash -lc "$command" >"$log" 2>&1; then
+    echo "[$label] ok"
+  else
+    status=$?
+    echo "[$label] failed with exit ${status}; log: ${log}" >&2
+    sed -n '"'"'1,240p'"'"' "$log" >&2
+    exit "$status"
+  fi
+' _
+status=$?
+set -e
+
+if [[ "$status" -eq 0 ]]; then
+  if [[ "$cleanup_log_dir" -eq 1 ]]; then
+    rm -rf "$log_dir"
+  fi
+  echo "All ${mode} jobs passed"
+else
+  echo "One or more ${mode} jobs failed; logs are in ${log_dir}" >&2
+fi
+
+exit "$status"
diff --git a/scripts/test_go_test_shard_test.go b/scripts/test_go_test_shard_test.go
new file mode 100644
index 0000000000..a98a9c88ed
--- /dev/null
+++ b/scripts/test_go_test_shard_test.go
@@ -0,0 +1,59 @@
+package scripts_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+func TestGoTestShardPreservesAcceptanceAuthEnv(t *testing.T) {
+	repoRoot := filepath.Dir(t.TempDir())
+	if wd, err := os.Getwd(); err == nil {
+		repoRoot = filepath.Dir(wd)
+	}
+
+	cmd := exec.Command(
+		filepath.Join(repoRoot, "scripts", "test-go-test-shard"),
+		"./scripts/testdata/test-go-test-shard/env_required",
+		"1",
+		"1",
+	)
+	cmd.Dir = repoRoot
+	cmd.Env = []string{
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + t.TempDir(),
+		"GO_TEST_TIMEOUT=1m",
+		"ANTHROPIC_AUTH_TOKEN=synthetic-token",
+	}
+
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("test-go-test-shard failed: %v\n%s", err, out)
+	}
+}
+
+func TestGoTestShardRunsWithoutPreservedProviderEnv(t *testing.T) {
+	repoRoot := filepath.Dir(t.TempDir())
+	if wd, err := os.Getwd(); err == nil {
+		repoRoot = filepath.Dir(wd)
+	}
+
+	cmd := exec.Command(
+		filepath.Join(repoRoot, "scripts", "test-go-test-shard"),
+		"./scripts/testdata/test-go-test-shard/no_extra_env",
+		"1",
+		"1",
+	)
+	cmd.Dir = repoRoot
+	cmd.Env = []string{
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + t.TempDir(),
+		"GO_TEST_TIMEOUT=1m",
+	}
+
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("test-go-test-shard failed without preserved provider env: %v\n%s", err, out)
+	}
+}
diff --git a/scripts/testdata/test-go-test-shard/env_required/env_required_test.go b/scripts/testdata/test-go-test-shard/env_required/env_required_test.go
new file mode 100644
index 0000000000..dc07d51db9
--- /dev/null
+++ b/scripts/testdata/test-go-test-shard/env_required/env_required_test.go
@@ -0,0 +1,15 @@
+package envrequired
+
+import (
+	"os"
+	"testing"
+)
+
+func TestMain(m *testing.M) {
+	if os.Getenv("ANTHROPIC_AUTH_TOKEN") == "" {
+		os.Exit(0)
+	}
+	os.Exit(m.Run())
+}
+
+func TestRunsWhenAuthEnvSurvives(t *testing.T) {}
diff --git a/scripts/testdata/test-go-test-shard/env_required/testenv_import_test.go b/scripts/testdata/test-go-test-shard/env_required/testenv_import_test.go
new file mode 100644
index 0000000000..c2ea6db7a5
--- /dev/null
+++ b/scripts/testdata/test-go-test-shard/env_required/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package envrequired
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/scripts/testdata/test-go-test-shard/no_extra_env/no_extra_env_test.go b/scripts/testdata/test-go-test-shard/no_extra_env/no_extra_env_test.go
new file mode 100644
index 0000000000..62b868bcf0
--- /dev/null
+++ b/scripts/testdata/test-go-test-shard/no_extra_env/no_extra_env_test.go
@@ -0,0 +1,5 @@
+package noextraenv
+
+import "testing"
+
+func TestRunsWithoutExtraEnv(t *testing.T) {}
diff --git a/scripts/testdata/test-go-test-shard/no_extra_env/testenv_import_test.go b/scripts/testdata/test-go-test-shard/no_extra_env/testenv_import_test.go
new file mode 100644
index 0000000000..ed4ad58c88
--- /dev/null
+++ b/scripts/testdata/test-go-test-shard/no_extra_env/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package noextraenv
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/scripts/testenv_import_test.go b/scripts/testenv_import_test.go
new file mode 100644
index 0000000000..17f003fd0f
--- /dev/null
+++ b/scripts/testenv_import_test.go
@@ -0,0 +1,5 @@
+// Code generated by go run scripts/add-testenv-import.go; DO NOT EDIT.
+
+package scripts_test
+
+import _ "github.com/gastownhall/gascity/internal/testenv"
diff --git a/scripts/worker_inference_setup.py b/scripts/worker_inference_setup.py
index a5e0fade46..e19019aec3 100644
--- a/scripts/worker_inference_setup.py
+++ b/scripts/worker_inference_setup.py
@@ -1,15 +1,18 @@
 #!/usr/bin/env python3
 
 import argparse
+import os
+from pathlib import Path
 import shutil
 import subprocess
 
 
-PACKAGE_BY_PROVIDER = {
-    "claude": "@anthropic-ai/claude-code",
-    "codex": "@openai/codex",
-    "gemini": "@google/gemini-cli",
+NPM_PACKAGE_BY_PROVIDER = {
+    "codex": ("@openai/codex", "CODEX_CLI_VERSION", "0.125.0"),
+    "gemini": ("@google/gemini-cli", "GEMINI_CLI_VERSION", "0.40.0"),
+    "opencode": ("opencode-ai", "OPENCODE_CLI_VERSION", "1.14.33"),
 }
+CLAUDE_CODE_VERSION = "2.1.123"
 
 
 def parse_args() -> argparse.Namespace:
@@ -26,15 +29,24 @@ def main() -> int:
     if args.command != "install":
         raise SystemExit(f"unsupported command: {args.command}")
     provider = args.profile.split("/", 1)[0].strip().lower()
-    package = PACKAGE_BY_PROVIDER.get(provider)
-    if not package:
+    if provider not in {"claude", *NPM_PACKAGE_BY_PROVIDER}:
         raise SystemExit(f"unsupported worker-inference profile: {args.profile!r}")
     if shutil.which(provider) and not args.force:
         print(f"{provider} already present in PATH; skipping install")
         return 0
-    subprocess.run(["npm", "install", "-g", package], check=True)
+
+    if provider == "claude":
+        version = os.environ.get("CLAUDE_CODE_VERSION", CLAUDE_CODE_VERSION)
+        repo_root = Path(__file__).resolve().parents[1]
+        installer = repo_root / ".github" / "scripts" / "install-claude-native.sh"
+        subprocess.run([str(installer), version], check=True)
+    else:
+        package, env_var, default_version = NPM_PACKAGE_BY_PROVIDER[provider]
+        version = os.environ.get(env_var, default_version)
+        subprocess.run(["npm", "install", "-g", f"{package}@{version}"], check=True)
+
     if not shutil.which(provider):
-        raise SystemExit(f"{provider} was not found in PATH after installing {package}")
+        raise SystemExit(f"{provider} was not found in PATH after installation")
     return 0
 
 
diff --git a/specs/architecture.md b/specs/architecture.md
deleted file mode 100644
index 9d1dbbe3a4..0000000000
--- a/specs/architecture.md
+++ /dev/null
@@ -1,555 +0,0 @@
-# Gas City Architecture
-
-This spec captures the architectural invariants Gas City has
-converged on. It is a normative document: future contributions that
-violate these invariants are wrong unless a conscious decision in
-this spec changes. Plans in `plans/archive/` describe the journeys
-that produced these invariants; this spec describes the
-destination.
-
-Two architectural themes run through everything below:
-
-1. **The object model is the center; the CLI and the HTTP + SSE API
-   are projections over it.** One canonical domain, two typed
-   surfaces.
-2. **Typed data end-to-end.** Go structs with annotations drive a
-   generated OpenAPI 3.1 contract; every wire-visible shape appears
-   in the spec; consumers in any language code against the same
-   contract. Zero opacity on the wire.
-
-## 1. The object model
-
-`internal/{beads, mail, convoy, formula, agent, events, session,
-sling, graphroute, agentutil, pathutil, ...}` is the canonical
-domain. All business logic lives there. The two surfaces below call
-into it; neither re-implements validation, routing, or invariants.
-
-```
-cmd/gc/cmd_*.go               internal/api/handler_*.go
-  (arg parsing,                 (Huma input/output types,
-   text formatting,              handler bodies,
-   exit codes)                   typed error returns)
-        \                              /
-         \                            /
-          v                          v
-   internal/sling/        internal/convoy/
-   internal/agentutil/    internal/graphroute/
-   internal/pathutil/
-            |
-            v
-   internal/{beads, config, formula, molecule, agent, events, ...}
-```
-
-### Invariants
-
-- **Domain code has no I/O surfacing.** No `fmt.Fprintf`, no
-  `io.Writer` parameters, no HTTP responses. Domain functions
-  return values and errors. Text formatting is a CLI concern; JSON
-  shaping is an API concern.
-- **Narrow interfaces over flag bags.** Domain-side dependencies
-  use focused interfaces (`AgentResolver`, `BeadRouter`,
-  `Notifier`, `BranchResolver`) validated at construction.
-- **Intent-based APIs.** Callers express intent (`RouteBead`,
-  `LaunchFormula`, `AttachFormula`, `ExpandConvoy`); implementation
-  decides how (shell command, direct store, API call). No
-  god-struct option bags passed around.
-- **No upward dependencies.** A lower layer never imports from a
-  higher layer.
-
-## 2. Projections: CLI and HTTP + SSE API
-
-### CLI projection (`cmd/gc/`)
-
-The CLI calls the core library directly. It is not a generic
-remote client; it coexists with a local supervisor in the same city
-by routing through HTTP only when lock coordination requires it.
-
-Concretely, `cmd/gc/apiroute.go:apiClient()` implements this rule:
-
-- **No running local supervisor** → CLI calls the core library
-  directly against the on-disk stores.
-- **Running local supervisor with mutations allowed** → CLI routes
-  the mutation through the local HTTP API via the generated Go
-  client. The supervisor executes the mutation under its own
-  locks; the CLI's result is consistent with the supervisor's
-  state.
-
-Remote access is not the first-class reason this path exists. A
-`--base-url http://remote:port` invocation is a side effect of the
-same mechanism, not its purpose. The generated client is "library
-calls dispatched over HTTP when we have to cross a process
-boundary we didn't create."
-
-### API projection (`internal/api/`)
-
-Every HTTP + SSE endpoint is registered through Huma against
-annotated Go types. Huma generates the OpenAPI 3.1 spec from those
-types; the spec drives everything downstream.
-
-### The generated Go client
-
-`internal/api/genclient/` has three in-tree consumer categories,
-governed by a structural rule: **direct consumption is allowed for
-endpoints that (a) do not participate in write-side fallback (no
-`ShouldFallback` path) and (b) do not require domain-type conversion
-at the adapter seam.** Anything that fails either test goes through
-`internal/api/client.go`.
-
-1. **CLI mutation coordination** via `internal/api/client.go`, used
-   by `cmd/gc/apiroute.go` as described above. This is the only
-   consumer for paths that mutate state and could race an in-process
-   supervisor, or that need domain-type conversion (e.g. typed
-   `session.SubmitIntent` from a string wire field). The adapter
-   also owns local-file fallback when the controller isn't running.
-2. **Read/stream CLI surfaces that import genclient directly** —
-   currently `cmd/gc/cmd_events.go`, which calls typed methods for
-   event listing and SSE following. Events have no write-side
-   fallback (no bus without a controller) and need no domain-type
-   conversion, so they satisfy the structural rule. Future
-   read-only CLI surfaces that meet the same two conditions are
-   allowed to import genclient directly; no case-by-case approval
-   needed.
-3. **Layer 2 conformance probe** —
-   `genclient_roundtrip_test.go` exercises every generated method
-   against a real supervisor so spec/reality drift fails CI.
-
-The generated client is not promoted as a public Go SDK for
-external consumers. External Go consumers, if they ever appear,
-get a supported surface at that point; until then the `internal/`
-location is load-bearing.
-
-### The dashboard projection
-
-The dashboard is a static TypeScript SPA served by a tiny Go
-binary (`cmd/gc/dashboard/`) whose only jobs are to embed the
-compiled bundle and inject the supervisor URL into `index.html`.
-The SPA talks directly to the supervisor's typed OpenAPI endpoints
-from the browser — the dashboard server is NOT an API proxy. The
-dashboard server also hosts one narrow operational debug endpoint
-(`/__client-log`) that accepts browser error logs for centralized
-debugging; this endpoint is intentionally outside the typed HTTP +
-SSE control plane and may use standard `encoding/json` for body
-decoding.
-
-## 3. The typed-wire principle
-
-The invariants below apply to every operation under `internal/api/`
-except the `/svc/*` workspace-service proxy (see §5).
-
-### 3.1 Annotations drive the live implementation
-
-Each endpoint is a Go function whose signature (typed input struct,
-typed output struct) plus a `huma.Operation` value IS the endpoint
-definition. Huma binds it, validates it, routes it, serializes it,
-schema-describes it. There is no second description of the endpoint
-anywhere — not in a router table, not in an OpenAPI YAML, not in a
-client stub.
-
-### 3.2 Spec is generated, never hand-written
-
-`internal/api/openapi.json` and `docs/schema/openapi.json` are
-outputs of `cmd/genspec`, which reads the live Huma registration
-from a `SupervisorMux`. The pre-commit hook regenerates both on
-every Go-file commit. `TestOpenAPISpecInSync` fails CI if the
-committed spec drifts from what the supervisor serves.
-
-### 3.3 The routes we register ARE the routes we expose
-
-Per-city operations live at `/v0/city/{cityName}/...`.
-Supervisor-scope operations live at their top-level paths. No
-shadow mapping. No `prefix-strip-and-forward`. No client-side
-path-rewrite helpers. The existence of such a helper is direct
-evidence the spec disagrees with reality and is a bug to fix.
-
-### 3.4 No hand-constructed JSON for domain data
-
-Every wire byte that represents a domain value comes from encoding
-a typed Go struct (schema-registered with Huma) through the
-standard JSON encoder, directly or via Huma's own serialization
-machinery. This principle forbids three anti-patterns specifically:
-
-- `json.Marshal(map[string]any{...})` — untyped input.
-- `fmt.Sprintf`-built JSON strings — hand-constructed shape.
-- `json.Marshal(anyInterfaceValue)` where the interface carries
-  values whose types are not schema-registered — hides the shape
-  from the spec.
-
-The test a reviewer applies: *is there any line in your code that
-produces JSON-shaped output from non-typed or map-typed input?* If
-yes, violation. If every JSON byte comes from `encoder.Encode` of a
-typed, schema-registered struct, the principle holds.
-
-Protocol framing around domain data — HTTP status codes, HTTP
-response headers, SSE `id:` / `event:` / `data:` / retry line
-separators, chunked-encoding bytes — is not domain data and is not
-in scope for this principle. The carve-out is direction-symmetric
-and covers two specific files: `internal/api/sse.go` (emitter)
-hand-writes the SSE protocol-text lines around a typed
-`encoder.Encode(data)` call on a registered struct, and
-`cmd/gc/cmd_events.go:sseDecoder` (consumer) hand-parses the same
-SSE protocol-text lines and `json.Unmarshal`s the `data:` payload
-into typed `genclient.*` structs. In both directions the domain
-payload IS framework-encoded/decoded; the surrounding protocol
-literals are not JSON at all.
-
-New SSE endpoints must register through `registerSSE` /
-`registerSSEStringID`; ad-hoc SSE handlers outside those helpers
-are not covered by this carve-out.
-
-Edge cases that are NOT wire and therefore exempt:
-
-- SQL/BLOB (de)serialization in storage packages.
-- Hashing request bodies for idempotency keys.
-- Parsing stored JSONL transcript/log files from disk.
-- Parsing external-tool output we don't own (provider CLI stdout,
-  provider auth files like `~/.codex/auth.json`).
-- Internal event-bus `[]byte` payloads between in-process emitters
-  and consumers (these become typed at the wire via the registry —
-  see §4).
-
-Custom `MarshalJSON` / `UnmarshalJSON` on wire types are forbidden
-with two narrow, documented exceptions:
-
-- **`SessionRawMessageFrame`** (`internal/api/session_frame_types.go`)
-  — the raw-frame pass-through for provider-native session
-  transcripts; forwards arbitrary JSON the provider wrote. See §3.6.
-- **`EventPayloadUnion`** (`internal/api/convoy_event_stream.go`)
-  — the wire wrapper around `events.Payload` that emits the typed
-  payload as a named `oneOf` component. Its `MarshalJSON` emits
-  the concrete variant directly (so the wire sees `{"rig":...}`
-  rather than a wrapper object); its Schema method registers and
-  refs the named component. Required to get a single named
-  `EventPayload` component schema that Go and TS clients can both
-  consume.
-
-### 3.5 Typed structs for every shape knowable at compile time
-
-Every response field, every SSE event payload, every input body is
-a named Go struct with real fields and Huma tags. No
-`json.RawMessage` or `map[string]any` in the typed control plane,
-with exactly one class of exception (§3.6).
-
-"Heterogeneous", "opaque", "clients render it generically", "we'll
-figure out the union later", and "it's just internal" are not
-qualifying exceptions. If our code constructs the map, we know the
-keys. Make it a struct.
-
-### 3.5.1 No hidden inputs — every accepted parameter appears in the spec
-
-Every input a handler reads MUST be a typed field on its Huma
-input struct (`path:`, `query:`, `header:`, or `Body`). The
-generated OpenAPI spec is the complete and exhaustive description
-of the inputs an endpoint accepts. Running a request through a
-handler must not produce a different outcome than running the same
-request through the spec.
-
-Three anti-patterns are specifically forbidden:
-
-- **Dynamic or wildcard query parameters.** Any scheme where a
-  handler accepts query keys matching a pattern (`var.*`, `meta_*`,
-  `x-*`) rather than declared names. OpenAPI 3.1 cannot express
-  wildcard query keys; accepting them creates a hidden contract
-  the spec cannot describe. When a handler needs an open-ended
-  string-to-string dictionary as input, move the input into a
-  typed request body field (`Vars map[string]string` on a POST
-  body). Dictionary bodies have a schema; dictionary query
-  parameters do not.
-- **Resolvers that read raw URL query or header values that
-  aren't declared input fields.** `huma.Resolver` implementations
-  may validate or normalize values the struct already declares,
-  but may not read keys off `ctx.URL().Query()` or `ctx.Header()`
-  that aren't present on the input struct. If a resolver needs a
-  value, that value is a declared field — no exceptions.
-- **Presence-vs-empty semantics not expressible in JSONSchema.**
-  If a handler behaves differently for "parameter absent" vs
-  "parameter present with empty value", the input field must be a
-  pointer type (`*string`) so the distinction appears on the wire
-  contract. Resolver-based presence flags hide the semantics.
-
-The test a reviewer applies: does running an undeclared query
-parameter or an undeclared body field through the handler change
-its behavior? If yes, violation. The spec is the contract; the
-handler does not get a second, private contract the spec doesn't
-know about.
-
-Huma does not reject undeclared query parameters by default
-(they are silently ignored). That is not permission to rely on
-them — silent acceptance of undeclared parameters is a property
-of the framework, not a blessing of hidden contract. Callers that
-send undeclared parameters are sending noise; handlers that read
-them are violating this principle.
-
-### 3.6 Raw pass-through for provider-native session frames
-
-Session transcript streaming and query endpoints forward
-provider-native frames with full fidelity. Each response/envelope
-identifies the producing provider via a `provider` field whose
-value is one of the known provider keys (`claude`, `codex`,
-`gemini`, `open-code`, etc.); each frame's JSON is emitted verbatim
-as the provider wrote it, with no GC-side interpretation.
-Consumers parse frames using provider-specific logic on their side,
-keyed by the provider identifier on the envelope.
-
-The single JSON-pass-through wire type is `SessionRawMessageFrame`
-(`internal/api/session_frame_types.go`). Its Schema method emits
-an "any JSON value" schema because Gas City does not own the
-shape of provider frames. Publishing typed wire schemas for
-provider frames would claim a contract we don't own: a provider
-could change its frame shape tomorrow and the spec would silently
-lie until regenerated. Honest opacity with a provider discriminator
-is the right design.
-
-Passing through externally-authored shapes is not a license to
-also opacify our own shapes that happen to be nested near them.
-Every GC-owned field on the same envelope as the raw frames
-(envelope metadata, provider identifier, session info) stays
-typed.
-
-### 3.7 Every event type has a typed wire payload
-
-See §4.
-
-### 3.8 Error responses are typed too
-
-Every error returned by a Huma handler is a
-`huma.StatusError`-producing call with a real problem-details
-body. No `apiError{}` shortcuts. No hand-written `writeError`.
-
-For the outermost panic-recovery middleware (which must run before
-Huma enters the stack), error bodies are pre-serialized
-`application/problem+json` byte constants — one `var` declaration
-per well-known error, no runtime `json.Marshal`. The constants
-live in `internal/api/middleware.go` as `problemBody` values.
-
-### 3.9 `/svc/*` is the only exclusion
-
-`/svc/*` is a raw pass-through to external service processes that
-own their own contracts. It is explicitly not a typed API
-surface. This is the single carved-out path inside `internal/api/`.
-If `/svc/*` ever becomes typed, it gets its own migration.
-
-## 4. Event typing (the registry)
-
-Events are a first-class part of the typed wire contract. Both the
-SSE streams (`/v0/events/stream`,
-`/v0/city/{cityName}/events/stream`) and the list endpoints
-(`GET /v0/events`, `GET /v0/city/{cityName}/events`) describe their
-`payload` field as a named `oneOf` union covering every registered
-`events.Payload` shape. There is no opaque `payload: {}` anywhere
-on the wire.
-
-### Mechanism
-
-- **Bus layer (`internal/events`)** stores payloads as `[]byte` so
-  it stays domain-agnostic. `events.Event` and `events.TaggedEvent`
-  are bus-internal types only; they are never returned directly
-  from an HTTP handler.
-- **Registry (`internal/events/payload.go`)** holds the event-type
-  → Go-type mapping. `events.RegisterPayload(typeConst, sample)`
-  associates a constant with a sample value of a type implementing
-  the sealed `events.Payload` interface. `events.DecodePayload`
-  turns bus bytes back into the registered typed value.
-- **Emitters** take values of `events.Payload` rather than
-  `map[string]any`. The sealed interface keeps ad-hoc shapes out
-  of emission sites at compile time.
-- **Wire projection** — the API-layer `WireEvent` /
-  `WireTaggedEvent` types (list) and `eventStreamEnvelope` /
-  `taggedEventStreamEnvelope` (SSE) carry a typed `Payload` field
-  wrapped in `EventPayloadUnion`. `EventPayloadUnion.Schema`
-  registers a named `EventPayload` component whose schema is a
-  `oneOf` of every registered payload type.
-
-### Registry coverage
-
-Every constant in `events.KnownEventTypes` MUST have a registered
-payload. Events that carry no structured data register
-`events.NoPayload` — a typed empty struct that still produces a
-named schema variant so the wire stays uniform across event types.
-
-`TestEveryKnownEventTypeHasRegisteredPayload` fails CI if a new
-constant is added without registration; that's how the registry
-discipline stays load-bearing rather than best-effort.
-
-**Decode-failure policy (uniform across list and stream).** Decode
-failures and unregistered event types are omitted from list and
-stream output and logged via `log.Printf`; the wire never carries
-a degraded envelope with nil payload. A malformed event is a CI
-bug (the registry-coverage test above catches it before prod);
-emitting a typed envelope with `payload: null` would train
-consumers to tolerate broken payloads, defeating the point of
-§3.4. Clean omission plus a loud log is the contract.
-
-### Discrimination design
-
-The envelope carries a plain `type: string` field; the `payload`
-field is the discriminated `oneOf` union. Consumers switch on
-`type` and narrow `payload` explicitly:
-
-```typescript
-if (event.type === "mail.sent") {
-  use(event.payload as MailEventPayload);
-}
-```
-
-Envelope-level discrimination — each event-type constant pinned
-as a `type` const in its own envelope variant, with OpenAPI 3.1
-discriminators giving consumers automatic narrowing — would be
-nicer. It is not the design because no current Go OpenAPI client
-generator produces a workable Go type from envelope-level
-`oneOf`:
-
-- **oapi-codegen** collapses the envelope to a `json.RawMessage`
-  wrapper that loses all field access — `cmd/gc/cmd_events.go`'s
-  field-based construction breaks.
-- **ogen** drops `text/event-stream` operations entirely —
-  the events streams disappear from the generated client.
-
-The payload-field-union design is the current ceiling. Every
-payload variant is still fully typed on the wire; consumers narrow
-explicitly rather than getting automatic discriminator narrowing.
-See §6 for the full tooling note.
-
-## 5. Developer workflow
-
-The invariants above exist so the developer's contribution to the
-HTTP + SSE surface is Go code only. Tooling produces everything
-else.
-
-### Adding or changing a REST operation
-
-1. Edit or add input/output struct types with Huma tags
-   (`json:"..."`, `minLength:"1"`, `required:"true"`, etc.).
-2. Write the handler function; register via `huma.Register` (or
-   the `cityGet` / `cityPost` / `cityPatch` / etc. helpers in
-   `internal/api/city_scope.go` for per-city scoped operations).
-3. Commit. Pre-commit regenerates `internal/api/openapi.json`,
-   `docs/schema/openapi.json`, `internal/api/genclient/`, and the
-   TS types under `cmd/gc/dashboard/web/src/generated/`. Mintlify
-   publishes the spec on the next docs build.
-
-### Adding or changing an event type
-
-1. Add the constant to `internal/events/events.go` and append it
-   to `events.KnownEventTypes`.
-2. Define a typed payload struct implementing `events.Payload` (a
-   trivial `IsEventPayload()` method), or use `events.NoPayload`
-   for events whose envelope fields alone capture the semantics.
-3. Call `events.RegisterPayload(constant, sample)` from an
-   `init()` in the domain package that owns the event (e.g.
-   `internal/api/event_payloads.go` for mail/bead;
-   `internal/extmsg/events.go` for extmsg).
-4. Commit. Pre-commit regenerates the discriminated-union wire
-   schema; generated clients gain the new typed variant
-   automatically.
-
-### CI guards
-
-Skipping any step lands on a CI failure, not a production bug:
-
-| Miss | Caught by |
-|---|---|
-| Spec not regenerated after Go-type change | `TestOpenAPISpecInSync` |
-| Generated Go client out of sync with spec | `TestGeneratedClientInSync` |
-| Handler response field undeclared in spec | Layer 1 response-validation tests |
-| Spec/client method-shape drift | Layer 2 round-trip tests (`genclient_roundtrip_test.go`) |
-| End-to-end binary wire regression | Layer 3 integration tests (`//go:build integration`) |
-| New event-type constant without registered payload | `TestEveryKnownEventTypeHasRegisteredPayload` |
-| Hard-coded SPA `/v0/...` path outside typed client | TypeScript build (`satisfies SpecPath` in `api.ts`) |
-
-## 6. Tooling landscape
-
-Principle 7's "payload-field-level discrimination rather than
-envelope-level" is a Go-tooling constraint, not a principled
-preference. The TypeScript and Go ecosystems differ on what they
-support; this section records what we evaluated and what we use
-per language.
-
-### Go (server-side Huma, client via oapi-codegen)
-
-- **Huma v2** — server framework. Generates OpenAPI 3.1 from
-  annotated Go types; we use it for every typed endpoint. Emits a
-  3.0 downgrade on request for consumers that still need 3.0.
-- **oapi-codegen** — our current Go client generator. Supports
-  OpenAPI 3.0 (we feed it the downgrade from Huma). When given
-  envelope-level `oneOf`, it generates `struct { union
-  json.RawMessage }` with `AsX`/`FromX`/`MergeX` accessor methods.
-  That shape breaks field-based construction in
-  `cmd/gc/cmd_events.go`. It does generate typed request methods
-  for SSE endpoints, but does not parse SSE frames — the caller
-  handles framing.
-- **ogen** — evaluated via spike. Refuses `text/event-stream`
-  content type entirely; every SSE endpoint is dropped from the
-  generated client. With `ignore_not_implemented: all`, ogen
-  produces clean REST types but drops SSE operations Gas City is
-  built on. Not viable.
-- **openapi-generator** (Java-based) — breaks the pure-Go toolchain
-  and generates less-idiomatic Go.
-- **Commercial SDK generators** (Speakeasy, Fern, Stainless) —
-  generate typed Go SSE clients including envelope-level `oneOf`
-  handling. Not open source; paid plans start at ~$250/mo.
-
-The payload-field-union `EventPayload` design (Principle 7) is the
-current ceiling under open-source Go tooling. Revisit if
-oapi-codegen's experimental 3.1/3.2-aware branch stabilizes or if
-another open-source Go generator ships envelope-level `oneOf` plus
-SSE that works with our shape.
-
-### TypeScript (dashboard SPA)
-
-- **`openapi-fetch`** — typed `fetch` wrapper, the tool the
-  dashboard uses for every REST call site. Typed path/body/response
-  against `openapi-typescript`-generated `schema.d.ts`. Minimal
-  runtime, well-documented, keeps REST call-site code short. Does
-  not handle SSE — that's what drives the dual-tool design below.
-- **`@hey-api/openapi-ts`** — open-source generator the dashboard
-  uses exclusively for SSE. Generates typed stream functions using
-  `fetch()` + `ReadableStream` (not `EventSource`), which means
-  custom auth headers work, retry with exponential backoff is
-  built in, and each stream has typed discriminated-union response
-  types keyed by the SSE `event` name. `sse.ts` is a thin callback
-  bridge over the generated `streamSupervisorEvents`,
-  `streamEvents`, and `streamSession` functions; the per-frame
-  JSON parsing, line buffering, and retry are all framework code.
-- **`openapi-typescript-codegen`** — unmaintained.
-- **OpenAPI Generator** (Java) — same pure-toolchain concern as Go.
-
-The dual-tool design is pragmatic, not aspirational: each library
-handles what it's good at. `openapi-fetch` is the minimal typed
-surface for REST consumers (kept because it has zero impact on
-call-site code and the ecosystem has shifted to hey-api slowly
-enough that we'd gain nothing by churning every REST call today).
-`@hey-api/openapi-ts` is the only open-source TS tool that
-generates typed SSE stream clients, and it handles every aspect of
-the SSE wire that used to be hand-rolled in `sse.ts`.
-
-The Go-side `oneOf` ceiling described above does not apply to
-TypeScript consumers. SSE frames come typed and discriminated
-through the generated stream functions; consumers get automatic
-`switch (frame.event)` narrowing with no hand-written parser or
-type guard in the SPA.
-
-## 7. What is out of scope
-
-- **`/svc/*` proxy.** See §3.9.
-- **Outbound HTTP** (`internal/extmsg/http_adapter.go`,
-  `internal/workspacesvc/proxy_process.go`). Not typed API
-  endpoints; we consume someone else's contract.
-- **Storage-layer (de)serialization** (SQL BLOBs, JSONL log files,
-  external-tool auth files). Not on our wire.
-- **Generated Go client as a Go SDK surface.** Stays in
-  `internal/` until external consumers show up.
-- **WebSocket transport.** HTTP + SSE only. OpenAPI 3.1 + Huma
-  covers SSE end-to-end, so AsyncAPI / Modelina are not in play.
-
-## 8. Maintenance rule
-
-Every file-path citation in this spec is load-bearing. If you
-rename or remove a cited symbol (`events.KnownEventTypes`,
-`EventPayloadUnion`, `TestEveryKnownEventTypeHasRegisteredPayload`,
-`cmd/gc/apiroute.go:apiClient()`, etc.), **update this spec in the
-same commit**. A stale spec is worse than no spec — it misleads
-future agents about what invariants hold.
-
-Line numbers are deliberately omitted so the spec survives
-refactors. Package names, type names, and test names are stable
-anchors.
diff --git a/test/acceptance/beads_cli_contract_test.go b/test/acceptance/beads_cli_contract_test.go
index 907e86351d..703d1c6de3 100644
--- a/test/acceptance/beads_cli_contract_test.go
+++ b/test/acceptance/beads_cli_contract_test.go
@@ -671,7 +671,18 @@ func TestBdBasicCRUD(t *testing.T) {
 	// --- Config ---
 
 	t.Run("ConfigSet", func(t *testing.T) {
-		requireBD(t, dir, "config", "set", "issue_prefix", "ct")
+		requireBD(t, dir, "config", "set", "export.auto", "false")
+		out := requireBD(t, dir, "config", "get", "export.auto")
+		if strings.TrimSpace(out) != "false" {
+			t.Fatalf("bd config get export.auto = %q, want false", strings.TrimSpace(out))
+		}
+	})
+
+	t.Run("ConfigGetIssuePrefix", func(t *testing.T) {
+		out := requireBD(t, dir, "config", "get", "issue_prefix")
+		if strings.TrimSpace(out) != "ct" {
+			t.Fatalf("bd config get issue_prefix = %q, want ct", strings.TrimSpace(out))
+		}
 	})
 }
 
diff --git a/test/acceptance/dashboard_serve_test.go b/test/acceptance/dashboard_serve_test.go
index 67c05b30c9..e8fa9e7534 100644
--- a/test/acceptance/dashboard_serve_test.go
+++ b/test/acceptance/dashboard_serve_test.go
@@ -224,7 +224,7 @@ func (b *backgroundCmd) logs(t *testing.T) string {
 }
 
 func httpGetText(rawURL string) (string, error) {
-	client := &http.Client{Timeout: 500 * time.Millisecond}
+	client := &http.Client{Timeout: 5 * time.Second}
 	resp, err := client.Get(rawURL) //nolint:gosec // acceptance test against localhost
 	if err != nil {
 		return "", err
diff --git a/test/acceptance/helpers/city.go b/test/acceptance/helpers/city.go
index 398c1a7f90..69eb91094b 100644
--- a/test/acceptance/helpers/city.go
+++ b/test/acceptance/helpers/city.go
@@ -3,6 +3,7 @@ package acceptancehelpers
 import (
 	"crypto/rand"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -29,7 +30,7 @@ type City struct {
 // The city is NOT initialized — call Init() or InitFrom() next.
 func NewCity(t *testing.T, env *Env) *City {
 	t.Helper()
-	return newCityAt(t, env, t.TempDir())
+	return newCityAt(t, env, acceptanceTempDir(t))
 }
 
 // NewCityInRoot creates a city under the provided root directory.
@@ -106,6 +107,14 @@ func (c *City) RigAdd(rigPath string, include string) {
 	if err := EnsureClaudeProjectState(c.Env, rigPath); err != nil {
 		c.t.Fatalf("acceptance: seeding Claude state for rig %s: %v", rigPath, err)
 	}
+	// Rig temp dirs are often created with t.TempDir() after Init/InitFrom has
+	// already registered its cleanup. Registering another best-effort stop +
+	// unregister cleanup here ensures those temp dirs are removed only after rig
+	// runtime state under .gc has been torn down.
+	c.t.Cleanup(func() {
+		RunGC(c.Env, c.Dir, "stop", c.Dir)       //nolint:errcheck
+		RunGC(c.Env, c.Dir, "unregister", c.Dir) //nolint:errcheck
+	})
 }
 
 // AppendToConfig appends raw TOML content to city.toml.
@@ -220,6 +229,48 @@ func uniqueName() string {
 	return "at-" + hex.EncodeToString(b)
 }
 
+func acceptanceTempDir(t *testing.T) string {
+	t.Helper()
+	dir, err := os.MkdirTemp("", "gc-acceptance-*")
+	if err != nil {
+		t.Fatalf("acceptance: creating temp dir: %v", err)
+	}
+	t.Cleanup(func() {
+		removeAllWithRetry(t, dir, 5*time.Second, 50*time.Millisecond)
+	})
+	return dir
+}
+
+func removeAllWithRetry(t *testing.T, dir string, timeout, interval time.Duration) {
+	t.Helper()
+	if err := removeAllWithRetryFunc(dir, timeout, interval, os.RemoveAll); err != nil {
+		t.Fatalf("acceptance: removing temp dir %s: %v", dir, err)
+	}
+}
+
+func removeAllWithRetryFunc(dir string, timeout, interval time.Duration, remove func(string) error) error {
+	deadline := time.Now().Add(timeout)
+	var lastErr error
+	for {
+		if err := remove(dir); err != nil {
+			if os.IsNotExist(err) {
+				return nil
+			}
+			lastErr = err
+		} else {
+			return nil
+		}
+		if time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(interval)
+	}
+	if lastErr == nil {
+		lastErr = errors.New("timed out")
+	}
+	return lastErr
+}
+
 // ExamplesDir returns the absolute path to the examples/ directory
 // in the source tree.
 func ExamplesDir() string {
diff --git a/test/acceptance/helpers/city_test.go b/test/acceptance/helpers/city_test.go
new file mode 100644
index 0000000000..4f65389b8f
--- /dev/null
+++ b/test/acceptance/helpers/city_test.go
@@ -0,0 +1,24 @@
+package acceptancehelpers
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestRemoveAllWithRetryFuncRetriesTransientFailure(t *testing.T) {
+	calls := 0
+	err := removeAllWithRetryFunc("synthetic-dir", time.Second, time.Nanosecond, func(string) error {
+		calls++
+		if calls == 1 {
+			return errors.New("directory not empty")
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("removeAllWithRetryFunc: %v", err)
+	}
+	if calls != 2 {
+		t.Fatalf("remove calls = %d, want 2", calls)
+	}
+}
diff --git a/test/acceptance/helpers/env.go b/test/acceptance/helpers/env.go
index 42be6ea672..5380cb248c 100644
--- a/test/acceptance/helpers/env.go
+++ b/test/acceptance/helpers/env.go
@@ -41,6 +41,7 @@ func NewEnv(gcBinary, gcHome, runtimeDir string) *Env {
 		"CLAUDE_CODE_SUBAGENT_MODEL",
 		"OPENAI_API_KEY",
 		"GEMINI_API_KEY",
+		"GOOGLE_GENERATIVE_AI_API_KEY",
 		"GOOGLE_API_KEY",
 		"GOOGLE_APPLICATION_CREDENTIALS",
 		"GOOGLE_CLOUD_PROJECT",
diff --git a/test/acceptance/init_lifecycle_test.go b/test/acceptance/init_lifecycle_test.go
index 5f7ba190e1..0d12e0988d 100644
--- a/test/acceptance/init_lifecycle_test.go
+++ b/test/acceptance/init_lifecycle_test.go
@@ -143,8 +143,9 @@ source = ".gc/system/packs/gastown"
 		t.Fatalf("gc init resume failed with missing packs — Bug 4 regression:\n%s", out)
 	}
 	t.Cleanup(func() {
-		helpers.RunGC(c.Env, c.Dir, "stop", c.Dir)       //nolint:errcheck
-		helpers.RunGC(c.Env, c.Dir, "unregister", c.Dir) //nolint:errcheck
+		helpers.RunGC(c.Env, c.Dir, "stop", c.Dir)               //nolint:errcheck
+		helpers.RunGC(c.Env, c.Dir, "unregister", c.Dir)         //nolint:errcheck
+		helpers.RunGC(c.Env, "", "supervisor", "stop", "--wait") //nolint:errcheck
 	})
 	// Positive assertion: packs must have been materialized.
 	if !c.HasFile(".gc/system/packs/gastown/pack.toml") {
diff --git a/test/acceptance/mail_lifecycle_test.go b/test/acceptance/mail_lifecycle_test.go
index c73c542506..dfa00ad92e 100644
--- a/test/acceptance/mail_lifecycle_test.go
+++ b/test/acceptance/mail_lifecycle_test.go
@@ -120,6 +120,47 @@ func TestMailLifecycle(t *testing.T) {
 			t.Fatal("expected error deleting nonexistent message")
 		}
 	})
+
+	t.Run("Delete_MultiID_BatchClose", func(t *testing.T) {
+		var ids []string
+		for i := 0; i < 3; i++ {
+			sendOut, sendErr := c.GC("mail", "send", "mayor", "--from", "human",
+				"-s", "batch", "-m", "batch body")
+			if sendErr != nil {
+				t.Fatalf("gc mail send[%d]: %v\n%s", i, sendErr, sendOut)
+			}
+		}
+		inboxOut, inboxErr := c.GC("mail", "inbox", "mayor")
+		if inboxErr != nil {
+			t.Fatalf("gc mail inbox mayor: %v\n%s", inboxErr, inboxOut)
+		}
+		for _, line := range strings.Split(inboxOut, "\n") {
+			fields := strings.Fields(line)
+			if len(fields) == 0 {
+				continue
+			}
+			candidate := fields[0]
+			if strings.Contains(candidate, "-") && len(candidate) >= 4 && len(candidate) <= 20 {
+				ids = append(ids, candidate)
+			}
+			if len(ids) == 3 {
+				break
+			}
+		}
+		if len(ids) < 3 {
+			t.Fatalf("could not collect 3 message IDs from inbox:\n%s", inboxOut)
+		}
+		args := append([]string{"mail", "delete"}, ids...)
+		delOut, delErr := c.GC(args...)
+		if delErr != nil {
+			t.Fatalf("gc mail delete %v: %v\n%s", ids, delErr, delOut)
+		}
+		for _, id := range ids {
+			if !strings.Contains(delOut, "Deleted message "+id) {
+				t.Errorf("delete output missing %q:\n%s", "Deleted message "+id, delOut)
+			}
+		}
+	})
 }
 
 func TestMailErrorPaths(t *testing.T) {
diff --git a/test/acceptance/session_test.go b/test/acceptance/session_test.go
index 54009b87c2..6e77b6fe01 100644
--- a/test/acceptance/session_test.go
+++ b/test/acceptance/session_test.go
@@ -9,9 +9,11 @@
 package acceptance_test
 
 import (
+	"encoding/json"
 	"strings"
 	"testing"
 
+	"github.com/gastownhall/gascity/internal/session"
 	helpers "github.com/gastownhall/gascity/test/acceptance/helpers"
 )
 
@@ -90,38 +92,52 @@ func TestSessionErrors(t *testing.T) {
 	})
 }
 
-func TestSessionEmptyCity(t *testing.T) {
+func TestSessionDefaultNamedSession(t *testing.T) {
 	c := helpers.NewCity(t, testEnv)
 	c.Init("claude")
 
-	t.Run("List_Empty", func(t *testing.T) {
+	t.Run("List_DefaultNamedSession", func(t *testing.T) {
 		out, err := c.GC("session", "list")
 		if err != nil {
 			t.Fatalf("gc session list: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "No sessions found") {
-			t.Errorf("expected 'No sessions found' on fresh city, got:\n%s", out)
+		if strings.Contains(out, "No sessions found") {
+			t.Errorf("expected default named session on fresh city, got:\n%s", out)
+		}
+		for _, want := range []string{"mayor", "creating"} {
+			if !strings.Contains(out, want) {
+				t.Errorf("expected %q in default named session list, got:\n%s", want, out)
+			}
 		}
 	})
 
-	t.Run("List_JSON", func(t *testing.T) {
+	t.Run("List_JSON_DefaultNamedSession", func(t *testing.T) {
 		out, err := c.GC("session", "list", "--json")
 		if err != nil {
 			t.Fatalf("gc session list --json: %v\n%s", err, out)
 		}
-		trimmed := strings.TrimSpace(out)
-		if trimmed != "[]" && trimmed != "null" && !strings.HasPrefix(trimmed, "[") {
-			t.Errorf("expected JSON array on fresh city, got:\n%s", out)
+		var got []session.Info
+		if err := json.Unmarshal([]byte(out), &got); err != nil {
+			t.Fatalf("gc session list --json output is not a session array: %v\n%s", err, out)
+		}
+		if len(got) != 1 {
+			t.Fatalf("session count = %d, want 1 default named session\n%s", len(got), out)
+		}
+		if got[0].Template != "mayor" {
+			t.Errorf("template = %q, want mayor\n%s", got[0].Template, out)
+		}
+		if got[0].State != session.StateCreating {
+			t.Errorf("state = %q, want creating\n%s", got[0].State, out)
 		}
 	})
 
-	t.Run("Prune_Empty", func(t *testing.T) {
+	t.Run("Prune_NoClosedSessions", func(t *testing.T) {
 		out, err := c.GC("session", "prune")
 		if err != nil {
 			t.Fatalf("gc session prune: %v\n%s", err, out)
 		}
 		if !strings.Contains(out, "No sessions to prune") {
-			t.Errorf("expected 'No sessions to prune' on fresh city, got:\n%s", out)
+			t.Errorf("expected 'No sessions to prune' with only default named session, got:\n%s", out)
 		}
 	})
 }
diff --git a/test/acceptance/tier_c/fresh_install_spawn_test.go b/test/acceptance/tier_c/fresh_install_spawn_test.go
index 7795c38895..f32aa27235 100644
--- a/test/acceptance/tier_c/fresh_install_spawn_test.go
+++ b/test/acceptance/tier_c/fresh_install_spawn_test.go
@@ -61,7 +61,9 @@ func TestFreshInit_ClaudeUnrestricted(t *testing.T) {
 	}
 
 	result := runFreshInitSlingClaudeWork(t, "Write the current time to permission-check.txt", "permission-check.txt")
-	command := metaString(result.SpawnedSessionBead.Metadata, "command")
+	spawnedSessionBead, err := showBeadJSON(result.CityDir, result.SpawnedSessionBead.ID)
+	require.NoError(t, err, "refresh spawned session bead %s", result.SpawnedSessionBead.ID)
+	command := metaString(spawnedSessionBead.Metadata, "command")
 	require.NotEmpty(t, command, "spawned worker should persist the resolved launch command")
 	require.Contains(t, command, "--dangerously-skip-permissions", "fresh claude worker should launch unrestricted")
 	require.NotContains(t, command, "--permission-mode auto-edit", "fresh claude worker should not launch in auto-edit mode")
diff --git a/test/acceptance/tutorial_goldens/tutorial04_test.go b/test/acceptance/tutorial_goldens/tutorial04_test.go
deleted file mode 100644
index d5a347ff58..0000000000
--- a/test/acceptance/tutorial_goldens/tutorial04_test.go
+++ /dev/null
@@ -1,295 +0,0 @@
-//go:build acceptance_c
-
-package tutorialgoldens
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestTutorial05Formulas(t *testing.T) {
-	ws := newTutorialWorkspace(t)
-	ws.attachDiagnostics(t, "tutorial-05")
-
-	myCity := expandHome(ws.home(), "~/my-city")
-	myProject := expandHome(ws.home(), "~/my-project")
-	myAPI := expandHome(ws.home(), "~/my-api")
-	mustMkdirAll(t, myProject)
-	mustMkdirAll(t, myAPI)
-
-	out, err := ws.runShell("gc init ~/my-city --provider claude --skip-provider-readiness", "")
-	if err != nil {
-		t.Fatalf("seed city init: %v\n%s", err, out)
-	}
-	ws.setCWD(myCity)
-	for _, cmd := range []string{"gc rig add ~/my-project", "gc rig add ~/my-api"} {
-		if out, err := ws.runShell(cmd, ""); err != nil {
-			t.Fatalf("seed rig add %q: %v\n%s", cmd, err, out)
-		}
-	}
-	ws.noteWarning("tutorial 05 continuity workaround: the page assumes helper/reviewer agents and both rigs already exist, so the page driver seeds my-project, my-api, and those supporting agents before exercising the visible worker + formula commands")
-	if out, err := ws.runShell("gc agent add --name helper", ""); err != nil {
-		t.Fatalf("seed helper scaffold: %v\n%s", err, out)
-	}
-	writeFile(t, filepath.Join(myCity, "agents", "helper", "prompt.template.md"), "# Helper Agent\nHandle supporting work.\n", 0o644)
-	if out, err := ws.runShell("gc agent add --name reviewer --dir my-project", ""); err != nil {
-		t.Fatalf("seed reviewer scaffold: %v\n%s", err, out)
-	}
-	writeFile(t, filepath.Join(myCity, "agents", "reviewer", "agent.toml"), "dir = \"my-project\"\nprovider = \""+tutorialReviewerProvider()+"\"\n", 0o644)
-	writeFile(t, filepath.Join(myCity, "agents", "reviewer", "prompt.template.md"), "# Reviewer Agent\nReview code.\n", 0o644)
-
-	writeFile(t, filepath.Join(myCity, "formulas", "greeting.toml"), `formula = "greeting"
-
-[vars]
-name = "world"
-
-[[steps]]
-id = "say-hello"
-title = "Say hello to {{name}}"
-`, 0o644)
-
-	writeFile(t, filepath.Join(myCity, "formulas", "feature-work.toml"), `formula = "feature-work"
-
-[vars.title]
-description = "What this feature is about"
-required = true
-
-[vars.branch]
-description = "Target branch"
-default = "main"
-
-[vars.priority]
-description = "How urgent is this"
-default = "normal"
-enum = ["low", "normal", "high", "critical"]
-
-[[steps]]
-id = "implement"
-title = "Implement {{title}}"
-description = "Work on {{title}} against {{branch}} (priority: {{priority}})"
-`, 0o644)
-
-	writeFile(t, filepath.Join(myCity, "formulas", "deploy-flow.toml"), `formula = "deploy-flow"
-
-[vars]
-env = "dev"
-
-[[steps]]
-id = "build"
-title = "Build"
-
-[[steps]]
-id = "deploy"
-title = "Deploy to staging"
-condition = "{{env}} == staging"
-`, 0o644)
-
-	writeFile(t, filepath.Join(myCity, "formulas", "retry-deploy.toml"), `formula = "retry-deploy"
-
-[[steps]]
-id = "retries"
-title = "Attempt deployment"
-
-[steps.loop]
-count = 3
-
-[[steps.loop.body]]
-id = "attempt"
-title = "Try to deploy"
-`, 0o644)
-
-	var pancakesRootID string
-
-	t.Run("cat > formulas/pancakes.toml << 'EOF'", func(t *testing.T) {
-		cmd := tutorialPancakesFormulaShellCommand(t)
-		if out, err := ws.runShell(cmd, ""); err != nil {
-			t.Fatalf("writing pancakes formula: %v\n%s", err, out)
-		}
-	})
-
-	t.Run("gc formula list", func(t *testing.T) {
-		out, err := ws.runShell("gc formula list", "")
-		if err != nil {
-			t.Fatalf("gc formula list: %v\n%s", err, out)
-		}
-		for _, want := range []string{"pancakes", "greeting", "feature-work", "deploy-flow", "retry-deploy"} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("formula list missing %q:\n%s", want, out)
-			}
-		}
-	})
-
-	t.Run("gc formula show pancakes", func(t *testing.T) {
-		out, err := ws.runShell("gc formula show pancakes", "")
-		if err != nil {
-			t.Fatalf("gc formula show pancakes: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Formula: pancakes") {
-			t.Fatalf("formula show missing header:\n%s", out)
-		}
-		if !strings.Contains(out, "Steps (5):") {
-			t.Fatalf("tutorial contract: pancakes should render 5 visible steps, got:\n%s", out)
-		}
-	})
-
-	t.Run("gc agent add --name worker", func(t *testing.T) {
-		out, err := ws.runShell("gc agent add --name worker", "")
-		if err != nil {
-			t.Fatalf("gc agent add --name worker: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Scaffolded agent 'worker'") {
-			t.Fatalf("gc agent add output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run("cat > agents/worker/prompt.template.md << 'EOF'", func(t *testing.T) {
-		cmd := `cat > agents/worker/prompt.template.md << 'EOF'
-# Worker Agent
-You are a general-purpose Gas City worker. Execute assigned work carefully and report the result.
-EOF`
-		if out, err := ws.runShell(cmd, ""); err != nil {
-			t.Fatalf("writing worker prompt: %v\n%s", err, out)
-		}
-	})
-
-	t.Run("gc sling mayor pancakes --formula", func(t *testing.T) {
-		out, err := ws.runShell("gc sling mayor pancakes --formula", "")
-		if err != nil {
-			t.Fatalf("gc sling mayor pancakes --formula: %v\n%s", err, out)
-		}
-		if !strings.Contains(strings.ToLower(out), "slung formula") {
-			t.Fatalf("formula sling output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run("gc formula cook pancakes", func(t *testing.T) {
-		ws.setCWD(myProject)
-		out, err := ws.runShell("gc formula cook pancakes", "")
-		if err != nil {
-			t.Fatalf("gc formula cook pancakes: %v\n%s", err, out)
-		}
-		pancakesRootID = firstBeadID(out)
-		if pancakesRootID == "" {
-			t.Fatalf("could not parse pancakes root id:\n%s", out)
-		}
-	})
-
-	t.Run("gc sling worker mp-2wx", func(t *testing.T) {
-		if pancakesRootID == "" {
-			t.Fatal("missing pancakes root id")
-		}
-		out, err := ws.runShell(fmt.Sprintf("gc sling worker %s", pancakesRootID), "")
-		if err != nil {
-			t.Fatalf("gc sling worker %s: %v\n%s", pancakesRootID, err, out)
-		}
-		if !strings.Contains(out, "Slung") {
-			t.Fatalf("gc sling worker output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run(`gc formula cook greeting --var name="Alice"`, func(t *testing.T) {
-		ws.setCWD(myCity)
-		out, err := ws.runShell(`gc formula cook greeting --var name="Alice"`, "")
-		if err != nil {
-			t.Fatalf("gc formula cook greeting --var name=Alice: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "greeting.say-hello") {
-			t.Fatalf("cook greeting output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run("gc formula cook greeting", func(t *testing.T) {
-		out, err := ws.runShell("gc formula cook greeting", "")
-		if err != nil {
-			t.Fatalf("gc formula cook greeting: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "greeting.say-hello") {
-			t.Fatalf("cook greeting default output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run(`gc formula show greeting --var name="Alice"`, func(t *testing.T) {
-		out, err := ws.runShell(`gc formula show greeting --var name="Alice"`, "")
-		if err != nil {
-			t.Fatalf("gc formula show greeting: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Say hello to Alice") {
-			t.Fatalf("show greeting should substitute Alice:\n%s", out)
-		}
-	})
-
-	t.Run(`gc formula cook feature-work --var title="Auth overhaul" --var branch="develop"`, func(t *testing.T) {
-		out, err := ws.runShell(`gc formula cook feature-work --var title="Auth overhaul" --var branch="develop"`, "")
-		if err != nil {
-			t.Fatalf("gc formula cook feature-work branch variant: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "feature-work.implement") {
-			t.Fatalf("feature-work cook output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run(`gc formula cook feature-work --var title="Auth overhaul" --var priority="critical"`, func(t *testing.T) {
-		out, err := ws.runShell(`gc formula cook feature-work --var title="Auth overhaul" --var priority="critical"`, "")
-		if err != nil {
-			t.Fatalf("gc formula cook feature-work priority variant: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "feature-work.implement") {
-			t.Fatalf("feature-work cook output mismatch:\n%s", out)
-		}
-	})
-
-	t.Run(`gc formula show feature-work --var title="Auth system"`, func(t *testing.T) {
-		out, err := ws.runShell(`gc formula show feature-work --var title="Auth system"`, "")
-		if err != nil {
-			t.Fatalf("gc formula show feature-work: %v\n%s", err, out)
-		}
-		for _, want := range []string{"Formula: feature-work", "Implement Auth system"} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("feature-work show missing %q:\n%s", want, out)
-			}
-		}
-	})
-
-	t.Run("gc formula show deploy-flow --var env=dev", func(t *testing.T) {
-		out, err := ws.runShell("gc formula show deploy-flow --var env=dev", "")
-		if err != nil {
-			t.Fatalf("gc formula show deploy-flow env=dev: %v\n%s", err, out)
-		}
-		if strings.Contains(out, "deploy-flow.deploy") {
-			t.Fatalf("deploy-flow env=dev should omit deploy step:\n%s", out)
-		}
-	})
-
-	t.Run("gc formula show deploy-flow --var env=staging", func(t *testing.T) {
-		out, err := ws.runShell("gc formula show deploy-flow --var env=staging", "")
-		if err != nil {
-			t.Fatalf("gc formula show deploy-flow env=staging: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "deploy-flow.deploy") {
-			t.Fatalf("deploy-flow env=staging should include deploy step:\n%s", out)
-		}
-	})
-
-	t.Run("gc formula show retry-deploy", func(t *testing.T) {
-		out, err := ws.runShell("gc formula show retry-deploy", "")
-		if err != nil {
-			t.Fatalf("gc formula show retry-deploy: %v\n%s", err, out)
-		}
-		for _, want := range []string{
-			"retry-deploy.retries.iter1.attempt",
-			"retry-deploy.retries.iter2.attempt",
-			"retry-deploy.retries.iter3.attempt",
-		} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("retry-deploy show missing %q:\n%s", want, out)
-			}
-		}
-	})
-
-	if data, err := os.ReadFile(filepath.Join(myCity, "city.toml")); err == nil {
-		ws.noteDiagnostic("final city.toml:\n%s", string(data))
-	}
-}
diff --git a/test/acceptance/tutorial_goldens/tutorial05_test.go b/test/acceptance/tutorial_goldens/tutorial05_test.go
index 8642e8e47a..d5a347ff58 100644
--- a/test/acceptance/tutorial_goldens/tutorial05_test.go
+++ b/test/acceptance/tutorial_goldens/tutorial05_test.go
@@ -4,367 +4,292 @@ package tutorialgoldens
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
-func TestTutorial06Beads(t *testing.T) {
+func TestTutorial05Formulas(t *testing.T) {
 	ws := newTutorialWorkspace(t)
-	ws.attachDiagnostics(t, "tutorial-06")
+	ws.attachDiagnostics(t, "tutorial-05")
 
 	myCity := expandHome(ws.home(), "~/my-city")
 	myProject := expandHome(ws.home(), "~/my-project")
+	myAPI := expandHome(ws.home(), "~/my-api")
 	mustMkdirAll(t, myProject)
+	mustMkdirAll(t, myAPI)
 
 	out, err := ws.runShell("gc init ~/my-city --provider claude --skip-provider-readiness", "")
 	if err != nil {
 		t.Fatalf("seed city init: %v\n%s", err, out)
 	}
 	ws.setCWD(myCity)
-
-	if out, err := ws.runShell("gc rig add ~/my-project", ""); err != nil {
-		t.Fatalf("seed rig add: %v\n%s", err, out)
-	}
-	ws.noteWarning("tutorial 06 continuity workaround: the page assumes helper/worker/reviewer agents already exist from earlier tutorials, so the page driver seeds those agent definitions explicitly before querying beads state")
-	ws.noteWarning("TODO(issue #632): tutorial 06 still documents explicit rig-qualified reviewer examples; once rig-local shorthand is reliable in acceptance-style paths, simplify those examples where the user is already operating inside the rig context")
-	for _, cmd := range []string{
-		"gc agent add --name helper",
-		"gc agent add --name worker",
-		"gc agent add --name reviewer --dir my-project",
-	} {
+	for _, cmd := range []string{"gc rig add ~/my-project", "gc rig add ~/my-api"} {
 		if out, err := ws.runShell(cmd, ""); err != nil {
-			t.Fatalf("seed agent scaffold %q: %v\n%s", cmd, err, out)
+			t.Fatalf("seed rig add %q: %v\n%s", cmd, err, out)
 		}
 	}
+	ws.noteWarning("tutorial 05 continuity workaround: the page assumes helper/reviewer agents and both rigs already exist, so the page driver seeds my-project, my-api, and those supporting agents before exercising the visible worker + formula commands")
+	if out, err := ws.runShell("gc agent add --name helper", ""); err != nil {
+		t.Fatalf("seed helper scaffold: %v\n%s", err, out)
+	}
 	writeFile(t, filepath.Join(myCity, "agents", "helper", "prompt.template.md"), "# Helper Agent\nHandle supporting work.\n", 0o644)
-	writeFile(t, filepath.Join(myCity, "agents", "worker", "prompt.template.md"), "# Worker Agent\nHandle general work.\n", 0o644)
+	if out, err := ws.runShell("gc agent add --name reviewer --dir my-project", ""); err != nil {
+		t.Fatalf("seed reviewer scaffold: %v\n%s", err, out)
+	}
 	writeFile(t, filepath.Join(myCity, "agents", "reviewer", "agent.toml"), "dir = \"my-project\"\nprovider = \""+tutorialReviewerProvider()+"\"\n", 0o644)
 	writeFile(t, filepath.Join(myCity, "agents", "reviewer", "prompt.template.md"), "# Reviewer Agent\nReview code.\n", 0o644)
-	ws.noteDiagnostic("tutorial 06 continuity setup: replaying tutorial 05's documented pancakes formula command before exercising the next page's bead examples")
-	if out, err := ws.runShell(tutorialPancakesFormulaShellCommand(t), ""); err != nil {
-		t.Fatalf("seed tutorial 05 pancakes formula: %v\n%s", err, out)
-	}
 
-	updateAPIOut, err := ws.runShell(`bd create "Update API docs"`, "")
-	if err != nil {
-		t.Fatalf("seed update api docs: %v\n%s", err, updateAPIOut)
-	}
-	updateAPIID := firstBeadID(updateAPIOut)
-	if updateAPIID == "" {
-		t.Fatalf("could not parse update-api-docs bead id:\n%s", updateAPIOut)
-	}
-	if out, err := ws.runShell(fmt.Sprintf("bd label add %s pool:my-project/worker", updateAPIID), ""); err != nil {
-		t.Fatalf("seed pool label: %v\n%s", err, out)
-	}
-	if out, err := ws.runShell("gc formula cook pancakes", ""); err != nil {
-		t.Fatalf("seed pancakes cook: %v\n%s", err, out)
-	}
+	writeFile(t, filepath.Join(myCity, "formulas", "greeting.toml"), `formula = "greeting"
 
-	var loginBugID string
-	var refactorID string
-	var sprintConvoyID string
-	var ownedConvoyID string
-	var deployConvoyID string
+[vars]
+name = "world"
 
-	t.Run("cat city.toml", func(t *testing.T) {
-		out, err := ws.runShell("cat city.toml", "")
-		if err != nil {
-			t.Fatalf("cat city.toml: %v\n%s", err, out)
-		}
-		for _, want := range []string{
-			`provider = "claude"`,
-			`name = "my-project"`,
-		} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("city.toml missing %q:\n%s", want, out)
-			}
-		}
-		if strings.Contains(out, myProject) {
-			t.Fatalf("city.toml should not contain machine-local rig path %q:\n%s", myProject, out)
-		}
-	})
+[[steps]]
+id = "say-hello"
+title = "Say hello to {{name}}"
+`, 0o644)
 
-	t.Run("cat agents/reviewer/agent.toml", func(t *testing.T) {
-		out, err := ws.runShell("cat agents/reviewer/agent.toml", "")
-		if err != nil {
-			t.Fatalf("cat agents/reviewer/agent.toml: %v\n%s", err, out)
-		}
-		for _, want := range []string{
-			`dir = "my-project"`,
-			`provider = "` + tutorialReviewerProvider() + `"`,
-		} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("agents/reviewer/agent.toml missing %q:\n%s", want, out)
-			}
-		}
-	})
+	writeFile(t, filepath.Join(myCity, "formulas", "feature-work.toml"), `formula = "feature-work"
 
-	t.Run("bd list", func(t *testing.T) {
-		out, err := ws.runShell("bd list", "")
-		if err != nil {
-			t.Fatalf("bd list: %v\n%s", err, out)
-		}
-		for _, want := range []string{"Update API docs", "Status:"} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("bd list missing %q:\n%s", want, out)
-			}
-		}
-	})
+[vars.title]
+description = "What this feature is about"
+required = true
 
-	t.Run(`bd create "Fix the login bug"`, func(t *testing.T) {
-		out, err := ws.runShell(`bd create "Fix the login bug"`, "")
-		if err != nil {
-			t.Fatalf("bd create Fix the login bug: %v\n%s", err, out)
-		}
-		loginBugID = firstBeadID(out)
-		if loginBugID == "" {
-			t.Fatalf("could not parse login bug bead id:\n%s", out)
-		}
-	})
+[vars.branch]
+description = "Target branch"
+default = "main"
 
-	t.Run(`bd create "Refactor auth module" --type feature`, func(t *testing.T) {
-		out, err := ws.runShell(`bd create "Refactor auth module" --type feature`, "")
-		if err != nil {
-			t.Fatalf("bd create Refactor auth module: %v\n%s", err, out)
-		}
-		refactorID = firstBeadID(out)
-		if refactorID == "" {
-			t.Fatalf("could not parse refactor auth module bead id:\n%s", out)
-		}
-	})
+[vars.priority]
+description = "How urgent is this"
+default = "normal"
+enum = ["low", "normal", "high", "critical"]
 
-	t.Run("bd close mc-ykp", func(t *testing.T) {
-		if loginBugID == "" {
-			t.Fatal("missing Fix the login bug bead id")
-		}
-		out, err := ws.runShell(fmt.Sprintf("bd close %s", loginBugID), "")
-		if err != nil {
-			t.Fatalf("bd close %s: %v\n%s", loginBugID, err, out)
-		}
-		if !strings.Contains(out, "Closed") {
-			t.Fatalf("bd close output mismatch:\n%s", out)
+[[steps]]
+id = "implement"
+title = "Implement {{title}}"
+description = "Work on {{title}} against {{branch}} (priority: {{priority}})"
+`, 0o644)
+
+	writeFile(t, filepath.Join(myCity, "formulas", "deploy-flow.toml"), `formula = "deploy-flow"
+
+[vars]
+env = "dev"
+
+[[steps]]
+id = "build"
+title = "Build"
+
+[[steps]]
+id = "deploy"
+title = "Deploy to staging"
+condition = "{{env}} == staging"
+`, 0o644)
+
+	writeFile(t, filepath.Join(myCity, "formulas", "retry-deploy.toml"), `formula = "retry-deploy"
+
+[[steps]]
+id = "retries"
+title = "Attempt deployment"
+
+[steps.loop]
+count = 3
+
+[[steps.loop.body]]
+id = "attempt"
+title = "Try to deploy"
+`, 0o644)
+
+	var pancakesRootID string
+
+	t.Run("cat > formulas/pancakes.toml << 'EOF'", func(t *testing.T) {
+		cmd := tutorialPancakesFormulaShellCommand(t)
+		if out, err := ws.runShell(cmd, ""); err != nil {
+			t.Fatalf("writing pancakes formula: %v\n%s", err, out)
 		}
 	})
 
-	t.Run("bd list --status open --flat", func(t *testing.T) {
-		out, err := ws.runShell("bd list --status open --flat", "")
+	t.Run("gc formula list", func(t *testing.T) {
+		out, err := ws.runShell("gc formula list", "")
 		if err != nil {
-			t.Fatalf("bd list --status open --flat: %v\n%s", err, out)
+			t.Fatalf("gc formula list: %v\n%s", err, out)
 		}
-		for _, want := range []string{"Refactor auth module", "Update API docs"} {
+		for _, want := range []string{"pancakes", "greeting", "feature-work", "deploy-flow", "retry-deploy"} {
 			if !strings.Contains(out, want) {
-				t.Fatalf("open flat list missing %q:\n%s", want, out)
+				t.Fatalf("formula list missing %q:\n%s", want, out)
 			}
 		}
-		if loginBugID != "" && strings.Contains(out, loginBugID) {
-			t.Fatalf("closed login bug should not still appear in open list:\n%s", out)
-		}
 	})
 
-	t.Run("bd list --status in_progress --flat", func(t *testing.T) {
-		ws.noteWarning("tutorial 06 coverage workaround: the page expects live in-progress work, so the page driver marks the refactor bead in_progress before running the filtered status query")
-		if out, err := ws.runShell(fmt.Sprintf("bd update %s --status in_progress", refactorID), ""); err != nil {
-			t.Fatalf("seed refactor in_progress state: %v\n%s", err, out)
-		}
-		out, err := ws.runShell("bd list --status in_progress --flat", "")
+	t.Run("gc formula show pancakes", func(t *testing.T) {
+		out, err := ws.runShell("gc formula show pancakes", "")
 		if err != nil {
-			t.Fatalf("bd list --status in_progress --flat: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Refactor auth module") {
-			t.Fatalf("in-progress list should expose live runtime work:\n%s", out)
+			t.Fatalf("gc formula show pancakes: %v\n%s", err, out)
 		}
-	})
-
-	t.Run("bd label add mc-a4l priority:high", func(t *testing.T) {
-		if refactorID == "" {
-			t.Fatal("missing Refactor auth module bead id")
+		if !strings.Contains(out, "Formula: pancakes") {
+			t.Fatalf("formula show missing header:\n%s", out)
 		}
-		out, err := ws.runShell(fmt.Sprintf("bd label add %s priority:high", refactorID), "")
-		if err != nil {
-			t.Fatalf("adding priority label: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "priority:high") {
-			t.Fatalf("label add output mismatch:\n%s", out)
+		if !strings.Contains(out, "Steps (5):") {
+			t.Fatalf("tutorial contract: pancakes should render 5 visible steps, got:\n%s", out)
 		}
 	})
 
-	t.Run("bd label add mc-a4l frontend", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("bd label add %s frontend", refactorID), "")
+	t.Run("gc agent add --name worker", func(t *testing.T) {
+		out, err := ws.runShell("gc agent add --name worker", "")
 		if err != nil {
-			t.Fatalf("adding frontend label: %v\n%s", err, out)
+			t.Fatalf("gc agent add --name worker: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "frontend") {
-			t.Fatalf("label add output mismatch:\n%s", out)
+		if !strings.Contains(out, "Scaffolded agent 'worker'") {
+			t.Fatalf("gc agent add output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("bd list --label priority:high --flat", func(t *testing.T) {
-		out, err := ws.runShell("bd list --label priority:high --flat", "")
-		if err != nil {
-			t.Fatalf("bd list --label priority:high --flat: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Refactor auth module") {
-			t.Fatalf("label query should show Refactor auth module:\n%s", out)
+	t.Run("cat > agents/worker/prompt.template.md << 'EOF'", func(t *testing.T) {
+		cmd := `cat > agents/worker/prompt.template.md << 'EOF'
+# Worker Agent
+You are a general-purpose Gas City worker. Execute assigned work carefully and report the result.
+EOF`
+		if out, err := ws.runShell(cmd, ""); err != nil {
+			t.Fatalf("writing worker prompt: %v\n%s", err, out)
 		}
 	})
 
-	t.Run("bd update mc-a4l --set-metadata branch=feature/auth --set-metadata reviewer=sky", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("bd update %s --set-metadata branch=feature/auth --set-metadata reviewer=sky", refactorID), "")
+	t.Run("gc sling mayor pancakes --formula", func(t *testing.T) {
+		out, err := ws.runShell("gc sling mayor pancakes --formula", "")
 		if err != nil {
-			t.Fatalf("bd update metadata: %v\n%s", err, out)
+			t.Fatalf("gc sling mayor pancakes --formula: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "Updated") {
-			t.Fatalf("metadata update output mismatch:\n%s", out)
+		if !strings.Contains(strings.ToLower(out), "slung formula") {
+			t.Fatalf("formula sling output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("bd dep mc-a4l --blocks mc-xp7", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("bd dep %s --blocks %s", refactorID, updateAPIID), "")
+	t.Run("gc formula cook pancakes", func(t *testing.T) {
+		ws.setCWD(myProject)
+		out, err := ws.runShell("gc formula cook pancakes", "")
 		if err != nil {
-			t.Fatalf("bd dep --blocks: %v\n%s", err, out)
+			t.Fatalf("gc formula cook pancakes: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "blocks") {
-			t.Fatalf("dependency output mismatch:\n%s", out)
+		pancakesRootID = firstBeadID(out)
+		if pancakesRootID == "" {
+			t.Fatalf("could not parse pancakes root id:\n%s", out)
 		}
 	})
 
-	t.Run(`gc convoy create "Sprint 42" mc-ykp mc-a4l mc-xp7`, func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf(`gc convoy create "Sprint 42" %s %s %s`, loginBugID, refactorID, updateAPIID), "")
-		if err != nil {
-			t.Fatalf("gc convoy create Sprint 42: %v\n%s", err, out)
+	t.Run("gc sling worker mp-2wx", func(t *testing.T) {
+		if pancakesRootID == "" {
+			t.Fatal("missing pancakes root id")
 		}
-		sprintConvoyID = firstBeadID(out)
-		if sprintConvoyID == "" {
-			t.Fatalf("could not parse Sprint 42 convoy id:\n%s", out)
-		}
-	})
-
-	t.Run("gc convoy status mc-d4g", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("gc convoy status %s", sprintConvoyID), "")
+		out, err := ws.runShell(fmt.Sprintf("gc sling worker %s", pancakesRootID), "")
 		if err != nil {
-			t.Fatalf("gc convoy status %s: %v\n%s", sprintConvoyID, err, out)
+			t.Fatalf("gc sling worker %s: %v\n%s", pancakesRootID, err, out)
 		}
-		for _, want := range []string{"Sprint 42", "Fix the login bug", "Refactor auth module", "Update API docs"} {
-			if !strings.Contains(out, want) {
-				t.Fatalf("convoy status missing %q:\n%s", want, out)
-			}
+		if !strings.Contains(out, "Slung") {
+			t.Fatalf("gc sling worker output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run(`gc convoy create "Auth rewrite" --owned --target integration/auth`, func(t *testing.T) {
-		out, err := ws.runShell(`gc convoy create "Auth rewrite" --owned --target integration/auth`, "")
+	t.Run(`gc formula cook greeting --var name="Alice"`, func(t *testing.T) {
+		ws.setCWD(myCity)
+		out, err := ws.runShell(`gc formula cook greeting --var name="Alice"`, "")
 		if err != nil {
-			t.Fatalf("gc convoy create Auth rewrite: %v\n%s", err, out)
+			t.Fatalf("gc formula cook greeting --var name=Alice: %v\n%s", err, out)
 		}
-		ownedConvoyID = firstBeadID(out)
-		if ownedConvoyID == "" {
-			t.Fatalf("could not parse owned convoy id:\n%s", out)
+		if !strings.Contains(out, "greeting.say-hello") {
+			t.Fatalf("cook greeting output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("gc convoy land mc-0ud", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("gc convoy land %s", ownedConvoyID), "")
+	t.Run("gc formula cook greeting", func(t *testing.T) {
+		out, err := ws.runShell("gc formula cook greeting", "")
 		if err != nil {
-			t.Fatalf("gc convoy land %s: %v\n%s", ownedConvoyID, err, out)
+			t.Fatalf("gc formula cook greeting: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "Landed") {
-			t.Fatalf("convoy land output mismatch:\n%s", out)
+		if !strings.Contains(out, "greeting.say-hello") {
+			t.Fatalf("cook greeting default output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("gc convoy add mc-d4g mc-xp7", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("gc convoy add %s %s", sprintConvoyID, updateAPIID), "")
+	t.Run(`gc formula show greeting --var name="Alice"`, func(t *testing.T) {
+		out, err := ws.runShell(`gc formula show greeting --var name="Alice"`, "")
 		if err != nil {
-			t.Fatalf("gc convoy add %s %s: %v\n%s", sprintConvoyID, updateAPIID, err, out)
+			t.Fatalf("gc formula show greeting: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "Added") {
-			t.Fatalf("convoy add output mismatch:\n%s", out)
+		if !strings.Contains(out, "Say hello to Alice") {
+			t.Fatalf("show greeting should substitute Alice:\n%s", out)
 		}
 	})
 
-	t.Run("gc convoy check", func(t *testing.T) {
-		out, err := ws.runShell("gc convoy check", "")
+	t.Run(`gc formula cook feature-work --var title="Auth overhaul" --var branch="develop"`, func(t *testing.T) {
+		out, err := ws.runShell(`gc formula cook feature-work --var title="Auth overhaul" --var branch="develop"`, "")
 		if err != nil {
-			t.Fatalf("gc convoy check: %v\n%s", err, out)
+			t.Fatalf("gc formula cook feature-work branch variant: %v\n%s", err, out)
 		}
-		if strings.TrimSpace(out) == "" {
-			t.Fatal("gc convoy check output is empty")
+		if !strings.Contains(out, "feature-work.implement") {
+			t.Fatalf("feature-work cook output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("gc convoy stranded", func(t *testing.T) {
-		out, err := ws.runShell("gc convoy stranded", "")
+	t.Run(`gc formula cook feature-work --var title="Auth overhaul" --var priority="critical"`, func(t *testing.T) {
+		out, err := ws.runShell(`gc formula cook feature-work --var title="Auth overhaul" --var priority="critical"`, "")
 		if err != nil {
-			t.Fatalf("gc convoy stranded: %v\n%s", err, out)
+			t.Fatalf("gc formula cook feature-work priority variant: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "CONVOY") {
-			t.Fatalf("convoy stranded output missing header:\n%s", out)
+		if !strings.Contains(out, "feature-work.implement") {
+			t.Fatalf("feature-work cook output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run(`gc convoy create "Deploy v2" --owner mayor --merge mr --target main`, func(t *testing.T) {
-		out, err := ws.runShell(`gc convoy create "Deploy v2" --owner mayor --merge mr --target main`, "")
+	t.Run(`gc formula show feature-work --var title="Auth system"`, func(t *testing.T) {
+		out, err := ws.runShell(`gc formula show feature-work --var title="Auth system"`, "")
 		if err != nil {
-			t.Fatalf("gc convoy create Deploy v2: %v\n%s", err, out)
+			t.Fatalf("gc formula show feature-work: %v\n%s", err, out)
 		}
-		deployConvoyID = firstBeadID(out)
-		if deployConvoyID == "" {
-			t.Fatalf("could not parse Deploy v2 convoy id:\n%s", out)
+		for _, want := range []string{"Formula: feature-work", "Implement Auth system"} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("feature-work show missing %q:\n%s", want, out)
+			}
 		}
 	})
 
-	t.Run("gc convoy target mc-zk1 develop", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("gc convoy target %s develop", deployConvoyID), "")
+	t.Run("gc formula show deploy-flow --var env=dev", func(t *testing.T) {
+		out, err := ws.runShell("gc formula show deploy-flow --var env=dev", "")
 		if err != nil {
-			t.Fatalf("gc convoy target %s develop: %v\n%s", deployConvoyID, err, out)
+			t.Fatalf("gc formula show deploy-flow env=dev: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "develop") {
-			t.Fatalf("convoy target output mismatch:\n%s", out)
+		if strings.Contains(out, "deploy-flow.deploy") {
+			t.Fatalf("deploy-flow env=dev should omit deploy step:\n%s", out)
 		}
 	})
 
-	t.Run("bd ready --metadata-field gc.routed_to=my-project/worker --unassigned --limit=1", func(t *testing.T) {
-		out, err := ws.runShell("bd ready --metadata-field gc.routed_to=my-project/worker --unassigned --limit=1", "")
+	t.Run("gc formula show deploy-flow --var env=staging", func(t *testing.T) {
+		out, err := ws.runShell("gc formula show deploy-flow --var env=staging", "")
 		if err != nil {
-			t.Fatalf("bd ready --metadata-field gc.routed_to=my-project/worker --unassigned --limit=1: %v\n%s", err, out)
+			t.Fatalf("gc formula show deploy-flow env=staging: %v\n%s", err, out)
 		}
-	})
-
-	t.Run("bd list --status open --type task --flat", func(t *testing.T) {
-		out, err := ws.runShell("bd list --status open --type task --flat", "")
-		if err != nil {
-			t.Fatalf("bd list --status open --type task --flat: %v\n%s", err, out)
-		}
-		if !strings.Contains(out, "Update API docs") {
-			t.Fatalf("open task list should contain Update API docs:\n%s", out)
+		if !strings.Contains(out, "deploy-flow.deploy") {
+			t.Fatalf("deploy-flow env=staging should include deploy step:\n%s", out)
 		}
 	})
 
-	t.Run("bd show mc-a4l", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("bd show %s", refactorID), "")
+	t.Run("gc formula show retry-deploy", func(t *testing.T) {
+		out, err := ws.runShell("gc formula show retry-deploy", "")
 		if err != nil {
-			t.Fatalf("bd show %s: %v\n%s", refactorID, err, out)
+			t.Fatalf("gc formula show retry-deploy: %v\n%s", err, out)
 		}
-		for _, want := range []string{"Refactor auth module", "feature/auth", "reviewer: sky"} {
+		for _, want := range []string{
+			"retry-deploy.retries.iter1.attempt",
+			"retry-deploy.retries.iter2.attempt",
+			"retry-deploy.retries.iter3.attempt",
+		} {
 			if !strings.Contains(out, want) {
-				t.Fatalf("bd show missing %q:\n%s", want, out)
+				t.Fatalf("retry-deploy show missing %q:\n%s", want, out)
 			}
 		}
 	})
 
-	t.Run("bd close mc-a4l", func(t *testing.T) {
-		out, err := ws.runShell(fmt.Sprintf("bd close %s", refactorID), "")
-		if err != nil {
-			t.Fatalf("bd close %s: %v\n%s", refactorID, err, out)
-		}
-		if !strings.Contains(out, "Closed") {
-			t.Fatalf("bd close output mismatch:\n%s", out)
-		}
-	})
-
-	ws.noteDiagnostic("tutorial 05 seeded update-api-docs bead: %s", updateAPIID)
-	if sprintConvoyID != "" {
-		ws.noteDiagnostic("tutorial 05 Sprint 42 convoy: %s", sprintConvoyID)
+	if data, err := os.ReadFile(filepath.Join(myCity, "city.toml")); err == nil {
+		ws.noteDiagnostic("final city.toml:\n%s", string(data))
 	}
 }
diff --git a/test/acceptance/tutorial_goldens/tutorial06_test.go b/test/acceptance/tutorial_goldens/tutorial06_test.go
index 6a81ea43b5..8642e8e47a 100644
--- a/test/acceptance/tutorial_goldens/tutorial06_test.go
+++ b/test/acceptance/tutorial_goldens/tutorial06_test.go
@@ -9,13 +9,13 @@ import (
 	"testing"
 )
 
-func TestTutorial07Orders(t *testing.T) {
+func TestTutorial06Beads(t *testing.T) {
 	ws := newTutorialWorkspace(t)
-	ws.attachDiagnostics(t, "tutorial-07")
+	ws.attachDiagnostics(t, "tutorial-06")
 
 	myCity := expandHome(ws.home(), "~/my-city")
-	myAPI := expandHome(ws.home(), "~/my-api")
-	mustMkdirAll(t, myAPI)
+	myProject := expandHome(ws.home(), "~/my-project")
+	mustMkdirAll(t, myProject)
 
 	out, err := ws.runShell("gc init ~/my-city --provider claude --skip-provider-readiness", "")
 	if err != nil {
@@ -23,214 +23,348 @@ func TestTutorial07Orders(t *testing.T) {
 	}
 	ws.setCWD(myCity)
 
-	if out, err := ws.runShell("gc rig add ~/my-api", ""); err != nil {
-		t.Fatalf("seed my-api rig add: %v\n%s", err, out)
+	if out, err := ws.runShell("gc rig add ~/my-project", ""); err != nil {
+		t.Fatalf("seed rig add: %v\n%s", err, out)
 	}
+	ws.noteWarning("tutorial 06 continuity workaround: the page assumes helper/worker/reviewer agents already exist from earlier tutorials, so the page driver seeds those agent definitions explicitly before querying beads state")
+	ws.noteWarning("TODO(issue #632): tutorial 06 still documents explicit rig-qualified reviewer examples; once rig-local shorthand is reliable in acceptance-style paths, simplify those examples where the user is already operating inside the rig context")
+	for _, cmd := range []string{
+		"gc agent add --name helper",
+		"gc agent add --name worker",
+		"gc agent add --name reviewer --dir my-project",
+	} {
+		if out, err := ws.runShell(cmd, ""); err != nil {
+			t.Fatalf("seed agent scaffold %q: %v\n%s", cmd, err, out)
+		}
+	}
+	writeFile(t, filepath.Join(myCity, "agents", "helper", "prompt.template.md"), "# Helper Agent\nHandle supporting work.\n", 0o644)
+	writeFile(t, filepath.Join(myCity, "agents", "worker", "prompt.template.md"), "# Worker Agent\nHandle general work.\n", 0o644)
+	writeFile(t, filepath.Join(myCity, "agents", "reviewer", "agent.toml"), "dir = \"my-project\"\nprovider = \""+tutorialReviewerProvider()+"\"\n", 0o644)
+	writeFile(t, filepath.Join(myCity, "agents", "reviewer", "prompt.template.md"), "# Reviewer Agent\nReview code.\n", 0o644)
+	ws.noteDiagnostic("tutorial 06 continuity setup: replaying tutorial 05's documented pancakes formula command before exercising the next page's bead examples")
+	if out, err := ws.runShell(tutorialPancakesFormulaShellCommand(t), ""); err != nil {
+		t.Fatalf("seed tutorial 05 pancakes formula: %v\n%s", err, out)
+	}
+
+	updateAPIOut, err := ws.runShell(`bd create "Update API docs"`, "")
+	if err != nil {
+		t.Fatalf("seed update api docs: %v\n%s", err, updateAPIOut)
+	}
+	updateAPIID := firstBeadID(updateAPIOut)
+	if updateAPIID == "" {
+		t.Fatalf("could not parse update-api-docs bead id:\n%s", updateAPIOut)
+	}
+	if out, err := ws.runShell(fmt.Sprintf("bd label add %s pool:my-project/worker", updateAPIID), ""); err != nil {
+		t.Fatalf("seed pool label: %v\n%s", err, out)
+	}
+	if out, err := ws.runShell("gc formula cook pancakes", ""); err != nil {
+		t.Fatalf("seed pancakes cook: %v\n%s", err, out)
+	}
+
+	var loginBugID string
+	var refactorID string
+	var sprintConvoyID string
+	var ownedConvoyID string
+	var deployConvoyID string
+
+	t.Run("cat city.toml", func(t *testing.T) {
+		out, err := ws.runShell("cat city.toml", "")
+		if err != nil {
+			t.Fatalf("cat city.toml: %v\n%s", err, out)
+		}
+		for _, want := range []string{
+			`provider = "claude"`,
+			`name = "my-project"`,
+		} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("city.toml missing %q:\n%s", want, out)
+			}
+		}
+		if strings.Contains(out, myProject) {
+			t.Fatalf("city.toml should not contain machine-local rig path %q:\n%s", myProject, out)
+		}
+	})
+
+	t.Run("cat agents/reviewer/agent.toml", func(t *testing.T) {
+		out, err := ws.runShell("cat agents/reviewer/agent.toml", "")
+		if err != nil {
+			t.Fatalf("cat agents/reviewer/agent.toml: %v\n%s", err, out)
+		}
+		for _, want := range []string{
+			`dir = "my-project"`,
+			`provider = "` + tutorialReviewerProvider() + `"`,
+		} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("agents/reviewer/agent.toml missing %q:\n%s", want, out)
+			}
+		}
+	})
 
-	cityToml := filepath.Join(myCity, "city.toml")
-	replaceInFile(
-		t,
-		cityToml,
-		fmt.Sprintf("name = %q\n", "my-api"),
-		fmt.Sprintf("name = %q\n\n[rigs.imports.dev_ops]\nsource = \"./packs/dev-ops\"\n", "my-api"),
-	)
-
-	writeFile(t, filepath.Join(myCity, "formulas", "review.toml"), `formula = "review"
-
-[[steps]]
-id = "check"
-title = "Check open PRs that need review"
-`, 0o644)
-	writeFile(t, filepath.Join(myCity, "formulas", "release-notes.toml"), `formula = "release-notes"
-
-[[steps]]
-id = "gather"
-title = "Gather merged PRs from the last week"
-
-[[steps]]
-id = "summarize"
-title = "Write release notes"
-needs = ["gather"]
-
-[[steps]]
-id = "post"
-title = "Post release notes to the team channel"
-needs = ["summarize"]
-`, 0o644)
-	writeFile(t, filepath.Join(myCity, "packs", "dev-ops", "pack.toml"), `[pack]
-name = "dev-ops"
-schema = 2
-`, 0o644)
-	writeFile(t, filepath.Join(myCity, "packs", "dev-ops", "formulas", "test-suite.toml"), `formula = "test-suite"
-
-[[steps]]
-id = "run"
-title = "Run the test suite"
-`, 0o644)
-
-	reviewOrder := `[order]
-description = "Check for PRs that need review"
-formula = "review"
-trigger = "cooldown"
-interval = "5m"
-pool = "worker"
-`
-	depUpdateOrder := `[order]
-description = "Check dependency updates"
-formula = "review"
-trigger = "cooldown"
-interval = "1h"
-pool = "worker"
-`
-	releaseNotesOrder := `[order]
-description = "Generate release notes"
-formula = "release-notes"
-trigger = "cooldown"
-interval = "24h"
-pool = "worker"
-`
-	testSuiteOrder := `[order]
-description = "Run the test suite"
-formula = "test-suite"
-trigger = "cooldown"
-interval = "5m"
-pool = "worker"
-`
-
-	writeFile(t, filepath.Join(myCity, "orders", "review-check.toml"), reviewOrder, 0o644)
-	writeFile(t, filepath.Join(myCity, "orders", "dep-update.toml"), depUpdateOrder, 0o644)
-	writeFile(t, filepath.Join(myCity, "orders", "release-notes.toml"), releaseNotesOrder, 0o644)
-	writeFile(t, filepath.Join(myCity, "packs", "dev-ops", "orders", "test-suite.toml"), testSuiteOrder, 0o644)
-
-	t.Run("gc order list", func(t *testing.T) {
-		out, err := ws.runShell("gc order list", "")
-		if err != nil {
-			t.Fatalf("gc order list: %v\n%s", err, out)
-		}
-		for _, want := range []string{"review-check", "dep-update", "release-notes"} {
+	t.Run("bd list", func(t *testing.T) {
+		out, err := ws.runShell("bd list", "")
+		if err != nil {
+			t.Fatalf("bd list: %v\n%s", err, out)
+		}
+		for _, want := range []string{"Update API docs", "Status:"} {
 			if !strings.Contains(out, want) {
-				t.Fatalf("order list missing %q:\n%s", want, out)
+				t.Fatalf("bd list missing %q:\n%s", want, out)
 			}
 		}
 	})
 
-	t.Run("gc order show review-check", func(t *testing.T) {
-		out, err := ws.runShell("gc order show review-check", "")
+	t.Run(`bd create "Fix the login bug"`, func(t *testing.T) {
+		out, err := ws.runShell(`bd create "Fix the login bug"`, "")
+		if err != nil {
+			t.Fatalf("bd create Fix the login bug: %v\n%s", err, out)
+		}
+		loginBugID = firstBeadID(out)
+		if loginBugID == "" {
+			t.Fatalf("could not parse login bug bead id:\n%s", out)
+		}
+	})
+
+	t.Run(`bd create "Refactor auth module" --type feature`, func(t *testing.T) {
+		out, err := ws.runShell(`bd create "Refactor auth module" --type feature`, "")
+		if err != nil {
+			t.Fatalf("bd create Refactor auth module: %v\n%s", err, out)
+		}
+		refactorID = firstBeadID(out)
+		if refactorID == "" {
+			t.Fatalf("could not parse refactor auth module bead id:\n%s", out)
+		}
+	})
+
+	t.Run("bd close mc-ykp", func(t *testing.T) {
+		if loginBugID == "" {
+			t.Fatal("missing Fix the login bug bead id")
+		}
+		out, err := ws.runShell(fmt.Sprintf("bd close %s", loginBugID), "")
+		if err != nil {
+			t.Fatalf("bd close %s: %v\n%s", loginBugID, err, out)
+		}
+		if !strings.Contains(out, "Closed") {
+			t.Fatalf("bd close output mismatch:\n%s", out)
+		}
+	})
+
+	t.Run("bd list --status open --flat", func(t *testing.T) {
+		out, err := ws.runShell("bd list --status open --flat", "")
 		if err != nil {
-			t.Fatalf("gc order show review-check: %v\n%s", err, out)
+			t.Fatalf("bd list --status open --flat: %v\n%s", err, out)
 		}
-		for _, want := range []string{"review-check", "Formula:", "review"} {
+		for _, want := range []string{"Refactor auth module", "Update API docs"} {
 			if !strings.Contains(out, want) {
-				t.Fatalf("order show review-check missing %q:\n%s", want, out)
+				t.Fatalf("open flat list missing %q:\n%s", want, out)
 			}
 		}
+		if loginBugID != "" && strings.Contains(out, loginBugID) {
+			t.Fatalf("closed login bug should not still appear in open list:\n%s", out)
+		}
+	})
+
+	t.Run("bd list --status in_progress --flat", func(t *testing.T) {
+		ws.noteWarning("tutorial 06 coverage workaround: the page expects live in-progress work, so the page driver marks the refactor bead in_progress before running the filtered status query")
+		if out, err := ws.runShell(fmt.Sprintf("bd update %s --status in_progress", refactorID), ""); err != nil {
+			t.Fatalf("seed refactor in_progress state: %v\n%s", err, out)
+		}
+		out, err := ws.runShell("bd list --status in_progress --flat", "")
+		if err != nil {
+			t.Fatalf("bd list --status in_progress --flat: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "Refactor auth module") {
+			t.Fatalf("in-progress list should expose live runtime work:\n%s", out)
+		}
+	})
+
+	t.Run("bd label add mc-a4l priority:high", func(t *testing.T) {
+		if refactorID == "" {
+			t.Fatal("missing Refactor auth module bead id")
+		}
+		out, err := ws.runShell(fmt.Sprintf("bd label add %s priority:high", refactorID), "")
+		if err != nil {
+			t.Fatalf("adding priority label: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "priority:high") {
+			t.Fatalf("label add output mismatch:\n%s", out)
+		}
 	})
 
-	t.Run("gc order check", func(t *testing.T) {
-		out, err := ws.runShell("gc order check", "")
-		if err != nil && !strings.Contains(out, "NAME") {
-			t.Fatalf("gc order check: %v\n%s", err, out)
+	t.Run("bd label add mc-a4l frontend", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("bd label add %s frontend", refactorID), "")
+		if err != nil {
+			t.Fatalf("adding frontend label: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "review-check") {
-			t.Fatalf("order check should mention review-check:\n%s", out)
+		if !strings.Contains(out, "frontend") {
+			t.Fatalf("label add output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("gc order run review-check", func(t *testing.T) {
-		out, err := ws.runShell("gc order run review-check", "")
+	t.Run("bd list --label priority:high --flat", func(t *testing.T) {
+		out, err := ws.runShell("bd list --label priority:high --flat", "")
 		if err != nil {
-			t.Fatalf("gc order run review-check: %v\n%s", err, out)
+			t.Fatalf("bd list --label priority:high --flat: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, `Order "review-check" executed`) {
-			t.Fatalf("order run output mismatch:\n%s", out)
+		if !strings.Contains(out, "Refactor auth module") {
+			t.Fatalf("label query should show Refactor auth module:\n%s", out)
 		}
 	})
 
-	t.Run("gc order history", func(t *testing.T) {
-		out, err := ws.runShell("gc order history", "")
+	t.Run("bd update mc-a4l --set-metadata branch=feature/auth --set-metadata reviewer=sky", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("bd update %s --set-metadata branch=feature/auth --set-metadata reviewer=sky", refactorID), "")
 		if err != nil {
-			t.Fatalf("gc order history: %v\n%s", err, out)
+			t.Fatalf("bd update metadata: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "review-check") {
-			t.Fatalf("order history should mention review-check:\n%s", out)
+		if !strings.Contains(out, "Updated") {
+			t.Fatalf("metadata update output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("gc order history review-check", func(t *testing.T) {
-		out, err := ws.runShell("gc order history review-check", "")
+	t.Run("bd dep mc-a4l --blocks mc-xp7", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("bd dep %s --blocks %s", refactorID, updateAPIID), "")
 		if err != nil {
-			t.Fatalf("gc order history review-check: %v\n%s", err, out)
+			t.Fatalf("bd dep --blocks: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "review-check") {
-			t.Fatalf("filtered order history should mention review-check:\n%s", out)
+		if !strings.Contains(out, "blocks") {
+			t.Fatalf("dependency output mismatch:\n%s", out)
 		}
 	})
 
-	t.Run("gc order list (with rig order)", func(t *testing.T) {
-		out, err := ws.runShell("gc order list", "")
+	t.Run(`gc convoy create "Sprint 42" mc-ykp mc-a4l mc-xp7`, func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf(`gc convoy create "Sprint 42" %s %s %s`, loginBugID, refactorID, updateAPIID), "")
 		if err != nil {
-			t.Fatalf("gc order list (with rig order): %v\n%s", err, out)
+			t.Fatalf("gc convoy create Sprint 42: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "test-suite") {
-			t.Fatalf("order list should include test-suite:\n%s", out)
+		sprintConvoyID = firstBeadID(out)
+		if sprintConvoyID == "" {
+			t.Fatalf("could not parse Sprint 42 convoy id:\n%s", out)
 		}
 	})
 
-	t.Run("gc order show test-suite --rig my-api", func(t *testing.T) {
-		out, err := ws.runShell("gc order show test-suite --rig my-api", "")
+	t.Run("gc convoy status mc-d4g", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("gc convoy status %s", sprintConvoyID), "")
 		if err != nil {
-			t.Fatalf("gc order show test-suite --rig my-api: %v\n%s", err, out)
+			t.Fatalf("gc convoy status %s: %v\n%s", sprintConvoyID, err, out)
 		}
-		for _, want := range []string{"test-suite", "Formula:", "Target:"} {
+		for _, want := range []string{"Sprint 42", "Fix the login bug", "Refactor auth module", "Update API docs"} {
 			if !strings.Contains(out, want) {
-				t.Fatalf("rig order show missing %q:\n%s", want, out)
+				t.Fatalf("convoy status missing %q:\n%s", want, out)
 			}
 		}
 	})
 
-	t.Run("gc order run test-suite --rig my-api", func(t *testing.T) {
-		out, err := ws.runShell("gc order run test-suite --rig my-api", "")
+	t.Run(`gc convoy create "Auth rewrite" --owned --target integration/auth`, func(t *testing.T) {
+		out, err := ws.runShell(`gc convoy create "Auth rewrite" --owned --target integration/auth`, "")
 		if err != nil {
-			t.Fatalf("gc order run test-suite --rig my-api: %v\n%s", err, out)
+			t.Fatalf("gc convoy create Auth rewrite: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, `Order "test-suite" executed`) {
-			t.Fatalf("rig order run output mismatch:\n%s", out)
+		ownedConvoyID = firstBeadID(out)
+		if ownedConvoyID == "" {
+			t.Fatalf("could not parse owned convoy id:\n%s", out)
 		}
 	})
 
-	t.Run("gc start", func(t *testing.T) {
-		ws.noteWarning("tutorial 07 workaround: gc init currently leaves a standalone controller running, so the page driver stops that controller immediately before the visible gc start step")
-		if statusOut, statusErr := ws.runShell("gc status", ""); statusErr == nil && !strings.Contains(statusOut, "Controller: stopped") {
-			if stopOut, stopErr := ws.runShell("gc stop", ""); stopErr != nil {
-				t.Fatalf("hidden gc stop before visible gc start: %v\n%s", stopErr, stopOut)
-			}
+	t.Run("gc convoy land mc-0ud", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("gc convoy land %s", ownedConvoyID), "")
+		if err != nil {
+			t.Fatalf("gc convoy land %s: %v\n%s", ownedConvoyID, err, out)
+		}
+		if !strings.Contains(out, "Landed") {
+			t.Fatalf("convoy land output mismatch:\n%s", out)
 		}
-		out, err := ws.runShell("gc start", "")
+	})
+
+	t.Run("gc convoy add mc-d4g mc-xp7", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("gc convoy add %s %s", sprintConvoyID, updateAPIID), "")
+		if err != nil {
+			t.Fatalf("gc convoy add %s %s: %v\n%s", sprintConvoyID, updateAPIID, err, out)
+		}
+		if !strings.Contains(out, "Added") {
+			t.Fatalf("convoy add output mismatch:\n%s", out)
+		}
+	})
+
+	t.Run("gc convoy check", func(t *testing.T) {
+		out, err := ws.runShell("gc convoy check", "")
 		if err != nil {
-			t.Fatalf("gc start: %v\n%s", err, out)
+			t.Fatalf("gc convoy check: %v\n%s", err, out)
 		}
 		if strings.TrimSpace(out) == "" {
-			t.Fatal("gc start output is empty")
+			t.Fatal("gc convoy check output is empty")
+		}
+	})
+
+	t.Run("gc convoy stranded", func(t *testing.T) {
+		out, err := ws.runShell("gc convoy stranded", "")
+		if err != nil {
+			t.Fatalf("gc convoy stranded: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "CONVOY") {
+			t.Fatalf("convoy stranded output missing header:\n%s", out)
 		}
 	})
 
-	t.Run("gc order list (after start)", func(t *testing.T) {
-		out, err := ws.runShell("gc order list", "")
+	t.Run(`gc convoy create "Deploy v2" --owner mayor --merge mr --target main`, func(t *testing.T) {
+		out, err := ws.runShell(`gc convoy create "Deploy v2" --owner mayor --merge mr --target main`, "")
 		if err != nil {
-			t.Fatalf("gc order list after start: %v\n%s", err, out)
+			t.Fatalf("gc convoy create Deploy v2: %v\n%s", err, out)
 		}
-		if !strings.Contains(out, "review-check") {
-			t.Fatalf("order list after start missing review-check:\n%s", out)
+		deployConvoyID = firstBeadID(out)
+		if deployConvoyID == "" {
+			t.Fatalf("could not parse Deploy v2 convoy id:\n%s", out)
 		}
 	})
 
-	t.Run("gc order check (after start)", func(t *testing.T) {
-		out, err := ws.runShell("gc order check", "")
-		if err != nil && !strings.Contains(out, "NAME") {
-			t.Fatalf("gc order check after start: %v\n%s", err, out)
+	t.Run("gc convoy target mc-zk1 develop", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("gc convoy target %s develop", deployConvoyID), "")
+		if err != nil {
+			t.Fatalf("gc convoy target %s develop: %v\n%s", deployConvoyID, err, out)
+		}
+		if !strings.Contains(out, "develop") {
+			t.Fatalf("convoy target output mismatch:\n%s", out)
+		}
+	})
+
+	t.Run("bd ready --metadata-field gc.routed_to=my-project/worker --unassigned --limit=1", func(t *testing.T) {
+		out, err := ws.runShell("bd ready --metadata-field gc.routed_to=my-project/worker --unassigned --limit=1", "")
+		if err != nil {
+			t.Fatalf("bd ready --metadata-field gc.routed_to=my-project/worker --unassigned --limit=1: %v\n%s", err, out)
+		}
+	})
+
+	t.Run("bd list --status open --type task --flat", func(t *testing.T) {
+		out, err := ws.runShell("bd list --status open --type task --flat", "")
+		if err != nil {
+			t.Fatalf("bd list --status open --type task --flat: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "Update API docs") {
+			t.Fatalf("open task list should contain Update API docs:\n%s", out)
+		}
+	})
+
+	t.Run("bd show mc-a4l", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("bd show %s", refactorID), "")
+		if err != nil {
+			t.Fatalf("bd show %s: %v\n%s", refactorID, err, out)
+		}
+		for _, want := range []string{"Refactor auth module", "feature/auth", "reviewer: sky"} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("bd show missing %q:\n%s", want, out)
+			}
 		}
-		if !strings.Contains(out, "review-check") {
-			t.Fatalf("order check after start should mention review-check:\n%s", out)
+	})
+
+	t.Run("bd close mc-a4l", func(t *testing.T) {
+		out, err := ws.runShell(fmt.Sprintf("bd close %s", refactorID), "")
+		if err != nil {
+			t.Fatalf("bd close %s: %v\n%s", refactorID, err, out)
+		}
+		if !strings.Contains(out, "Closed") {
+			t.Fatalf("bd close output mismatch:\n%s", out)
 		}
 	})
+
+	ws.noteDiagnostic("tutorial 05 seeded update-api-docs bead: %s", updateAPIID)
+	if sprintConvoyID != "" {
+		ws.noteDiagnostic("tutorial 05 Sprint 42 convoy: %s", sprintConvoyID)
+	}
 }
diff --git a/test/acceptance/tutorial_goldens/tutorial07_test.go b/test/acceptance/tutorial_goldens/tutorial07_test.go
new file mode 100644
index 0000000000..6a81ea43b5
--- /dev/null
+++ b/test/acceptance/tutorial_goldens/tutorial07_test.go
@@ -0,0 +1,236 @@
+//go:build acceptance_c
+
+package tutorialgoldens
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestTutorial07Orders(t *testing.T) {
+	ws := newTutorialWorkspace(t)
+	ws.attachDiagnostics(t, "tutorial-07")
+
+	myCity := expandHome(ws.home(), "~/my-city")
+	myAPI := expandHome(ws.home(), "~/my-api")
+	mustMkdirAll(t, myAPI)
+
+	out, err := ws.runShell("gc init ~/my-city --provider claude --skip-provider-readiness", "")
+	if err != nil {
+		t.Fatalf("seed city init: %v\n%s", err, out)
+	}
+	ws.setCWD(myCity)
+
+	if out, err := ws.runShell("gc rig add ~/my-api", ""); err != nil {
+		t.Fatalf("seed my-api rig add: %v\n%s", err, out)
+	}
+
+	cityToml := filepath.Join(myCity, "city.toml")
+	replaceInFile(
+		t,
+		cityToml,
+		fmt.Sprintf("name = %q\n", "my-api"),
+		fmt.Sprintf("name = %q\n\n[rigs.imports.dev_ops]\nsource = \"./packs/dev-ops\"\n", "my-api"),
+	)
+
+	writeFile(t, filepath.Join(myCity, "formulas", "review.toml"), `formula = "review"
+
+[[steps]]
+id = "check"
+title = "Check open PRs that need review"
+`, 0o644)
+	writeFile(t, filepath.Join(myCity, "formulas", "release-notes.toml"), `formula = "release-notes"
+
+[[steps]]
+id = "gather"
+title = "Gather merged PRs from the last week"
+
+[[steps]]
+id = "summarize"
+title = "Write release notes"
+needs = ["gather"]
+
+[[steps]]
+id = "post"
+title = "Post release notes to the team channel"
+needs = ["summarize"]
+`, 0o644)
+	writeFile(t, filepath.Join(myCity, "packs", "dev-ops", "pack.toml"), `[pack]
+name = "dev-ops"
+schema = 2
+`, 0o644)
+	writeFile(t, filepath.Join(myCity, "packs", "dev-ops", "formulas", "test-suite.toml"), `formula = "test-suite"
+
+[[steps]]
+id = "run"
+title = "Run the test suite"
+`, 0o644)
+
+	reviewOrder := `[order]
+description = "Check for PRs that need review"
+formula = "review"
+trigger = "cooldown"
+interval = "5m"
+pool = "worker"
+`
+	depUpdateOrder := `[order]
+description = "Check dependency updates"
+formula = "review"
+trigger = "cooldown"
+interval = "1h"
+pool = "worker"
+`
+	releaseNotesOrder := `[order]
+description = "Generate release notes"
+formula = "release-notes"
+trigger = "cooldown"
+interval = "24h"
+pool = "worker"
+`
+	testSuiteOrder := `[order]
+description = "Run the test suite"
+formula = "test-suite"
+trigger = "cooldown"
+interval = "5m"
+pool = "worker"
+`
+
+	writeFile(t, filepath.Join(myCity, "orders", "review-check.toml"), reviewOrder, 0o644)
+	writeFile(t, filepath.Join(myCity, "orders", "dep-update.toml"), depUpdateOrder, 0o644)
+	writeFile(t, filepath.Join(myCity, "orders", "release-notes.toml"), releaseNotesOrder, 0o644)
+	writeFile(t, filepath.Join(myCity, "packs", "dev-ops", "orders", "test-suite.toml"), testSuiteOrder, 0o644)
+
+	t.Run("gc order list", func(t *testing.T) {
+		out, err := ws.runShell("gc order list", "")
+		if err != nil {
+			t.Fatalf("gc order list: %v\n%s", err, out)
+		}
+		for _, want := range []string{"review-check", "dep-update", "release-notes"} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("order list missing %q:\n%s", want, out)
+			}
+		}
+	})
+
+	t.Run("gc order show review-check", func(t *testing.T) {
+		out, err := ws.runShell("gc order show review-check", "")
+		if err != nil {
+			t.Fatalf("gc order show review-check: %v\n%s", err, out)
+		}
+		for _, want := range []string{"review-check", "Formula:", "review"} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("order show review-check missing %q:\n%s", want, out)
+			}
+		}
+	})
+
+	t.Run("gc order check", func(t *testing.T) {
+		out, err := ws.runShell("gc order check", "")
+		if err != nil && !strings.Contains(out, "NAME") {
+			t.Fatalf("gc order check: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "review-check") {
+			t.Fatalf("order check should mention review-check:\n%s", out)
+		}
+	})
+
+	t.Run("gc order run review-check", func(t *testing.T) {
+		out, err := ws.runShell("gc order run review-check", "")
+		if err != nil {
+			t.Fatalf("gc order run review-check: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, `Order "review-check" executed`) {
+			t.Fatalf("order run output mismatch:\n%s", out)
+		}
+	})
+
+	t.Run("gc order history", func(t *testing.T) {
+		out, err := ws.runShell("gc order history", "")
+		if err != nil {
+			t.Fatalf("gc order history: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "review-check") {
+			t.Fatalf("order history should mention review-check:\n%s", out)
+		}
+	})
+
+	t.Run("gc order history review-check", func(t *testing.T) {
+		out, err := ws.runShell("gc order history review-check", "")
+		if err != nil {
+			t.Fatalf("gc order history review-check: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "review-check") {
+			t.Fatalf("filtered order history should mention review-check:\n%s", out)
+		}
+	})
+
+	t.Run("gc order list (with rig order)", func(t *testing.T) {
+		out, err := ws.runShell("gc order list", "")
+		if err != nil {
+			t.Fatalf("gc order list (with rig order): %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "test-suite") {
+			t.Fatalf("order list should include test-suite:\n%s", out)
+		}
+	})
+
+	t.Run("gc order show test-suite --rig my-api", func(t *testing.T) {
+		out, err := ws.runShell("gc order show test-suite --rig my-api", "")
+		if err != nil {
+			t.Fatalf("gc order show test-suite --rig my-api: %v\n%s", err, out)
+		}
+		for _, want := range []string{"test-suite", "Formula:", "Target:"} {
+			if !strings.Contains(out, want) {
+				t.Fatalf("rig order show missing %q:\n%s", want, out)
+			}
+		}
+	})
+
+	t.Run("gc order run test-suite --rig my-api", func(t *testing.T) {
+		out, err := ws.runShell("gc order run test-suite --rig my-api", "")
+		if err != nil {
+			t.Fatalf("gc order run test-suite --rig my-api: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, `Order "test-suite" executed`) {
+			t.Fatalf("rig order run output mismatch:\n%s", out)
+		}
+	})
+
+	t.Run("gc start", func(t *testing.T) {
+		ws.noteWarning("tutorial 07 workaround: gc init currently leaves a standalone controller running, so the page driver stops that controller immediately before the visible gc start step")
+		if statusOut, statusErr := ws.runShell("gc status", ""); statusErr == nil && !strings.Contains(statusOut, "Controller: stopped") {
+			if stopOut, stopErr := ws.runShell("gc stop", ""); stopErr != nil {
+				t.Fatalf("hidden gc stop before visible gc start: %v\n%s", stopErr, stopOut)
+			}
+		}
+		out, err := ws.runShell("gc start", "")
+		if err != nil {
+			t.Fatalf("gc start: %v\n%s", err, out)
+		}
+		if strings.TrimSpace(out) == "" {
+			t.Fatal("gc start output is empty")
+		}
+	})
+
+	t.Run("gc order list (after start)", func(t *testing.T) {
+		out, err := ws.runShell("gc order list", "")
+		if err != nil {
+			t.Fatalf("gc order list after start: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "review-check") {
+			t.Fatalf("order list after start missing review-check:\n%s", out)
+		}
+	})
+
+	t.Run("gc order check (after start)", func(t *testing.T) {
+		out, err := ws.runShell("gc order check", "")
+		if err != nil && !strings.Contains(out, "NAME") {
+			t.Fatalf("gc order check after start: %v\n%s", err, out)
+		}
+		if !strings.Contains(out, "review-check") {
+			t.Fatalf("order check after start should mention review-check:\n%s", out)
+		}
+	})
+}
diff --git a/test/acceptance/worker_inference/classification_test.go b/test/acceptance/worker_inference/classification_test.go
index 2cd0483ff9..f404f46c70 100644
--- a/test/acceptance/worker_inference/classification_test.go
+++ b/test/acceptance/worker_inference/classification_test.go
@@ -68,6 +68,17 @@ func TestLiveFailureResultClassifiesProviderIncidents(t *testing.T) {
 	require.Equal(t, workertest.ResultProviderIssue, result.Status)
 }
 
+func TestLiveFailureResultClassifiesOpenCodeGeminiCapacity(t *testing.T) {
+	result := liveFailureResult(
+		workertest.ProfileID("opencode/tmux-cli"),
+		workertest.RequirementInferenceFreshTask,
+		"live worker did not complete within timeout",
+		map[string]string{"pane_tail": "gemini is way too hot right now (click to expand) [retrying in 31s attempt 4]"},
+	)
+
+	require.Equal(t, workertest.ResultProviderIssue, result.Status)
+}
+
 func TestLiveFailureResultClassifiesAuthErrorsFromPaneTail(t *testing.T) {
 	result := liveFailureResult(
 		workertest.ProfileID("claude/tmux-cli"),
@@ -128,6 +139,15 @@ purchase more credits or try again at 11:26 PM.
 	require.Equal(t, "rate_limit", blocked.Kind)
 }
 
+func TestClassifyLivePaneBlockedOpenCodeGeminiCapacity(t *testing.T) {
+	blocked := classifyLivePaneBlocked(`
+gemini is way too hot right now (click to expand) [retrying in 31s attempt 4]
+`)
+
+	require.NotNil(t, blocked)
+	require.Equal(t, "rate_limit", blocked.Kind)
+}
+
 func TestSessionStateCountsAsRunning(t *testing.T) {
 	require.True(t, sessionStateCountsAsRunning("active"))
 	require.True(t, sessionStateCountsAsRunning("awake"))
@@ -463,6 +483,45 @@ func TestStageCodexAuthFromFile(t *testing.T) {
 	require.FileExists(t, filepath.Join(gcHome, ".codex", "auth.json"))
 }
 
+func TestStageOpenCodeGeminiAuthFromEnv(t *testing.T) {
+	gcHome := t.TempDir()
+	env := helpers.NewEnv("", gcHome, t.TempDir())
+	t.Setenv("GEMINI_API_KEY", "gemini-key")
+
+	source, err := stageOpenCodeGeminiAuth(gcHome, env)
+	require.NoError(t, err)
+	require.Equal(t, "env:GEMINI_API_KEY", source)
+	require.Equal(t, "gemini-key", env.Get("GEMINI_API_KEY"))
+	require.Equal(t, filepath.Join(gcHome, ".local", "share"), env.Get("XDG_DATA_HOME"))
+	require.Equal(t, filepath.Join(gcHome, ".config"), env.Get("XDG_CONFIG_HOME"))
+	require.Equal(t, filepath.Join(gcHome, ".cache"), env.Get("XDG_CACHE_HOME"))
+	require.Equal(t, filepath.Join(gcHome, ".local", "state"), env.Get("XDG_STATE_HOME"))
+	require.Equal(t, filepath.Join(gcHome, ".local", "share", "gascity", "opencode-transcripts"), env.Get("GC_OPENCODE_TRANSCRIPT_DIR"))
+}
+
+func TestStageOpenCodeGeminiAuthUsesGoogleGenerativeAIEnv(t *testing.T) {
+	gcHome := t.TempDir()
+	env := helpers.NewEnv("", gcHome, t.TempDir())
+	t.Setenv("GOOGLE_GENERATIVE_AI_API_KEY", "google-generative-key")
+
+	source, err := stageOpenCodeGeminiAuth(gcHome, env)
+	require.NoError(t, err)
+	require.Equal(t, "env:GOOGLE_GENERATIVE_AI_API_KEY", source)
+	require.Equal(t, "google-generative-key", env.Get("GOOGLE_GENERATIVE_AI_API_KEY"))
+}
+
+func TestStageOpenCodeGeminiAuthMapsGoogleAPIKey(t *testing.T) {
+	gcHome := t.TempDir()
+	env := helpers.NewEnv("", gcHome, t.TempDir())
+	t.Setenv("GOOGLE_API_KEY", "google-key")
+
+	source, err := stageOpenCodeGeminiAuth(gcHome, env)
+	require.NoError(t, err)
+	require.Equal(t, "env:GOOGLE_API_KEY", source)
+	require.Equal(t, "google-key", env.Get("GOOGLE_API_KEY"))
+	require.Equal(t, "google-key", env.Get("GEMINI_API_KEY"))
+}
+
 func TestSeedLiveProviderStateCodexMarksTrustedProject(t *testing.T) {
 	gcHome := t.TempDir()
 	prevEnv := liveEnv
@@ -792,6 +851,35 @@ install_agent_hooks = ["gemini"]`)
 	require.Equal(t, 1, strings.Count(text, `install_agent_hooks = ["gemini"]`))
 }
 
+func TestInstallInferenceProbeAgentEnablesOpenCodeHooks(t *testing.T) {
+	cityDir := t.TempDir()
+	cityToml := filepath.Join(cityDir, "city.toml")
+	require.NoError(t, os.WriteFile(cityToml, []byte(`
+[workspace]
+name = "worker-inference-test"
+provider = "opencode"
+
+[[agent]]
+name = "mayor"
+prompt_template = "prompts/mayor.md"
+`), 0o644))
+
+	require.NoError(t, installInferenceProbeAgent(cityDir, true))
+	require.NoError(t, installInferenceProbeAgent(cityDir, true))
+
+	data, err := os.ReadFile(cityToml)
+	require.NoError(t, err)
+	text := string(data)
+	require.Contains(t, text, `[workspace]
+name = "worker-inference-test"
+provider = "opencode"
+install_agent_hooks = ["opencode"]`)
+	require.Contains(t, text, `[[agent]]
+name = "probe"
+session = "tmux"`)
+	require.Equal(t, 1, strings.Count(text, `install_agent_hooks = ["opencode"]`))
+}
+
 func TestInstallLiveProviderCommandOverride(t *testing.T) {
 	cityDir := t.TempDir()
 	cityToml := filepath.Join(cityDir, "city.toml")
@@ -828,6 +916,26 @@ provider = "claude"
 	require.Contains(t, text, `process_names = ["aimux", "claude"]`)
 }
 
+func TestInstallLiveProviderCommandOverrideIncludesArgsAppend(t *testing.T) {
+	cityDir := t.TempDir()
+	cityToml := filepath.Join(cityDir, "city.toml")
+	require.NoError(t, os.WriteFile(cityToml, []byte(`
+[workspace]
+name = "worker-inference-test"
+provider = "opencode"
+`), 0o644))
+
+	require.NoError(t, installLiveProviderCommandOverrideWithArgs(cityDir, "opencode", "/tmp/provider-bin/opencode", []string{"opencode", "node", "bun"}, []string{"--model", "google/gemini-2.5-flash"}))
+
+	data, err := os.ReadFile(cityToml)
+	require.NoError(t, err)
+	text := string(data)
+	require.Contains(t, text, `[providers.opencode]`)
+	require.Contains(t, text, `command = "/tmp/provider-bin/opencode"`)
+	require.Contains(t, text, `process_names = ["opencode", "node", "bun"]`)
+	require.Contains(t, text, `args_append = ["--model", "google/gemini-2.5-flash"]`)
+}
+
 func TestSetNamedSessionMode(t *testing.T) {
 	cityDir := t.TempDir()
 	cityToml := filepath.Join(cityDir, "city.toml")
diff --git a/test/acceptance/worker_inference/main_test.go b/test/acceptance/worker_inference/main_test.go
index 6d252a50e6..19bbd7cfc2 100644
--- a/test/acceptance/worker_inference/main_test.go
+++ b/test/acceptance/worker_inference/main_test.go
@@ -21,6 +21,8 @@ var (
 	liveSetup providerSetup
 )
 
+const defaultOpenCodeGeminiModel = "google/gemini-2.5-flash"
+
 type providerSetup struct {
 	Profile      workerpkg.Profile
 	Provider     string
@@ -123,6 +125,8 @@ func resolveProfile(raw string) workerpkg.Profile {
 		return workerpkg.ProfileCodexTmuxCLI
 	case string(workerpkg.ProfileGeminiTmuxCLI):
 		return workerpkg.ProfileGeminiTmuxCLI
+	case string(workerpkg.ProfileOpenCodeTmuxCLI):
+		return workerpkg.ProfileOpenCodeTmuxCLI
 	default:
 		return workerpkg.Profile(strings.TrimSpace(raw))
 	}
@@ -136,6 +140,8 @@ func profileProvider(profile workerpkg.Profile) string {
 		return "codex"
 	case workerpkg.ProfileGeminiTmuxCLI:
 		return "gemini"
+	case workerpkg.ProfileOpenCodeTmuxCLI:
+		return "opencode"
 	default:
 		return ""
 	}
@@ -147,6 +153,8 @@ func profileSearchPaths(gcHome string, profile workerpkg.Profile) []string {
 		return []string{filepath.Join(gcHome, ".codex", "sessions")}
 	case workerpkg.ProfileGeminiTmuxCLI:
 		return []string{filepath.Join(gcHome, ".gemini", "tmp")}
+	case workerpkg.ProfileOpenCodeTmuxCLI:
+		return []string{filepath.Join(gcHome, ".local", "share", "gascity", "opencode-transcripts")}
 	default:
 		return []string{filepath.Join(gcHome, ".claude", "projects")}
 	}
@@ -160,6 +168,8 @@ func stageProviderAuth(gcHome string, env *helpers.Env, profile workerpkg.Profil
 		return stageCodexAuth(gcHome, env)
 	case workerpkg.ProfileGeminiTmuxCLI:
 		return stageGeminiAuth(gcHome, env)
+	case workerpkg.ProfileOpenCodeTmuxCLI:
+		return stageOpenCodeGeminiAuth(gcHome, env)
 	default:
 		return "", fmt.Errorf("unsupported worker-inference profile %q", profile)
 	}
@@ -386,6 +396,42 @@ func stageGeminiAuth(gcHome string, env *helpers.Env) (string, error) {
 	return "", fmt.Errorf("gemini auth unavailable: set GEMINI_API_KEY/GOOGLE_API_KEY or stage ~/.gemini oauth files")
 }
 
+func stageOpenCodeGeminiAuth(gcHome string, env *helpers.Env) (string, error) {
+	xdgData := filepath.Join(gcHome, ".local", "share")
+	xdgConfig := filepath.Join(gcHome, ".config")
+	xdgCache := filepath.Join(gcHome, ".cache")
+	xdgState := filepath.Join(gcHome, ".local", "state")
+	transcriptDir := filepath.Join(xdgData, "gascity", "opencode-transcripts")
+	for _, dir := range []string{xdgData, xdgConfig, xdgCache, xdgState, transcriptDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			return "", err
+		}
+	}
+	env.With("XDG_DATA_HOME", xdgData).
+		With("XDG_CONFIG_HOME", xdgConfig).
+		With("XDG_CACHE_HOME", xdgCache).
+		With("XDG_STATE_HOME", xdgState).
+		With("GC_OPENCODE_TRANSCRIPT_DIR", transcriptDir)
+
+	if apiKey := strings.TrimSpace(os.Getenv("GOOGLE_GENERATIVE_AI_API_KEY")); apiKey != "" {
+		env.With("GOOGLE_GENERATIVE_AI_API_KEY", apiKey)
+		return "env:GOOGLE_GENERATIVE_AI_API_KEY", nil
+	}
+	if apiKey := strings.TrimSpace(os.Getenv("GEMINI_API_KEY")); apiKey != "" {
+		env.With("GEMINI_API_KEY", apiKey)
+		return "env:GEMINI_API_KEY", nil
+	}
+	if apiKey := strings.TrimSpace(os.Getenv("GOOGLE_API_KEY")); apiKey != "" {
+		env.With("GOOGLE_API_KEY", apiKey).With("GEMINI_API_KEY", apiKey)
+		return "env:GOOGLE_API_KEY", nil
+	}
+	if authContent := strings.TrimSpace(os.Getenv("OPENCODE_AUTH_CONTENT")); authContent != "" {
+		env.With("OPENCODE_AUTH_CONTENT", authContent)
+		return "env:OPENCODE_AUTH_CONTENT", nil
+	}
+	return "", fmt.Errorf("opencode gemini auth unavailable: set GOOGLE_GENERATIVE_AI_API_KEY/GEMINI_API_KEY/GOOGLE_API_KEY or OPENCODE_AUTH_CONTENT")
+}
+
 func copySanitizedGeminiSettingsIfExists(src, dst string) error {
 	data, err := os.ReadFile(src)
 	if os.IsNotExist(err) {
diff --git a/test/acceptance/worker_inference/worker_handle_live_helpers_test.go b/test/acceptance/worker_inference/worker_handle_live_helpers_test.go
index 7f3de2252b..84a3a743a4 100644
--- a/test/acceptance/worker_inference/worker_handle_live_helpers_test.go
+++ b/test/acceptance/worker_inference/worker_handle_live_helpers_test.go
@@ -15,6 +15,8 @@ import (
 
 	"github.com/gastownhall/gascity/internal/beads"
 	"github.com/gastownhall/gascity/internal/config"
+	"github.com/gastownhall/gascity/internal/fsys"
+	"github.com/gastownhall/gascity/internal/hooks"
 	"github.com/gastownhall/gascity/internal/runtime"
 	runtimetmux "github.com/gastownhall/gascity/internal/runtime/tmux"
 	sessionpkg "github.com/gastownhall/gascity/internal/session"
@@ -82,6 +84,9 @@ func newLiveWorkerHandleHarness(t *testing.T) (*liveWorkerHandleHarness, error)
 	if err := writeWorkerHandleInstructions(root, resolved.InstructionsFile); err != nil {
 		return nil, err
 	}
+	if err := installLiveHandleProviderHooks(root, liveSetup.Profile); err != nil {
+		return nil, err
+	}
 
 	socketName := filepath.Base(root)
 	tmuxCfg := runtimetmux.DefaultConfig()
@@ -137,6 +142,15 @@ func newLiveWorkerHandleHarness(t *testing.T) (*liveWorkerHandleHarness, error)
 	return harness, nil
 }
 
+func installLiveHandleProviderHooks(workDir string, profile workerpkg.Profile) error {
+	switch profile {
+	case workerpkg.ProfileOpenCodeTmuxCLI:
+		return hooks.Install(fsys.OSFS{}, workDir, workDir, []string{"opencode"})
+	default:
+		return nil
+	}
+}
+
 func liveWorkerDebugf(format string, args ...any) {
 	if strings.TrimSpace(os.Getenv("GC_WORKER_HANDLE_DEBUG")) != "1" {
 		return
@@ -165,7 +179,8 @@ func resolveLiveHandleProvider() (*config.ResolvedProvider, error) {
 	}
 	return config.ResolveProvider(agent, workspace, map[string]config.ProviderSpec{
 		liveSetup.Provider: {
-			Command: liveSetup.BinaryPath,
+			Command:    liveSetup.BinaryPath,
+			ArgsAppend: liveProviderArgsAppend(),
 		},
 	}, exec.LookPath)
 }
@@ -273,20 +288,21 @@ func (h *liveWorkerHandleHarness) stop() (workerpkg.State, map[string]string, er
 func (h *liveWorkerHandleHarness) submitAndWaitForFile(prompt, outputRel string, delivery workerpkg.DeliveryIntent) (workerpkg.State, string, map[string]string, error) {
 	ctx := context.Background()
 	evidence := h.baseEvidence()
-	evidence["prompt"] = prompt
 	evidence["submit_delivery"] = string(delivery)
 	outputPath := filepath.Join(h.workDir, outputRel)
 	evidence["output_path"] = outputPath
+	actualPrompt := prompt + "\n\nWrite the requested output file at this exact path: " + outputPath
+	evidence["prompt"] = actualPrompt
 
 	result, err := h.handle.Message(ctx, workerpkg.MessageRequest{
-		Text:     prompt,
+		Text:     actualPrompt,
 		Delivery: delivery,
 	})
 	evidence["submit_queued"] = strconv.FormatBool(result.Queued)
 
 	state, stateErr := h.handle.State(ctx)
 	evidence = h.withStateEvidence(evidence, state, stateErr)
-	liveWorkerDebugf("submit-and-wait work_dir=%s delivery=%s phase=%s session_id=%s session_name=%s queued=%v err=%v state_err=%v prompt=%q", h.workDir, delivery, state.Phase, state.SessionID, state.SessionName, result.Queued, err, stateErr, prompt)
+	liveWorkerDebugf("submit-and-wait work_dir=%s delivery=%s phase=%s session_id=%s session_name=%s queued=%v err=%v state_err=%v prompt=%q", h.workDir, delivery, state.Phase, state.SessionID, state.SessionName, result.Queued, err, stateErr, actualPrompt)
 	if err != nil {
 		return state, "", h.withBlockedEvidence(evidence, state.SessionName), err
 	}
diff --git a/test/acceptance/worker_inference/worker_inference_test.go b/test/acceptance/worker_inference/worker_inference_test.go
index 9e12eb8955..d2311595d4 100644
--- a/test/acceptance/worker_inference/worker_inference_test.go
+++ b/test/acceptance/worker_inference/worker_inference_test.go
@@ -468,12 +468,6 @@ func TestWorkerInferenceFreshResetIsolation(t *testing.T) {
 	readyRel := fmt.Sprintf("worker-inference-reset-ready-%s.txt", liveSetup.Provider)
 	readyText := "ready"
 	alias := fmt.Sprintf("probe-reset-%s", liveSetup.Provider)
-	firstPrompt := fmt.Sprintf(
-		"Create a file named %s containing exactly %q and nothing else. Also remember this exact summary phrase for a later message: %q. Do not write that remembered phrase to any file right now.",
-		readyRel,
-		readyText,
-		phase1Profile.Continuation.AnchorText,
-	)
 
 	run, client, cityScope, spawnEvidence, err := startManagedInferenceSession(
 		t,
@@ -486,8 +480,14 @@ func TestWorkerInferenceFreshResetIsolation(t *testing.T) {
 		t.FailNow()
 	}
 
-	sessionInfo, statusOut, err := sendSessionMessageWhenReady(run.CityDir, run.SessionID, run.SessionName, client, firstPrompt)
 	readyPath := filepath.Join(run.CityDir, readyRel)
+	firstPrompt := fmt.Sprintf(
+		"Create a file at exactly %s containing exactly %q and nothing else. Also remember this exact summary phrase for a later message: %q. Do not write that remembered phrase to any file right now.",
+		readyPath,
+		readyText,
+		phase1Profile.Continuation.AnchorText,
+	)
+	sessionInfo, statusOut, err := sendSessionMessageWhenReady(run.CityDir, run.SessionID, run.SessionName, client, firstPrompt)
 	taskEvidence := map[string]string{
 		"city_dir":         run.CityDir,
 		"provider":         liveSetup.Provider,
@@ -602,13 +602,13 @@ func TestWorkerInferenceFreshResetIsolation(t *testing.T) {
 
 	proofRel := fmt.Sprintf("worker-inference-reset-proof-%s.txt", liveSetup.Provider)
 	expectedProof := phase1Profile.Continuation.ResetResponseContains
+	proofPath := filepath.Join(run.CityDir, proofRel)
 	proofPrompt := fmt.Sprintf(
-		"Without reading files or manually searching history, create a file named %s containing exactly the summary phrase from our earlier turn if you still know it. If you cannot do that because this is a fresh session, write exactly %q and nothing else.",
-		proofRel,
+		"Without reading files or manually searching history, create a file at exactly %s containing exactly the summary phrase from our earlier turn if you still know it. If you cannot do that because this is a fresh session, write exactly %q and nothing else.",
+		proofPath,
 		expectedProof,
 	)
 	sessionInfo, statusOut, err = sendSessionMessageWhenReady(run.CityDir, run.SessionID, resetSession.SessionName, client, proofPrompt)
-	proofPath := filepath.Join(run.CityDir, proofRel)
 	proofEvidence := map[string]string{
 		"city_dir":         run.CityDir,
 		"provider":         liveSetup.Provider,
@@ -1338,6 +1338,10 @@ func newLiveCity(t *testing.T) *helpers.City {
 }
 
 func installLiveProviderCommandOverride(cityDir, provider, command string, processNames []string) error {
+	return installLiveProviderCommandOverrideWithArgs(cityDir, provider, command, processNames, nil)
+}
+
+func installLiveProviderCommandOverrideWithArgs(cityDir, provider, command string, processNames, argsAppend []string) error {
 	provider = strings.TrimSpace(provider)
 	command = strings.TrimSpace(command)
 	if provider == "" || command == "" {
@@ -1373,6 +1377,19 @@ func installLiveProviderCommandOverride(cityDir, provider, command string, proce
 			fmt.Fprintf(&b, "process_names = [%s]\n", strings.Join(quoted, ", "))
 		}
 	}
+	if len(argsAppend) > 0 {
+		quoted := make([]string, 0, len(argsAppend))
+		for _, arg := range argsAppend {
+			arg = strings.TrimSpace(arg)
+			if arg == "" {
+				continue
+			}
+			quoted = append(quoted, strconv.Quote(arg))
+		}
+		if len(quoted) > 0 {
+			fmt.Fprintf(&b, "args_append = [%s]\n", strings.Join(quoted, ", "))
+		}
+	}
 	return os.WriteFile(cityPath, []byte(b.String()), 0o644)
 }
 
@@ -1880,7 +1897,7 @@ func startManagedInferenceSession(
 			"stage":    "install_agent",
 		}, fmt.Errorf("installing worker inference probe agent: %w", err)
 	}
-	if err := installLiveProviderCommandOverride(c.Dir, liveSetup.Provider, liveSetup.BinaryPath, liveSetup.ProcessNames); err != nil {
+	if err := installLiveProviderCommandOverrideWithArgs(c.Dir, liveSetup.Provider, liveSetup.BinaryPath, liveSetup.ProcessNames, liveProviderArgsAppend()); err != nil {
 		return inferenceSessionRun{}, nil, "", map[string]string{
 			"city_dir":    c.Dir,
 			"binary_path": liveSetup.BinaryPath,
@@ -1901,9 +1918,6 @@ func startManagedInferenceSession(
 			"stage":    "suspend_mayor",
 		}, fmt.Errorf("suspending default mayor session: %w", err)
 	}
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
-	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 	if err := closeLiveSessionsByTemplate(c.Dir, "mayor"); err != nil {
 		return inferenceSessionRun{}, nil, "", map[string]string{
 			"city_dir": c.Dir,
@@ -1924,6 +1938,9 @@ func startManagedInferenceSession(
 			"stage":    "close_template",
 		}, fmt.Errorf("closing stale %s sessions before managed session start: %w", templateName, err)
 	}
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
+	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 
 	startOut, startErr := runGCWithTimeout(liveBootstrapTimeout, liveEnv, c.Dir, "start", c.Dir)
 	startTimedOut := isRunTimeout(startErr)
@@ -2087,7 +2104,7 @@ func runFreshInitSlingWorkWithSetup(t *testing.T, provider, prompt, outputRel st
 			"init_out":    strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("installing worker inference probe agent: %w", err)
 	}
-	if err := installLiveProviderCommandOverride(c.Dir, liveSetup.Provider, liveSetup.BinaryPath, liveSetup.ProcessNames); err != nil {
+	if err := installLiveProviderCommandOverrideWithArgs(c.Dir, liveSetup.Provider, liveSetup.BinaryPath, liveSetup.ProcessNames, liveProviderArgsAppend()); err != nil {
 		return inferenceRun{}, map[string]string{
 			"city_dir":    c.Dir,
 			"binary_path": liveSetup.BinaryPath,
@@ -2116,9 +2133,6 @@ func runFreshInitSlingWorkWithSetup(t *testing.T, provider, prompt, outputRel st
 			"init_out":     strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("suspending default mayor session: %w", err)
 	}
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
-	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 	if err := closeLiveSessionsByTemplate(c.Dir, "mayor"); err != nil {
 		return inferenceRun{}, map[string]string{
 			"city_dir":     c.Dir,
@@ -2139,6 +2153,9 @@ func runFreshInitSlingWorkWithSetup(t *testing.T, provider, prompt, outputRel st
 			"init_out":     strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("closing stale %s sessions before live start: %w", inferenceSlingTarget, err)
 	}
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
+	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 
 	startOut, startErr := runGCWithTimeout(liveBootstrapTimeout, liveEnv, c.Dir, "start", c.Dir)
 	startTimedOut := isRunTimeout(startErr)
@@ -2388,6 +2405,21 @@ func freshWorkerNudgeDelivery(provider string) string {
 	return "wait-idle"
 }
 
+func liveProviderArgsAppend() []string {
+	if liveSetup.Profile != workerpkg.ProfileOpenCodeTmuxCLI {
+		return nil
+	}
+	return []string{"--model", liveOpenCodeModel()}
+}
+
+func liveOpenCodeModel() string {
+	model := strings.TrimSpace(os.Getenv("GC_WORKER_INFERENCE_OPENCODE_MODEL"))
+	if model == "" {
+		return defaultOpenCodeGeminiModel
+	}
+	return model
+}
+
 func runFreshManualSessionTurn(t *testing.T, provider, templateName, alias, prompt, outputRel string) (inferenceSessionRun, map[string]string, map[string]string, string, error) {
 	t.Helper()
 
@@ -2428,7 +2460,7 @@ func runFreshManualSessionTurn(t *testing.T, provider, templateName, alias, prom
 			"init_out":   strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("installing worker inference probe agent: %w", err)
 	}
-	if err := installLiveProviderCommandOverride(c.Dir, liveSetup.Provider, liveSetup.BinaryPath, liveSetup.ProcessNames); err != nil {
+	if err := installLiveProviderCommandOverrideWithArgs(c.Dir, liveSetup.Provider, liveSetup.BinaryPath, liveSetup.ProcessNames, liveProviderArgsAppend()); err != nil {
 		return inferenceSessionRun{}, map[string]string{
 			"city_dir":    c.Dir,
 			"binary_path": liveSetup.BinaryPath,
@@ -2450,9 +2482,6 @@ func runFreshManualSessionTurn(t *testing.T, provider, templateName, alias, prom
 			"init_out":    strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("suspending default mayor session: %w", err)
 	}
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
-	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 	if err := closeLiveSessionsByTemplate(c.Dir, "mayor"); err != nil {
 		return inferenceSessionRun{}, map[string]string{
 			"city_dir":    c.Dir,
@@ -2475,6 +2504,9 @@ func runFreshManualSessionTurn(t *testing.T, provider, templateName, alias, prom
 			"init_out":    strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("closing stale %s sessions before manual session start: %w", templateName, err)
 	}
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
+	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 
 	newOut, newErr := runGCWithTimeout(90*time.Second, liveEnv, c.Dir, "session", "new", templateName, "--alias", alias, "--no-attach")
 	sessionID := parseCreatedSessionID(newOut)
@@ -2755,9 +2787,6 @@ func runFreshNamedSessionTurn(t *testing.T, provider, identity, prompt, outputRe
 			"init_out":   strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("suspending default mayor session: %w", err)
 	}
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
-	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
-	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 	if err := closeLiveSessionsByTemplate(c.Dir, "mayor"); err != nil {
 		return inferenceSessionRun{}, map[string]string{
 			"city_dir":   c.Dir,
@@ -2767,6 +2796,9 @@ func runFreshNamedSessionTurn(t *testing.T, provider, identity, prompt, outputRe
 			"init_out":   strings.TrimSpace(initOut),
 		}, nil, "spawn", fmt.Errorf("closing stale mayor sessions before live start: %w", err)
 	}
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, "", "supervisor", "stop")
+	_, _ = runGCWithTimeout(liveShutdownTimeout, liveEnv, c.Dir, "stop", c.Dir)
+	_, _ = waitForManagedDoltStopped(c.Dir, liveStopBarrierTimeout)
 
 	startOut, startErr := runGCWithTimeout(liveBootstrapTimeout, liveEnv, c.Dir, "start", c.Dir)
 	startTimedOut := isRunTimeout(startErr)
@@ -3086,13 +3118,17 @@ When a later message asks you to recall prior turn context, use conversation mem
 	}
 	var additions []string
 	if !strings.Contains(string(data), "\nname = \""+inferenceProbeTemplate+"\"") {
+		sessionLine, err := inferenceProbeSessionLine(data)
+		if err != nil {
+			return err
+		}
 		additions = append(additions, fmt.Sprintf(`
 
 [[agent]]
 name = %q
-prompt_template = %q
+%sprompt_template = %q
 max_active_sessions = %d
-`, inferenceProbeTemplate, inferenceProbePromptPath, maxActiveSessions))
+`, inferenceProbeTemplate, sessionLine, inferenceProbePromptPath, maxActiveSessions))
 	}
 	if includeNamedSession && !strings.Contains(string(data), "\n[[named_session]]\ntemplate = \""+inferenceProbeTemplate+"\"") {
 		additions = append(additions, fmt.Sprintf(`
@@ -3122,21 +3158,33 @@ skip = [%s]
 	return os.WriteFile(cityPath, append(data, []byte(strings.Join(additions, ""))...), 0o644)
 }
 
+func inferenceProbeSessionLine(data []byte) (string, error) {
+	cfg, err := config.Parse(data)
+	if err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(cfg.Workspace.Provider) == "opencode" {
+		return `session = "tmux"` + "\n", nil
+	}
+	return "", nil
+}
+
 func ensureInferenceProbeProviderHooks(data []byte) ([]byte, bool, error) {
 	cfg, err := config.Parse(data)
 	if err != nil {
 		return nil, false, err
 	}
-	if strings.TrimSpace(cfg.Workspace.Provider) != "gemini" {
+	provider := strings.TrimSpace(cfg.Workspace.Provider)
+	if provider != "gemini" && provider != "opencode" {
 		return data, false, nil
 	}
-	if stringListContains(cfg.Workspace.InstallAgentHooks, "gemini") {
+	if stringListContains(cfg.Workspace.InstallAgentHooks, provider) {
 		return data, false, nil
 	}
 	if len(cfg.Workspace.InstallAgentHooks) > 0 {
-		return nil, false, fmt.Errorf("workspace install_agent_hooks must include gemini for live Gemini worker inference tests")
+		return nil, false, fmt.Errorf("workspace install_agent_hooks must include %s for live %s worker inference tests", provider, provider)
 	}
-	updated, err := insertWorkspaceSetting(data, `install_agent_hooks = ["gemini"]`)
+	updated, err := insertWorkspaceSetting(data, fmt.Sprintf(`install_agent_hooks = [%q]`, provider))
 	if err != nil {
 		return nil, false, err
 	}
@@ -4436,6 +4484,7 @@ func classifyLiveFailure(detail string, evidence map[string]string) workertest.R
 		"rate limited",
 		"rate_limit",
 		"too many requests",
+		"too hot",
 		"try again later",
 		"temporarily unavailable",
 		"service unavailable",
@@ -5195,6 +5244,7 @@ func classifyLivePaneBlocked(paneTail string) *liveBlockedInteraction {
 		"approaching rate limits",
 		"usage limit reached",
 		"rate limit",
+		"too hot",
 	):
 		return &liveBlockedInteraction{
 			Kind:     "rate_limit",
diff --git a/test/agents/graph-dispatch.sh b/test/agents/graph-dispatch.sh
index fa10cdde25..04bf553223 100755
--- a/test/agents/graph-dispatch.sh
+++ b/test/agents/graph-dispatch.sh
@@ -27,6 +27,19 @@ trace() {
     printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" >> "$TRACE_FILE"
 }
 
+if ! command -v timeout >/dev/null 2>&1; then
+    if command -v gtimeout >/dev/null 2>&1; then
+        timeout() {
+            gtimeout "$@"
+        }
+    else
+        timeout() {
+            shift
+            "$@"
+        }
+    fi
+fi
+
 current_port_file() {
     if [ -f "$GC_CITY/.beads/dolt-server.port" ]; then
         tr -d '\n' < "$GC_CITY/.beads/dolt-server.port"
@@ -69,7 +82,7 @@ ref_matches_suffix_list() {
     for suffix in "${suffixes[@]}"; do
         suffix=$(trim_spaces "$suffix")
         [ -n "$suffix" ] || continue
-        if [[ "$ref" == *"$suffix"* ]]; then
+        if [[ "$ref" == *"$suffix" ]]; then
             return 0
         fi
     done
@@ -472,6 +485,46 @@ while true; do
     trace "run bead=$bead_id ref=$ref kind=$kind source=$source_id work_dir=$work_dir"
     trace_store
 
+    # Abort-propagation defense for TestGraphWorkflowFailureRunsCleanup.
+    # Without this, a worker that picked up .implement or .submit after
+    # preflight closed with fail, but before the controller's
+    # skipOpenScopeMembers pass ran, could race the controller:
+    #   1. Outcome race: worker closes a skipped step with pass before the
+    #      controller's skip lands. bd allows overwrites on closed beads,
+    #      so whoever writes last wins.
+    #   2. Side-effect race: .submit mutates the source issue before this
+    #      worker notices the abort.
+    #   3. Report race: worker writes the ref to REPORT_FILE between its
+    #      own outcome check and close.
+    # Defense: detect any sibling hard failure in the same workflow before
+    # step side effects and close this bead as skipped.
+    # Scoped to gc.failure_class="hard" so retry-flavor transient failures
+    # (which the controller DOESN'T use to skip siblings) don't trigger
+    # false positives. Teardown beads must still run after body failure.
+    sibling_hard_fail="false"
+    if [ "$kind" != "cleanup" ] && [ -n "$root_id" ]; then
+        if sibling_json=$(timeout 10 bd list --all --limit=0 --json 2>/dev/null); then
+            if printf '%s\n' "$sibling_json" | json_payload | jq -e \
+                --arg root "$root_id" --arg self "$bead_id" '
+                    if type == "array" then
+                        any(.[]?; (.metadata // {})["gc.root_bead_id"] == $root
+                                    and .id != $self
+                                    and .status == "closed"
+                                    and (.metadata // {})["gc.outcome"] == "fail"
+                                    and (.metadata // {})["gc.failure_class"] == "hard")
+                    else false
+                    end' >/dev/null 2>&1; then
+                sibling_hard_fail="true"
+            fi
+        fi
+    fi
+    if [ "$sibling_hard_fail" = "true" ] && [[ "$ref" != *.cleanup-worktree* ]]; then
+        trace "skip-sibling-hard-fail bead=$bead_id ref=$ref root=$root_id (sibling has outcome=fail class=hard; closing self as skipped)"
+        bd update "$bead_id" --set-metadata "gc.outcome=skipped" --status closed 2>/dev/null || \
+            trace "skip-close-failed bead=$bead_id ref=$ref"
+        continue
+    fi
+
     case "$ref" in
         *.workspace-setup*)
             if [ -z "$work_dir" ]; then
@@ -560,46 +613,6 @@ while true; do
         continue
     fi
 
-    # Abort-propagation defense for TestGraphWorkflowFailureRunsCleanup.
-    # Without this, a worker that picked up .implement after preflight
-    # closed with fail — but before the controller's skipOpenScopeMembers
-    # pass ran — could race the controller in two ways:
-    #   1. Outcome race: worker closes .implement with pass before the
-    #      controller's skip lands. bd allows overwrites on closed beads,
-    #      so whoever writes last wins.
-    #   2. Report race: worker writes .implement to REPORT_FILE between
-    #      its own outcome check and the close.
-    # Defense: detect any sibling hard failure in the same workflow and
-    # close this bead as skipped ourselves instead of closing with pass.
-    # Scoped to gc.failure_class="hard" so retry-flavor transient
-    # failures (which the controller DOESN'T use to skip siblings) don't
-    # trigger false positives.
-    # Teardown beads must still run after body failure; only body members get
-    # the sibling-hard-fail short-circuit.
-    sibling_hard_fail="false"
-    if [ "$kind" != "cleanup" ] && [ -n "$root_id" ]; then
-        if sibling_json=$(timeout 10 bd list --all --limit=0 --json 2>/dev/null); then
-            if printf '%s\n' "$sibling_json" | json_payload | jq -e \
-                --arg root "$root_id" --arg self "$bead_id" '
-                    if type == "array" then
-                        any(.[]?; (.metadata // {})["gc.root_bead_id"] == $root
-                                    and .id != $self
-                                    and .status == "closed"
-                                    and (.metadata // {})["gc.outcome"] == "fail"
-                                    and (.metadata // {})["gc.failure_class"] == "hard")
-                    else false
-                    end' >/dev/null 2>&1; then
-                sibling_hard_fail="true"
-            fi
-        fi
-    fi
-    if [ "$sibling_hard_fail" = "true" ] && [[ "$ref" != *.cleanup-worktree* ]]; then
-        trace "skip-sibling-hard-fail bead=$bead_id ref=$ref root=$root_id (sibling has outcome=fail class=hard; closing self as skipped)"
-        bd update "$bead_id" --set-metadata "gc.outcome=skipped" --status closed 2>/dev/null || \
-            trace "skip-close-failed bead=$bead_id ref=$ref"
-        continue
-    fi
-
     printf '%s\n' "$ref" >> "$REPORT_FILE"
     trace "close bead=$bead_id ref=$ref"
     trace_store
diff --git a/test/docsync/docsync_test.go b/test/docsync/docsync_test.go
index ed95763898..cf435a2a42 100644
--- a/test/docsync/docsync_test.go
+++ b/test/docsync/docsync_test.go
@@ -30,12 +30,12 @@ var markdownLinkRE = regexp.MustCompile(`\[[^][]+\]\(([^)]+)\)`)
 // and should be link-checked. Update this list when adding or removing doc
 // directories. TestDocDirCoverage will fail if a new directory with markdown
 // appears that is not accounted for here or in docTreeIgnored.
-var docTreeDirs = []string{"contrib", "docs", "engdocs", "specs"}
+var docTreeDirs = []string{"contrib", "docs", "engdocs", "release-gates"}
 
 // docTreeIgnored lists directories that contain markdown but are not
 // documentation trees (e.g., embedded prompt templates, test fixtures,
 // gitignored scratch space for local work).
-var docTreeIgnored = []string{"cmd", "examples", "internal", "plans", "scripts", "test", "tmp"}
+var docTreeIgnored = []string{"cmd", "examples", "internal", "plans", "release-gates", "scripts", "test", "tmp"}
 
 // knownBrokenLinks lists links to docs that do not exist yet. These are
 // excluded from TestLocalMarkdownLinks failures but still logged. Remove
@@ -570,7 +570,7 @@ func TestNoKnownStaleDocReferences(t *testing.T) {
 		"agent.NewFake",
 		"session.Fake",
 		"agent.Fake",
-		"internal/dolt",
+		"internal/dolt/",
 	}
 
 	var hits []string
diff --git a/test/integration/E2E-PROVIDER-GAPS.md b/test/integration/E2E-PROVIDER-GAPS.md
index c7fccac4d7..14b805c879 100644
--- a/test/integration/E2E-PROVIDER-GAPS.md
+++ b/test/integration/E2E-PROVIDER-GAPS.md
@@ -146,15 +146,15 @@ minutes — far beyond the 10-minute test timeout.
 
 ---
 
-### RC-3: Agent lifecycle events not emitted with exec provider (MEDIUM)
+### RC-3: Session lifecycle events not emitted with exec provider (MEDIUM)
 
 **Impact:** 1 Docker failure (TestE2E_AgentLifecycleEvents)
 
-`gc events --type agent.started` returns empty output after `gc start`.
+`gc events --type session.woke` returns empty output after `gc start`.
 The events may only be emitted by the controller loop (not one-shot
 start), or the exec provider path in `doStart` may skip event recording.
 
-**Investigation needed:** Check if `doStart` records agent.started events
+**Investigation needed:** Check if `doStart` records `session.woke` events
 for exec session providers. The one-shot path may return before events
 are flushed.
 
@@ -271,7 +271,7 @@ Remaining failures would be:
    Use `-timeout 120m` for K8s runs, or create a K8s-specific test
    subset.
 
-4. **[P2] Investigate agent.started event emission for exec providers**
+4. **[P2] Investigate `session.woke` event emission for exec providers**
    May need to record events in the one-shot `doStart` path.
 
 5. **[P2] Consider test parallelization**
diff --git a/test/integration/e2e_comm_test.go b/test/integration/e2e_comm_test.go
index 85440d8c62..0d8a4b611e 100644
--- a/test/integration/e2e_comm_test.go
+++ b/test/integration/e2e_comm_test.go
@@ -203,20 +203,27 @@ func TestE2E_ConfigDrift(t *testing.T) {
 		t.Fatalf("initial CUSTOM_VERSION: got %v, want [v1]", report.getAll("CUSTOM_VERSION"))
 	}
 
+	// Remove old report so we can detect a new one.
+	reportPath := strings.ReplaceAll("drifter", "/", "__")
+	reportDir := cityDir + "/.gc-reports"
+	_ = removeFile(reportDir + "/" + reportPath + ".report")
+
 	// Change config by mutating the fingerprinted start_command. Custom env
 	// keys are intentionally ignored by the runtime fingerprint, so changing
 	// Env alone should not imply restart.
 	city.Agents[0].StartCommand = "CUSTOM_VERSION=v2 " + e2eReportScript()
 	rewriteE2ETomlPreservingNamedSessions(t, cityDir, city)
 
-	// Remove old report so we can detect a new one.
-	reportPath := strings.ReplaceAll("drifter", "/", "__")
-	reportDir := cityDir + "/.gc-reports"
-	_ = removeFile(reportDir + "/" + reportPath + ".report")
+	out, err := gc(cityDir, "reload", "--timeout", "45s")
+	if err != nil {
+		t.Fatalf("gc reload after config drift failed: %v\noutput: %s", err, out)
+	}
 
-	// The controller is already running. Writing city.toml should trigger a
-	// config reload and reconcile via the watcher/patrol loop.
-	report2 := waitForReport(t, cityDir, "drifter", e2eDefaultTimeout())
+	// The controller is already running. Reloading city.toml should reconcile
+	// and restart the drifted session. Named sessions can defer config drift
+	// while recent activity cannot be ruled out, so allow the bounded deferral
+	// window to expire on slower providers.
+	report2 := waitForReport(t, cityDir, "drifter", 3*time.Minute)
 	if !report2.has("CUSTOM_VERSION", "v2") {
 		t.Errorf("post-drift CUSTOM_VERSION: got %v, want [v2]", report2.getAll("CUSTOM_VERSION"))
 	}
diff --git a/test/integration/e2e_helpers_test.go b/test/integration/e2e_helpers_test.go
index 55f24f2432..243a24a3b7 100644
--- a/test/integration/e2e_helpers_test.go
+++ b/test/integration/e2e_helpers_test.go
@@ -116,12 +116,39 @@ func (r *e2eReport) has(key, value string) bool {
 	return false
 }
 
+func (r *e2eReport) hasPath(t *testing.T, key, value string) bool {
+	t.Helper()
+	for _, v := range r.Values[key] {
+		if sameE2EPath(t, v, value) {
+			return true
+		}
+	}
+	return false
+}
+
 // hasKey returns true if the key is present in the report.
 func (r *e2eReport) hasKey(key string) bool {
 	_, ok := r.Values[key]
 	return ok
 }
 
+func sameE2EPath(t *testing.T, got, want string) bool {
+	t.Helper()
+	return normalizeE2EPath(t, got) == normalizeE2EPath(t, want)
+}
+
+func normalizeE2EPath(t *testing.T, path string) string {
+	t.Helper()
+	if path == "" {
+		return path
+	}
+	resolved, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		return path
+	}
+	return resolved
+}
+
 // renderE2EToml generates a full single-file template for gc init --file.
 func renderE2EToml(city e2eCity) string {
 	var b strings.Builder
@@ -453,6 +480,9 @@ func setupE2ECityNoStart(t *testing.T, city e2eCity) string {
 	if err != nil {
 		t.Fatalf("gc stop after init failed: %v\noutput: %s", err, out)
 	}
+	if err := os.RemoveAll(filepath.Join(cityDir, ".gc-reports")); err != nil {
+		t.Fatalf("removing stale reports after init stop: %v", err)
+	}
 	restartIsolatedSupervisor(t, env)
 
 	t.Cleanup(func() {
diff --git a/test/integration/e2e_hook_test.go b/test/integration/e2e_hook_test.go
index ab1f10d83f..a026ca877d 100644
--- a/test/integration/e2e_hook_test.go
+++ b/test/integration/e2e_hook_test.go
@@ -3,6 +3,8 @@
 package integration
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -51,29 +53,62 @@ func TestE2E_Hook_WithWork(t *testing.T) {
 	}
 }
 
-// TestE2E_Hook_Inject verifies that gc hook --inject wraps output in
-// system-reminder tags and always exits 0.
+// TestE2E_Hook_Inject verifies that gc hook --inject is silent legacy
+// compatibility and does not run the configured work query.
 func TestE2E_Hook_Inject(t *testing.T) {
+	const markerName = "inject-work-query-ran"
+	const armEnv = "GC_E2E_HOOK_INJECT_ARM"
+	armValue := uniqueCityName()
 	city := e2eCity{
 		Agents: []e2eAgent{
 			{
 				Name:         "injectee",
 				StartCommand: e2eSleepScript(),
-				WorkQuery:    "echo 'inject hook work items'",
+				WorkQuery:    "if [ \"${" + armEnv + ":-}\" = \"" + armValue + "\" ]; then touch .gc/" + markerName + " && echo 'inject hook work items'; fi",
 			},
 		},
 	}
-	cityDir := setupE2ECity(t, nil, city)
+	cityDir := setupE2ECityNoStart(t, city)
+	markerPath := filepath.Join(cityDir, ".gc", markerName)
+	if _, err := os.Stat(markerPath); err == nil {
+		t.Fatalf("work_query marker exists before gc hook --inject: %s", markerPath)
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("checking pre-hook work_query marker: %v", err)
+	}
 
-	// Hook with --inject should wrap in system-reminder.
-	out, err := gc(cityDir, "hook", "--inject", "injectee")
+	env := commandEnvForDir(cityDir, false)
+	env = append(env, armEnv+"="+armValue)
+	out, err := runGCWithEnv(env, cityDir, "hook", "--inject", "injectee")
 	if err != nil {
 		t.Fatalf("gc hook --inject should exit 0: %v\noutput: %s", err, out)
 	}
-	if !strings.Contains(out, "<system-reminder>") {
-		t.Errorf("expected <system-reminder> in inject output:\n%s", out)
+	if strings.TrimSpace(out) != "" {
+		t.Errorf("gc hook --inject should be silent, got:\n%s", out)
+	}
+
+	if _, err := os.Stat(markerPath); err == nil {
+		t.Fatalf("gc hook --inject ran work_query; marker exists at %s", markerPath)
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("checking work_query marker: %v", err)
+	}
+
+	hookEnv := filterEnvMany(commandEnvForDir(cityDir, false),
+		"GC_RIG",
+		"GC_RIG_ROOT",
+		"GC_CITY",
+		"GC_CITY_PATH",
+		"GC_CITY_ROOT",
+		"GC_CITY_RUNTIME_DIR",
+	)
+	hookEnv = append(hookEnv, armEnv+"="+armValue)
+	out, err = runGCWithEnv(hookEnv, cityDir, "hook", "injectee")
+	if err != nil {
+		t.Fatalf("gc hook should run armed work_query: %v\noutput: %s", err, out)
 	}
 	if !strings.Contains(out, "inject hook work items") {
-		t.Errorf("expected work items in inject output:\n%s", out)
+		t.Fatalf("gc hook output missing armed work query result:\n%s", out)
+	}
+	if _, err := os.Stat(markerPath); err != nil {
+		t.Fatalf("normal gc hook did not create work_query marker: %v", err)
 	}
 }
diff --git a/test/integration/e2e_pool_test.go b/test/integration/e2e_pool_test.go
index aa0279d0ce..ffacd3148c 100644
--- a/test/integration/e2e_pool_test.go
+++ b/test/integration/e2e_pool_test.go
@@ -75,10 +75,10 @@ func TestE2E_Pool_WithDir(t *testing.T) {
 	wantDir := filepath.Join(cityDir, "workdir")
 
 	// Both instances share the same workdir (no template expansion).
-	if cwd := r1.get("CWD"); cwd != wantDir {
+	if cwd := r1.get("CWD"); !sameE2EPath(t, cwd, wantDir) {
 		t.Errorf("dirpool-1 CWD = %q, want %q", cwd, wantDir)
 	}
-	if cwd := r2.get("CWD"); cwd != wantDir {
+	if cwd := r2.get("CWD"); !sameE2EPath(t, cwd, wantDir) {
 		t.Errorf("dirpool-2 CWD = %q, want %q", cwd, wantDir)
 	}
 }
diff --git a/test/integration/e2e_test.go b/test/integration/e2e_test.go
index 86da845e6b..9f4200b44c 100644
--- a/test/integration/e2e_test.go
+++ b/test/integration/e2e_test.go
@@ -27,7 +27,7 @@ func TestE2E_EnvVars_CityScoped(t *testing.T) {
 	}
 
 	// GC_CITY must be the city directory.
-	if !report.has("GC_CITY", cityDir) {
+	if !report.hasPath(t, "GC_CITY", cityDir) {
 		t.Errorf("GC_CITY: got %v, want [%s]", report.getAll("GC_CITY"), cityDir)
 	}
 
@@ -79,7 +79,7 @@ func TestE2E_Dir_Default(t *testing.T) {
 	report := waitForReport(t, cityDir, "nodir", e2eDefaultTimeout())
 
 	cwd := report.get("CWD")
-	if cwd != cityDir {
+	if !sameE2EPath(t, cwd, cityDir) {
 		t.Errorf("CWD = %q, want %q (city directory)", cwd, cityDir)
 	}
 }
@@ -102,7 +102,7 @@ func TestE2E_Dir_Relative(t *testing.T) {
 
 	want := filepath.Join(cityDir, "work", "agent")
 	cwd := report.get("CWD")
-	if cwd != want {
+	if !sameE2EPath(t, cwd, want) {
 		t.Errorf("CWD = %q, want %q", cwd, want)
 	}
 }
@@ -125,11 +125,11 @@ func TestE2E_Dir_GC_DIR(t *testing.T) {
 
 	want := filepath.Join(cityDir, "subdir")
 	gcDir := report.get("GC_DIR")
-	if gcDir != want {
+	if !sameE2EPath(t, gcDir, want) {
 		t.Errorf("GC_DIR = %q, want %q", gcDir, want)
 	}
 	// GC_CITY should still be the city root.
-	if !report.has("GC_CITY", cityDir) {
+	if !report.hasPath(t, "GC_CITY", cityDir) {
 		t.Errorf("GC_CITY = %v, want [%s]", report.getAll("GC_CITY"), cityDir)
 	}
 }
@@ -168,6 +168,26 @@ func TestE2E_Overlay(t *testing.T) {
 	}
 }
 
+func TestE2E_NoStartClearsReportsFromInit(t *testing.T) {
+	city := e2eCity{
+		Agents: []e2eAgent{
+			{Name: "nostart-report", StartCommand: e2eReportScript()},
+		},
+	}
+	cityDir := setupE2ECityNoStart(t, city)
+	reportDir := filepath.Join(cityDir, ".gc-reports")
+	entries, err := os.ReadDir(reportDir)
+	if os.IsNotExist(err) {
+		return
+	}
+	if err != nil {
+		t.Fatalf("reading report dir: %v", err)
+	}
+	if len(entries) > 0 {
+		t.Fatalf("setupE2ECityNoStart left stale report files: %v", entries)
+	}
+}
+
 // TestE2E_Hooks_Gemini verifies that install_agent_hooks=["gemini"] creates
 // .gemini/settings.json in the workdir.
 func TestE2E_Hooks_Gemini(t *testing.T) {
diff --git a/test/integration/gastown_helpers_test.go b/test/integration/gastown_helpers_test.go
index 054e70f6ff..da98825f3a 100644
--- a/test/integration/gastown_helpers_test.go
+++ b/test/integration/gastown_helpers_test.go
@@ -230,16 +230,86 @@ func tailText(s string, maxLines int) string {
 // city.toml configuration.
 func initBd(t *testing.T, dir string) string {
 	t.Helper()
+	env := standaloneBdEnv(t, dir)
+
+	if _, err := os.Stat(filepath.Join(dir, ".git")); err != nil {
+		if !os.IsNotExist(err) {
+			t.Fatalf("stat %s/.git: %v", dir, err)
+		}
+		gitCmd := exec.Command("git", "init", "--quiet")
+		gitCmd.Dir = dir
+		gitCmd.Env = env
+		if out, err := gitCmd.CombinedOutput(); err != nil {
+			t.Fatalf("git init in %s failed: %v\noutput: %s", dir, err, out)
+		}
+	}
+
 	prefix := uniqueCityName()
-	cmd := exec.Command(bdBinary, "init", "-p", prefix, "--skip-hooks", "-q")
+	cmd := exec.Command(bdBinary, "init", "-p", prefix, "--skip-hooks", "--skip-agents", "-q")
 	cmd.Dir = dir
-	cmd.Env = os.Environ()
+	cmd.Env = env
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("bd init in %s failed: %v\noutput: %s", dir, err, out)
 	}
+	registerCityCommandEnv(dir, env)
+	t.Cleanup(func() { unregisterCityCommandEnv(dir) })
 	return prefix
 }
 
+func standaloneBdEnv(t *testing.T, dir string) []string {
+	t.Helper()
+
+	env := newIsolatedToolEnv(t, false)
+	env = filterEnvMany(env,
+		"GC_CITY",
+		"GC_CITY_PATH",
+		"GC_CITY_ROOT",
+		"GC_CITY_RUNTIME_DIR",
+		"GC_RIG",
+		"GC_RIG_ROOT",
+		"GC_BEADS",
+		"GC_BEADS_SCOPE_ROOT",
+		"GC_DOLT",
+		"GC_DOLT_HOST",
+		"GC_DOLT_PORT",
+		"GC_DOLT_USER",
+		"GC_DOLT_PASSWORD",
+		"BEADS_DIR",
+		"BEADS_DOLT_AUTO_START",
+		"BEADS_DOLT_SERVER_HOST",
+		"BEADS_DOLT_SERVER_PORT",
+		"BEADS_DOLT_SERVER_USER",
+		"BEADS_DOLT_PASSWORD",
+	)
+	if gcHome := parseEnvList(env)["GC_HOME"]; gcHome != "" {
+		env = replaceEnv(env, "HOME", gcHome)
+	}
+	env = replaceEnv(env, "BD_NON_INTERACTIVE", "1")
+	env = append(env, "BEADS_DIR="+filepath.Join(dir, ".beads"))
+	return env
+}
+
+func bdStandalone(t testing.TB, dir string, args ...string) (string, error) {
+	t.Helper()
+	return runCommand(dir, standaloneBDEnvForDir(dir), integrationBDCommandTimeout, bdBinary, args...)
+}
+
+func TestInitBdAllowsStandaloneCreate(t *testing.T) {
+	requireDoltIntegration(t)
+
+	dir := t.TempDir()
+	prefix := initBd(t, dir)
+
+	out, err := bd(dir, "create", "standalone bead")
+	if err != nil {
+		t.Fatalf("bd create failed: %v\noutput: %s", err, out)
+	}
+	beadID := extractBeadID(t, out)
+	if !strings.HasPrefix(beadID, prefix) {
+		t.Fatalf("bead ID %q should start with prefix %q", beadID, prefix)
+	}
+}
+
 // createBead creates a bead and returns its ID.
 func createBead(t *testing.T, cityDir, title string) string {
 	t.Helper()
diff --git a/test/integration/gastown_multirig_test.go b/test/integration/gastown_multirig_test.go
index 56a82b7e93..8bc2320168 100644
--- a/test/integration/gastown_multirig_test.go
+++ b/test/integration/gastown_multirig_test.go
@@ -87,10 +87,14 @@ func setupMultiRigCity(t *testing.T, rigCount int) (cityDir string, rigDirs []st
 	for i := 0; i < rigCount; i++ {
 		rigDirs[i] = filepath.Join(t.TempDir(), fmt.Sprintf("rig-%d", i))
 		require.NoError(t, os.MkdirAll(rigDirs[i], 0o755))
+		registerCityCommandEnv(rigDirs[i], env)
 	}
 
 	t.Cleanup(func() {
 		unregisterCityCommandEnv(cityDir)
+		for _, rigDir := range rigDirs {
+			unregisterCityCommandEnv(rigDir)
+		}
 		runGCWithEnv(env, "", "stop", cityDir)                //nolint:errcheck // best-effort cleanup
 		runGCWithEnv(env, "", "supervisor", "stop", "--wait") //nolint:errcheck // best-effort cleanup
 		deadline := time.Now().Add(10 * time.Second)
@@ -157,6 +161,57 @@ func writeMultiRigToml(t *testing.T, cityDir, cityName string, rigDirs []string,
 	require.NoError(t, os.WriteFile(tomlPath, []byte(b.String()), 0o644))
 }
 
+func installFakeBDForCity(t *testing.T, cityDir string) {
+	t.Helper()
+
+	shimDir := t.TempDir()
+	script := filepath.Join(shimDir, "bd")
+	content := `#!/bin/sh
+set -eu
+store="${BEADS_DIR:?}/fake-beads"
+mkdir -p "$store"
+case "${1:-}" in
+  create)
+    title="${2:?missing title}"
+    id="${GC_BEADS_PREFIX:-bd}-fake"
+    printf '%s' "$title" > "$store/$id"
+    printf 'Created issue: %s\n' "$id"
+    ;;
+  show)
+    id="${2:?missing id}"
+    if [ ! -f "$store/$id" ]; then
+      printf 'Error: issue not found: %s\n' "$id" >&2
+      exit 1
+    fi
+    printf 'ID: %s\n' "$id"
+    printf 'Title: %s\n' "$(cat "$store/$id")"
+    ;;
+  *)
+    printf 'unsupported fake bd command: %s\n' "$*" >&2
+    exit 2
+    ;;
+esac
+`
+	require.NoError(t, os.WriteFile(script, []byte(content), 0o755))
+
+	loaded, ok := cityCommandEnv.Load(cityDir)
+	require.True(t, ok, "city command env should be registered for %s", cityDir)
+	env := append([]string(nil), loaded.([]string)...)
+	envMap := parseEnvList(env)
+	env = replaceEnv(env, "PATH", prependPath(shimDir, envMap["PATH"]))
+	registerCityCommandEnv(cityDir, env)
+}
+
+func seedConfiguredFakeBDWorkspace(t *testing.T, dir, prefix string) {
+	t.Helper()
+
+	beadsDir := filepath.Join(dir, ".beads")
+	require.NoError(t, os.MkdirAll(beadsDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(beadsDir, "config.yaml"), []byte("issue_prefix: "+prefix+"\n"), 0o644))
+	metadata := fmt.Sprintf(`{"database":"dolt","backend":"dolt","dolt_mode":"server","dolt_database":%q}`+"\n", prefix)
+	require.NoError(t, os.WriteFile(filepath.Join(beadsDir, "metadata.json"), []byte(metadata), 0o644))
+}
+
 // TestGastown_MultiRig_ConfigLoads creates a city with 2 rigs and verifies
 // that gc config show reports both rigs.
 func TestGastown_MultiRig_ConfigLoads(t *testing.T) {
@@ -269,14 +324,18 @@ func TestGastown_MultiRig_BeadIsolation(t *testing.T) {
 		{Name: "worker", StartCommand: "sleep 3600"},
 	}
 	writeMultiRigToml(t, cityDir, cityName, rigDirs, agents)
-
-	// Initialize beads in each rig directory with unique prefixes.
-	prefix0 := initBd(t, rigDirs[0])
-	prefix1 := initBd(t, rigDirs[1])
+	installFakeBDForCity(t, cityDir)
+
+	// Seed bd store markers after city.toml exists, then exercise only
+	// Gas City's configured rig route rather than direct cwd-based bd calls.
+	prefix0 := "r0"
+	prefix1 := "r1"
+	seedConfiguredFakeBDWorkspace(t, rigDirs[0], prefix0)
+	seedConfiguredFakeBDWorkspace(t, rigDirs[1], prefix1)
 	assert.NotEqual(t, prefix0, prefix1, "rig bead prefixes should differ")
 
-	// Create a bead from rig-0's directory.
-	out, err := bd(rigDirs[0], "create", "multi-rig bead test alpha")
+	// Create a bead through Gas City's configured rig route.
+	out, err := gc(cityDir, "bd", "--rig", "rig-0", "create", "multi-rig bead test alpha")
 	require.NoError(t, err, "bd create in rig-0: %s", out)
 	beadID := extractBeadID(t, out)
 
@@ -285,11 +344,17 @@ func TestGastown_MultiRig_BeadIsolation(t *testing.T) {
 	assert.True(t, strings.HasPrefix(beadID, prefix0),
 		"bead ID %q should start with rig-0 prefix %q", beadID, prefix0)
 
-	// Verify the bead is visible from rig-0.
-	out, err = bd(rigDirs[0], "show", beadID)
+	// Verify the bead is visible through rig-0's configured route.
+	out, err = gc(cityDir, "bd", "--rig", "rig-0", "show", beadID)
 	require.NoError(t, err, "bd show from rig-0: %s", out)
 	assert.Contains(t, out, "multi-rig bead test alpha",
 		"bead should be visible from rig-0")
+
+	// Verify the same bead is not visible through rig-1's configured route.
+	out, err = gc(cityDir, "bd", "--rig", "rig-1", "show", beadID)
+	require.Error(t, err, "bd show from rig-1 should fail for bead %s; output: %s", beadID, out)
+	assert.NotContains(t, out, "multi-rig bead test alpha",
+		"bead should not be visible from rig-1")
 }
 
 // TestGastown_MultiRig_IndependentLifecycle starts a city with 2 rigs, stops
diff --git a/test/integration/gc_live_contract_test.go b/test/integration/gc_live_contract_test.go
index 77c1a7e3e1..0a2c7faf11 100644
--- a/test/integration/gc_live_contract_test.go
+++ b/test/integration/gc_live_contract_test.go
@@ -3,6 +3,7 @@
 package integration
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"encoding/json"
@@ -23,12 +24,12 @@ import (
 	openapivalidator "github.com/pb33f/libopenapi-validator"
 )
 
-// TestGCLiveContract_BeadsAndEvents ports the MC live GC contract's
-// API-only coverage into this repo. It boots a real supervisor, creates an
-// isolated city and rig through the HTTP API, validates responses against the
-// live OpenAPI document, exercises the bead lifecycle MC depends on, validates
-// city and supervisor event list schemas, and unregisters the city through the
-// API.
+// TestGCLiveContract_BeadsAndEvents covers real-world app API usage directly
+// in this repo. It boots a real supervisor with isolated
+// state, creates an isolated city and rig through the HTTP API, validates
+// responses against the live OpenAPI document, exercises real Dolt-backed
+// beads, mail, events, and subprocess agent sessions, and unregisters the city
+// through the API.
 func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 	bin := buildGCBinary(t)
 
@@ -47,7 +48,7 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 	writeSupervisorConfig(t, gcHome, port)
 
 	baseURL := "http://127.0.0.1:" + strconv.Itoa(port)
-	env := integrationEnvFor(gcHome, runtimeDir, true)
+	env := append(integrationEnvFor(gcHome, runtimeDir, true), "GC_SESSION=subprocess")
 
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
@@ -74,29 +75,48 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 
 	specBytes := liveContractRequest(t, baseURL, nil, http.MethodGet, "/openapi.json", nil, http.StatusOK)
 	assertLiveContractSpec(t, specBytes)
+	assertLiveContractRequiredOperations(t, specBytes)
 	validator := liveContractValidator(t, specBytes)
 
-	cityName := "mc-live-contract-" + strconv.FormatInt(time.Now().UnixNano(), 36)
+	cityName := "real-world-app-contract-" + strconv.FormatInt(time.Now().UnixNano(), 36)
 	cityDir := filepath.Join(root, "cities", cityName)
 	createCity := liveContractJSON[struct {
-		OK   bool   `json:"ok"`
-		Name string `json:"name"`
-		Path string `json:"path"`
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
 	}](t, baseURL, validator, http.MethodPost, "/v0/city", map[string]string{
-		"dir":      cityDir,
-		"provider": "claude",
+		"dir":           cityDir,
+		"start_command": "bash " + agentScript("stuck-agent.sh"),
 	}, http.StatusAccepted)
-	if !createCity.OK || createCity.Name != cityName || createCity.Path != cityDir {
-		t.Fatalf("city create response = %+v, want ok=true name=%q path=%q", createCity, cityName, cityDir)
+	if createCity.RequestID == "" {
+		t.Fatalf("city create response missing request_id")
+	}
+	if createCity.EventCursor == "" {
+		t.Fatalf("city create response missing event_cursor")
 	}
 
 	cityBase := "/v0/city/" + url.PathEscape(cityName)
-	waitForLiveContractEvent(t, baseURL, validator, "/v0/events", cityName, "city.ready", 120*time.Second)
+	waitForLiveContractRequestID[struct {
+		RequestID string `json:"request_id"`
+		Name      string `json:"name"`
+		Path      string `json:"path"`
+	}](t, baseURL, validator, "/v0/events", createCity.RequestID, "request.result.city.create", 120*time.Second, createCity.EventCursor)
 	liveContractJSON[struct {
 		Status string `json:"status"`
 	}](t, baseURL, validator, http.MethodGet, cityBase+"/health", nil, http.StatusOK)
-	assertLiveContractStreamOpens(t, baseURL, "/v0/events/stream")
-	assertLiveContractStreamOpens(t, baseURL, cityBase+"/events/stream")
+	// Use replay cursors so the open check verifies the SSE route without
+	// waiting for a fresh event or the 15s idle heartbeat.
+	assertLiveContractStreamOpens(t, baseURL, "/v0/events/stream?after_cursor=0")
+	assertLiveContractStreamOpens(t, baseURL, cityBase+"/events/stream?after_seq=0")
+
+	cityScopedBead := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodPost, cityBase+"/beads", map[string]any{
+		"description": "City-scoped fixture created immediately after async city.create completion.",
+		"labels":      []string{"real-world-app-contract", "city-scope"},
+		"title":       "real-world app contract city-scoped bead",
+		"type":        "task",
+	}, http.StatusCreated)
+	if cityScopedBead.ID == "" || cityScopedBead.Status != "open" {
+		t.Fatalf("city-scoped bead = %+v, want id and open status", cityScopedBead)
+	}
 
 	rigName := "alpha"
 	rigDir := filepath.Join(cityDir, rigName)
@@ -109,84 +129,208 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 	}](t, baseURL, validator, http.MethodPost, cityBase+"/rigs", map[string]string{
 		"name":   rigName,
 		"path":   rigDir,
-		"prefix": "mc-" + strconv.FormatInt(time.Now().UnixNano(), 36),
+		"prefix": "rw" + strconv.FormatInt(time.Now().UnixNano(), 36),
 	}, http.StatusCreated)
 	waitForLiveContractRig(t, baseURL, validator, cityBase, rigName, rigDir, 30*time.Second)
 
+	liveContractJSON[struct {
+		Status   string `json:"status"`
+		Provider string `json:"provider"`
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/providers", map[string]any{
+		"name":        "contract-agent",
+		"command":     "bash",
+		"args":        []string{agentScript("stuck-agent.sh")},
+		"prompt_mode": "none",
+	}, http.StatusCreated)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+		Agent  string `json:"agent"`
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/agents", map[string]string{
+		"name":     "worker",
+		"dir":      rigName,
+		"provider": "contract-agent",
+	}, http.StatusCreated)
+	targetAgent := rigName + "/worker"
+	waitForLiveContractAgent(t, baseURL, validator, cityBase, targetAgent, 30*time.Second)
+
+	publicProviders := liveContractJSON[struct {
+		Items []struct {
+			Name string `json:"name"`
+		} `json:"items"`
+	}](t, baseURL, validator, http.MethodGet, cityBase+"/providers/public", nil, http.StatusOK)
+	if len(publicProviders.Items) == 0 {
+		t.Fatal("GET providers/public returned no providers")
+	}
+	liveContractJSON[map[string]any](t, baseURL, validator, http.MethodGet, cityBase+"/readiness?fresh=false", nil, http.StatusOK)
+	liveContractJSON[map[string]any](t, baseURL, validator, http.MethodGet, cityBase+"/provider-readiness?fresh=false", nil, http.StatusOK)
+	cfg := liveContractJSON[struct {
+		Agents []contractConfigAgent `json:"agents"`
+	}](t, baseURL, validator, http.MethodGet, cityBase+"/config", nil, http.StatusOK)
+	if !liveContractConfigHasAgent(cfg.Agents, "worker", rigName) {
+		t.Fatalf("GET config missing created agent %q; agents=%+v", targetAgent, cfg.Agents)
+	}
+
 	runID := strconv.FormatInt(time.Now().UnixNano(), 36)
+	sessionID := createLiveContractAgentSession(t, baseURL, validator, cityBase, targetAgent, rigName, "mail-"+runID)
 	rootBead := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodPost, cityBase+"/beads", map[string]any{
 		"description": "Root fixture created by TestGCLiveContract_BeadsAndEvents",
-		"labels":      []string{"mc-live-contract", "root"},
+		"labels":      []string{"real-world-app-contract", "root"},
 		"metadata": map[string]string{
-			"mc.contract.role":   "root",
-			"mc.contract.run_id": runID,
+			"real_world_app.contract.role":   "root",
+			"real_world_app.contract.run_id": runID,
 		},
 		"priority": 2,
 		"rig":      rigName,
-		"title":    "MC live contract root " + runID,
+		"title":    "real-world app contract root " + runID,
 		"type":     "feature",
 	}, http.StatusCreated)
 	if rootBead.ID == "" || rootBead.Status != "open" || rootBead.Type != "feature" {
 		t.Fatalf("root bead = %+v, want id, open status, feature type", rootBead)
 	}
-	if rootBead.Metadata["mc.contract.run_id"] != runID {
+	if rootBead.Metadata["real_world_app.contract.run_id"] != runID {
 		t.Fatalf("root metadata = %#v, want run_id=%q", rootBead.Metadata, runID)
 	}
+	idempotentKey := "real-world-app-contract-idempotent-" + runID
+	idempotentBody := map[string]any{
+		"description": "Idempotency fixture created by TestGCLiveContract_BeadsAndEvents",
+		"labels":      []string{"real-world-app-contract", "idempotency"},
+		"rig":         rigName,
+		"title":       "real-world app contract idempotent " + runID,
+		"type":        "task",
+	}
+	firstReplay := liveContractRequestWithHeaders(t, baseURL, validator, http.MethodPost, cityBase+"/beads", idempotentBody, http.StatusCreated, map[string]string{
+		"Idempotency-Key": idempotentKey,
+	})
+	secondReplay := liveContractRequestWithHeaders(t, baseURL, validator, http.MethodPost, cityBase+"/beads", idempotentBody, http.StatusCreated, map[string]string{
+		"Idempotency-Key": idempotentKey,
+	})
+	if !bytes.Equal(firstReplay, secondReplay) {
+		t.Fatalf("idempotent mutation replay body changed:\nfirst:  %s\nsecond: %s", string(firstReplay), string(secondReplay))
+	}
+	var idempotentBead beads.Bead
+	if err := json.Unmarshal(firstReplay, &idempotentBead); err != nil {
+		t.Fatalf("decode idempotent bead: %v", err)
+	}
+
+	waitForLiveContractAgent(t, baseURL, validator, cityBase, targetAgent, 30*time.Second)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+		Target string `json:"target"`
+		Bead   string `json:"bead"`
+		Mode   string `json:"mode"`
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/sling", map[string]any{
+		"rig":    rigName,
+		"target": targetAgent,
+		"bead":   rootBead.ID,
+		"force":  true,
+	}, http.StatusOK)
+	formulaName := "real-world-app-contract-work"
+	formulaDir := filepath.Join(cityDir, "formulas")
+	if err := os.MkdirAll(formulaDir, 0o755); err != nil {
+		t.Fatalf("mkdir formula dir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(formulaDir, formulaName+".toml"), []byte(`
+formula = "real-world-app-contract-work"
+version = 1
+description = "Live contract preview fixture."
+
+[vars]
+[vars.issue]
+description = "Work bead ID"
+required = true
+
+[[steps]]
+id = "do-work"
+title = "Do {{issue}}"
+description = "Read and complete {{issue}}."
+`), 0o644); err != nil {
+		t.Fatalf("write formula fixture: %v", err)
+	}
+	liveContractJSON[struct {
+		Name    string `json:"name"`
+		Preview struct {
+			Nodes []struct {
+				ID string `json:"id"`
+			} `json:"nodes"`
+		} `json:"preview"`
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/formulas/"+url.PathEscape(formulaName)+"/preview", map[string]any{
+		"scope_kind": "city",
+		"scope_ref":  cityName,
+		"target":     targetAgent,
+		"vars":       map[string]string{"issue": rootBead.ID},
+	}, http.StatusOK)
+	exerciseLiveContractFormulasAndWorkflows(t, baseURL, validator, cityBase, formulaName, targetAgent, rigName, rootBead.ID, runID)
+	exerciseLiveContractOrders(t, baseURL, validator, cityBase, rigName, rootBead.ID, runID)
+
+	lifecycleBead := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodPost, cityBase+"/beads", map[string]any{
+		"description": "Lifecycle fixture created by TestGCLiveContract_BeadsAndEvents",
+		"labels":      []string{"real-world-app-contract", "lifecycle"},
+		"metadata": map[string]string{
+			"real_world_app.contract.role":   "lifecycle",
+			"real_world_app.contract.run_id": runID,
+		},
+		"rig":   rigName,
+		"title": "real-world app contract lifecycle " + runID,
+		"type":  "task",
+	}, http.StatusCreated)
+	if lifecycleBead.ID == "" {
+		t.Fatal("lifecycle bead missing id")
+	}
 
 	liveContractJSON[struct {
 		Status string `json:"status"`
-	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(rootBead.ID)+"/update", map[string]any{
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(lifecycleBead.ID)+"/update", map[string]any{
 		"metadata": map[string]string{
-			"mc.contract.metadata_update": "true",
-			"mc_permission_mode":          "default",
-			"mc_starred":                  "true",
+			"real_world_app.contract.metadata_update": "true",
+			"real_world_app.permission_mode":          "default",
+			"real_world_app.starred":                  "true",
 		},
 		"status": "in_progress",
 	}, http.StatusOK)
-	updatedRoot := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(rootBead.ID), nil, http.StatusOK)
-	if updatedRoot.Status != "in_progress" || updatedRoot.Metadata["mc.contract.metadata_update"] != "true" {
-		t.Fatalf("updated root = %+v, want in_progress plus metadata update", updatedRoot)
+	updatedLifecycle := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(lifecycleBead.ID), nil, http.StatusOK)
+	if updatedLifecycle.Status != "in_progress" || updatedLifecycle.Metadata["real_world_app.contract.metadata_update"] != "true" {
+		t.Fatalf("updated lifecycle bead = %+v, want in_progress plus metadata update", updatedLifecycle)
 	}
 
 	liveContractJSON[struct {
 		Status string `json:"status"`
-	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(rootBead.ID)+"/close", nil, http.StatusOK)
-	closedRoot := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(rootBead.ID), nil, http.StatusOK)
-	if closedRoot.Status != "closed" {
-		t.Fatalf("closed root status = %q, want closed", closedRoot.Status)
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(lifecycleBead.ID)+"/close", nil, http.StatusOK)
+	closedLifecycle := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(lifecycleBead.ID), nil, http.StatusOK)
+	if closedLifecycle.Status != "closed" {
+		t.Fatalf("closed lifecycle bead status = %q, want closed", closedLifecycle.Status)
 	}
 	liveContractJSON[struct {
 		Status string `json:"status"`
-	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(rootBead.ID)+"/reopen", nil, http.StatusOK)
-	reopenedRoot := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(rootBead.ID), nil, http.StatusOK)
-	if reopenedRoot.Status != "open" {
-		t.Fatalf("reopened root status = %q, want open", reopenedRoot.Status)
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(lifecycleBead.ID)+"/reopen", nil, http.StatusOK)
+	reopenedLifecycle := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(lifecycleBead.ID), nil, http.StatusOK)
+	if reopenedLifecycle.Status != "open" {
+		t.Fatalf("reopened lifecycle bead status = %q, want open", reopenedLifecycle.Status)
 	}
 
 	childBead := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodPost, cityBase+"/beads", map[string]any{
 		"description": "Child fixture that exercises parent and update semantics",
-		"labels":      []string{"mc-live-contract", "child", "needs-update"},
+		"labels":      []string{"real-world-app-contract", "child", "needs-update"},
 		"metadata": map[string]string{
-			"mc.contract.role":   "child",
-			"mc.contract.run_id": runID,
+			"real_world_app.contract.role":   "child",
+			"real_world_app.contract.run_id": runID,
 		},
 		"parent":   rootBead.ID,
 		"priority": 1,
 		"rig":      rigName,
-		"title":    "MC live contract child " + runID,
+		"title":    "real-world app contract child " + runID,
 		"type":     "task",
 	}, http.StatusCreated)
 	siblingBead := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodPost, cityBase+"/beads", map[string]any{
 		"description": "Sibling fixture for list and filter coverage",
-		"labels":      []string{"mc-live-contract", "sibling"},
+		"labels":      []string{"real-world-app-contract", "sibling"},
 		"metadata": map[string]string{
-			"mc.contract.role":   "sibling",
-			"mc.contract.run_id": runID,
+			"real_world_app.contract.role":   "sibling",
+			"real_world_app.contract.run_id": runID,
 		},
 		"parent":   rootBead.ID,
 		"priority": 3,
 		"rig":      rigName,
-		"title":    "MC live contract sibling " + runID,
+		"title":    "real-world app contract sibling " + runID,
 		"type":     "bug",
 	}, http.StatusCreated)
 	if childBead.ParentID != rootBead.ID || childBead.Type != "task" {
@@ -201,12 +345,12 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(childBead.ID)+"/update", map[string]any{
 		"description":   "Updated child fixture",
 		"labels":        []string{"verified"},
-		"metadata":      map[string]string{"mc.contract.updated": "true"},
+		"metadata":      map[string]string{"real_world_app.contract.updated": "true"},
 		"parent":        "",
 		"priority":      4,
 		"remove_labels": []string{"needs-update"},
 		"status":        "in_progress",
-		"title":         "MC live contract child updated " + runID,
+		"title":         "real-world app contract child updated " + runID,
 		"type":          "bug",
 	}, http.StatusOK)
 	updatedChild := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(childBead.ID), nil, http.StatusOK)
@@ -216,21 +360,20 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 	if !containsString(updatedChild.Labels, "verified") || containsString(updatedChild.Labels, "needs-update") {
 		t.Fatalf("updated child labels = %#v, want verified without needs-update", updatedChild.Labels)
 	}
-	if updatedChild.Metadata["mc.contract.updated"] != "true" {
-		t.Fatalf("updated child metadata = %#v, want mc.contract.updated=true", updatedChild.Metadata)
+	if updatedChild.Metadata["real_world_app.contract.updated"] != "true" {
+		t.Fatalf("updated child metadata = %#v, want real_world_app.contract.updated=true", updatedChild.Metadata)
 	}
 
 	liveContractJSON[struct {
 		Status string `json:"status"`
 	}](t, baseURL, validator, http.MethodPost, cityBase+"/bead/"+url.PathEscape(childBead.ID)+"/update", map[string]any{
-		"metadata": map[string]string{"mc.contract.parent_restored": "true"},
+		"metadata": map[string]string{"real_world_app.contract.parent_restored": "true"},
 		"parent":   rootBead.ID,
 	}, http.StatusOK)
 	restoredChild := liveContractJSON[beads.Bead](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(childBead.ID), nil, http.StatusOK)
 	if restoredChild.ParentID != rootBead.ID {
 		t.Fatalf("restored child parent = %q, want %q", restoredChild.ParentID, rootBead.ID)
 	}
-
 	deps := liveContractJSON[struct {
 		Children []beads.Bead `json:"children"`
 	}](t, baseURL, validator, http.MethodGet, cityBase+"/bead/"+url.PathEscape(rootBead.ID)+"/deps", nil, http.StatusOK)
@@ -258,7 +401,7 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 	list := liveContractJSON[struct {
 		Items []beads.Bead `json:"items"`
 		Total int          `json:"total"`
-	}](t, baseURL, validator, http.MethodGet, cityBase+"/beads?label=mc-live-contract&limit=50&rig="+url.QueryEscape(rigName), nil, http.StatusOK)
+	}](t, baseURL, validator, http.MethodGet, cityBase+"/beads?label=real-world-app-contract&limit=50&rig="+url.QueryEscape(rigName), nil, http.StatusOK)
 	if list.Total < 3 || !beadListContains(list.Items, rootBead.ID) || !beadListContains(list.Items, siblingBead.ID) {
 		t.Fatalf("filtered beads = %+v, want root and sibling", list)
 	}
@@ -266,27 +409,120 @@ func TestGCLiveContract_BeadsAndEvents(t *testing.T) {
 		t.Fatalf("filtered sibling parent = %q, want %q", listedSibling.ParentID, rootBead.ID)
 	}
 
-	waitForLiveContractEvent(t, baseURL, validator, cityBase+"/events", cityName, "city.ready", 10*time.Second)
-	liveContractJSON[contractEventList](t, baseURL, validator, http.MethodGet, "/v0/events?limit=50", nil, http.StatusOK)
+	message := liveContractJSON[struct {
+		ID       string `json:"id"`
+		ThreadID string `json:"thread_id"`
+		Rig      string `json:"rig"`
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/mail", map[string]string{
+		"rig":     rigName,
+		"from":    "real-world-app-contract",
+		"to":      sessionID,
+		"subject": "real-world app contract mail " + runID,
+		"body":    "Exercise the typed mail API contract.",
+	}, http.StatusCreated)
+	if message.ID == "" {
+		t.Fatalf("mail send response missing id: %+v", message)
+	}
+	mailPath := cityBase + "/mail/" + url.PathEscape(message.ID)
+	mailRigQuery := "?rig=" + url.QueryEscape(rigName)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodPost, mailPath+"/read"+mailRigQuery, nil, http.StatusOK)
+	readMessage := liveContractJSON[struct {
+		ID   string `json:"id"`
+		Read bool   `json:"read"`
+	}](t, baseURL, validator, http.MethodGet, mailPath+"?rig="+url.QueryEscape(rigName), nil, http.StatusOK)
+	if readMessage.ID != message.ID || !readMessage.Read {
+		t.Fatalf("mail read state after read = %+v, want id=%q read=true", readMessage, message.ID)
+	}
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodPost, mailPath+"/mark-unread"+mailRigQuery, nil, http.StatusOK)
+	unreadMessage := liveContractJSON[struct {
+		ID   string `json:"id"`
+		Read bool   `json:"read"`
+	}](t, baseURL, validator, http.MethodGet, mailPath+"?rig="+url.QueryEscape(rigName), nil, http.StatusOK)
+	if unreadMessage.ID != message.ID || unreadMessage.Read {
+		t.Fatalf("mail read state after mark-unread = %+v, want id=%q read=false", unreadMessage, message.ID)
+	}
+	reply := liveContractJSON[struct {
+		ID string `json:"id"`
+	}](t, baseURL, validator, http.MethodPost, mailPath+"/reply"+mailRigQuery, map[string]string{
+		"from":    targetAgent,
+		"subject": "Re: real-world app contract mail " + runID,
+		"body":    "Reply from live contract coverage.",
+	}, http.StatusCreated)
+	if reply.ID == "" {
+		t.Fatalf("mail reply response missing id: %+v", reply)
+	}
+	if message.ThreadID == "" {
+		t.Fatalf("mail send response missing thread_id: %+v", message)
+	}
+	liveContractJSON[struct {
+		Items []struct {
+			ID string `json:"id"`
+		} `json:"items"`
+		Total int `json:"total"`
+	}](t, baseURL, validator, http.MethodGet, cityBase+"/mail/thread/"+url.PathEscape(message.ThreadID)+"?rig="+url.QueryEscape(rigName), nil, http.StatusOK)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodPost, mailPath+"/archive"+mailRigQuery, nil, http.StatusOK)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodDelete, mailPath+mailRigQuery, nil, http.StatusOK)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodPost, cityBase+"/session/"+url.PathEscape(sessionID)+"/close?delete=true", nil, http.StatusOK)
+
+	exerciseLiveContractSessionLifecycle(t, baseURL, validator, cityBase, targetAgent, rigName, runID)
+
+	events, err := liveContractEventList(baseURL, validator, "/v0/events?limit=50")
+	if err != nil {
+		t.Fatalf("GET /v0/events?limit=50: %v", err)
+	}
+	if events.Total == 0 {
+		t.Fatal("GET /v0/events?limit=50 returned no events")
+	}
+	cityEvents, err := liveContractEventList(baseURL, validator, cityBase+"/events?limit=50")
+	if err != nil {
+		t.Fatalf("GET %s/events?limit=50: %v", cityBase, err)
+	}
+	if cityEvents.Total == 0 {
+		t.Fatalf("GET %s/events?limit=50 returned no events", cityBase)
+	}
 	runLiveContractReadSweep(t, baseURL, validator, specBytes, cityName, rigName)
 
-	for _, id := range []string{siblingBead.ID, childBead.ID, rootBead.ID} {
+	for _, id := range []string{idempotentBead.ID, lifecycleBead.ID, siblingBead.ID, childBead.ID, rootBead.ID} {
 		liveContractJSON[struct {
 			Status string `json:"status"`
 		}](t, baseURL, validator, http.MethodDelete, cityBase+"/bead/"+url.PathEscape(id), nil, http.StatusOK)
 	}
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodPatch, cityBase, map[string]bool{"suspended": true}, http.StatusOK)
+	closeLiveContractRigSessions(t, baseURL, validator, cityBase, rigName)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, validator, http.MethodPatch, cityBase, map[string]bool{"suspended": false}, http.StatusOK)
 	liveContractJSON[struct {
 		Status string `json:"status"`
 	}](t, baseURL, validator, http.MethodDelete, cityBase+"/rig/"+url.PathEscape(rigName), nil, http.StatusOK)
 
 	unregister := liveContractJSON[struct {
-		OK   bool   `json:"ok"`
-		Name string `json:"name"`
-		Path string `json:"path"`
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
 	}](t, baseURL, validator, http.MethodPost, cityBase+"/unregister", nil, http.StatusAccepted)
-	if !unregister.OK || unregister.Name != cityName {
-		t.Fatalf("unregister response = %+v, want ok=true name=%q", unregister, cityName)
+	if unregister.RequestID == "" {
+		t.Fatalf("unregister response missing request_id")
+	}
+	if unregister.EventCursor == "" {
+		t.Fatalf("unregister response missing event_cursor")
 	}
+	waitForLiveContractRequestID[struct {
+		RequestID string `json:"request_id"`
+		Name      string `json:"name"`
+		Path      string `json:"path"`
+	}](t, baseURL, validator, "/v0/events", unregister.RequestID, "request.result.city.unregister", 120*time.Second, unregister.EventCursor)
 	waitForCityAbsent(t, baseURL, validator, cityName, 45*time.Second)
 }
 
@@ -296,14 +532,80 @@ type contractEventList struct {
 }
 
 type contractEvent struct {
-	Type    string `json:"type"`
-	Subject string `json:"subject"`
-	City    string `json:"city"`
-	Payload struct {
-		Name  string `json:"name"`
-		Path  string `json:"path"`
-		Error string `json:"error"`
-	} `json:"payload"`
+	Type    string          `json:"type"`
+	Subject string          `json:"subject"`
+	City    string          `json:"city"`
+	Payload json.RawMessage `json:"payload"`
+}
+
+type liveContractRequiredOperation struct {
+	Method       string
+	OperationID  string
+	PathTemplate string
+}
+
+var liveContractRequiredOperations = []liveContractRequiredOperation{
+	{Method: http.MethodGet, OperationID: "get-v0-cities", PathTemplate: "/v0/cities"},
+	{Method: http.MethodGet, OperationID: "get-health", PathTemplate: "/health"},
+	{Method: http.MethodPost, OperationID: "post-v0-city", PathTemplate: "/v0/city"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-unregister", PathTemplate: "/v0/city/{cityName}/unregister"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-agents", PathTemplate: "/v0/city/{cityName}/agents"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-config", PathTemplate: "/v0/city/{cityName}/config"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-health", PathTemplate: "/v0/city/{cityName}/health"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-providers", PathTemplate: "/v0/city/{cityName}/providers"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-providers-public", PathTemplate: "/v0/city/{cityName}/providers/public"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-readiness", PathTemplate: "/v0/city/{cityName}/readiness"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-rigs", PathTemplate: "/v0/city/{cityName}/rigs"},
+	{Method: http.MethodPost, OperationID: "create-rig", PathTemplate: "/v0/city/{cityName}/rigs"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-sessions", PathTemplate: "/v0/city/{cityName}/sessions"},
+	{Method: http.MethodPost, OperationID: "create-session", PathTemplate: "/v0/city/{cityName}/sessions"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-session-by-id", PathTemplate: "/v0/city/{cityName}/session/{id}"},
+	{Method: http.MethodPatch, OperationID: "patch-v0-city-by-city-name-session-by-id", PathTemplate: "/v0/city/{cityName}/session/{id}"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-session-by-id-agents", PathTemplate: "/v0/city/{cityName}/session/{id}/agents"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-session-by-id-agents-by-agent-id", PathTemplate: "/v0/city/{cityName}/session/{id}/agents/{agentId}"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-session-by-id-close", PathTemplate: "/v0/city/{cityName}/session/{id}/close"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-session-by-id-kill", PathTemplate: "/v0/city/{cityName}/session/{id}/kill"},
+	{Method: http.MethodPost, OperationID: "send-session-message", PathTemplate: "/v0/city/{cityName}/session/{id}/messages"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-session-by-id-pending", PathTemplate: "/v0/city/{cityName}/session/{id}/pending"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-session-by-id-rename", PathTemplate: "/v0/city/{cityName}/session/{id}/rename"},
+	{Method: http.MethodPost, OperationID: "respond-session", PathTemplate: "/v0/city/{cityName}/session/{id}/respond"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-session-by-id-stop", PathTemplate: "/v0/city/{cityName}/session/{id}/stop"},
+	{Method: http.MethodGet, OperationID: "stream-session", PathTemplate: "/v0/city/{cityName}/session/{id}/stream"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-session-by-id-suspend", PathTemplate: "/v0/city/{cityName}/session/{id}/suspend"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-session-by-id-transcript", PathTemplate: "/v0/city/{cityName}/session/{id}/transcript"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-session-by-id-wake", PathTemplate: "/v0/city/{cityName}/session/{id}/wake"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-beads", PathTemplate: "/v0/city/{cityName}/beads"},
+	{Method: http.MethodPost, OperationID: "create-bead", PathTemplate: "/v0/city/{cityName}/beads"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-bead-by-id", PathTemplate: "/v0/city/{cityName}/bead/{id}"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-bead-by-id-close", PathTemplate: "/v0/city/{cityName}/bead/{id}/close"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-bead-by-id-deps", PathTemplate: "/v0/city/{cityName}/bead/{id}/deps"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-bead-by-id-reopen", PathTemplate: "/v0/city/{cityName}/bead/{id}/reopen"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-bead-by-id-update", PathTemplate: "/v0/city/{cityName}/bead/{id}/update"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-beads-graph-by-root-id", PathTemplate: "/v0/city/{cityName}/beads/graph/{rootID}"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-mail", PathTemplate: "/v0/city/{cityName}/mail"},
+	{Method: http.MethodPost, OperationID: "send-mail", PathTemplate: "/v0/city/{cityName}/mail"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-mail-by-id", PathTemplate: "/v0/city/{cityName}/mail/{id}"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-mail-by-id-archive", PathTemplate: "/v0/city/{cityName}/mail/{id}/archive"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-mail-by-id-mark-unread", PathTemplate: "/v0/city/{cityName}/mail/{id}/mark-unread"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-mail-by-id-read", PathTemplate: "/v0/city/{cityName}/mail/{id}/read"},
+	{Method: http.MethodPost, OperationID: "reply-mail", PathTemplate: "/v0/city/{cityName}/mail/{id}/reply"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-mail-thread-by-id", PathTemplate: "/v0/city/{cityName}/mail/thread/{id}"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-formulas", PathTemplate: "/v0/city/{cityName}/formulas"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-formulas-feed", PathTemplate: "/v0/city/{cityName}/formulas/feed"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-formulas-by-name", PathTemplate: "/v0/city/{cityName}/formulas/{name}"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-formulas-by-name-preview", PathTemplate: "/v0/city/{cityName}/formulas/{name}/preview"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-formulas-by-name-runs", PathTemplate: "/v0/city/{cityName}/formulas/{name}/runs"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-orders", PathTemplate: "/v0/city/{cityName}/orders"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-orders-check", PathTemplate: "/v0/city/{cityName}/orders/check"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-orders-feed", PathTemplate: "/v0/city/{cityName}/orders/feed"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-orders-history", PathTemplate: "/v0/city/{cityName}/orders/history"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-order-history-by-bead-id", PathTemplate: "/v0/city/{cityName}/order/history/{bead_id}"},
+	{Method: http.MethodPost, OperationID: "post-v0-city-by-city-name-sling", PathTemplate: "/v0/city/{cityName}/sling"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-convoy-by-id", PathTemplate: "/v0/city/{cityName}/convoy/{id}"},
+	{Method: http.MethodDelete, OperationID: "delete-v0-city-by-city-name-convoy-by-id", PathTemplate: "/v0/city/{cityName}/convoy/{id}"},
+	{Method: http.MethodGet, OperationID: "get-v0-city-by-city-name-workflow-by-workflow-id", PathTemplate: "/v0/city/{cityName}/workflow/{workflow_id}"},
+	{Method: http.MethodGet, OperationID: "get-v0-events", PathTemplate: "/v0/events"},
+	{Method: http.MethodGet, OperationID: "stream-supervisor-events", PathTemplate: "/v0/events/stream"},
 }
 
 type liveContractReadProbe struct {
@@ -328,6 +630,375 @@ type contractGraphDep struct {
 	Kind string `json:"kind"`
 }
 
+type contractConfigAgent struct {
+	Name string `json:"name"`
+	Dir  string `json:"dir"`
+}
+
+func liveContractConfigHasAgent(agents []contractConfigAgent, name, dir string) bool {
+	for _, agent := range agents {
+		if agent.Name == name && agent.Dir == dir {
+			return true
+		}
+	}
+	return false
+}
+
+func createLiveContractAgentSession(t *testing.T, baseURL string, v openapivalidator.Validator, cityBase, targetAgent, rigName, label string) string {
+	t.Helper()
+	create := liveContractJSON[struct {
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
+		Status      string `json:"status"`
+	}](t, baseURL, v, http.MethodPost, cityBase+"/sessions", map[string]any{
+		"alias":      "rw-" + label,
+		"async":      true,
+		"kind":       "agent",
+		"name":       targetAgent,
+		"project_id": rigName,
+		"title":      "real-world app contract " + label,
+	}, http.StatusAccepted)
+	if create.RequestID == "" {
+		t.Fatalf("%s session create response missing request_id", label)
+	}
+	if create.EventCursor == "" {
+		t.Fatalf("%s session create response missing event_cursor", label)
+	}
+	result := waitForLiveContractRequestID[struct {
+		RequestID string `json:"request_id"`
+		Session   struct {
+			ID    string `json:"id"`
+			Title string `json:"title"`
+			Alias string `json:"alias"`
+			Rig   string `json:"rig"`
+			State string `json:"state"`
+		} `json:"session"`
+	}](t, baseURL, v, cityBase+"/events", create.RequestID, "request.result.session.create", 120*time.Second, create.EventCursor)
+	if result.Session.ID == "" {
+		t.Fatalf("%s session create result missing session.id", label)
+	}
+	if result.Session.State == "creating" {
+		t.Fatalf("%s session create result state = %q, want commandable state", label, result.Session.State)
+	}
+	if result.Session.Title != "real-world app contract "+label {
+		t.Fatalf("%s session title = %q", label, result.Session.Title)
+	}
+	if result.Session.Rig != rigName {
+		t.Fatalf("%s session rig = %q, want %q", label, result.Session.Rig, rigName)
+	}
+	if result.Session.Alias == "" {
+		t.Fatalf("%s session missing controller-managed alias", label)
+	}
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/session/"+url.PathEscape(result.Session.ID)+"/pending", nil, http.StatusOK)
+	return result.Session.ID
+}
+
+func closeLiveContractRigSessions(t *testing.T, baseURL string, v openapivalidator.Validator, cityBase, rigName string) {
+	t.Helper()
+	deadline := time.Now().Add(30 * time.Second)
+	for {
+		sessions := liveContractJSON[struct {
+			Items []struct {
+				ID       string `json:"id"`
+				Rig      string `json:"rig"`
+				Template string `json:"template"`
+				State    string `json:"state"`
+			} `json:"items"`
+		}](t, baseURL, v, http.MethodGet, cityBase+"/sessions?limit=100", nil, http.StatusOK)
+
+		remaining := 0
+		for _, sess := range sessions.Items {
+			if sess.ID == "" || sess.State == "closed" {
+				continue
+			}
+			if sess.Rig != rigName && !strings.HasPrefix(sess.Template, rigName+"/") {
+				continue
+			}
+			remaining++
+			liveContractJSON[struct {
+				Status string `json:"status"`
+			}](t, baseURL, v, http.MethodPost, cityBase+"/session/"+url.PathEscape(sess.ID)+"/close?delete=true", nil, http.StatusOK)
+		}
+		if remaining == 0 {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out closing %d live contract rig session(s)", remaining)
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+}
+
+func exerciseLiveContractSessionLifecycle(t *testing.T, baseURL string, v openapivalidator.Validator, cityBase, targetAgent, rigName, runID string) {
+	t.Helper()
+	id := createLiveContractAgentSession(t, baseURL, v, cityBase, targetAgent, rigName, "lifecycle-"+runID)
+	sessionPath := cityBase + "/session/" + url.PathEscape(id)
+
+	detail := liveContractJSON[struct {
+		ID string `json:"id"`
+	}](t, baseURL, v, http.MethodGet, sessionPath, nil, http.StatusOK)
+	if detail.ID != id {
+		t.Fatalf("session detail id = %q, want %q", detail.ID, id)
+	}
+
+	patchedTitle := "real-world app contract patched " + runID
+	patched := liveContractJSON[struct {
+		ID    string `json:"id"`
+		Title string `json:"title"`
+		Alias string `json:"alias"`
+	}](t, baseURL, v, http.MethodPatch, sessionPath, map[string]string{"title": patchedTitle}, http.StatusOK)
+	if patched.ID != id || patched.Title != patchedTitle || patched.Alias == "" {
+		t.Fatalf("patched session = %+v, want id=%q title=%q with alias", patched, id, patchedTitle)
+	}
+
+	renamedTitle := "real-world app contract renamed " + runID
+	renamed := liveContractJSON[struct {
+		ID    string `json:"id"`
+		Title string `json:"title"`
+	}](t, baseURL, v, http.MethodPost, sessionPath+"/rename", map[string]string{"title": renamedTitle}, http.StatusOK)
+	if renamed.ID != id || renamed.Title != renamedTitle {
+		t.Fatalf("renamed session = %+v, want id=%q title=%q", renamed, id, renamedTitle)
+	}
+
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, v, http.MethodPost, sessionPath+"/suspend", nil, http.StatusOK)
+	waitForLiveContractSessionState(t, baseURL, v, sessionPath, "suspended", 30*time.Second)
+
+	wake := liveContractJSON[struct {
+		ID string `json:"id"`
+	}](t, baseURL, v, http.MethodPost, sessionPath+"/wake", nil, http.StatusOK)
+	if wake.ID != id {
+		t.Fatalf("wake id = %q, want %q", wake.ID, id)
+	}
+
+	msg := liveContractJSON[struct {
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
+	}](t, baseURL, v, http.MethodPost, sessionPath+"/messages", map[string]string{
+		"message": "real-world app contract message " + runID,
+	}, http.StatusAccepted)
+	if msg.RequestID == "" || msg.RequestID == id {
+		t.Fatalf("message response = %+v, want request_id distinct from session id %q", msg, id)
+	}
+	if msg.EventCursor == "" {
+		t.Fatalf("message response missing event_cursor")
+	}
+	waitForLiveContractRequestID[struct {
+		RequestID string `json:"request_id"`
+	}](t, baseURL, v, cityBase+"/events", msg.RequestID, "request.result.session.message", 120*time.Second, msg.EventCursor)
+
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, sessionPath+"/pending", nil, http.StatusOK)
+	liveContractRequestOneOf(t, baseURL, v, http.MethodPost, sessionPath+"/respond", map[string]string{
+		"action": "deny",
+		"text":   "real-world app contract no-pending response " + runID,
+	}, []int{http.StatusConflict, http.StatusNotImplemented})
+	transcript := liveContractJSON[struct {
+		ID     string `json:"id"`
+		Format string `json:"format"`
+	}](t, baseURL, v, http.MethodGet, sessionPath+"/transcript?format=raw&tail=1", nil, http.StatusOK)
+	if transcript.ID != id || transcript.Format != "raw" {
+		t.Fatalf("raw transcript = %+v, want id=%q format=raw", transcript, id)
+	}
+	assertLiveContractStreamOpens(t, baseURL, sessionPath+"/stream?format=raw")
+
+	agents := liveContractJSON[struct {
+		Agents []struct {
+			AgentID string `json:"agent_id"`
+			ID      string `json:"id"`
+		} `json:"agents"`
+	}](t, baseURL, v, http.MethodGet, sessionPath+"/agents", nil, http.StatusOK)
+	for _, agent := range agents.Agents {
+		agentID := agent.AgentID
+		if agentID == "" {
+			agentID = agent.ID
+		}
+		if agentID != "" {
+			liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, sessionPath+"/agents/"+url.PathEscape(agentID), nil, http.StatusOK)
+			break
+		}
+	}
+
+	stopped := liveContractJSON[struct {
+		ID string `json:"id"`
+	}](t, baseURL, v, http.MethodPost, sessionPath+"/stop", nil, http.StatusOK)
+	if stopped.ID != id {
+		t.Fatalf("stop id = %q, want %q", stopped.ID, id)
+	}
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, v, http.MethodPost, sessionPath+"/close?delete=true", nil, http.StatusOK)
+
+	killID := createLiveContractAgentSession(t, baseURL, v, cityBase, targetAgent, rigName, "kill-"+runID)
+	killed := liveContractJSON[struct {
+		ID string `json:"id"`
+	}](t, baseURL, v, http.MethodPost, cityBase+"/session/"+url.PathEscape(killID)+"/kill", nil, http.StatusOK)
+	if killed.ID != killID {
+		t.Fatalf("kill id = %q, want %q", killed.ID, killID)
+	}
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, v, http.MethodPost, cityBase+"/session/"+url.PathEscape(killID)+"/close?delete=true", nil, http.StatusOK)
+}
+
+func waitForLiveContractSessionState(t *testing.T, baseURL string, v openapivalidator.Validator, sessionPath, want string, timeout time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		session := liveContractJSON[struct {
+			State string `json:"state"`
+		}](t, baseURL, v, http.MethodGet, sessionPath, nil, http.StatusOK)
+		if session.State == want {
+			return
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %s state at %s", want, sessionPath)
+}
+
+func waitForLiveContractSessionCommandable(t *testing.T, baseURL string, v openapivalidator.Validator, sessionPath string, timeout time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	var lastState string
+	for time.Now().Before(deadline) {
+		session := liveContractJSON[struct {
+			State string `json:"state"`
+		}](t, baseURL, v, http.MethodGet, sessionPath, nil, http.StatusOK)
+		lastState = session.State
+		switch session.State {
+		case "creating":
+			time.Sleep(250 * time.Millisecond)
+			continue
+		case "crashed", "closed":
+			t.Fatalf("session at %s reached state %q before command lifecycle checks", sessionPath, session.State)
+		default:
+			if session.State != "" {
+				return
+			}
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for session at %s to leave creating state; last state=%q", sessionPath, lastState)
+}
+
+func exerciseLiveContractFormulasAndWorkflows(t *testing.T, baseURL string, v openapivalidator.Validator, cityBase, formulaName, targetAgent, rigName, rootBeadID, runID string) {
+	t.Helper()
+	formulas := liveContractJSON[struct {
+		Items []struct {
+			Name string `json:"name"`
+		} `json:"items"`
+		Total int `json:"total"`
+	}](t, baseURL, v, http.MethodGet, cityBase+"/formulas?scope_kind=rig&scope_ref="+url.QueryEscape(rigName), nil, http.StatusOK)
+	if formulas.Total < len(formulas.Items) || formulas.Total == 0 || !formulaListContains(formulas.Items, formulaName) {
+		t.Fatalf("formula list = %+v, want %q", formulas, formulaName)
+	}
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/formulas/feed?scope_kind=rig&scope_ref="+url.QueryEscape(rigName), nil, http.StatusOK)
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/formulas/"+url.PathEscape(formulaName)+"?scope_kind=rig&scope_ref="+url.QueryEscape(rigName)+"&target="+url.QueryEscape(targetAgent), nil, http.StatusOK)
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodPost, cityBase+"/formulas/"+url.PathEscape(formulaName)+"/preview", map[string]any{
+		"scope_kind": "rig",
+		"scope_ref":  rigName,
+		"target":     targetAgent,
+		"vars":       map[string]string{"issue": rootBeadID},
+	}, http.StatusOK)
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/formulas/"+url.PathEscape(formulaName)+"/runs?limit=5&scope_kind=rig&scope_ref="+url.QueryEscape(rigName), nil, http.StatusOK)
+	liveContractRequestOneOf(t, baseURL, v, http.MethodPost, cityBase+"/sling", map[string]any{
+		"target": targetAgent,
+	}, []int{http.StatusOK, http.StatusBadRequest, http.StatusUnprocessableEntity, http.StatusNotFound})
+	workflow := liveContractJSON[beads.Bead](t, baseURL, v, http.MethodPost, cityBase+"/beads", map[string]any{
+		"description": "Workflow fixture created by TestGCLiveContract_BeadsAndEvents",
+		"labels":      []string{"real-world-app-contract", "workflow"},
+		"metadata": map[string]string{
+			"gc.kind":             "workflow",
+			"gc.formula":          formulaName,
+			"gc.formula_contract": "graph.v2",
+			"gc.workflow_id":      "real-world-app-workflow-" + runID,
+		},
+		"rig":   rigName,
+		"title": "real-world app contract workflow " + runID,
+		"type":  "convoy",
+	}, http.StatusCreated)
+	workflowID := workflow.ID
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/workflow/"+url.PathEscape(workflowID)+"?scope_kind=rig&scope_ref="+url.QueryEscape(rigName), nil, http.StatusOK)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, v, http.MethodDelete, cityBase+"/workflow/"+url.PathEscape(workflowID)+"?scope_kind=rig&scope_ref="+url.QueryEscape(rigName), nil, http.StatusOK)
+
+	convoyItem := liveContractJSON[beads.Bead](t, baseURL, v, http.MethodPost, cityBase+"/beads", map[string]any{
+		"description": "Disposable convoy item fixture created by TestGCLiveContract_BeadsAndEvents",
+		"labels":      []string{"real-world-app-contract", "convoy-item"},
+		"rig":         rigName,
+		"title":       "real-world app contract convoy item " + runID,
+		"type":        "task",
+	}, http.StatusCreated)
+	convoy := liveContractJSON[beads.Bead](t, baseURL, v, http.MethodPost, cityBase+"/convoys", map[string]any{
+		"rig":   rigName,
+		"title": "real-world app contract convoy " + runID,
+		"items": []string{convoyItem.ID},
+	}, http.StatusCreated)
+	if convoy.ID == "" {
+		t.Fatalf("convoy create response missing id: %+v", convoy)
+	}
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/convoy/"+url.PathEscape(convoy.ID), nil, http.StatusOK)
+	liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, v, http.MethodDelete, cityBase+"/convoy/"+url.PathEscape(convoy.ID), nil, http.StatusOK)
+}
+
+func exerciseLiveContractOrders(t *testing.T, baseURL string, v openapivalidator.Validator, cityBase, rigName, rootBeadID, runID string) {
+	t.Helper()
+	scopedName := "real-world-app-contract-" + runID + ":rig:" + rigName
+	orderRun := liveContractJSON[beads.Bead](t, baseURL, v, http.MethodPost, cityBase+"/beads", map[string]any{
+		"description": "Order history fixture created by TestGCLiveContract_BeadsAndEvents",
+		"labels":      []string{"order-run:" + scopedName, "real-world-app-contract"},
+		"metadata": map[string]string{
+			"convergence.gate_stdout": "hello from live contract",
+		},
+		"rig":   rigName,
+		"title": "real-world app contract order history " + runID,
+		"type":  "task",
+	}, http.StatusCreated)
+	defer liveContractJSON[struct {
+		Status string `json:"status"`
+	}](t, baseURL, v, http.MethodDelete, cityBase+"/bead/"+url.PathEscape(orderRun.ID), nil, http.StatusOK)
+
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/orders", nil, http.StatusOK)
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/orders/check", nil, http.StatusOK)
+	liveContractJSON[map[string]any](t, baseURL, v, http.MethodGet, cityBase+"/orders/feed?scope_kind=rig&scope_ref="+url.QueryEscape(rigName)+"&limit=25", nil, http.StatusOK)
+	history := liveContractJSON[struct {
+		Entries []struct {
+			BeadID    string `json:"bead_id"`
+			StoreRef  string `json:"store_ref"`
+			HasOutput bool   `json:"has_output"`
+		} `json:"entries"`
+	}](t, baseURL, v, http.MethodGet, cityBase+"/orders/history?scoped_name="+url.QueryEscape(scopedName)+"&limit=20", nil, http.StatusOK)
+	if len(history.Entries) == 0 || history.Entries[0].BeadID != orderRun.ID {
+		t.Fatalf("order history = %+v, want entry for %q", history, orderRun.ID)
+	}
+	detailPath := cityBase + "/order/history/" + url.PathEscape(history.Entries[0].BeadID)
+	if history.Entries[0].StoreRef != "" {
+		detailPath += "?store_ref=" + url.QueryEscape(history.Entries[0].StoreRef)
+	}
+	detail := liveContractJSON[struct {
+		BeadID string `json:"bead_id"`
+		Output string `json:"output"`
+	}](t, baseURL, v, http.MethodGet, detailPath, nil, http.StatusOK)
+	if detail.BeadID != orderRun.ID || !strings.Contains(detail.Output, "hello from live contract") {
+		t.Fatalf("order history detail = %+v, want output for %q", detail, orderRun.ID)
+	}
+}
+
+func formulaListContains(items []struct {
+	Name string `json:"name"`
+}, want string,
+) bool {
+	for _, item := range items {
+		if item.Name == want {
+			return true
+		}
+	}
+	return false
+}
+
 func liveContractValidator(t *testing.T, specBytes []byte) openapivalidator.Validator {
 	t.Helper()
 	doc, err := libopenapi.NewDocument(specBytes)
@@ -352,11 +1023,19 @@ func liveContractJSON[T any](t *testing.T, baseURL string, v openapivalidator.Va
 }
 
 func liveContractRequest(t *testing.T, baseURL string, v openapivalidator.Validator, method, path string, body any, wantStatus int) []byte {
+	t.Helper()
+	return liveContractRequestWithHeaders(t, baseURL, v, method, path, body, wantStatus, nil)
+}
+
+func liveContractRequestWithHeaders(t *testing.T, baseURL string, v openapivalidator.Validator, method, path string, body any, wantStatus int, headers map[string]string) []byte {
 	t.Helper()
 	req, err := liveContractHTTPRequest(baseURL, method, path, body)
 	if err != nil {
 		t.Fatalf("%s %s build request: %v", method, path, err)
 	}
+	for name, value := range headers {
+		req.Header.Set(name, value)
+	}
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		t.Fatalf("%s %s: %v", method, path, err)
@@ -375,6 +1054,39 @@ func liveContractRequest(t *testing.T, baseURL string, v openapivalidator.Valida
 	return raw
 }
 
+func liveContractRequestOneOf(t *testing.T, baseURL string, v openapivalidator.Validator, method, path string, body any, wantStatuses []int) []byte {
+	t.Helper()
+	req, err := liveContractHTTPRequest(baseURL, method, path, body)
+	if err != nil {
+		t.Fatalf("%s %s build request: %v", method, path, err)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, path, err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("%s %s read response: %v", method, path, err)
+	}
+	if !intListContains(wantStatuses, resp.StatusCode) {
+		t.Fatalf("%s %s status = %d, want one of %v; body: %s", method, path, resp.StatusCode, wantStatuses, string(raw))
+	}
+	if v != nil {
+		validateLiveContractResponse(t, v, req, resp, raw)
+	}
+	return raw
+}
+
+func intListContains(items []int, want int) bool {
+	for _, item := range items {
+		if item == want {
+			return true
+		}
+	}
+	return false
+}
+
 func liveContractHTTPRequest(baseURL, method, path string, body any) (*http.Request, error) {
 	var reader io.Reader
 	if body != nil {
@@ -400,7 +1112,7 @@ func liveContractHTTPRequest(baseURL, method, path string, body any) (*http.Requ
 
 func assertLiveContractStreamOpens(t *testing.T, baseURL, path string) {
 	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 	defer cancel()
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, baseURL+path, nil)
 	if err != nil {
@@ -440,6 +1152,136 @@ func validateLiveContractResponse(t *testing.T, v openapivalidator.Validator, re
 	t.Fatalf("%s %s response does not match OpenAPI schema:\n%sbody: %s", req.Method, req.URL.Path, details.String(), string(raw))
 }
 
+func waitForLiveContractRequestID[T any](t *testing.T, baseURL string, v openapivalidator.Validator, path, requestID, successType string, timeout time.Duration, eventCursor string) T {
+	t.Helper()
+	env := waitForLiveContractRequestEvent(t, baseURL, path, requestID, successType, timeout, eventCursor)
+	var payload T
+	if err := json.Unmarshal(env.Payload, &payload); err != nil {
+		t.Fatalf("%s payload for request_id=%s did not decode: %v\npayload: %s", successType, requestID, err, string(env.Payload))
+	}
+	return payload
+}
+
+func waitForLiveContractRequestEvent(t *testing.T, baseURL, path, requestID, successType string, timeout time.Duration, eventCursor string) contractEvent {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	cursor := strings.TrimSpace(eventCursor)
+	streamPath := path
+	if strings.HasSuffix(streamPath, "/events") && streamPath != "/v0/events" {
+		streamPath += "/stream"
+		if cursor != "" {
+			streamPath += "?after_seq=" + url.QueryEscape(cursor)
+		} else {
+			streamPath += "?after_seq=0"
+		}
+	} else {
+		streamPath = strings.TrimSuffix(streamPath, "/") + "/stream"
+		if cursor != "" {
+			streamPath += "?after_cursor=" + url.QueryEscape(cursor)
+		} else {
+			streamPath += "?after_cursor=0"
+		}
+	}
+	if path == "/v0/events" {
+		streamPath = "/v0/events/stream"
+		if cursor != "" {
+			streamPath += "?after_cursor=" + url.QueryEscape(cursor)
+		} else {
+			streamPath += "?after_cursor=0"
+		}
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, baseURL+streamPath, nil)
+	if err != nil {
+		t.Fatalf("build SSE request %s: %v", streamPath, err)
+	}
+	req.Header.Set("Accept", "text/event-stream")
+	req.Header.Set("X-GC-Request", "live-contract")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET %s SSE: %v", streamPath, err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		raw, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		t.Fatalf("GET %s SSE status = %d, want 200; body: %s", streamPath, resp.StatusCode, string(raw))
+	}
+
+	scanner := bufio.NewScanner(resp.Body)
+	scanner.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
+	var data strings.Builder
+	observed := 0
+	var recent []string
+	remember := func(event contractEvent) {
+		observed++
+		req := liveContractEventPayloadRequestID(event.Payload)
+		desc := event.Type
+		if event.City != "" {
+			desc += " city=" + event.City
+		}
+		if event.Subject != "" {
+			desc += " subject=" + event.Subject
+		}
+		if req != "" {
+			desc += " request_id=" + req
+		}
+		recent = append(recent, desc)
+		if len(recent) > 8 {
+			recent = recent[1:]
+		}
+	}
+	for scanner.Scan() {
+		line := scanner.Text()
+		switch {
+		case strings.HasPrefix(line, "data:"):
+			value := strings.TrimPrefix(line, "data:")
+			value = strings.TrimPrefix(value, " ")
+			if data.Len() > 0 {
+				data.WriteByte('\n')
+			}
+			data.WriteString(value)
+		case line == "":
+			if data.Len() == 0 {
+				continue
+			}
+			var event contractEvent
+			if err := json.Unmarshal([]byte(data.String()), &event); err != nil {
+				t.Fatalf("decode SSE event from %s: %v; data=%s", streamPath, err, data.String())
+			}
+			data.Reset()
+			remember(event)
+			if event.Type == successType && liveContractEventPayloadRequestID(event.Payload) == requestID {
+				return event
+			}
+			if event.Type == "request.failed" && liveContractEventPayloadRequestID(event.Payload) == requestID {
+				var payload struct {
+					ErrorCode    string `json:"error_code"`
+					ErrorMessage string `json:"error_message"`
+				}
+				_ = json.Unmarshal(event.Payload, &payload)
+				t.Fatalf("request.failed for request_id=%s: %s: %s", requestID, payload.ErrorCode, payload.ErrorMessage)
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil && ctx.Err() == nil {
+		t.Fatalf("scan SSE %s: %v", streamPath, err)
+	}
+	t.Fatalf("timed out waiting for %s for request_id=%s from %s after observing %d SSE data frames; recent=%v", successType, requestID, streamPath, observed, recent)
+	return contractEvent{}
+}
+
+func liveContractEventPayloadRequestID(raw json.RawMessage) string {
+	var payload struct {
+		RequestID string `json:"request_id"`
+	}
+	if err := json.Unmarshal(raw, &payload); err != nil {
+		return ""
+	}
+	return payload.RequestID
+}
+
 func waitForLiveContractEvent(t *testing.T, baseURL string, v openapivalidator.Validator, path, subject, eventType string, timeout time.Duration) {
 	t.Helper()
 	deadline := time.Now().Add(timeout)
@@ -456,7 +1298,7 @@ func waitForLiveContractEvent(t *testing.T, baseURL string, v openapivalidator.V
 				return
 			}
 			if event.Subject == subject && strings.HasSuffix(event.Type, "_failed") {
-				t.Fatalf("event %s for %s failed: %+v", event.Type, subject, event.Payload)
+				t.Fatalf("event %s for %s failed: %s", event.Type, subject, string(event.Payload))
 			}
 		}
 		time.Sleep(250 * time.Millisecond)
@@ -574,6 +1416,47 @@ func liveContractRigList(baseURL string, v openapivalidator.Validator, cityBase
 	return rigs, nil
 }
 
+func waitForLiveContractAgent(t *testing.T, baseURL string, v openapivalidator.Validator, cityBase, targetAgent string, timeout time.Duration) {
+	t.Helper()
+	dir, base, ok := strings.Cut(targetAgent, "/")
+	if !ok || dir == "" || base == "" {
+		t.Fatalf("target agent %q is not a qualified rig agent", targetAgent)
+	}
+	path := cityBase + "/agent/" + url.PathEscape(dir) + "/" + url.PathEscape(base)
+	deadline := time.Now().Add(timeout)
+	var lastErr error
+	for time.Now().Before(deadline) {
+		req, err := liveContractHTTPRequest(baseURL, http.MethodGet, path, nil)
+		if err != nil {
+			t.Fatalf("GET %s build request: %v", path, err)
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			lastErr = err
+			time.Sleep(250 * time.Millisecond)
+			continue
+		}
+		raw, readErr := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		if readErr != nil {
+			lastErr = readErr
+			time.Sleep(250 * time.Millisecond)
+			continue
+		}
+		if resp.StatusCode == http.StatusOK {
+			if v != nil {
+				resp.Body = io.NopCloser(bytes.NewReader(raw))
+				validateLiveContractResponse(t, v, req, resp, raw)
+				_ = resp.Body.Close()
+			}
+			return
+		}
+		lastErr = fmt.Errorf("GET %s status %d: %s", path, resp.StatusCode, string(raw))
+		time.Sleep(250 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for agent %q at %s; last error: %v", targetAgent, path, lastErr)
+}
+
 func runLiveContractReadSweep(t *testing.T, baseURL string, v openapivalidator.Validator, specBytes []byte, cityName, rigName string) {
 	t.Helper()
 	probes := collectLiveContractReadProbes(t, specBytes, cityName, rigName)
@@ -692,9 +1575,59 @@ func assertLiveContractSpec(t *testing.T, specBytes []byte) {
 			cityPayloadRefs = append(cityPayloadRefs, ref)
 		}
 	}
-	if len(cityPayloadRefs) != 1 || !strings.Contains(cityPayloadRefs[0], "CityLifecyclePayload") {
-		t.Fatalf("EventPayload city lifecycle branches = %#v, want exactly CityLifecyclePayload", cityPayloadRefs)
+	for _, want := range []string{"CityLifecyclePayload", "CityCreateSucceededPayload", "CityUnregisterSucceededPayload"} {
+		if !refListContainsSchema(cityPayloadRefs, want) {
+			t.Fatalf("EventPayload city branches = %#v, missing %s", cityPayloadRefs, want)
+		}
+	}
+}
+
+func assertLiveContractRequiredOperations(t *testing.T, specBytes []byte) {
+	t.Helper()
+	var spec struct {
+		Paths map[string]map[string]struct {
+			OperationID string `json:"operationId"`
+		} `json:"paths"`
+	}
+	if err := json.Unmarshal(specBytes, &spec); err != nil {
+		t.Fatalf("decode OpenAPI paths: %v", err)
 	}
+
+	type operationShape struct {
+		Method       string
+		PathTemplate string
+	}
+	operations := make(map[string]operationShape)
+	for pathTemplate, pathItem := range spec.Paths {
+		for method, operation := range pathItem {
+			if operation.OperationID == "" {
+				continue
+			}
+			operations[operation.OperationID] = operationShape{
+				Method:       strings.ToUpper(method),
+				PathTemplate: pathTemplate,
+			}
+		}
+	}
+
+	for _, required := range liveContractRequiredOperations {
+		found, ok := operations[required.OperationID]
+		if !ok {
+			t.Fatalf("OpenAPI missing required real-world app GC operation %s (%s %s)", required.OperationID, required.Method, required.PathTemplate)
+		}
+		if found.Method != required.Method || found.PathTemplate != required.PathTemplate {
+			t.Fatalf("OpenAPI operation %s = %s %s, want %s %s", required.OperationID, found.Method, found.PathTemplate, required.Method, required.PathTemplate)
+		}
+	}
+}
+
+func refListContainsSchema(refs []string, schema string) bool {
+	for _, ref := range refs {
+		if strings.HasSuffix(ref, "/"+schema) {
+			return true
+		}
+	}
+	return false
 }
 
 func containsString(items []string, want string) bool {
diff --git a/test/integration/graph_dispatch_test.go b/test/integration/graph_dispatch_test.go
index 7ab386455f..ed52b51a14 100644
--- a/test/integration/graph_dispatch_test.go
+++ b/test/integration/graph_dispatch_test.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"testing"
@@ -49,7 +50,7 @@ func TestGraphWorkflowSuccessPath(t *testing.T) {
 	cityDir := setupGraphWorkflowCity(t, "success")
 	issueID, workflowID := startScopedWorkflow(t, cityDir)
 
-	workflow := waitForBeadClosed(t, cityDir, workflowID, 180*time.Second)
+	workflow := waitForBeadClosed(t, cityDir, workflowID, graphWorkflowCloseTimeout())
 	if got := metaValue(workflow, "gc.outcome"); got != "pass" {
 		t.Fatalf("workflow outcome = %q, want pass", got)
 	}
@@ -94,7 +95,7 @@ func TestGraphWorkflowFailureRunsCleanup(t *testing.T) {
 	cityDir := setupGraphWorkflowCity(t, "fail-preflight")
 	issueID, workflowID := startScopedWorkflow(t, cityDir)
 
-	workflow := waitForBeadClosed(t, cityDir, workflowID, 180*time.Second)
+	workflow := waitForBeadClosed(t, cityDir, workflowID, graphWorkflowCloseTimeout())
 	if got := metaValue(workflow, "gc.outcome"); got != "fail" {
 		t.Fatalf("workflow outcome = %q, want fail", got)
 	}
@@ -140,7 +141,7 @@ func TestGraphWorkflowFailureRunsCleanup(t *testing.T) {
 func assertControlDispatcherLane(t *testing.T, cityDir string) {
 	t.Helper()
 
-	workflowTrace := readOptionalFile(filepath.Join(cityDir, "control-dispatcher-trace.log"))
+	workflowTrace := readOptionalFile(filepath.Join(cityDir, ".gc", "runtime", "control-dispatcher-trace.log"))
 	if !strings.Contains(workflowTrace, "serve process bead=") {
 		t.Fatalf("control-dispatcher trace missing processed control bead evidence:\n%s", workflowTrace)
 	}
@@ -151,6 +152,13 @@ func assertControlDispatcherLane(t *testing.T, cityDir string) {
 	}
 }
 
+func graphWorkflowCloseTimeout() time.Duration {
+	if runtime.GOOS == "darwin" {
+		return 6 * time.Minute
+	}
+	return 180 * time.Second
+}
+
 func setupGraphWorkflowCity(t *testing.T, mode string) string {
 	t.Helper()
 	env := newIsolatedCommandEnv(t, true)
@@ -262,7 +270,7 @@ func waitForBeadClosed(t *testing.T, cityDir, beadID string, timeout time.Durati
 		sessionPeekOut = fmt.Sprintf("gc session peek worker failed: %v\noutput: %s", sessionPeekErr, sessionPeekOut)
 	}
 	traceOut := readOptionalFile(filepath.Join(cityDir, "graph-workflow-trace.log"))
-	workflowTraceOut := readOptionalFile(filepath.Join(cityDir, "control-dispatcher-trace.log"))
+	workflowTraceOut := readOptionalFile(filepath.Join(cityDir, ".gc", "runtime", "control-dispatcher-trace.log"))
 	t.Fatalf("waiting for bead %s to close failed: %v\nready:\n%s\nready worker:\n%s\nsessions:\n%s\nworker peek:\n%s\ntrace:\n%s\nworkflow trace:\n%s\nbeads:\n%s",
 		beadID, waitErr, readyOut, readyAssigneeOut, sessionListOut, sessionPeekOut, traceOut, workflowTraceOut, out)
 	return graphBead{}
diff --git a/test/integration/helpers_test.go b/test/integration/helpers_test.go
index 7e1aa98aae..5e8d8ad671 100644
--- a/test/integration/helpers_test.go
+++ b/test/integration/helpers_test.go
@@ -119,6 +119,9 @@ func initCityWithManagedDoltRecovery(t *testing.T, env []string, configPath, cit
 	for attempt := 1; attempt <= 2; attempt++ {
 		out, err = runGCDoltWithEnv(env, "", "init", "--skip-provider-readiness", "--file", configPath, cityDir)
 		if err == nil {
+			if readyOut, readyErr := waitForManagedDoltCityReady(env, cityDir, 20*time.Second); readyErr != nil {
+				t.Fatalf("gc init succeeded but managed Dolt city never became ready: %v\nlast bd output: %s", readyErr, readyOut)
+			}
 			return
 		}
 
diff --git a/test/integration/huma_binary_test.go b/test/integration/huma_binary_test.go
index 902087883d..004a1b7740 100644
--- a/test/integration/huma_binary_test.go
+++ b/test/integration/huma_binary_test.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -294,10 +295,10 @@ func waitHTTP(t *testing.T, url string, deadline time.Duration) {
 // TestHumaBinary_CityCreateAsync exercises the async POST /v0/city
 // contract end-to-end against a live supervisor: subscribe to
 // /v0/events/stream, POST /v0/city, verify the handler returns 202
-// immediately with {ok, name, path}, then assert a city.ready event
-// for that city name arrives on the SSE stream. This is the test MC's
+// immediately with {request_id}, then assert a request.result.city.create event
+// for that city name arrives on the SSE stream. This is the test a real-world app's
 // live contract harness implicitly needs — without it, any
-// regression in Scaffold, the reconciler's city.ready emission, or
+// regression in Scaffold, the reconciler's city create completion emission, or
 // the supervisor event multiplexer would ship unnoticed.
 //
 // Build-tagged `integration`; run with:
@@ -374,34 +375,32 @@ func TestHumaBinary_CityCreateAsync(t *testing.T) {
 		t.Errorf("POST /v0/city took %s, want fast scaffold response (<20s); async contract is broken", postDur)
 	}
 	var createResp struct {
-		OK   bool   `json:"ok"`
-		Name string `json:"name"`
-		Path string `json:"path"`
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
 	}
 	if err := json.Unmarshal(postBody, &createResp); err != nil {
 		t.Fatalf("decode create response: %v; body: %s", err, string(postBody))
 	}
-	if !createResp.OK {
-		t.Errorf("ok = false; body: %s", string(postBody))
+	if createResp.RequestID == "" {
+		t.Fatalf("empty request_id in response; body: %s", string(postBody))
 	}
-	if createResp.Name == "" {
-		t.Fatalf("empty city name in response; body: %s", string(postBody))
+	if createResp.EventCursor == "" {
+		t.Fatalf("empty event_cursor in response; body: %s", string(postBody))
 	}
-	if createResp.Path != cityDir {
-		t.Errorf("path = %q, want %q", createResp.Path, cityDir)
-	}
-	t.Logf("POST /v0/city returned 202 in %s for city %q", postDur.Round(time.Millisecond), createResp.Name)
+	// The city name is the basename of cityDir.
+	cityName := filepath.Base(cityDir)
+	t.Logf("POST /v0/city returned 202 in %s for city %q (request_id=%s)", postDur.Round(time.Millisecond), cityName, createResp.RequestID)
 
 	// 2. Subscribe to /v0/events/stream. No retry: Scaffold writes
 	// the city to cities.toml synchronously before POST returns, and
 	// TransientCityEventProviders reads cities.toml directly, so the
 	// mux contains this city's event provider by the time the client
-	// receives 202. after_cursor=0 requests replay from the start
-	// so the client doesn't miss city.ready if it fires between POST
-	// return and subscribe.
+	// receives 202. event_cursor is the supervisor head captured before
+	// acceptance, so the client catches this request's result without
+	// replaying unrelated historical backlog.
 	streamCtx, streamCancel := context.WithTimeout(context.Background(), 90*time.Second)
 	t.Cleanup(streamCancel)
-	streamReq, err := http.NewRequestWithContext(streamCtx, http.MethodGet, baseURL+"/v0/events/stream?after_cursor=0", nil)
+	streamReq, err := http.NewRequestWithContext(streamCtx, http.MethodGet, baseURL+"/v0/events/stream?after_cursor="+url.QueryEscape(createResp.EventCursor), nil)
 	if err != nil {
 		t.Fatalf("build stream request: %v", err)
 	}
@@ -422,17 +421,18 @@ func TestHumaBinary_CityCreateAsync(t *testing.T) {
 	eventLines := make(chan string, 128)
 	go readSSEFrames(streamResp.Body, eventLines)
 
-	// 3. Wait for city.ready (or city.init_failed) on the SSE stream
-	// whose envelope Subject == createResp.Name. This is the async
-	// completion contract the MC live harness relies on.
+	// 3. Wait for request.result.city.create (or request.failed with
+	// operation=city.create) on the SSE stream whose envelope Subject
+	// == cityName. This is the async completion contract the real-world app live
+	// harness relies on.
 	deadline := time.After(120 * time.Second)
 	for {
 		select {
 		case <-deadline:
-			t.Fatalf("timed out waiting for city.ready for %q; collected %d lines so far", createResp.Name, len(eventLines))
+			t.Fatalf("timed out waiting for request.result.city.create for %q; collected %d lines so far", cityName, len(eventLines))
 		case line, ok := <-eventLines:
 			if !ok {
-				t.Fatalf("SSE stream closed before city.ready for %q arrived", createResp.Name)
+				t.Fatalf("SSE stream closed before request.result.city.create for %q arrived", cityName)
 			}
 			// SSE "data:" lines carry JSON envelopes. Ignore
 			// heartbeats, comments, framing lines.
@@ -441,21 +441,30 @@ func TestHumaBinary_CityCreateAsync(t *testing.T) {
 			}
 			payload := strings.TrimPrefix(line, "data: ")
 			var env struct {
-				Type    string `json:"type"`
-				Subject string `json:"subject"`
+				Type    string          `json:"type"`
+				Subject string          `json:"subject"`
+				Payload json.RawMessage `json:"payload"`
 			}
 			if err := json.Unmarshal([]byte(payload), &env); err != nil {
 				continue
 			}
-			if env.Subject != createResp.Name {
+			if env.Subject != cityName || !payloadRequestIDMatches(env.Payload, createResp.RequestID) {
 				continue
 			}
 			switch env.Type {
-			case "city.ready":
-				t.Logf("received city.ready for %q — async contract satisfied", createResp.Name)
+			case "request.result.city.create":
+				t.Logf("received request.result.city.create for %q — async contract satisfied", cityName)
 				return
-			case "city.init_failed":
-				t.Fatalf("received city.init_failed for %q: %s", createResp.Name, payload)
+			case "request.failed":
+				var result struct {
+					Payload struct {
+						RequestID string `json:"request_id"`
+						Operation string `json:"operation"`
+					} `json:"payload"`
+				}
+				if err := json.Unmarshal([]byte(payload), &result); err == nil && result.Payload.RequestID == createResp.RequestID && result.Payload.Operation == "city.create" {
+					t.Fatalf("received request.failed(city.create) for %q: %s", cityName, payload)
+				}
 			}
 		}
 	}
@@ -463,8 +472,8 @@ func TestHumaBinary_CityCreateAsync(t *testing.T) {
 
 // TestHumaBinary_CityUnregisterAsync exercises the async
 // POST /v0/city/{cityName}/unregister contract end-to-end against a
-// live supervisor. Creates a city, waits for city.ready, then POSTs
-// unregister and asserts city.unregistered arrives on the same SSE
+// live supervisor. Creates a city, waits for create completion, then POSTs
+// unregister and asserts unregister completion arrives on the same SSE
 // stream. Symmetric with TestHumaBinary_CityCreateAsync.
 //
 // Build-tagged `integration`; run with:
@@ -532,20 +541,25 @@ func TestHumaBinary_CityUnregisterAsync(t *testing.T) {
 		t.Fatalf("POST /v0/city status = %d, want 202; body: %s", postResp.StatusCode, string(postBody))
 	}
 	var createResp struct {
-		Name string `json:"name"`
-		Path string `json:"path"`
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
 	}
 	if err := json.Unmarshal(postBody, &createResp); err != nil {
 		t.Fatalf("decode create response: %v; body: %s", err, string(postBody))
 	}
+	if createResp.EventCursor == "" {
+		t.Fatalf("empty city create event_cursor in response; body: %s", string(postBody))
+	}
+	// The city name is the basename of cityDir.
+	cityName := filepath.Base(cityDir)
 
-	// 2. Subscribe to /v0/events/stream and wait for city.ready so
+	// 2. Subscribe to /v0/events/stream and wait for city ready so
 	// we know the reconciler has fully adopted the city (the
 	// unregister reconcile path we're testing operates on the
 	// running set).
 	streamCtx, streamCancel := context.WithTimeout(context.Background(), 180*time.Second)
 	t.Cleanup(streamCancel)
-	streamReq, err := http.NewRequestWithContext(streamCtx, http.MethodGet, baseURL+"/v0/events/stream?after_cursor=0", nil)
+	streamReq, err := http.NewRequestWithContext(streamCtx, http.MethodGet, baseURL+"/v0/events/stream?after_cursor="+url.QueryEscape(createResp.EventCursor), nil)
 	if err != nil {
 		t.Fatalf("build stream request: %v", err)
 	}
@@ -568,30 +582,31 @@ ready:
 	for {
 		select {
 		case <-readyDeadline:
-			t.Fatalf("timed out waiting for city.ready for %q", createResp.Name)
+			t.Fatalf("timed out waiting for request.result.city.create for %q", cityName)
 		case line, ok := <-eventLines:
 			if !ok {
-				t.Fatalf("SSE stream closed before city.ready for %q arrived", createResp.Name)
+				t.Fatalf("SSE stream closed before request.result.city.create for %q arrived", cityName)
 			}
 			if !strings.HasPrefix(line, "data: ") {
 				continue
 			}
 			var env struct {
-				Type    string `json:"type"`
-				Subject string `json:"subject"`
+				Type    string          `json:"type"`
+				Subject string          `json:"subject"`
+				Payload json.RawMessage `json:"payload"`
 			}
 			if err := json.Unmarshal([]byte(strings.TrimPrefix(line, "data: ")), &env); err != nil {
 				continue
 			}
-			if env.Subject == createResp.Name && env.Type == "city.ready" {
+			if env.Type == "request.result.city.create" && payloadRequestIDMatches(env.Payload, createResp.RequestID) {
 				break ready
 			}
 		}
 	}
-	t.Logf("city %q ready; issuing unregister", createResp.Name)
+	t.Logf("city %q ready; issuing unregister", cityName)
 
 	// 3. POST /v0/city/{cityName}/unregister. Expect 202.
-	unregURL := baseURL + "/v0/city/" + createResp.Name + "/unregister"
+	unregURL := baseURL + "/v0/city/" + cityName + "/unregister"
 	unregReq, err := http.NewRequestWithContext(ctx, http.MethodPost, unregURL, nil)
 	if err != nil {
 		t.Fatalf("build unregister request: %v", err)
@@ -612,52 +627,80 @@ ready:
 		t.Errorf("POST unregister took %s, want fast response (<20s)", unregDur)
 	}
 	var unregBodyDecoded struct {
-		OK   bool   `json:"ok"`
-		Name string `json:"name"`
-		Path string `json:"path"`
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
 	}
 	if err := json.Unmarshal(unregBody, &unregBodyDecoded); err != nil {
 		t.Fatalf("decode unregister response: %v; body: %s", err, string(unregBody))
 	}
-	// macOS resolves /tmp -> /private/tmp at some boundaries; strip
-	// either prefix so the test survives wherever the canonicalization
-	// kicked in.
-	canonicalize := func(p string) string { return strings.TrimPrefix(p, "/private") }
-	if !unregBodyDecoded.OK || unregBodyDecoded.Name != createResp.Name || canonicalize(unregBodyDecoded.Path) != canonicalize(createResp.Path) {
-		t.Errorf("unregister response mismatch: got %+v, want ok=true name=%q path=%q", unregBodyDecoded, createResp.Name, createResp.Path)
+	if unregBodyDecoded.RequestID == "" {
+		t.Errorf("unregister response missing request_id; body: %s", string(unregBody))
+	}
+	if unregBodyDecoded.EventCursor == "" {
+		t.Fatalf("unregister response missing event_cursor; body: %s", string(unregBody))
+	}
+	t.Logf("POST unregister returned 202 in %s (request_id=%s)", unregDur.Round(time.Millisecond), unregBodyDecoded.RequestID)
+
+	// 4. Wait for request.result.city.unregister (or request.failed
+	// with operation=city.unregister) on a stream opened after the POST
+	// from the returned event cursor.
+	unregStreamCtx, unregStreamCancel := context.WithTimeout(context.Background(), 120*time.Second)
+	t.Cleanup(unregStreamCancel)
+	unregStreamReq, err := http.NewRequestWithContext(unregStreamCtx, http.MethodGet, baseURL+"/v0/events/stream?after_cursor="+url.QueryEscape(unregBodyDecoded.EventCursor), nil)
+	if err != nil {
+		t.Fatalf("build unregister stream request: %v", err)
+	}
+	unregStreamReq.Header.Set("Accept", "text/event-stream")
+	unregStreamResp, err := http.DefaultClient.Do(unregStreamReq)
+	if err != nil {
+		t.Fatalf("GET /v0/events/stream for unregister: %v", err)
+	}
+	defer unregStreamResp.Body.Close() //nolint:errcheck
+	if unregStreamResp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(unregStreamResp.Body)
+		t.Fatalf("GET /v0/events/stream for unregister status = %d, want 200; body: %s", unregStreamResp.StatusCode, string(b))
 	}
-	t.Logf("POST unregister returned 202 in %s", unregDur.Round(time.Millisecond))
+	unregEventLines := make(chan string, 256)
+	go readSSEFrames(unregStreamResp.Body, unregEventLines)
 
-	// 4. Wait for city.unregistered (or city.unregister_failed) on
-	// the SSE stream.
 	unregDeadline := time.After(120 * time.Second)
 	for {
 		select {
 		case <-unregDeadline:
-			t.Fatalf("timed out waiting for city.unregistered for %q", createResp.Name)
-		case line, ok := <-eventLines:
+			t.Fatalf("timed out waiting for request.result.city.unregister for %q", cityName)
+		case line, ok := <-unregEventLines:
 			if !ok {
-				t.Fatalf("SSE stream closed before city.unregistered for %q arrived", createResp.Name)
+				t.Fatalf("SSE stream closed before request.result.city.unregister for %q arrived", cityName)
 			}
 			if !strings.HasPrefix(line, "data: ") {
 				continue
 			}
+			payload := strings.TrimPrefix(line, "data: ")
 			var env struct {
-				Type    string `json:"type"`
-				Subject string `json:"subject"`
+				Type    string          `json:"type"`
+				Subject string          `json:"subject"`
+				Payload json.RawMessage `json:"payload"`
 			}
-			if err := json.Unmarshal([]byte(strings.TrimPrefix(line, "data: ")), &env); err != nil {
+			if err := json.Unmarshal([]byte(payload), &env); err != nil {
 				continue
 			}
-			if env.Subject != createResp.Name {
+			if env.Subject != cityName || !payloadRequestIDMatches(env.Payload, unregBodyDecoded.RequestID) {
 				continue
 			}
 			switch env.Type {
-			case "city.unregistered":
-				t.Logf("received city.unregistered for %q — async unregister contract satisfied", createResp.Name)
+			case "request.result.city.unregister":
+				t.Logf("received request.result.city.unregister for %q — async contract satisfied", cityName)
 				return
-			case "city.unregister_failed":
-				t.Fatalf("received city.unregister_failed for %q: %s", createResp.Name, strings.TrimPrefix(line, "data: "))
+			case "request.failed":
+				var result struct {
+					Payload struct {
+						RequestID string `json:"request_id"`
+						Operation string `json:"operation"`
+					} `json:"payload"`
+				}
+				if err := json.Unmarshal([]byte(payload), &result); err == nil && result.Payload.RequestID == unregBodyDecoded.RequestID && result.Payload.Operation == "city.unregister" {
+					t.Fatalf("received request.failed(city.unregister) for %q: %s", cityName, payload)
+				}
 			}
 		}
 	}
@@ -689,3 +732,293 @@ func readSSEFrames(body io.ReadCloser, out chan<- string) {
 		}
 	}
 }
+
+// TestHumaBinary_SessionMessageAsync exercises the async POST
+// /v0/city/{cityName}/session/{id}/messages contract end-to-end:
+// create a city, wait for it to be ready, create a provider session,
+// suspend it, send a message, assert 202 returns immediately, then
+// wait for a request.result.session.message event on the SSE stream.
+func TestHumaBinary_SessionMessageAsync(t *testing.T) {
+	bin := buildGCBinary(t)
+
+	root := shortTempDir(t)
+	gcHome := filepath.Join(root, "home")
+	runtimeDir := filepath.Join(root, "run")
+	for _, dir := range []string{gcHome, runtimeDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatalf("mkdir %s: %v", dir, err)
+		}
+	}
+	port := reserveFreePort(t)
+	writeSupervisorConfig(t, gcHome, port)
+	if err := seedDoltIdentityForRoot(gcHome); err != nil {
+		t.Fatalf("seed dolt identity: %v", err)
+	}
+
+	baseURL := "http://127.0.0.1:" + strconv.Itoa(port)
+	env := integrationEnvFor(gcHome, runtimeDir, true)
+	env = append(env, "GC_SESSION=fake")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	cmd := exec.CommandContext(ctx, bin, "supervisor", "run")
+	cmd.Env = env
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		t.Fatalf("stderr pipe: %v", err)
+	}
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start supervisor: %v", err)
+	}
+	var supervisorLog strings.Builder
+	go func() { _, _ = io.Copy(&supervisorLog, stderr) }()
+	t.Cleanup(func() {
+		cancel()
+		_ = cmd.Wait()
+		if t.Failed() {
+			t.Logf("supervisor stderr:\n%s", supervisorLog.String())
+		}
+	})
+
+	waitHTTP(t, baseURL+"/health", 10*time.Second)
+
+	// 1. Create a city with fake session provider so provider
+	// startup is instant (no real Claude CLI needed).
+	cityDir := filepath.Join(gcHome, "msg-test-city")
+	cityBody := `{"dir":"` + cityDir + `","provider":"claude"}`
+	postReq, _ := http.NewRequestWithContext(ctx, http.MethodPost, baseURL+"/v0/city", strings.NewReader(cityBody))
+	postReq.Header.Set("Content-Type", "application/json")
+	postReq.Header.Set("X-GC-Request", "true")
+	postResp, err := http.DefaultClient.Do(postReq)
+	if err != nil {
+		t.Fatalf("POST /v0/city: %v", err)
+	}
+	postBody, _ := io.ReadAll(postResp.Body)
+	_ = postResp.Body.Close()
+	if postResp.StatusCode != http.StatusAccepted {
+		t.Fatalf("POST /v0/city status = %d, want 202; body: %s", postResp.StatusCode, string(postBody))
+	}
+	var createResp struct {
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
+	}
+	json.Unmarshal(postBody, &createResp) //nolint:errcheck
+	if createResp.RequestID == "" {
+		t.Fatalf("empty city create request_id in response; body: %s", string(postBody))
+	}
+	if createResp.EventCursor == "" {
+		t.Fatalf("empty city create event_cursor in response; body: %s", string(postBody))
+	}
+	cityName := filepath.Base(cityDir)
+	cityBase := baseURL + "/v0/city/" + cityName
+
+	// 2. Subscribe to events and wait for city ready.
+	streamCtx, streamCancel := context.WithTimeout(context.Background(), 120*time.Second)
+	t.Cleanup(streamCancel)
+	streamReq, _ := http.NewRequestWithContext(streamCtx, http.MethodGet, baseURL+"/v0/events/stream?after_cursor="+url.QueryEscape(createResp.EventCursor), nil)
+	streamReq.Header.Set("Accept", "text/event-stream")
+	streamResp, err := http.DefaultClient.Do(streamReq)
+	if err != nil {
+		t.Fatalf("GET /v0/events/stream: %v", err)
+	}
+	defer streamResp.Body.Close() //nolint:errcheck
+
+	eventLines := make(chan string, 256)
+	go readSSEFrames(streamResp.Body, eventLines)
+
+	waitForRequestResultOnStream(t, eventLines, createResp.RequestID, "request.result.city.create", 120*time.Second)
+	t.Logf("city %q ready", cityName)
+
+	// 3. Create a provider session.
+	sessBody := `{"kind":"provider","name":"claude","project_id":"alpha","title":"msg-async-test","alias":"msg-async-test"}`
+	sessReq, _ := http.NewRequestWithContext(ctx, http.MethodPost, cityBase+"/sessions", strings.NewReader(sessBody))
+	sessReq.Header.Set("Content-Type", "application/json")
+	sessReq.Header.Set("X-GC-Request", "true")
+	sessResp, err := http.DefaultClient.Do(sessReq)
+	if err != nil {
+		t.Fatalf("POST /sessions: %v", err)
+	}
+	sessRespBody, _ := io.ReadAll(sessResp.Body)
+	_ = sessResp.Body.Close()
+	if sessResp.StatusCode != http.StatusAccepted {
+		t.Fatalf("POST /sessions status = %d, want 202; body: %s", sessResp.StatusCode, string(sessRespBody))
+	}
+	var sessAccepted struct {
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
+	}
+	json.Unmarshal(sessRespBody, &sessAccepted) //nolint:errcheck
+	if sessAccepted.RequestID == "" {
+		t.Fatalf("empty session create request_id in response; body: %s", string(sessRespBody))
+	}
+	if sessAccepted.EventCursor == "" {
+		t.Fatalf("empty session create event_cursor in response; body: %s", string(sessRespBody))
+	}
+	var sessResult struct {
+		RequestID string `json:"request_id"`
+		Session   struct {
+			ID string `json:"id"`
+		} `json:"session"`
+	}
+	if payload := waitForRequestResultFromStreamURL(t, cityBase+"/events/stream?after_seq="+url.QueryEscape(sessAccepted.EventCursor), sessAccepted.RequestID, "request.result.session.create", 120*time.Second); payload != nil {
+		if err := json.Unmarshal(payload, &sessResult); err != nil {
+			t.Fatalf("decode session create result payload: %v; payload=%s", err, string(payload))
+		}
+	}
+	sessionID := sessResult.Session.ID
+	if sessionID == "" {
+		t.Fatalf("empty session ID in result for request_id=%s", sessAccepted.RequestID)
+	}
+	t.Logf("created session %q", sessionID)
+
+	// 4. Suspend the session.
+	suspReq, _ := http.NewRequestWithContext(ctx, http.MethodPost, cityBase+"/session/"+sessionID+"/suspend", nil)
+	suspReq.Header.Set("X-GC-Request", "true")
+	suspResp, err := http.DefaultClient.Do(suspReq)
+	if err != nil {
+		t.Fatalf("POST /suspend: %v", err)
+	}
+	_ = suspResp.Body.Close()
+	if suspResp.StatusCode != http.StatusOK {
+		t.Fatalf("POST /suspend status = %d, want 200", suspResp.StatusCode)
+	}
+	t.Logf("suspended session %q", sessionID)
+
+	// 5. Send a message — must return 202 immediately (async).
+	msgBody := `{"message":"hello after suspend"}`
+	msgReq, _ := http.NewRequestWithContext(ctx, http.MethodPost, cityBase+"/session/"+sessionID+"/messages", strings.NewReader(msgBody))
+	msgReq.Header.Set("Content-Type", "application/json")
+	msgReq.Header.Set("X-GC-Request", "true")
+	msgStart := time.Now()
+	msgResp, err := http.DefaultClient.Do(msgReq)
+	if err != nil {
+		t.Fatalf("POST /messages: %v", err)
+	}
+	msgDur := time.Since(msgStart)
+	msgRespBody, _ := io.ReadAll(msgResp.Body)
+	_ = msgResp.Body.Close()
+	if msgResp.StatusCode != http.StatusAccepted {
+		t.Fatalf("POST /messages status = %d, want 202; body: %s", msgResp.StatusCode, string(msgRespBody))
+	}
+	var msgAccepted struct {
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
+	}
+	json.Unmarshal(msgRespBody, &msgAccepted) //nolint:errcheck
+	if msgAccepted.RequestID == "" {
+		t.Fatalf("empty message request_id in response; body: %s", string(msgRespBody))
+	}
+	if msgAccepted.EventCursor == "" {
+		t.Fatalf("empty message event_cursor in response; body: %s", string(msgRespBody))
+	}
+	if msgDur > 5*time.Second {
+		t.Errorf("POST /messages took %s, want fast async response (<5s)", msgDur)
+	}
+	t.Logf("POST /messages returned 202 in %s", msgDur.Round(time.Millisecond))
+
+	// 6. Wait for request.result.session.message on the event stream.
+	waitForRequestResultFromStreamURL(t, cityBase+"/events/stream?after_seq="+url.QueryEscape(msgAccepted.EventCursor), msgAccepted.RequestID, "request.result.session.message", 120*time.Second)
+	t.Logf("request.result.session.message received for %q", sessionID)
+
+	// 7. Submit a follow-up message and wait for the async result.
+	submitBody := `{"message":"follow up after async message","intent":"follow_up"}`
+	submitReq, _ := http.NewRequestWithContext(ctx, http.MethodPost, cityBase+"/session/"+sessionID+"/submit", strings.NewReader(submitBody))
+	submitReq.Header.Set("Content-Type", "application/json")
+	submitReq.Header.Set("X-GC-Request", "true")
+	submitResp, err := http.DefaultClient.Do(submitReq)
+	if err != nil {
+		t.Fatalf("POST /submit: %v", err)
+	}
+	submitRespBody, _ := io.ReadAll(submitResp.Body)
+	_ = submitResp.Body.Close()
+	if submitResp.StatusCode != http.StatusAccepted {
+		t.Fatalf("POST /submit status = %d, want 202; body: %s", submitResp.StatusCode, string(submitRespBody))
+	}
+	var submitAccepted struct {
+		RequestID   string `json:"request_id"`
+		EventCursor string `json:"event_cursor"`
+	}
+	json.Unmarshal(submitRespBody, &submitAccepted) //nolint:errcheck
+	if submitAccepted.RequestID == "" {
+		t.Fatalf("empty submit request_id in response; body: %s", string(submitRespBody))
+	}
+	if submitAccepted.EventCursor == "" {
+		t.Fatalf("empty submit event_cursor in response; body: %s", string(submitRespBody))
+	}
+	waitForRequestResultFromStreamURL(t, cityBase+"/events/stream?after_seq="+url.QueryEscape(submitAccepted.EventCursor), submitAccepted.RequestID, "request.result.session.submit", 120*time.Second)
+	t.Logf("request.result.session.submit received for %q", sessionID)
+}
+
+func waitForRequestResultFromStreamURL(t *testing.T, streamURL, requestID, successType string, timeout time.Duration) json.RawMessage {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, streamURL, nil)
+	if err != nil {
+		t.Fatalf("build event stream request: %v", err)
+	}
+	req.Header.Set("Accept", "text/event-stream")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET %s: %v", streamURL, err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		t.Fatalf("GET %s status = %d, want 200; body: %s", streamURL, resp.StatusCode, string(body))
+	}
+	lines := make(chan string, 256)
+	go readSSEFrames(resp.Body, lines)
+	return waitForRequestResultOnStream(t, lines, requestID, successType, timeout)
+}
+
+// waitForRequestResultOnStream waits for a typed success event
+// (successType, e.g. "request.result.city.create") or request.failed
+// with the same request_id. Event type discriminates the payload shape.
+func waitForRequestResultOnStream(t *testing.T, eventLines <-chan string, requestID, successType string, timeout time.Duration) json.RawMessage {
+	t.Helper()
+	deadline := time.After(timeout)
+	for {
+		select {
+		case <-deadline:
+			t.Fatalf("timed out waiting for %s for request_id=%q", successType, requestID)
+		case line, ok := <-eventLines:
+			if !ok {
+				t.Fatalf("SSE stream closed before %s for request_id=%q arrived", successType, requestID)
+			}
+			if !strings.HasPrefix(line, "data: ") {
+				continue
+			}
+			raw := strings.TrimPrefix(line, "data: ")
+			var env struct {
+				Type    string          `json:"type"`
+				Payload json.RawMessage `json:"payload"`
+			}
+			if err := json.Unmarshal([]byte(raw), &env); err != nil {
+				continue
+			}
+			if !payloadRequestIDMatches(env.Payload, requestID) {
+				continue
+			}
+			if env.Type == successType {
+				return env.Payload
+			}
+			if env.Type == "request.failed" {
+				var result struct {
+					ErrorCode    string `json:"error_code"`
+					ErrorMessage string `json:"error_message"`
+				}
+				if err := json.Unmarshal(env.Payload, &result); err == nil {
+					t.Fatalf("request.failed for request_id=%q: %s: %s", requestID, result.ErrorCode, result.ErrorMessage)
+				}
+			}
+		}
+	}
+}
+
+func payloadRequestIDMatches(payload json.RawMessage, requestID string) bool {
+	var correlation struct {
+		RequestID string `json:"request_id"`
+	}
+	return json.Unmarshal(payload, &correlation) == nil && correlation.RequestID == requestID
+}
diff --git a/test/integration/integration_test.go b/test/integration/integration_test.go
index 704ae42ec0..a7201d8776 100644
--- a/test/integration/integration_test.go
+++ b/test/integration/integration_test.go
@@ -394,13 +394,66 @@ func gcDolt(dir string, args ...string) (string, error) {
 // bd runs the bd binary with the given args. If dir is non-empty, it sets
 // the working directory. Returns combined stdout+stderr and any error.
 func bd(dir string, args ...string) (string, error) {
-	out, err := runCommand(dir, commandEnvForDir(dir, false), integrationBDCommandTimeout, bdBinary, args...)
+	env := commandEnvForDir(dir, false)
+	if usesStandaloneBDWorkspace(dir, env) {
+		env = standaloneBDEnvForDir(dir)
+	}
+	out, err := runCommand(dir, env, integrationBDCommandTimeout, bdBinary, args...)
 	if err == nil || !shouldUseFileStoreBDFallback(dir, out, args) {
 		return out, err
 	}
 	return runFileStoreBD(dir, args...)
 }
 
+func standaloneBDEnvForDir(dir string) []string {
+	base := parseEnvList(integrationEnv())
+	keep := []string{
+		"HOME",
+		"PATH",
+		"TMPDIR",
+		"USER",
+		"LOGNAME",
+		"LANG",
+		"LC_ALL",
+		"TZ",
+		"DOLT_ROOT_PATH",
+		integrationRealBDBinaryEnv,
+		integrationGCBinaryEnv,
+		integrationDoltBinaryEnv,
+	}
+	env := make([]string, 0, len(keep)+3)
+	for _, key := range keep {
+		if value, ok := base[key]; ok {
+			env = append(env, key+"="+value)
+		}
+	}
+	// Keep DOLT_ROOT_PATH from integrationEnv so standalone bd commands use
+	// the suite's seeded Dolt identity instead of an unseeded per-workspace root.
+	// BEADS_DIR and XDG_RUNTIME_DIR are temp-scoped by caller-owned test dirs;
+	// bd's embedded-mode default needs no server shutdown, and server-mode tests
+	// should use their own explicit lifecycle instead of hiding it in this env.
+	env = append(env, "XDG_RUNTIME_DIR="+dir)
+	env = append(env, "BEADS_DIR="+filepath.Join(dir, ".beads"))
+	return append(env, "BEADS_DOLT_AUTO_START=1")
+}
+
+func usesStandaloneBDWorkspace(dir string, env []string) bool {
+	if parseEnvList(env)["GC_BEADS"] == "file" {
+		return false
+	}
+	return hasStandaloneBDWorkspace(dir)
+}
+
+func hasStandaloneBDWorkspace(dir string) bool {
+	if dir == "" {
+		return false
+	}
+	if _, err := os.Stat(filepath.Join(dir, ".beads", "config.yaml")); err == nil {
+		return true
+	}
+	return false
+}
+
 // bdDolt runs bd against a Dolt-backed city using the same isolated runtime
 // env as integration gc commands plus the city's managed Dolt port.
 func bdDolt(dir string, args ...string) (string, error) {
@@ -423,8 +476,17 @@ func bdDolt(dir string, args ...string) (string, error) {
 	if err == nil || dir == "" || !managedDoltTransportRetryable(out) {
 		return out, err
 	}
+	if _, readyErr := waitForManagedDoltCityReady(env, dir, 20*time.Second); readyErr == nil {
+		if port, ok := currentManagedDoltPortForTest(dir); ok {
+			env = appendManagedDoltEndpointEnv(env, port)
+		}
+		return runCommand(dir, env, integrationBDCommandTimeout, bdBinary, args...)
+	}
 	if port, ok := ensureManagedDoltPortForTest(dir); ok {
 		env = appendManagedDoltEndpointEnv(env, port)
+		if delay := managedDoltRetryDelay(out); delay > 0 {
+			time.Sleep(delay)
+		}
 		return runCommand(dir, env, integrationBDCommandTimeout, bdBinary, args...)
 	}
 	return out, err
@@ -659,12 +721,25 @@ func integrationEnvDolt() []string {
 
 func integrationEnvFor(gcHome, runtimeDir string, useDolt bool) []string {
 	env := filterEnv(os.Environ(), "GC_BEADS")
+	env = filterEnv(env, "BEADS_DIR")
+	env = filterEnv(env, "GC_BEADS_SCOPE_ROOT")
 	env = filterEnv(env, "GC_DOLT")
 	env = filterEnv(env, "PATH")
 	env = filterEnv(env, "GC_HOME")
+	env = filterEnv(env, "GC_DIR")
+	env = filterEnv(env, "GC_CITY")
+	env = filterEnv(env, "GC_CITY_PATH")
+	env = filterEnv(env, "GC_CITY_ROOT")
+	env = filterEnv(env, "GC_CITY_RUNTIME_DIR")
+	env = filterEnv(env, "GC_AGENT")
+	env = filterEnv(env, "GC_RIG")
+	env = filterEnv(env, "GC_RIG_ROOT")
+	env = filterEnv(env, "GC_TEMPLATE")
+	env = filterEnv(env, "GC_SESSION_NAME")
 	env = filterEnv(env, "XDG_RUNTIME_DIR")
 	env = filterEnv(env, integrationRealBDBinaryEnv)
 	env = filterEnv(env, "DOLT_ROOT_PATH")
+	env = filterEnv(env, "BEADS_ACTOR")
 	env = filterEnv(env, "GC_DOLT_HOST")
 	env = filterEnv(env, "GC_DOLT_PORT")
 	env = filterEnv(env, "GC_DOLT_USER")
@@ -672,7 +747,16 @@ func integrationEnvFor(gcHome, runtimeDir string, useDolt bool) []string {
 	env = filterEnv(env, "BEADS_DOLT_SERVER_HOST")
 	env = filterEnv(env, "BEADS_DOLT_SERVER_PORT")
 	env = filterEnv(env, "BEADS_DOLT_SERVER_USER")
+	env = filterEnv(env, "BEADS_DOLT_HOST")
+	env = filterEnv(env, "BEADS_DOLT_PORT")
+	env = filterEnv(env, "BEADS_DOLT_USER")
+	env = filterEnv(env, "BEADS_DOLT_DATABASE")
+	env = filterEnv(env, "BEADS_DOLT_DATA_DIR")
 	env = filterEnv(env, "BEADS_DOLT_PASSWORD")
+	env = filterEnv(env, "DOLT_HOST")
+	env = filterEnv(env, "DOLT_PORT")
+	env = filterEnv(env, "DOLT_USER")
+	env = filterEnv(env, "DOLT_PASSWORD")
 	env = filterEnv(env, integrationGCBinaryEnv)
 	env = filterEnv(env, integrationDoltBinaryEnv)
 	env = filterEnv(env, "BEADS_DOLT_AUTO_START")
@@ -937,12 +1021,16 @@ func ensureManagedDoltPortForTest(cityDir string) (string, bool) {
 func managedDoltTransportRetryable(out string) bool {
 	msg := strings.ToLower(out)
 	for _, marker := range []string{
+		"dolt circuit breaker is open",
+		"server appears down, failing fast",
 		"dolt server unreachable",
 		"dial tcp",
 		"connection refused",
 		"broken pipe",
 		"unexpected eof",
 		"bad connection",
+		"dolt circuit breaker is open",
+		"server appears down",
 	} {
 		if strings.Contains(msg, marker) {
 			return true
@@ -951,6 +1039,21 @@ func managedDoltTransportRetryable(out string) bool {
 	return false
 }
 
+func managedDoltRetryDelay(out string) time.Duration {
+	msg := strings.ToLower(out)
+	if strings.Contains(msg, "dolt circuit breaker is open") || strings.Contains(msg, "server appears down, failing fast") {
+		return 5 * time.Second
+	}
+	return 0
+}
+
+func TestManagedDoltTransportRetryableIncludesCircuitBreaker(t *testing.T) {
+	out := `{"error":"failed to open database: dolt circuit breaker is open: server appears down, failing fast (cooldown 5s)"}`
+	if !managedDoltTransportRetryable(out) {
+		t.Fatalf("managedDoltTransportRetryable(%q) = false, want true", out)
+	}
+}
+
 func testPortReachable(port string) bool {
 	conn, err := net.DialTimeout("tcp", net.JoinHostPort("127.0.0.1", port), 250*time.Millisecond)
 	if err != nil {
@@ -1081,14 +1184,40 @@ func TestIntegrationEnvForUsesIsolatedHome(t *testing.T) {
 	integrationToolBinDir = filepath.Join(t.TempDir(), "bin")
 
 	t.Setenv("HOME", "/host/home")
+	t.Setenv("BEADS_DIR", "/host/beads")
 	t.Setenv("GC_DOLT_HOST", "ambient-host")
 	t.Setenv("GC_DOLT_PORT", "0")
 	t.Setenv("GC_DOLT_USER", "ambient-user")
 	t.Setenv("GC_DOLT_PASSWORD", "ambient-password")
+	t.Setenv("BEADS_DIR", "/host/beads")
+	t.Setenv("BEADS_ACTOR", "ambient-actor")
+	t.Setenv("BEADS_DIR", "/host/repo/.beads")
 	t.Setenv("BEADS_DOLT_SERVER_HOST", "ambient-beads-host")
 	t.Setenv("BEADS_DOLT_SERVER_PORT", "0")
 	t.Setenv("BEADS_DOLT_SERVER_USER", "ambient-beads-user")
+	t.Setenv("BEADS_DOLT_HOST", "ambient-legacy-host")
+	t.Setenv("BEADS_DOLT_PORT", "0")
+	t.Setenv("BEADS_DOLT_USER", "ambient-legacy-user")
+	t.Setenv("BEADS_DOLT_DATABASE", "ambient-legacy-db")
+	t.Setenv("BEADS_DOLT_DATA_DIR", filepath.Join(t.TempDir(), "ambient-dolt-data"))
 	t.Setenv("BEADS_DOLT_PASSWORD", "ambient-beads-password")
+	t.Setenv("DOLT_HOST", "ambient-raw-host")
+	t.Setenv("DOLT_PORT", "0")
+	t.Setenv("DOLT_USER", "ambient-raw-user")
+	t.Setenv("DOLT_PASSWORD", "ambient-raw-password")
+	t.Setenv("BEADS_DIR", "/host/beads")
+	t.Setenv("BEADS_ACTOR", "host-agent")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "/host/scope")
+	t.Setenv("GC_DIR", "/host/gc-dir")
+	t.Setenv("GC_CITY", "/host/city")
+	t.Setenv("GC_CITY_PATH", "/host/city-path")
+	t.Setenv("GC_CITY_ROOT", "/host/city-root")
+	t.Setenv("GC_CITY_RUNTIME_DIR", "/host/runtime")
+	t.Setenv("GC_AGENT", "host-agent")
+	t.Setenv("GC_RIG", "host-rig")
+	t.Setenv("GC_RIG_ROOT", "/host/rig")
+	t.Setenv("GC_TEMPLATE", "host/template")
+	t.Setenv("GC_SESSION_NAME", "host-session")
 	env := integrationEnv()
 	got := parseEnvList(env)
 
@@ -1111,14 +1240,40 @@ func TestIntegrationEnvForUsesIsolatedHome(t *testing.T) {
 		t.Fatalf("BEADS_DOLT_AUTO_START = %q, want %q; tests must match bdRuntimeEnv and suppress bd's rogue auto-start", got["BEADS_DOLT_AUTO_START"], "0")
 	}
 	for _, key := range []string{
+		"BEADS_DIR",
+		"GC_BEADS_SCOPE_ROOT",
 		"GC_DOLT_HOST",
 		"GC_DOLT_PORT",
 		"GC_DOLT_USER",
 		"GC_DOLT_PASSWORD",
+		"BEADS_ACTOR",
+		"BEADS_DIR",
 		"BEADS_DOLT_SERVER_HOST",
 		"BEADS_DOLT_SERVER_PORT",
 		"BEADS_DOLT_SERVER_USER",
+		"BEADS_DOLT_HOST",
+		"BEADS_DOLT_PORT",
+		"BEADS_DOLT_USER",
+		"BEADS_DOLT_DATABASE",
+		"BEADS_DOLT_DATA_DIR",
 		"BEADS_DOLT_PASSWORD",
+		"DOLT_HOST",
+		"DOLT_PORT",
+		"DOLT_USER",
+		"DOLT_PASSWORD",
+		"BEADS_DIR",
+		"BEADS_ACTOR",
+		"GC_BEADS_SCOPE_ROOT",
+		"GC_DIR",
+		"GC_CITY",
+		"GC_CITY_PATH",
+		"GC_CITY_ROOT",
+		"GC_CITY_RUNTIME_DIR",
+		"GC_AGENT",
+		"GC_RIG",
+		"GC_RIG_ROOT",
+		"GC_TEMPLATE",
+		"GC_SESSION_NAME",
 	} {
 		if _, ok := got[key]; ok {
 			t.Fatalf("%s leaked into integration env: %v", key, got[key])
@@ -1126,6 +1281,134 @@ func TestIntegrationEnvForUsesIsolatedHome(t *testing.T) {
 	}
 }
 
+func TestManagedDoltTransportRetryableRecognizesCircuitBreaker(t *testing.T) {
+	output := `{"error":"failed to open database: dolt circuit breaker is open: server appears down, failing fast (cooldown 5s)"}`
+	if !managedDoltTransportRetryable(output) {
+		t.Fatalf("managedDoltTransportRetryable(%q) = false, want true", output)
+	}
+	if got := managedDoltRetryDelay(output); got < 5*time.Second {
+		t.Fatalf("managedDoltRetryDelay(%q) = %s, want at least 5s", output, got)
+	}
+	if got := managedDoltRetryDelay("dial tcp 127.0.0.1:3306: connect: connection refused"); got != 0 {
+		t.Fatalf("managedDoltRetryDelay for plain transport error = %s, want 0", got)
+	}
+}
+
+func TestStandaloneBDEnvAllowsBDAutoStart(t *testing.T) {
+	oldGCHome := testGCHome
+	oldRuntimeDir := testRuntimeDir
+	oldRealBDBinary := realBDBinary
+	oldToolBinDir := integrationToolBinDir
+	t.Cleanup(func() {
+		testGCHome = oldGCHome
+		testRuntimeDir = oldRuntimeDir
+		realBDBinary = oldRealBDBinary
+		integrationToolBinDir = oldToolBinDir
+	})
+
+	testGCHome = filepath.Join(t.TempDir(), "gc-home")
+	testRuntimeDir = filepath.Join(t.TempDir(), "runtime")
+	realBDBinary = "/usr/bin/bd"
+	integrationToolBinDir = filepath.Join(t.TempDir(), "bin")
+
+	t.Setenv("BEADS_DOLT_AUTO_START", "0")
+	t.Setenv("BEADS_DIR", "/host/beads")
+	t.Setenv("GC_DOLT", "skip")
+	t.Setenv("GC_DOLT_HOST", "ambient-host")
+	t.Setenv("GC_DOLT_PORT", "1234")
+	t.Setenv("GC_DOLT_USER", "ambient-user")
+	t.Setenv("GC_DOLT_PASSWORD", "ambient-password")
+	t.Setenv("GC_DOLT_STATE_FILE", "/host/dolt-state.json")
+	t.Setenv("GC_DOLT_CONFIG_FILE", "/host/dolt-config.yaml")
+	t.Setenv("GC_DOLT_DATA_DIR", "/host/dolt-data")
+	t.Setenv("GC_DOLT_LOG_FILE", "/host/dolt.log")
+	t.Setenv("GC_DOLT_PID_FILE", "/host/dolt.pid")
+	t.Setenv("GC_DOLT_LOCK_FILE", "/host/dolt.lock")
+	t.Setenv("GC_DOLT_MANAGED_LOCAL", "1")
+	t.Setenv("BEADS_DOLT_SERVER_HOST", "ambient-beads-host")
+	t.Setenv("BEADS_DOLT_SERVER_PORT", "5678")
+	t.Setenv("BEADS_DOLT_SERVER_USER", "ambient-beads-user")
+	t.Setenv("BEADS_DOLT_PASSWORD", "ambient-beads-password")
+	t.Setenv("BEADS_DOLT_HOST", "ambient-legacy-host")
+	t.Setenv("BEADS_DOLT_PORT", "9012")
+	t.Setenv("BEADS_DOLT_USER", "ambient-legacy-user")
+	t.Setenv("BEADS_DOLT_DATABASE", "ambient-legacy-db")
+	t.Setenv("BEADS_DOLT_DATA_DIR", filepath.Join(t.TempDir(), "ambient-dolt-data"))
+	t.Setenv("GC_CITY", "/host/city")
+	t.Setenv("GC_CITY_PATH", "/host/city")
+	t.Setenv("GC_CITY_RUNTIME_DIR", "/host/runtime")
+
+	dir := t.TempDir()
+	env := standaloneBDEnvForDir(dir)
+	got := parseEnvList(env)
+
+	if got["BEADS_DOLT_AUTO_START"] != "1" {
+		t.Fatalf("BEADS_DOLT_AUTO_START = %q, want 1", got["BEADS_DOLT_AUTO_START"])
+	}
+	if got["BEADS_DIR"] != filepath.Join(dir, ".beads") {
+		t.Fatalf("BEADS_DIR = %q, want %q", got["BEADS_DIR"], filepath.Join(dir, ".beads"))
+	}
+	if got["DOLT_ROOT_PATH"] != testGCHome {
+		t.Fatalf("DOLT_ROOT_PATH = %q, want seeded integration root %q", got["DOLT_ROOT_PATH"], testGCHome)
+	}
+	if got["XDG_RUNTIME_DIR"] != dir {
+		t.Fatalf("XDG_RUNTIME_DIR = %q, want %q", got["XDG_RUNTIME_DIR"], dir)
+	}
+	for _, key := range []string{
+		"GC_DOLT",
+		"GC_DOLT_HOST",
+		"GC_DOLT_PORT",
+		"GC_DOLT_USER",
+		"GC_DOLT_PASSWORD",
+		"GC_DOLT_STATE_FILE",
+		"GC_DOLT_CONFIG_FILE",
+		"GC_DOLT_DATA_DIR",
+		"GC_DOLT_LOG_FILE",
+		"GC_DOLT_PID_FILE",
+		"GC_DOLT_LOCK_FILE",
+		"GC_DOLT_MANAGED_LOCAL",
+		"BEADS_DOLT_SERVER_HOST",
+		"BEADS_DOLT_SERVER_PORT",
+		"BEADS_DOLT_SERVER_USER",
+		"BEADS_DOLT_PASSWORD",
+		"BEADS_DOLT_HOST",
+		"BEADS_DOLT_PORT",
+		"BEADS_DOLT_USER",
+		"BEADS_DOLT_DATABASE",
+		"BEADS_DOLT_DATA_DIR",
+		"GC_CITY",
+		"GC_CITY_PATH",
+		"GC_CITY_RUNTIME_DIR",
+	} {
+		if _, ok := got[key]; ok {
+			t.Fatalf("%s leaked into standalone bd env: %v", key, got[key])
+		}
+	}
+}
+
+func TestUsesStandaloneBDWorkspaceKeepsFileProviderOnShim(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, ".beads"), 0o755); err != nil {
+		t.Fatalf("mkdir .beads: %v", err)
+	}
+
+	if usesStandaloneBDWorkspace(dir, []string{"GC_BEADS=file"}) {
+		t.Fatal("file provider city should keep using the file-store bd shim")
+	}
+	if usesStandaloneBDWorkspace(dir, []string{"GC_BEADS=dolt"}) {
+		t.Fatal("bare .beads directory should not select the standalone bd env")
+	}
+	if err := os.WriteFile(filepath.Join(dir, ".beads", "config.yaml"), []byte("issue_prefix: test\n"), 0o644); err != nil {
+		t.Fatalf("write config.yaml: %v", err)
+	}
+	if usesStandaloneBDWorkspace(dir, []string{"GC_BEADS=file"}) {
+		t.Fatal("file provider city with config.yaml should keep using the file-store bd shim")
+	}
+	if !usesStandaloneBDWorkspace(dir, []string{"GC_BEADS=dolt"}) {
+		t.Fatal("standalone .beads workspace with config.yaml should use the standalone bd env")
+	}
+}
+
 func TestCommandEnvForDirPrefersRegisteredCityEnv(t *testing.T) {
 	cityDir := filepath.Join(t.TempDir(), "city")
 	want := []string{"HOME=/tmp/isolated", "GC_HOME=/tmp/isolated", "PATH=/tmp/bin"}
@@ -1151,6 +1434,63 @@ func TestCommandEnvLookupDirUsesRegisteredPathArg(t *testing.T) {
 	}
 }
 
+func TestStandaloneBdEnvIsolatesAmbientDoltConfig(t *testing.T) {
+	t.Setenv("HOME", "/host/home")
+	t.Setenv("GC_CITY", "/host/city")
+	t.Setenv("GC_CITY_PATH", "/host/city")
+	t.Setenv("GC_RIG", "host-rig")
+	t.Setenv("GC_BEADS", "bd")
+	t.Setenv("GC_BEADS_SCOPE_ROOT", "/host/repo")
+	t.Setenv("GC_DOLT", "server")
+	t.Setenv("GC_DOLT_HOST", "127.0.0.1")
+	t.Setenv("GC_DOLT_PORT", "0")
+	t.Setenv("GC_DOLT_USER", "ambient-user")
+	t.Setenv("GC_DOLT_PASSWORD", "ambient-password")
+	t.Setenv("BEADS_DIR", "/host/beads")
+	t.Setenv("BEADS_DOLT_AUTO_START", "0")
+	t.Setenv("BEADS_DOLT_SERVER_HOST", "127.0.0.1")
+	t.Setenv("BEADS_DOLT_SERVER_PORT", "0")
+	t.Setenv("BEADS_DOLT_SERVER_USER", "ambient-user")
+	t.Setenv("BEADS_DOLT_PASSWORD", "ambient-password")
+
+	dir := filepath.Join(t.TempDir(), "standalone")
+	got := parseEnvList(standaloneBdEnv(t, dir))
+
+	if got["HOME"] == "/host/home" || got["HOME"] == "" {
+		t.Fatalf("HOME = %q, want isolated non-empty home", got["HOME"])
+	}
+	if got["HOME"] != got["GC_HOME"] {
+		t.Fatalf("HOME = %q, want GC_HOME %q", got["HOME"], got["GC_HOME"])
+	}
+	if got["BEADS_DIR"] != filepath.Join(dir, ".beads") {
+		t.Fatalf("BEADS_DIR = %q, want standalone beads dir", got["BEADS_DIR"])
+	}
+	if got["BD_NON_INTERACTIVE"] != "1" {
+		t.Fatalf("BD_NON_INTERACTIVE = %q, want 1", got["BD_NON_INTERACTIVE"])
+	}
+	for _, key := range []string{
+		"GC_CITY",
+		"GC_CITY_PATH",
+		"GC_RIG",
+		"GC_BEADS",
+		"GC_BEADS_SCOPE_ROOT",
+		"GC_DOLT",
+		"GC_DOLT_HOST",
+		"GC_DOLT_PORT",
+		"GC_DOLT_USER",
+		"GC_DOLT_PASSWORD",
+		"BEADS_DOLT_AUTO_START",
+		"BEADS_DOLT_SERVER_HOST",
+		"BEADS_DOLT_SERVER_PORT",
+		"BEADS_DOLT_SERVER_USER",
+		"BEADS_DOLT_PASSWORD",
+	} {
+		if _, ok := got[key]; ok {
+			t.Fatalf("%s leaked into standalone bd env: %v", key, got)
+		}
+	}
+}
+
 func TestRenderE2ETomlPlainAgentUsesNamedSessionWithoutSingletonCap(t *testing.T) {
 	toml := renderE2EToml(e2eCity{
 		Agents: []e2eAgent{{Name: "worker", StartCommand: "sleep 3600"}},
diff --git a/test/integration/review_formula_test.go b/test/integration/review_formula_test.go
index 476aa0623f..fb56a03bd1 100644
--- a/test/integration/review_formula_test.go
+++ b/test/integration/review_formula_test.go
@@ -223,7 +223,11 @@ func TestAdoptPRFormulaRetriesTransientReviewerStep(t *testing.T) {
 
 	steps := listWorkflowSteps(t, cityDir, workflowID)
 	if !hasStepWithSuffix(steps, "review-pipeline.review-codex.attempt.2") {
-		t.Fatalf("missing retry attempt for codex reviewer; got: %v", steps)
+		trace := readOptionalFile(filepath.Join(cityDir, "graph-workflow-trace.log"))
+		if !traceShowsSameAttemptTransientRetry(trace, "review-loop.iteration.1.review-pipeline.review-codex.attempt.1") {
+			dumpWorkflowState(t, cityDir, workflowID)
+			t.Fatalf("missing retry attempt for codex reviewer; got: %v", steps)
+		}
 	}
 
 	logical := mustFindWorkflowBeadByRefSuffix(t, cityDir, workflowID, "review-loop.iteration.1.review-pipeline.review-codex")
@@ -234,7 +238,11 @@ func TestAdoptPRFormulaRetriesTransientReviewerStep(t *testing.T) {
 
 func TestAdoptPRFormulaSoftFailsGeminiAfterTransientRetries(t *testing.T) {
 	cityDir := setupReviewFormulaCity(t, "success", map[string]string{
-		"GC_GRAPH_ALWAYS_TRANSIENT_SUFFIXES": "review-loop.iteration.1.review-pipeline.review-gemini.attempt.",
+		"GC_GRAPH_ALWAYS_TRANSIENT_SUFFIXES": strings.Join([]string{
+			"review-loop.iteration.1.review-pipeline.review-gemini.attempt.1",
+			"review-loop.iteration.1.review-pipeline.review-gemini.attempt.2",
+			"review-loop.iteration.1.review-pipeline.review-gemini.attempt.3",
+		}, ","),
 	})
 	_, workflowID := startReviewWorkflow(t, cityDir, "mol-adopt-pr-v2", map[string]string{
 		"issue":       "",
@@ -255,6 +263,7 @@ func TestAdoptPRFormulaSoftFailsGeminiAfterTransientRetries(t *testing.T) {
 		"review-pipeline.review-gemini.attempt.3",
 	} {
 		if !hasStepWithSuffix(steps, suffix) {
+			dumpWorkflowState(t, cityDir, workflowID)
 			t.Fatalf("missing Gemini retry attempt %q; got: %v", suffix, steps)
 		}
 	}
@@ -321,7 +330,7 @@ on_exhausted = "hard_fail"
 	if !traceHasLineWithAll(trace, "exit-after-claim bead="+attempt2.ID, "ref="+attempt2.Ref) {
 		t.Fatalf("worker trace missing forced crash evidence:\n%s", trace)
 	}
-	if countTraceLinesWithAll(trace, "claim bead="+attempt2.ID) < 2 {
+	if countTraceLinesWithAll(trace, "claim bead="+attempt2.ID)+countTraceLinesWithAll(trace, "resume bead="+attempt2.ID) < 2 {
 		t.Fatalf("worker trace missing reclaim evidence for %s:\n%s", attempt2.ID, trace)
 	}
 	if !traceHasLineWithAll(trace, "run bead="+attempt2.ID, "ref="+attempt2.Ref) {
@@ -501,6 +510,22 @@ func hasStepWithSuffix(steps []string, suffix string) bool {
 	return false
 }
 
+func traceShowsSameAttemptTransientRetry(trace, stepRef string) bool {
+	runCount := 0
+	sawTransientClose := false
+	for _, line := range strings.Split(trace, "\n") {
+		if strings.Contains(line, " run bead=") && strings.Contains(line, "ref="+stepRef) {
+			runCount++
+		}
+		if strings.Contains(line, " close-fail bead=") &&
+			strings.Contains(line, "ref="+stepRef) &&
+			strings.Contains(line, "class=transient") {
+			sawTransientClose = true
+		}
+	}
+	return sawTransientClose && runCount >= 2
+}
+
 func dumpWorkflowState(t *testing.T, cityDir, workflowID string) {
 	t.Helper()
 	out, _ := bdDolt(cityDir, "list", "--json", "--all", "--limit=0")
diff --git a/test/packlint/gc_nudge_form_test.go b/test/packlint/gc_nudge_form_test.go
new file mode 100644
index 0000000000..f442473dbe
--- /dev/null
+++ b/test/packlint/gc_nudge_form_test.go
@@ -0,0 +1,241 @@
+// TestGcNudgeFormPositional guards issue #1491: the bare `gc nudge <target>
+// "msg"` form was retired when the `gc nudge` namespace was reduced to
+// `drain`/`status`/`poll`. The deprecated form falls through to help-text on
+// stderr and exits non-zero; every shipped call site wraps with
+// `2>/dev/null || true`, so it silently no-ops. The canonical send-form is
+// `gc session nudge <target> "msg"`. This test fails if a pack template,
+// formula, asset script, or shipped doc reintroduces the deprecated form.
+
+package packlint
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// nudgeScanDirs is the set of repo-root-relative directories whose embedded
+// shell text and command examples must use the canonical `gc session nudge`
+// form. Same set as `bd_show_jq_test.go` plus the user-facing docs tree,
+// which must not teach migrating users the deprecated form. Design-history
+// files under engdocs are intentionally out of scope.
+var nudgeScanDirs = []string{
+	"examples",
+	"internal/bootstrap/packs",
+	"docs",
+}
+
+// nudgeScanExts limits walking to files that ship embedded shell text or
+// teach command syntax to agents and operators.
+var nudgeScanExts = map[string]bool{
+	".toml": true,
+	".md":   true,
+	".sh":   true,
+}
+
+// nudgeAllowlistFiles are repo-relative paths whose `gc nudge <target>`
+// occurrences are intentionally retained as historical or struck-through
+// documentation of the resolution itself.
+var nudgeAllowlistFiles = map[string]bool{
+	"examples/gastown/FUTURE.md": true,
+}
+
+// validNudgeSubcommands are the still-supported `gc nudge` subcommands.
+// `gc nudge drain`, `gc nudge status`, and `gc nudge poll` remain valid;
+// the bare positional form does not.
+var validNudgeSubcommands = map[string]bool{
+	"drain":  true,
+	"status": true,
+	"poll":   true,
+}
+
+func TestGcNudgeFormPositional(t *testing.T) {
+	root := repoRoot()
+	var violations []string
+	for _, dir := range nudgeScanDirs {
+		abs := filepath.Join(root, dir)
+		err := filepath.WalkDir(abs, func(path string, d fs.DirEntry, walkErr error) error {
+			if walkErr != nil {
+				return walkErr
+			}
+			if d.IsDir() {
+				return nil
+			}
+			if !nudgeScanExts[filepath.Ext(path)] {
+				return nil
+			}
+			rel, _ := filepath.Rel(root, path)
+			if nudgeAllowlistFiles[filepath.ToSlash(rel)] {
+				return nil
+			}
+			data, err := os.ReadFile(path)
+			if err != nil {
+				return fmt.Errorf("reading %s: %w", path, err)
+			}
+			for lineNum, line := range strings.Split(string(data), "\n") {
+				if v := violatesNudgeForm(line); v != "" {
+					violations = append(violations,
+						filepath.ToSlash(rel)+":"+strconv.Itoa(lineNum+1)+": "+v)
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatalf("walking %s: %v", dir, err)
+		}
+	}
+	if len(violations) > 0 {
+		t.Errorf("deprecated `gc nudge <target> \"msg\"` (or `{{ cmd }} nudge ...`) form found"+
+			" — silently no-ops because the bare `gc nudge` namespace was reduced to"+
+			" `drain`/`status`/`poll` (issue #1491).\n"+
+			"Fix: replace with `gc session nudge <target> \"msg\"` (or"+
+			" `{{ cmd }} session nudge <target> \"msg\"`).\n\n%s",
+			strings.Join(violations, "\n"))
+	}
+}
+
+func TestViolatesNudgeForm(t *testing.T) {
+	cases := []struct {
+		name      string
+		line      string
+		violation bool
+	}{
+		{name: "deprecated bare positional", line: `gc nudge deacon/ "DOG_DONE: ok"`, violation: true},
+		{name: "deprecated templated cmd", line: `{{ cmd }} nudge <target> "message"`, violation: true},
+		{name: "deprecated templated rig", line: `gc nudge {{ .RigName }}/refinery "msg"`, violation: true},
+		{name: "deprecated indented", line: `    gc nudge dog/ "Compactor needed"`, violation: true},
+		{name: "deprecated quoted positional target", line: `gc nudge "deacon/" "DOG_DONE: ok"`, violation: true},
+		{name: "canonical session form", line: `gc session nudge deacon/ "DOG_DONE: ok"`, violation: false},
+		{name: "canonical templated session form", line: `{{ cmd }} session nudge <target> "message"`, violation: false},
+		{name: "still-valid drain subcommand", line: `gc nudge drain --inject`, violation: false},
+		{name: "still-valid status subcommand", line: `gc nudge status`, violation: false},
+		{name: "still-valid poll subcommand", line: `gc nudge poll --json`, violation: false},
+		{name: "markdown link to status", line: `[gc nudge status](#gc-nudge-status) | Show queued`, violation: false},
+		{name: "instructional backticked bare command", line: "Use `gc nudge` to alert the witness", violation: true},
+		{name: "instructional via backticked bare command", line: "Health check via `gc nudge`", violation: true},
+		{name: "instructional bare command dash", line: "Use `gc nudge` - ephemeral, zero Dolt overhead", violation: true},
+		{name: "backticked status prose", line: "Use `gc nudge status` to inspect queued nudges", violation: false},
+		{name: "backticked valid namespace prose", line: "The `gc nudge` subcommand only exposes deferred-delivery controls (`drain`, `status`, `poll`)", violation: false},
+		{name: "prose mention without invocation", line: "The gc nudge namespace is for drain/status/poll only", violation: false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := violatesNudgeForm(tc.line) != ""
+			if got != tc.violation {
+				t.Errorf("violatesNudgeForm(%q) = %v, want %v", tc.line, got, tc.violation)
+			}
+		})
+	}
+}
+
+// violatesNudgeForm returns the offending substring if the line contains a
+// `gc nudge <token>` or `{{ ... }} nudge <token>` invocation where <token>
+// is a positional target rather than one of the still-valid subcommands.
+// Returns empty when the line is clean.
+//
+// Heuristic for distinguishing real invocations from prose mentions: the
+// command prefix must occur at the start of the trimmed line, possibly
+// after a shell prompt. Mid-line occurrences are treated as prose
+// references (e.g., `Use the gc nudge namespace ...`).
+func violatesNudgeForm(line string) string {
+	if v := violatesBacktickedBareNudge(line); v != "" {
+		return v
+	}
+	for _, prefix := range nudgeCommandPrefixes(line) {
+		before := strings.TrimSpace(line[:prefix.start])
+		switch before {
+		case "", "$", ">", "#":
+		default:
+			continue
+		}
+		rest := strings.TrimLeft(line[prefix.end:], " \t")
+		if rest == "" {
+			continue
+		}
+		if isWordChar(rest[0]) {
+			if validNudgeSubcommands[firstToken(rest)] {
+				continue
+			}
+		}
+		return strings.TrimSpace(line[prefix.start:])
+	}
+	return ""
+}
+
+// violatesBacktickedBareNudge catches instructional prose that names the
+// retired send interface without an explicit target, such as "Use `gc nudge`".
+func violatesBacktickedBareNudge(line string) string {
+	const bare = "`gc nudge`"
+	if !strings.Contains(line, bare) {
+		return ""
+	}
+	lower := strings.ToLower(line)
+	if strings.Contains(lower, "drain") &&
+		strings.Contains(lower, "status") &&
+		strings.Contains(lower, "poll") {
+		return ""
+	}
+	return bare
+}
+
+type nudgePrefix struct {
+	start, end int
+}
+
+// nudgeCommandPrefixes finds every occurrence of `gc nudge ` or
+// `{{ <expr> }} nudge ` on the line and returns the [start,end) byte ranges
+// of each prefix (start at the first letter of the command, end after the
+// trailing space).
+func nudgeCommandPrefixes(line string) []nudgePrefix {
+	var out []nudgePrefix
+	const literal = "gc nudge "
+	for i := 0; i+len(literal) <= len(line); i++ {
+		if line[i:i+len(literal)] != literal {
+			continue
+		}
+		if i > 0 && isWordChar(line[i-1]) {
+			continue
+		}
+		out = append(out, nudgePrefix{start: i, end: i + len(literal)})
+	}
+	const tmplOpen = "{{"
+	const tmplNudge = " nudge "
+	for i := 0; i+len(tmplOpen) <= len(line); i++ {
+		if line[i:i+len(tmplOpen)] != tmplOpen {
+			continue
+		}
+		closeIdx := strings.Index(line[i:], "}}")
+		if closeIdx < 0 {
+			continue
+		}
+		afterClose := i + closeIdx + len("}}")
+		if afterClose+len(tmplNudge) > len(line) {
+			continue
+		}
+		if line[afterClose:afterClose+len(tmplNudge)] != tmplNudge {
+			continue
+		}
+		out = append(out, nudgePrefix{start: i, end: afterClose + len(tmplNudge)})
+	}
+	return out
+}
+
+// firstToken returns the leading run of word characters. Stopping at any
+// non-word byte handles markdown link tails (`status](#...)`), trailing
+// punctuation (`drain.`), and quoted forms uniformly.
+func firstToken(s string) string {
+	for i := 0; i < len(s); i++ {
+		if !isWordChar(s[i]) {
+			return s[:i]
+		}
+	}
+	return s
+}
+
+func isWordChar(c byte) bool {
+	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_'
+}